@open-mercato/scheduler 0.6.8-develop.7100.1.fbf66fca35 → 0.7.0

package/dist/modules/scheduler/lib/safeQueueTargets.js

@@ -1,157 +0,0 @@
-import { getModules } from "@open-mercato/shared/lib/modules/registry";
-import { z } from "zod";
-const registeredPayloadSchemas = /* @__PURE__ */ new Map();
-function registerSchedulerQueuePayloadSchema(queue, schema) {
-  registeredPayloadSchemas.set(queue, schema);
-}
-function getSchedulerQueuePayloadSchema(queue) {
-  return registeredPayloadSchemas.get(queue) ?? null;
-}
-async function assertSchedulerQueueTargetAuthorized(params) {
-  const requiredFeatures = getSchedulerQueueRequiredFeatures(params.queue);
-  if (requiredFeatures.length === 0) return null;
-  if (params.isSuperAdmin === true) return null;
-  const actorUserId = typeof params.actorUserId === "string" ? params.actorUserId.trim() : "";
-  if (!actorUserId) return "Scheduler queue target requires an authenticated creator";
-  if (typeof params.rbacService?.userHasAllFeatures !== "function") {
-    return "Scheduler queue target authorization is unavailable";
-  }
-  const authorized = await params.rbacService.userHasAllFeatures(actorUserId, requiredFeatures, {
-    tenantId: params.tenantId ?? null,
-    organizationId: params.organizationId ?? null
-  });
-  if (!authorized) {
-    return `Scheduler queue target requires features the creator lacks: ${requiredFeatures.join(", ")}`;
-  }
-  return null;
-}
-function validateSchedulerTargetPayload(queue, targetPayload) {
-  const schema = getSchedulerQueuePayloadSchema(queue);
-  if (!schema) return null;
-  const result = schema.safeParse(targetPayload ?? {});
-  if (result.success) return null;
-  const firstIssue = result.error.issues[0];
-  return [
-    firstIssue?.path?.length ? `${firstIssue.path.join(".")}: ` : "",
-    firstIssue?.message ?? "Invalid payload"
-  ].join("");
-}
-const RESERVED_PAYLOAD_KEYS = /* @__PURE__ */ new Set(["tenantId", "organizationId", "scope"]);
-function isReservedPayloadKey(key) {
-  return RESERVED_PAYLOAD_KEYS.has(key) || key.startsWith("_");
-}
-function stripReservedKeys(payload) {
-  const result = {};
-  for (const [key, value] of Object.entries(payload)) {
-    if (isReservedPayloadKey(key)) continue;
-    if (key === "payload" && value !== null && typeof value === "object" && !Array.isArray(value)) {
-      result[key] = stripReservedKeys(value);
-      continue;
-    }
-    result[key] = value;
-  }
-  return result;
-}
-function buildTrustedScheduleScope(schedule) {
-  return {
-    tenantId: schedule.tenantId ?? null,
-    organizationId: schedule.organizationId ?? null
-  };
-}
-function sanitizeSchedulerTargetPayload(targetPayload, schedule) {
-  const source = targetPayload ?? {};
-  const cloned = structuredClone(source);
-  const stripped = stripReservedKeys(cloned);
-  return {
-    ...stripped,
-    scope: buildTrustedScheduleScope(schedule)
-  };
-}
-const queueConsumerCache = /* @__PURE__ */ new WeakMap();
-function collectQueueConsumers() {
-  let modules;
-  try {
-    modules = getModules();
-  } catch {
-    return /* @__PURE__ */ new Map();
-  }
-  const cached = queueConsumerCache.get(modules);
-  if (cached) return cached;
-  const byQueue = /* @__PURE__ */ new Map();
-  for (const mod of modules) {
-    for (const worker of mod.workers ?? []) {
-      if (!worker.queue) continue;
-      const consumers = byQueue.get(worker.queue) ?? [];
-      consumers.push(worker);
-      byQueue.set(worker.queue, consumers);
-    }
-  }
-  queueConsumerCache.set(modules, byQueue);
-  return byQueue;
-}
-function listSchedulerSafeQueueTargets() {
-  const targets = [];
-  for (const [queue, consumers] of collectQueueConsumers()) {
-    const optedIn = consumers.filter((worker) => worker.schedulerSafe === true);
-    if (optedIn.length === 0 || optedIn.length !== consumers.length) continue;
-    const requiredFeatures = [...new Set(optedIn.flatMap((worker) => Array.isArray(worker.schedulerRequiredFeatures) ? worker.schedulerRequiredFeatures : []))];
-    const ownerModuleIds = [...new Set(consumers.map((worker) => typeof worker.id === "string" ? worker.id.split(":")[0] ?? "" : ""))];
-    targets.push({ queue, moduleId: ownerModuleIds[0] ?? "", requiredFeatures });
-  }
-  targets.sort((a, b) => a.queue.localeCompare(b.queue));
-  return targets;
-}
-function isSchedulerSafeQueue(queue) {
-  if (!queue) return false;
-  return listSchedulerSafeQueueTargets().some((target) => target.queue === queue);
-}
-function getSchedulerQueueRequiredFeatures(queue) {
-  return listSchedulerSafeQueueTargets().find((target) => target.queue === queue)?.requiredFeatures ?? [];
-}
-function findQueueOwnerModuleIds(queue) {
-  const owners = /* @__PURE__ */ new Set();
-  for (const [candidate, consumers] of collectQueueConsumers()) {
-    if (candidate !== queue) continue;
-    for (const worker of consumers) {
-      if (typeof worker.id === "string") owners.add(worker.id.split(":")[0] ?? "");
-    }
-  }
-  return owners;
-}
-function auditSchedulerModuleQueueRows(rows) {
-  return rows.filter((row) => row.sourceType === "module" && row.targetQueue).map((row) => ({
-    scheduleId: row.id,
-    name: row.name ?? void 0,
-    sourceModule: row.sourceModule ?? null,
-    targetQueue: row.targetQueue ?? null,
-    isEnabled: row.isEnabled !== false,
-    dispatchAllowed: canDispatchScheduleQueueTarget(row)
-  }));
-}
-function canDispatchScheduleQueueTarget(schedule) {
-  if (!schedule.targetQueue) return false;
-  if (schedule.sourceType === "module") {
-    if (!schedule.sourceModule) return false;
-    if (schedule.createdByUserId) return false;
-    return findQueueOwnerModuleIds(schedule.targetQueue).has(schedule.sourceModule);
-  }
-  return isSchedulerSafeQueue(schedule.targetQueue);
-}
-registerSchedulerQueuePayloadSchema(
-  "scheduler-test",
-  z.object({ message: z.string().max(200).optional() }).passthrough()
-);
-export {
-  assertSchedulerQueueTargetAuthorized,
-  auditSchedulerModuleQueueRows,
-  buildTrustedScheduleScope,
-  canDispatchScheduleQueueTarget,
-  getSchedulerQueuePayloadSchema,
-  getSchedulerQueueRequiredFeatures,
-  isSchedulerSafeQueue,
-  listSchedulerSafeQueueTargets,
-  registerSchedulerQueuePayloadSchema,
-  sanitizeSchedulerTargetPayload,
-  validateSchedulerTargetPayload
-};
-//# sourceMappingURL=safeQueueTargets.js.map

package/dist/modules/scheduler/lib/safeQueueTargets.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/modules/scheduler/lib/safeQueueTargets.ts"],
-  "sourcesContent": ["import { getModules } from '@open-mercato/shared/lib/modules/registry'\nimport type { ModuleWorker } from '@open-mercato/shared/modules/registry'\nimport { z, type ZodTypeAny } from 'zod'\n\nexport type SchedulerSafeQueueTarget = {\n  queue: string\n  /**\n   * Indicative primary owner \u2014 the first registry module found among the\n   * queue's consumers. A queue may legitimately have consumers from more than\n   * one module; ownership for provenance checks is always resolved per module.\n   */\n  moduleId: string\n  /** Extra creator features a principal must hold to schedule onto this queue. */\n  requiredFeatures: string[]\n}\n\nexport type TrustedScheduleScope = {\n  tenantId: string | null\n  organizationId: string | null\n}\n\n/**\n * Runtime payload schemas for opted-in scheduler targets.\n *\n * Worker metadata cannot carry a Zod schema through static registry generation,\n * so the module that owns a schedulable worker registers its target payload\n * schema here at bootstrap. Targets without a registered schema accept\n * arbitrary JSON payloads (documented escape hatch, mirroring scheduler-safe\n * commands which also carry no payload schema).\n */\nconst registeredPayloadSchemas = new Map<string, ZodTypeAny>()\n\nexport function registerSchedulerQueuePayloadSchema(queue: string, schema: ZodTypeAny): void {\n  registeredPayloadSchemas.set(queue, schema)\n}\n\nexport function getSchedulerQueuePayloadSchema(queue: string): ZodTypeAny | null {\n  return registeredPayloadSchemas.get(queue) ?? null\n}\n\nexport type SchedulerTargetRbacService = {\n  userHasAllFeatures?: (\n    userId: string,\n    required: readonly string[],\n    scope: { tenantId: string | null; organizationId: string | null },\n  ) => Promise<boolean>\n}\n\n/**\n * Creator-side authorization for an opted-in queue target (#5213): a principal\n * must hold every feature the target declares beyond `scheduler.jobs.manage`.\n * Super administrators bypass target-specific checks, mirroring the rest of\n * the scheduler's authorization model. Returns null when authorized,\n * otherwise a short reason string.\n */\nexport async function assertSchedulerQueueTargetAuthorized(params: {\n  queue: string\n  actorUserId?: string | null\n  tenantId?: string | null\n  organizationId?: string | null\n  isSuperAdmin?: boolean\n  rbacService?: SchedulerTargetRbacService | null\n}): Promise<string | null> {\n  const requiredFeatures = getSchedulerQueueRequiredFeatures(params.queue)\n  if (requiredFeatures.length === 0) return null\n  if (params.isSuperAdmin === true) return null\n\n  const actorUserId = typeof params.actorUserId === 'string' ? params.actorUserId.trim() : ''\n  if (!actorUserId) return 'Scheduler queue target requires an authenticated creator'\n  if (typeof params.rbacService?.userHasAllFeatures !== 'function') {\n    return 'Scheduler queue target authorization is unavailable'\n  }\n\n  const authorized = await params.rbacService.userHasAllFeatures(actorUserId, requiredFeatures, {\n    tenantId: params.tenantId ?? null,\n    organizationId: params.organizationId ?? null,\n  })\n  if (!authorized) {\n    return `Scheduler queue target requires features the creator lacks: ${requiredFeatures.join(', ')}`\n  }\n  return null\n}\n\n/**\n * Validates an author-supplied target payload against the target's registered\n * schema, when one exists. Returns null when the payload is acceptable,\n * otherwise a short reason string.\n */\nexport function validateSchedulerTargetPayload(\n  queue: string,\n  targetPayload: Record<string, unknown> | null | undefined,\n): string | null {\n  const schema = getSchedulerQueuePayloadSchema(queue)\n  if (!schema) return null\n  const result = schema.safeParse(targetPayload ?? {})\n  if (result.success) return null\n  const firstIssue = result.error.issues[0]\n  return [\n    firstIssue?.path?.length ? `${firstIssue.path.join('.')}: ` : '',\n    firstIssue?.message ?? 'Invalid payload',\n  ].join('')\n}\n\n/**\n * Keys a schedule author may never control on a dispatched target payload:\n * tenant/organization authority context and the reserved `_`-prefixed envelope\n * namespace (idempotency keys, dispatch-origin markers, \u2026).\n */\nconst RESERVED_PAYLOAD_KEYS = new Set(['tenantId', 'organizationId', 'scope'])\n\nfunction isReservedPayloadKey(key: string): boolean {\n  return RESERVED_PAYLOAD_KEYS.has(key) || key.startsWith('_')\n}\n\nfunction stripReservedKeys(payload: Record<string, unknown>): Record<string, unknown> {\n  const result: Record<string, unknown> = {}\n  for (const [key, value] of Object.entries(payload)) {\n    if (isReservedPayloadKey(key)) continue\n    if (key === 'payload' && value !== null && typeof value === 'object' && !Array.isArray(value)) {\n      result[key] = stripReservedKeys(value as Record<string, unknown>)\n      continue\n    }\n    result[key] = value\n  }\n  return result\n}\n\n/**\n * Rebuild the trusted scope for a dispatched schedule payload from the stored\n * schedule row. Callers must never trust scope-shaped data from the schedule\n * author's `targetPayload`.\n */\nexport function buildTrustedScheduleScope(schedule: {\n  tenantId?: string | null\n  organizationId?: string | null\n}): TrustedScheduleScope {\n  return {\n    tenantId: schedule.tenantId ?? null,\n    organizationId: schedule.organizationId ?? null,\n  }\n}\n\n/**\n * Sanitize an author-supplied schedule target payload before dispatch:\n * deep-copies it, strips reserved authority and `_`-prefixed envelope keys at\n * the payload root and inside the local-strategy `payload` wrapper level, then\n * injects the trusted scope derived from the schedule row.\n */\nexport function sanitizeSchedulerTargetPayload(\n  targetPayload: Record<string, unknown> | null | undefined,\n  schedule: Parameters<typeof buildTrustedScheduleScope>[0],\n): Record<string, unknown> {\n  const source = targetPayload ?? {}\n  const cloned = structuredClone(source)\n  const stripped = stripReservedKeys(cloned)\n  return {\n    ...stripped,\n    scope: buildTrustedScheduleScope(schedule),\n  }\n}\n\nconst queueConsumerCache = new WeakMap<object, Map<string, ModuleWorker[]>>()\n\nfunction collectQueueConsumers(): Map<string, ModuleWorker[]> {\n  let modules: ReturnType<typeof getModules>\n  try {\n    modules = getModules()\n  } catch {\n    return new Map()\n  }\n  // The registry returns the same array instance between registrations, so the\n  // grouped map can be memoized per instance instead of rebuilt per lookup.\n  const cached = queueConsumerCache.get(modules)\n  if (cached) return cached\n\n  const byQueue = new Map<string, ModuleWorker[]>()\n  for (const mod of modules) {\n    for (const worker of mod.workers ?? []) {\n      if (!worker.queue) continue\n      const consumers = byQueue.get(worker.queue) ?? []\n      consumers.push(worker)\n      byQueue.set(worker.queue, consumers)\n    }\n  }\n  queueConsumerCache.set(modules, byQueue)\n  return byQueue\n}\n\n/**\n * Enumerate queue targets that are safe for user-facing scheduling (#5213):\n * every worker consuming the queue must explicitly opt in \u2014 queue consumers\n * compete for the same jobs, so a single non-opted-in consumer would otherwise\n * receive scheduler-controlled payloads it never agreed to accept.\n */\nexport function listSchedulerSafeQueueTargets(): SchedulerSafeQueueTarget[] {\n  const targets: SchedulerSafeQueueTarget[] = []\n  for (const [queue, consumers] of collectQueueConsumers()) {\n    const optedIn = consumers.filter((worker) => worker.schedulerSafe === true)\n    if (optedIn.length === 0 || optedIn.length !== consumers.length) continue\n\n    const requiredFeatures = [...new Set(optedIn.flatMap((worker) => (\n      Array.isArray(worker.schedulerRequiredFeatures) ? worker.schedulerRequiredFeatures : []\n    )))]\n    const ownerModuleIds = [...new Set(consumers.map((worker) => (\n      typeof worker.id === 'string' ? (worker.id.split(':')[0] ?? '') : ''\n    )))]\n    targets.push({ queue, moduleId: ownerModuleIds[0] ?? '', requiredFeatures })\n  }\n  targets.sort((a, b) => a.queue.localeCompare(b.queue))\n  return targets\n}\n\nexport function isSchedulerSafeQueue(queue: string | null | undefined): boolean {\n  if (!queue) return false\n  return listSchedulerSafeQueueTargets().some((target) => target.queue === queue)\n}\n\n/**\n * Extra creator features required by the target queue beyond\n * `scheduler.jobs.manage` (#5213). Empty when the target declares none.\n */\nexport function getSchedulerQueueRequiredFeatures(queue: string): string[] {\n  return listSchedulerSafeQueueTargets().find((target) => target.queue === queue)?.requiredFeatures ?? []\n}\n\n/**\n * The module ids that own workers on this queue, from the live registry.\n */\nfunction findQueueOwnerModuleIds(queue: string): Set<string> {\n  const owners = new Set<string>()\n  for (const [candidate, consumers] of collectQueueConsumers()) {\n    if (candidate !== queue) continue\n    for (const worker of consumers) {\n      if (typeof worker.id === 'string') owners.add(worker.id.split(':')[0] ?? '')\n    }\n  }\n  return owners\n}\n\n/**\n * Operator-facing audit for persisted module-authored queue rows (#5213).\n *\n * Provenance on pre-upgrade rows is not fully verifiable at rest: a row created\n * by a non-user-bound API key carries no acting-user stamp, making it\n * indistinguishable from a genuine module registration. This helper surfaces\n * every module-authored queue-target row with its current dispatch verdict so\n * operators can review the allowed ones against their known integrations\n * (`mercato scheduler audit-queue-targets`).\n */\nexport type SchedulerModuleQueueRowAudit = {\n  scheduleId: string\n  name?: string\n  sourceModule: string | null\n  targetQueue: string | null\n  isEnabled: boolean\n  /** Whether the dispatch guard currently lets this row fire. */\n  dispatchAllowed: boolean\n}\n\nexport function auditSchedulerModuleQueueRows(\n  rows: ReadonlyArray<{\n    id: string\n    name?: string | null\n    targetQueue?: string | null\n    sourceType?: string | null\n    sourceModule?: string | null\n    createdByUserId?: string | null\n    isEnabled?: boolean\n  }>,\n): SchedulerModuleQueueRowAudit[] {\n  return rows\n    .filter((row) => row.sourceType === 'module' && row.targetQueue)\n    .map((row) => ({\n      scheduleId: row.id,\n      name: row.name ?? undefined,\n      sourceModule: row.sourceModule ?? null,\n      targetQueue: row.targetQueue ?? null,\n      isEnabled: row.isEnabled !== false,\n      dispatchAllowed: canDispatchScheduleQueueTarget(row),\n    }))\n}\n\n/**\n * Dispatch-time authorization for queue-targeted schedules (#5213).\n *\n * Provenance is server-owned and verified, never trusted from the stored row:\n * - API-authored schedules (`sourceType: 'user'`) may only target queues whose\n *   workers all opted into scheduling.\n * - Module-authored schedules are accepted only when the recorded\n *   `sourceModule` owns the queue in the live registry AND the row carries no\n *   acting-user stamp (`createdByUserId == null`) \u2014 `schedulerService.register()`\n *   never stamps one while every interactive API write does. Residual limit: a\n *   pre-upgrade row authored by a non-user-bound API key also lacks the stamp;\n *   surface those with `auditSchedulerModuleQueueRows` /\n *   `mercato scheduler audit-queue-targets`.\n */\nexport function canDispatchScheduleQueueTarget(schedule: {\n  targetQueue?: string | null\n  sourceType?: string | null\n  sourceModule?: string | null\n  /** Server-stamped actor on API-authored rows; module registration never sets it. */\n  createdByUserId?: string | null\n}): boolean {\n  if (!schedule.targetQueue) return false\n  if (schedule.sourceType === 'module') {\n    // Provenance must be server-owned, and both stored fields were client-\n    // writable before #5213. A matching sourceModule alone is forgeable public\n    // knowledge, so a persisted module row is only trusted when it also carries\n    // no acting-user stamp: `schedulerService.register()` never sets one, while\n    // every API write does. Forged pre-upgrade rows fail closed here.\n    if (!schedule.sourceModule) return false\n    if (schedule.createdByUserId) return false\n    return findQueueOwnerModuleIds(schedule.targetQueue).has(schedule.sourceModule)\n  }\n  return isSchedulerSafeQueue(schedule.targetQueue)\n}\n\n// Built-in opted-in target owned by this module: the side-effect-free QA echo\n// queue. The strict shape keeps scheduler-controlled payloads predictable and\n// gives deployments a working reference for registering their own schemas.\nregisterSchedulerQueuePayloadSchema(\n  'scheduler-test',\n  z.object({ message: z.string().max(200).optional() }).passthrough(),\n)\n"],
-  "mappings": "AAAA,SAAS,kBAAkB;AAE3B,SAAS,SAA0B;AA4BnC,MAAM,2BAA2B,oBAAI,IAAwB;AAEtD,SAAS,oCAAoC,OAAe,QAA0B;AAC3F,2BAAyB,IAAI,OAAO,MAAM;AAC5C;AAEO,SAAS,+BAA+B,OAAkC;AAC/E,SAAO,yBAAyB,IAAI,KAAK,KAAK;AAChD;AAiBA,eAAsB,qCAAqC,QAOhC;AACzB,QAAM,mBAAmB,kCAAkC,OAAO,KAAK;AACvE,MAAI,iBAAiB,WAAW,EAAG,QAAO;AAC1C,MAAI,OAAO,iBAAiB,KAAM,QAAO;AAEzC,QAAM,cAAc,OAAO,OAAO,gBAAgB,WAAW,OAAO,YAAY,KAAK,IAAI;AACzF,MAAI,CAAC,YAAa,QAAO;AACzB,MAAI,OAAO,OAAO,aAAa,uBAAuB,YAAY;AAChE,WAAO;AAAA,EACT;AAEA,QAAM,aAAa,MAAM,OAAO,YAAY,mBAAmB,aAAa,kBAAkB;AAAA,IAC5F,UAAU,OAAO,YAAY;AAAA,IAC7B,gBAAgB,OAAO,kBAAkB;AAAA,EAC3C,CAAC;AACD,MAAI,CAAC,YAAY;AACf,WAAO,+DAA+D,iBAAiB,KAAK,IAAI,CAAC;AAAA,EACnG;AACA,SAAO;AACT;AAOO,SAAS,+BACd,OACA,eACe;AACf,QAAM,SAAS,+BAA+B,KAAK;AACnD,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,SAAS,OAAO,UAAU,iBAAiB,CAAC,CAAC;AACnD,MAAI,OAAO,QAAS,QAAO;AAC3B,QAAM,aAAa,OAAO,MAAM,OAAO,CAAC;AACxC,SAAO;AAAA,IACL,YAAY,MAAM,SAAS,GAAG,WAAW,KAAK,KAAK,GAAG,CAAC,OAAO;AAAA,IAC9D,YAAY,WAAW;AAAA,EACzB,EAAE,KAAK,EAAE;AACX;AAOA,MAAM,wBAAwB,oBAAI,IAAI,CAAC,YAAY,kBAAkB,OAAO,CAAC;AAE7E,SAAS,qBAAqB,KAAsB;AAClD,SAAO,sBAAsB,IAAI,GAAG,KAAK,IAAI,WAAW,GAAG;AAC7D;AAEA,SAAS,kBAAkB,SAA2D;AACpF,QAAM,SAAkC,CAAC;AACzC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,QAAI,qBAAqB,GAAG,EAAG;AAC/B,QAAI,QAAQ,aAAa,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,GAAG;AAC7F,aAAO,GAAG,IAAI,kBAAkB,KAAgC;AAChE;AAAA,IACF;AACA,WAAO,GAAG,IAAI;AAAA,EAChB;AACA,SAAO;AACT;AAOO,SAAS,0BAA0B,UAGjB;AACvB,SAAO;AAAA,IACL,UAAU,SAAS,YAAY;AAAA,IAC/B,gBAAgB,SAAS,kBAAkB;AAAA,EAC7C;AACF;AAQO,SAAS,+BACd,eACA,UACyB;AACzB,QAAM,SAAS,iBAAiB,CAAC;AACjC,QAAM,SAAS,gBAAgB,MAAM;AACrC,QAAM,WAAW,kBAAkB,MAAM;AACzC,SAAO;AAAA,IACL,GAAG;AAAA,IACH,OAAO,0BAA0B,QAAQ;AAAA,EAC3C;AACF;AAEA,MAAM,qBAAqB,oBAAI,QAA6C;AAE5E,SAAS,wBAAqD;AAC5D,MAAI;AACJ,MAAI;AACF,cAAU,WAAW;AAAA,EACvB,QAAQ;AACN,WAAO,oBAAI,IAAI;AAAA,EACjB;AAGA,QAAM,SAAS,mBAAmB,IAAI,OAAO;AAC7C,MAAI,OAAQ,QAAO;AAEnB,QAAM,UAAU,oBAAI,IAA4B;AAChD,aAAW,OAAO,SAAS;AACzB,eAAW,UAAU,IAAI,WAAW,CAAC,GAAG;AACtC,UAAI,CAAC,OAAO,MAAO;AACnB,YAAM,YAAY,QAAQ,IAAI,OAAO,KAAK,KAAK,CAAC;AAChD,gBAAU,KAAK,MAAM;AACrB,cAAQ,IAAI,OAAO,OAAO,SAAS;AAAA,IACrC;AAAA,EACF;AACA,qBAAmB,IAAI,SAAS,OAAO;AACvC,SAAO;AACT;AAQO,SAAS,gCAA4D;AAC1E,QAAM,UAAsC,CAAC;AAC7C,aAAW,CAAC,OAAO,SAAS,KAAK,sBAAsB,GAAG;AACxD,UAAM,UAAU,UAAU,OAAO,CAAC,WAAW,OAAO,kBAAkB,IAAI;AAC1E,QAAI,QAAQ,WAAW,KAAK,QAAQ,WAAW,UAAU,OAAQ;AAEjE,UAAM,mBAAmB,CAAC,GAAG,IAAI,IAAI,QAAQ,QAAQ,CAAC,WACpD,MAAM,QAAQ,OAAO,yBAAyB,IAAI,OAAO,4BAA4B,CAAC,CACvF,CAAC,CAAC;AACH,UAAM,iBAAiB,CAAC,GAAG,IAAI,IAAI,UAAU,IAAI,CAAC,WAChD,OAAO,OAAO,OAAO,WAAY,OAAO,GAAG,MAAM,GAAG,EAAE,CAAC,KAAK,KAAM,EACnE,CAAC,CAAC;AACH,YAAQ,KAAK,EAAE,OAAO,UAAU,eAAe,CAAC,KAAK,IAAI,iBAAiB,CAAC;AAAA,EAC7E;AACA,UAAQ,KAAK,CAAC,GAAG,MAAM,EAAE,MAAM,cAAc,EAAE,KAAK,CAAC;AACrD,SAAO;AACT;AAEO,SAAS,qBAAqB,OAA2C;AAC9E,MAAI,CAAC,MAAO,QAAO;AACnB,SAAO,8BAA8B,EAAE,KAAK,CAAC,WAAW,OAAO,UAAU,KAAK;AAChF;AAMO,SAAS,kCAAkC,OAAyB;AACzE,SAAO,8BAA8B,EAAE,KAAK,CAAC,WAAW,OAAO,UAAU,KAAK,GAAG,oBAAoB,CAAC;AACxG;AAKA,SAAS,wBAAwB,OAA4B;AAC3D,QAAM,SAAS,oBAAI,IAAY;AAC/B,aAAW,CAAC,WAAW,SAAS,KAAK,sBAAsB,GAAG;AAC5D,QAAI,cAAc,MAAO;AACzB,eAAW,UAAU,WAAW;AAC9B,UAAI,OAAO,OAAO,OAAO,SAAU,QAAO,IAAI,OAAO,GAAG,MAAM,GAAG,EAAE,CAAC,KAAK,EAAE;AAAA,IAC7E;AAAA,EACF;AACA,SAAO;AACT;AAsBO,SAAS,8BACd,MASgC;AAChC,SAAO,KACJ,OAAO,CAAC,QAAQ,IAAI,eAAe,YAAY,IAAI,WAAW,EAC9D,IAAI,CAAC,SAAS;AAAA,IACb,YAAY,IAAI;AAAA,IAChB,MAAM,IAAI,QAAQ;AAAA,IAClB,cAAc,IAAI,gBAAgB;AAAA,IAClC,aAAa,IAAI,eAAe;AAAA,IAChC,WAAW,IAAI,cAAc;AAAA,IAC7B,iBAAiB,+BAA+B,GAAG;AAAA,EACrD,EAAE;AACN;AAgBO,SAAS,+BAA+B,UAMnC;AACV,MAAI,CAAC,SAAS,YAAa,QAAO;AAClC,MAAI,SAAS,eAAe,UAAU;AAMpC,QAAI,CAAC,SAAS,aAAc,QAAO;AACnC,QAAI,SAAS,gBAAiB,QAAO;AACrC,WAAO,wBAAwB,SAAS,WAAW,EAAE,IAAI,SAAS,YAAY;AAAA,EAChF;AACA,SAAO,qBAAqB,SAAS,WAAW;AAClD;AAKA;AAAA,EACE;AAAA,EACA,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,YAAY;AACpE;",
-  "names": []
-}

package/dist/modules/scheduler/lib/scheduleAccess.js

@@ -1,22 +0,0 @@
-function resolveScheduleAccess(schedule, actor) {
-  const isSuperAdmin = actor?.isSuperAdmin === true;
-  const scheduleTenantId = schedule.tenantId ?? null;
-  const actorTenantId = actor?.tenantId ?? null;
-  if (schedule.scopeType === "system" || scheduleTenantId === null) {
-    if (isSuperAdmin) return "allowed";
-    if (scheduleTenantId !== null && scheduleTenantId !== actorTenantId) return "not_found";
-    return "forbidden";
-  }
-  if (actorTenantId === null) return "not_found";
-  if (scheduleTenantId !== actorTenantId) return "not_found";
-  const scheduleOrganizationId = schedule.organizationId ?? null;
-  const actorOrganizationId = actor?.orgId ?? null;
-  if (scheduleOrganizationId !== null && actorOrganizationId !== null && scheduleOrganizationId !== actorOrganizationId) {
-    return "not_found";
-  }
-  return "allowed";
-}
-export {
-  resolveScheduleAccess
-};
-//# sourceMappingURL=scheduleAccess.js.map

package/dist/modules/scheduler/lib/scheduleAccess.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/modules/scheduler/lib/scheduleAccess.ts"],
-  "sourcesContent": ["export type ScheduleScopeActor = {\n  tenantId?: string | null\n  orgId?: string | null\n  isSuperAdmin?: boolean\n}\n\nexport type ScheduleScopeType = 'system' | 'organization' | 'tenant'\n\n/**\n * The scope columns of a loaded `ScheduledJob` row. Every field is optional because the\n * entity declares them that way (`tenantId?: string | null`), so a required shape here\n * could not accept the row the routes actually load.\n *\n * `undefined` is therefore normalized to `null` on read. That is fail-closed where it\n * matters: an absent `tenantId` classifies the row as system-scoped, which restricts it to\n * super admins rather than widening it. An absent `organizationId` reads as \"not bound to an\n * organization\", the same as an explicit null, which is what the list endpoint's tenant\n * branch already treats as tenant-wide.\n */\nexport type ScheduleScopeSubject = {\n  scopeType?: ScheduleScopeType | null\n  tenantId?: string | null\n  organizationId?: string | null\n}\n\nexport type ScheduleAccessDecision = 'allowed' | 'not_found' | 'forbidden'\n\n/**\n * Decides whether an actor may act on a single schedule that was loaded by id alone.\n *\n * Isolation belongs here, on the loaded row, and never in the `where` clause: a\n * system-scoped schedule carries a null `tenantId`, so folding the actor's tenant into the\n * lookup makes that row unmatchable and turns every system-scope check below into dead code.\n * `commands/jobs.ts` (update/delete) and `api/jobs/buildFilters.ts` (list) already model\n * visibility this way.\n *\n * System scope is classified exactly as `ensureCanManageSystemScopedJob` classifies it \u2014\n * `scopeType === 'system' || tenantId == null` \u2014 so update, delete, trigger and executions\n * cannot disagree about what a system-scoped row is. `organizationId` deliberately plays no\n * part in that test: a row with a null tenant is system-scoped whether or not an\n * organization is set, which is how the create validator's scope refinement and the two\n * command guards already read it.\n *\n * `not_found` vs `forbidden` is deliberate. Another tenant's or another organization's\n * schedule answers `not_found`, because a 403 would confirm that the id exists. Only a\n * system-scoped schedule answers `forbidden` \u2014 its existence is a property of the\n * deployment, not of a tenant.\n *\n * An unresolved actor tenant fails closed for everyone, super admins included, matching\n * `buildSchedulerJobsFilters`, which returns an unmatchable filter when the tenant is\n * falsy. Such an actor cannot see a tenant-bound schedule in the list either.\n *\n * Super-admin status reads the immutable `isSuperAdmin` flag derived from RoleAcl/UserAcl at\n * session resolution. Never compare role names, which are tenant-mutable and spoofable.\n *\n * Organization isolation compares the actor's single `orgId`, where the list endpoint uses\n * the resolved organization scope (`filterIds`: the selected organization plus its\n * descendants). The two diverge in **both** directions, and the second is the permissive one:\n *\n * - Narrower: an actor whose scope spans several organizations sees those rows in the list\n *   but is answered `not_found` here.\n * - Wider: an actor carrying no `orgId` at all reaches any org-bound row inside its tenant,\n *   because the organization comparison below short-circuits \u2014 while the list hides those\n *   rows entirely, emitting its organization branch only when at least one id is known.\n *\n * Both directions are inherited from the lookup this helper replaces, which compared the same\n * single id and omitted the clause entirely when it was absent. They are preserved rather\n * than corrected here, because widening or narrowing silently would change access the\n * previous lookup granted; reconciling the two paths is tracked separately.\n */\nexport function resolveScheduleAccess(\n  schedule: ScheduleScopeSubject,\n  actor: ScheduleScopeActor | null | undefined,\n): ScheduleAccessDecision {\n  const isSuperAdmin = actor?.isSuperAdmin === true\n  const scheduleTenantId = schedule.tenantId ?? null\n\n  const actorTenantId = actor?.tenantId ?? null\n\n  if (schedule.scopeType === 'system' || scheduleTenantId === null) {\n    if (isSuperAdmin) return 'allowed'\n    // A row mislabelled `system` while still bound to a tenant must not confirm its\n    // existence across a tenant boundary \u2014 answering 403 there would tell an actor in one\n    // tenant that the id exists in another, which is the disclosure the `not_found`\n    // decisions below exist to prevent. Only a genuinely tenant-less row answers 403.\n    if (scheduleTenantId !== null && scheduleTenantId !== actorTenantId) return 'not_found'\n    return 'forbidden'\n  }\n\n  if (actorTenantId === null) return 'not_found'\n  if (scheduleTenantId !== actorTenantId) return 'not_found'\n\n  // Unlike the list endpoint's equivalent branch, which pins `scope_type = 'tenant'`\n  // (buildFilters.ts), an org-null row is reachable here whatever its `scopeType`. Same\n  // scope-inconsistent-row class as above and equally not producible by the create path;\n  // left loose deliberately rather than diverging from the pre-existing lookup.\n  const scheduleOrganizationId = schedule.organizationId ?? null\n  const actorOrganizationId = actor?.orgId ?? null\n  if (scheduleOrganizationId !== null && actorOrganizationId !== null && scheduleOrganizationId !== actorOrganizationId) {\n    return 'not_found'\n  }\n\n  return 'allowed'\n}\n"],
-  "mappings": "AAsEO,SAAS,sBACd,UACA,OACwB;AACxB,QAAM,eAAe,OAAO,iBAAiB;AAC7C,QAAM,mBAAmB,SAAS,YAAY;AAE9C,QAAM,gBAAgB,OAAO,YAAY;AAEzC,MAAI,SAAS,cAAc,YAAY,qBAAqB,MAAM;AAChE,QAAI,aAAc,QAAO;AAKzB,QAAI,qBAAqB,QAAQ,qBAAqB,cAAe,QAAO;AAC5E,WAAO;AAAA,EACT;AAEA,MAAI,kBAAkB,KAAM,QAAO;AACnC,MAAI,qBAAqB,cAAe,QAAO;AAM/C,QAAM,yBAAyB,SAAS,kBAAkB;AAC1D,QAAM,sBAAsB,OAAO,SAAS;AAC5C,MAAI,2BAA2B,QAAQ,wBAAwB,QAAQ,2BAA2B,qBAAqB;AACrH,WAAO;AAAA,EACT;AAEA,SAAO;AACT;",
-  "names": []
-}

package/dist/modules/scheduler/workers/test-echo-queue.worker.js

@@ -1,22 +0,0 @@
-import { createLogger } from "@open-mercato/shared/lib/logger";
-const logger = createLogger("scheduler").child({ component: "test-echo-queue" });
-const metadata = {
-  queue: "scheduler-test",
-  id: "scheduler:test-echo-queue",
-  concurrency: 1,
-  /**
-   * Deliberate scheduler-safe target for QA fixtures and manual experiments,
-   * mirroring the `scheduler.test.echo` command. The handler is side-effect
-   * free: it only logs that a delivery arrived.
-   */
-  schedulerSafe: true
-};
-async function handle(job, _ctx) {
-  const message = typeof job.payload?.message === "string" ? job.payload.message : "";
-  logger.info("Test queue target received a scheduled delivery", { messageId: message.slice(0, 80) });
-}
-export {
-  handle as default,
-  metadata
-};
-//# sourceMappingURL=test-echo-queue.worker.js.map

package/dist/modules/scheduler/workers/test-echo-queue.worker.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/modules/scheduler/workers/test-echo-queue.worker.ts"],
-  "sourcesContent": ["import type { QueuedJob, JobContext, WorkerMeta } from '@open-mercato/queue'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('scheduler').child({ component: 'test-echo-queue' })\n\nexport const metadata: WorkerMeta = {\n  queue: 'scheduler-test',\n  id: 'scheduler:test-echo-queue',\n  concurrency: 1,\n  /**\n   * Deliberate scheduler-safe target for QA fixtures and manual experiments,\n   * mirroring the `scheduler.test.echo` command. The handler is side-effect\n   * free: it only logs that a delivery arrived.\n   */\n  schedulerSafe: true,\n}\n\ntype TestEchoPayload = {\n  message?: unknown\n}\n\nexport default async function handle(job: QueuedJob<TestEchoPayload>, _ctx: JobContext): Promise<void> {\n  const message = typeof job.payload?.message === 'string' ? job.payload.message : ''\n  logger.info('Test queue target received a scheduled delivery', { messageId: message.slice(0, 80) })\n}\n"],
-  "mappings": "AACA,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,kBAAkB,CAAC;AAExE,MAAM,WAAuB;AAAA,EAClC,OAAO;AAAA,EACP,IAAI;AAAA,EACJ,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMb,eAAe;AACjB;AAMA,eAAO,OAA8B,KAAiC,MAAiC;AACrG,QAAM,UAAU,OAAO,IAAI,SAAS,YAAY,WAAW,IAAI,QAAQ,UAAU;AACjF,SAAO,KAAK,mDAAmD,EAAE,WAAW,QAAQ,MAAM,GAAG,EAAE,EAAE,CAAC;AACpG;",
-  "names": []
-}

package/src/modules/scheduler/__integration__/TC-SCHED-008-safe-targets.spec.ts

@@ -1,90 +0,0 @@
-import { expect, test } from '@playwright/test'
-import { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api'
-import { readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures'
-import {
-  SCHEDULER_FORBIDDEN_INTERNAL_QUEUES,
-  SCHEDULER_JOBS_PATH,
-  SCHEDULER_TARGETS_PATH,
-  createScheduleJob,
-  deleteScheduleJob,
-  getScheduleJobById,
-  uniqueScheduleName,
-} from './helpers/scheduler'
-
-/**
- * TC-SCHED-008: Scheduler queue targets are restricted to authorized safe
- * workers (#5213). A principal holding only `scheduler.jobs.manage` must not be
- * able to aim a schedule at an internal/system worker queue with an arbitrary
- * payload — neither at creation, nor by retargeting later.
- */
-test.describe('TC-SCHED-008: scheduler queue targets restricted to safe workers', () => {
-  for (const forbiddenQueue of SCHEDULER_FORBIDDEN_INTERNAL_QUEUES) {
-    test(`rejects creating a schedule targeting the ${forbiddenQueue} worker`, async ({ request }) => {
-      const token = await getAuthToken(request, 'admin')
-
-      const response = await apiRequest(request, 'POST', SCHEDULER_JOBS_PATH, {
-        token,
-        data: {
-          name: uniqueScheduleName('Forbidden Queue Target'),
-          scopeType: 'organization',
-          scheduleType: 'interval',
-          scheduleValue: '15m',
-          timezone: 'UTC',
-          targetType: 'queue',
-          targetQueue: forbiddenQueue,
-          targetPayload: { scope: { tenantId: 'forged', organizationId: 'forged' } },
-          isEnabled: true,
-          sourceType: 'user',
-        },
-      })
-
-      expect(response.status(), `${forbiddenQueue} must not be schedulable`).toBe(400)
-      const body = await readJsonSafe<{ error?: string; details?: Array<{ path?: Array<string | number> }> }>(response)
-      const issuePaths = (body?.details ?? []).map((issue) => (issue.path ?? []).join('.'))
-      expect(issuePaths).toContain('targetQueue')
-    })
-  }
-
-  test('rejects retargeting an existing schedule to an internal worker queue', async ({ request }) => {
-    const token = await getAuthToken(request, 'admin')
-    let scheduleId: string | null = null
-
-    try {
-      scheduleId = await createScheduleJob(request, token, { name: uniqueScheduleName('Retarget Guard') })
-
-      const response = await apiRequest(request, 'PUT', SCHEDULER_JOBS_PATH, {
-        token,
-        data: {
-          id: scheduleId,
-          targetType: 'queue',
-          targetQueue: 'stripe-webhook',
-        },
-      })
-
-      // Enforcement lives in the update command (change-detection vs the stored
-      // row), so an actual retarget lands as 422 with the approval error.
-      expect(response.status()).toBe(422)
-      const body = await readJsonSafe<{ error?: string }>(response)
-      expect(body?.error ?? '').toMatch(/not an approved scheduler target/i)
-
-      const unchanged = await getScheduleJobById(request, token, scheduleId)
-      expect(unchanged).not.toBeNull()
-      expect(unchanged!.targetType).toBe('command')
-    } finally {
-      await deleteScheduleJob(request, token, scheduleId)
-    }
-  })
-
-  test('targets endpoint keeps internal worker queues undiscoverable', async ({ request }) => {
-    const token = await getAuthToken(request, 'admin')
-
-    const response = await apiRequest(request, 'GET', SCHEDULER_TARGETS_PATH, { token })
-    expect(response.status()).toBe(200)
-
-    const body = await readJsonSafe<{ queues?: Array<{ value: string }> }>(response)
-    const values = (body?.queues ?? []).map((queue) => queue.value)
-    for (const forbidden of SCHEDULER_FORBIDDEN_INTERNAL_QUEUES) {
-      expect(values).not.toContain(forbidden)
-    }
-  })
-})

package/src/modules/scheduler/__integration__/TC-SCHED-008.spec.ts

@@ -1,94 +0,0 @@
-import { expect, test } from '@playwright/test'
-import { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api'
-import { readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures'
-import {
-  SCHEDULER_JOBS_PATH,
-  SCHEDULER_TRIGGER_PATH,
-  createScheduleJob,
-  deleteScheduleJob,
-  uniqueScheduleName,
-} from './helpers/scheduler'
-
-const isAsyncQueueStrategy = (process.env.QUEUE_STRATEGY || 'local') === 'async'
-
-type TriggerBody = { ok?: boolean; jobId?: string; error?: string; message?: string }
-
-/**
- * TC-SCHED-008: POST /api/scheduler/trigger and GET /api/scheduler/jobs/[id]/executions
- * resolve the scope of a system-scoped schedule on the loaded row, not in the lookup.
- *
- * A system-scoped schedule has `tenantId === null` and `organizationId === null`. When both
- * routes folded the caller's tenant/org into the `where` clause, no such row could ever match
- * and every caller — super admins included — got 404, which also masked each route's own
- * super-admin gate. A super admin must now reach the schedule, and a non-super-admin must be
- * told 403 rather than 404.
- *
- * The super-admin assertions hold under either queue strategy: each route's
- * `QUEUE_STRATEGY=async` check sits after the lookup, so `local` yields the pre-existing
- * 400 — never 404.
- */
-test.describe('TC-SCHED-008: system-scoped schedule access on trigger and executions', () => {
-  test('super admin reaches the schedule on both routes; a non-super-admin is forbidden', async ({ request }) => {
-    const superToken = await getAuthToken(request, 'superadmin')
-    const adminToken = await getAuthToken(request, 'admin')
-    let scheduleId: string | null = null
-
-    try {
-      // Creating a system-scoped schedule is itself super-admin only.
-      scheduleId = await createScheduleJob(request, superToken, {
-        name: uniqueScheduleName('System-Trigger-Test'),
-        scopeType: 'system',
-        scheduleType: 'interval',
-        scheduleValue: '1h',
-      })
-
-      const superResponse = await apiRequest(request, 'POST', SCHEDULER_TRIGGER_PATH, {
-        token: superToken,
-        data: { id: scheduleId },
-      })
-      const superBody = await readJsonSafe<TriggerBody>(superResponse)
-      expect(
-        superResponse.status(),
-        'a super admin must not be told a system-scoped schedule does not exist',
-      ).not.toBe(404)
-
-      if (isAsyncQueueStrategy) {
-        expect(superResponse.status()).toBe(200)
-        expect(superBody?.ok).toBe(true)
-        expect(typeof superBody?.jobId === 'string' && superBody.jobId.length > 0).toBe(true)
-      } else {
-        // The strategy check runs after the scope check, so this 400 is the response the
-        // 404 used to mask.
-        expect(superResponse.status()).toBe(400)
-        expect(superBody?.error ?? '').toMatch(/async/i)
-      }
-
-      // The same schedule is visible enough to be refused, not hidden, from a tenant admin.
-      const adminResponse = await apiRequest(request, 'POST', SCHEDULER_TRIGGER_PATH, {
-        token: adminToken,
-        data: { id: scheduleId },
-      })
-      expect(
-        adminResponse.status(),
-        'a non-super-admin must be forbidden from triggering a system-scoped schedule',
-      ).toBe(403)
-
-      // The execution-history route carried the same lookup and needs the same guarantees.
-      const executionsPath = `${SCHEDULER_JOBS_PATH}/${scheduleId}/executions`
-      const superExecutions = await apiRequest(request, 'GET', executionsPath, { token: superToken })
-      expect(
-        superExecutions.status(),
-        'a super admin must not be told a system-scoped schedule has no execution history route',
-      ).not.toBe(404)
-      expect(superExecutions.status()).toBe(isAsyncQueueStrategy ? 200 : 400)
-
-      const adminExecutions = await apiRequest(request, 'GET', executionsPath, { token: adminToken })
-      expect(
-        adminExecutions.status(),
-        'a non-super-admin must be forbidden from reading a system-scoped execution history',
-      ).toBe(403)
-    } finally {
-      await deleteScheduleJob(request, superToken, scheduleId)
-    }
-  })
-})

package/src/modules/scheduler/commands/__tests__/jobs.target-guard.test.ts

@@ -1,177 +0,0 @@
-export {}
-
-const registerCommand = jest.fn()
-
-jest.mock('@open-mercato/shared/lib/commands', () => ({
-  registerCommand,
-}))
-
-jest.mock('@open-mercato/shared/lib/i18n/server', () => ({
-  resolveTranslations: jest.fn().mockResolvedValue({
-    translate: (_key: string, fallback?: string) => fallback ?? _key,
-  }),
-}))
-
-function loadCommands() {
-  let update: any
-  jest.isolateModules(() => {
-    require('../jobs')
-    update = registerCommand.mock.calls.find(([cmd]) => cmd.id === 'scheduler.jobs.update')?.[0]
-  })
-  return update
-}
-
-const safeQueueRow = {
-  id: 'job-1',
-  name: 'QA queue schedule',
-  scopeType: 'organization',
-  tenantId: 'tenant-a',
-  organizationId: 'org-a',
-  isEnabled: true,
-  scheduleType: 'interval',
-  scheduleValue: '15m',
-  timezone: 'UTC',
-  targetType: 'queue',
-  targetQueue: 'scheduler-test',
-  targetCommand: null,
-  // nested payload the UI round-trips verbatim
-  targetPayload: { source: 'integration-test', retries: { max: 5 } },
-  sourceType: 'user',
-  sourceModule: null,
-}
-
-const moduleOwnedRow = {
-  ...safeQueueRow,
-  id: 'job-module',
-  name: 'Module-owned schedule',
-  sourceType: 'module',
-  sourceModule: 'legacy_module',
-  createdByUserId: null,
-}
-
-function makeEm(schedule: Record<string, unknown>) {
-  return {
-    fork: jest.fn().mockReturnThis(),
-    findOne: jest.fn().mockResolvedValue(schedule),
-    persist: jest.fn(),
-    flush: jest.fn().mockResolvedValue(undefined),
-    count: jest.fn().mockResolvedValue(0),
-  }
-}
-
-describe('scheduler.jobs.update target-change detection (#5213 N1)', () => {
-  beforeEach(() => {
-    jest.clearAllMocks()
-    jest.resetModules()
-  })
-
-  it('allows an operational-only save of a module-authored schedule whose form resends the unchanged target', async () => {
-    const update = loadCommands()
-    const em = makeEm(moduleOwnedRow)
-    const ctx = {
-      auth: { isSuperAdmin: false, tenantId: 'tenant-a', orgId: 'org-a', sub: 'user-1' },
-      container: { resolve: jest.fn(() => em) },
-    }
-
-    const result = await update.execute(
-      {
-        id: moduleOwnedRow.id,
-        // the shipped edit form always resends every field…
-        targetType: moduleOwnedRow.targetType,
-        targetQueue: moduleOwnedRow.targetQueue,
-        targetPayload: moduleOwnedRow.targetPayload,
-        // …while the operator only changed operational values
-        name: 'Renamed by ops',
-        scheduleValue: '30m',
-        scheduleType: 'interval',
-        isEnabled: false,
-      },
-      ctx,
-    )
-
-    expect(result).toEqual({ ok: true })
-    expect(em.flush).toHaveBeenCalled()
-  })
-
-  it('still blocks an actual target or payload change on a module-authored schedule', async () => {
-    const update = loadCommands()
-    const em = makeEm(moduleOwnedRow)
-    const ctx = {
-      auth: { isSuperAdmin: false, tenantId: 'tenant-a', orgId: 'org-a', sub: 'user-1' },
-      container: { resolve: jest.fn(() => em) },
-    }
-
-    await expect(
-      update.execute({ id: moduleOwnedRow.id, targetQueue: 'stripe-webhook' }, ctx),
-    ).rejects.toMatchObject({ status: 403 })
-    await expect(
-      update.execute({ id: moduleOwnedRow.id, targetPayload: { forged: true } }, ctx),
-    ).rejects.toMatchObject({ status: 403 })
-    expect(em.flush).not.toHaveBeenCalled()
-  })
-
-  it('lets admins disable a legacy user-authored row whose stored queue is no longer approved (#5213 N1)', async () => {
-    const update = loadCommands()
-    const legacyUnsafe = {
-      ...safeQueueRow,
-      id: 'job-legacy',
-      targetQueue: 'stripe-webhook',
-      targetPayload: null as unknown,
-    }
-    const em = makeEm(legacyUnsafe)
-    const ctx = {
-      auth: { isSuperAdmin: false, tenantId: 'tenant-a', orgId: 'org-a', sub: 'user-1' },
-      container: { resolve: jest.fn(() => em) },
-    }
-
-    // the shipped edit form resends every field — target fields included —
-    // while only flipping the switch
-    const result = await update.execute(
-      {
-        id: legacyUnsafe.id,
-        targetType: legacyUnsafe.targetType,
-        targetQueue: legacyUnsafe.targetQueue,
-        isEnabled: false,
-      },
-      ctx,
-    )
-    expect(result).toEqual({ ok: true })
-
-    // retargeting onto another unapproved queue is still rejected
-    await expect(
-      update.execute({ id: legacyUnsafe.id, targetQueue: 'payment-gateways-webhook' }, ctx),
-    ).rejects.toMatchObject({ status: 422 })
-  })
-
-  it('treats an empty-object stored payload as equal to the null the form submits (#5213 N1-residual)', async () => {
-    const update = loadCommands()
-    const emptyPayloadRow = {
-      ...moduleOwnedRow,
-      id: 'job-module-empty-payload',
-      targetPayload: {},
-    }
-    const em = makeEm(emptyPayloadRow)
-    const ctx = {
-      auth: { isSuperAdmin: true, tenantId: null, orgId: null, sub: 'super-1' },
-      container: { resolve: jest.fn(() => em) },
-    }
-
-    // ai_assistant-style registration stores `targetPayload: {}`; the edit form
-    // normalizes that to `targetPayload: null` on submit. An operational save
-    // must not trip the module-owned-target guard over the shape difference.
-    const result = await update.execute(
-      {
-        id: emptyPayloadRow.id,
-        targetType: emptyPayloadRow.targetType,
-        targetQueue: emptyPayloadRow.targetQueue,
-        targetPayload: null,
-        name: 'Renamed by ops',
-        isEnabled: true,
-      },
-      ctx,
-    )
-
-    expect(result).toEqual({ ok: true })
-    expect(em.flush).toHaveBeenCalled()
-  })
-})