@open-mercato/scheduler 0.6.8-develop.7066.1.6bfa9ff69f → 0.6.8-develop.7067.1.82e9867ea1

package/dist/modules/scheduler/workers/execute-schedule.worker.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/scheduler/workers/execute-schedule.worker.ts"],
-  "sourcesContent": ["import type { QueuedJob, JobContext, WorkerMeta } from '@open-mercato/queue'\nimport { createQueue } from '@open-mercato/queue'\nimport { getRedisUrlOrThrow } from '@open-mercato/shared/lib/redis/connection'\nimport type { EntityManager } from '@mikro-orm/core'\nimport { ScheduledJob } from '../data/entities.js'\nimport { CommandBus } from '@open-mercato/shared/lib/commands'\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport { emitSchedulerEvent } from '../events.js'\nimport { assertSchedulerSafeCommandAuthorized } from '../lib/scheduler-safe-commands.js'\nimport { buildScheduledCommandContext } from '../lib/commandContext.js'\nimport { buildQueueTargetPayload, buildSchedulerIdempotencyKey } from '../lib/queueTargetPayload.js'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('scheduler').child({ component: 'worker' })\n\n// Worker metadata for auto-discovery\nexport const metadata: WorkerMeta = {\n  queue: 'scheduler-execution',\n  concurrency: 5, // Process up to 5 schedules concurrently\n}\n\nexport type ExecuteSchedulePayload = {\n  scheduleId: string\n  tenantId?: string | null\n  organizationId?: string | null\n  scopeType: 'system' | 'organization' | 'tenant'\n  triggerType?: 'scheduled' | 'manual'\n  triggeredByUserId?: string | null\n}\n\ntype HandlerContext = { resolve: <T = unknown>(name: string) => T }\ntype RbacServiceLike = {\n  tenantHasFeature(\n    tenantId: string | null | undefined,\n    feature: string,\n    opts?: { organizationId?: string | null },\n  ): Promise<boolean>\n  userHasAllFeatures(\n    userId: string,\n    required: readonly string[],\n    scope: { tenantId: string | null; organizationId: string | null },\n  ): Promise<boolean>\n}\n\n/**\n * Worker that executes scheduled jobs.\n * \n * This worker is triggered by BullMQ repeatable jobs at the scheduled times.\n * It loads the fresh schedule configuration from the database, validates\n * conditions, and enqueues the target job or executes the command.\n * \n * BullMQ handles:\n * - Timing (exact cron/interval execution)\n * - Distributed locking (prevents duplicate execution)\n * - Retries (if worker fails)\n * - Execution history (via job state, logs, timestamps)\n * \n * This worker handles:\n * - Loading fresh schedule config\n * - Checking feature flags and conditions\n * - Enqueuing target job or executing command\n * - Updating last run time\n */\nexport default async function executeScheduleWorker(\n  job: QueuedJob<ExecuteSchedulePayload>,\n  ctx: JobContext & HandlerContext,\n): Promise<void> {\n  logger.debug('Processing job', {\n    jobId: ctx.jobId,\n    attemptNumber: ctx.attemptNumber,\n  })\n  \n  // Defensive: handle both data and payload for BullMQ compatibility\n  const payload = (job.payload || (job as unknown as { data?: ExecuteSchedulePayload }).data) as ExecuteSchedulePayload | undefined\n  \n  if (!payload || !payload.scheduleId) {\n    logger.error('Invalid job payload: scheduleId missing', { jobId: ctx.jobId })\n    throw new Error('scheduleId is required in job payload')\n  }\n\n  const { scheduleId } = payload\n\n  const em = ctx.resolve<EntityManager>('em')\n  const rbacService = ctx.resolve<RbacServiceLike>('rbacService')\n\n  // Load fresh schedule from database\n  const schedule = await em.findOne(ScheduledJob, { \n    id: scheduleId,\n    deletedAt: null,\n  })\n\n  if (!schedule) {\n    logger.info('Schedule not found or deleted', { scheduleId })\n    return\n  }\n\n  // CRITICAL: Verify scope integrity - ensure payload scope matches database\n  // This prevents scope tampering and ensures proper multi-tenant isolation\n  if (payload.scopeType !== schedule.scopeType) {\n    logger.error('Scope type mismatch for schedule', {\n      scheduleId,\n      payloadScope: payload.scopeType,\n      dbScope: schedule.scopeType,\n    })\n    throw new Error('Schedule scope type mismatch - potential security issue')\n  }\n\n  if (payload.tenantId !== schedule.tenantId) {\n    logger.error('Tenant ID mismatch for schedule', {\n      scheduleId,\n      payloadTenant: payload.tenantId,\n      dbTenant: schedule.tenantId,\n    })\n    throw new Error('Schedule tenant ID mismatch - potential security issue')\n  }\n\n  if (payload.organizationId !== schedule.organizationId) {\n    logger.error('Organization ID mismatch for schedule', {\n      scheduleId,\n      payloadOrg: payload.organizationId,\n      dbOrg: schedule.organizationId,\n    })\n    throw new Error('Schedule organization ID mismatch - potential security issue')\n  }\n\n  // Check if schedule is still enabled\n  if (!schedule.isEnabled) {\n    logger.debug('Schedule is disabled', { scheduleId })\n    await emitSchedulerEvent('scheduler.job.skipped', {\n      id: schedule.id,\n      tenantId: schedule.tenantId,\n      organizationId: schedule.organizationId,\n      reason: 'Schedule is disabled',\n    })\n    return\n  }\n\n  // Emit started event\n  await emitSchedulerEvent('scheduler.job.started', {\n    id: schedule.id,\n    tenantId: schedule.tenantId,\n    organizationId: schedule.organizationId,\n    scheduleName: schedule.name,\n    attemptNumber: ctx.attemptNumber || 1,\n  })\n\n  // Check feature flag if required\n  if (schedule.requireFeature) {\n    const hasFeature = await rbacService.tenantHasFeature(\n      schedule.tenantId,\n      schedule.requireFeature,\n      { organizationId: schedule.organizationId },\n    )\n    \n    if (!hasFeature) {\n      await emitSchedulerEvent('scheduler.job.skipped', {\n        id: schedule.id,\n        tenantId: schedule.tenantId,\n        organizationId: schedule.organizationId,\n        reason: `Feature not enabled: ${schedule.requireFeature}`,\n      })\n\n      logger.debug('Schedule skipped: feature not enabled', { scheduleId, requireFeature: schedule.requireFeature })\n      return\n    }\n  }\n\n  // Enqueue target job or execute command\n  if (schedule.targetType === 'queue' && schedule.targetQueue) {\n    // Determine queue strategy from environment\n    const queueStrategy = (process.env.QUEUE_STRATEGY || 'local') as 'local' | 'async'\n    const targetQueue = createQueue(schedule.targetQueue, queueStrategy, {\n      connection: { url: getRedisUrlOrThrow('QUEUE') },\n    })\n    \n    let targetJobId: string | undefined\n    try {\n      // The execute-schedule job id is stable across BullMQ retries, so if\n      // this worker crashes between enqueue and DB flush the retried attempt\n      // reuses the same idempotency key and downstream workers can dedupe.\n      const idempotencyKey = buildSchedulerIdempotencyKey(schedule.id, ctx.jobId ?? Date.now())\n\n      targetJobId = await targetQueue.enqueue(buildQueueTargetPayload({\n        targetPayload: schedule.targetPayload,\n        tenantId: schedule.tenantId,\n        organizationId: schedule.organizationId,\n        idempotencyKey,\n      }))\n    } finally {\n      // Always close the queue instance to free Redis connections\n      await targetQueue.close()\n    }\n    \n    // Update schedule's last run time\n    schedule.lastRunAt = new Date()\n    await em.flush()\n\n    await emitSchedulerEvent('scheduler.job.completed', {\n      id: schedule.id,\n      tenantId: schedule.tenantId,\n      organizationId: schedule.organizationId,\n      queueJobId: targetJobId,\n      queueName: schedule.targetQueue,\n    })\n\n    logger.debug('Successfully enqueued job', {\n      scheduleId: schedule.id,\n      targetQueue: schedule.targetQueue,\n      queueJobId: targetJobId,\n    })\n\n  } else if (schedule.targetType === 'command' && schedule.targetCommand) {\n    const commandBus = new CommandBus()\n    const actorUserId = typeof schedule.createdByUserId === 'string' ? schedule.createdByUserId.trim() : ''\n    await assertSchedulerSafeCommandAuthorized({\n      commandId: schedule.targetCommand,\n      actorUserId,\n      tenantId: schedule.tenantId,\n      organizationId: schedule.organizationId,\n      rbacService,\n    })\n    \n    const commandInput = {\n      ...((schedule.targetPayload as Record<string, unknown>) || {}),\n      tenantId: schedule.tenantId,\n      organizationId: schedule.organizationId,\n    }\n    \n    // Build the schedule-scoped command context after the allowlist/RBAC gate.\n    const commandCtx = buildScheduledCommandContext(schedule, ctx as unknown as AppContainer)\n    \n    const commandResult = await commandBus.execute(schedule.targetCommand, {\n      input: commandInput,\n      ctx: commandCtx,\n    })\n    \n    // Update schedule's last run time\n    schedule.lastRunAt = new Date()\n    await em.flush()\n    \n    await emitSchedulerEvent('scheduler.job.completed', {\n      id: schedule.id,\n      tenantId: schedule.tenantId,\n      organizationId: schedule.organizationId,\n      commandId: schedule.targetCommand,\n      commandResult: commandResult.result,\n    })\n    \n    logger.debug('Successfully executed command', {\n      scheduleId: schedule.id,\n      commandId: schedule.targetCommand,\n    })\n\n  } else {\n    throw new Error('Invalid target configuration')\n  }\n}\n"],
-  "mappings": "AACA,SAAS,mBAAmB;AAC5B,SAAS,0BAA0B;AAEnC,SAAS,oBAAoB;AAC7B,SAAS,kBAAkB;AAE3B,SAAS,0BAA0B;AACnC,SAAS,4CAA4C;AACrD,SAAS,oCAAoC;AAC7C,SAAS,yBAAyB,oCAAoC;AACtE,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,SAAS,CAAC;AAG/D,MAAM,WAAuB;AAAA,EAClC,OAAO;AAAA,EACP,aAAa;AAAA;AACf;AA4CA,eAAO,sBACL,KACA,KACe;AACf,SAAO,MAAM,kBAAkB;AAAA,IAC7B,OAAO,IAAI;AAAA,IACX,eAAe,IAAI;AAAA,EACrB,CAAC;AAGD,QAAM,UAAW,IAAI,WAAY,IAAqD;AAEtF,MAAI,CAAC,WAAW,CAAC,QAAQ,YAAY;AACnC,WAAO,MAAM,2CAA2C,EAAE,OAAO,IAAI,MAAM,CAAC;AAC5E,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACzD;AAEA,QAAM,EAAE,WAAW,IAAI;AAEvB,QAAM,KAAK,IAAI,QAAuB,IAAI;AAC1C,QAAM,cAAc,IAAI,QAAyB,aAAa;AAG9D,QAAM,WAAW,MAAM,GAAG,QAAQ,cAAc;AAAA,IAC9C,IAAI;AAAA,IACJ,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,UAAU;AACb,WAAO,KAAK,iCAAiC,EAAE,WAAW,CAAC;AAC3D;AAAA,EACF;AAIA,MAAI,QAAQ,cAAc,SAAS,WAAW;AAC5C,WAAO,MAAM,oCAAoC;AAAA,MAC/C;AAAA,MACA,cAAc,QAAQ;AAAA,MACtB,SAAS,SAAS;AAAA,IACpB,CAAC;AACD,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AAEA,MAAI,QAAQ,aAAa,SAAS,UAAU;AAC1C,WAAO,MAAM,mCAAmC;AAAA,MAC9C;AAAA,MACA,eAAe,QAAQ;AAAA,MACvB,UAAU,SAAS;AAAA,IACrB,CAAC;AACD,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AAEA,MAAI,QAAQ,mBAAmB,SAAS,gBAAgB;AACtD,WAAO,MAAM,yCAAyC;AAAA,MACpD;AAAA,MACA,YAAY,QAAQ;AAAA,MACpB,OAAO,SAAS;AAAA,IAClB,CAAC;AACD,UAAM,IAAI,MAAM,8DAA8D;AAAA,EAChF;AAGA,MAAI,CAAC,SAAS,WAAW;AACvB,WAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC;AACnD,UAAM,mBAAmB,yBAAyB;AAAA,MAChD,IAAI,SAAS;AAAA,MACb,UAAU,SAAS;AAAA,MACnB,gBAAgB,SAAS;AAAA,MACzB,QAAQ;AAAA,IACV,CAAC;AACD;AAAA,EACF;AAGA,QAAM,mBAAmB,yBAAyB;AAAA,IAChD,IAAI,SAAS;AAAA,IACb,UAAU,SAAS;AAAA,IACnB,gBAAgB,SAAS;AAAA,IACzB,cAAc,SAAS;AAAA,IACvB,eAAe,IAAI,iBAAiB;AAAA,EACtC,CAAC;AAGD,MAAI,SAAS,gBAAgB;AAC3B,UAAM,aAAa,MAAM,YAAY;AAAA,MACnC,SAAS;AAAA,MACT,SAAS;AAAA,MACT,EAAE,gBAAgB,SAAS,eAAe;AAAA,IAC5C;AAEA,QAAI,CAAC,YAAY;AACf,YAAM,mBAAmB,yBAAyB;AAAA,QAChD,IAAI,SAAS;AAAA,QACb,UAAU,SAAS;AAAA,QACnB,gBAAgB,SAAS;AAAA,QACzB,QAAQ,wBAAwB,SAAS,cAAc;AAAA,MACzD,CAAC;AAED,aAAO,MAAM,yCAAyC,EAAE,YAAY,gBAAgB,SAAS,eAAe,CAAC;AAC7G;AAAA,IACF;AAAA,EACF;AAGA,MAAI,SAAS,eAAe,WAAW,SAAS,aAAa;AAE3D,UAAM,gBAAiB,QAAQ,IAAI,kBAAkB;AACrD,UAAM,cAAc,YAAY,SAAS,aAAa,eAAe;AAAA,MACnE,YAAY,EAAE,KAAK,mBAAmB,OAAO,EAAE;AAAA,IACjD,CAAC;AAED,QAAI;AACJ,QAAI;AAIF,YAAM,iBAAiB,6BAA6B,SAAS,IAAI,IAAI,SAAS,KAAK,IAAI,CAAC;AAExF,oBAAc,MAAM,YAAY,QAAQ,wBAAwB;AAAA,QAC9D,eAAe,SAAS;AAAA,QACxB,UAAU,SAAS;AAAA,QACnB,gBAAgB,SAAS;AAAA,QACzB;AAAA,MACF,CAAC,CAAC;AAAA,IACJ,UAAE;AAEA,YAAM,YAAY,MAAM;AAAA,IAC1B;AAGA,aAAS,YAAY,oBAAI,KAAK;AAC9B,UAAM,GAAG,MAAM;AAEf,UAAM,mBAAmB,2BAA2B;AAAA,MAClD,IAAI,SAAS;AAAA,MACb,UAAU,SAAS;AAAA,MACnB,gBAAgB,SAAS;AAAA,MACzB,YAAY;AAAA,MACZ,WAAW,SAAS;AAAA,IACtB,CAAC;AAED,WAAO,MAAM,6BAA6B;AAAA,MACxC,YAAY,SAAS;AAAA,MACrB,aAAa,SAAS;AAAA,MACtB,YAAY;AAAA,IACd,CAAC;AAAA,EAEH,WAAW,SAAS,eAAe,aAAa,SAAS,eAAe;AACtE,UAAM,aAAa,IAAI,WAAW;AAClC,UAAM,cAAc,OAAO,SAAS,oBAAoB,WAAW,SAAS,gBAAgB,KAAK,IAAI;AACrG,UAAM,qCAAqC;AAAA,MACzC,WAAW,SAAS;AAAA,MACpB;AAAA,MACA,UAAU,SAAS;AAAA,MACnB,gBAAgB,SAAS;AAAA,MACzB;AAAA,IACF,CAAC;AAED,UAAM,eAAe;AAAA,MACnB,GAAK,SAAS,iBAA6C,CAAC;AAAA,MAC5D,UAAU,SAAS;AAAA,MACnB,gBAAgB,SAAS;AAAA,IAC3B;AAGA,UAAM,aAAa,6BAA6B,UAAU,GAA8B;AAExF,UAAM,gBAAgB,MAAM,WAAW,QAAQ,SAAS,eAAe;AAAA,MACrE,OAAO;AAAA,MACP,KAAK;AAAA,IACP,CAAC;AAGD,aAAS,YAAY,oBAAI,KAAK;AAC9B,UAAM,GAAG,MAAM;AAEf,UAAM,mBAAmB,2BAA2B;AAAA,MAClD,IAAI,SAAS;AAAA,MACb,UAAU,SAAS;AAAA,MACnB,gBAAgB,SAAS;AAAA,MACzB,WAAW,SAAS;AAAA,MACpB,eAAe,cAAc;AAAA,IAC/B,CAAC;AAED,WAAO,MAAM,iCAAiC;AAAA,MAC5C,YAAY,SAAS;AAAA,MACrB,WAAW,SAAS;AAAA,IACtB,CAAC;AAAA,EAEH,OAAO;AACL,UAAM,IAAI,MAAM,8BAA8B;AAAA,EAChD;AACF;",
+  "sourcesContent": ["import type { QueuedJob, JobContext, WorkerMeta } from '@open-mercato/queue'\nimport { createQueue } from '@open-mercato/queue'\nimport { getRedisUrlOrThrow } from '@open-mercato/shared/lib/redis/connection'\nimport type { EntityManager } from '@mikro-orm/core'\nimport { ScheduledJob } from '../data/entities.js'\nimport { CommandBus } from '@open-mercato/shared/lib/commands'\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport { emitSchedulerEvent } from '../events.js'\nimport { assertSchedulerSafeCommandAuthorized } from '../lib/scheduler-safe-commands.js'\nimport { buildScheduledCommandContext } from '../lib/commandContext.js'\nimport { buildQueueTargetPayload, buildSchedulerIdempotencyKey } from '../lib/queueTargetPayload.js'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport {\n  canDispatchScheduleQueueTarget,\n  getSchedulerQueueRequiredFeatures,\n  sanitizeSchedulerTargetPayload,\n  validateSchedulerTargetPayload,\n} from '../lib/safeQueueTargets'\n\nconst logger = createLogger('scheduler').child({ component: 'worker' })\n\n// Worker metadata for auto-discovery\nexport const metadata: WorkerMeta = {\n  queue: 'scheduler-execution',\n  concurrency: 5, // Process up to 5 schedules concurrently\n}\n\nexport type ExecuteSchedulePayload = {\n  scheduleId: string\n  tenantId?: string | null\n  organizationId?: string | null\n  scopeType: 'system' | 'organization' | 'tenant'\n  triggerType?: 'scheduled' | 'manual'\n  triggeredByUserId?: string | null\n}\n\ntype HandlerContext = { resolve: <T = unknown>(name: string) => T }\ntype RbacServiceLike = {\n  tenantHasFeature(\n    tenantId: string | null | undefined,\n    feature: string,\n    opts?: { organizationId?: string | null },\n  ): Promise<boolean>\n  userHasAllFeatures(\n    userId: string,\n    required: readonly string[],\n    scope: { tenantId: string | null; organizationId: string | null },\n  ): Promise<boolean>\n}\n\n/**\n * Worker that executes scheduled jobs.\n * \n * This worker is triggered by BullMQ repeatable jobs at the scheduled times.\n * It loads the fresh schedule configuration from the database, validates\n * conditions, and enqueues the target job or executes the command.\n * \n * BullMQ handles:\n * - Timing (exact cron/interval execution)\n * - Distributed locking (prevents duplicate execution)\n * - Retries (if worker fails)\n * - Execution history (via job state, logs, timestamps)\n * \n * This worker handles:\n * - Loading fresh schedule config\n * - Checking feature flags and conditions\n * - Enqueuing target job or executing command\n * - Updating last run time\n */\nexport default async function executeScheduleWorker(\n  job: QueuedJob<ExecuteSchedulePayload>,\n  ctx: JobContext & HandlerContext,\n): Promise<void> {\n  logger.debug('Processing job', {\n    jobId: ctx.jobId,\n    attemptNumber: ctx.attemptNumber,\n  })\n  \n  // Defensive: handle both data and payload for BullMQ compatibility\n  const payload = (job.payload || (job as unknown as { data?: ExecuteSchedulePayload }).data) as ExecuteSchedulePayload | undefined\n  \n  if (!payload || !payload.scheduleId) {\n    logger.error('Invalid job payload: scheduleId missing', { jobId: ctx.jobId })\n    throw new Error('scheduleId is required in job payload')\n  }\n\n  const { scheduleId } = payload\n\n  const em = ctx.resolve<EntityManager>('em')\n  const rbacService = ctx.resolve<RbacServiceLike>('rbacService')\n\n  // Load fresh schedule from database\n  const schedule = await em.findOne(ScheduledJob, { \n    id: scheduleId,\n    deletedAt: null,\n  })\n\n  if (!schedule) {\n    logger.info('Schedule not found or deleted', { scheduleId })\n    return\n  }\n\n  // CRITICAL: Verify scope integrity - ensure payload scope matches database\n  // This prevents scope tampering and ensures proper multi-tenant isolation\n  if (payload.scopeType !== schedule.scopeType) {\n    logger.error('Scope type mismatch for schedule', {\n      scheduleId,\n      payloadScope: payload.scopeType,\n      dbScope: schedule.scopeType,\n    })\n    throw new Error('Schedule scope type mismatch - potential security issue')\n  }\n\n  if (payload.tenantId !== schedule.tenantId) {\n    logger.error('Tenant ID mismatch for schedule', {\n      scheduleId,\n      payloadTenant: payload.tenantId,\n      dbTenant: schedule.tenantId,\n    })\n    throw new Error('Schedule tenant ID mismatch - potential security issue')\n  }\n\n  if (payload.organizationId !== schedule.organizationId) {\n    logger.error('Organization ID mismatch for schedule', {\n      scheduleId,\n      payloadOrg: payload.organizationId,\n      dbOrg: schedule.organizationId,\n    })\n    throw new Error('Schedule organization ID mismatch - potential security issue')\n  }\n\n  // Check if schedule is still enabled\n  if (!schedule.isEnabled) {\n    logger.debug('Schedule is disabled', { scheduleId })\n    await emitSchedulerEvent('scheduler.job.skipped', {\n      id: schedule.id,\n      tenantId: schedule.tenantId,\n      organizationId: schedule.organizationId,\n      reason: 'Schedule is disabled',\n    })\n    return\n  }\n\n  // Emit started event\n  await emitSchedulerEvent('scheduler.job.started', {\n    id: schedule.id,\n    tenantId: schedule.tenantId,\n    organizationId: schedule.organizationId,\n    scheduleName: schedule.name,\n    attemptNumber: ctx.attemptNumber || 1,\n  })\n\n  // Check feature flag if required\n  if (schedule.requireFeature) {\n    const hasFeature = await rbacService.tenantHasFeature(\n      schedule.tenantId,\n      schedule.requireFeature,\n      { organizationId: schedule.organizationId },\n    )\n    \n    if (!hasFeature) {\n      await emitSchedulerEvent('scheduler.job.skipped', {\n        id: schedule.id,\n        tenantId: schedule.tenantId,\n        organizationId: schedule.organizationId,\n        reason: `Feature not enabled: ${schedule.requireFeature}`,\n      })\n\n      logger.debug('Schedule skipped: feature not enabled', { scheduleId, requireFeature: schedule.requireFeature })\n      return\n    }\n  }\n\n  // Enqueue target job or execute command\n  if (schedule.targetType === 'queue' && schedule.targetQueue) {\n    // Dispatch-time reauthorization (#5213): provenance is verified, never\n    // trusted \u2014 module-authored rows must still be owned by their recorded\n    // sourceModule and carry no acting-user stamp; API-authored rows may only\n    // target workers that opted into scheduling.\n    if (!canDispatchScheduleQueueTarget(schedule)) {\n      logger.error('Refusing non-safe queue target for schedule', {\n        scheduleId,\n        targetQueue: schedule.targetQueue,\n        sourceType: schedule.sourceType,\n        sourceModule: schedule.sourceType === 'module' ? schedule.sourceModule : undefined,\n      })\n      await emitSchedulerEvent('scheduler.job.skipped', {\n        id: schedule.id,\n        tenantId: schedule.tenantId,\n        organizationId: schedule.organizationId,\n        reason: `Queue is not an approved scheduler target: ${schedule.targetQueue}`,\n      })\n      return\n    }\n\n    // Re-validate the stored payload against the target's registered schema and\n    // the tenant-level features the target requires (#5213, defense in depth).\n    const payloadIssue = validateSchedulerTargetPayload(schedule.targetQueue, schedule.targetPayload)\n    if (payloadIssue) {\n      logger.error('Refusing schedule with invalid payload for queue target', {\n        scheduleId,\n        targetQueue: schedule.targetQueue,\n        issue: payloadIssue,\n      })\n      await emitSchedulerEvent('scheduler.job.skipped', {\n        id: schedule.id,\n        tenantId: schedule.tenantId,\n        organizationId: schedule.organizationId,\n        reason: `Invalid payload for scheduler queue ${schedule.targetQueue}`,\n      })\n      return\n    }\n\n    const requiredQueueFeatures = getSchedulerQueueRequiredFeatures(schedule.targetQueue)\n    if (schedule.scopeType !== 'system' && requiredQueueFeatures.length > 0) {\n      for (const feature of requiredQueueFeatures) {\n        if (await rbacService.tenantHasFeature(schedule.tenantId, feature, { organizationId: schedule.organizationId })) continue\n        logger.error('Refusing schedule whose tenant lacks a required feature of the queue target', {\n          scheduleId,\n          targetQueue: schedule.targetQueue,\n          feature,\n        })\n        await emitSchedulerEvent('scheduler.job.skipped', {\n          id: schedule.id,\n          tenantId: schedule.tenantId,\n          organizationId: schedule.organizationId,\n          reason: `Tenant lacks feature required by scheduler queue ${schedule.targetQueue}: ${feature}`,\n        })\n        return\n      }\n    }\n\n    // Determine queue strategy from environment\n    const queueStrategy = (process.env.QUEUE_STRATEGY || 'local') as 'local' | 'async'\n    const targetQueue = createQueue(schedule.targetQueue, queueStrategy, {\n      connection: { url: getRedisUrlOrThrow('QUEUE') },\n    })\n\n    let targetJobId: string | undefined\n    try {\n      // The execute-schedule job id is stable across BullMQ retries, so if\n      // this worker crashes between enqueue and DB flush the retried attempt\n      // reuses the same idempotency key and downstream workers can dedupe.\n      const idempotencyKey = buildSchedulerIdempotencyKey(schedule.id, ctx.jobId ?? Date.now())\n\n      // Rebuild tenant/org authority context and the trusted dispatch origin\n      // server-side; author-supplied scope/envelope keys never survive (#5213).\n      const sanitizedPayload = sanitizeSchedulerTargetPayload(schedule.targetPayload, schedule)\n      targetJobId = await targetQueue.enqueue({\n        ...buildQueueTargetPayload({\n          targetPayload: sanitizedPayload,\n          tenantId: schedule.tenantId,\n          organizationId: schedule.organizationId,\n          idempotencyKey,\n        }),\n        _jobOrigin: 'scheduler' as const,\n      })\n    } finally {\n      // Always close the queue instance to free Redis connections\n      await targetQueue.close()\n    }\n    \n    // Update schedule's last run time\n    schedule.lastRunAt = new Date()\n    await em.flush()\n\n    await emitSchedulerEvent('scheduler.job.completed', {\n      id: schedule.id,\n      tenantId: schedule.tenantId,\n      organizationId: schedule.organizationId,\n      queueJobId: targetJobId,\n      queueName: schedule.targetQueue,\n    })\n\n    logger.debug('Successfully enqueued job', {\n      scheduleId: schedule.id,\n      targetQueue: schedule.targetQueue,\n      queueJobId: targetJobId,\n    })\n\n  } else if (schedule.targetType === 'command' && schedule.targetCommand) {\n    const commandBus = new CommandBus()\n    const actorUserId = typeof schedule.createdByUserId === 'string' ? schedule.createdByUserId.trim() : ''\n    await assertSchedulerSafeCommandAuthorized({\n      commandId: schedule.targetCommand,\n      actorUserId,\n      tenantId: schedule.tenantId,\n      organizationId: schedule.organizationId,\n      rbacService,\n    })\n    \n    const commandInput = {\n      ...((schedule.targetPayload as Record<string, unknown>) || {}),\n      tenantId: schedule.tenantId,\n      organizationId: schedule.organizationId,\n    }\n    \n    // Build the schedule-scoped command context after the allowlist/RBAC gate.\n    const commandCtx = buildScheduledCommandContext(schedule, ctx as unknown as AppContainer)\n    \n    const commandResult = await commandBus.execute(schedule.targetCommand, {\n      input: commandInput,\n      ctx: commandCtx,\n    })\n    \n    // Update schedule's last run time\n    schedule.lastRunAt = new Date()\n    await em.flush()\n    \n    await emitSchedulerEvent('scheduler.job.completed', {\n      id: schedule.id,\n      tenantId: schedule.tenantId,\n      organizationId: schedule.organizationId,\n      commandId: schedule.targetCommand,\n      commandResult: commandResult.result,\n    })\n    \n    logger.debug('Successfully executed command', {\n      scheduleId: schedule.id,\n      commandId: schedule.targetCommand,\n    })\n\n  } else {\n    throw new Error('Invalid target configuration')\n  }\n}\n"],
+  "mappings": "AACA,SAAS,mBAAmB;AAC5B,SAAS,0BAA0B;AAEnC,SAAS,oBAAoB;AAC7B,SAAS,kBAAkB;AAE3B,SAAS,0BAA0B;AACnC,SAAS,4CAA4C;AACrD,SAAS,oCAAoC;AAC7C,SAAS,yBAAyB,oCAAoC;AACtE,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,SAAS,CAAC;AAG/D,MAAM,WAAuB;AAAA,EAClC,OAAO;AAAA,EACP,aAAa;AAAA;AACf;AA4CA,eAAO,sBACL,KACA,KACe;AACf,SAAO,MAAM,kBAAkB;AAAA,IAC7B,OAAO,IAAI;AAAA,IACX,eAAe,IAAI;AAAA,EACrB,CAAC;AAGD,QAAM,UAAW,IAAI,WAAY,IAAqD;AAEtF,MAAI,CAAC,WAAW,CAAC,QAAQ,YAAY;AACnC,WAAO,MAAM,2CAA2C,EAAE,OAAO,IAAI,MAAM,CAAC;AAC5E,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACzD;AAEA,QAAM,EAAE,WAAW,IAAI;AAEvB,QAAM,KAAK,IAAI,QAAuB,IAAI;AAC1C,QAAM,cAAc,IAAI,QAAyB,aAAa;AAG9D,QAAM,WAAW,MAAM,GAAG,QAAQ,cAAc;AAAA,IAC9C,IAAI;AAAA,IACJ,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,UAAU;AACb,WAAO,KAAK,iCAAiC,EAAE,WAAW,CAAC;AAC3D;AAAA,EACF;AAIA,MAAI,QAAQ,cAAc,SAAS,WAAW;AAC5C,WAAO,MAAM,oCAAoC;AAAA,MAC/C;AAAA,MACA,cAAc,QAAQ;AAAA,MACtB,SAAS,SAAS;AAAA,IACpB,CAAC;AACD,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AAEA,MAAI,QAAQ,aAAa,SAAS,UAAU;AAC1C,WAAO,MAAM,mCAAmC;AAAA,MAC9C;AAAA,MACA,eAAe,QAAQ;AAAA,MACvB,UAAU,SAAS;AAAA,IACrB,CAAC;AACD,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AAEA,MAAI,QAAQ,mBAAmB,SAAS,gBAAgB;AACtD,WAAO,MAAM,yCAAyC;AAAA,MACpD;AAAA,MACA,YAAY,QAAQ;AAAA,MACpB,OAAO,SAAS;AAAA,IAClB,CAAC;AACD,UAAM,IAAI,MAAM,8DAA8D;AAAA,EAChF;AAGA,MAAI,CAAC,SAAS,WAAW;AACvB,WAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC;AACnD,UAAM,mBAAmB,yBAAyB;AAAA,MAChD,IAAI,SAAS;AAAA,MACb,UAAU,SAAS;AAAA,MACnB,gBAAgB,SAAS;AAAA,MACzB,QAAQ;AAAA,IACV,CAAC;AACD;AAAA,EACF;AAGA,QAAM,mBAAmB,yBAAyB;AAAA,IAChD,IAAI,SAAS;AAAA,IACb,UAAU,SAAS;AAAA,IACnB,gBAAgB,SAAS;AAAA,IACzB,cAAc,SAAS;AAAA,IACvB,eAAe,IAAI,iBAAiB;AAAA,EACtC,CAAC;AAGD,MAAI,SAAS,gBAAgB;AAC3B,UAAM,aAAa,MAAM,YAAY;AAAA,MACnC,SAAS;AAAA,MACT,SAAS;AAAA,MACT,EAAE,gBAAgB,SAAS,eAAe;AAAA,IAC5C;AAEA,QAAI,CAAC,YAAY;AACf,YAAM,mBAAmB,yBAAyB;AAAA,QAChD,IAAI,SAAS;AAAA,QACb,UAAU,SAAS;AAAA,QACnB,gBAAgB,SAAS;AAAA,QACzB,QAAQ,wBAAwB,SAAS,cAAc;AAAA,MACzD,CAAC;AAED,aAAO,MAAM,yCAAyC,EAAE,YAAY,gBAAgB,SAAS,eAAe,CAAC;AAC7G;AAAA,IACF;AAAA,EACF;AAGA,MAAI,SAAS,eAAe,WAAW,SAAS,aAAa;AAK3D,QAAI,CAAC,+BAA+B,QAAQ,GAAG;AAC7C,aAAO,MAAM,+CAA+C;AAAA,QAC1D;AAAA,QACA,aAAa,SAAS;AAAA,QACtB,YAAY,SAAS;AAAA,QACrB,cAAc,SAAS,eAAe,WAAW,SAAS,eAAe;AAAA,MAC3E,CAAC;AACD,YAAM,mBAAmB,yBAAyB;AAAA,QAChD,IAAI,SAAS;AAAA,QACb,UAAU,SAAS;AAAA,QACnB,gBAAgB,SAAS;AAAA,QACzB,QAAQ,8CAA8C,SAAS,WAAW;AAAA,MAC5E,CAAC;AACD;AAAA,IACF;AAIA,UAAM,eAAe,+BAA+B,SAAS,aAAa,SAAS,aAAa;AAChG,QAAI,cAAc;AAChB,aAAO,MAAM,2DAA2D;AAAA,QACtE;AAAA,QACA,aAAa,SAAS;AAAA,QACtB,OAAO;AAAA,MACT,CAAC;AACD,YAAM,mBAAmB,yBAAyB;AAAA,QAChD,IAAI,SAAS;AAAA,QACb,UAAU,SAAS;AAAA,QACnB,gBAAgB,SAAS;AAAA,QACzB,QAAQ,uCAAuC,SAAS,WAAW;AAAA,MACrE,CAAC;AACD;AAAA,IACF;AAEA,UAAM,wBAAwB,kCAAkC,SAAS,WAAW;AACpF,QAAI,SAAS,cAAc,YAAY,sBAAsB,SAAS,GAAG;AACvE,iBAAW,WAAW,uBAAuB;AAC3C,YAAI,MAAM,YAAY,iBAAiB,SAAS,UAAU,SAAS,EAAE,gBAAgB,SAAS,eAAe,CAAC,EAAG;AACjH,eAAO,MAAM,+EAA+E;AAAA,UAC1F;AAAA,UACA,aAAa,SAAS;AAAA,UACtB;AAAA,QACF,CAAC;AACD,cAAM,mBAAmB,yBAAyB;AAAA,UAChD,IAAI,SAAS;AAAA,UACb,UAAU,SAAS;AAAA,UACnB,gBAAgB,SAAS;AAAA,UACzB,QAAQ,oDAAoD,SAAS,WAAW,KAAK,OAAO;AAAA,QAC9F,CAAC;AACD;AAAA,MACF;AAAA,IACF;AAGA,UAAM,gBAAiB,QAAQ,IAAI,kBAAkB;AACrD,UAAM,cAAc,YAAY,SAAS,aAAa,eAAe;AAAA,MACnE,YAAY,EAAE,KAAK,mBAAmB,OAAO,EAAE;AAAA,IACjD,CAAC;AAED,QAAI;AACJ,QAAI;AAIF,YAAM,iBAAiB,6BAA6B,SAAS,IAAI,IAAI,SAAS,KAAK,IAAI,CAAC;AAIxF,YAAM,mBAAmB,+BAA+B,SAAS,eAAe,QAAQ;AACxF,oBAAc,MAAM,YAAY,QAAQ;AAAA,QACtC,GAAG,wBAAwB;AAAA,UACzB,eAAe;AAAA,UACf,UAAU,SAAS;AAAA,UACnB,gBAAgB,SAAS;AAAA,UACzB;AAAA,QACF,CAAC;AAAA,QACD,YAAY;AAAA,MACd,CAAC;AAAA,IACH,UAAE;AAEA,YAAM,YAAY,MAAM;AAAA,IAC1B;AAGA,aAAS,YAAY,oBAAI,KAAK;AAC9B,UAAM,GAAG,MAAM;AAEf,UAAM,mBAAmB,2BAA2B;AAAA,MAClD,IAAI,SAAS;AAAA,MACb,UAAU,SAAS;AAAA,MACnB,gBAAgB,SAAS;AAAA,MACzB,YAAY;AAAA,MACZ,WAAW,SAAS;AAAA,IACtB,CAAC;AAED,WAAO,MAAM,6BAA6B;AAAA,MACxC,YAAY,SAAS;AAAA,MACrB,aAAa,SAAS;AAAA,MACtB,YAAY;AAAA,IACd,CAAC;AAAA,EAEH,WAAW,SAAS,eAAe,aAAa,SAAS,eAAe;AACtE,UAAM,aAAa,IAAI,WAAW;AAClC,UAAM,cAAc,OAAO,SAAS,oBAAoB,WAAW,SAAS,gBAAgB,KAAK,IAAI;AACrG,UAAM,qCAAqC;AAAA,MACzC,WAAW,SAAS;AAAA,MACpB;AAAA,MACA,UAAU,SAAS;AAAA,MACnB,gBAAgB,SAAS;AAAA,MACzB;AAAA,IACF,CAAC;AAED,UAAM,eAAe;AAAA,MACnB,GAAK,SAAS,iBAA6C,CAAC;AAAA,MAC5D,UAAU,SAAS;AAAA,MACnB,gBAAgB,SAAS;AAAA,IAC3B;AAGA,UAAM,aAAa,6BAA6B,UAAU,GAA8B;AAExF,UAAM,gBAAgB,MAAM,WAAW,QAAQ,SAAS,eAAe;AAAA,MACrE,OAAO;AAAA,MACP,KAAK;AAAA,IACP,CAAC;AAGD,aAAS,YAAY,oBAAI,KAAK;AAC9B,UAAM,GAAG,MAAM;AAEf,UAAM,mBAAmB,2BAA2B;AAAA,MAClD,IAAI,SAAS;AAAA,MACb,UAAU,SAAS;AAAA,MACnB,gBAAgB,SAAS;AAAA,MACzB,WAAW,SAAS;AAAA,MACpB,eAAe,cAAc;AAAA,IAC/B,CAAC;AAED,WAAO,MAAM,iCAAiC;AAAA,MAC5C,YAAY,SAAS;AAAA,MACrB,WAAW,SAAS;AAAA,IACtB,CAAC;AAAA,EAEH,OAAO;AACL,UAAM,IAAI,MAAM,8BAA8B;AAAA,EAChD;AACF;",
   "names": []
 }

package/dist/modules/scheduler/workers/test-echo-queue.worker.js

@@ -0,0 +1,22 @@
+import { createLogger } from "@open-mercato/shared/lib/logger";
+const logger = createLogger("scheduler").child({ component: "test-echo-queue" });
+const metadata = {
+  queue: "scheduler-test",
+  id: "scheduler:test-echo-queue",
+  concurrency: 1,
+  /**
+   * Deliberate scheduler-safe target for QA fixtures and manual experiments,
+   * mirroring the `scheduler.test.echo` command. The handler is side-effect
+   * free: it only logs that a delivery arrived.
+   */
+  schedulerSafe: true
+};
+async function handle(job, _ctx) {
+  const message = typeof job.payload?.message === "string" ? job.payload.message : "";
+  logger.info("Test queue target received a scheduled delivery", { messageId: message.slice(0, 80) });
+}
+export {
+  handle as default,
+  metadata
+};
+//# sourceMappingURL=test-echo-queue.worker.js.map

package/dist/modules/scheduler/workers/test-echo-queue.worker.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/scheduler/workers/test-echo-queue.worker.ts"],
+  "sourcesContent": ["import type { QueuedJob, JobContext, WorkerMeta } from '@open-mercato/queue'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('scheduler').child({ component: 'test-echo-queue' })\n\nexport const metadata: WorkerMeta = {\n  queue: 'scheduler-test',\n  id: 'scheduler:test-echo-queue',\n  concurrency: 1,\n  /**\n   * Deliberate scheduler-safe target for QA fixtures and manual experiments,\n   * mirroring the `scheduler.test.echo` command. The handler is side-effect\n   * free: it only logs that a delivery arrived.\n   */\n  schedulerSafe: true,\n}\n\ntype TestEchoPayload = {\n  message?: unknown\n}\n\nexport default async function handle(job: QueuedJob<TestEchoPayload>, _ctx: JobContext): Promise<void> {\n  const message = typeof job.payload?.message === 'string' ? job.payload.message : ''\n  logger.info('Test queue target received a scheduled delivery', { messageId: message.slice(0, 80) })\n}\n"],
+  "mappings": "AACA,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,kBAAkB,CAAC;AAExE,MAAM,WAAuB;AAAA,EAClC,OAAO;AAAA,EACP,IAAI;AAAA,EACJ,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMb,eAAe;AACjB;AAMA,eAAO,OAA8B,KAAiC,MAAiC;AACrG,QAAM,UAAU,OAAO,IAAI,SAAS,YAAY,WAAW,IAAI,QAAQ,UAAU;AACjF,SAAO,KAAK,mDAAmD,EAAE,WAAW,QAAQ,MAAM,GAAG,EAAE,EAAE,CAAC;AACpG;",
+  "names": []
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/scheduler",
-  "version": "0.6.8-develop.7066.1.6bfa9ff69f",
+  "version": "0.6.8-develop.7067.1.82e9867ea1",
   "license": "MIT",
   "description": "Database-managed scheduled jobs with admin UI",
   "type": "module",
@@ -59,13 +59,13 @@
     "./*/*/*/*/*/*.json": "./src/*/*/*/*/*/*.json"
   },
   "dependencies": {
-    "@open-mercato/events": "0.6.8-develop.7066.1.6bfa9ff69f",
-    "@open-mercato/queue": "0.6.8-develop.7066.1.6bfa9ff69f",
+    "@open-mercato/events": "0.6.8-develop.7067.1.82e9867ea1",
+    "@open-mercato/queue": "0.6.8-develop.7067.1.82e9867ea1",
     "cron-parser": "^5.6.2"
   },
   "peerDependencies": {
     "@mikro-orm/core": "^7.0.14",
-    "@open-mercato/shared": "0.6.8-develop.7066.1.6bfa9ff69f",
+    "@open-mercato/shared": "0.6.8-develop.7067.1.82e9867ea1",
     "bullmq": "^5.0.0 || ^6.0.0",
     "ioredis": "^5.0.0 || ^6.0.0",
     "zod": ">=3.23.0"
@@ -79,7 +79,7 @@
     }
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.6.8-develop.7066.1.6bfa9ff69f",
+    "@open-mercato/shared": "0.6.8-develop.7067.1.82e9867ea1",
     "@types/jest": "^30.0.0",
     "@types/node": "^26.1.2",
     "jest": "^30.4.2",

package/src/modules/scheduler/__integration__/TC-SCHED-001.spec.ts

@@ -17,8 +17,8 @@ async function createSchedule(request: import('@playwright/test').APIRequestCont
       scheduleType: 'interval',
       scheduleValue: '15m',
       timezone: 'UTC',
-      targetType: 'queue',
-      targetQueue: 'scheduler-execution',
+      targetType: 'command',
+      targetCommand: 'scheduler.test.echo',
       targetPayload: { source: 'integration-test' },
       isEnabled: true,
       sourceType: 'user',

package/src/modules/scheduler/__integration__/TC-SCHED-004.spec.ts

@@ -1,7 +1,10 @@
 import { expect, test } from '@playwright/test'
 import { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api'
 import { readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures'
-import { SCHEDULER_EXECUTION_QUEUE, SCHEDULER_TARGETS_PATH } from './helpers/scheduler'
+import {
+  SCHEDULER_FORBIDDEN_INTERNAL_QUEUES,
+  SCHEDULER_TARGETS_PATH,
+} from './helpers/scheduler'
 
 type TargetOption = { value: string; label: string }
 type TargetsResponse = { queues?: TargetOption[]; commands?: TargetOption[] }
@@ -21,12 +24,13 @@ function expectOptionShape(options: TargetOption[], label: string) {
 }
 
 /**
- * TC-SCHED-004: GET /api/scheduler/targets returns available queue names
- * (from module workers) and registered command IDs (from the command
- * registry), both sorted alphabetically by value. Read-only, no fixtures.
+ * TC-SCHED-004: GET /api/scheduler/targets returns scheduler-safe queue names
+ * and registered command IDs (from the command registry), both sorted
+ * alphabetically by value. Internal/system workers must stay undiscoverable.
+ * Read-only, no fixtures.
  */
 test.describe('TC-SCHED-004: GET /api/scheduler/targets lists queues and commands', () => {
-  test('returns sorted queues (incl. scheduler-execution) and a non-empty command list', async ({ request }) => {
+  test('returns only scheduler-safe queues plus a non-empty sorted command list', async ({ request }) => {
     const token = await getAuthToken(request, 'admin')
 
     const response = await apiRequest(request, 'GET', SCHEDULER_TARGETS_PATH, { token })
@@ -36,12 +40,14 @@ test.describe('TC-SCHED-004: GET /api/scheduler/targets lists queues and command
     const queues = body?.queues ?? []
     const commands = body?.commands ?? []
 
-    // Queues: non-empty, well-shaped, sorted, and include the known scheduler queue.
+    // Queues: well-shaped, sorted, and free of internal/system worker queues (#5213).
     expect(Array.isArray(body?.queues)).toBe(true)
-    expect(queues.length).toBeGreaterThan(0)
     expectOptionShape(queues, 'queues')
-    expect(queues.map((queue) => queue.value)).toContain(SCHEDULER_EXECUTION_QUEUE)
     expectSortedByValue(queues, 'queues')
+    const queueValues = queues.map((queue) => queue.value)
+    for (const forbidden of SCHEDULER_FORBIDDEN_INTERNAL_QUEUES) {
+      expect(queueValues, `internal queue ${forbidden} must not be a scheduler target`).not.toContain(forbidden)
+    }
 
     // Commands: non-empty, well-shaped, and sorted.
     expect(Array.isArray(body?.commands)).toBe(true)

package/src/modules/scheduler/__integration__/TC-SCHED-007.spec.ts

@@ -1,7 +1,7 @@
 import { expect, test } from '@playwright/test'
 import { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api'
 import { readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures'
-import { SCHEDULER_EXECUTION_QUEUE, SCHEDULER_JOBS_PATH, uniqueScheduleName } from './helpers/scheduler'
+import { SCHEDULER_JOBS_PATH, SCHEDULER_TEST_COMMAND, uniqueScheduleName } from './helpers/scheduler'
 
 type ValidationError = { error?: string; details?: Array<{ path?: Array<string | number> }> }
 
@@ -36,8 +36,8 @@ test.describe('TC-SCHED-007: POST /api/scheduler/jobs validates schedule value f
           scheduleType: testCase.scheduleType,
           scheduleValue: testCase.scheduleValue,
           timezone: 'UTC',
-          targetType: 'queue',
-          targetQueue: SCHEDULER_EXECUTION_QUEUE,
+          targetType: 'command',
+          targetCommand: SCHEDULER_TEST_COMMAND,
           isEnabled: true,
           sourceType: 'user',
         },

package/src/modules/scheduler/__integration__/TC-SCHED-008-safe-targets.spec.ts

@@ -0,0 +1,90 @@
+import { expect, test } from '@playwright/test'
+import { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api'
+import { readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures'
+import {
+  SCHEDULER_FORBIDDEN_INTERNAL_QUEUES,
+  SCHEDULER_JOBS_PATH,
+  SCHEDULER_TARGETS_PATH,
+  createScheduleJob,
+  deleteScheduleJob,
+  getScheduleJobById,
+  uniqueScheduleName,
+} from './helpers/scheduler'
+
+/**
+ * TC-SCHED-008: Scheduler queue targets are restricted to authorized safe
+ * workers (#5213). A principal holding only `scheduler.jobs.manage` must not be
+ * able to aim a schedule at an internal/system worker queue with an arbitrary
+ * payload — neither at creation, nor by retargeting later.
+ */
+test.describe('TC-SCHED-008: scheduler queue targets restricted to safe workers', () => {
+  for (const forbiddenQueue of SCHEDULER_FORBIDDEN_INTERNAL_QUEUES) {
+    test(`rejects creating a schedule targeting the ${forbiddenQueue} worker`, async ({ request }) => {
+      const token = await getAuthToken(request, 'admin')
+
+      const response = await apiRequest(request, 'POST', SCHEDULER_JOBS_PATH, {
+        token,
+        data: {
+          name: uniqueScheduleName('Forbidden Queue Target'),
+          scopeType: 'organization',
+          scheduleType: 'interval',
+          scheduleValue: '15m',
+          timezone: 'UTC',
+          targetType: 'queue',
+          targetQueue: forbiddenQueue,
+          targetPayload: { scope: { tenantId: 'forged', organizationId: 'forged' } },
+          isEnabled: true,
+          sourceType: 'user',
+        },
+      })
+
+      expect(response.status(), `${forbiddenQueue} must not be schedulable`).toBe(400)
+      const body = await readJsonSafe<{ error?: string; details?: Array<{ path?: Array<string | number> }> }>(response)
+      const issuePaths = (body?.details ?? []).map((issue) => (issue.path ?? []).join('.'))
+      expect(issuePaths).toContain('targetQueue')
+    })
+  }
+
+  test('rejects retargeting an existing schedule to an internal worker queue', async ({ request }) => {
+    const token = await getAuthToken(request, 'admin')
+    let scheduleId: string | null = null
+
+    try {
+      scheduleId = await createScheduleJob(request, token, { name: uniqueScheduleName('Retarget Guard') })
+
+      const response = await apiRequest(request, 'PUT', SCHEDULER_JOBS_PATH, {
+        token,
+        data: {
+          id: scheduleId,
+          targetType: 'queue',
+          targetQueue: 'stripe-webhook',
+        },
+      })
+
+      // Enforcement lives in the update command (change-detection vs the stored
+      // row), so an actual retarget lands as 422 with the approval error.
+      expect(response.status()).toBe(422)
+      const body = await readJsonSafe<{ error?: string }>(response)
+      expect(body?.error ?? '').toMatch(/not an approved scheduler target/i)
+
+      const unchanged = await getScheduleJobById(request, token, scheduleId)
+      expect(unchanged).not.toBeNull()
+      expect(unchanged!.targetType).toBe('command')
+    } finally {
+      await deleteScheduleJob(request, token, scheduleId)
+    }
+  })
+
+  test('targets endpoint keeps internal worker queues undiscoverable', async ({ request }) => {
+    const token = await getAuthToken(request, 'admin')
+
+    const response = await apiRequest(request, 'GET', SCHEDULER_TARGETS_PATH, { token })
+    expect(response.status()).toBe(200)
+
+    const body = await readJsonSafe<{ queues?: Array<{ value: string }> }>(response)
+    const values = (body?.queues ?? []).map((queue) => queue.value)
+    for (const forbidden of SCHEDULER_FORBIDDEN_INTERNAL_QUEUES) {
+      expect(values).not.toContain(forbidden)
+    }
+  })
+})

package/src/modules/scheduler/__integration__/TC-SCHED-CRUDFORM-001.spec.ts

@@ -90,7 +90,7 @@ test.describe('TC-SCHED-CRUDFORM-001: Scheduled Job CrudForm persists scope, tar
           scheduleValue: '15m',
           timezone: 'UTC',
           targetType: 'queue',
-          targetQueue: 'scheduler-execution',
+          targetQueue: 'scheduler-test',
           targetPayload: createPayload,
           isEnabled: true,
           sourceType: 'user',
@@ -105,7 +105,7 @@ test.describe('TC-SCHED-CRUDFORM-001: Scheduled Job CrudForm persists scope, tar
           scheduleValue: '15m',
           timezone: 'UTC',
           targetType: 'queue',
-          targetQueue: 'scheduler-execution',
+          targetQueue: 'scheduler-test',
           targetCommand: null,
           targetPayload: createPayload,
           isEnabled: true,
@@ -133,7 +133,7 @@ test.describe('TC-SCHED-CRUDFORM-001: Scheduled Job CrudForm persists scope, tar
           scheduleValue: '0 0 * * *',
           timezone: 'Europe/Warsaw',
           targetType: 'queue',
-          targetQueue: 'scheduler-execution',
+          targetQueue: 'scheduler-test',
           targetCommand: null,
           targetPayload: updatePayload,
           isEnabled: false,

package/src/modules/scheduler/__integration__/TC-UNDO-001-scheduler-jobs.spec.ts

@@ -1,86 +1,174 @@
-import { expect, test } from '@playwright/test'
+import { expect, test, type APIRequestContext, type APIResponse } from '@playwright/test'
 import { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api'
-import {
-  extractOperation,
-  runCrudUndoRoundTrip,
-  skipIfUndoTestsDisabled,
-} from '@open-mercato/core/helpers/integration/undoHarness'
-import {
-  SCHEDULER_JOBS_PATH,
-  SCHEDULER_TRIGGER_PATH,
-  createScheduleJob,
-  deleteScheduleJob,
-} from './helpers/scheduler'
 
 /**
- * TC-UNDO-001 (#2582, refs #2468) — scheduler.jobs undo/redo correctness.
+ * TC-UNDO-001: scheduler.jobs undo round-trip (regression for issue #2504).
  *
- * Regression lock for #2504: scheduler.jobs undo was a silent no-op because every
- * undo handler read `logEntry.payload` (always undefined — the command bus persists
- * the undo snapshot under `commandPayload`), so undo returned `{ ok: true }` while
- * changing nothing. Fixed in PR #2514 via `extractUndoPayload`. This spec asserts the
- * corrected behavior (full restoration), driving the real command bus through the
- * public API + the audit-log undo/redo endpoints.
+ * Before the fix, every scheduler.jobs undo handler read `logEntry.payload`
+ * (always undefined — the command bus persists the undo snapshot under
+ * `commandPayload`), so undo returned `{ ok: true }` while silently changing
+ * nothing. This spec exercises the real HTTP path end-to-end:
+ *   - CREATE -> undo  => job is soft-deleted (no longer listed)
+ *   - UPDATE -> undo  => renamed field is restored to its prior value
+ *   - DELETE -> undo  => soft-deleted job is re-materialized
  *
- * scheduler.jobs is a standard `makeCrudRoute` entity (POST/PUT/DELETE on the
- * collection, `?id=` read-back, camelCase serializer, no custom fields), so the shared
- * `runCrudUndoRoundTrip` harness covers the full round-trip in one pass:
- *   - I1 update → undo restores every scalar (and bumps `updatedAt`)
- *   - I2 delete → undo re-materializes the soft-deleted job
- *   - I3 create → undo soft-deletes (never hard-deletes)
- *   - I5 a consumed undo token is rejected on a second undo
- *   - I6 redo re-applies the command's after-snapshot
- *
- * I4 (custom fields) is N/A — `scheduled_job` declares no `ce.ts`, so it has no `cf_*`.
+ * Endpoints covered:
+ *   - POST   /api/scheduler/jobs                       (create)
+ *   - GET    /api/scheduler/jobs?id=                   (read)
+ *   - PUT    /api/scheduler/jobs                       (update)
+ *   - DELETE /api/scheduler/jobs                       (delete, cleanup)
+ *   - POST   /api/audit_logs/audit-logs/actions/undo   (undo)
  */
-function jobCreatePayload(stamp: string): Record<string, unknown> {
-  return {
-    name: `TC-UNDO-001 Scheduler ${stamp}`,
-    description: 'TC-UNDO-001 undo/redo probe',
-    scopeType: 'organization',
-    scheduleType: 'interval',
-    scheduleValue: '15m',
-    timezone: 'UTC',
-    targetType: 'queue',
-    targetQueue: 'scheduler-execution',
-    isEnabled: true,
-    sourceType: 'user',
-  }
+
+type ScheduleRow = {
+  id: string
+  name: string
+  description: string | null
+  scheduleValue: string
+}
+
+// The undo endpoint only honors the *latest* undoable log for a resource, and
+// `latestUndoableForResource` orders by `created_at` alone. Audit `created_at` is
+// millisecond-precision (`new Date()` at log time), so a create + a follow-up
+// mutation issued within the same millisecond tie and the lookup may resolve to
+// the wrong log. A short settle guarantees the operation under undo is strictly
+// the most recent, keeping the round-trip deterministic.
+async function settleAuditClock(): Promise<void> {
+  await new Promise((resolve) => setTimeout(resolve, 50))
+}
+
+function readUndoToken(res: APIResponse): string {
+  const header = res.headers()['x-om-operation'] ?? ''
+  const enc = header.startsWith('omop:') ? header.slice(5) : ''
+  expect(enc, 'x-om-operation header should carry an omop: payload').not.toBe('')
+  const payload = JSON.parse(decodeURIComponent(enc)) as { undoToken?: string }
+  expect(typeof payload.undoToken, 'undoToken present in operation payload').toBe('string')
+  return payload.undoToken as string
+}
+
+async function getById(
+  request: APIRequestContext,
+  token: string,
+  id: string,
+): Promise<ScheduleRow | undefined> {
+  const res = await apiRequest(request, 'GET', `/api/scheduler/jobs?id=${encodeURIComponent(id)}`, { token })
+  expect(res.status()).toBe(200)
+  const body = (await res.json()) as { items?: ScheduleRow[] }
+  return (body.items ?? [])[0]
 }
 
-test.describe('TC-UNDO-001 scheduler.jobs undo/redo (#2504)', () => {
-  test.beforeAll(() => {
-    skipIfUndoTestsDisabled()
+async function createJob(request: APIRequestContext, token: string, name: string): Promise<{ id: string; res: APIResponse }> {
+  const res = await apiRequest(request, 'POST', '/api/scheduler/jobs', {
+    token,
+    data: {
+      name,
+      description: 'TC-UNDO-001 probe',
+      scopeType: 'tenant',
+      scheduleType: 'cron',
+      scheduleValue: '0 0 * * *',
+      timezone: 'UTC',
+      targetType: 'command',
+      targetCommand: 'scheduler.test.echo',
+      isEnabled: true,
+      sourceType: 'user',
+    },
   })
+  expect(res.status(), 'create returns 201').toBe(201)
+  const id = ((await res.json()) as { id: string }).id
+  expect(id, 'create returns an id').toBeTruthy()
+  return { id, res }
+}
+
+async function undo(request: APIRequestContext, token: string, undoToken: string): Promise<void> {
+  const res = await apiRequest(request, 'POST', '/api/audit_logs/audit-logs/actions/undo', {
+    token,
+    data: { undoToken },
+  })
+  const raw = await res.text()
+  expect(res.status(), `undo returns 200 (body: ${raw})`).toBe(200)
+  const body = JSON.parse(raw) as { ok?: boolean }
+  expect(body.ok, 'undo body is { ok: true }').toBe(true)
+}
+
+async function cleanup(request: APIRequestContext, token: string | null, id: string | null): Promise<void> {
+  if (!token || !id) return
+  try {
+    await apiRequest(request, 'DELETE', '/api/scheduler/jobs', { token, data: { id } })
+  } catch {
+    /* ignore */
+  }
+}
+
+test.describe('TC-UNDO-001: scheduler.jobs undo actually restores state (#2504)', () => {
+  test('UPDATE -> undo restores the prior name', async ({ request }) => {
+    let token: string | null = null
+    let id: string | null = null
+    try {
+      token = await getAuthToken(request, 'admin')
+      const originalName = `TC-UNDO-001 Update ${Date.now()}`
+      ;({ id } = await createJob(request, token, originalName))
+      await settleAuditClock()
 
-  test('jobs CRUD commands restore scalar state on undo/redo (I1/I2/I3/I5/I6)', async ({ request }) => {
-    const token = await getAuthToken(request, 'admin')
+      const updateRes = await apiRequest(request, 'PUT', '/api/scheduler/jobs', {
+        token,
+        data: { id, name: `${originalName} RENAMED` },
+      })
+      expect(updateRes.status(), 'update returns 200').toBe(200)
+      expect((await getById(request, token, id))?.name).toBe(`${originalName} RENAMED`)
 
-    await runCrudUndoRoundTrip(request, token, {
-      label: 'scheduler.jobs',
-      collectionPath: SCHEDULER_JOBS_PATH,
-      field: 'name',
-      createPayload: jobCreatePayload,
-      updatePayload: (id, stamp) => ({ id, name: `TC-UNDO-001 Scheduler Renamed ${stamp}` }),
-    })
+      await undo(request, token, readUndoToken(updateRes))
+
+      const restored = await getById(request, token, id)
+      expect(restored, 'job still exists after update-undo').toBeTruthy()
+      expect(restored!.name, 'name restored to original by undo').toBe(originalName)
+    } finally {
+      await cleanup(request, token, id)
+    }
   })
 
-  // §4 — manual trigger is a fire-and-forget enqueue that never goes through the
-  // command bus, so it exposes no undo affordance. The assertion holds regardless of
-  // QUEUE_STRATEGY: async returns 200 (enqueued), local returns 400 (rejected) — neither
-  // issues an `x-om-operation` undo token.
-  test('§4 trigger exposes no undo token', async ({ request }) => {
-    const token = await getAuthToken(request, 'admin')
-    let jobId: string | null = null
+  test('DELETE -> undo re-lists the soft-deleted job', async ({ request }) => {
+    let token: string | null = null
+    let id: string | null = null
     try {
-      jobId = await createScheduleJob(request, token)
-      const triggerRes = await apiRequest(request, 'POST', SCHEDULER_TRIGGER_PATH, {
+      token = await getAuthToken(request, 'admin')
+      const name = `TC-UNDO-001 Delete ${Date.now()}`
+      ;({ id } = await createJob(request, token, name))
+      await settleAuditClock()
+
+      const deleteRes = await apiRequest(request, 'DELETE', '/api/scheduler/jobs', {
         token,
-        data: { id: jobId },
+        data: { id },
       })
-      expect(extractOperation(triggerRes), 'trigger response carries no undo token (§4)').toBeNull()
+      expect(deleteRes.status(), 'delete returns 200').toBe(200)
+      expect(await getById(request, token, id), 'job is gone after delete').toBeFalsy()
+
+      await undo(request, token, readUndoToken(deleteRes))
+
+      const restored = await getById(request, token, id)
+      expect(restored, 'job re-materialized by delete-undo').toBeTruthy()
+      expect(restored!.name).toBe(name)
+    } finally {
+      await cleanup(request, token, id)
+    }
+  })
+
+  test('CREATE -> undo removes the created job', async ({ request }) => {
+    let token: string | null = null
+    let id: string | null = null
+    try {
+      token = await getAuthToken(request, 'admin')
+      const name = `TC-UNDO-001 Create ${Date.now()}`
+      const created = await createJob(request, token, name)
+      id = created.id
+
+      expect(await getById(request, token, id), 'job exists after create').toBeTruthy()
+
+      await undo(request, token, readUndoToken(created.res))
+
+      expect(await getById(request, token, id), 'job removed by create-undo').toBeFalsy()
+      id = null // already undone; nothing to clean up
     } finally {
-      await deleteScheduleJob(request, token, jobId)
+      await cleanup(request, token, id)
     }
   })
 })