Skip to content

feat: reject domain client initialization in browsers#5

Open
safwanyp wants to merge 1 commit into
opencoredev:mainfrom
safwanyp:main
Open

feat: reject domain client initialization in browsers#5
safwanyp wants to merge 1 commit into
opencoredev:mainfrom
safwanyp:main

Conversation

@safwanyp

@safwanyp safwanyp commented Jul 13, 2026

Copy link
Copy Markdown

Closes #1

Context

the readme states:

Domain SDK is server-side only

an early exit is not a "silver bullet" or anything, but it helps prevent accidental client-side usage.

Changes

createDomainClient() fails when browser globals such as window or document are present.

i thought about including browser worker detection, but it's tricky. WorkerGlobalScope is what i was planning on using, but it can also be present in valid server-side worker runtimes. as far as i know, cloudflare workers (as an exmaple) has worker-style globals. adding a check for this might be risky, so i decided not to include it.

@vercel

vercel Bot commented Jul 13, 2026

Copy link
Copy Markdown

@safwanyp is attempting to deploy a commit to the OpenCore Team on Vercel.

A member of the Team first needs to authorize it.

@greptile-apps

greptile-apps Bot commented Jul 13, 2026

Copy link
Copy Markdown

Greptile Summary

This PR adds a browser-environment guard to the domain client. The main changes are:

  • createDomainClient() now throws when window or document is present.
  • The error message points callers toward server routes, server actions, or backend services.
  • The client tests now cover initialization when a browser-like window global exists.

Confidence Score: 5/5

Safe to merge with minimal risk.

The change is small, localized to client construction, and covered by a targeted test that restores changed global state.

No files require special attention.

T-Rex T-Rex Logs

What T-Rex did

  • I reviewed the existing changed tests and the explicit runtime harness source, and confirmed the harness ran successfully with exit code 0.

View all artifacts

T-Rex Ran code and verified through T-Rex

Important Files Changed

Filename Overview
packages/sdk/src/core/client.ts Adds an environment assertion before client construction to reject browser globals before provider configuration is used; no issues found.
packages/sdk/test/core/client.test.ts Adds coverage for browser-like window globals and restores the original global descriptor after the assertion; no issues found.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
participant Caller
participant Client as createDomainClient
participant Guard as assertServerEnvironment
participant Provider

Caller->>Client: createDomainClient(options)
Client->>Guard: check globalThis environment
alt window or document is defined
    Guard-->>Client: throw server-side-only Error
    Client-->>Caller: initialization rejected
else no browser globals
    Guard-->>Client: return
    Client->>Provider: validate provider and create operations
    Client-->>Caller: DomainClient
end
Loading
%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
participant Caller
participant Client as createDomainClient
participant Guard as assertServerEnvironment
participant Provider

Caller->>Client: createDomainClient(options)
Client->>Guard: check globalThis environment
alt window or document is defined
    Guard-->>Client: throw server-side-only Error
    Client-->>Caller: initialization rejected
else no browser globals
    Guard-->>Client: return
    Client->>Provider: validate provider and create operations
    Client-->>Caller: DomainClient
end
Loading

Reviews (1): Last reviewed commit: "feat: reject domain client initializatio..." | Re-trigger Greptile

@shivamrun shivamrun left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks good overall

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

enforce the server-only constraint

2 participants