[SLOP(claude-opus-4-8[1m]-high)] feat(rivetkit): add cloudflare-workers and supabase platform packages

[NathanFlurry]

[SLOP(claude-opus-4-8[1m]-high)] docs(examples): add cloudflare workers hono and raw router examples

[NathanFlurry]

Stack for rivet-dev/rivet

• [SLOP(claude-opus-4-8[1m]-medium)] fix(website): fix docs styling issues #5261 vkomutvy · 2026-06-14 08:01:27
• [SLOP(claude-opus-4-8[1m]-high)] docs(examples): wire quickstart examples, clients, and dev tools links #5260 ykkuxrxl · 2026-06-14 08:01:26
• [SLOP(claude-opus-4-8[1m]-high)] feat(rivetkit): add cloudflare-workers and supabase platform packages #5256 ztlsusyv · 2026-06-14 04:08:59 👈
• [SLOP(gpt-5)] feat(cli): add rivetkit cli #5255 kprpzusk · 2026-06-13 23:00:59
• [SLOP(claude-opus-4-8[1m]-medium)] docs(website): consolidate landing pages, deploy quickstarts, and docs restructuring #5254 psyxxqon · 2026-06-13 23:00:58
• [SLOP(claude-opus-4-8)] refactor(rivetkit): deprecate actor kv api across core and typescript #5253 polvovvk · 2026-06-13 23:00:57
• [SLOP(claude-opus-4-8)] docs(examples): split effect example into hello-world-effect and chat-room-effect #5252 wolqzmyo · 2026-06-13 23:00:56
• [SLOP(gpt-5)] fix(rivetkit): normalize protocol args source-side #5251 lvpxytwl · 2026-06-13 00:10:46
• [SLOP(claude-opus-4-8)] docs(actors): apply docs audit fixes #5250 rtqklwqu · 2026-06-13 00:10:45
• [SLOP(claude-opus-4-8)] docs(actors): rewrite in-memory state page, remove sandbox page, fix stateSaveInterval default, forbid em dashes #5249 pqwwounv · 2026-06-13 00:10:44
• [SLOP(claude-opus-4-8-medium)] docs(pool-configuration): fix runner-config SDK snippet to use RivetClient from engine-api-full #5248 tmoxrznq · 2026-06-13 00:10:42
• [SLOP(claude-opus-4-8-medium)] docs(quickstart): clean up rust quickstart to import shared actor and auto-download engine #5246 lrzpsprl · 2026-06-13 00:10:40
• [SLOP(claude-opus-4-8-medium)] fix(rivetkit-wasm): add missing inspector_tabs field to ActorConfigInput conversion #5245 ookuputp · 2026-06-13 00:10:39
• main

Get stack: forklift get 5256
Push local edits: forklift submit
Merge when ready: forklift merge 5256

[claude]

PR #5256 Review: Cloudflare Workers + Supabase platform packages, Rust CLI, args normalization

Overview

This PR is a large, multi-faceted feature addition:

• New platform packages: @rivetkit/cloudflare-workers and @rivetkit/supabase that wrap the wasm runtime for edge platforms
• New Rust CLI (rivet-cli): rivet dev, rivet engine, rivet deploy, rivet setup-ci commands
• New crate: rivetkit-engine-process extracted from rivetkit-core (now a crate dependency instead of duplicated code)
• args normalization protocol change: scalars/objects now wrap to [value], null/undefined to []
• properties field in the inspector action body as a named alternative to positional args
• Actor KV deprecation in both Rust (#[deprecated]) and TypeScript (@deprecated)
• Docs reorganization: connect/ renamed to deploy/, new Cloudflare/Supabase quickstart pages
• New examples: hello-world-cloudflare-workers (3 variants), hello-world-supabase-functions, hello-world-effect, chat-room-effect

---

Issues & Observations

1. Breaking change in positional_value (Rust) needs attention

The positional_value function in rivetkit-rust/packages/rivetkit/src/action.rs changed how map-typed CBOR values are encoded:

• Before: Value::Map(entries) extracted the values and returned [v1, v2, ...]
• After: Value::Map(_) wraps the entire map as [{...}]

This is consistent with the new properties protocol convention but is a silent behavioral break for any Rust actor actions defined as named structs. The CLAUDE.md addition documents the new invariant. Confirm this is intentional and consider whether a protocol version bump or warning is needed for Rust actor code relying on the old map-to-positional extraction.

2. FetchWebSocket is missing addEventListener / removeEventListener

The WebSocket shim in cloudflare-workers/src/websocket.ts implements only the callback-property interface (onopen, onmessage, etc.) but not the full EventTarget interface. The wasm tunnel uses the callback approach internally so this works for the runtime's own connection. However, globalThis.WebSocket is replaced globally, so any third-party npm package in the user Worker that calls new WebSocket(url) and uses addEventListener("message", ...) will silently lose all events. Consider either adding a minimal event-listener layer or narrowing the override so it does not replace globalThis.WebSocket if the host already provides a working implementation.

Also, send() silently discards data when readyState === CLOSING or CLOSED rather than throwing InvalidStateError, diverging from the spec.

3. envApplied flag race on concurrent first-requests (minor)

In createHandler, two requests can arrive and begin executing concurrently before either sets envApplied = true. applyEnv is idempotent (all checks are if (!config.x)), so the practical outcome is benign. A brief comment calling that out would prevent future readers from introducing a non-idempotent mutation in applyEnv.

4. applyEnv mutates registry.config post-construction

applyEnv casts registry.config and mutates it after setup() returns, which breaks encapsulation. If Registry ever freezes config at construction time, this will silently stop working. A cleaner follow-up would be passing env resolution into setup() or accepting env as a parameter in registry.handler(request, env).

5. Supabase path-stripping > 0 guard needs a comment

const prefixedIndex = url.pathname.indexOf(managerSegment);
if (prefixedIndex > 0) { ... }

The logic is correct. The > 0 (not >= 0) check prevents re-routing a path already caught by the startsWith check above. A comment explaining why would prevent an accidental "fix" to >= 0 in the future.

6. Engine binary download buffers entire binary in memory

fetch_bytes in rivetkit-engine-process loads the full engine binary into a Vec<u8> before writing to disk. For a developer CLI this is acceptable, but streaming to a tempfile and atomically renaming into the cache path would be safer against partial writes on SIGKILL. Low priority, but worth a TODO comment.

7. npx supabase may trigger a slow first-run download

In dev.rs, the Supabase provider runs npx supabase functions serve .... This will download the Supabase CLI via npx on first use. Worth a note in the README about pre-installing the CLI to avoid a slow first run.

---

What Is Done Well

• Test harness refactor in shared-platform-harness.ts cleanly separates the actor body from platform bootstrapping so each fixture looks like public docs code. Consistent with CLAUDE.md guidance.
• rivetkit-engine-process extraction is clean: 884 lines moved verbatim from rivetkit-core to its own crate, reducing core's dependency footprint. The new crate is consumed by both the TypeScript bridge and the CLI.
• kv_internal() is a good pattern: core keeps using KV as persistence backing while kv() is deprecated for actors.
• normalize_json_args / normalizeArgs are extracted consistently on both Rust and TypeScript sides.
• properties validation is consistent between Rust (inspector.rs) and TypeScript (native.ts): both reject null, arrays, and non-objects, and both reject a body that supplies both args and properties.
• Runner config cache invalidation on endpoint change in pegboard/src/ops/runner_config/upsert.rs looks like an important bug fix bundled into this PR.
• sideEffects entries in @rivetkit/cloudflare-workers/package.json correctly flag the WebSocket shim so bundlers do not tree-shake it.
• Rust typed-event test in client.rs is correctly updated to send cbor(&vec![event]) (array-wrapped) instead of cbor(&event), matching the new protocol invariant.
• The dev.rs CLI has unit tests for resolve_port and strip_env_quotes covering the tricky edge cases.

---

Style Notes (per CLAUDE.md)

• The doc comment block on EngineProcessManager in engine-process/src/lib.rs uses em dashes, which CLAUDE.md forbids. Replace with periods.
• A few comments in dev.rs use the // Something - extra note dash pattern instead of complete sentences.

---

Test Coverage Gap

No unit tests for the engine binary download or checksum verification paths in rivetkit-engine-process. The checksum_for_artifact and sha256_hex functions are pure and easily testable. Consider adding a tests/ module for the manifest parsing and checksum matching logic.