@open-mercato/scheduler 0.6.5-develop.4588.1.ecaa16cfc0 → 0.6.5-develop.4620.1.c20bc7e4bb

package/.turbo/turbo-build.log

@@ -1,2 +1,2 @@
-[build:scheduler] found 43 entry points
+[build:scheduler] found 50 entry points
 [build:scheduler] built successfully

package/dist/modules/scheduler/__integration__/TC-SCHED-002.spec.js

@@ -0,0 +1,49 @@
+import { expect, test } from "@playwright/test";
+import { apiRequest, getAuthToken } from "@open-mercato/core/helpers/integration/api";
+import { readJsonSafe } from "@open-mercato/core/helpers/integration/generalFixtures";
+import {
+  SCHEDULER_JOBS_PATH,
+  createScheduleJob,
+  deleteScheduleJob,
+  getScheduleJobById,
+  uniqueScheduleName
+} from "./helpers/scheduler.js";
+test.describe("TC-SCHED-002: PUT /api/scheduler/jobs updates schedule fields", () => {
+  test("updates name and scheduleValue while preserving identity and scope", async ({ request }) => {
+    const token = await getAuthToken(request, "admin");
+    let scheduleId = null;
+    try {
+      scheduleId = await createScheduleJob(request, token, {
+        name: uniqueScheduleName("Sched Update"),
+        scheduleType: "interval",
+        scheduleValue: "15m"
+      });
+      const original = await getScheduleJobById(request, token, scheduleId);
+      expect(original).not.toBeNull();
+      expect(original.scheduleValue).toBe("15m");
+      const updateResponse = await apiRequest(request, "PUT", SCHEDULER_JOBS_PATH, {
+        token,
+        data: { id: scheduleId, name: "Updated-Test-1", scheduleType: "interval", scheduleValue: "30m" }
+      });
+      expect(updateResponse.status()).toBe(200);
+      const updateBody = await readJsonSafe(updateResponse);
+      expect(updateBody?.ok).toBe(true);
+      const updated = await getScheduleJobById(request, token, scheduleId);
+      expect(updated).not.toBeNull();
+      expect(updated.name).toBe("Updated-Test-1");
+      expect(updated.scheduleValue).toBe("30m");
+      expect(updated.id).toBe(scheduleId);
+      expect(updated.tenantId).toBe(original.tenantId);
+      expect(updated.organizationId).toBe(original.organizationId);
+      expect(updated.targetQueue).toBe(original.targetQueue);
+      if (original.createdAt && updated.updatedAt) {
+        expect(new Date(updated.updatedAt).getTime()).toBeGreaterThanOrEqual(
+          new Date(original.createdAt).getTime()
+        );
+      }
+    } finally {
+      await deleteScheduleJob(request, token, scheduleId);
+    }
+  });
+});
+//# sourceMappingURL=TC-SCHED-002.spec.js.map

package/dist/modules/scheduler/__integration__/TC-SCHED-002.spec.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/scheduler/__integration__/TC-SCHED-002.spec.ts"],
+  "sourcesContent": ["import { expect, test } from '@playwright/test'\nimport { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api'\nimport { readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures'\nimport {\n  SCHEDULER_JOBS_PATH,\n  createScheduleJob,\n  deleteScheduleJob,\n  getScheduleJobById,\n  uniqueScheduleName,\n} from './helpers/scheduler'\n\n/**\n * TC-SCHED-002: PUT /api/scheduler/jobs updates schedule fields correctly\n *\n * Note: scheduleUpdateSchema requires `scheduleType` whenever `scheduleValue`\n * changes, so the update payload sends both (the issue's draft omitted the\n * type \u2014 the route rejects that with 400). This asserts the real contract.\n */\ntest.describe('TC-SCHED-002: PUT /api/scheduler/jobs updates schedule fields', () => {\n  test('updates name and scheduleValue while preserving identity and scope', async ({ request }) => {\n    const token = await getAuthToken(request, 'admin')\n    let scheduleId: string | null = null\n\n    try {\n      scheduleId = await createScheduleJob(request, token, {\n        name: uniqueScheduleName('Sched Update'),\n        scheduleType: 'interval',\n        scheduleValue: '15m',\n      })\n\n      const original = await getScheduleJobById(request, token, scheduleId)\n      expect(original).not.toBeNull()\n      expect(original!.scheduleValue).toBe('15m')\n\n      const updateResponse = await apiRequest(request, 'PUT', SCHEDULER_JOBS_PATH, {\n        token,\n        data: { id: scheduleId, name: 'Updated-Test-1', scheduleType: 'interval', scheduleValue: '30m' },\n      })\n      expect(updateResponse.status()).toBe(200)\n      const updateBody = await readJsonSafe<{ ok?: boolean }>(updateResponse)\n      expect(updateBody?.ok).toBe(true)\n\n      const updated = await getScheduleJobById(request, token, scheduleId)\n      expect(updated).not.toBeNull()\n      // Mutated fields persisted\n      expect(updated!.name).toBe('Updated-Test-1')\n      expect(updated!.scheduleValue).toBe('30m')\n      // Identity and scope unchanged\n      expect(updated!.id).toBe(scheduleId)\n      expect(updated!.tenantId).toBe(original!.tenantId)\n      expect(updated!.organizationId).toBe(original!.organizationId)\n      expect(updated!.targetQueue).toBe(original!.targetQueue)\n      // updatedAt advances past the original creation timestamp\n      if (original!.createdAt && updated!.updatedAt) {\n        expect(new Date(updated!.updatedAt).getTime()).toBeGreaterThanOrEqual(\n          new Date(original!.createdAt).getTime(),\n        )\n      }\n    } finally {\n      await deleteScheduleJob(request, token, scheduleId)\n    }\n  })\n})\n"],
+  "mappings": "AAAA,SAAS,QAAQ,YAAY;AAC7B,SAAS,YAAY,oBAAoB;AACzC,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AASP,KAAK,SAAS,iEAAiE,MAAM;AACnF,OAAK,sEAAsE,OAAO,EAAE,QAAQ,MAAM;AAChG,UAAM,QAAQ,MAAM,aAAa,SAAS,OAAO;AACjD,QAAI,aAA4B;AAEhC,QAAI;AACF,mBAAa,MAAM,kBAAkB,SAAS,OAAO;AAAA,QACnD,MAAM,mBAAmB,cAAc;AAAA,QACvC,cAAc;AAAA,QACd,eAAe;AAAA,MACjB,CAAC;AAED,YAAM,WAAW,MAAM,mBAAmB,SAAS,OAAO,UAAU;AACpE,aAAO,QAAQ,EAAE,IAAI,SAAS;AAC9B,aAAO,SAAU,aAAa,EAAE,KAAK,KAAK;AAE1C,YAAM,iBAAiB,MAAM,WAAW,SAAS,OAAO,qBAAqB;AAAA,QAC3E;AAAA,QACA,MAAM,EAAE,IAAI,YAAY,MAAM,kBAAkB,cAAc,YAAY,eAAe,MAAM;AAAA,MACjG,CAAC;AACD,aAAO,eAAe,OAAO,CAAC,EAAE,KAAK,GAAG;AACxC,YAAM,aAAa,MAAM,aAA+B,cAAc;AACtE,aAAO,YAAY,EAAE,EAAE,KAAK,IAAI;AAEhC,YAAM,UAAU,MAAM,mBAAmB,SAAS,OAAO,UAAU;AACnE,aAAO,OAAO,EAAE,IAAI,SAAS;AAE7B,aAAO,QAAS,IAAI,EAAE,KAAK,gBAAgB;AAC3C,aAAO,QAAS,aAAa,EAAE,KAAK,KAAK;AAEzC,aAAO,QAAS,EAAE,EAAE,KAAK,UAAU;AACnC,aAAO,QAAS,QAAQ,EAAE,KAAK,SAAU,QAAQ;AACjD,aAAO,QAAS,cAAc,EAAE,KAAK,SAAU,cAAc;AAC7D,aAAO,QAAS,WAAW,EAAE,KAAK,SAAU,WAAW;AAEvD,UAAI,SAAU,aAAa,QAAS,WAAW;AAC7C,eAAO,IAAI,KAAK,QAAS,SAAS,EAAE,QAAQ,CAAC,EAAE;AAAA,UAC7C,IAAI,KAAK,SAAU,SAAS,EAAE,QAAQ;AAAA,QACxC;AAAA,MACF;AAAA,IACF,UAAE;AACA,YAAM,kBAAkB,SAAS,OAAO,UAAU;AAAA,IACpD;AAAA,EACF,CAAC;AACH,CAAC;",
+  "names": []
+}

package/dist/modules/scheduler/__integration__/TC-SCHED-003.spec.js

@@ -0,0 +1,38 @@
+import { expect, test } from "@playwright/test";
+import { apiRequest, getAuthToken } from "@open-mercato/core/helpers/integration/api";
+import { readJsonSafe } from "@open-mercato/core/helpers/integration/generalFixtures";
+import { SCHEDULER_JOBS_PATH, createScheduleJob, deleteScheduleJob, getScheduleJobById } from "./helpers/scheduler.js";
+test.describe("TC-SCHED-003: DELETE /api/scheduler/jobs soft-deletes a schedule", () => {
+  test("removes the schedule from listings and returns 200 (not 404) afterwards", async ({ request }) => {
+    const token = await getAuthToken(request, "admin");
+    let scheduleId = null;
+    let deleted = false;
+    try {
+      scheduleId = await createScheduleJob(request, token);
+      const present = await getScheduleJobById(request, token, scheduleId);
+      expect(present).not.toBeNull();
+      const deleteResponse = await apiRequest(request, "DELETE", SCHEDULER_JOBS_PATH, {
+        token,
+        data: { id: scheduleId }
+      });
+      expect(deleteResponse.status()).toBe(200);
+      const deleteBody = await readJsonSafe(deleteResponse);
+      expect(deleteBody?.ok).toBe(true);
+      deleted = true;
+      const afterResponse = await apiRequest(
+        request,
+        "GET",
+        `${SCHEDULER_JOBS_PATH}?id=${encodeURIComponent(scheduleId)}`,
+        { token }
+      );
+      expect(afterResponse.status()).toBe(200);
+      const afterBody = await readJsonSafe(afterResponse);
+      expect(Array.isArray(afterBody?.items)).toBe(true);
+      expect((afterBody?.items ?? []).some((item) => item.id === scheduleId)).toBe(false);
+      expect((afterBody?.items ?? []).length).toBe(0);
+    } finally {
+      if (!deleted) await deleteScheduleJob(request, token, scheduleId);
+    }
+  });
+});
+//# sourceMappingURL=TC-SCHED-003.spec.js.map

package/dist/modules/scheduler/__integration__/TC-SCHED-003.spec.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/scheduler/__integration__/TC-SCHED-003.spec.ts"],
+  "sourcesContent": ["import { expect, test } from '@playwright/test'\nimport { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api'\nimport { readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures'\nimport { SCHEDULER_JOBS_PATH, createScheduleJob, deleteScheduleJob, getScheduleJobById } from './helpers/scheduler'\n\n/**\n * TC-SCHED-003: DELETE /api/scheduler/jobs soft-deletes a schedule and\n * prevents re-listing. The list endpoint keeps returning 200 (not 404) with\n * the soft-deleted record filtered out by the `deletedAt` soft-delete field.\n */\ntest.describe('TC-SCHED-003: DELETE /api/scheduler/jobs soft-deletes a schedule', () => {\n  test('removes the schedule from listings and returns 200 (not 404) afterwards', async ({ request }) => {\n    const token = await getAuthToken(request, 'admin')\n    let scheduleId: string | null = null\n    let deleted = false\n\n    try {\n      scheduleId = await createScheduleJob(request, token)\n\n      const present = await getScheduleJobById(request, token, scheduleId)\n      expect(present).not.toBeNull()\n\n      const deleteResponse = await apiRequest(request, 'DELETE', SCHEDULER_JOBS_PATH, {\n        token,\n        data: { id: scheduleId },\n      })\n      expect(deleteResponse.status()).toBe(200)\n      const deleteBody = await readJsonSafe<{ ok?: boolean }>(deleteResponse)\n      expect(deleteBody?.ok).toBe(true)\n      deleted = true\n\n      // Soft delete: list still returns 200 with an (empty) items array, never 404.\n      const afterResponse = await apiRequest(\n        request,\n        'GET',\n        `${SCHEDULER_JOBS_PATH}?id=${encodeURIComponent(scheduleId)}`,\n        { token },\n      )\n      expect(afterResponse.status()).toBe(200)\n      const afterBody = await readJsonSafe<{ items?: Array<{ id: string }> }>(afterResponse)\n      expect(Array.isArray(afterBody?.items)).toBe(true)\n      expect((afterBody?.items ?? []).some((item) => item.id === scheduleId)).toBe(false)\n      expect((afterBody?.items ?? []).length).toBe(0)\n    } finally {\n      if (!deleted) await deleteScheduleJob(request, token, scheduleId)\n    }\n  })\n})\n"],
+  "mappings": "AAAA,SAAS,QAAQ,YAAY;AAC7B,SAAS,YAAY,oBAAoB;AACzC,SAAS,oBAAoB;AAC7B,SAAS,qBAAqB,mBAAmB,mBAAmB,0BAA0B;AAO9F,KAAK,SAAS,oEAAoE,MAAM;AACtF,OAAK,2EAA2E,OAAO,EAAE,QAAQ,MAAM;AACrG,UAAM,QAAQ,MAAM,aAAa,SAAS,OAAO;AACjD,QAAI,aAA4B;AAChC,QAAI,UAAU;AAEd,QAAI;AACF,mBAAa,MAAM,kBAAkB,SAAS,KAAK;AAEnD,YAAM,UAAU,MAAM,mBAAmB,SAAS,OAAO,UAAU;AACnE,aAAO,OAAO,EAAE,IAAI,SAAS;AAE7B,YAAM,iBAAiB,MAAM,WAAW,SAAS,UAAU,qBAAqB;AAAA,QAC9E;AAAA,QACA,MAAM,EAAE,IAAI,WAAW;AAAA,MACzB,CAAC;AACD,aAAO,eAAe,OAAO,CAAC,EAAE,KAAK,GAAG;AACxC,YAAM,aAAa,MAAM,aAA+B,cAAc;AACtE,aAAO,YAAY,EAAE,EAAE,KAAK,IAAI;AAChC,gBAAU;AAGV,YAAM,gBAAgB,MAAM;AAAA,QAC1B;AAAA,QACA;AAAA,QACA,GAAG,mBAAmB,OAAO,mBAAmB,UAAU,CAAC;AAAA,QAC3D,EAAE,MAAM;AAAA,MACV;AACA,aAAO,cAAc,OAAO,CAAC,EAAE,KAAK,GAAG;AACvC,YAAM,YAAY,MAAM,aAAgD,aAAa;AACrF,aAAO,MAAM,QAAQ,WAAW,KAAK,CAAC,EAAE,KAAK,IAAI;AACjD,cAAQ,WAAW,SAAS,CAAC,GAAG,KAAK,CAAC,SAAS,KAAK,OAAO,UAAU,CAAC,EAAE,KAAK,KAAK;AAClF,cAAQ,WAAW,SAAS,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC;AAAA,IAChD,UAAE;AACA,UAAI,CAAC,QAAS,OAAM,kBAAkB,SAAS,OAAO,UAAU;AAAA,IAClE;AAAA,EACF,CAAC;AACH,CAAC;",
+  "names": []
+}

package/dist/modules/scheduler/__integration__/TC-SCHED-004.spec.js

@@ -0,0 +1,36 @@
+import { expect, test } from "@playwright/test";
+import { apiRequest, getAuthToken } from "@open-mercato/core/helpers/integration/api";
+import { readJsonSafe } from "@open-mercato/core/helpers/integration/generalFixtures";
+import { SCHEDULER_EXECUTION_QUEUE, SCHEDULER_TARGETS_PATH } from "./helpers/scheduler.js";
+function expectSortedByValue(options, label) {
+  const values = options.map((option) => option.value);
+  expect(values, `${label} should be sorted alphabetically by value`).toEqual(
+    [...values].sort((a, b) => a.localeCompare(b))
+  );
+}
+function expectOptionShape(options, label) {
+  for (const option of options) {
+    expect(typeof option.value, `${label} option value should be a string`).toBe("string");
+    expect(typeof option.label, `${label} option label should be a string`).toBe("string");
+  }
+}
+test.describe("TC-SCHED-004: GET /api/scheduler/targets lists queues and commands", () => {
+  test("returns sorted queues (incl. scheduler-execution) and a non-empty command list", async ({ request }) => {
+    const token = await getAuthToken(request, "admin");
+    const response = await apiRequest(request, "GET", SCHEDULER_TARGETS_PATH, { token });
+    expect(response.status()).toBe(200);
+    const body = await readJsonSafe(response);
+    const queues = body?.queues ?? [];
+    const commands = body?.commands ?? [];
+    expect(Array.isArray(body?.queues)).toBe(true);
+    expect(queues.length).toBeGreaterThan(0);
+    expectOptionShape(queues, "queues");
+    expect(queues.map((queue) => queue.value)).toContain(SCHEDULER_EXECUTION_QUEUE);
+    expectSortedByValue(queues, "queues");
+    expect(Array.isArray(body?.commands)).toBe(true);
+    expect(commands.length).toBeGreaterThan(0);
+    expectOptionShape(commands, "commands");
+    expectSortedByValue(commands, "commands");
+  });
+});
+//# sourceMappingURL=TC-SCHED-004.spec.js.map

package/dist/modules/scheduler/__integration__/TC-SCHED-004.spec.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/scheduler/__integration__/TC-SCHED-004.spec.ts"],
+  "sourcesContent": ["import { expect, test } from '@playwright/test'\nimport { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api'\nimport { readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures'\nimport { SCHEDULER_EXECUTION_QUEUE, SCHEDULER_TARGETS_PATH } from './helpers/scheduler'\n\ntype TargetOption = { value: string; label: string }\ntype TargetsResponse = { queues?: TargetOption[]; commands?: TargetOption[] }\n\nfunction expectSortedByValue(options: TargetOption[], label: string) {\n  const values = options.map((option) => option.value)\n  expect(values, `${label} should be sorted alphabetically by value`).toEqual(\n    [...values].sort((a, b) => a.localeCompare(b)),\n  )\n}\n\nfunction expectOptionShape(options: TargetOption[], label: string) {\n  for (const option of options) {\n    expect(typeof option.value, `${label} option value should be a string`).toBe('string')\n    expect(typeof option.label, `${label} option label should be a string`).toBe('string')\n  }\n}\n\n/**\n * TC-SCHED-004: GET /api/scheduler/targets returns available queue names\n * (from module workers) and registered command IDs (from the command\n * registry), both sorted alphabetically by value. Read-only, no fixtures.\n */\ntest.describe('TC-SCHED-004: GET /api/scheduler/targets lists queues and commands', () => {\n  test('returns sorted queues (incl. scheduler-execution) and a non-empty command list', async ({ request }) => {\n    const token = await getAuthToken(request, 'admin')\n\n    const response = await apiRequest(request, 'GET', SCHEDULER_TARGETS_PATH, { token })\n    expect(response.status()).toBe(200)\n\n    const body = await readJsonSafe<TargetsResponse>(response)\n    const queues = body?.queues ?? []\n    const commands = body?.commands ?? []\n\n    // Queues: non-empty, well-shaped, sorted, and include the known scheduler queue.\n    expect(Array.isArray(body?.queues)).toBe(true)\n    expect(queues.length).toBeGreaterThan(0)\n    expectOptionShape(queues, 'queues')\n    expect(queues.map((queue) => queue.value)).toContain(SCHEDULER_EXECUTION_QUEUE)\n    expectSortedByValue(queues, 'queues')\n\n    // Commands: non-empty, well-shaped, and sorted.\n    expect(Array.isArray(body?.commands)).toBe(true)\n    expect(commands.length).toBeGreaterThan(0)\n    expectOptionShape(commands, 'commands')\n    expectSortedByValue(commands, 'commands')\n  })\n})\n"],
+  "mappings": "AAAA,SAAS,QAAQ,YAAY;AAC7B,SAAS,YAAY,oBAAoB;AACzC,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B,8BAA8B;AAKlE,SAAS,oBAAoB,SAAyB,OAAe;AACnE,QAAM,SAAS,QAAQ,IAAI,CAAC,WAAW,OAAO,KAAK;AACnD,SAAO,QAAQ,GAAG,KAAK,2CAA2C,EAAE;AAAA,IAClE,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC;AAAA,EAC/C;AACF;AAEA,SAAS,kBAAkB,SAAyB,OAAe;AACjE,aAAW,UAAU,SAAS;AAC5B,WAAO,OAAO,OAAO,OAAO,GAAG,KAAK,kCAAkC,EAAE,KAAK,QAAQ;AACrF,WAAO,OAAO,OAAO,OAAO,GAAG,KAAK,kCAAkC,EAAE,KAAK,QAAQ;AAAA,EACvF;AACF;AAOA,KAAK,SAAS,sEAAsE,MAAM;AACxF,OAAK,kFAAkF,OAAO,EAAE,QAAQ,MAAM;AAC5G,UAAM,QAAQ,MAAM,aAAa,SAAS,OAAO;AAEjD,UAAM,WAAW,MAAM,WAAW,SAAS,OAAO,wBAAwB,EAAE,MAAM,CAAC;AACnF,WAAO,SAAS,OAAO,CAAC,EAAE,KAAK,GAAG;AAElC,UAAM,OAAO,MAAM,aAA8B,QAAQ;AACzD,UAAM,SAAS,MAAM,UAAU,CAAC;AAChC,UAAM,WAAW,MAAM,YAAY,CAAC;AAGpC,WAAO,MAAM,QAAQ,MAAM,MAAM,CAAC,EAAE,KAAK,IAAI;AAC7C,WAAO,OAAO,MAAM,EAAE,gBAAgB,CAAC;AACvC,sBAAkB,QAAQ,QAAQ;AAClC,WAAO,OAAO,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,UAAU,yBAAyB;AAC9E,wBAAoB,QAAQ,QAAQ;AAGpC,WAAO,MAAM,QAAQ,MAAM,QAAQ,CAAC,EAAE,KAAK,IAAI;AAC/C,WAAO,SAAS,MAAM,EAAE,gBAAgB,CAAC;AACzC,sBAAkB,UAAU,UAAU;AACtC,wBAAoB,UAAU,UAAU;AAAA,EAC1C,CAAC;AACH,CAAC;",
+  "names": []
+}

package/dist/modules/scheduler/__integration__/TC-SCHED-005.spec.js

@@ -0,0 +1,41 @@
+import { expect, test } from "@playwright/test";
+import { apiRequest, getAuthToken } from "@open-mercato/core/helpers/integration/api";
+import { readJsonSafe } from "@open-mercato/core/helpers/integration/generalFixtures";
+import {
+  SCHEDULER_TRIGGER_PATH,
+  createScheduleJob,
+  deleteScheduleJob,
+  uniqueScheduleName
+} from "./helpers/scheduler.js";
+const isAsyncQueueStrategy = (process.env.QUEUE_STRATEGY || "local") === "async";
+test.describe("TC-SCHED-005: POST /api/scheduler/trigger manual execution", () => {
+  test("enqueues an execution job (async) or rejects with async-required (local)", async ({ request }) => {
+    const token = await getAuthToken(request, "admin");
+    let scheduleId = null;
+    try {
+      scheduleId = await createScheduleJob(request, token, {
+        name: uniqueScheduleName("Trigger-Test"),
+        scheduleType: "interval",
+        scheduleValue: "1h"
+      });
+      const response = await apiRequest(request, "POST", SCHEDULER_TRIGGER_PATH, {
+        token,
+        data: { id: scheduleId }
+      });
+      if (isAsyncQueueStrategy) {
+        expect(response.status()).toBe(200);
+        const body = await readJsonSafe(response);
+        expect(body?.ok).toBe(true);
+        expect(typeof body?.jobId === "string" && (body?.jobId?.length ?? 0) > 0).toBe(true);
+        expect(body?.message ?? "").toMatch(/queued|triggered/i);
+      } else {
+        expect(response.status()).toBe(400);
+        const body = await readJsonSafe(response);
+        expect(`${body?.error ?? ""} ${body?.message ?? ""}`).toMatch(/async/i);
+      }
+    } finally {
+      await deleteScheduleJob(request, token, scheduleId);
+    }
+  });
+});
+//# sourceMappingURL=TC-SCHED-005.spec.js.map

package/dist/modules/scheduler/__integration__/TC-SCHED-005.spec.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/scheduler/__integration__/TC-SCHED-005.spec.ts"],
+  "sourcesContent": ["import { expect, test } from '@playwright/test'\nimport { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api'\nimport { readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures'\nimport {\n  SCHEDULER_TRIGGER_PATH,\n  createScheduleJob,\n  deleteScheduleJob,\n  uniqueScheduleName,\n} from './helpers/scheduler'\n\nconst isAsyncQueueStrategy = (process.env.QUEUE_STRATEGY || 'local') === 'async'\n\n/**\n * TC-SCHED-005: POST /api/scheduler/trigger manually enqueues a schedule for\n * execution. Manual triggers require the async (BullMQ) queue strategy, so the\n * assertion branches on QUEUE_STRATEGY exactly like TC-SCHED-001: async returns\n * 200 + jobId, local returns 400 with an \"async required\" message.\n */\ntest.describe('TC-SCHED-005: POST /api/scheduler/trigger manual execution', () => {\n  test('enqueues an execution job (async) or rejects with async-required (local)', async ({ request }) => {\n    const token = await getAuthToken(request, 'admin')\n    let scheduleId: string | null = null\n\n    try {\n      scheduleId = await createScheduleJob(request, token, {\n        name: uniqueScheduleName('Trigger-Test'),\n        scheduleType: 'interval',\n        scheduleValue: '1h',\n      })\n\n      const response = await apiRequest(request, 'POST', SCHEDULER_TRIGGER_PATH, {\n        token,\n        data: { id: scheduleId },\n      })\n\n      if (isAsyncQueueStrategy) {\n        expect(response.status()).toBe(200)\n        const body = await readJsonSafe<{ ok?: boolean; jobId?: string; message?: string }>(response)\n        expect(body?.ok).toBe(true)\n        expect(typeof body?.jobId === 'string' && (body?.jobId?.length ?? 0) > 0).toBe(true)\n        expect(body?.message ?? '').toMatch(/queued|triggered/i)\n      } else {\n        expect(response.status()).toBe(400)\n        const body = await readJsonSafe<{ error?: string; message?: string }>(response)\n        expect(`${body?.error ?? ''} ${body?.message ?? ''}`).toMatch(/async/i)\n      }\n    } finally {\n      await deleteScheduleJob(request, token, scheduleId)\n    }\n  })\n})\n"],
+  "mappings": "AAAA,SAAS,QAAQ,YAAY;AAC7B,SAAS,YAAY,oBAAoB;AACzC,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,wBAAwB,QAAQ,IAAI,kBAAkB,aAAa;AAQzE,KAAK,SAAS,8DAA8D,MAAM;AAChF,OAAK,4EAA4E,OAAO,EAAE,QAAQ,MAAM;AACtG,UAAM,QAAQ,MAAM,aAAa,SAAS,OAAO;AACjD,QAAI,aAA4B;AAEhC,QAAI;AACF,mBAAa,MAAM,kBAAkB,SAAS,OAAO;AAAA,QACnD,MAAM,mBAAmB,cAAc;AAAA,QACvC,cAAc;AAAA,QACd,eAAe;AAAA,MACjB,CAAC;AAED,YAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,wBAAwB;AAAA,QACzE;AAAA,QACA,MAAM,EAAE,IAAI,WAAW;AAAA,MACzB,CAAC;AAED,UAAI,sBAAsB;AACxB,eAAO,SAAS,OAAO,CAAC,EAAE,KAAK,GAAG;AAClC,cAAM,OAAO,MAAM,aAAiE,QAAQ;AAC5F,eAAO,MAAM,EAAE,EAAE,KAAK,IAAI;AAC1B,eAAO,OAAO,MAAM,UAAU,aAAa,MAAM,OAAO,UAAU,KAAK,CAAC,EAAE,KAAK,IAAI;AACnF,eAAO,MAAM,WAAW,EAAE,EAAE,QAAQ,mBAAmB;AAAA,MACzD,OAAO;AACL,eAAO,SAAS,OAAO,CAAC,EAAE,KAAK,GAAG;AAClC,cAAM,OAAO,MAAM,aAAmD,QAAQ;AAC9E,eAAO,GAAG,MAAM,SAAS,EAAE,IAAI,MAAM,WAAW,EAAE,EAAE,EAAE,QAAQ,QAAQ;AAAA,MACxE;AAAA,IACF,UAAE;AACA,YAAM,kBAAkB,SAAS,OAAO,UAAU;AAAA,IACpD;AAAA,EACF,CAAC;AACH,CAAC;",
+  "names": []
+}

package/dist/modules/scheduler/__integration__/TC-SCHED-006.spec.js

@@ -0,0 +1,61 @@
+import { expect, test } from "@playwright/test";
+import { apiRequest, getAuthToken } from "@open-mercato/core/helpers/integration/api";
+import {
+  createRoleFixture,
+  createUserFixture,
+  deleteRoleIfExists,
+  deleteUserIfExists,
+  setRoleAclFeatures
+} from "@open-mercato/core/helpers/integration/authFixtures";
+import { getTokenContext, readJsonSafe } from "@open-mercato/core/helpers/integration/generalFixtures";
+import { SCHEDULER_JOBS_PATH, createScheduleJob, deleteScheduleJob, getScheduleJobById } from "./helpers/scheduler.js";
+test.describe("TC-SCHED-006: scheduler.jobs.manage gate on PUT/DELETE", () => {
+  test("view-only user gets 403 on PUT and DELETE; schedule stays intact", async ({ request }) => {
+    const adminToken = await getAuthToken(request, "admin");
+    const { organizationId } = getTokenContext(adminToken);
+    expect(organizationId.length, "admin token should carry an organization id").toBeGreaterThan(0);
+    const stamp = `${Date.now()}`;
+    let roleId = null;
+    let userId = null;
+    let scheduleId = null;
+    try {
+      roleId = await createRoleFixture(request, adminToken, { name: `sched-view-only-${stamp}` });
+      await setRoleAclFeatures(request, adminToken, { roleId, features: ["scheduler.jobs.view"] });
+      const email = `sched-view-only-${stamp}@example.com`;
+      const password = "Sched-View-1!";
+      userId = await createUserFixture(request, adminToken, {
+        email,
+        password,
+        organizationId,
+        roles: [roleId],
+        name: "Scheduler View Only"
+      });
+      const viewToken = await getAuthToken(request, email, password);
+      scheduleId = await createScheduleJob(request, adminToken);
+      const listResponse = await apiRequest(request, "GET", SCHEDULER_JOBS_PATH, { token: viewToken });
+      expect(listResponse.status()).toBe(200);
+      const putResponse = await apiRequest(request, "PUT", SCHEDULER_JOBS_PATH, {
+        token: viewToken,
+        data: { id: scheduleId, name: "Should-Not-Apply" }
+      });
+      expect(putResponse.status()).toBe(403);
+      const putBody = await readJsonSafe(putResponse);
+      expect(putBody?.requiredFeatures ?? []).toContain("scheduler.jobs.manage");
+      const deleteResponse = await apiRequest(request, "DELETE", SCHEDULER_JOBS_PATH, {
+        token: viewToken,
+        data: { id: scheduleId }
+      });
+      expect(deleteResponse.status()).toBe(403);
+      const deleteBody = await readJsonSafe(deleteResponse);
+      expect(deleteBody?.requiredFeatures ?? []).toContain("scheduler.jobs.manage");
+      const after = await getScheduleJobById(request, adminToken, scheduleId);
+      expect(after).not.toBeNull();
+      expect(after.name).not.toBe("Should-Not-Apply");
+    } finally {
+      await deleteScheduleJob(request, adminToken, scheduleId);
+      await deleteUserIfExists(request, adminToken, userId);
+      await deleteRoleIfExists(request, adminToken, roleId);
+    }
+  });
+});
+//# sourceMappingURL=TC-SCHED-006.spec.js.map

package/dist/modules/scheduler/__integration__/TC-SCHED-006.spec.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/scheduler/__integration__/TC-SCHED-006.spec.ts"],
+  "sourcesContent": ["import { expect, test } from '@playwright/test'\nimport { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api'\nimport {\n  createRoleFixture,\n  createUserFixture,\n  deleteRoleIfExists,\n  deleteUserIfExists,\n  setRoleAclFeatures,\n} from '@open-mercato/core/helpers/integration/authFixtures'\nimport { getTokenContext, readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures'\nimport { SCHEDULER_JOBS_PATH, createScheduleJob, deleteScheduleJob, getScheduleJobById } from './helpers/scheduler'\n\ntype ForbiddenBody = { error?: string; requiredFeatures?: string[] }\n\n/**\n * TC-SCHED-006: PUT and DELETE on /api/scheduler/jobs are gated by\n * `scheduler.jobs.manage`. A user holding only `scheduler.jobs.view` can read\n * schedules but is denied with 403 on both mutating verbs, and a failed attempt\n * leaves the schedule untouched.\n */\ntest.describe('TC-SCHED-006: scheduler.jobs.manage gate on PUT/DELETE', () => {\n  test('view-only user gets 403 on PUT and DELETE; schedule stays intact', async ({ request }) => {\n    const adminToken = await getAuthToken(request, 'admin')\n    const { organizationId } = getTokenContext(adminToken)\n    expect(organizationId.length, 'admin token should carry an organization id').toBeGreaterThan(0)\n\n    const stamp = `${Date.now()}`\n    let roleId: string | null = null\n    let userId: string | null = null\n    let scheduleId: string | null = null\n\n    try {\n      // A role that can view schedules but not manage them.\n      roleId = await createRoleFixture(request, adminToken, { name: `sched-view-only-${stamp}` })\n      await setRoleAclFeatures(request, adminToken, { roleId, features: ['scheduler.jobs.view'] })\n\n      const email = `sched-view-only-${stamp}@example.com`\n      // Password must satisfy the default policy (min length + digit + uppercase + special).\n      const password = 'Sched-View-1!'\n      userId = await createUserFixture(request, adminToken, {\n        email,\n        password,\n        organizationId,\n        roles: [roleId],\n        name: 'Scheduler View Only',\n      })\n      const viewToken = await getAuthToken(request, email, password)\n\n      scheduleId = await createScheduleJob(request, adminToken)\n\n      // Sanity: the view-only user authenticates and CAN list (has the view feature),\n      // so the 403s below are specifically about the missing manage feature.\n      const listResponse = await apiRequest(request, 'GET', SCHEDULER_JOBS_PATH, { token: viewToken })\n      expect(listResponse.status()).toBe(200)\n\n      // PUT denied\n      const putResponse = await apiRequest(request, 'PUT', SCHEDULER_JOBS_PATH, {\n        token: viewToken,\n        data: { id: scheduleId, name: 'Should-Not-Apply' },\n      })\n      expect(putResponse.status()).toBe(403)\n      const putBody = await readJsonSafe<ForbiddenBody>(putResponse)\n      expect(putBody?.requiredFeatures ?? []).toContain('scheduler.jobs.manage')\n\n      // DELETE denied\n      const deleteResponse = await apiRequest(request, 'DELETE', SCHEDULER_JOBS_PATH, {\n        token: viewToken,\n        data: { id: scheduleId },\n      })\n      expect(deleteResponse.status()).toBe(403)\n      const deleteBody = await readJsonSafe<ForbiddenBody>(deleteResponse)\n      expect(deleteBody?.requiredFeatures ?? []).toContain('scheduler.jobs.manage')\n\n      // The schedule is unchanged and still present (admin can read it).\n      const after = await getScheduleJobById(request, adminToken, scheduleId)\n      expect(after).not.toBeNull()\n      expect(after!.name).not.toBe('Should-Not-Apply')\n    } finally {\n      await deleteScheduleJob(request, adminToken, scheduleId)\n      await deleteUserIfExists(request, adminToken, userId)\n      await deleteRoleIfExists(request, adminToken, roleId)\n    }\n  })\n})\n"],
+  "mappings": "AAAA,SAAS,QAAQ,YAAY;AAC7B,SAAS,YAAY,oBAAoB;AACzC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,iBAAiB,oBAAoB;AAC9C,SAAS,qBAAqB,mBAAmB,mBAAmB,0BAA0B;AAU9F,KAAK,SAAS,0DAA0D,MAAM;AAC5E,OAAK,oEAAoE,OAAO,EAAE,QAAQ,MAAM;AAC9F,UAAM,aAAa,MAAM,aAAa,SAAS,OAAO;AACtD,UAAM,EAAE,eAAe,IAAI,gBAAgB,UAAU;AACrD,WAAO,eAAe,QAAQ,6CAA6C,EAAE,gBAAgB,CAAC;AAE9F,UAAM,QAAQ,GAAG,KAAK,IAAI,CAAC;AAC3B,QAAI,SAAwB;AAC5B,QAAI,SAAwB;AAC5B,QAAI,aAA4B;AAEhC,QAAI;AAEF,eAAS,MAAM,kBAAkB,SAAS,YAAY,EAAE,MAAM,mBAAmB,KAAK,GAAG,CAAC;AAC1F,YAAM,mBAAmB,SAAS,YAAY,EAAE,QAAQ,UAAU,CAAC,qBAAqB,EAAE,CAAC;AAE3F,YAAM,QAAQ,mBAAmB,KAAK;AAEtC,YAAM,WAAW;AACjB,eAAS,MAAM,kBAAkB,SAAS,YAAY;AAAA,QACpD;AAAA,QACA;AAAA,QACA;AAAA,QACA,OAAO,CAAC,MAAM;AAAA,QACd,MAAM;AAAA,MACR,CAAC;AACD,YAAM,YAAY,MAAM,aAAa,SAAS,OAAO,QAAQ;AAE7D,mBAAa,MAAM,kBAAkB,SAAS,UAAU;AAIxD,YAAM,eAAe,MAAM,WAAW,SAAS,OAAO,qBAAqB,EAAE,OAAO,UAAU,CAAC;AAC/F,aAAO,aAAa,OAAO,CAAC,EAAE,KAAK,GAAG;AAGtC,YAAM,cAAc,MAAM,WAAW,SAAS,OAAO,qBAAqB;AAAA,QACxE,OAAO;AAAA,QACP,MAAM,EAAE,IAAI,YAAY,MAAM,mBAAmB;AAAA,MACnD,CAAC;AACD,aAAO,YAAY,OAAO,CAAC,EAAE,KAAK,GAAG;AACrC,YAAM,UAAU,MAAM,aAA4B,WAAW;AAC7D,aAAO,SAAS,oBAAoB,CAAC,CAAC,EAAE,UAAU,uBAAuB;AAGzE,YAAM,iBAAiB,MAAM,WAAW,SAAS,UAAU,qBAAqB;AAAA,QAC9E,OAAO;AAAA,QACP,MAAM,EAAE,IAAI,WAAW;AAAA,MACzB,CAAC;AACD,aAAO,eAAe,OAAO,CAAC,EAAE,KAAK,GAAG;AACxC,YAAM,aAAa,MAAM,aAA4B,cAAc;AACnE,aAAO,YAAY,oBAAoB,CAAC,CAAC,EAAE,UAAU,uBAAuB;AAG5E,YAAM,QAAQ,MAAM,mBAAmB,SAAS,YAAY,UAAU;AACtE,aAAO,KAAK,EAAE,IAAI,SAAS;AAC3B,aAAO,MAAO,IAAI,EAAE,IAAI,KAAK,kBAAkB;AAAA,IACjD,UAAE;AACA,YAAM,kBAAkB,SAAS,YAAY,UAAU;AACvD,YAAM,mBAAmB,SAAS,YAAY,MAAM;AACpD,YAAM,mBAAmB,SAAS,YAAY,MAAM;AAAA,IACtD;AAAA,EACF,CAAC;AACH,CAAC;",
+  "names": []
+}

package/dist/modules/scheduler/__integration__/TC-SCHED-007.spec.js

@@ -0,0 +1,36 @@
+import { expect, test } from "@playwright/test";
+import { apiRequest, getAuthToken } from "@open-mercato/core/helpers/integration/api";
+import { readJsonSafe } from "@open-mercato/core/helpers/integration/generalFixtures";
+import { SCHEDULER_EXECUTION_QUEUE, SCHEDULER_JOBS_PATH, uniqueScheduleName } from "./helpers/scheduler.js";
+const invalidCases = [
+  { label: "cron: not a cron expression", scheduleType: "cron", scheduleValue: "not-a-cron" },
+  { label: "cron: too few fields", scheduleType: "cron", scheduleValue: "* * *" },
+  { label: "interval: unsupported unit", scheduleType: "interval", scheduleValue: "15x" },
+  { label: "interval: missing unit", scheduleType: "interval", scheduleValue: "99" }
+];
+test.describe("TC-SCHED-007: POST /api/scheduler/jobs validates schedule value format", () => {
+  for (const testCase of invalidCases) {
+    test(`rejects ${testCase.label} with 400 on scheduleValue`, async ({ request }) => {
+      const token = await getAuthToken(request, "admin");
+      const response = await apiRequest(request, "POST", SCHEDULER_JOBS_PATH, {
+        token,
+        data: {
+          name: uniqueScheduleName("Invalid Schedule Value"),
+          scopeType: "organization",
+          scheduleType: testCase.scheduleType,
+          scheduleValue: testCase.scheduleValue,
+          timezone: "UTC",
+          targetType: "queue",
+          targetQueue: SCHEDULER_EXECUTION_QUEUE,
+          isEnabled: true,
+          sourceType: "user"
+        }
+      });
+      expect(response.status(), `${testCase.label} should be rejected with 400`).toBe(400);
+      const body = await readJsonSafe(response);
+      const issuePaths = (body?.details ?? []).map((issue) => (issue.path ?? []).join("."));
+      expect(issuePaths, `${testCase.label} error should target scheduleValue`).toContain("scheduleValue");
+    });
+  }
+});
+//# sourceMappingURL=TC-SCHED-007.spec.js.map

package/dist/modules/scheduler/__integration__/TC-SCHED-007.spec.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/scheduler/__integration__/TC-SCHED-007.spec.ts"],
+  "sourcesContent": ["import { expect, test } from '@playwright/test'\nimport { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api'\nimport { readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures'\nimport { SCHEDULER_EXECUTION_QUEUE, SCHEDULER_JOBS_PATH, uniqueScheduleName } from './helpers/scheduler'\n\ntype ValidationError = { error?: string; details?: Array<{ path?: Array<string | number> }> }\n\n/**\n * TC-SCHED-007: POST /api/scheduler/jobs rejects invalid cron and interval\n * `scheduleValue`s with 400 and an error scoped to the `scheduleValue` path.\n *\n * Interval format is `<number><unit>` with unit in s|m|h|d, so the inputs below\n * are genuinely malformed (the issue's \"99h\"/\"0m\" drafts are actually valid).\n * All cases are rejected at validation, so no records are created and no\n * teardown is required.\n */\nconst invalidCases = [\n  { label: 'cron: not a cron expression', scheduleType: 'cron' as const, scheduleValue: 'not-a-cron' },\n  { label: 'cron: too few fields', scheduleType: 'cron' as const, scheduleValue: '* * *' },\n  { label: 'interval: unsupported unit', scheduleType: 'interval' as const, scheduleValue: '15x' },\n  { label: 'interval: missing unit', scheduleType: 'interval' as const, scheduleValue: '99' },\n]\n\ntest.describe('TC-SCHED-007: POST /api/scheduler/jobs validates schedule value format', () => {\n  for (const testCase of invalidCases) {\n    test(`rejects ${testCase.label} with 400 on scheduleValue`, async ({ request }) => {\n      const token = await getAuthToken(request, 'admin')\n\n      const response = await apiRequest(request, 'POST', SCHEDULER_JOBS_PATH, {\n        token,\n        data: {\n          name: uniqueScheduleName('Invalid Schedule Value'),\n          scopeType: 'organization',\n          scheduleType: testCase.scheduleType,\n          scheduleValue: testCase.scheduleValue,\n          timezone: 'UTC',\n          targetType: 'queue',\n          targetQueue: SCHEDULER_EXECUTION_QUEUE,\n          isEnabled: true,\n          sourceType: 'user',\n        },\n      })\n\n      expect(response.status(), `${testCase.label} should be rejected with 400`).toBe(400)\n      const body = await readJsonSafe<ValidationError>(response)\n      const issuePaths = (body?.details ?? []).map((issue) => (issue.path ?? []).join('.'))\n      expect(issuePaths, `${testCase.label} error should target scheduleValue`).toContain('scheduleValue')\n    })\n  }\n})\n"],
+  "mappings": "AAAA,SAAS,QAAQ,YAAY;AAC7B,SAAS,YAAY,oBAAoB;AACzC,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B,qBAAqB,0BAA0B;AAanF,MAAM,eAAe;AAAA,EACnB,EAAE,OAAO,+BAA+B,cAAc,QAAiB,eAAe,aAAa;AAAA,EACnG,EAAE,OAAO,wBAAwB,cAAc,QAAiB,eAAe,QAAQ;AAAA,EACvF,EAAE,OAAO,8BAA8B,cAAc,YAAqB,eAAe,MAAM;AAAA,EAC/F,EAAE,OAAO,0BAA0B,cAAc,YAAqB,eAAe,KAAK;AAC5F;AAEA,KAAK,SAAS,0EAA0E,MAAM;AAC5F,aAAW,YAAY,cAAc;AACnC,SAAK,WAAW,SAAS,KAAK,8BAA8B,OAAO,EAAE,QAAQ,MAAM;AACjF,YAAM,QAAQ,MAAM,aAAa,SAAS,OAAO;AAEjD,YAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,qBAAqB;AAAA,QACtE;AAAA,QACA,MAAM;AAAA,UACJ,MAAM,mBAAmB,wBAAwB;AAAA,UACjD,WAAW;AAAA,UACX,cAAc,SAAS;AAAA,UACvB,eAAe,SAAS;AAAA,UACxB,UAAU;AAAA,UACV,YAAY;AAAA,UACZ,aAAa;AAAA,UACb,WAAW;AAAA,UACX,YAAY;AAAA,QACd;AAAA,MACF,CAAC;AAED,aAAO,SAAS,OAAO,GAAG,GAAG,SAAS,KAAK,8BAA8B,EAAE,KAAK,GAAG;AACnF,YAAM,OAAO,MAAM,aAA8B,QAAQ;AACzD,YAAM,cAAc,MAAM,WAAW,CAAC,GAAG,IAAI,CAAC,WAAW,MAAM,QAAQ,CAAC,GAAG,KAAK,GAAG,CAAC;AACpF,aAAO,YAAY,GAAG,SAAS,KAAK,oCAAoC,EAAE,UAAU,eAAe;AAAA,IACrG,CAAC;AAAA,EACH;AACF,CAAC;",
+  "names": []
+}

package/dist/modules/scheduler/__integration__/helpers/scheduler.js

@@ -0,0 +1,59 @@
+import { expect } from "@playwright/test";
+import { apiRequest } from "@open-mercato/core/helpers/integration/api";
+import { readJsonSafe } from "@open-mercato/core/helpers/integration/generalFixtures";
+const SCHEDULER_JOBS_PATH = "/api/scheduler/jobs";
+const SCHEDULER_TARGETS_PATH = "/api/scheduler/targets";
+const SCHEDULER_TRIGGER_PATH = "/api/scheduler/trigger";
+const SCHEDULER_EXECUTION_QUEUE = "scheduler-execution";
+let sequence = 0;
+function uniqueScheduleName(prefix) {
+  sequence += 1;
+  return `${prefix} ${Date.now()}-${sequence}`;
+}
+async function createScheduleJob(request, token, overrides = {}) {
+  const targetType = overrides.targetType ?? "queue";
+  const data = {
+    name: overrides.name ?? uniqueScheduleName("Integration Scheduler"),
+    description: overrides.description ?? "Created by scheduler integration tests",
+    scopeType: overrides.scopeType ?? "organization",
+    scheduleType: overrides.scheduleType ?? "interval",
+    scheduleValue: overrides.scheduleValue ?? "15m",
+    timezone: overrides.timezone ?? "UTC",
+    targetType,
+    targetPayload: overrides.targetPayload ?? { source: "integration-test" },
+    isEnabled: overrides.isEnabled ?? true,
+    sourceType: overrides.sourceType ?? "user"
+  };
+  if (targetType === "command") {
+    data.targetCommand = overrides.targetCommand;
+  } else {
+    data.targetQueue = overrides.targetQueue ?? SCHEDULER_EXECUTION_QUEUE;
+  }
+  const response = await apiRequest(request, "POST", SCHEDULER_JOBS_PATH, { token, data });
+  const body = await readJsonSafe(response);
+  expect(response.status(), "POST /api/scheduler/jobs should return 201").toBe(201);
+  const id = body?.id;
+  expect(typeof id === "string" && /^[0-9a-f-]{36}$/i.test(id), "create response should include a UUID id").toBe(true);
+  return String(id);
+}
+async function getScheduleJobById(request, token, id) {
+  const response = await apiRequest(request, "GET", `${SCHEDULER_JOBS_PATH}?id=${encodeURIComponent(id)}`, { token });
+  expect(response.status(), "GET /api/scheduler/jobs?id should return 200").toBe(200);
+  const body = await readJsonSafe(response);
+  return (body?.items ?? []).find((item) => item.id === id) ?? null;
+}
+async function deleteScheduleJob(request, token, id) {
+  if (!id) return;
+  await apiRequest(request, "DELETE", SCHEDULER_JOBS_PATH, { token, data: { id } }).catch(() => null);
+}
+export {
+  SCHEDULER_EXECUTION_QUEUE,
+  SCHEDULER_JOBS_PATH,
+  SCHEDULER_TARGETS_PATH,
+  SCHEDULER_TRIGGER_PATH,
+  createScheduleJob,
+  deleteScheduleJob,
+  getScheduleJobById,
+  uniqueScheduleName
+};
+//# sourceMappingURL=scheduler.js.map

package/dist/modules/scheduler/__integration__/helpers/scheduler.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/scheduler/__integration__/helpers/scheduler.ts"],
+  "sourcesContent": ["import { expect, type APIRequestContext } from '@playwright/test'\nimport { apiRequest } from '@open-mercato/core/helpers/integration/api'\nimport { readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures'\n\nexport const SCHEDULER_JOBS_PATH = '/api/scheduler/jobs'\nexport const SCHEDULER_TARGETS_PATH = '/api/scheduler/targets'\nexport const SCHEDULER_TRIGGER_PATH = '/api/scheduler/trigger'\n\n/** Queue registered by the scheduler module's execute-schedule worker. */\nexport const SCHEDULER_EXECUTION_QUEUE = 'scheduler-execution'\n\nexport type SchedulerJob = {\n  id: string\n  name: string\n  description: string | null\n  scopeType: 'system' | 'organization' | 'tenant'\n  organizationId: string | null\n  tenantId: string | null\n  scheduleType: 'cron' | 'interval'\n  scheduleValue: string\n  timezone: string\n  targetType: 'queue' | 'command'\n  targetQueue: string | null\n  targetCommand: string | null\n  isEnabled: boolean\n  createdAt: string | null\n  updatedAt: string | null\n}\n\nexport type CreateScheduleOverrides = {\n  name?: string\n  description?: string | null\n  scopeType?: 'system' | 'organization' | 'tenant'\n  scheduleType?: 'cron' | 'interval'\n  scheduleValue?: string\n  timezone?: string\n  targetType?: 'queue' | 'command'\n  targetQueue?: string\n  targetCommand?: string\n  targetPayload?: Record<string, unknown>\n  isEnabled?: boolean\n  sourceType?: 'user' | 'module'\n}\n\nlet sequence = 0\n\n/** Stable-ish unique label so concurrent fixtures never collide on name. */\nexport function uniqueScheduleName(prefix: string): string {\n  sequence += 1\n  return `${prefix} ${Date.now()}-${sequence}`\n}\n\n/**\n * Create an organization-scoped queue-target schedule via the API and return its id.\n * Org/tenant are derived server-side from the caller's auth context, so the caller\n * only needs an admin (or otherwise scheduler.jobs.manage) token.\n */\nexport async function createScheduleJob(\n  request: APIRequestContext,\n  token: string,\n  overrides: CreateScheduleOverrides = {},\n): Promise<string> {\n  const targetType = overrides.targetType ?? 'queue'\n  const data: Record<string, unknown> = {\n    name: overrides.name ?? uniqueScheduleName('Integration Scheduler'),\n    description: overrides.description ?? 'Created by scheduler integration tests',\n    scopeType: overrides.scopeType ?? 'organization',\n    scheduleType: overrides.scheduleType ?? 'interval',\n    scheduleValue: overrides.scheduleValue ?? '15m',\n    timezone: overrides.timezone ?? 'UTC',\n    targetType,\n    targetPayload: overrides.targetPayload ?? { source: 'integration-test' },\n    isEnabled: overrides.isEnabled ?? true,\n    sourceType: overrides.sourceType ?? 'user',\n  }\n  if (targetType === 'command') {\n    data.targetCommand = overrides.targetCommand\n  } else {\n    data.targetQueue = overrides.targetQueue ?? SCHEDULER_EXECUTION_QUEUE\n  }\n\n  const response = await apiRequest(request, 'POST', SCHEDULER_JOBS_PATH, { token, data })\n  const body = await readJsonSafe<{ id?: string }>(response)\n  expect(response.status(), 'POST /api/scheduler/jobs should return 201').toBe(201)\n  const id = body?.id\n  expect(typeof id === 'string' && /^[0-9a-f-]{36}$/i.test(id), 'create response should include a UUID id').toBe(true)\n  return String(id)\n}\n\n/** Fetch a single schedule by id from the list endpoint; null when absent (e.g. soft-deleted). */\nexport async function getScheduleJobById(\n  request: APIRequestContext,\n  token: string,\n  id: string,\n): Promise<SchedulerJob | null> {\n  const response = await apiRequest(request, 'GET', `${SCHEDULER_JOBS_PATH}?id=${encodeURIComponent(id)}`, { token })\n  expect(response.status(), 'GET /api/scheduler/jobs?id should return 200').toBe(200)\n  const body = await readJsonSafe<{ items?: SchedulerJob[] }>(response)\n  return (body?.items ?? []).find((item) => item.id === id) ?? null\n}\n\n/** Best-effort cleanup; swallows errors so teardown never masks the real assertion. */\nexport async function deleteScheduleJob(\n  request: APIRequestContext,\n  token: string,\n  id: string | null,\n): Promise<void> {\n  if (!id) return\n  await apiRequest(request, 'DELETE', SCHEDULER_JOBS_PATH, { token, data: { id } }).catch(() => null)\n}\n"],
+  "mappings": "AAAA,SAAS,cAAsC;AAC/C,SAAS,kBAAkB;AAC3B,SAAS,oBAAoB;AAEtB,MAAM,sBAAsB;AAC5B,MAAM,yBAAyB;AAC/B,MAAM,yBAAyB;AAG/B,MAAM,4BAA4B;AAmCzC,IAAI,WAAW;AAGR,SAAS,mBAAmB,QAAwB;AACzD,cAAY;AACZ,SAAO,GAAG,MAAM,IAAI,KAAK,IAAI,CAAC,IAAI,QAAQ;AAC5C;AAOA,eAAsB,kBACpB,SACA,OACA,YAAqC,CAAC,GACrB;AACjB,QAAM,aAAa,UAAU,cAAc;AAC3C,QAAM,OAAgC;AAAA,IACpC,MAAM,UAAU,QAAQ,mBAAmB,uBAAuB;AAAA,IAClE,aAAa,UAAU,eAAe;AAAA,IACtC,WAAW,UAAU,aAAa;AAAA,IAClC,cAAc,UAAU,gBAAgB;AAAA,IACxC,eAAe,UAAU,iBAAiB;AAAA,IAC1C,UAAU,UAAU,YAAY;AAAA,IAChC;AAAA,IACA,eAAe,UAAU,iBAAiB,EAAE,QAAQ,mBAAmB;AAAA,IACvE,WAAW,UAAU,aAAa;AAAA,IAClC,YAAY,UAAU,cAAc;AAAA,EACtC;AACA,MAAI,eAAe,WAAW;AAC5B,SAAK,gBAAgB,UAAU;AAAA,EACjC,OAAO;AACL,SAAK,cAAc,UAAU,eAAe;AAAA,EAC9C;AAEA,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,qBAAqB,EAAE,OAAO,KAAK,CAAC;AACvF,QAAM,OAAO,MAAM,aAA8B,QAAQ;AACzD,SAAO,SAAS,OAAO,GAAG,4CAA4C,EAAE,KAAK,GAAG;AAChF,QAAM,KAAK,MAAM;AACjB,SAAO,OAAO,OAAO,YAAY,mBAAmB,KAAK,EAAE,GAAG,0CAA0C,EAAE,KAAK,IAAI;AACnH,SAAO,OAAO,EAAE;AAClB;AAGA,eAAsB,mBACpB,SACA,OACA,IAC8B;AAC9B,QAAM,WAAW,MAAM,WAAW,SAAS,OAAO,GAAG,mBAAmB,OAAO,mBAAmB,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC;AAClH,SAAO,SAAS,OAAO,GAAG,8CAA8C,EAAE,KAAK,GAAG;AAClF,QAAM,OAAO,MAAM,aAAyC,QAAQ;AACpE,UAAQ,MAAM,SAAS,CAAC,GAAG,KAAK,CAAC,SAAS,KAAK,OAAO,EAAE,KAAK;AAC/D;AAGA,eAAsB,kBACpB,SACA,OACA,IACe;AACf,MAAI,CAAC,GAAI;AACT,QAAM,WAAW,SAAS,UAAU,qBAAqB,EAAE,OAAO,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,MAAM,IAAI;AACpG;",
+  "names": []
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/scheduler",
-  "version": "0.6.5-develop.4588.1.ecaa16cfc0",
+  "version": "0.6.5-develop.4620.1.c20bc7e4bb",
   "description": "Database-managed scheduled jobs with admin UI",
   "type": "module",
   "main": "./dist/index.js",
@@ -58,13 +58,13 @@
     "./*/*/*/*/*/*.json": "./src/*/*/*/*/*/*.json"
   },
   "dependencies": {
-    "@open-mercato/events": "0.6.5-develop.4588.1.ecaa16cfc0",
-    "@open-mercato/queue": "0.6.5-develop.4588.1.ecaa16cfc0",
+    "@open-mercato/events": "0.6.5-develop.4620.1.c20bc7e4bb",
+    "@open-mercato/queue": "0.6.5-develop.4620.1.c20bc7e4bb",
     "cron-parser": "^5.5.0"
   },
   "peerDependencies": {
     "@mikro-orm/core": "^7.0.14",
-    "@open-mercato/shared": "0.6.5-develop.4588.1.ecaa16cfc0",
+    "@open-mercato/shared": "0.6.5-develop.4620.1.c20bc7e4bb",
     "bullmq": "^5.0.0",
     "ioredis": "^5.0.0",
     "zod": ">=3.23.0"
@@ -78,7 +78,7 @@
     }
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.6.5-develop.4588.1.ecaa16cfc0",
+    "@open-mercato/shared": "0.6.5-develop.4620.1.c20bc7e4bb",
     "@types/jest": "^30.0.0",
     "@types/node": "^25.9.1",
     "jest": "^30.4.2",

package/src/modules/scheduler/__integration__/TC-SCHED-002.spec.ts

@@ -0,0 +1,63 @@
+import { expect, test } from '@playwright/test'
+import { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api'
+import { readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures'
+import {
+  SCHEDULER_JOBS_PATH,
+  createScheduleJob,
+  deleteScheduleJob,
+  getScheduleJobById,
+  uniqueScheduleName,
+} from './helpers/scheduler'
+
+/**
+ * TC-SCHED-002: PUT /api/scheduler/jobs updates schedule fields correctly
+ *
+ * Note: scheduleUpdateSchema requires `scheduleType` whenever `scheduleValue`
+ * changes, so the update payload sends both (the issue's draft omitted the
+ * type — the route rejects that with 400). This asserts the real contract.
+ */
+test.describe('TC-SCHED-002: PUT /api/scheduler/jobs updates schedule fields', () => {
+  test('updates name and scheduleValue while preserving identity and scope', async ({ request }) => {
+    const token = await getAuthToken(request, 'admin')
+    let scheduleId: string | null = null
+
+    try {
+      scheduleId = await createScheduleJob(request, token, {
+        name: uniqueScheduleName('Sched Update'),
+        scheduleType: 'interval',
+        scheduleValue: '15m',
+      })
+
+      const original = await getScheduleJobById(request, token, scheduleId)
+      expect(original).not.toBeNull()
+      expect(original!.scheduleValue).toBe('15m')
+
+      const updateResponse = await apiRequest(request, 'PUT', SCHEDULER_JOBS_PATH, {
+        token,
+        data: { id: scheduleId, name: 'Updated-Test-1', scheduleType: 'interval', scheduleValue: '30m' },
+      })
+      expect(updateResponse.status()).toBe(200)
+      const updateBody = await readJsonSafe<{ ok?: boolean }>(updateResponse)
+      expect(updateBody?.ok).toBe(true)
+
+      const updated = await getScheduleJobById(request, token, scheduleId)
+      expect(updated).not.toBeNull()
+      // Mutated fields persisted
+      expect(updated!.name).toBe('Updated-Test-1')
+      expect(updated!.scheduleValue).toBe('30m')
+      // Identity and scope unchanged
+      expect(updated!.id).toBe(scheduleId)
+      expect(updated!.tenantId).toBe(original!.tenantId)
+      expect(updated!.organizationId).toBe(original!.organizationId)
+      expect(updated!.targetQueue).toBe(original!.targetQueue)
+      // updatedAt advances past the original creation timestamp
+      if (original!.createdAt && updated!.updatedAt) {
+        expect(new Date(updated!.updatedAt).getTime()).toBeGreaterThanOrEqual(
+          new Date(original!.createdAt).getTime(),
+        )
+      }
+    } finally {
+      await deleteScheduleJob(request, token, scheduleId)
+    }
+  })
+})

package/src/modules/scheduler/__integration__/TC-SCHED-003.spec.ts

@@ -0,0 +1,48 @@
+import { expect, test } from '@playwright/test'
+import { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api'
+import { readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures'
+import { SCHEDULER_JOBS_PATH, createScheduleJob, deleteScheduleJob, getScheduleJobById } from './helpers/scheduler'
+
+/**
+ * TC-SCHED-003: DELETE /api/scheduler/jobs soft-deletes a schedule and
+ * prevents re-listing. The list endpoint keeps returning 200 (not 404) with
+ * the soft-deleted record filtered out by the `deletedAt` soft-delete field.
+ */
+test.describe('TC-SCHED-003: DELETE /api/scheduler/jobs soft-deletes a schedule', () => {
+  test('removes the schedule from listings and returns 200 (not 404) afterwards', async ({ request }) => {
+    const token = await getAuthToken(request, 'admin')
+    let scheduleId: string | null = null
+    let deleted = false
+
+    try {
+      scheduleId = await createScheduleJob(request, token)
+
+      const present = await getScheduleJobById(request, token, scheduleId)
+      expect(present).not.toBeNull()
+
+      const deleteResponse = await apiRequest(request, 'DELETE', SCHEDULER_JOBS_PATH, {
+        token,
+        data: { id: scheduleId },
+      })
+      expect(deleteResponse.status()).toBe(200)
+      const deleteBody = await readJsonSafe<{ ok?: boolean }>(deleteResponse)
+      expect(deleteBody?.ok).toBe(true)
+      deleted = true
+
+      // Soft delete: list still returns 200 with an (empty) items array, never 404.
+      const afterResponse = await apiRequest(
+        request,
+        'GET',
+        `${SCHEDULER_JOBS_PATH}?id=${encodeURIComponent(scheduleId)}`,
+        { token },
+      )
+      expect(afterResponse.status()).toBe(200)
+      const afterBody = await readJsonSafe<{ items?: Array<{ id: string }> }>(afterResponse)
+      expect(Array.isArray(afterBody?.items)).toBe(true)
+      expect((afterBody?.items ?? []).some((item) => item.id === scheduleId)).toBe(false)
+      expect((afterBody?.items ?? []).length).toBe(0)
+    } finally {
+      if (!deleted) await deleteScheduleJob(request, token, scheduleId)
+    }
+  })
+})

package/src/modules/scheduler/__integration__/TC-SCHED-004.spec.ts

@@ -0,0 +1,52 @@
+import { expect, test } from '@playwright/test'
+import { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api'
+import { readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures'
+import { SCHEDULER_EXECUTION_QUEUE, SCHEDULER_TARGETS_PATH } from './helpers/scheduler'
+
+type TargetOption = { value: string; label: string }
+type TargetsResponse = { queues?: TargetOption[]; commands?: TargetOption[] }
+
+function expectSortedByValue(options: TargetOption[], label: string) {
+  const values = options.map((option) => option.value)
+  expect(values, `${label} should be sorted alphabetically by value`).toEqual(
+    [...values].sort((a, b) => a.localeCompare(b)),
+  )
+}
+
+function expectOptionShape(options: TargetOption[], label: string) {
+  for (const option of options) {
+    expect(typeof option.value, `${label} option value should be a string`).toBe('string')
+    expect(typeof option.label, `${label} option label should be a string`).toBe('string')
+  }
+}
+
+/**
+ * TC-SCHED-004: GET /api/scheduler/targets returns available queue names
+ * (from module workers) and registered command IDs (from the command
+ * registry), both sorted alphabetically by value. Read-only, no fixtures.
+ */
+test.describe('TC-SCHED-004: GET /api/scheduler/targets lists queues and commands', () => {
+  test('returns sorted queues (incl. scheduler-execution) and a non-empty command list', async ({ request }) => {
+    const token = await getAuthToken(request, 'admin')
+
+    const response = await apiRequest(request, 'GET', SCHEDULER_TARGETS_PATH, { token })
+    expect(response.status()).toBe(200)
+
+    const body = await readJsonSafe<TargetsResponse>(response)
+    const queues = body?.queues ?? []
+    const commands = body?.commands ?? []
+
+    // Queues: non-empty, well-shaped, sorted, and include the known scheduler queue.
+    expect(Array.isArray(body?.queues)).toBe(true)
+    expect(queues.length).toBeGreaterThan(0)
+    expectOptionShape(queues, 'queues')
+    expect(queues.map((queue) => queue.value)).toContain(SCHEDULER_EXECUTION_QUEUE)
+    expectSortedByValue(queues, 'queues')
+
+    // Commands: non-empty, well-shaped, and sorted.
+    expect(Array.isArray(body?.commands)).toBe(true)
+    expect(commands.length).toBeGreaterThan(0)
+    expectOptionShape(commands, 'commands')
+    expectSortedByValue(commands, 'commands')
+  })
+})

package/src/modules/scheduler/__integration__/TC-SCHED-005.spec.ts

@@ -0,0 +1,51 @@
+import { expect, test } from '@playwright/test'
+import { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api'
+import { readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures'
+import {
+  SCHEDULER_TRIGGER_PATH,
+  createScheduleJob,
+  deleteScheduleJob,
+  uniqueScheduleName,
+} from './helpers/scheduler'
+
+const isAsyncQueueStrategy = (process.env.QUEUE_STRATEGY || 'local') === 'async'
+
+/**
+ * TC-SCHED-005: POST /api/scheduler/trigger manually enqueues a schedule for
+ * execution. Manual triggers require the async (BullMQ) queue strategy, so the
+ * assertion branches on QUEUE_STRATEGY exactly like TC-SCHED-001: async returns
+ * 200 + jobId, local returns 400 with an "async required" message.
+ */
+test.describe('TC-SCHED-005: POST /api/scheduler/trigger manual execution', () => {
+  test('enqueues an execution job (async) or rejects with async-required (local)', async ({ request }) => {
+    const token = await getAuthToken(request, 'admin')
+    let scheduleId: string | null = null
+
+    try {
+      scheduleId = await createScheduleJob(request, token, {
+        name: uniqueScheduleName('Trigger-Test'),
+        scheduleType: 'interval',
+        scheduleValue: '1h',
+      })
+
+      const response = await apiRequest(request, 'POST', SCHEDULER_TRIGGER_PATH, {
+        token,
+        data: { id: scheduleId },
+      })
+
+      if (isAsyncQueueStrategy) {
+        expect(response.status()).toBe(200)
+        const body = await readJsonSafe<{ ok?: boolean; jobId?: string; message?: string }>(response)
+        expect(body?.ok).toBe(true)
+        expect(typeof body?.jobId === 'string' && (body?.jobId?.length ?? 0) > 0).toBe(true)
+        expect(body?.message ?? '').toMatch(/queued|triggered/i)
+      } else {
+        expect(response.status()).toBe(400)
+        const body = await readJsonSafe<{ error?: string; message?: string }>(response)
+        expect(`${body?.error ?? ''} ${body?.message ?? ''}`).toMatch(/async/i)
+      }
+    } finally {
+      await deleteScheduleJob(request, token, scheduleId)
+    }
+  })
+})

package/src/modules/scheduler/__integration__/TC-SCHED-006.spec.ts

@@ -0,0 +1,84 @@
+import { expect, test } from '@playwright/test'
+import { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api'
+import {
+  createRoleFixture,
+  createUserFixture,
+  deleteRoleIfExists,
+  deleteUserIfExists,
+  setRoleAclFeatures,
+} from '@open-mercato/core/helpers/integration/authFixtures'
+import { getTokenContext, readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures'
+import { SCHEDULER_JOBS_PATH, createScheduleJob, deleteScheduleJob, getScheduleJobById } from './helpers/scheduler'
+
+type ForbiddenBody = { error?: string; requiredFeatures?: string[] }
+
+/**
+ * TC-SCHED-006: PUT and DELETE on /api/scheduler/jobs are gated by
+ * `scheduler.jobs.manage`. A user holding only `scheduler.jobs.view` can read
+ * schedules but is denied with 403 on both mutating verbs, and a failed attempt
+ * leaves the schedule untouched.
+ */
+test.describe('TC-SCHED-006: scheduler.jobs.manage gate on PUT/DELETE', () => {
+  test('view-only user gets 403 on PUT and DELETE; schedule stays intact', async ({ request }) => {
+    const adminToken = await getAuthToken(request, 'admin')
+    const { organizationId } = getTokenContext(adminToken)
+    expect(organizationId.length, 'admin token should carry an organization id').toBeGreaterThan(0)
+
+    const stamp = `${Date.now()}`
+    let roleId: string | null = null
+    let userId: string | null = null
+    let scheduleId: string | null = null
+
+    try {
+      // A role that can view schedules but not manage them.
+      roleId = await createRoleFixture(request, adminToken, { name: `sched-view-only-${stamp}` })
+      await setRoleAclFeatures(request, adminToken, { roleId, features: ['scheduler.jobs.view'] })
+
+      const email = `sched-view-only-${stamp}@example.com`
+      // Password must satisfy the default policy (min length + digit + uppercase + special).
+      const password = 'Sched-View-1!'
+      userId = await createUserFixture(request, adminToken, {
+        email,
+        password,
+        organizationId,
+        roles: [roleId],
+        name: 'Scheduler View Only',
+      })
+      const viewToken = await getAuthToken(request, email, password)
+
+      scheduleId = await createScheduleJob(request, adminToken)
+
+      // Sanity: the view-only user authenticates and CAN list (has the view feature),
+      // so the 403s below are specifically about the missing manage feature.
+      const listResponse = await apiRequest(request, 'GET', SCHEDULER_JOBS_PATH, { token: viewToken })
+      expect(listResponse.status()).toBe(200)
+
+      // PUT denied
+      const putResponse = await apiRequest(request, 'PUT', SCHEDULER_JOBS_PATH, {
+        token: viewToken,
+        data: { id: scheduleId, name: 'Should-Not-Apply' },
+      })
+      expect(putResponse.status()).toBe(403)
+      const putBody = await readJsonSafe<ForbiddenBody>(putResponse)
+      expect(putBody?.requiredFeatures ?? []).toContain('scheduler.jobs.manage')
+
+      // DELETE denied
+      const deleteResponse = await apiRequest(request, 'DELETE', SCHEDULER_JOBS_PATH, {
+        token: viewToken,
+        data: { id: scheduleId },
+      })
+      expect(deleteResponse.status()).toBe(403)
+      const deleteBody = await readJsonSafe<ForbiddenBody>(deleteResponse)
+      expect(deleteBody?.requiredFeatures ?? []).toContain('scheduler.jobs.manage')
+
+      // The schedule is unchanged and still present (admin can read it).
+      const after = await getScheduleJobById(request, adminToken, scheduleId)
+      expect(after).not.toBeNull()
+      expect(after!.name).not.toBe('Should-Not-Apply')
+    } finally {
+      await deleteScheduleJob(request, adminToken, scheduleId)
+      await deleteUserIfExists(request, adminToken, userId)
+      await deleteRoleIfExists(request, adminToken, roleId)
+    }
+  })
+})

package/src/modules/scheduler/__integration__/TC-SCHED-007.spec.ts

@@ -0,0 +1,50 @@
+import { expect, test } from '@playwright/test'
+import { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api'
+import { readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures'
+import { SCHEDULER_EXECUTION_QUEUE, SCHEDULER_JOBS_PATH, uniqueScheduleName } from './helpers/scheduler'
+
+type ValidationError = { error?: string; details?: Array<{ path?: Array<string | number> }> }
+
+/**
+ * TC-SCHED-007: POST /api/scheduler/jobs rejects invalid cron and interval
+ * `scheduleValue`s with 400 and an error scoped to the `scheduleValue` path.
+ *
+ * Interval format is `<number><unit>` with unit in s|m|h|d, so the inputs below
+ * are genuinely malformed (the issue's "99h"/"0m" drafts are actually valid).
+ * All cases are rejected at validation, so no records are created and no
+ * teardown is required.
+ */
+const invalidCases = [
+  { label: 'cron: not a cron expression', scheduleType: 'cron' as const, scheduleValue: 'not-a-cron' },
+  { label: 'cron: too few fields', scheduleType: 'cron' as const, scheduleValue: '* * *' },
+  { label: 'interval: unsupported unit', scheduleType: 'interval' as const, scheduleValue: '15x' },
+  { label: 'interval: missing unit', scheduleType: 'interval' as const, scheduleValue: '99' },
+]
+
+test.describe('TC-SCHED-007: POST /api/scheduler/jobs validates schedule value format', () => {
+  for (const testCase of invalidCases) {
+    test(`rejects ${testCase.label} with 400 on scheduleValue`, async ({ request }) => {
+      const token = await getAuthToken(request, 'admin')
+
+      const response = await apiRequest(request, 'POST', SCHEDULER_JOBS_PATH, {
+        token,
+        data: {
+          name: uniqueScheduleName('Invalid Schedule Value'),
+          scopeType: 'organization',
+          scheduleType: testCase.scheduleType,
+          scheduleValue: testCase.scheduleValue,
+          timezone: 'UTC',
+          targetType: 'queue',
+          targetQueue: SCHEDULER_EXECUTION_QUEUE,
+          isEnabled: true,
+          sourceType: 'user',
+        },
+      })
+
+      expect(response.status(), `${testCase.label} should be rejected with 400`).toBe(400)
+      const body = await readJsonSafe<ValidationError>(response)
+      const issuePaths = (body?.details ?? []).map((issue) => (issue.path ?? []).join('.'))
+      expect(issuePaths, `${testCase.label} error should target scheduleValue`).toContain('scheduleValue')
+    })
+  }
+})

package/src/modules/scheduler/__integration__/helpers/scheduler.ts

@@ -0,0 +1,110 @@
+import { expect, type APIRequestContext } from '@playwright/test'
+import { apiRequest } from '@open-mercato/core/helpers/integration/api'
+import { readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures'
+
+export const SCHEDULER_JOBS_PATH = '/api/scheduler/jobs'
+export const SCHEDULER_TARGETS_PATH = '/api/scheduler/targets'
+export const SCHEDULER_TRIGGER_PATH = '/api/scheduler/trigger'
+
+/** Queue registered by the scheduler module's execute-schedule worker. */
+export const SCHEDULER_EXECUTION_QUEUE = 'scheduler-execution'
+
+export type SchedulerJob = {
+  id: string
+  name: string
+  description: string | null
+  scopeType: 'system' | 'organization' | 'tenant'
+  organizationId: string | null
+  tenantId: string | null
+  scheduleType: 'cron' | 'interval'
+  scheduleValue: string
+  timezone: string
+  targetType: 'queue' | 'command'
+  targetQueue: string | null
+  targetCommand: string | null
+  isEnabled: boolean
+  createdAt: string | null
+  updatedAt: string | null
+}
+
+export type CreateScheduleOverrides = {
+  name?: string
+  description?: string | null
+  scopeType?: 'system' | 'organization' | 'tenant'
+  scheduleType?: 'cron' | 'interval'
+  scheduleValue?: string
+  timezone?: string
+  targetType?: 'queue' | 'command'
+  targetQueue?: string
+  targetCommand?: string
+  targetPayload?: Record<string, unknown>
+  isEnabled?: boolean
+  sourceType?: 'user' | 'module'
+}
+
+let sequence = 0
+
+/** Stable-ish unique label so concurrent fixtures never collide on name. */
+export function uniqueScheduleName(prefix: string): string {
+  sequence += 1
+  return `${prefix} ${Date.now()}-${sequence}`
+}
+
+/**
+ * Create an organization-scoped queue-target schedule via the API and return its id.
+ * Org/tenant are derived server-side from the caller's auth context, so the caller
+ * only needs an admin (or otherwise scheduler.jobs.manage) token.
+ */
+export async function createScheduleJob(
+  request: APIRequestContext,
+  token: string,
+  overrides: CreateScheduleOverrides = {},
+): Promise<string> {
+  const targetType = overrides.targetType ?? 'queue'
+  const data: Record<string, unknown> = {
+    name: overrides.name ?? uniqueScheduleName('Integration Scheduler'),
+    description: overrides.description ?? 'Created by scheduler integration tests',
+    scopeType: overrides.scopeType ?? 'organization',
+    scheduleType: overrides.scheduleType ?? 'interval',
+    scheduleValue: overrides.scheduleValue ?? '15m',
+    timezone: overrides.timezone ?? 'UTC',
+    targetType,
+    targetPayload: overrides.targetPayload ?? { source: 'integration-test' },
+    isEnabled: overrides.isEnabled ?? true,
+    sourceType: overrides.sourceType ?? 'user',
+  }
+  if (targetType === 'command') {
+    data.targetCommand = overrides.targetCommand
+  } else {
+    data.targetQueue = overrides.targetQueue ?? SCHEDULER_EXECUTION_QUEUE
+  }
+
+  const response = await apiRequest(request, 'POST', SCHEDULER_JOBS_PATH, { token, data })
+  const body = await readJsonSafe<{ id?: string }>(response)
+  expect(response.status(), 'POST /api/scheduler/jobs should return 201').toBe(201)
+  const id = body?.id
+  expect(typeof id === 'string' && /^[0-9a-f-]{36}$/i.test(id), 'create response should include a UUID id').toBe(true)
+  return String(id)
+}
+
+/** Fetch a single schedule by id from the list endpoint; null when absent (e.g. soft-deleted). */
+export async function getScheduleJobById(
+  request: APIRequestContext,
+  token: string,
+  id: string,
+): Promise<SchedulerJob | null> {
+  const response = await apiRequest(request, 'GET', `${SCHEDULER_JOBS_PATH}?id=${encodeURIComponent(id)}`, { token })
+  expect(response.status(), 'GET /api/scheduler/jobs?id should return 200').toBe(200)
+  const body = await readJsonSafe<{ items?: SchedulerJob[] }>(response)
+  return (body?.items ?? []).find((item) => item.id === id) ?? null
+}
+
+/** Best-effort cleanup; swallows errors so teardown never masks the real assertion. */
+export async function deleteScheduleJob(
+  request: APIRequestContext,
+  token: string,
+  id: string | null,
+): Promise<void> {
+  if (!id) return
+  await apiRequest(request, 'DELETE', SCHEDULER_JOBS_PATH, { token, data: { id } }).catch(() => null)
+}