@auriclabs/jobs-infra 2.0.0 → 2.2.0

package/.turbo/turbo-build.log

@@ -1,5 +1,5 @@
 
-> @auriclabs/jobs-infra@2.0.0 build /home/runner/work/packages/packages/packages/jobs-infra
+> @auriclabs/jobs-infra@2.2.0 build /home/runner/work/packages/packages/packages/jobs-infra
 > tsdown src/index.ts --format cjs,esm --dts --tsconfig tsconfig.build.json --no-hash
 
 [tsdown] Node.js v20.20.2 is deprecated. Support will be removed in the next minor release. Please upgrade to Node.js 22.18.0 or later.
@@ -7,19 +7,25 @@
 ℹ entry: src/index.ts
 ℹ tsconfig: tsconfig.build.json
 ℹ Build start
-ℹ [CJS] dist/index.cjs  1.67 kB │ gzip: 0.76 kB
-ℹ [CJS] 1 files, total: 1.67 kB
-ℹ [CJS] dist/index.d.cts.map  0.55 kB │ gzip: 0.27 kB
-ℹ [CJS] dist/index.d.cts      0.88 kB │ gzip: 0.39 kB
-ℹ [CJS] 2 files, total: 1.43 kB
-[PLUGIN_TIMINGS] Warning: Your build spent significant time in plugin `rolldown-plugin-dts:generate`. See https://rolldown.rs/options/checks#plugintimings for more details.
+ℹ [CJS] dist/index.cjs  5.47 kB │ gzip: 2.23 kB
+ℹ [CJS] 1 files, total: 5.47 kB
+ℹ [CJS] dist/index.d.cts.map  1.35 kB │ gzip: 0.51 kB
+ℹ [CJS] dist/index.d.cts      5.09 kB │ gzip: 1.99 kB
+ℹ [CJS] 2 files, total: 6.43 kB
+[PLUGIN_TIMINGS] Warning: Your build spent significant time in plugins. Here is a breakdown:
+  - rolldown-plugin-dts:generate (69%)
+  - tsdown:deps (30%)
+See https://rolldown.rs/options/checks#plugintimings for more details.
 
-ℹ [ESM] dist/index.mjs        1.58 kB │ gzip: 0.73 kB
-ℹ [ESM] dist/index.mjs.map    3.73 kB │ gzip: 1.35 kB
-ℹ [ESM] dist/index.d.mts.map  0.55 kB │ gzip: 0.27 kB
-ℹ [ESM] dist/index.d.mts      0.88 kB │ gzip: 0.38 kB
-ℹ [ESM] 4 files, total: 6.74 kB
-✔ Build complete in 7174ms
-[PLUGIN_TIMINGS] Warning: Your build spent significant time in plugin `rolldown-plugin-dts:generate`. See https://rolldown.rs/options/checks#plugintimings for more details.
+✔ Build complete in 6061ms
+ℹ [ESM] dist/index.mjs         4.25 kB │ gzip: 1.77 kB
+ℹ [ESM] dist/index.mjs.map    13.35 kB │ gzip: 4.78 kB
+ℹ [ESM] dist/index.d.mts.map   1.35 kB │ gzip: 0.51 kB
+ℹ [ESM] dist/index.d.mts       5.09 kB │ gzip: 1.99 kB
+ℹ [ESM] 4 files, total: 24.03 kB
+[PLUGIN_TIMINGS] Warning: Your build spent significant time in plugins. Here is a breakdown:
+  - rolldown-plugin-dts:generate (84%)
+  - tsdown:deps (16%)
+See https://rolldown.rs/options/checks#plugintimings for more details.
 
-✔ Build complete in 7175ms
+✔ Build complete in 6063ms

package/CHANGELOG.md

@@ -1,5 +1,51 @@
 # @auriclabs/jobs-infra
 
+## 2.2.0
+
+### Minor Changes
+
+- dd6d044: Take the `sst` components namespace as an explicit parameter in `createJobTable` and
+  `createJobsDashboard` instead of referencing the injected `sst` global.
+
+  `@auriclabs/jobs-infra` ships as ESM (`dist/index.mjs`). SST's config evaluator injects the `sst`
+  global into config source through an esbuild `onLoad` plugin whose filter is
+  `\.(js|ts|jsx|tsx)# @auriclabs/jobs-infra, which deliberately skips `.mjs`/`.cjs`. (`$app` / `$jsonStringify`/`$output`arrive via esbuild`Define`/`Inject`, which are extension-agnostic and keep working — only the `sst`namespace and`@pulumi/\*`provider aliases come from the skipped`onLoad`channel.) A bare`sst.aws.Dynamo`reference in the`.mjs`build therefore threw`ReferenceError:
+  sst is not
+  defined`at deploy time. Passing`sst`in as a parameter — as`@auriclabs/migrations`' `createTable(sst)`
+  already does — sidesteps the injection entirely.
+
+  Breaking:
+  - `createJobTable(name)` → `createJobTable(sst, name)`
+  - `createJobsDashboard(options)` now requires `options.sst`
+
+  `registerJobResources` is unchanged: it only uses `$jsonStringify` (an `Inject` global that works
+  in `.mjs`) plus caller-supplied resources.
+
+## 2.1.0
+
+### Minor Changes
+
+- 2f09e53: Add typed job registry (defineJobs), in-process registry executor
+  (createRegistryExecutorHandler), continuation/time-budget helpers (continueJob, createTimeBudget)
+  with per-attempt continuation state, and retryJob (which resumes from the last attempt's
+  continuation state). Fix prepareNextJobAttempt to allow retrying failed jobs and to reject
+  concurrent attempts on running jobs.
+
+  Add a jobs dashboard modeled on the migrations dashboard: a bundled Vite/React UI (ui/), a
+  dashboard API (createJobsDashboardApiHandler — list/summary/detail/retry/cancel; no job creation),
+  list/summary read methods on the job service, and an `auric-jobs-dashboard` local CLI that serves
+  the same UI against a deployed table via SSO.
+
+  jobs-infra: add 'in-process' executor resource variant that subscribes a consumer-provided handler
+  with QUEUE_URL_LIST wired, wire QUEUE_URL_LIST on the lambda executor so scheduledAt re-enqueue
+  works there too, and add createJobsDashboard (ApiGatewayV2 + StaticSite + optional CloudFront
+  basic-auth) for deploying the dashboard.
+
+### Patch Changes
+
+- Updated dependencies [2f09e53]
+  - @auriclabs/jobs@0.3.0
+
 ## 2.0.0
 
 ### Patch Changes

package/README.md

@@ -91,6 +91,16 @@ interface LambdaJobResource {
   fns: FunctionWithName[];  // From @auriclabs/sst-utils
 }
 
+// In-process jobs: SQS → consumer runs registered handlers directly
+interface InProcessJobResource {
+  id: string;
+  executor: 'in-process';
+  queue: sst.aws.Queue;
+  handler: string;          // wraps createRegistryExecutorHandler(...) from @auriclabs/jobs
+  link?: unknown[];         // extra linkables the handlers depend on
+  environment?: Record<string, string>;
+}
+
 // Worker jobs: SQS → custom processing (no executor subscription)
 interface WorkerJobResource {
   id: string;
@@ -98,7 +108,36 @@ interface WorkerJobResource {
   queue: sst.aws.Queue;
 }
 
-type JobResource = LambdaJobResource | WorkerJobResource;
+type JobResource = LambdaJobResource | InProcessJobResource | WorkerJobResource;
+```
+
+Example `'in-process'` executor wiring:
+
+```typescript
+registerJobResources({
+  table,
+  resources: [
+    {
+      id: 'worker',
+      executor: 'in-process',
+      queue: workerJobQueue,
+      handler: 'services/job/handlers/registry-executor.handler',
+      link: [bucket],
+    },
+  ],
+  handlerPaths: { ... },
+});
+```
+
+```typescript
+// services/job/handlers/registry-executor.ts
+import { createRegistryExecutorHandler, initJobs } from '@auriclabs/jobs';
+import { Resource } from 'sst';
+
+initJobs({ tableName: Resource.JobTable.name });
+export const handler = createRegistryExecutorHandler({
+  syncItems: async (payload) => { /* ... */ },
+});
 ```
 
 ### What `registerJobResources` sets up
@@ -114,6 +153,37 @@ type JobResource = LambdaJobResource | WorkerJobResource;
    - Sets `LAMBDA_FUNCTION_LIST` env var (maps function names to ARNs)
    - Batch config: 10 items, 3 second window, partial responses enabled
 
+3. **In-process executor subscriptions** for each `InProcessJobResource` (`executor: 'in-process'`)
+   - Subscribes queue to the consumer-provided handler
+   - Links table, queue, and any extra `link` entries
+   - Sets `QUEUE_URL_LIST` env var (needed for scheduledAt re-enqueue and continuations)
+   - Same batch config as the Lambda executor
+
+### `createJobsDashboard(options)`
+
+Deploys the jobs dashboard that ships inside `@auriclabs/jobs`: an
+`ApiGatewayV2` routing `$default` to your dashboard API handler, and a
+`StaticSite` serving the package's `ui/` bundle with the API URL injected
+at deploy time. Optional CloudFront basic-auth gates the static site
+(discovery prevention only — the API itself is unauthenticated, so deploy
+on dev/demo stages only).
+
+```typescript
+import { createJobsDashboard } from '@auriclabs/jobs-infra';
+
+if (['dev', 'demo'].includes($app.stage)) {
+  createJobsDashboard({
+    apiHandler: 'services/job/dashboard.handler', // wraps createJobsDashboardApiHandler
+    table,
+    basicAuth: { username: 'ops', password: secret.value },
+  });
+}
+```
+
+Options: `apiHandler`, `table`, `link?` (extra linkables for the API fn),
+`domain?`, `uiPath?` (override the resolved @auriclabs/jobs ui dir),
+`basicAuth?` (`{ username, password, realm? }`). Returns `{ api, site }`.
+
 ## Full Example
 
 ```typescript

package/dist/index.cjs

@@ -1,6 +1,31 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+//#endregion
+let node_module = require("node:module");
+let node_path = require("node:path");
+node_path = __toESM(node_path);
 //#region src/job-table.ts
-function createJobTable(name) {
+function createJobTable(sst, name) {
 	return new sst.aws.Dynamo(name, {
 		fields: {
 			pk: "string",
@@ -46,7 +71,26 @@ function registerJobResources(config) {
 				resource.queue,
 				...resource.fns
 			],
-			environment: { LAMBDA_FUNCTION_LIST: $jsonStringify(resource.fns.map((f) => [f.name, f.arn])) }
+			environment: {
+				LAMBDA_FUNCTION_LIST: $jsonStringify(resource.fns.map((f) => [f.name, f.arn])),
+				QUEUE_URL_LIST
+			}
+		}, { batch: {
+			size: 10,
+			window: "3 seconds",
+			partialResponses: true
+		} });
+		if (resource.executor === "in-process") resource.queue.subscribe({
+			handler: resource.handler,
+			link: [
+				table,
+				resource.queue,
+				...resource.link ?? []
+			],
+			environment: {
+				...resource.environment,
+				QUEUE_URL_LIST
+			}
 		}, { batch: {
 			size: 10,
 			window: "3 seconds",
@@ -55,5 +99,69 @@ function registerJobResources(config) {
 	});
 }
 //#endregion
+//#region src/dashboard.ts
+function createJobsDashboard(options) {
+	const { sst } = options;
+	const api = new sst.aws.ApiGatewayV2("JobsDashboardApi", { cors: true });
+	const link = [options.table, ...options.link ?? []];
+	api.route("$default", {
+		handler: options.apiHandler,
+		link
+	});
+	const uiPath = options.uiPath ?? resolveJobsUiPath();
+	const uiRelative = node_path.default.relative(process.cwd(), uiPath);
+	const basicAuthInjection = options.basicAuth ? buildBasicAuthInjection(options.basicAuth) : void 0;
+	return {
+		api,
+		site: new sst.aws.StaticSite("JobsDashboard", {
+			path: uiRelative,
+			build: {
+				command: [
+					"rm -rf _deploy",
+					"cp -r dist _deploy",
+					`sed -i.bak 's|<head>|<head><script>globalThis.__JOBS_API_URL__="'$VITE_API_URL'"<\/script>|' _deploy/index.html`,
+					"rm -f _deploy/index.html.bak"
+				].join(" && "),
+				output: "_deploy"
+			},
+			dev: {
+				command: "npx vite dev",
+				url: "http://localhost:3101"
+			},
+			environment: { VITE_API_URL: api.url },
+			domain: options.domain,
+			...basicAuthInjection && { edge: { viewerRequest: { injection: basicAuthInjection } } }
+		})
+	};
+}
+/**
+* Resolve the `@auriclabs/jobs` package's `ui/` directory. jobs-infra is a
+* separate package, so the UI ships with `@auriclabs/jobs` — resolve it
+* through the consumer's node_modules (the workspace link covers local dev).
+*/
+function resolveJobsUiPath() {
+	const pkgJsonPath = (0, node_module.createRequire)(require("url").pathToFileURL(__filename).href).resolve("@auriclabs/jobs/package.json");
+	const pkgRoot = node_path.default.dirname(pkgJsonPath);
+	return node_path.default.join(pkgRoot, "ui");
+}
+function buildBasicAuthInjection(auth) {
+	const realm = (auth.realm ?? "Jobs Dashboard").replace(/"/g, "\\\"");
+	return $output([auth.username, auth.password]).apply(([username, password]) => {
+		return [
+			"var __auth = event.request.headers.authorization && event.request.headers.authorization.value;",
+			`if (__auth !== "Basic ${Buffer.from(`${username}:${password}`).toString("base64")}") {`,
+			"  return {",
+			"    statusCode: 401,",
+			"    statusDescription: \"Unauthorized\",",
+			"    headers: {",
+			`      "www-authenticate": { value: 'Basic realm="${realm}"' }`,
+			"    }",
+			"  };",
+			"}"
+		].join("\n");
+	});
+}
+//#endregion
 exports.createJobTable = createJobTable;
+exports.createJobsDashboard = createJobsDashboard;
 exports.registerJobResources = registerJobResources;

package/dist/index.d.cts

@@ -1,7 +1,27 @@
 import { FunctionWithName } from "@auriclabs/sst-utils";
 
 //#region src/job-table.d.ts
-declare function createJobTable(name: string): sst.aws.Dynamo;
+/**
+ * The subset of the SST components namespace that {@link createJobTable} needs
+ * at runtime.
+ *
+ * `@auriclabs/jobs-infra` ships as ESM (`dist/index.mjs`). SST's config
+ * evaluator injects the `sst` global into config source via an esbuild
+ * `onLoad` plugin whose filter is `\.(js|ts|jsx|tsx)$` — it deliberately skips
+ * `.mjs`/`.cjs`. (The `$app` / `$jsonStringify` / `$output` globals arrive via
+ * esbuild `Define`/`Inject`, which are extension-agnostic, so those keep
+ * working; only the `sst` namespace and the `@pulumi/*` provider aliases come
+ * from the skipped `onLoad` channel.) A bare `sst.aws.Dynamo` reference in this
+ * `.mjs` file therefore throws `ReferenceError: sst is not defined` at deploy
+ * time. Taking `sst` as a parameter — exactly as `@auriclabs/migrations`'
+ * `createTable(sst)` does — sidesteps the injection entirely.
+ */
+interface JobTableSstProvider {
+  aws: {
+    Dynamo: typeof sst.aws.Dynamo;
+  };
+}
+declare function createJobTable(sst: JobTableSstProvider, name: string): sst.aws.Dynamo;
 //#endregion
 //#region src/job-resources.d.ts
 interface LambdaJobResource {
@@ -10,12 +30,22 @@ interface LambdaJobResource {
   queue: sst.aws.Queue;
   fns: FunctionWithName[];
 }
+interface InProcessJobResource {
+  id: string;
+  executor: 'in-process';
+  queue: sst.aws.Queue;
+  /** Path to a handler that wraps createRegistryExecutorHandler(...) from @auriclabs/jobs. */
+  handler: string;
+  /** Extra linkables the in-process handlers depend on. */
+  link?: unknown[];
+  environment?: Record<string, string>;
+}
 interface WorkerJobResource {
   id: string;
   executor?: never;
   queue: sst.aws.Queue;
 }
-type JobResource = LambdaJobResource | WorkerJobResource;
+type JobResource = LambdaJobResource | InProcessJobResource | WorkerJobResource;
 interface RegisterJobResourcesConfig {
   table: sst.aws.Dynamo;
   resources: JobResource[];
@@ -26,5 +56,72 @@ interface RegisterJobResourcesConfig {
 }
 declare function registerJobResources(config: RegisterJobResourcesConfig): void;
 //#endregion
-export { JobResource, LambdaJobResource, RegisterJobResourcesConfig, WorkerJobResource, createJobTable, registerJobResources };
+//#region src/dashboard.d.ts
+interface JobsDashboardBasicAuthConfig {
+  /** Plaintext username — typically wired from an SST secret. */
+  username: $util.Input<string>;
+  /** Plaintext password — typically wired from an SST secret. */
+  password: $util.Input<string>;
+  /** Realm shown in browser auth dialog. Defaults to "Jobs Dashboard". */
+  realm?: string;
+}
+/**
+ * The subset of the SST components namespace that {@link createJobsDashboard}
+ * needs at runtime.
+ *
+ * Passed in rather than referenced as the `sst` global for the same reason as
+ * {@link JobTableSstProvider}: this package ships as `.mjs`, and SST's config
+ * evaluator skips `.mjs`/`.cjs` when injecting the `sst` global (its esbuild
+ * `onLoad` plugin filters on `\.(js|ts|jsx|tsx)$`). See the note on
+ * {@link JobTableSstProvider} for the full mechanism.
+ */
+interface JobsDashboardSstProvider {
+  aws: {
+    ApiGatewayV2: typeof sst.aws.ApiGatewayV2;
+    StaticSite: typeof sst.aws.StaticSite;
+  };
+}
+interface JobsDashboardOptions {
+  /**
+   * SST components namespace — pass the injected `sst` global from your
+   * `sst.config.ts` (a `.ts` file, which SST *does* inject `sst` into).
+   * See {@link JobsDashboardSstProvider}.
+   */
+  sst: JobsDashboardSstProvider;
+  /**
+   * Handler path for the dashboard API Lambda. The handler should call
+   * `initJobs({ tableName: Resource.<JobTable>.name })` and export
+   * `createJobsDashboardApiHandler()` from `@auriclabs/jobs`.
+   */
+  apiHandler: string;
+  /** Job table — linked into the API function. */
+  table: sst.aws.Dynamo;
+  /** Extra linkables for the API function (beyond the table). */
+  link?: unknown[];
+  domain?: sst.aws.StaticSiteArgs['domain'];
+  /**
+   * Override the path to the `@auriclabs/jobs` package's `ui/` directory.
+   * Defaults to resolving the installed package via `require.resolve`.
+   */
+  uiPath?: string;
+  /**
+   * Optional HTTP basic auth gate on the static site. When set, injects a
+   * basic-auth check into the StaticSite's CloudFront viewer-request
+   * function — requests without the matching `Authorization: Basic <base64>`
+   * header get a 401 before any routing logic runs. Credentials are inlined
+   * into the function source at deploy time via Pulumi apply.
+   *
+   * Note: this only gates the static UI. The API gateway URL remains
+   * directly callable — browsers don't auto-send basic auth credentials
+   * cross-origin, so the dashboard's fetch() can't carry them. Treat this
+   * as discovery-prevention for the dashboard, not API protection.
+   */
+  basicAuth?: JobsDashboardBasicAuthConfig;
+}
+declare function createJobsDashboard(options: JobsDashboardOptions): {
+  api: sst.aws.ApiGatewayV2;
+  site: sst.aws.StaticSite;
+};
+//#endregion
+export { InProcessJobResource, JobResource, JobTableSstProvider, JobsDashboardBasicAuthConfig, JobsDashboardOptions, JobsDashboardSstProvider, LambdaJobResource, RegisterJobResourcesConfig, WorkerJobResource, createJobTable, createJobsDashboard, registerJobResources };
 //# sourceMappingURL=index.d.cts.map

package/dist/index.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.cts","names":[],"sources":["../src/job-table.ts","../src/job-resources.ts"],"mappings":";;;iBAAgB,cAAA,CAAe,IAAA,WAAY,GAAA,CAAA,GAAA,CAAA,MAAA;;;UCE1B,iBAAA;EACf,EAAA;EACA,QAAA;EACA,KAAA,EAAO,GAAA,CAAI,GAAA,CAAI,KAAA;EACf,GAAA,EAAK,gBAAA;AAAA;AAAA,UAGU,iBAAA;EACf,EAAA;EACA,QAAA;EACA,KAAA,EAAO,GAAA,CAAI,GAAA,CAAI,KAAA;AAAA;AAAA,KAGL,WAAA,GAAc,iBAAA,GAAoB,iBAAA;AAAA,UAE7B,0BAAA;EACf,KAAA,EAAO,GAAA,CAAI,GAAA,CAAI,MAAA;EACf,SAAA,EAAW,WAAA;EACX,YAAA;IACE,MAAA;IACA,QAAA;EAAA;AAAA;AAAA,iBAIY,oBAAA,CAAqB,MAAA,EAAQ,0BAAA"}
+{"version":3,"file":"index.d.cts","names":[],"sources":["../src/job-table.ts","../src/job-resources.ts","../src/dashboard.ts"],"mappings":";;;;;;AAeA;;;;;;;;;;;AAMA;UANiB,mBAAA;EACf,GAAA;IACE,MAAA,SAAe,GAAA,CAAI,GAAA,CAAI,MAAA;EAAA;AAAA;AAAA,iBAIX,cAAA,CAAe,GAAA,EAAK,mBAAA,EAAqB,IAAA,WAAY,GAAA,CAAA,GAAA,CAAA,MAAA;;;UCnBpD,iBAAA;EACf,EAAA;EACA,QAAA;EACA,KAAA,EAAO,GAAA,CAAI,GAAA,CAAI,KAAA;EACf,GAAA,EAAK,gBAAA;AAAA;AAAA,UAGU,oBAAA;EACf,EAAA;EACA,QAAA;EACA,KAAA,EAAO,GAAA,CAAI,GAAA,CAAI,KAAA;EDKU;ECHzB,OAAA;EDG+B;ECD/B,IAAA;EACA,WAAA,GAAc,MAAA;AAAA;AAAA,UAGC,iBAAA;EACf,EAAA;EACA,QAAA;EACA,KAAA,EAAO,GAAA,CAAI,GAAA,CAAI,KAAA;AAAA;AAAA,KAGL,WAAA,GAAc,iBAAA,GAAoB,oBAAA,GAAuB,iBAAA;AAAA,UAEpD,0BAAA;EACf,KAAA,EAAO,GAAA,CAAI,GAAA,CAAI,MAAA;EACf,SAAA,EAAW,WAAA;EACX,YAAA;IACE,MAAA;IACA,QAAA;EAAA;AAAA;AAAA,iBAIY,oBAAA,CAAqB,MAAA,EAAQ,0BAAA;;;UClC5B,4BAAA;;EAEf,QAAA,EAAU,KAAA,CAAM,KAAA;EFUD;EERf,QAAA,EAAU,KAAA,CAAM,KAAA;;EAEhB,KAAA;AAAA;;;;;;;AFYF;;;;UECiB,wBAAA;EACf,GAAA;IACE,YAAA,SAAqB,GAAA,CAAI,GAAA,CAAI,YAAA;IAC7B,UAAA,SAAmB,GAAA,CAAI,GAAA,CAAI,UAAA;EAAA;AAAA;AAAA,UAId,oBAAA;EFRoD;;;;ACnBrE;ECiCE,GAAA,EAAK,wBAAA;;;;;;EAML,UAAA;EDpCW;ECsCX,KAAA,EAAO,GAAA,CAAI,GAAA,CAAI,MAAA;EDrCf;ECuCA,IAAA;EACA,MAAA,GAAS,GAAA,CAAI,GAAA,CAAI,cAAA;EDxCI;AAGvB;;;EC0CE,MAAA;EDzCA;;;;;;;;;;;;ECsDA,SAAA,GAAY,4BAAA;AAAA;AAAA,iBAGE,mBAAA,CAAoB,OAAA,EAAS,oBAAA"}

package/dist/index.d.mts

@@ -1,7 +1,27 @@
 import { FunctionWithName } from "@auriclabs/sst-utils";
 
 //#region src/job-table.d.ts
-declare function createJobTable(name: string): sst.aws.Dynamo;
+/**
+ * The subset of the SST components namespace that {@link createJobTable} needs
+ * at runtime.
+ *
+ * `@auriclabs/jobs-infra` ships as ESM (`dist/index.mjs`). SST's config
+ * evaluator injects the `sst` global into config source via an esbuild
+ * `onLoad` plugin whose filter is `\.(js|ts|jsx|tsx)$` — it deliberately skips
+ * `.mjs`/`.cjs`. (The `$app` / `$jsonStringify` / `$output` globals arrive via
+ * esbuild `Define`/`Inject`, which are extension-agnostic, so those keep
+ * working; only the `sst` namespace and the `@pulumi/*` provider aliases come
+ * from the skipped `onLoad` channel.) A bare `sst.aws.Dynamo` reference in this
+ * `.mjs` file therefore throws `ReferenceError: sst is not defined` at deploy
+ * time. Taking `sst` as a parameter — exactly as `@auriclabs/migrations`'
+ * `createTable(sst)` does — sidesteps the injection entirely.
+ */
+interface JobTableSstProvider {
+  aws: {
+    Dynamo: typeof sst.aws.Dynamo;
+  };
+}
+declare function createJobTable(sst: JobTableSstProvider, name: string): sst.aws.Dynamo;
 //#endregion
 //#region src/job-resources.d.ts
 interface LambdaJobResource {
@@ -10,12 +30,22 @@ interface LambdaJobResource {
   queue: sst.aws.Queue;
   fns: FunctionWithName[];
 }
+interface InProcessJobResource {
+  id: string;
+  executor: 'in-process';
+  queue: sst.aws.Queue;
+  /** Path to a handler that wraps createRegistryExecutorHandler(...) from @auriclabs/jobs. */
+  handler: string;
+  /** Extra linkables the in-process handlers depend on. */
+  link?: unknown[];
+  environment?: Record<string, string>;
+}
 interface WorkerJobResource {
   id: string;
   executor?: never;
   queue: sst.aws.Queue;
 }
-type JobResource = LambdaJobResource | WorkerJobResource;
+type JobResource = LambdaJobResource | InProcessJobResource | WorkerJobResource;
 interface RegisterJobResourcesConfig {
   table: sst.aws.Dynamo;
   resources: JobResource[];
@@ -26,5 +56,72 @@ interface RegisterJobResourcesConfig {
 }
 declare function registerJobResources(config: RegisterJobResourcesConfig): void;
 //#endregion
-export { JobResource, LambdaJobResource, RegisterJobResourcesConfig, WorkerJobResource, createJobTable, registerJobResources };
+//#region src/dashboard.d.ts
+interface JobsDashboardBasicAuthConfig {
+  /** Plaintext username — typically wired from an SST secret. */
+  username: $util.Input<string>;
+  /** Plaintext password — typically wired from an SST secret. */
+  password: $util.Input<string>;
+  /** Realm shown in browser auth dialog. Defaults to "Jobs Dashboard". */
+  realm?: string;
+}
+/**
+ * The subset of the SST components namespace that {@link createJobsDashboard}
+ * needs at runtime.
+ *
+ * Passed in rather than referenced as the `sst` global for the same reason as
+ * {@link JobTableSstProvider}: this package ships as `.mjs`, and SST's config
+ * evaluator skips `.mjs`/`.cjs` when injecting the `sst` global (its esbuild
+ * `onLoad` plugin filters on `\.(js|ts|jsx|tsx)$`). See the note on
+ * {@link JobTableSstProvider} for the full mechanism.
+ */
+interface JobsDashboardSstProvider {
+  aws: {
+    ApiGatewayV2: typeof sst.aws.ApiGatewayV2;
+    StaticSite: typeof sst.aws.StaticSite;
+  };
+}
+interface JobsDashboardOptions {
+  /**
+   * SST components namespace — pass the injected `sst` global from your
+   * `sst.config.ts` (a `.ts` file, which SST *does* inject `sst` into).
+   * See {@link JobsDashboardSstProvider}.
+   */
+  sst: JobsDashboardSstProvider;
+  /**
+   * Handler path for the dashboard API Lambda. The handler should call
+   * `initJobs({ tableName: Resource.<JobTable>.name })` and export
+   * `createJobsDashboardApiHandler()` from `@auriclabs/jobs`.
+   */
+  apiHandler: string;
+  /** Job table — linked into the API function. */
+  table: sst.aws.Dynamo;
+  /** Extra linkables for the API function (beyond the table). */
+  link?: unknown[];
+  domain?: sst.aws.StaticSiteArgs['domain'];
+  /**
+   * Override the path to the `@auriclabs/jobs` package's `ui/` directory.
+   * Defaults to resolving the installed package via `require.resolve`.
+   */
+  uiPath?: string;
+  /**
+   * Optional HTTP basic auth gate on the static site. When set, injects a
+   * basic-auth check into the StaticSite's CloudFront viewer-request
+   * function — requests without the matching `Authorization: Basic <base64>`
+   * header get a 401 before any routing logic runs. Credentials are inlined
+   * into the function source at deploy time via Pulumi apply.
+   *
+   * Note: this only gates the static UI. The API gateway URL remains
+   * directly callable — browsers don't auto-send basic auth credentials
+   * cross-origin, so the dashboard's fetch() can't carry them. Treat this
+   * as discovery-prevention for the dashboard, not API protection.
+   */
+  basicAuth?: JobsDashboardBasicAuthConfig;
+}
+declare function createJobsDashboard(options: JobsDashboardOptions): {
+  api: sst.aws.ApiGatewayV2;
+  site: sst.aws.StaticSite;
+};
+//#endregion
+export { InProcessJobResource, JobResource, JobTableSstProvider, JobsDashboardBasicAuthConfig, JobsDashboardOptions, JobsDashboardSstProvider, LambdaJobResource, RegisterJobResourcesConfig, WorkerJobResource, createJobTable, createJobsDashboard, registerJobResources };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/job-table.ts","../src/job-resources.ts"],"mappings":";;;iBAAgB,cAAA,CAAe,IAAA,WAAY,GAAA,CAAA,GAAA,CAAA,MAAA;;;UCE1B,iBAAA;EACf,EAAA;EACA,QAAA;EACA,KAAA,EAAO,GAAA,CAAI,GAAA,CAAI,KAAA;EACf,GAAA,EAAK,gBAAA;AAAA;AAAA,UAGU,iBAAA;EACf,EAAA;EACA,QAAA;EACA,KAAA,EAAO,GAAA,CAAI,GAAA,CAAI,KAAA;AAAA;AAAA,KAGL,WAAA,GAAc,iBAAA,GAAoB,iBAAA;AAAA,UAE7B,0BAAA;EACf,KAAA,EAAO,GAAA,CAAI,GAAA,CAAI,MAAA;EACf,SAAA,EAAW,WAAA;EACX,YAAA;IACE,MAAA;IACA,QAAA;EAAA;AAAA;AAAA,iBAIY,oBAAA,CAAqB,MAAA,EAAQ,0BAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/job-table.ts","../src/job-resources.ts","../src/dashboard.ts"],"mappings":";;;;;;AAeA;;;;;;;;;;;AAMA;UANiB,mBAAA;EACf,GAAA;IACE,MAAA,SAAe,GAAA,CAAI,GAAA,CAAI,MAAA;EAAA;AAAA;AAAA,iBAIX,cAAA,CAAe,GAAA,EAAK,mBAAA,EAAqB,IAAA,WAAY,GAAA,CAAA,GAAA,CAAA,MAAA;;;UCnBpD,iBAAA;EACf,EAAA;EACA,QAAA;EACA,KAAA,EAAO,GAAA,CAAI,GAAA,CAAI,KAAA;EACf,GAAA,EAAK,gBAAA;AAAA;AAAA,UAGU,oBAAA;EACf,EAAA;EACA,QAAA;EACA,KAAA,EAAO,GAAA,CAAI,GAAA,CAAI,KAAA;EDKU;ECHzB,OAAA;EDG+B;ECD/B,IAAA;EACA,WAAA,GAAc,MAAA;AAAA;AAAA,UAGC,iBAAA;EACf,EAAA;EACA,QAAA;EACA,KAAA,EAAO,GAAA,CAAI,GAAA,CAAI,KAAA;AAAA;AAAA,KAGL,WAAA,GAAc,iBAAA,GAAoB,oBAAA,GAAuB,iBAAA;AAAA,UAEpD,0BAAA;EACf,KAAA,EAAO,GAAA,CAAI,GAAA,CAAI,MAAA;EACf,SAAA,EAAW,WAAA;EACX,YAAA;IACE,MAAA;IACA,QAAA;EAAA;AAAA;AAAA,iBAIY,oBAAA,CAAqB,MAAA,EAAQ,0BAAA;;;UClC5B,4BAAA;;EAEf,QAAA,EAAU,KAAA,CAAM,KAAA;EFUD;EERf,QAAA,EAAU,KAAA,CAAM,KAAA;;EAEhB,KAAA;AAAA;;;;;;;AFYF;;;;UECiB,wBAAA;EACf,GAAA;IACE,YAAA,SAAqB,GAAA,CAAI,GAAA,CAAI,YAAA;IAC7B,UAAA,SAAmB,GAAA,CAAI,GAAA,CAAI,UAAA;EAAA;AAAA;AAAA,UAId,oBAAA;EFRoD;;;;ACnBrE;ECiCE,GAAA,EAAK,wBAAA;;;;;;EAML,UAAA;EDpCW;ECsCX,KAAA,EAAO,GAAA,CAAI,GAAA,CAAI,MAAA;EDrCf;ECuCA,IAAA;EACA,MAAA,GAAS,GAAA,CAAI,GAAA,CAAI,cAAA;EDxCI;AAGvB;;;EC0CE,MAAA;EDzCA;;;;;;;;;;;;ECsDA,SAAA,GAAY,4BAAA;AAAA;AAAA,iBAGE,mBAAA,CAAoB,OAAA,EAAS,oBAAA"}

package/dist/index.mjs

@@ -1,5 +1,7 @@
+import { createRequire } from "node:module";
+import path from "node:path";
 //#region src/job-table.ts
-function createJobTable(name) {
+function createJobTable(sst, name) {
 	return new sst.aws.Dynamo(name, {
 		fields: {
 			pk: "string",
@@ -45,15 +47,97 @@ function registerJobResources(config) {
 				resource.queue,
 				...resource.fns
 			],
-			environment: { LAMBDA_FUNCTION_LIST: $jsonStringify(resource.fns.map((f) => [f.name, f.arn])) }
+			environment: {
+				LAMBDA_FUNCTION_LIST: $jsonStringify(resource.fns.map((f) => [f.name, f.arn])),
+				QUEUE_URL_LIST
+			}
 		}, { batch: {
 			size: 10,
 			window: "3 seconds",
 			partialResponses: true
 		} });
+		if (resource.executor === "in-process") resource.queue.subscribe({
+			handler: resource.handler,
+			link: [
+				table,
+				resource.queue,
+				...resource.link ?? []
+			],
+			environment: {
+				...resource.environment,
+				QUEUE_URL_LIST
+			}
+		}, { batch: {
+			size: 10,
+			window: "3 seconds",
+			partialResponses: true
+		} });
+	});
+}
+//#endregion
+//#region src/dashboard.ts
+function createJobsDashboard(options) {
+	const { sst } = options;
+	const api = new sst.aws.ApiGatewayV2("JobsDashboardApi", { cors: true });
+	const link = [options.table, ...options.link ?? []];
+	api.route("$default", {
+		handler: options.apiHandler,
+		link
+	});
+	const uiPath = options.uiPath ?? resolveJobsUiPath();
+	const uiRelative = path.relative(process.cwd(), uiPath);
+	const basicAuthInjection = options.basicAuth ? buildBasicAuthInjection(options.basicAuth) : void 0;
+	return {
+		api,
+		site: new sst.aws.StaticSite("JobsDashboard", {
+			path: uiRelative,
+			build: {
+				command: [
+					"rm -rf _deploy",
+					"cp -r dist _deploy",
+					`sed -i.bak 's|<head>|<head><script>globalThis.__JOBS_API_URL__="'$VITE_API_URL'"<\/script>|' _deploy/index.html`,
+					"rm -f _deploy/index.html.bak"
+				].join(" && "),
+				output: "_deploy"
+			},
+			dev: {
+				command: "npx vite dev",
+				url: "http://localhost:3101"
+			},
+			environment: { VITE_API_URL: api.url },
+			domain: options.domain,
+			...basicAuthInjection && { edge: { viewerRequest: { injection: basicAuthInjection } } }
+		})
+	};
+}
+/**
+* Resolve the `@auriclabs/jobs` package's `ui/` directory. jobs-infra is a
+* separate package, so the UI ships with `@auriclabs/jobs` — resolve it
+* through the consumer's node_modules (the workspace link covers local dev).
+*/
+function resolveJobsUiPath() {
+	const pkgJsonPath = createRequire(import.meta.url).resolve("@auriclabs/jobs/package.json");
+	const pkgRoot = path.dirname(pkgJsonPath);
+	return path.join(pkgRoot, "ui");
+}
+function buildBasicAuthInjection(auth) {
+	const realm = (auth.realm ?? "Jobs Dashboard").replace(/"/g, "\\\"");
+	return $output([auth.username, auth.password]).apply(([username, password]) => {
+		return [
+			"var __auth = event.request.headers.authorization && event.request.headers.authorization.value;",
+			`if (__auth !== "Basic ${Buffer.from(`${username}:${password}`).toString("base64")}") {`,
+			"  return {",
+			"    statusCode: 401,",
+			"    statusDescription: \"Unauthorized\",",
+			"    headers: {",
+			`      "www-authenticate": { value: 'Basic realm="${realm}"' }`,
+			"    }",
+			"  };",
+			"}"
+		].join("\n");
 	});
 }
 //#endregion
-export { createJobTable, registerJobResources };
+export { createJobTable, createJobsDashboard, registerJobResources };
 
 //# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../src/job-table.ts","../src/job-resources.ts"],"sourcesContent":["export function createJobTable(name: string) {\n  return new sst.aws.Dynamo(name, {\n    fields: {\n      pk: 'string',\n      sk: 'string',\n      numberIndexPk: 'string',\n      numberIndexSk: 'number',\n      gsi1pk: 'string',\n      gsi1sk: 'string',\n    },\n    primaryIndex: {\n      hashKey: 'pk',\n      rangeKey: 'sk',\n    },\n    globalIndexes: {\n      numberIndex: { hashKey: 'numberIndexPk', rangeKey: 'numberIndexSk' },\n      gsi1: { hashKey: 'gsi1pk', rangeKey: 'gsi1sk' },\n    },\n    stream: 'new-and-old-images',\n  });\n}\n","import { FunctionWithName } from '@auriclabs/sst-utils';\n\nexport interface LambdaJobResource {\n  id: string;\n  executor: 'lambda';\n  queue: sst.aws.Queue;\n  fns: FunctionWithName[];\n}\n\nexport interface WorkerJobResource {\n  id: string;\n  executor?: never;\n  queue: sst.aws.Queue;\n}\n\nexport type JobResource = LambdaJobResource | WorkerJobResource;\n\nexport interface RegisterJobResourcesConfig {\n  table: sst.aws.Dynamo;\n  resources: JobResource[];\n  handlerPaths: {\n    stream: string;\n    executor: string;\n  };\n}\n\nexport function registerJobResources(config: RegisterJobResourcesConfig) {\n  const { table, resources, handlerPaths } = config;\n  const QUEUE_URL_LIST = $jsonStringify(resources.map(({ id, queue }) => [id, queue.url]));\n\n  table.subscribe(\n    'JobTableStream',\n    {\n      handler: handlerPaths.stream,\n      link: [table, ...resources.map(({ queue }) => queue)],\n      environment: {\n        QUEUE_URL_LIST,\n      },\n    },\n    {\n      filters: [\n        {\n          dynamodb: {\n            NewImage: {\n              __edb_e__: {\n                S: ['job-attempt'],\n              },\n            },\n          },\n        },\n        {\n          dynamodb: {\n            OldImage: {\n              __edb_e__: {\n                S: ['job-attempt'],\n              },\n            },\n          },\n        },\n      ],\n    },\n  );\n\n  resources.forEach((resource) => {\n    if (!('executor' in resource)) {\n      return;\n    }\n\n    if (resource.executor === 'lambda') {\n      resource.queue.subscribe(\n        {\n          handler: handlerPaths.executor,\n          link: [table, resource.queue, ...resource.fns],\n          environment: {\n            LAMBDA_FUNCTION_LIST: $jsonStringify(resource.fns.map((f) => [f.name, f.arn])),\n          },\n        },\n        {\n          batch: {\n            size: 10,\n            window: '3 seconds',\n            partialResponses: true,\n          },\n        },\n      );\n    }\n  });\n}\n"],"mappings":";AAAA,SAAgB,eAAe,MAAc;AAC3C,QAAO,IAAI,IAAI,IAAI,OAAO,MAAM;EAC9B,QAAQ;GACN,IAAI;GACJ,IAAI;GACJ,eAAe;GACf,eAAe;GACf,QAAQ;GACR,QAAQ;GACT;EACD,cAAc;GACZ,SAAS;GACT,UAAU;GACX;EACD,eAAe;GACb,aAAa;IAAE,SAAS;IAAiB,UAAU;IAAiB;GACpE,MAAM;IAAE,SAAS;IAAU,UAAU;IAAU;GAChD;EACD,QAAQ;EACT,CAAC;;;;ACOJ,SAAgB,qBAAqB,QAAoC;CACvE,MAAM,EAAE,OAAO,WAAW,iBAAiB;CAC3C,MAAM,iBAAiB,eAAe,UAAU,KAAK,EAAE,IAAI,YAAY,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC;AAExF,OAAM,UACJ,kBACA;EACE,SAAS,aAAa;EACtB,MAAM,CAAC,OAAO,GAAG,UAAU,KAAK,EAAE,YAAY,MAAM,CAAC;EACrD,aAAa,EACX,gBACD;EACF,EACD,EACE,SAAS,CACP,EACE,UAAU,EACR,UAAU,EACR,WAAW,EACT,GAAG,CAAC,cAAc,EACnB,EACF,EACF,EACF,EACD,EACE,UAAU,EACR,UAAU,EACR,WAAW,EACT,GAAG,CAAC,cAAc,EACnB,EACF,EACF,EACF,CACF,EACF,CACF;AAED,WAAU,SAAS,aAAa;AAC9B,MAAI,EAAE,cAAc,UAClB;AAGF,MAAI,SAAS,aAAa,SACxB,UAAS,MAAM,UACb;GACE,SAAS,aAAa;GACtB,MAAM;IAAC;IAAO,SAAS;IAAO,GAAG,SAAS;IAAI;GAC9C,aAAa,EACX,sBAAsB,eAAe,SAAS,IAAI,KAAK,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,EAC/E;GACF,EACD,EACE,OAAO;GACL,MAAM;GACN,QAAQ;GACR,kBAAkB;GACnB,EACF,CACF;GAEH"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/job-table.ts","../src/job-resources.ts","../src/dashboard.ts"],"sourcesContent":["/**\n * The subset of the SST components namespace that {@link createJobTable} needs\n * at runtime.\n *\n * `@auriclabs/jobs-infra` ships as ESM (`dist/index.mjs`). SST's config\n * evaluator injects the `sst` global into config source via an esbuild\n * `onLoad` plugin whose filter is `\\.(js|ts|jsx|tsx)$` — it deliberately skips\n * `.mjs`/`.cjs`. (The `$app` / `$jsonStringify` / `$output` globals arrive via\n * esbuild `Define`/`Inject`, which are extension-agnostic, so those keep\n * working; only the `sst` namespace and the `@pulumi/*` provider aliases come\n * from the skipped `onLoad` channel.) A bare `sst.aws.Dynamo` reference in this\n * `.mjs` file therefore throws `ReferenceError: sst is not defined` at deploy\n * time. Taking `sst` as a parameter — exactly as `@auriclabs/migrations`'\n * `createTable(sst)` does — sidesteps the injection entirely.\n */\nexport interface JobTableSstProvider {\n  aws: {\n    Dynamo: typeof sst.aws.Dynamo;\n  };\n}\n\nexport function createJobTable(sst: JobTableSstProvider, name: string) {\n  return new sst.aws.Dynamo(name, {\n    fields: {\n      pk: 'string',\n      sk: 'string',\n      numberIndexPk: 'string',\n      numberIndexSk: 'number',\n      gsi1pk: 'string',\n      gsi1sk: 'string',\n    },\n    primaryIndex: {\n      hashKey: 'pk',\n      rangeKey: 'sk',\n    },\n    globalIndexes: {\n      numberIndex: { hashKey: 'numberIndexPk', rangeKey: 'numberIndexSk' },\n      gsi1: { hashKey: 'gsi1pk', rangeKey: 'gsi1sk' },\n    },\n    stream: 'new-and-old-images',\n  });\n}\n","import { FunctionWithName } from '@auriclabs/sst-utils';\n\nexport interface LambdaJobResource {\n  id: string;\n  executor: 'lambda';\n  queue: sst.aws.Queue;\n  fns: FunctionWithName[];\n}\n\nexport interface InProcessJobResource {\n  id: string;\n  executor: 'in-process';\n  queue: sst.aws.Queue;\n  /** Path to a handler that wraps createRegistryExecutorHandler(...) from @auriclabs/jobs. */\n  handler: string;\n  /** Extra linkables the in-process handlers depend on. */\n  link?: unknown[];\n  environment?: Record<string, string>;\n}\n\nexport interface WorkerJobResource {\n  id: string;\n  executor?: never;\n  queue: sst.aws.Queue;\n}\n\nexport type JobResource = LambdaJobResource | InProcessJobResource | WorkerJobResource;\n\nexport interface RegisterJobResourcesConfig {\n  table: sst.aws.Dynamo;\n  resources: JobResource[];\n  handlerPaths: {\n    stream: string;\n    executor: string;\n  };\n}\n\nexport function registerJobResources(config: RegisterJobResourcesConfig) {\n  const { table, resources, handlerPaths } = config;\n  const QUEUE_URL_LIST = $jsonStringify(resources.map(({ id, queue }) => [id, queue.url]));\n\n  table.subscribe(\n    'JobTableStream',\n    {\n      handler: handlerPaths.stream,\n      link: [table, ...resources.map(({ queue }) => queue)],\n      environment: {\n        QUEUE_URL_LIST,\n      },\n    },\n    {\n      filters: [\n        {\n          dynamodb: {\n            NewImage: {\n              __edb_e__: {\n                S: ['job-attempt'],\n              },\n            },\n          },\n        },\n        {\n          dynamodb: {\n            OldImage: {\n              __edb_e__: {\n                S: ['job-attempt'],\n              },\n            },\n          },\n        },\n      ],\n    },\n  );\n\n  resources.forEach((resource) => {\n    if (!('executor' in resource)) {\n      return;\n    }\n\n    if (resource.executor === 'lambda') {\n      resource.queue.subscribe(\n        {\n          handler: handlerPaths.executor,\n          link: [table, resource.queue, ...resource.fns],\n          environment: {\n            LAMBDA_FUNCTION_LIST: $jsonStringify(resource.fns.map((f) => [f.name, f.arn])),\n            // needed for startJob's scheduledAt re-enqueue\n            QUEUE_URL_LIST,\n          },\n        },\n        {\n          batch: {\n            size: 10,\n            window: '3 seconds',\n            partialResponses: true,\n          },\n        },\n      );\n    }\n\n    if (resource.executor === 'in-process') {\n      resource.queue.subscribe(\n        {\n          handler: resource.handler,\n          link: [table, resource.queue, ...(resource.link ?? [])],\n          environment: {\n            ...resource.environment,\n            // in-process executors re-enqueue for scheduledAt deferrals and\n            // continuations — must win over consumer-provided environment\n            QUEUE_URL_LIST,\n          },\n        },\n        {\n          batch: {\n            size: 10,\n            window: '3 seconds',\n            partialResponses: true,\n          },\n        },\n      );\n    }\n  });\n}\n","import { createRequire } from 'node:module';\nimport path from 'node:path';\n\nexport interface JobsDashboardBasicAuthConfig {\n  /** Plaintext username — typically wired from an SST secret. */\n  username: $util.Input<string>;\n  /** Plaintext password — typically wired from an SST secret. */\n  password: $util.Input<string>;\n  /** Realm shown in browser auth dialog. Defaults to \"Jobs Dashboard\". */\n  realm?: string;\n}\n\n/**\n * The subset of the SST components namespace that {@link createJobsDashboard}\n * needs at runtime.\n *\n * Passed in rather than referenced as the `sst` global for the same reason as\n * {@link JobTableSstProvider}: this package ships as `.mjs`, and SST's config\n * evaluator skips `.mjs`/`.cjs` when injecting the `sst` global (its esbuild\n * `onLoad` plugin filters on `\\.(js|ts|jsx|tsx)$`). See the note on\n * {@link JobTableSstProvider} for the full mechanism.\n */\nexport interface JobsDashboardSstProvider {\n  aws: {\n    ApiGatewayV2: typeof sst.aws.ApiGatewayV2;\n    StaticSite: typeof sst.aws.StaticSite;\n  };\n}\n\nexport interface JobsDashboardOptions {\n  /**\n   * SST components namespace — pass the injected `sst` global from your\n   * `sst.config.ts` (a `.ts` file, which SST *does* inject `sst` into).\n   * See {@link JobsDashboardSstProvider}.\n   */\n  sst: JobsDashboardSstProvider;\n  /**\n   * Handler path for the dashboard API Lambda. The handler should call\n   * `initJobs({ tableName: Resource.<JobTable>.name })` and export\n   * `createJobsDashboardApiHandler()` from `@auriclabs/jobs`.\n   */\n  apiHandler: string;\n  /** Job table — linked into the API function. */\n  table: sst.aws.Dynamo;\n  /** Extra linkables for the API function (beyond the table). */\n  link?: unknown[];\n  domain?: sst.aws.StaticSiteArgs['domain'];\n  /**\n   * Override the path to the `@auriclabs/jobs` package's `ui/` directory.\n   * Defaults to resolving the installed package via `require.resolve`.\n   */\n  uiPath?: string;\n  /**\n   * Optional HTTP basic auth gate on the static site. When set, injects a\n   * basic-auth check into the StaticSite's CloudFront viewer-request\n   * function — requests without the matching `Authorization: Basic <base64>`\n   * header get a 401 before any routing logic runs. Credentials are inlined\n   * into the function source at deploy time via Pulumi apply.\n   *\n   * Note: this only gates the static UI. The API gateway URL remains\n   * directly callable — browsers don't auto-send basic auth credentials\n   * cross-origin, so the dashboard's fetch() can't carry them. Treat this\n   * as discovery-prevention for the dashboard, not API protection.\n   */\n  basicAuth?: JobsDashboardBasicAuthConfig;\n}\n\nexport function createJobsDashboard(options: JobsDashboardOptions) {\n  const { sst } = options;\n  const api = new sst.aws.ApiGatewayV2('JobsDashboardApi', { cors: true });\n\n  const link: unknown[] = [options.table, ...(options.link ?? [])];\n\n  api.route('$default', {\n    handler: options.apiHandler,\n    link,\n  });\n\n  const uiPath = options.uiPath ?? resolveJobsUiPath();\n  const uiRelative = path.relative(process.cwd(), uiPath);\n\n  const basicAuthInjection = options.basicAuth\n    ? buildBasicAuthInjection(options.basicAuth)\n    : undefined;\n\n  // Copy pre-built dist and inject the API URL at deploy time.\n  // The build command copies ui/dist to a temp output dir and injects\n  // a script tag that sets globalThis.__JOBS_API_URL__ before the app loads.\n  const site = new sst.aws.StaticSite('JobsDashboard', {\n    path: uiRelative,\n\n    build: {\n      command: [\n        // _deploy persists in node_modules across deploys — a stale copy would\n        // nest the new dist and keep serving the old bundle\n        'rm -rf _deploy',\n        'cp -r dist _deploy',\n        `sed -i.bak 's|<head>|<head><script>globalThis.__JOBS_API_URL__=\"'$VITE_API_URL'\"</script>|' _deploy/index.html`,\n        'rm -f _deploy/index.html.bak',\n      ].join(' && '),\n      output: '_deploy',\n    },\n    dev: {\n      command: 'npx vite dev',\n      url: 'http://localhost:3101',\n    },\n    environment: {\n      VITE_API_URL: api.url,\n    },\n    domain: options.domain,\n    ...(basicAuthInjection && {\n      edge: {\n        viewerRequest: { injection: basicAuthInjection },\n      },\n    }),\n  });\n\n  return { api, site };\n}\n\n/**\n * Resolve the `@auriclabs/jobs` package's `ui/` directory. jobs-infra is a\n * separate package, so the UI ships with `@auriclabs/jobs` — resolve it\n * through the consumer's node_modules (the workspace link covers local dev).\n */\nfunction resolveJobsUiPath(): string {\n  const require = createRequire(import.meta.url);\n  const pkgJsonPath = require.resolve('@auriclabs/jobs/package.json');\n  const pkgRoot = path.dirname(pkgJsonPath);\n  return path.join(pkgRoot, 'ui');\n}\n\nfunction buildBasicAuthInjection(auth: JobsDashboardBasicAuthConfig) {\n  const realm = (auth.realm ?? 'Jobs Dashboard').replace(/\"/g, '\\\\\"');\n\n  // Inline the encoded credential into the CloudFront Function source at\n  // deploy time. CFFs can't read SSM at runtime, so the credential lives\n  // in the deployed function's code (same trust boundary as SST secret\n  // state). Rotate by updating the upstream secret and redeploying.\n  //\n  // Returned as an injection string that SST splices into the start of\n  // its existing `cloudfront-js-2.0` viewer-request handler — a 401\n  // return short-circuits the rest of the routing logic.\n  return $output([auth.username, auth.password]).apply(([username, password]) => {\n    const encoded = Buffer.from(`${username}:${password}`).toString('base64');\n    return [\n      'var __auth = event.request.headers.authorization && event.request.headers.authorization.value;',\n      `if (__auth !== \"Basic ${encoded}\") {`,\n      '  return {',\n      '    statusCode: 401,',\n      '    statusDescription: \"Unauthorized\",',\n      '    headers: {',\n      `      \"www-authenticate\": { value: 'Basic realm=\"${realm}\"' }`,\n      '    }',\n      '  };',\n      '}',\n    ].join('\\n');\n  });\n}\n"],"mappings":";;;AAqBA,SAAgB,eAAe,KAA0B,MAAc;AACrE,QAAO,IAAI,IAAI,IAAI,OAAO,MAAM;EAC9B,QAAQ;GACN,IAAI;GACJ,IAAI;GACJ,eAAe;GACf,eAAe;GACf,QAAQ;GACR,QAAQ;GACT;EACD,cAAc;GACZ,SAAS;GACT,UAAU;GACX;EACD,eAAe;GACb,aAAa;IAAE,SAAS;IAAiB,UAAU;IAAiB;GACpE,MAAM;IAAE,SAAS;IAAU,UAAU;IAAU;GAChD;EACD,QAAQ;EACT,CAAC;;;;ACHJ,SAAgB,qBAAqB,QAAoC;CACvE,MAAM,EAAE,OAAO,WAAW,iBAAiB;CAC3C,MAAM,iBAAiB,eAAe,UAAU,KAAK,EAAE,IAAI,YAAY,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC;AAExF,OAAM,UACJ,kBACA;EACE,SAAS,aAAa;EACtB,MAAM,CAAC,OAAO,GAAG,UAAU,KAAK,EAAE,YAAY,MAAM,CAAC;EACrD,aAAa,EACX,gBACD;EACF,EACD,EACE,SAAS,CACP,EACE,UAAU,EACR,UAAU,EACR,WAAW,EACT,GAAG,CAAC,cAAc,EACnB,EACF,EACF,EACF,EACD,EACE,UAAU,EACR,UAAU,EACR,WAAW,EACT,GAAG,CAAC,cAAc,EACnB,EACF,EACF,EACF,CACF,EACF,CACF;AAED,WAAU,SAAS,aAAa;AAC9B,MAAI,EAAE,cAAc,UAClB;AAGF,MAAI,SAAS,aAAa,SACxB,UAAS,MAAM,UACb;GACE,SAAS,aAAa;GACtB,MAAM;IAAC;IAAO,SAAS;IAAO,GAAG,SAAS;IAAI;GAC9C,aAAa;IACX,sBAAsB,eAAe,SAAS,IAAI,KAAK,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAE9E;IACD;GACF,EACD,EACE,OAAO;GACL,MAAM;GACN,QAAQ;GACR,kBAAkB;GACnB,EACF,CACF;AAGH,MAAI,SAAS,aAAa,aACxB,UAAS,MAAM,UACb;GACE,SAAS,SAAS;GAClB,MAAM;IAAC;IAAO,SAAS;IAAO,GAAI,SAAS,QAAQ,EAAE;IAAE;GACvD,aAAa;IACX,GAAG,SAAS;IAGZ;IACD;GACF,EACD,EACE,OAAO;GACL,MAAM;GACN,QAAQ;GACR,kBAAkB;GACnB,EACF,CACF;GAEH;;;;ACtDJ,SAAgB,oBAAoB,SAA+B;CACjE,MAAM,EAAE,QAAQ;CAChB,MAAM,MAAM,IAAI,IAAI,IAAI,aAAa,oBAAoB,EAAE,MAAM,MAAM,CAAC;CAExE,MAAM,OAAkB,CAAC,QAAQ,OAAO,GAAI,QAAQ,QAAQ,EAAE,CAAE;AAEhE,KAAI,MAAM,YAAY;EACpB,SAAS,QAAQ;EACjB;EACD,CAAC;CAEF,MAAM,SAAS,QAAQ,UAAU,mBAAmB;CACpD,MAAM,aAAa,KAAK,SAAS,QAAQ,KAAK,EAAE,OAAO;CAEvD,MAAM,qBAAqB,QAAQ,YAC/B,wBAAwB,QAAQ,UAAU,GAC1C,KAAA;AAkCJ,QAAO;EAAE;EAAK,MA7BD,IAAI,IAAI,IAAI,WAAW,iBAAiB;GACnD,MAAM;GAEN,OAAO;IACL,SAAS;KAGP;KACA;KACA;KACA;KACD,CAAC,KAAK,OAAO;IACd,QAAQ;IACT;GACD,KAAK;IACH,SAAS;IACT,KAAK;IACN;GACD,aAAa,EACX,cAAc,IAAI,KACnB;GACD,QAAQ,QAAQ;GAChB,GAAI,sBAAsB,EACxB,MAAM,EACJ,eAAe,EAAE,WAAW,oBAAoB,EACjD,EACF;GACF,CAAC;EAEkB;;;;;;;AAQtB,SAAS,oBAA4B;CAEnC,MAAM,cADU,cAAc,OAAO,KAAK,IAAI,CAClB,QAAQ,+BAA+B;CACnE,MAAM,UAAU,KAAK,QAAQ,YAAY;AACzC,QAAO,KAAK,KAAK,SAAS,KAAK;;AAGjC,SAAS,wBAAwB,MAAoC;CACnE,MAAM,SAAS,KAAK,SAAS,kBAAkB,QAAQ,MAAM,OAAM;AAUnE,QAAO,QAAQ,CAAC,KAAK,UAAU,KAAK,SAAS,CAAC,CAAC,OAAO,CAAC,UAAU,cAAc;AAE7E,SAAO;GACL;GACA,yBAHc,OAAO,KAAK,GAAG,SAAS,GAAG,WAAW,CAAC,SAAS,SAAS,CAGtC;GACjC;GACA;GACA;GACA;GACA,oDAAoD,MAAM;GAC1D;GACA;GACA;GACD,CAAC,KAAK,KAAK;GACZ"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@auriclabs/jobs-infra",
-  "version": "2.0.0",
+  "version": "2.2.0",
   "description": "SST infrastructure helpers for job queue tables and resources",
   "prettier": "@auriclabs/prettier-config",
   "main": "dist/index.cjs",
@@ -20,14 +20,21 @@
   "dependencies": {},
   "devDependencies": {
     "sst": "^4.3.7",
-    "@auriclabs/sst-utils": "1.1.7",
-    "@auriclabs/sst-types": "0.1.0"
+    "@auriclabs/jobs": "0.3.0",
+    "@auriclabs/sst-types": "0.1.0",
+    "@auriclabs/sst-utils": "1.1.14"
   },
   "peerDependencies": {
+    "@auriclabs/jobs": ">=0.3.0",
     "@auriclabs/sst-types": "^0.1.0",
     "@auriclabs/sst-utils": "^1.2.0",
     "sst": "^4.3.7"
   },
+  "peerDependenciesMeta": {
+    "@auriclabs/jobs": {
+      "optional": true
+    }
+  },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/"
   },

package/src/dashboard.ts

@@ -0,0 +1,159 @@
+import { createRequire } from 'node:module';
+import path from 'node:path';
+
+export interface JobsDashboardBasicAuthConfig {
+  /** Plaintext username — typically wired from an SST secret. */
+  username: $util.Input<string>;
+  /** Plaintext password — typically wired from an SST secret. */
+  password: $util.Input<string>;
+  /** Realm shown in browser auth dialog. Defaults to "Jobs Dashboard". */
+  realm?: string;
+}
+
+/**
+ * The subset of the SST components namespace that {@link createJobsDashboard}
+ * needs at runtime.
+ *
+ * Passed in rather than referenced as the `sst` global for the same reason as
+ * {@link JobTableSstProvider}: this package ships as `.mjs`, and SST's config
+ * evaluator skips `.mjs`/`.cjs` when injecting the `sst` global (its esbuild
+ * `onLoad` plugin filters on `\.(js|ts|jsx|tsx)$`). See the note on
+ * {@link JobTableSstProvider} for the full mechanism.
+ */
+export interface JobsDashboardSstProvider {
+  aws: {
+    ApiGatewayV2: typeof sst.aws.ApiGatewayV2;
+    StaticSite: typeof sst.aws.StaticSite;
+  };
+}
+
+export interface JobsDashboardOptions {
+  /**
+   * SST components namespace — pass the injected `sst` global from your
+   * `sst.config.ts` (a `.ts` file, which SST *does* inject `sst` into).
+   * See {@link JobsDashboardSstProvider}.
+   */
+  sst: JobsDashboardSstProvider;
+  /**
+   * Handler path for the dashboard API Lambda. The handler should call
+   * `initJobs({ tableName: Resource.<JobTable>.name })` and export
+   * `createJobsDashboardApiHandler()` from `@auriclabs/jobs`.
+   */
+  apiHandler: string;
+  /** Job table — linked into the API function. */
+  table: sst.aws.Dynamo;
+  /** Extra linkables for the API function (beyond the table). */
+  link?: unknown[];
+  domain?: sst.aws.StaticSiteArgs['domain'];
+  /**
+   * Override the path to the `@auriclabs/jobs` package's `ui/` directory.
+   * Defaults to resolving the installed package via `require.resolve`.
+   */
+  uiPath?: string;
+  /**
+   * Optional HTTP basic auth gate on the static site. When set, injects a
+   * basic-auth check into the StaticSite's CloudFront viewer-request
+   * function — requests without the matching `Authorization: Basic <base64>`
+   * header get a 401 before any routing logic runs. Credentials are inlined
+   * into the function source at deploy time via Pulumi apply.
+   *
+   * Note: this only gates the static UI. The API gateway URL remains
+   * directly callable — browsers don't auto-send basic auth credentials
+   * cross-origin, so the dashboard's fetch() can't carry them. Treat this
+   * as discovery-prevention for the dashboard, not API protection.
+   */
+  basicAuth?: JobsDashboardBasicAuthConfig;
+}
+
+export function createJobsDashboard(options: JobsDashboardOptions) {
+  const { sst } = options;
+  const api = new sst.aws.ApiGatewayV2('JobsDashboardApi', { cors: true });
+
+  const link: unknown[] = [options.table, ...(options.link ?? [])];
+
+  api.route('$default', {
+    handler: options.apiHandler,
+    link,
+  });
+
+  const uiPath = options.uiPath ?? resolveJobsUiPath();
+  const uiRelative = path.relative(process.cwd(), uiPath);
+
+  const basicAuthInjection = options.basicAuth
+    ? buildBasicAuthInjection(options.basicAuth)
+    : undefined;
+
+  // Copy pre-built dist and inject the API URL at deploy time.
+  // The build command copies ui/dist to a temp output dir and injects
+  // a script tag that sets globalThis.__JOBS_API_URL__ before the app loads.
+  const site = new sst.aws.StaticSite('JobsDashboard', {
+    path: uiRelative,
+
+    build: {
+      command: [
+        // _deploy persists in node_modules across deploys — a stale copy would
+        // nest the new dist and keep serving the old bundle
+        'rm -rf _deploy',
+        'cp -r dist _deploy',
+        `sed -i.bak 's|<head>|<head><script>globalThis.__JOBS_API_URL__="'$VITE_API_URL'"</script>|' _deploy/index.html`,
+        'rm -f _deploy/index.html.bak',
+      ].join(' && '),
+      output: '_deploy',
+    },
+    dev: {
+      command: 'npx vite dev',
+      url: 'http://localhost:3101',
+    },
+    environment: {
+      VITE_API_URL: api.url,
+    },
+    domain: options.domain,
+    ...(basicAuthInjection && {
+      edge: {
+        viewerRequest: { injection: basicAuthInjection },
+      },
+    }),
+  });
+
+  return { api, site };
+}
+
+/**
+ * Resolve the `@auriclabs/jobs` package's `ui/` directory. jobs-infra is a
+ * separate package, so the UI ships with `@auriclabs/jobs` — resolve it
+ * through the consumer's node_modules (the workspace link covers local dev).
+ */
+function resolveJobsUiPath(): string {
+  const require = createRequire(import.meta.url);
+  const pkgJsonPath = require.resolve('@auriclabs/jobs/package.json');
+  const pkgRoot = path.dirname(pkgJsonPath);
+  return path.join(pkgRoot, 'ui');
+}
+
+function buildBasicAuthInjection(auth: JobsDashboardBasicAuthConfig) {
+  const realm = (auth.realm ?? 'Jobs Dashboard').replace(/"/g, '\\"');
+
+  // Inline the encoded credential into the CloudFront Function source at
+  // deploy time. CFFs can't read SSM at runtime, so the credential lives
+  // in the deployed function's code (same trust boundary as SST secret
+  // state). Rotate by updating the upstream secret and redeploying.
+  //
+  // Returned as an injection string that SST splices into the start of
+  // its existing `cloudfront-js-2.0` viewer-request handler — a 401
+  // return short-circuits the rest of the routing logic.
+  return $output([auth.username, auth.password]).apply(([username, password]) => {
+    const encoded = Buffer.from(`${username}:${password}`).toString('base64');
+    return [
+      'var __auth = event.request.headers.authorization && event.request.headers.authorization.value;',
+      `if (__auth !== "Basic ${encoded}") {`,
+      '  return {',
+      '    statusCode: 401,',
+      '    statusDescription: "Unauthorized",',
+      '    headers: {',
+      `      "www-authenticate": { value: 'Basic realm="${realm}"' }`,
+      '    }',
+      '  };',
+      '}',
+    ].join('\n');
+  });
+}

package/src/index.ts

@@ -1,2 +1,3 @@
 export * from './job-table';
 export * from './job-resources';
+export * from './dashboard';

package/src/job-resources.ts

@@ -7,13 +7,24 @@ export interface LambdaJobResource {
   fns: FunctionWithName[];
 }
 
+export interface InProcessJobResource {
+  id: string;
+  executor: 'in-process';
+  queue: sst.aws.Queue;
+  /** Path to a handler that wraps createRegistryExecutorHandler(...) from @auriclabs/jobs. */
+  handler: string;
+  /** Extra linkables the in-process handlers depend on. */
+  link?: unknown[];
+  environment?: Record<string, string>;
+}
+
 export interface WorkerJobResource {
   id: string;
   executor?: never;
   queue: sst.aws.Queue;
 }
 
-export type JobResource = LambdaJobResource | WorkerJobResource;
+export type JobResource = LambdaJobResource | InProcessJobResource | WorkerJobResource;
 
 export interface RegisterJobResourcesConfig {
   table: sst.aws.Dynamo;
@@ -73,6 +84,30 @@ export function registerJobResources(config: RegisterJobResourcesConfig) {
           link: [table, resource.queue, ...resource.fns],
           environment: {
             LAMBDA_FUNCTION_LIST: $jsonStringify(resource.fns.map((f) => [f.name, f.arn])),
+            // needed for startJob's scheduledAt re-enqueue
+            QUEUE_URL_LIST,
+          },
+        },
+        {
+          batch: {
+            size: 10,
+            window: '3 seconds',
+            partialResponses: true,
+          },
+        },
+      );
+    }
+
+    if (resource.executor === 'in-process') {
+      resource.queue.subscribe(
+        {
+          handler: resource.handler,
+          link: [table, resource.queue, ...(resource.link ?? [])],
+          environment: {
+            ...resource.environment,
+            // in-process executors re-enqueue for scheduledAt deferrals and
+            // continuations — must win over consumer-provided environment
+            QUEUE_URL_LIST,
           },
         },
         {

package/src/job-table.ts

@@ -1,4 +1,25 @@
-export function createJobTable(name: string) {
+/**
+ * The subset of the SST components namespace that {@link createJobTable} needs
+ * at runtime.
+ *
+ * `@auriclabs/jobs-infra` ships as ESM (`dist/index.mjs`). SST's config
+ * evaluator injects the `sst` global into config source via an esbuild
+ * `onLoad` plugin whose filter is `\.(js|ts|jsx|tsx)$` — it deliberately skips
+ * `.mjs`/`.cjs`. (The `$app` / `$jsonStringify` / `$output` globals arrive via
+ * esbuild `Define`/`Inject`, which are extension-agnostic, so those keep
+ * working; only the `sst` namespace and the `@pulumi/*` provider aliases come
+ * from the skipped `onLoad` channel.) A bare `sst.aws.Dynamo` reference in this
+ * `.mjs` file therefore throws `ReferenceError: sst is not defined` at deploy
+ * time. Taking `sst` as a parameter — exactly as `@auriclabs/migrations`'
+ * `createTable(sst)` does — sidesteps the injection entirely.
+ */
+export interface JobTableSstProvider {
+  aws: {
+    Dynamo: typeof sst.aws.Dynamo;
+  };
+}
+
+export function createJobTable(sst: JobTableSstProvider, name: string) {
   return new sst.aws.Dynamo(name, {
     fields: {
       pk: 'string',