The engine resolves its acting identity from this client's token and
caches the resolution per client object — the client's auth must be
stable for the engine's lifetime. To act as someone else, construct
an engine over a client bound to their token (withConfig({token})),
never mutate this client's auth in place.
Any configured apiVersion works: every verb derives its working
client onto ENGINE_API_VERSION, on the raw namespace as much as
through createEngine — see WorkflowClient.withConfig.
OptionalclockDeterministic-time seam, pinned once for this engine and threaded
into every verb it drives — $now, the now op-source, and the
timestamps the engine stamps all read from it. Omit (the default) to
use real wall-clock time; production never sets this. The test bench
(@sanity/workflow-engine-test) wraps this same seam as setNow /
advance. Deliberately engine-construction config, NOT a per-verb
option.
OptionaleffectsOptionalexecutionDeclared execution context — the advisory "via what" stamped on every
history entry alongside the token-resolved actor. Construction-scope
configuration, never per-call: the runtime half is always inferred, and
the declared {kind, id} half labels the host (see EXECUTION_KINDS).
Omitted ⇒ runtime-only stamps.
OptionalidempotencyHow long a recorded idempotencyKey dedupes retries (the
processedRequests[] row's lifetime). Default 24 hours. Size it to the
caller's longest retry horizon — a retry arriving after the row expired
re-executes the operation.
OptionalloggerOptionalresourceOptional routing override for cross-resource reads (subject + ancestor
docs that live in a different Sanity resource than the workflow). Called
with a parsed GDR; return a client for that resource, or undefined to let
the engine route it — client for the workflow resource itself, a
sibling derived from client's credentials for anything else. A served
resource is also part of the declared surface for runtime-supplied refs.
Engine-scope configuration — see CreateEngineArgs.
Engine-scope environment partition — required. See validateTag + tags.ts.
OptionaltelemetryProduct-telemetry seam, pinned once for this engine and threaded into
every verb it drives. The core engine ships no metrics pipeline — it
cannot know the environment's output rules (consent, transport, data
governance), so it only DEFINES events (exported from the package
root) and logs them through this logger; the app shell that does know
those rules owns store creation, consent resolution, and transport.
Omit (the default) to emit nothing. Any @sanity/telemetry
TelemetryLogger satisfies this seam — the engine mirrors the shape
rather than depending on the package. Same rule as the clock:
engine-construction config, never a per-verb option.
The Sanity resource the engine's own data lives in. Used to mint
GDR URIs for every doc the engine writes (definitions, instances,
ancestor refs). Mirrors @sanity/client's ClientConfigResource.
The EngineScopeArgs scope pinned at construction, plus the engine-only extras (
effectsandloggerFactoryfeeddrainEffects+verifyDeployedDefinitions). Thetagpartition is required and never defaulted — the engine enforces nothing, so the partition is the only thing keeping reads and writes off the wrong environment.