# X_BROWSER_TRANSPORT_BYPASS

## Means

browser-reachable code opens its own connection instead of using the one seam

## Typical cause

a `fetch(` call, `new WebSocket(`, `new XMLHttpRequest(` or `new EventSource(` — or the global `fetch` handed on as a value (`rpc({ fetch })`, `fetch: fetch`, `const f = window.fetch`, `make(globalThis.fetch)`; a property named `fetch`, a local binding and a type position are not) — in an island or a module one reaches (its import closure, followed name by name through barrels, into the app's own `packages/*`). Such a request skips the page's record store, the idempotency header and the principal fence. Reported by `x verify`'s `boundaries` step in **every app** (`As of 2026-10`; built in, not a `guards/` file, so an app cannot delete it) — there no file may hold one: the three seams are the framework's, inside `node_modules`, and the walk stops at that boundary. In this repository `bun run browser-transport` runs the same rule with the seams as files: `packages/core/src/client-dispatch.ts` for `fetch`, `packages/realtime/src/browser-socket.ts` for sockets, `packages/storage/src/upload-client.ts` for XHR, nothing for `EventSource`; the service worker's files are exempt. **Blind spots, stated:** a browser module that is no island, names no seam and is imported by neither; a request made inside an installed package; a computed member (`globalThis['fetch']`); a bare `fetch(` in a file that binds a local `fetch`. A `route.ts`, a job and a test are server code and never reported

## Fix

`x verify --only boundaries --json` after replacing the call the finding names: an action → `await browserClient.<action>(input)` (`rpc<Api['actions']>` in `apps/web/shared/browser-client.ts`); a read → `useQuery(<QUERY_REF>, input)`; a socket or SSE → `useQuery` / `useChannel`; a file → `uploadFile({ file, grant })` from `@ultimat3/storage`; anything else → `clientTransport({ method, url })` from `@ultimat3/core/page`; a `fetch` passed as a value → delete it (`rpc()` and `queryClient()` send through `clientTransport` when given none) and move the module that took it onto one of the above

[CLI and verify](/error-codes#cli-and-verify)