@open-mercato/scheduler 0.6.8-develop.7100.1.fbf66fca35 → 0.7.0

package/dist/modules/scheduler/workers/execute-schedule.worker.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/scheduler/workers/execute-schedule.worker.ts"],
-  "sourcesContent": ["import type { QueuedJob, JobContext, WorkerMeta } from '@open-mercato/queue'\nimport { createQueue } from '@open-mercato/queue'\nimport { getRedisUrlOrThrow } from '@open-mercato/shared/lib/redis/connection'\nimport type { EntityManager } from '@mikro-orm/core'\nimport { ScheduledJob } from '../data/entities.js'\nimport { CommandBus } from '@open-mercato/shared/lib/commands'\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport { emitSchedulerEvent } from '../events.js'\nimport { assertSchedulerSafeCommandAuthorized } from '../lib/scheduler-safe-commands.js'\nimport { buildScheduledCommandContext } from '../lib/commandContext.js'\nimport { buildQueueTargetPayload, buildSchedulerIdempotencyKey } from '../lib/queueTargetPayload.js'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport {\n  canDispatchScheduleQueueTarget,\n  getSchedulerQueueRequiredFeatures,\n  sanitizeSchedulerTargetPayload,\n  validateSchedulerTargetPayload,\n} from '../lib/safeQueueTargets'\n\nconst logger = createLogger('scheduler').child({ component: 'worker' })\n\n// Worker metadata for auto-discovery\nexport const metadata: WorkerMeta = {\n  queue: 'scheduler-execution',\n  concurrency: 5, // Process up to 5 schedules concurrently\n}\n\nexport type ExecuteSchedulePayload = {\n  scheduleId: string\n  tenantId?: string | null\n  organizationId?: string | null\n  scopeType: 'system' | 'organization' | 'tenant'\n  triggerType?: 'scheduled' | 'manual'\n  triggeredByUserId?: string | null\n}\n\ntype HandlerContext = { resolve: <T = unknown>(name: string) => T }\ntype RbacServiceLike = {\n  tenantHasFeature(\n    tenantId: string | null | undefined,\n    feature: string,\n    opts?: { organizationId?: string | null },\n  ): Promise<boolean>\n  userHasAllFeatures(\n    userId: string,\n    required: readonly string[],\n    scope: { tenantId: string | null; organizationId: string | null },\n  ): Promise<boolean>\n}\n\n/**\n * Worker that executes scheduled jobs.\n * \n * This worker is triggered by BullMQ repeatable jobs at the scheduled times.\n * It loads the fresh schedule configuration from the database, validates\n * conditions, and enqueues the target job or executes the command.\n * \n * BullMQ handles:\n * - Timing (exact cron/interval execution)\n * - Distributed locking (prevents duplicate execution)\n * - Retries (if worker fails)\n * - Execution history (via job state, logs, timestamps)\n * \n * This worker handles:\n * - Loading fresh schedule config\n * - Checking feature flags and conditions\n * - Enqueuing target job or executing command\n * - Updating last run time\n */\nexport default async function executeScheduleWorker(\n  job: QueuedJob<ExecuteSchedulePayload>,\n  ctx: JobContext & HandlerContext,\n): Promise<void> {\n  logger.debug('Processing job', {\n    jobId: ctx.jobId,\n    attemptNumber: ctx.attemptNumber,\n  })\n  \n  // Defensive: handle both data and payload for BullMQ compatibility\n  const payload = (job.payload || (job as unknown as { data?: ExecuteSchedulePayload }).data) as ExecuteSchedulePayload | undefined\n  \n  if (!payload || !payload.scheduleId) {\n    logger.error('Invalid job payload: scheduleId missing', { jobId: ctx.jobId })\n    throw new Error('scheduleId is required in job payload')\n  }\n\n  const { scheduleId } = payload\n\n  const em = ctx.resolve<EntityManager>('em')\n  const rbacService = ctx.resolve<RbacServiceLike>('rbacService')\n\n  // Load fresh schedule from database\n  const schedule = await em.findOne(ScheduledJob, { \n    id: scheduleId,\n    deletedAt: null,\n  })\n\n  if (!schedule) {\n    logger.info('Schedule not found or deleted', { scheduleId })\n    return\n  }\n\n  // CRITICAL: Verify scope integrity - ensure payload scope matches database\n  // This prevents scope tampering and ensures proper multi-tenant isolation\n  if (payload.scopeType !== schedule.scopeType) {\n    logger.error('Scope type mismatch for schedule', {\n      scheduleId,\n      payloadScope: payload.scopeType,\n      dbScope: schedule.scopeType,\n    })\n    throw new Error('Schedule scope type mismatch - potential security issue')\n  }\n\n  if (payload.tenantId !== schedule.tenantId) {\n    logger.error('Tenant ID mismatch for schedule', {\n      scheduleId,\n      payloadTenant: payload.tenantId,\n      dbTenant: schedule.tenantId,\n    })\n    throw new Error('Schedule tenant ID mismatch - potential security issue')\n  }\n\n  if (payload.organizationId !== schedule.organizationId) {\n    logger.error('Organization ID mismatch for schedule', {\n      scheduleId,\n      payloadOrg: payload.organizationId,\n      dbOrg: schedule.organizationId,\n    })\n    throw new Error('Schedule organization ID mismatch - potential security issue')\n  }\n\n  // Check if schedule is still enabled\n  if (!schedule.isEnabled) {\n    logger.debug('Schedule is disabled', { scheduleId })\n    await emitSchedulerEvent('scheduler.job.skipped', {\n      id: schedule.id,\n      tenantId: schedule.tenantId,\n      organizationId: schedule.organizationId,\n      reason: 'Schedule is disabled',\n    })\n    return\n  }\n\n  // Emit started event\n  await emitSchedulerEvent('scheduler.job.started', {\n    id: schedule.id,\n    tenantId: schedule.tenantId,\n    organizationId: schedule.organizationId,\n    scheduleName: schedule.name,\n    attemptNumber: ctx.attemptNumber || 1,\n  })\n\n  // Check feature flag if required\n  if (schedule.requireFeature) {\n    const hasFeature = await rbacService.tenantHasFeature(\n      schedule.tenantId,\n      schedule.requireFeature,\n      { organizationId: schedule.organizationId },\n    )\n    \n    if (!hasFeature) {\n      await emitSchedulerEvent('scheduler.job.skipped', {\n        id: schedule.id,\n        tenantId: schedule.tenantId,\n        organizationId: schedule.organizationId,\n        reason: `Feature not enabled: ${schedule.requireFeature}`,\n      })\n\n      logger.debug('Schedule skipped: feature not enabled', { scheduleId, requireFeature: schedule.requireFeature })\n      return\n    }\n  }\n\n  // Enqueue target job or execute command\n  if (schedule.targetType === 'queue' && schedule.targetQueue) {\n    // Dispatch-time reauthorization (#5213): provenance is verified, never\n    // trusted \u2014 module-authored rows must still be owned by their recorded\n    // sourceModule and carry no acting-user stamp; API-authored rows may only\n    // target workers that opted into scheduling.\n    if (!canDispatchScheduleQueueTarget(schedule)) {\n      logger.error('Refusing non-safe queue target for schedule', {\n        scheduleId,\n        targetQueue: schedule.targetQueue,\n        sourceType: schedule.sourceType,\n        sourceModule: schedule.sourceType === 'module' ? schedule.sourceModule : undefined,\n      })\n      await emitSchedulerEvent('scheduler.job.skipped', {\n        id: schedule.id,\n        tenantId: schedule.tenantId,\n        organizationId: schedule.organizationId,\n        reason: `Queue is not an approved scheduler target: ${schedule.targetQueue}`,\n      })\n      return\n    }\n\n    // Re-validate the stored payload against the target's registered schema and\n    // the tenant-level features the target requires (#5213, defense in depth).\n    const payloadIssue = validateSchedulerTargetPayload(schedule.targetQueue, schedule.targetPayload)\n    if (payloadIssue) {\n      logger.error('Refusing schedule with invalid payload for queue target', {\n        scheduleId,\n        targetQueue: schedule.targetQueue,\n        issue: payloadIssue,\n      })\n      await emitSchedulerEvent('scheduler.job.skipped', {\n        id: schedule.id,\n        tenantId: schedule.tenantId,\n        organizationId: schedule.organizationId,\n        reason: `Invalid payload for scheduler queue ${schedule.targetQueue}`,\n      })\n      return\n    }\n\n    const requiredQueueFeatures = getSchedulerQueueRequiredFeatures(schedule.targetQueue)\n    if (schedule.scopeType !== 'system' && requiredQueueFeatures.length > 0) {\n      for (const feature of requiredQueueFeatures) {\n        if (await rbacService.tenantHasFeature(schedule.tenantId, feature, { organizationId: schedule.organizationId })) continue\n        logger.error('Refusing schedule whose tenant lacks a required feature of the queue target', {\n          scheduleId,\n          targetQueue: schedule.targetQueue,\n          feature,\n        })\n        await emitSchedulerEvent('scheduler.job.skipped', {\n          id: schedule.id,\n          tenantId: schedule.tenantId,\n          organizationId: schedule.organizationId,\n          reason: `Tenant lacks feature required by scheduler queue ${schedule.targetQueue}: ${feature}`,\n        })\n        return\n      }\n    }\n\n    // Determine queue strategy from environment\n    const queueStrategy = (process.env.QUEUE_STRATEGY || 'local') as 'local' | 'async'\n    const targetQueue = createQueue(schedule.targetQueue, queueStrategy, {\n      connection: { url: getRedisUrlOrThrow('QUEUE') },\n    })\n\n    let targetJobId: string | undefined\n    try {\n      // The execute-schedule job id is stable across BullMQ retries, so if\n      // this worker crashes between enqueue and DB flush the retried attempt\n      // reuses the same idempotency key and downstream workers can dedupe.\n      const idempotencyKey = buildSchedulerIdempotencyKey(schedule.id, ctx.jobId ?? Date.now())\n\n      // Rebuild tenant/org authority context and the trusted dispatch origin\n      // server-side; author-supplied scope/envelope keys never survive (#5213).\n      const sanitizedPayload = sanitizeSchedulerTargetPayload(schedule.targetPayload, schedule)\n      targetJobId = await targetQueue.enqueue({\n        ...buildQueueTargetPayload({\n          targetPayload: sanitizedPayload,\n          tenantId: schedule.tenantId,\n          organizationId: schedule.organizationId,\n          idempotencyKey,\n        }),\n        _jobOrigin: 'scheduler' as const,\n      })\n    } finally {\n      // Always close the queue instance to free Redis connections\n      await targetQueue.close()\n    }\n    \n    // Update schedule's last run time\n    schedule.lastRunAt = new Date()\n    await em.flush()\n\n    await emitSchedulerEvent('scheduler.job.completed', {\n      id: schedule.id,\n      tenantId: schedule.tenantId,\n      organizationId: schedule.organizationId,\n      queueJobId: targetJobId,\n      queueName: schedule.targetQueue,\n    })\n\n    logger.debug('Successfully enqueued job', {\n      scheduleId: schedule.id,\n      targetQueue: schedule.targetQueue,\n      queueJobId: targetJobId,\n    })\n\n  } else if (schedule.targetType === 'command' && schedule.targetCommand) {\n    const commandBus = new CommandBus()\n    const actorUserId = typeof schedule.createdByUserId === 'string' ? schedule.createdByUserId.trim() : ''\n    await assertSchedulerSafeCommandAuthorized({\n      commandId: schedule.targetCommand,\n      actorUserId,\n      tenantId: schedule.tenantId,\n      organizationId: schedule.organizationId,\n      rbacService,\n    })\n    \n    const commandInput = {\n      ...((schedule.targetPayload as Record<string, unknown>) || {}),\n      tenantId: schedule.tenantId,\n      organizationId: schedule.organizationId,\n    }\n    \n    // Build the schedule-scoped command context after the allowlist/RBAC gate.\n    const commandCtx = buildScheduledCommandContext(schedule, ctx as unknown as AppContainer)\n    \n    const commandResult = await commandBus.execute(schedule.targetCommand, {\n      input: commandInput,\n      ctx: commandCtx,\n    })\n    \n    // Update schedule's last run time\n    schedule.lastRunAt = new Date()\n    await em.flush()\n    \n    await emitSchedulerEvent('scheduler.job.completed', {\n      id: schedule.id,\n      tenantId: schedule.tenantId,\n      organizationId: schedule.organizationId,\n      commandId: schedule.targetCommand,\n      commandResult: commandResult.result,\n    })\n    \n    logger.debug('Successfully executed command', {\n      scheduleId: schedule.id,\n      commandId: schedule.targetCommand,\n    })\n\n  } else {\n    throw new Error('Invalid target configuration')\n  }\n}\n"],
-  "mappings": "AACA,SAAS,mBAAmB;AAC5B,SAAS,0BAA0B;AAEnC,SAAS,oBAAoB;AAC7B,SAAS,kBAAkB;AAE3B,SAAS,0BAA0B;AACnC,SAAS,4CAA4C;AACrD,SAAS,oCAAoC;AAC7C,SAAS,yBAAyB,oCAAoC;AACtE,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,SAAS,CAAC;AAG/D,MAAM,WAAuB;AAAA,EAClC,OAAO;AAAA,EACP,aAAa;AAAA;AACf;AA4CA,eAAO,sBACL,KACA,KACe;AACf,SAAO,MAAM,kBAAkB;AAAA,IAC7B,OAAO,IAAI;AAAA,IACX,eAAe,IAAI;AAAA,EACrB,CAAC;AAGD,QAAM,UAAW,IAAI,WAAY,IAAqD;AAEtF,MAAI,CAAC,WAAW,CAAC,QAAQ,YAAY;AACnC,WAAO,MAAM,2CAA2C,EAAE,OAAO,IAAI,MAAM,CAAC;AAC5E,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACzD;AAEA,QAAM,EAAE,WAAW,IAAI;AAEvB,QAAM,KAAK,IAAI,QAAuB,IAAI;AAC1C,QAAM,cAAc,IAAI,QAAyB,aAAa;AAG9D,QAAM,WAAW,MAAM,GAAG,QAAQ,cAAc;AAAA,IAC9C,IAAI;AAAA,IACJ,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,UAAU;AACb,WAAO,KAAK,iCAAiC,EAAE,WAAW,CAAC;AAC3D;AAAA,EACF;AAIA,MAAI,QAAQ,cAAc,SAAS,WAAW;AAC5C,WAAO,MAAM,oCAAoC;AAAA,MAC/C;AAAA,MACA,cAAc,QAAQ;AAAA,MACtB,SAAS,SAAS;AAAA,IACpB,CAAC;AACD,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AAEA,MAAI,QAAQ,aAAa,SAAS,UAAU;AAC1C,WAAO,MAAM,mCAAmC;AAAA,MAC9C;AAAA,MACA,eAAe,QAAQ;AAAA,MACvB,UAAU,SAAS;AAAA,IACrB,CAAC;AACD,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AAEA,MAAI,QAAQ,mBAAmB,SAAS,gBAAgB;AACtD,WAAO,MAAM,yCAAyC;AAAA,MACpD;AAAA,MACA,YAAY,QAAQ;AAAA,MACpB,OAAO,SAAS;AAAA,IAClB,CAAC;AACD,UAAM,IAAI,MAAM,8DAA8D;AAAA,EAChF;AAGA,MAAI,CAAC,SAAS,WAAW;AACvB,WAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC;AACnD,UAAM,mBAAmB,yBAAyB;AAAA,MAChD,IAAI,SAAS;AAAA,MACb,UAAU,SAAS;AAAA,MACnB,gBAAgB,SAAS;AAAA,MACzB,QAAQ;AAAA,IACV,CAAC;AACD;AAAA,EACF;AAGA,QAAM,mBAAmB,yBAAyB;AAAA,IAChD,IAAI,SAAS;AAAA,IACb,UAAU,SAAS;AAAA,IACnB,gBAAgB,SAAS;AAAA,IACzB,cAAc,SAAS;AAAA,IACvB,eAAe,IAAI,iBAAiB;AAAA,EACtC,CAAC;AAGD,MAAI,SAAS,gBAAgB;AAC3B,UAAM,aAAa,MAAM,YAAY;AAAA,MACnC,SAAS;AAAA,MACT,SAAS;AAAA,MACT,EAAE,gBAAgB,SAAS,eAAe;AAAA,IAC5C;AAEA,QAAI,CAAC,YAAY;AACf,YAAM,mBAAmB,yBAAyB;AAAA,QAChD,IAAI,SAAS;AAAA,QACb,UAAU,SAAS;AAAA,QACnB,gBAAgB,SAAS;AAAA,QACzB,QAAQ,wBAAwB,SAAS,cAAc;AAAA,MACzD,CAAC;AAED,aAAO,MAAM,yCAAyC,EAAE,YAAY,gBAAgB,SAAS,eAAe,CAAC;AAC7G;AAAA,IACF;AAAA,EACF;AAGA,MAAI,SAAS,eAAe,WAAW,SAAS,aAAa;AAK3D,QAAI,CAAC,+BAA+B,QAAQ,GAAG;AAC7C,aAAO,MAAM,+CAA+C;AAAA,QAC1D;AAAA,QACA,aAAa,SAAS;AAAA,QACtB,YAAY,SAAS;AAAA,QACrB,cAAc,SAAS,eAAe,WAAW,SAAS,eAAe;AAAA,MAC3E,CAAC;AACD,YAAM,mBAAmB,yBAAyB;AAAA,QAChD,IAAI,SAAS;AAAA,QACb,UAAU,SAAS;AAAA,QACnB,gBAAgB,SAAS;AAAA,QACzB,QAAQ,8CAA8C,SAAS,WAAW;AAAA,MAC5E,CAAC;AACD;AAAA,IACF;AAIA,UAAM,eAAe,+BAA+B,SAAS,aAAa,SAAS,aAAa;AAChG,QAAI,cAAc;AAChB,aAAO,MAAM,2DAA2D;AAAA,QACtE;AAAA,QACA,aAAa,SAAS;AAAA,QACtB,OAAO;AAAA,MACT,CAAC;AACD,YAAM,mBAAmB,yBAAyB;AAAA,QAChD,IAAI,SAAS;AAAA,QACb,UAAU,SAAS;AAAA,QACnB,gBAAgB,SAAS;AAAA,QACzB,QAAQ,uCAAuC,SAAS,WAAW;AAAA,MACrE,CAAC;AACD;AAAA,IACF;AAEA,UAAM,wBAAwB,kCAAkC,SAAS,WAAW;AACpF,QAAI,SAAS,cAAc,YAAY,sBAAsB,SAAS,GAAG;AACvE,iBAAW,WAAW,uBAAuB;AAC3C,YAAI,MAAM,YAAY,iBAAiB,SAAS,UAAU,SAAS,EAAE,gBAAgB,SAAS,eAAe,CAAC,EAAG;AACjH,eAAO,MAAM,+EAA+E;AAAA,UAC1F;AAAA,UACA,aAAa,SAAS;AAAA,UACtB;AAAA,QACF,CAAC;AACD,cAAM,mBAAmB,yBAAyB;AAAA,UAChD,IAAI,SAAS;AAAA,UACb,UAAU,SAAS;AAAA,UACnB,gBAAgB,SAAS;AAAA,UACzB,QAAQ,oDAAoD,SAAS,WAAW,KAAK,OAAO;AAAA,QAC9F,CAAC;AACD;AAAA,MACF;AAAA,IACF;AAGA,UAAM,gBAAiB,QAAQ,IAAI,kBAAkB;AACrD,UAAM,cAAc,YAAY,SAAS,aAAa,eAAe;AAAA,MACnE,YAAY,EAAE,KAAK,mBAAmB,OAAO,EAAE;AAAA,IACjD,CAAC;AAED,QAAI;AACJ,QAAI;AAIF,YAAM,iBAAiB,6BAA6B,SAAS,IAAI,IAAI,SAAS,KAAK,IAAI,CAAC;AAIxF,YAAM,mBAAmB,+BAA+B,SAAS,eAAe,QAAQ;AACxF,oBAAc,MAAM,YAAY,QAAQ;AAAA,QACtC,GAAG,wBAAwB;AAAA,UACzB,eAAe;AAAA,UACf,UAAU,SAAS;AAAA,UACnB,gBAAgB,SAAS;AAAA,UACzB;AAAA,QACF,CAAC;AAAA,QACD,YAAY;AAAA,MACd,CAAC;AAAA,IACH,UAAE;AAEA,YAAM,YAAY,MAAM;AAAA,IAC1B;AAGA,aAAS,YAAY,oBAAI,KAAK;AAC9B,UAAM,GAAG,MAAM;AAEf,UAAM,mBAAmB,2BAA2B;AAAA,MAClD,IAAI,SAAS;AAAA,MACb,UAAU,SAAS;AAAA,MACnB,gBAAgB,SAAS;AAAA,MACzB,YAAY;AAAA,MACZ,WAAW,SAAS;AAAA,IACtB,CAAC;AAED,WAAO,MAAM,6BAA6B;AAAA,MACxC,YAAY,SAAS;AAAA,MACrB,aAAa,SAAS;AAAA,MACtB,YAAY;AAAA,IACd,CAAC;AAAA,EAEH,WAAW,SAAS,eAAe,aAAa,SAAS,eAAe;AACtE,UAAM,aAAa,IAAI,WAAW;AAClC,UAAM,cAAc,OAAO,SAAS,oBAAoB,WAAW,SAAS,gBAAgB,KAAK,IAAI;AACrG,UAAM,qCAAqC;AAAA,MACzC,WAAW,SAAS;AAAA,MACpB;AAAA,MACA,UAAU,SAAS;AAAA,MACnB,gBAAgB,SAAS;AAAA,MACzB;AAAA,IACF,CAAC;AAED,UAAM,eAAe;AAAA,MACnB,GAAK,SAAS,iBAA6C,CAAC;AAAA,MAC5D,UAAU,SAAS;AAAA,MACnB,gBAAgB,SAAS;AAAA,IAC3B;AAGA,UAAM,aAAa,6BAA6B,UAAU,GAA8B;AAExF,UAAM,gBAAgB,MAAM,WAAW,QAAQ,SAAS,eAAe;AAAA,MACrE,OAAO;AAAA,MACP,KAAK;AAAA,IACP,CAAC;AAGD,aAAS,YAAY,oBAAI,KAAK;AAC9B,UAAM,GAAG,MAAM;AAEf,UAAM,mBAAmB,2BAA2B;AAAA,MAClD,IAAI,SAAS;AAAA,MACb,UAAU,SAAS;AAAA,MACnB,gBAAgB,SAAS;AAAA,MACzB,WAAW,SAAS;AAAA,MACpB,eAAe,cAAc;AAAA,IAC/B,CAAC;AAED,WAAO,MAAM,iCAAiC;AAAA,MAC5C,YAAY,SAAS;AAAA,MACrB,WAAW,SAAS;AAAA,IACtB,CAAC;AAAA,EAEH,OAAO;AACL,UAAM,IAAI,MAAM,8BAA8B;AAAA,EAChD;AACF;",
+  "sourcesContent": ["import type { QueuedJob, JobContext, WorkerMeta } from '@open-mercato/queue'\nimport { createQueue } from '@open-mercato/queue'\nimport { getRedisUrlOrThrow } from '@open-mercato/shared/lib/redis/connection'\nimport type { EntityManager } from '@mikro-orm/core'\nimport { ScheduledJob } from '../data/entities.js'\nimport { CommandBus } from '@open-mercato/shared/lib/commands'\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport { emitSchedulerEvent } from '../events.js'\nimport { assertSchedulerSafeCommandAuthorized } from '../lib/scheduler-safe-commands.js'\nimport { buildScheduledCommandContext } from '../lib/commandContext.js'\nimport { buildQueueTargetPayload, buildSchedulerIdempotencyKey } from '../lib/queueTargetPayload.js'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('scheduler').child({ component: 'worker' })\n\n// Worker metadata for auto-discovery\nexport const metadata: WorkerMeta = {\n  queue: 'scheduler-execution',\n  concurrency: 5, // Process up to 5 schedules concurrently\n}\n\nexport type ExecuteSchedulePayload = {\n  scheduleId: string\n  tenantId?: string | null\n  organizationId?: string | null\n  scopeType: 'system' | 'organization' | 'tenant'\n  triggerType?: 'scheduled' | 'manual'\n  triggeredByUserId?: string | null\n}\n\ntype HandlerContext = { resolve: <T = unknown>(name: string) => T }\ntype RbacServiceLike = {\n  tenantHasFeature(\n    tenantId: string | null | undefined,\n    feature: string,\n    opts?: { organizationId?: string | null },\n  ): Promise<boolean>\n  userHasAllFeatures(\n    userId: string,\n    required: readonly string[],\n    scope: { tenantId: string | null; organizationId: string | null },\n  ): Promise<boolean>\n}\n\n/**\n * Worker that executes scheduled jobs.\n * \n * This worker is triggered by BullMQ repeatable jobs at the scheduled times.\n * It loads the fresh schedule configuration from the database, validates\n * conditions, and enqueues the target job or executes the command.\n * \n * BullMQ handles:\n * - Timing (exact cron/interval execution)\n * - Distributed locking (prevents duplicate execution)\n * - Retries (if worker fails)\n * - Execution history (via job state, logs, timestamps)\n * \n * This worker handles:\n * - Loading fresh schedule config\n * - Checking feature flags and conditions\n * - Enqueuing target job or executing command\n * - Updating last run time\n */\nexport default async function executeScheduleWorker(\n  job: QueuedJob<ExecuteSchedulePayload>,\n  ctx: JobContext & HandlerContext,\n): Promise<void> {\n  logger.debug('Processing job', {\n    jobId: ctx.jobId,\n    attemptNumber: ctx.attemptNumber,\n  })\n  \n  // Defensive: handle both data and payload for BullMQ compatibility\n  const payload = (job.payload || (job as unknown as { data?: ExecuteSchedulePayload }).data) as ExecuteSchedulePayload | undefined\n  \n  if (!payload || !payload.scheduleId) {\n    logger.error('Invalid job payload: scheduleId missing', { jobId: ctx.jobId })\n    throw new Error('scheduleId is required in job payload')\n  }\n\n  const { scheduleId } = payload\n\n  const em = ctx.resolve<EntityManager>('em')\n  const rbacService = ctx.resolve<RbacServiceLike>('rbacService')\n\n  // Load fresh schedule from database\n  const schedule = await em.findOne(ScheduledJob, { \n    id: scheduleId,\n    deletedAt: null,\n  })\n\n  if (!schedule) {\n    logger.info('Schedule not found or deleted', { scheduleId })\n    return\n  }\n\n  // CRITICAL: Verify scope integrity - ensure payload scope matches database\n  // This prevents scope tampering and ensures proper multi-tenant isolation\n  if (payload.scopeType !== schedule.scopeType) {\n    logger.error('Scope type mismatch for schedule', {\n      scheduleId,\n      payloadScope: payload.scopeType,\n      dbScope: schedule.scopeType,\n    })\n    throw new Error('Schedule scope type mismatch - potential security issue')\n  }\n\n  if (payload.tenantId !== schedule.tenantId) {\n    logger.error('Tenant ID mismatch for schedule', {\n      scheduleId,\n      payloadTenant: payload.tenantId,\n      dbTenant: schedule.tenantId,\n    })\n    throw new Error('Schedule tenant ID mismatch - potential security issue')\n  }\n\n  if (payload.organizationId !== schedule.organizationId) {\n    logger.error('Organization ID mismatch for schedule', {\n      scheduleId,\n      payloadOrg: payload.organizationId,\n      dbOrg: schedule.organizationId,\n    })\n    throw new Error('Schedule organization ID mismatch - potential security issue')\n  }\n\n  // Check if schedule is still enabled\n  if (!schedule.isEnabled) {\n    logger.debug('Schedule is disabled', { scheduleId })\n    await emitSchedulerEvent('scheduler.job.skipped', {\n      id: schedule.id,\n      tenantId: schedule.tenantId,\n      organizationId: schedule.organizationId,\n      reason: 'Schedule is disabled',\n    })\n    return\n  }\n\n  // Emit started event\n  await emitSchedulerEvent('scheduler.job.started', {\n    id: schedule.id,\n    tenantId: schedule.tenantId,\n    organizationId: schedule.organizationId,\n    scheduleName: schedule.name,\n    attemptNumber: ctx.attemptNumber || 1,\n  })\n\n  // Check feature flag if required\n  if (schedule.requireFeature) {\n    const hasFeature = await rbacService.tenantHasFeature(\n      schedule.tenantId,\n      schedule.requireFeature,\n      { organizationId: schedule.organizationId },\n    )\n    \n    if (!hasFeature) {\n      await emitSchedulerEvent('scheduler.job.skipped', {\n        id: schedule.id,\n        tenantId: schedule.tenantId,\n        organizationId: schedule.organizationId,\n        reason: `Feature not enabled: ${schedule.requireFeature}`,\n      })\n\n      logger.debug('Schedule skipped: feature not enabled', { scheduleId, requireFeature: schedule.requireFeature })\n      return\n    }\n  }\n\n  // Enqueue target job or execute command\n  if (schedule.targetType === 'queue' && schedule.targetQueue) {\n    // Determine queue strategy from environment\n    const queueStrategy = (process.env.QUEUE_STRATEGY || 'local') as 'local' | 'async'\n    const targetQueue = createQueue(schedule.targetQueue, queueStrategy, {\n      connection: { url: getRedisUrlOrThrow('QUEUE') },\n    })\n    \n    let targetJobId: string | undefined\n    try {\n      // The execute-schedule job id is stable across BullMQ retries, so if\n      // this worker crashes between enqueue and DB flush the retried attempt\n      // reuses the same idempotency key and downstream workers can dedupe.\n      const idempotencyKey = buildSchedulerIdempotencyKey(schedule.id, ctx.jobId ?? Date.now())\n\n      targetJobId = await targetQueue.enqueue(buildQueueTargetPayload({\n        targetPayload: schedule.targetPayload,\n        tenantId: schedule.tenantId,\n        organizationId: schedule.organizationId,\n        idempotencyKey,\n      }))\n    } finally {\n      // Always close the queue instance to free Redis connections\n      await targetQueue.close()\n    }\n    \n    // Update schedule's last run time\n    schedule.lastRunAt = new Date()\n    await em.flush()\n\n    await emitSchedulerEvent('scheduler.job.completed', {\n      id: schedule.id,\n      tenantId: schedule.tenantId,\n      organizationId: schedule.organizationId,\n      queueJobId: targetJobId,\n      queueName: schedule.targetQueue,\n    })\n\n    logger.debug('Successfully enqueued job', {\n      scheduleId: schedule.id,\n      targetQueue: schedule.targetQueue,\n      queueJobId: targetJobId,\n    })\n\n  } else if (schedule.targetType === 'command' && schedule.targetCommand) {\n    const commandBus = new CommandBus()\n    const actorUserId = typeof schedule.createdByUserId === 'string' ? schedule.createdByUserId.trim() : ''\n    await assertSchedulerSafeCommandAuthorized({\n      commandId: schedule.targetCommand,\n      actorUserId,\n      tenantId: schedule.tenantId,\n      organizationId: schedule.organizationId,\n      rbacService,\n    })\n    \n    const commandInput = {\n      ...((schedule.targetPayload as Record<string, unknown>) || {}),\n      tenantId: schedule.tenantId,\n      organizationId: schedule.organizationId,\n    }\n    \n    // Build the schedule-scoped command context after the allowlist/RBAC gate.\n    const commandCtx = buildScheduledCommandContext(schedule, ctx as unknown as AppContainer)\n    \n    const commandResult = await commandBus.execute(schedule.targetCommand, {\n      input: commandInput,\n      ctx: commandCtx,\n    })\n    \n    // Update schedule's last run time\n    schedule.lastRunAt = new Date()\n    await em.flush()\n    \n    await emitSchedulerEvent('scheduler.job.completed', {\n      id: schedule.id,\n      tenantId: schedule.tenantId,\n      organizationId: schedule.organizationId,\n      commandId: schedule.targetCommand,\n      commandResult: commandResult.result,\n    })\n    \n    logger.debug('Successfully executed command', {\n      scheduleId: schedule.id,\n      commandId: schedule.targetCommand,\n    })\n\n  } else {\n    throw new Error('Invalid target configuration')\n  }\n}\n"],
+  "mappings": "AACA,SAAS,mBAAmB;AAC5B,SAAS,0BAA0B;AAEnC,SAAS,oBAAoB;AAC7B,SAAS,kBAAkB;AAE3B,SAAS,0BAA0B;AACnC,SAAS,4CAA4C;AACrD,SAAS,oCAAoC;AAC7C,SAAS,yBAAyB,oCAAoC;AACtE,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,SAAS,CAAC;AAG/D,MAAM,WAAuB;AAAA,EAClC,OAAO;AAAA,EACP,aAAa;AAAA;AACf;AA4CA,eAAO,sBACL,KACA,KACe;AACf,SAAO,MAAM,kBAAkB;AAAA,IAC7B,OAAO,IAAI;AAAA,IACX,eAAe,IAAI;AAAA,EACrB,CAAC;AAGD,QAAM,UAAW,IAAI,WAAY,IAAqD;AAEtF,MAAI,CAAC,WAAW,CAAC,QAAQ,YAAY;AACnC,WAAO,MAAM,2CAA2C,EAAE,OAAO,IAAI,MAAM,CAAC;AAC5E,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACzD;AAEA,QAAM,EAAE,WAAW,IAAI;AAEvB,QAAM,KAAK,IAAI,QAAuB,IAAI;AAC1C,QAAM,cAAc,IAAI,QAAyB,aAAa;AAG9D,QAAM,WAAW,MAAM,GAAG,QAAQ,cAAc;AAAA,IAC9C,IAAI;AAAA,IACJ,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,UAAU;AACb,WAAO,KAAK,iCAAiC,EAAE,WAAW,CAAC;AAC3D;AAAA,EACF;AAIA,MAAI,QAAQ,cAAc,SAAS,WAAW;AAC5C,WAAO,MAAM,oCAAoC;AAAA,MAC/C;AAAA,MACA,cAAc,QAAQ;AAAA,MACtB,SAAS,SAAS;AAAA,IACpB,CAAC;AACD,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AAEA,MAAI,QAAQ,aAAa,SAAS,UAAU;AAC1C,WAAO,MAAM,mCAAmC;AAAA,MAC9C;AAAA,MACA,eAAe,QAAQ;AAAA,MACvB,UAAU,SAAS;AAAA,IACrB,CAAC;AACD,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AAEA,MAAI,QAAQ,mBAAmB,SAAS,gBAAgB;AACtD,WAAO,MAAM,yCAAyC;AAAA,MACpD;AAAA,MACA,YAAY,QAAQ;AAAA,MACpB,OAAO,SAAS;AAAA,IAClB,CAAC;AACD,UAAM,IAAI,MAAM,8DAA8D;AAAA,EAChF;AAGA,MAAI,CAAC,SAAS,WAAW;AACvB,WAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC;AACnD,UAAM,mBAAmB,yBAAyB;AAAA,MAChD,IAAI,SAAS;AAAA,MACb,UAAU,SAAS;AAAA,MACnB,gBAAgB,SAAS;AAAA,MACzB,QAAQ;AAAA,IACV,CAAC;AACD;AAAA,EACF;AAGA,QAAM,mBAAmB,yBAAyB;AAAA,IAChD,IAAI,SAAS;AAAA,IACb,UAAU,SAAS;AAAA,IACnB,gBAAgB,SAAS;AAAA,IACzB,cAAc,SAAS;AAAA,IACvB,eAAe,IAAI,iBAAiB;AAAA,EACtC,CAAC;AAGD,MAAI,SAAS,gBAAgB;AAC3B,UAAM,aAAa,MAAM,YAAY;AAAA,MACnC,SAAS;AAAA,MACT,SAAS;AAAA,MACT,EAAE,gBAAgB,SAAS,eAAe;AAAA,IAC5C;AAEA,QAAI,CAAC,YAAY;AACf,YAAM,mBAAmB,yBAAyB;AAAA,QAChD,IAAI,SAAS;AAAA,QACb,UAAU,SAAS;AAAA,QACnB,gBAAgB,SAAS;AAAA,QACzB,QAAQ,wBAAwB,SAAS,cAAc;AAAA,MACzD,CAAC;AAED,aAAO,MAAM,yCAAyC,EAAE,YAAY,gBAAgB,SAAS,eAAe,CAAC;AAC7G;AAAA,IACF;AAAA,EACF;AAGA,MAAI,SAAS,eAAe,WAAW,SAAS,aAAa;AAE3D,UAAM,gBAAiB,QAAQ,IAAI,kBAAkB;AACrD,UAAM,cAAc,YAAY,SAAS,aAAa,eAAe;AAAA,MACnE,YAAY,EAAE,KAAK,mBAAmB,OAAO,EAAE;AAAA,IACjD,CAAC;AAED,QAAI;AACJ,QAAI;AAIF,YAAM,iBAAiB,6BAA6B,SAAS,IAAI,IAAI,SAAS,KAAK,IAAI,CAAC;AAExF,oBAAc,MAAM,YAAY,QAAQ,wBAAwB;AAAA,QAC9D,eAAe,SAAS;AAAA,QACxB,UAAU,SAAS;AAAA,QACnB,gBAAgB,SAAS;AAAA,QACzB;AAAA,MACF,CAAC,CAAC;AAAA,IACJ,UAAE;AAEA,YAAM,YAAY,MAAM;AAAA,IAC1B;AAGA,aAAS,YAAY,oBAAI,KAAK;AAC9B,UAAM,GAAG,MAAM;AAEf,UAAM,mBAAmB,2BAA2B;AAAA,MAClD,IAAI,SAAS;AAAA,MACb,UAAU,SAAS;AAAA,MACnB,gBAAgB,SAAS;AAAA,MACzB,YAAY;AAAA,MACZ,WAAW,SAAS;AAAA,IACtB,CAAC;AAED,WAAO,MAAM,6BAA6B;AAAA,MACxC,YAAY,SAAS;AAAA,MACrB,aAAa,SAAS;AAAA,MACtB,YAAY;AAAA,IACd,CAAC;AAAA,EAEH,WAAW,SAAS,eAAe,aAAa,SAAS,eAAe;AACtE,UAAM,aAAa,IAAI,WAAW;AAClC,UAAM,cAAc,OAAO,SAAS,oBAAoB,WAAW,SAAS,gBAAgB,KAAK,IAAI;AACrG,UAAM,qCAAqC;AAAA,MACzC,WAAW,SAAS;AAAA,MACpB;AAAA,MACA,UAAU,SAAS;AAAA,MACnB,gBAAgB,SAAS;AAAA,MACzB;AAAA,IACF,CAAC;AAED,UAAM,eAAe;AAAA,MACnB,GAAK,SAAS,iBAA6C,CAAC;AAAA,MAC5D,UAAU,SAAS;AAAA,MACnB,gBAAgB,SAAS;AAAA,IAC3B;AAGA,UAAM,aAAa,6BAA6B,UAAU,GAA8B;AAExF,UAAM,gBAAgB,MAAM,WAAW,QAAQ,SAAS,eAAe;AAAA,MACrE,OAAO;AAAA,MACP,KAAK;AAAA,IACP,CAAC;AAGD,aAAS,YAAY,oBAAI,KAAK;AAC9B,UAAM,GAAG,MAAM;AAEf,UAAM,mBAAmB,2BAA2B;AAAA,MAClD,IAAI,SAAS;AAAA,MACb,UAAU,SAAS;AAAA,MACnB,gBAAgB,SAAS;AAAA,MACzB,WAAW,SAAS;AAAA,MACpB,eAAe,cAAc;AAAA,IAC/B,CAAC;AAED,WAAO,MAAM,iCAAiC;AAAA,MAC5C,YAAY,SAAS;AAAA,MACrB,WAAW,SAAS;AAAA,IACtB,CAAC;AAAA,EAEH,OAAO;AACL,UAAM,IAAI,MAAM,8BAA8B;AAAA,EAChD;AACF;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/scheduler",
-  "version": "0.6.8-develop.7100.1.fbf66fca35",
+  "version": "0.7.0",
   "license": "MIT",
   "description": "Database-managed scheduled jobs with admin UI",
   "type": "module",
@@ -59,13 +59,13 @@
     "./*/*/*/*/*/*.json": "./src/*/*/*/*/*/*.json"
   },
   "dependencies": {
-    "@open-mercato/events": "0.6.8-develop.7100.1.fbf66fca35",
-    "@open-mercato/queue": "0.6.8-develop.7100.1.fbf66fca35",
+    "@open-mercato/events": "0.7.0",
+    "@open-mercato/queue": "0.7.0",
     "cron-parser": "^5.6.2"
   },
   "peerDependencies": {
     "@mikro-orm/core": "^7.0.14",
-    "@open-mercato/shared": "0.6.8-develop.7100.1.fbf66fca35",
+    "@open-mercato/shared": "0.7.0",
     "bullmq": "^5.0.0 || ^6.0.0",
     "ioredis": "^5.0.0 || ^6.0.0",
     "zod": ">=3.23.0"
@@ -79,7 +79,7 @@
     }
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.6.8-develop.7100.1.fbf66fca35",
+    "@open-mercato/shared": "0.7.0",
     "@types/jest": "^30.0.0",
     "@types/node": "^26.1.2",
     "jest": "^30.4.2",
@@ -93,6 +93,5 @@
     "type": "git",
     "url": "https://github.com/open-mercato/open-mercato",
     "directory": "packages/scheduler"
-  },
-  "stableVersion": "0.6.7"
+  }
 }

package/src/modules/scheduler/__integration__/TC-SCHED-001.spec.ts

@@ -17,8 +17,8 @@ async function createSchedule(request: import('@playwright/test').APIRequestCont
       scheduleType: 'interval',
       scheduleValue: '15m',
       timezone: 'UTC',
-      targetType: 'command',
-      targetCommand: 'scheduler.test.echo',
+      targetType: 'queue',
+      targetQueue: 'scheduler-execution',
       targetPayload: { source: 'integration-test' },
       isEnabled: true,
       sourceType: 'user',

package/src/modules/scheduler/__integration__/TC-SCHED-004.spec.ts

@@ -1,10 +1,7 @@
 import { expect, test } from '@playwright/test'
 import { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api'
 import { readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures'
-import {
-  SCHEDULER_FORBIDDEN_INTERNAL_QUEUES,
-  SCHEDULER_TARGETS_PATH,
-} from './helpers/scheduler'
+import { SCHEDULER_EXECUTION_QUEUE, SCHEDULER_TARGETS_PATH } from './helpers/scheduler'
 
 type TargetOption = { value: string; label: string }
 type TargetsResponse = { queues?: TargetOption[]; commands?: TargetOption[] }
@@ -24,13 +21,12 @@ function expectOptionShape(options: TargetOption[], label: string) {
 }
 
 /**
- * TC-SCHED-004: GET /api/scheduler/targets returns scheduler-safe queue names
- * and registered command IDs (from the command registry), both sorted
- * alphabetically by value. Internal/system workers must stay undiscoverable.
- * Read-only, no fixtures.
+ * TC-SCHED-004: GET /api/scheduler/targets returns available queue names
+ * (from module workers) and registered command IDs (from the command
+ * registry), both sorted alphabetically by value. Read-only, no fixtures.
  */
 test.describe('TC-SCHED-004: GET /api/scheduler/targets lists queues and commands', () => {
-  test('returns only scheduler-safe queues plus a non-empty sorted command list', async ({ request }) => {
+  test('returns sorted queues (incl. scheduler-execution) and a non-empty command list', async ({ request }) => {
     const token = await getAuthToken(request, 'admin')
 
     const response = await apiRequest(request, 'GET', SCHEDULER_TARGETS_PATH, { token })
@@ -40,14 +36,12 @@ test.describe('TC-SCHED-004: GET /api/scheduler/targets lists queues and command
     const queues = body?.queues ?? []
     const commands = body?.commands ?? []
 
-    // Queues: well-shaped, sorted, and free of internal/system worker queues (#5213).
+    // Queues: non-empty, well-shaped, sorted, and include the known scheduler queue.
     expect(Array.isArray(body?.queues)).toBe(true)
+    expect(queues.length).toBeGreaterThan(0)
     expectOptionShape(queues, 'queues')
+    expect(queues.map((queue) => queue.value)).toContain(SCHEDULER_EXECUTION_QUEUE)
     expectSortedByValue(queues, 'queues')
-    const queueValues = queues.map((queue) => queue.value)
-    for (const forbidden of SCHEDULER_FORBIDDEN_INTERNAL_QUEUES) {
-      expect(queueValues, `internal queue ${forbidden} must not be a scheduler target`).not.toContain(forbidden)
-    }
 
     // Commands: non-empty, well-shaped, and sorted.
     expect(Array.isArray(body?.commands)).toBe(true)

package/src/modules/scheduler/__integration__/TC-SCHED-007.spec.ts

@@ -1,7 +1,7 @@
 import { expect, test } from '@playwright/test'
 import { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api'
 import { readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures'
-import { SCHEDULER_JOBS_PATH, SCHEDULER_TEST_COMMAND, uniqueScheduleName } from './helpers/scheduler'
+import { SCHEDULER_EXECUTION_QUEUE, SCHEDULER_JOBS_PATH, uniqueScheduleName } from './helpers/scheduler'
 
 type ValidationError = { error?: string; details?: Array<{ path?: Array<string | number> }> }
 
@@ -36,8 +36,8 @@ test.describe('TC-SCHED-007: POST /api/scheduler/jobs validates schedule value f
           scheduleType: testCase.scheduleType,
           scheduleValue: testCase.scheduleValue,
           timezone: 'UTC',
-          targetType: 'command',
-          targetCommand: SCHEDULER_TEST_COMMAND,
+          targetType: 'queue',
+          targetQueue: SCHEDULER_EXECUTION_QUEUE,
           isEnabled: true,
           sourceType: 'user',
         },

package/src/modules/scheduler/__integration__/TC-SCHED-CRUDFORM-001.spec.ts

@@ -90,7 +90,7 @@ test.describe('TC-SCHED-CRUDFORM-001: Scheduled Job CrudForm persists scope, tar
           scheduleValue: '15m',
           timezone: 'UTC',
           targetType: 'queue',
-          targetQueue: 'scheduler-test',
+          targetQueue: 'scheduler-execution',
           targetPayload: createPayload,
           isEnabled: true,
           sourceType: 'user',
@@ -105,7 +105,7 @@ test.describe('TC-SCHED-CRUDFORM-001: Scheduled Job CrudForm persists scope, tar
           scheduleValue: '15m',
           timezone: 'UTC',
           targetType: 'queue',
-          targetQueue: 'scheduler-test',
+          targetQueue: 'scheduler-execution',
           targetCommand: null,
           targetPayload: createPayload,
           isEnabled: true,
@@ -133,7 +133,7 @@ test.describe('TC-SCHED-CRUDFORM-001: Scheduled Job CrudForm persists scope, tar
           scheduleValue: '0 0 * * *',
           timezone: 'Europe/Warsaw',
           targetType: 'queue',
-          targetQueue: 'scheduler-test',
+          targetQueue: 'scheduler-execution',
           targetCommand: null,
           targetPayload: updatePayload,
           isEnabled: false,

package/src/modules/scheduler/__integration__/TC-UNDO-001-scheduler-jobs.spec.ts

@@ -1,174 +1,86 @@
-import { expect, test, type APIRequestContext, type APIResponse } from '@playwright/test'
+import { expect, test } from '@playwright/test'
 import { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api'
+import {
+  extractOperation,
+  runCrudUndoRoundTrip,
+  skipIfUndoTestsDisabled,
+} from '@open-mercato/core/helpers/integration/undoHarness'
+import {
+  SCHEDULER_JOBS_PATH,
+  SCHEDULER_TRIGGER_PATH,
+  createScheduleJob,
+  deleteScheduleJob,
+} from './helpers/scheduler'
 
 /**
- * TC-UNDO-001: scheduler.jobs undo round-trip (regression for issue #2504).
+ * TC-UNDO-001 (#2582, refs #2468) — scheduler.jobs undo/redo correctness.
  *
- * Before the fix, every scheduler.jobs undo handler read `logEntry.payload`
- * (always undefined — the command bus persists the undo snapshot under
- * `commandPayload`), so undo returned `{ ok: true }` while silently changing
- * nothing. This spec exercises the real HTTP path end-to-end:
- *   - CREATE -> undo  => job is soft-deleted (no longer listed)
- *   - UPDATE -> undo  => renamed field is restored to its prior value
- *   - DELETE -> undo  => soft-deleted job is re-materialized
+ * Regression lock for #2504: scheduler.jobs undo was a silent no-op because every
+ * undo handler read `logEntry.payload` (always undefined — the command bus persists
+ * the undo snapshot under `commandPayload`), so undo returned `{ ok: true }` while
+ * changing nothing. Fixed in PR #2514 via `extractUndoPayload`. This spec asserts the
+ * corrected behavior (full restoration), driving the real command bus through the
+ * public API + the audit-log undo/redo endpoints.
  *
- * Endpoints covered:
- *   - POST   /api/scheduler/jobs                       (create)
- *   - GET    /api/scheduler/jobs?id=                   (read)
- *   - PUT    /api/scheduler/jobs                       (update)
- *   - DELETE /api/scheduler/jobs                       (delete, cleanup)
- *   - POST   /api/audit_logs/audit-logs/actions/undo   (undo)
+ * scheduler.jobs is a standard `makeCrudRoute` entity (POST/PUT/DELETE on the
+ * collection, `?id=` read-back, camelCase serializer, no custom fields), so the shared
+ * `runCrudUndoRoundTrip` harness covers the full round-trip in one pass:
+ *   - I1 update → undo restores every scalar (and bumps `updatedAt`)
+ *   - I2 delete → undo re-materializes the soft-deleted job
+ *   - I3 create → undo soft-deletes (never hard-deletes)
+ *   - I5 a consumed undo token is rejected on a second undo
+ *   - I6 redo re-applies the command's after-snapshot
+ *
+ * I4 (custom fields) is N/A — `scheduled_job` declares no `ce.ts`, so it has no `cf_*`.
  */
-
-type ScheduleRow = {
-  id: string
-  name: string
-  description: string | null
-  scheduleValue: string
-}
-
-// The undo endpoint only honors the *latest* undoable log for a resource, and
-// `latestUndoableForResource` orders by `created_at` alone. Audit `created_at` is
-// millisecond-precision (`new Date()` at log time), so a create + a follow-up
-// mutation issued within the same millisecond tie and the lookup may resolve to
-// the wrong log. A short settle guarantees the operation under undo is strictly
-// the most recent, keeping the round-trip deterministic.
-async function settleAuditClock(): Promise<void> {
-  await new Promise((resolve) => setTimeout(resolve, 50))
-}
-
-function readUndoToken(res: APIResponse): string {
-  const header = res.headers()['x-om-operation'] ?? ''
-  const enc = header.startsWith('omop:') ? header.slice(5) : ''
-  expect(enc, 'x-om-operation header should carry an omop: payload').not.toBe('')
-  const payload = JSON.parse(decodeURIComponent(enc)) as { undoToken?: string }
-  expect(typeof payload.undoToken, 'undoToken present in operation payload').toBe('string')
-  return payload.undoToken as string
-}
-
-async function getById(
-  request: APIRequestContext,
-  token: string,
-  id: string,
-): Promise<ScheduleRow | undefined> {
-  const res = await apiRequest(request, 'GET', `/api/scheduler/jobs?id=${encodeURIComponent(id)}`, { token })
-  expect(res.status()).toBe(200)
-  const body = (await res.json()) as { items?: ScheduleRow[] }
-  return (body.items ?? [])[0]
-}
-
-async function createJob(request: APIRequestContext, token: string, name: string): Promise<{ id: string; res: APIResponse }> {
-  const res = await apiRequest(request, 'POST', '/api/scheduler/jobs', {
-    token,
-    data: {
-      name,
-      description: 'TC-UNDO-001 probe',
-      scopeType: 'tenant',
-      scheduleType: 'cron',
-      scheduleValue: '0 0 * * *',
-      timezone: 'UTC',
-      targetType: 'command',
-      targetCommand: 'scheduler.test.echo',
-      isEnabled: true,
-      sourceType: 'user',
-    },
-  })
-  expect(res.status(), 'create returns 201').toBe(201)
-  const id = ((await res.json()) as { id: string }).id
-  expect(id, 'create returns an id').toBeTruthy()
-  return { id, res }
-}
-
-async function undo(request: APIRequestContext, token: string, undoToken: string): Promise<void> {
-  const res = await apiRequest(request, 'POST', '/api/audit_logs/audit-logs/actions/undo', {
-    token,
-    data: { undoToken },
-  })
-  const raw = await res.text()
-  expect(res.status(), `undo returns 200 (body: ${raw})`).toBe(200)
-  const body = JSON.parse(raw) as { ok?: boolean }
-  expect(body.ok, 'undo body is { ok: true }').toBe(true)
-}
-
-async function cleanup(request: APIRequestContext, token: string | null, id: string | null): Promise<void> {
-  if (!token || !id) return
-  try {
-    await apiRequest(request, 'DELETE', '/api/scheduler/jobs', { token, data: { id } })
-  } catch {
-    /* ignore */
+function jobCreatePayload(stamp: string): Record<string, unknown> {
+  return {
+    name: `TC-UNDO-001 Scheduler ${stamp}`,
+    description: 'TC-UNDO-001 undo/redo probe',
+    scopeType: 'organization',
+    scheduleType: 'interval',
+    scheduleValue: '15m',
+    timezone: 'UTC',
+    targetType: 'queue',
+    targetQueue: 'scheduler-execution',
+    isEnabled: true,
+    sourceType: 'user',
   }
 }
 
-test.describe('TC-UNDO-001: scheduler.jobs undo actually restores state (#2504)', () => {
-  test('UPDATE -> undo restores the prior name', async ({ request }) => {
-    let token: string | null = null
-    let id: string | null = null
-    try {
-      token = await getAuthToken(request, 'admin')
-      const originalName = `TC-UNDO-001 Update ${Date.now()}`
-      ;({ id } = await createJob(request, token, originalName))
-      await settleAuditClock()
-
-      const updateRes = await apiRequest(request, 'PUT', '/api/scheduler/jobs', {
-        token,
-        data: { id, name: `${originalName} RENAMED` },
-      })
-      expect(updateRes.status(), 'update returns 200').toBe(200)
-      expect((await getById(request, token, id))?.name).toBe(`${originalName} RENAMED`)
+test.describe('TC-UNDO-001 scheduler.jobs undo/redo (#2504)', () => {
+  test.beforeAll(() => {
+    skipIfUndoTestsDisabled()
+  })
 
-      await undo(request, token, readUndoToken(updateRes))
+  test('jobs CRUD commands restore scalar state on undo/redo (I1/I2/I3/I5/I6)', async ({ request }) => {
+    const token = await getAuthToken(request, 'admin')
 
-      const restored = await getById(request, token, id)
-      expect(restored, 'job still exists after update-undo').toBeTruthy()
-      expect(restored!.name, 'name restored to original by undo').toBe(originalName)
-    } finally {
-      await cleanup(request, token, id)
-    }
+    await runCrudUndoRoundTrip(request, token, {
+      label: 'scheduler.jobs',
+      collectionPath: SCHEDULER_JOBS_PATH,
+      field: 'name',
+      createPayload: jobCreatePayload,
+      updatePayload: (id, stamp) => ({ id, name: `TC-UNDO-001 Scheduler Renamed ${stamp}` }),
+    })
   })
 
-  test('DELETE -> undo re-lists the soft-deleted job', async ({ request }) => {
-    let token: string | null = null
-    let id: string | null = null
+  // §4 — manual trigger is a fire-and-forget enqueue that never goes through the
+  // command bus, so it exposes no undo affordance. The assertion holds regardless of
+  // QUEUE_STRATEGY: async returns 200 (enqueued), local returns 400 (rejected) — neither
+  // issues an `x-om-operation` undo token.
+  test('§4 trigger exposes no undo token', async ({ request }) => {
+    const token = await getAuthToken(request, 'admin')
+    let jobId: string | null = null
     try {
-      token = await getAuthToken(request, 'admin')
-      const name = `TC-UNDO-001 Delete ${Date.now()}`
-      ;({ id } = await createJob(request, token, name))
-      await settleAuditClock()
-
-      const deleteRes = await apiRequest(request, 'DELETE', '/api/scheduler/jobs', {
+      jobId = await createScheduleJob(request, token)
+      const triggerRes = await apiRequest(request, 'POST', SCHEDULER_TRIGGER_PATH, {
         token,
-        data: { id },
+        data: { id: jobId },
       })
-      expect(deleteRes.status(), 'delete returns 200').toBe(200)
-      expect(await getById(request, token, id), 'job is gone after delete').toBeFalsy()
-
-      await undo(request, token, readUndoToken(deleteRes))
-
-      const restored = await getById(request, token, id)
-      expect(restored, 'job re-materialized by delete-undo').toBeTruthy()
-      expect(restored!.name).toBe(name)
-    } finally {
-      await cleanup(request, token, id)
-    }
-  })
-
-  test('CREATE -> undo removes the created job', async ({ request }) => {
-    let token: string | null = null
-    let id: string | null = null
-    try {
-      token = await getAuthToken(request, 'admin')
-      const name = `TC-UNDO-001 Create ${Date.now()}`
-      const created = await createJob(request, token, name)
-      id = created.id
-
-      expect(await getById(request, token, id), 'job exists after create').toBeTruthy()
-
-      await undo(request, token, readUndoToken(created.res))
-
-      expect(await getById(request, token, id), 'job removed by create-undo').toBeFalsy()
-      id = null // already undone; nothing to clean up
+      expect(extractOperation(triggerRes), 'trigger response carries no undo token (§4)').toBeNull()
     } finally {
-      await cleanup(request, token, id)
+      await deleteScheduleJob(request, token, jobId)
     }
   })
 })

package/src/modules/scheduler/__integration__/helpers/scheduler.ts

@@ -6,25 +6,9 @@ export const SCHEDULER_JOBS_PATH = '/api/scheduler/jobs'
 export const SCHEDULER_TARGETS_PATH = '/api/scheduler/targets'
 export const SCHEDULER_TRIGGER_PATH = '/api/scheduler/trigger'
 
-/** Queue registered by the scheduler module's execute-schedule worker (internal, not schedulable). */
+/** Queue registered by the scheduler module's execute-schedule worker. */
 export const SCHEDULER_EXECUTION_QUEUE = 'scheduler-execution'
 
-/** Deliberately side-effect-free queue whose worker opted into scheduling (#5213). */
-export const SCHEDULER_TEST_QUEUE = 'scheduler-test'
-
-/**
- * Internal queues that must never be offered as scheduler targets (#5213).
- * Workers must opt in via `schedulerSafe: true` to become schedulable.
- */
-export const SCHEDULER_FORBIDDEN_INTERNAL_QUEUES = [
-  SCHEDULER_EXECUTION_QUEUE,
-  'stripe-webhook',
-  'payment-gateways-webhook',
-] as const
-
-/** Always-registered command used by fixtures now that queue targets are restricted. */
-export const SCHEDULER_TEST_COMMAND = 'scheduler.test.echo'
-
 export type SchedulerJob = {
   id: string
   name: string
@@ -67,19 +51,16 @@ export function uniqueScheduleName(prefix: string): string {
 }
 
 /**
- * Create an organization-scoped schedule via the API and return its id.
+ * Create an organization-scoped queue-target schedule via the API and return its id.
  * Org/tenant are derived server-side from the caller's auth context, so the caller
  * only needs an admin (or otherwise scheduler.jobs.manage) token.
- *
- * Defaults to a command target: user-authored queue targets are restricted to
- * scheduler-safe queues (#5213), so fixtures must not assume a queue is allowed.
  */
 export async function createScheduleJob(
   request: APIRequestContext,
   token: string,
   overrides: CreateScheduleOverrides = {},
 ): Promise<string> {
-  const targetType = overrides.targetType ?? 'command'
+  const targetType = overrides.targetType ?? 'queue'
   const data: Record<string, unknown> = {
     name: overrides.name ?? uniqueScheduleName('Integration Scheduler'),
     description: overrides.description ?? 'Created by scheduler integration tests',
@@ -93,9 +74,9 @@ export async function createScheduleJob(
     sourceType: overrides.sourceType ?? 'user',
   }
   if (targetType === 'command') {
-    data.targetCommand = overrides.targetCommand ?? SCHEDULER_TEST_COMMAND
+    data.targetCommand = overrides.targetCommand
   } else {
-    data.targetQueue = overrides.targetQueue ?? SCHEDULER_TEST_QUEUE
+    data.targetQueue = overrides.targetQueue ?? SCHEDULER_EXECUTION_QUEUE
   }
 
   const response = await apiRequest(request, 'POST', SCHEDULER_JOBS_PATH, { token, data })

package/src/modules/scheduler/api/jobs/[id]/executions/route.ts

@@ -5,7 +5,6 @@ import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import type { EntityManager } from '@mikro-orm/core'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { ScheduledJob } from '../../../../data/entities.js'
-import { resolveScheduleAccess } from '../../../../lib/scheduleAccess.js'
 import { getRedisUrlOrThrow, parseRedisUrl } from '@open-mercato/shared/lib/redis/connection'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { createLogger } from '@open-mercato/shared/lib/logger'
@@ -41,19 +40,30 @@ export async function GET(
   const scheduleId = params.id
 
   try {
-    // Load by id alone, then apply isolation to the loaded row. Folding the actor's
-    // tenant/org into the lookup would make every system-scoped schedule unmatchable.
-    const schedule = await em.findOne(ScheduledJob, { id: scheduleId, deletedAt: null })
+    // Verify schedule exists and user has access (with tenant/org scope filter)
+    const findFilter: Record<string, unknown> = {
+      id: scheduleId,
+      deletedAt: null,
+    }
 
-    if (!schedule) {
-      return NextResponse.json({ error: translate('scheduler.error.not_found', 'Schedule not found') }, { status: 404 })
+    // Apply tenant isolation: scope the query to the user's tenant/org
+    if (auth.tenantId) {
+      findFilter.tenantId = auth.tenantId
+    }
+    if (auth.orgId) {
+      findFilter.organizationId = auth.orgId
     }
 
-    const access = resolveScheduleAccess(schedule, auth)
-    if (access === 'not_found') {
+    const schedule = await em.findOne(ScheduledJob, findFilter)
+
+    if (!schedule) {
       return NextResponse.json({ error: translate('scheduler.error.not_found', 'Schedule not found') }, { status: 404 })
     }
-    if (access === 'forbidden') {
+
+    // System-scoped schedules (no tenantId/orgId) require super-admin. Use the
+    // immutable `isSuperAdmin` flag — never compare mutable/spoofable role names.
+    const isSuperAdmin = auth.isSuperAdmin === true
+    if (!schedule.tenantId && !schedule.organizationId && !isSuperAdmin) {
       return NextResponse.json({ error: translate('scheduler.error.access_denied', 'Access denied') }, { status: 403 })
     }
 

package/src/modules/scheduler/api/targets/__tests__/route.test.ts

@@ -50,8 +50,8 @@ describe('GET /api/scheduler/targets', () => {
       orgId: 'org-1',
     })
     ;(getModules as jest.Mock).mockReturnValue([
-      { workers: [{ queue: 'z-queue' }, { queue: 'internal-queue' }] },
-      { workers: [{ queue: 'a-queue', schedulerSafe: true }] },
+      { workers: [{ queue: 'z-queue' }] },
+      { workers: [{ queue: 'a-queue' }] },
     ])
   })
 
@@ -60,13 +60,14 @@ describe('GET /api/scheduler/targets', () => {
     unregisterCommand(unsafeCommand.id)
   })
 
-  it('lists only scheduler-safe queues and commands', async () => {
+  it('lists only scheduler-safe commands', async () => {
     const response = await GET(new NextRequest('http://localhost/api/scheduler/targets'))
     const body = await response.json()
 
     expect(response.status).toBe(200)
     expect(body.queues).toEqual([
       { value: 'a-queue', label: 'a-queue' },
+      { value: 'z-queue', label: 'z-queue' },
     ])
     expect(body.commands).toEqual([
       { value: safeCommand.id, label: safeCommand.id },