Limit the requestInfo to server-only. #635

sdk/package.json

@@ -179,6 +179,7 @@
     "puppeteer-core": "~24.22.0",
     "react-is": "~19.1.0",
     "rsc-html-stream": "~0.0.6",
+    "server-only": "^0.0.1",
     "tmp-promise": "~3.0.3",
     "ts-morph": "~27.0.0",
     "unique-names-generator": "~4.7.1",

sdk/src/runtime/entries/worker.ts

@@ -1,3 +1,4 @@
+import "server-only";
 import "./types/worker";
 export * from "../error";
 export * from "../lib/types";

sdk/src/runtime/requestInfo/worker.ts

@@ -1,4 +1,5 @@
 import { AsyncLocalStorage } from "async_hooks";
+import { experimental_taintObjectReference } from "react";
 import { defineRwState } from "rwsdk/__state";
 import { DefaultAppContext, RequestInfo } from "./types";
 
@@ -28,6 +29,14 @@ export const requestInfo: DefaultRequestInfo = Object.freeze(
   requestInfoBase,
 ) as DefaultRequestInfo;
 
+if (typeof experimental_taintObjectReference === "function") {
+  experimental_taintObjectReference(
+    "Do not pass the full requestInfo object to Client Components. " +
+      "Instead, pass only the specific data you need via props.",
+    requestInfo,
+  );
+}
+
 export function getRequestInfo(): RequestInfo {
   const store = requestInfoStore.getStore();
   if (!store) {