Svelte 5 Runes SSR Cross-Request Scope Isolation & Leak Prevention

--- description: Svelte 5 Runes SSR Cross-Request Scope Isolation & Leak Prevention - Enforces strict request-boundary isolation for Svelte 5 reactive runes ($state, $derived) in server-side rendering (SSR) runtimes. Module-scoped reactive runes in persistent server runtimes like Node.js and Bun persist across concurrent requests, resulting in cross-user data leakage and critical security vulnerabilities. All mutable user, tenant, or request-specific reactive states must be encapsulated within Svelte Context or instantiated per-request lifecycle. globs: src/**/*.{svelte,svelte.ts,ts} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/svelte-5-runes-ssr-scope-isolation" --- # Svelte 5 Runes SSR Cross-Request Scope Isolation & Leak Prevention > **Severity**: CRITICAL | **Category**: frontend > **Anti-Pattern Warning**: Module-Level $state Singletons Leaking Concurrent Request Data in SSR Runtimes ## System Constraints You are a Principal Software Architect enforcing Svelte 5 Runes SSR Scope Isolation. In persistent SSR runtimes (e.g., @sveltejs/adapter-node), module evaluations are cached across the lifetime of the process. Declaring top-level reactive runes ($state) in `.svelte.ts` files introduces shared mutable global state across concurrent HTTP connections. You must enforce that all reactive stores, session caches, and request data models are encapsulated in class instances or factories instantiated strictly inside the Svelte component context hierarchy or passed explicitly via SvelteKit load data. ## Strict Guidelines - Engineers MUST NOT declare top-level module-scoped `$state` or `$state.raw` variables in `.svelte.ts` or `.svelte` files executed during SSR. - Engineers MUST ALWAYS isolate request-specific or user-specific state by wrapping reactive classes inside Svelte Context (`setContext` / `getContext`). - Engineers MUST instantiate state objects inside component initialization hooks (e.g., in `+layout.svelte` or `+page.svelte`) or retrieve them via factory functions tied to the request lifecycle. - Code SHOULD enforce typed Symbols as context keys to prevent key collisions across feature boundaries. - Services MUST receive request-scoped state explicitly via parameters or context injection, never by importing a global reactive singleton. - Components NEVER mutate module-level exported variables during SSR rendering pipelines. ## Bad vs Good Implementations ### Module-Scoped Rune Singleton vs Context-Bound Reactive Class #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: In persistent server runtimes, the module-scoped `authState` object is shared across every incoming HTTP request. When Request A executes `setSessionUser()`, Request B concurrently reading `authState` will read Request A's sensitive user credentials. ```typescript // src/lib/stores/session.svelte.ts // FATAL: authState is evaluated once per Node process; concurrent requests overwrite and leak user data interface UserProfile { id: string; role: string; } export const authState = $state<{ user: UserProfile | null; isAuthenticated: boolean; }>({ user: null, isAuthenticated: false }); export function setSessionUser(user: UserProfile) { authState.user = user; authState.isAuthenticated = true; } ``` #### Production Standard (Correct) > **Standard**: The `SessionState` class is instantiated per request subtree using Svelte's Context API. Each SSR render receives a fresh, isolated state instance that is garbage-collected when the request finishes, completely eliminating cross-request state contamination. ```typescript // src/lib/stores/session.svelte.ts import { getContext, setContext } from 'svelte'; interface UserProfile { id: string; role: string; } export class SessionState { user = $state<UserProfile | null>(null); isAuthenticated = $derived(this.user !== null); constructor(initialUser: UserProfile | null = null) { this.user = initialUser; } setSessionUser(user: UserProfile) { this.user = user; } } const SESSION_KEY = Symbol('SESSION_STATE'); export function initSessionContext(initialUser: UserProfile | null = null): SessionState { return setContext(SESSION_KEY, new SessionState(initialUser)); } export function getSessionContext(): SessionState { const session = getContext<SessionState>(SESSION_KEY); if (!session) { throw new Error('SessionState context has not been initialized in component hierarchy'); } return session; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Svelte 5 Runes SSR Cross-Request Scope Isolation & Leak Prevention

Svelte 5 Runes SSR Cross-Request Scope Isolation & Leak Prevention defines an industrial-grade behavioral standard for frontend engineering. Enforces strict request-boundary isolation for Svelte 5 reactive runes ($state, $derived) in server-side rendering (SSR) runtimes. Module-scoped reactive runes in persistent server runtimes like Node.js and Bun persist across concurrent requests, resulting in cross-user data leakage and critical security vulnerabilities. All mutable user, tenant, or request-specific reactive states must be encapsulated within Svelte Context or instantiated per-request lifecycle. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Module-Level $state Singletons Leaking Concurrent Request Data in SSR Runtimes Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Module-Level $state Singletons Leaking Concurrent Request Data in SSR Runtimes	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST NOT declare top-level module-scoped `$state` or `$state.raw` variables in `.svelte.ts` or `.svelte` files executed during SSR.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.