Svelte 5 Runes SSR Reactive Context Leak Prevention Standard

--- description: Svelte 5 Runes SSR Reactive Context Leak Prevention Standard - Enforces strict isolation of fine-grained reactive runes ($state, $derived) during Server-Side Rendering (SSR) to prevent cross-request tenant bleeding and memory leaks. Prohibits module-level singleton state instances and mandates scoped context encapsulation via Svelte's context API or per-request instantiation boundaries. globs: src/**/*.{svelte,svelte.ts,svelte.js,ts,js} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/svelte5-runes-ssr-context-leak-prevention-standard" --- # Svelte 5 Runes SSR Reactive Context Leak Prevention Standard > **Severity**: CRITICAL | **Category**: frontend > **Anti-Pattern Warning**: Global Module-Level Runes Instantiation Permeating Concurrent Server Requests ## System Constraints You are a Principal Software Architect enforcing the Svelte 5 Runes SSR Reactive Context Leak Prevention Standard. Your mission is to detect and eliminate any global reactive state instantiated via $state, $state.raw, or class-based signal wrappers at module level that executes in SSR runtimes. You mandate that all mutable state is bound to Svelte component contexts (setContext/getContext) or per-request lifecycles. ## Strict Guidelines - Engineers MUST ALWAYS encapsulate mutable $state rune instances inside component lifecycles or factory functions instantiated per request. - Engineers MUST NOT declare mutable $state or $state.raw variables at the module root of .svelte.ts or .ts files that execute in an SSR environment. - Code SHOULD leverage setContext() and getContext() with unique Symbol keys to manage shared reactive state trees across component hierarchies safely during SSR. - Services MUST instantiate domain stores via dependency injection or factory pipelines initialized during request handling, never as singleton export declarations. - Components NEVER attach asynchronous listeners or persistent reactive signal chains in SSR code without deterministic teardown mechanisms. ## Bad vs Good Implementations ### Module-Level Shared State vs. Context-Bound Per-Request Encapsulation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Declaring `$state` at the top level of a module creates a shared global variable in the server process. Under concurrent requests, User A's profile updates `authSession`, exposing User A's private state to User B's SSR render cycle and preventing garbage collection. ```typescript // src/lib/stores/auth.svelte.ts - SEVERE SECURITY RISK: Leaks state across SSR requests interface UserProfile { id: string; role: string; } // Module-scope rune is shared across all concurrent SSR requests in the Node/Bun process export const authSession = $state<UserProfile>({ id: 'anonymous', role: 'guest' }); export function setSession(user: UserProfile) { authSession.id = user.id; authSession.role = user.role; } ``` #### Production Standard (Correct) > **Standard**: By encapsulating the reactive state inside a class and binding it to Svelte's context API (`setContext`/`getContext`), the reactive signal graph is strictly bound to the individual component tree. Every SSR request constructs its own independent context, eliminating cross-request leaks and enabling clean garbage collection. ```typescript // src/lib/stores/auth.svelte.ts - Safe: Per-request context isolation import { getContext, setContext } from 'svelte'; interface UserProfile { id: string; role: string; } export class AuthSession { #state = $state<UserProfile>({ id: 'anonymous', role: 'guest' }); constructor(initialState?: UserProfile) { if (initialState) { this.#state = initialState; } } get user(): UserProfile { return this.#state; } setSession(user: UserProfile): void { this.#state = user; } } const AUTH_CONTEXT_KEY = Symbol('AUTH_SESSION_KEY'); export function initAuthSession(initialState?: UserProfile): AuthSession { const session = new AuthSession(initialState); setContext(AUTH_CONTEXT_KEY, session); return session; } export function useAuthSession(): AuthSession { const session = getContext<AuthSession>(AUTH_CONTEXT_KEY); if (!session) { throw new Error('AuthSession requested outside of component lifecycle context'); } return session; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Svelte 5 Runes SSR Reactive Context Leak Prevention Standard

Svelte 5 Runes SSR Reactive Context Leak Prevention Standard defines an industrial-grade behavioral standard for frontend engineering. Enforces strict isolation of fine-grained reactive runes ($state, $derived) during Server-Side Rendering (SSR) to prevent cross-request tenant bleeding and memory leaks. Prohibits module-level singleton state instances and mandates scoped context encapsulation via Svelte's context API or per-request instantiation boundaries. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Global Module-Level Runes Instantiation Permeating Concurrent Server Requests Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Global Module-Level Runes Instantiation Permeating Concurrent Server Requests	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS encapsulate mutable $state rune instances inside component lifecycles or factory functions instantiated per request.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.