fix(rivetkit): fix BigInt serialization in inspector workflow history and state deserialization

[abcxff]

Description

Please include a summary of the changes and the related issue. Please also include relevant motivation and context.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

How Has This Been Tested?

Please describe the tests that you ran to verify your changes.

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

[railway-app]

🚅 Deployed to the rivet-pr-5058 environment in rivet-frontend

Service	Status	Web	Updated (UTC)
website	😴 Sleeping (View Logs)	Web	May 15, 2026 at 2:10 pm
frontend-inspector	❌ Build Failed (View Logs)	Web	May 14, 2026 at 6:13 pm
frontend-cloud	❌ Build Failed (View Logs)	Web	May 14, 2026 at 6:12 pm
ladle	❌ Build Failed (View Logs)	Web	May 14, 2026 at 6:10 pm
mcp-hub	✅ Success (View Logs)	Web	May 14, 2026 at 6:10 pm
kitchen-sink	❌ Build Failed (View Logs)	Web	May 14, 2026 at 6:10 pm

[abcxff]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• fix(rivetkit): fix BigInt serialization in inspector workflow history and state deserialization #5058 👈 (View in Graphite)
• DO NOT MERGE: queue diagnose #5050
• [slop]fix(workflow-engine): only commit step state after success #5010 : 1 other dependent PR (#5052 )
• fix(rivetkit): bind methods through createWriteThroughProxy #4987
• fix(rivetkit): remove client-side connection request size check #5057
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[claude]

PR Review: fix(rivetkit): BigInt serialization in inspector workflow history and state deserialization

Summary: This PR addresses two related BigInt/JSON serialization issues in the inspector path, plus adds ext/* to the pnpm workspace.

---

Code Quality

decodeCborCompat vs decodeCborJsonCompat switch (native.ts)

The change from decodeCborJsonCompat (which sets coerceSafeIntegerBigInts: true) to decodeCborCompat is correct — the old path was causing safe integers to be unnecessarily promoted to BigInts during state deserialization, which could cause downstream type mismatches. This is a good fix.

jsonSafe() wrapping of serializeWorkflowHistoryForJson

Correct direction — the inspector HTTP endpoint needs JSON-safe output and workflow history can contain BigInts or Uint8Arrays from CBOR-encoded data. The jsonSafe() / toHttpJsonCompatible() approach works, but note:

// jsonSafe does a full JSON.stringify/JSON.parse round-trip.
// For large workflow histories this is O(n) in history size on every
// inspector poll. The TODO comment acknowledges this — just flag it
// in case history grows large before the CBOR migration lands.

This is acceptable for the inspector path (which is diagnostic/debugging traffic, not hot-path), but worth tracking.

---

Potential Issues

ext/* workspace addition without a committed directory

pnpm-workspace.yaml and pnpm-lock.yaml both reference ext/test, but neither the ext/ directory nor ext/test/package.json appear to exist in this PR. This can cause:

• pnpm install to emit warnings or fail depending on the pnpm version
• CI confusion if install runs before the directory is created

Either the ext/test directory should be included in this PR, or the workspace entry should land in the same commit that adds the directory. If ext/test is a separate in-progress package, consider keeping the workspace entry in that future PR.

Type transparency after jsonSafe()

jsonSafe<T> preserves the TypeScript type T while silently converting bigint → number and Uint8Array → number[] at runtime. The return type of serializeWorkflowHistoryForJson stays unchanged, so callers see the original type but receive transformed values. This is fine for a JSON HTTP response, but worth noting in a comment near the function signature (or in the TODO) so a future refactor to CBOR doesn't accidentally remove the transformation and re-introduce the original bug.

---

Minor

• The TODO comment // TODO: Switch inspector routes to CBOR encoding is useful — keep it. When that work lands, jsonSafe() wrapping can be removed and CBOR will handle binary types natively.
• PR description checkboxes are all unchecked. Not blocking, but helpful to fill in for reviewers.

---

Verdict

The core logic changes are correct and fix a real bug. The main concern is the orphaned ext/test workspace entry — that should either ship with its directory or be deferred to its own PR. Everything else is low-risk.

🤖 Generated with Claude Code