Rulvar API reference / @rulvar/rulvar / CreateEngineOptions
Interface: CreateEngineOptions
Defined in: packages/core/dist/index.d.ts
Properties
| Property | Type | Description | Defined in |
|---|---|---|---|
adapters | ProviderAdapter[] | - | packages/core/dist/index.d.ts |
admission? | EngineAdmissionConfig | The durable admission bracket (RV4510, rfcs/admission.md): a configured scheduler brackets every non-preview run as one unit of work under (runId, genesis). A queued run WAITS for its grant honoring retryAfterMs; the terminal denied verdict refuses typed (AdmissionRejectedError) before any provider dispatch; the lease renews on a timer and releases at settle. Admission is an environmental fact: never journaled, and replay never consults it. The wire-level QuotaLimiter keeps being consulted per dispatch, unchanged: a granted ticket never exempts a wire from quota. | packages/core/dist/index.d.ts |
budgetDefaults? | BudgetDefaults | - | packages/core/dist/index.d.ts |
concurrency? | { perProvider?: Record<string, number>; perRun?: number; } | - | packages/core/dist/index.d.ts |
concurrency.perProvider? | Record<string, number> | - | packages/core/dist/index.d.ts |
concurrency.perRun? | number | - | packages/core/dist/index.d.ts |
defaults? | EngineDefaults | - | packages/core/dist/index.d.ts |
determinism? | DeterminismConfig | Bare-nondeterminism detection over in-process workflow bodies (RV-209): mode 'off' | 'warn' (default; detects outside production) |
executors? | Partial<Record<IsolatedExecutorTag, ToolExecutorProvider>> | Isolated tool executors (RV-216): one ToolExecutorProvider per non-inprocess executor tag. A tool declaring executor: 'subprocess' or 'container' dispatches through the matching provider, so its work runs OUT of the engine process under host-owned isolation instead of as an inprocess closure with full host capabilities. The shipped reference adapters (subprocessExecutor, containerExecutor) live in @rulvar/executor. Absent = only inprocess tools are accepted, and a non-inprocess tag is a typed ConfigError at spawn time. In-process tools stay ordinary function calls: never a sandbox for hostile or model-generated code. | packages/core/dist/index.d.ts |
extraDerivers? | readonly unknown[] | KeyDeriver registry extension (see https://docs.rulvar.com/guide/journal-compatibility). Plumbed now, consumed by the matching kernel from M2. | packages/core/dist/index.d.ts |
onEscalation? | (result) => | EscalationDecision | Promise<EscalationDecision> | The InProcessRunner escalation hook: receives escalated results when the call form cannot carry them; the returned decision is journaled as the authoritative escalation-decision entry. | packages/core/dist/index.d.ts |
ownership? | "auto" | "none" | The genesis ownership protocol (P0.2): over a journal store with the lease capability, a run or resume segment that was NOT handed a lease acquires its own before its first durable mutation, renews it at ttl/3 exactly like a queue worker, and releases it at settle. Fresh start, in-process resume, and worker takeover then share ONE owner/lease contract: at most one live driver per run across processes, a second driver's acquire rejects with the typed LeaseHeldError before any write or provider dispatch, and a crashed owner's lease expires after the store ttl so a worker sweep recovers the run. Default 'auto'. 'none' restores the pre-1.59.4 behavior (no engine-acquired leases) for hosts that coordinate ownership entirely outside the engine; a lease passed via RunOptions.lease or ResumeOptions.lease always wins over both modes (the caller owns acquire, renew, and release). Stores without the lease capability are unaffected: the embedded single-process default keeps the single-writer precondition. | packages/core/dist/index.d.ts |
pricing? | PriceTable | Versioned price table; wins over caps.pricing (M4-T06). | packages/core/dist/index.d.ts |
quota? | EngineQuotaConfig | The shared quota limiter (RV-215): a QuotaLimiter implementation consulted before every live wire dispatch of every run, plus the engine's tenant dimension and the limiter failure policy. Engines and processes that share one limiter (or one limiter storage, e.g. SqliteQuotaLimiter in @rulvar/store-sqlite over one database file) enforce one global quota; a denial rides the provider-429 retry and failover machinery without paying a wire call. Absent = no shared quota (Appendix A: an embeddable library must not surprise-throttle hosts). | packages/core/dist/index.d.ts |
redaction? | { maskEvents?: boolean; patterns?: readonly (string | RegExp)[]; } | The masking policy at the telemetry boundary. Default ON: key-shaped strings in every emitted WorkflowEvent are masked; never touches the journal (lossless encryption via serialization is the persistence-side tool). patterns adds host-defined redaction on top of the default credential set (RV-217): RegExp or pattern strings, compiled once at construction, applied to every string in every emitted event body. Feed the same patterns to the OTel exporter for trace parity. | packages/core/dist/index.d.ts |
redaction.maskEvents? | boolean | - | packages/core/dist/index.d.ts |
redaction.patterns? | readonly (string | RegExp)[] | - | packages/core/dist/index.d.ts |
runners? | { sandbox?: ScriptRunner; } | Runner registrations beyond the built-in InProcessRunner (M6-T02). sandbox executes CompiledWorkflow values (WorkerSandboxRunner ships in @rulvar/planner); running or resuming a compiled workflow without one is a typed ConfigError. | packages/core/dist/index.d.ts |
runners.sandbox? | ScriptRunner | - | packages/core/dist/index.d.ts |
security? | { argsHashSalt?: string; } | Metadata protection knobs (RV-217). argsHashSalt switches the RunMeta.argsHash digest from plain sha256 to HMAC-SHA256 under the salt: equal args stop correlating across deployments and low-entropy args stop being recoverable from the digest. The salt is deployment config, not a per-run secret: every engine (and the CLI host config) resuming this store's runs must carry the SAME salt, or the resume args gate refuses matching args. Runs recorded before the salt keep their unsalted digests; the gate then simply mismatches until forced, so introduce the salt on a fresh store or accept --allow-args-change on legacy runs. | packages/core/dist/index.d.ts |
security.argsHashSalt? | string | - | packages/core/dist/index.d.ts |
serialization? | SerializationHook | Redact/encrypt at the append/put boundaries, symmetric on load/get (M8-T04, OQ-22 executed). Applied by wrapping the configured stores; Engine.stores exposes the wrapped instances, so every reader passes one policy point. | packages/core/dist/index.d.ts |
stores? | { journal?: JournalStore; modelKnowledge?: ModelKnowledgeStore; transcripts?: TranscriptStore; } | - | packages/core/dist/index.d.ts |
stores.journal? | JournalStore | Default InMemoryStore (resume disabled, loud warning). | packages/core/dist/index.d.ts |
stores.modelKnowledge? | ModelKnowledgeStore | The ModelKnowledge claim store (M10-T03). Optional and OFF by default: an engine without it writes no kb entries at all. The runtime only ever receives the current()-only handle. | packages/core/dist/index.d.ts |
stores.transcripts? | TranscriptStore | - | packages/core/dist/index.d.ts |
telemetry? | { quotaDeniedAgentError?: boolean; } | Telemetry compat posture (RV1810). quotaDeniedAgentError: true restores the legacy agent:error twin beside the primary quota:denied event for recoverable pre-wire quota waits, for consumers still keyed to the old type. Default off: healthy throttling speaks its own type and never reads as failure. | packages/core/dist/index.d.ts |
telemetry.quotaDeniedAgentError? | boolean | - | packages/core/dist/index.d.ts |