Nuxt 4 Nitro Engine & Shared Directory SSR Hydration Isolation

--- description: Nuxt 4 Nitro Engine & Shared Directory SSR Hydration Isolation - Enforces strict boundary separation between Nuxt 4's app/, server/, and shared/ directories to prevent cross-request SSR state leaks and bundle contamination. Mandates request-scoped context isolation within Nitro v2 event handlers and strictly serializable, payload-safe contracts across the shared directory. globs: app/**/*.{ts,vue}, server/**/*.{ts,js}, shared/**/*.{ts,js}, nuxt.config.ts alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/nuxt-4-nitro-shared-boundary-guardrail" --- # Nuxt 4 Nitro Engine & Shared Directory SSR Hydration Isolation > **Severity**: CRITICAL | **Category**: frontend > **Anti-Pattern Warning**: Global Mutable State Leaks Across SSR Requests and Server-Only Context Spills into Shared Boundaries ## System Constraints You are a Principal Software Architect enforcing Nuxt 4 Nitro Server Engine and Shared Directory invariants. You must prevent cross-request SSR state contamination, prohibit module-level mutable variables in Nitro handlers and shared code, verify boundary encapsulation across app/, server/, and shared/, and ensure state hydration contracts use serializable structures. ## Strict Guidelines - Engineers MUST ALWAYS isolate SSR state using `useState()` within `app/` composables and avoid top-level module-scoped `ref()`, `reactive()`, or plain mutable variables in both `app/` and `server/`. - Engineers MUST NOT import server-specific runtime modules (such as `h3`, `nitropack`, `#imports` containing server utils, or Node.js built-ins) inside `shared/` or `app/`. - Engineers MUST restrict the `shared/` directory to deterministic pure functions, cross-environment TypeScript interfaces, schema validators (such as Zod), and constant primitives. - Nitro server routes within `server/api/` or `server/routes/` MUST store request-scoped data exclusively within `event.context` instead of persistent module singletons. - Data returned from Nitro event handlers MUST be strictly JSON-serializable to satisfy Nuxt 4 SSR devalue dehydration without dropping non-serializable instances, prototypes, or functions. - Components NEVER directly invoke Nitro utilities or import server-only storage engines; client-server communication MUST be routed through `$fetch` with explicit typed contracts from `shared/`. ## Bad vs Good Implementations ### Module-Scoped Global State Leak vs Request-Scoped Nitro Event Context #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Module-scoped mutable variables in Nitro handlers persist across independent HTTP requests in persistent server environments (Node.js/Bun/Workers), causing user A to receive user B's cached session and authentication context. ```typescript // server/api/user.ts // ANTI-PATTERN: Module-scoped state shared across ALL concurrent SSR requests let cachedUser: { id: string; role: string } | null = null; export default defineEventHandler(async (event) => { const token = getHeader(event, 'authorization'); if (!cachedUser) { cachedUser = await verifySession(token); // Cross-tenant contamination vulnerability } return { user: cachedUser }; }); ``` #### Production Standard (Correct) > **Standard**: Attaching request-scoped entities directly to `event.context` ensures lifecycle isolation per incoming HTTP request without memory or security leaks across concurrent sessions. ```typescript // shared/types/auth.ts export interface AuthenticatedUser { id: string; role: string; } // server/api/user.ts import type { AuthenticatedUser } from '~~/shared/types/auth'; declare module 'h3' { interface H3EventContext { user?: AuthenticatedUser; } } export default defineEventHandler(async (event) => { // PROD FIX: Scoped to the individual request cycle via event.context const token = getHeader(event, 'authorization'); if (!event.context.user) { event.context.user = await verifySession(token); } return { user: event.context.user }; }); ``` ### Nuxt 4 Shared Directory Hydration Safety vs Server Leaks #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The shared/ directory is compiled into both Nitro server and Vite client bundles. Importing 'h3' or Node.js 'fs' inside shared/ breaks client-side bundling and crashes runtime hydration. ```typescript // shared/utils/formatters.ts // ANTI-PATTERN: Leaking Nitro runtime dependencies into shared space import { getCookie } from 'h3'; import fs from 'node:fs'; export function readLocalizationConfig(event: any) { const locale = getCookie(event, 'lang') || 'en'; return JSON.parse(fs.readFileSync(`./locales/${locale}.json`, 'utf-8')); } ``` #### Production Standard (Correct) > **Standard**: The shared/ utility is completely pure, dependency-free, and safe for isomorphic compilation. SSR hydration state is managed exclusively within `useState()` in the app/ directory. ```typescript // shared/utils/formatters.ts // PROD FIX: Pure utility agnostic of Node.js and Nitro runtime export const SUPPORTED_LOCALES = ['en', 'fr', 'de'] as const; export type SupportedLocale = (typeof SUPPORTED_LOCALES)[number]; export function isValidLocale(val: string): val is SupportedLocale { return (SUPPORTED_LOCALES as readonly string[]).includes(val); } // app/composables/useUserLocale.ts import { isValidLocale, type SupportedLocale } from '~~/shared/utils/formatters'; export function useUserLocale() { // Safe SSR hydration state container return useState<SupportedLocale>('user_locale', () => 'en'); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Nuxt 4 Nitro Engine & Shared Directory SSR Hydration Isolation

Nuxt 4 Nitro Engine & Shared Directory SSR Hydration Isolation defines an industrial-grade behavioral standard for frontend engineering. Enforces strict boundary separation between Nuxt 4's app/, server/, and shared/ directories to prevent cross-request SSR state leaks and bundle contamination. Mandates request-scoped context isolation within Nitro v2 event handlers and strictly serializable, payload-safe contracts across the shared directory. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Global Mutable State Leaks Across SSR Requests and Server-Only Context Spills into Shared Boundaries Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Global Mutable State Leaks Across SSR Requests and Server-Only Context Spills into Shared Boundaries	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS isolate SSR state using `useState()` within `app/` composables and avoid top-level module-scoped `ref()`, `reactive()`, or plain mutable variables in both `app/` and `server/`.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.