Interface ScheduleRouterOptions

Every mutation (and denied read) is audited through this. Absent ⇒ no audit.

Route prefix. Default '/api/schedules'.

The deployment execution fence, or 'none' for a router with no database behind it. REQUIRED: a router receives a store facade and a resolver, not a database, so it cannot build one for itself the way init({ DB }) can — which leaves the host as the only place the wiring can happen, and an option a host may omit is one a host will omit. See ExecutionFenceWiring for the split-brain this closes (an unfenced surface next to a fenced runtime consumes work it then cannot run).

The gate itself is the runtime's refusal made earlier: an operator draining a deployment sees a schedule create refused at the API instead of accepted and then never fired.

Max raw request-body size in bytes. Must be a nonnegative safe integer; zero denies every non-empty body. Default 16384 (16 KiB).

Deployment count cap. A create at or over it is REJECTED. Must be a nonnegative safe integer; zero denies every create. Default 100.

Per-schedule fire-rate cap: the minimum interval between two consecutive fires of a schedule's cron, in ms. A cron whose interval is shorter is REJECTED at create/update — bounding the aggregate fire rate a deployment can schedule (with the count cap). Must be a positive safe integer. Default 60000 (1 minute).

Authenticate and validate the actor; undefined means 401.

Who may create/update/delete/pause/resume. Default RUN_START_ROLES (operator/admin) — reviewers/viewers cannot author schedules. Reads (get/ list/triggers) are not role-gated beyond ownership.

The schedules domain the facade reads/writes.

Catalog-backed target authorization shared with the fire-time tick.

Prove fixed-thread agent targets are durable bound memory.