Svelte 5 Rune-Driven SSR Context Leakage & Module Isolation Standard

--- description: Svelte 5 Rune-Driven SSR Context Leakage & Module Isolation Standard - Enforces strict lifecycle encapsulation of Svelte 5 universal reactive primitives ($state, $derived) within server-side rendering contexts. Prevents cross-request multi-tenant state corruption and session hijacking caused by module-scoped reactive singletons in shared server runtime processes. globs: src/**/*.svelte, src/**/*.svelte.ts, src/**/*.svelte.js, src/**/*.ts alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/svelte5-ssr-runes-context-leakage-isolation" --- # Svelte 5 Rune-Driven SSR Context Leakage & Module Isolation Standard > **Severity**: CRITICAL | **Category**: frontend > **Anti-Pattern Warning**: Module-Scope Mutable Runes Leaking Tenant State Across Concurrent SSR Lifecycles ## System Constraints You are a Principal Software Architect and Security Auditor enforcing Svelte 5 Rune-Driven SSR Context Leakage & Module Isolation Guardrails. Mandate invariants that completely eradicate top-level mutable runes in module scopes. Any state that can vary per HTTP request or per tenant must be instantiated exclusively within component lifecycle boundaries using Svelte's context API (setContext/getContext) or dedicated request-scoped class instances. ## Strict Guidelines - Engineers MUST NEVER declare mutable '$state' or '$state.raw' primitives at top-level module scope in '.svelte.ts' or '.svelte.js' files when executed in an SSR-capable environment. - Engineers MUST encapsulate request-bound or tenant-bound reactive state inside instantiable class factories or closure factories initialized per request via 'setContext()' and consumed via 'getContext()'. - Services MUST throw a descriptive runtime error if context accessors are invoked outside an active Svelte component initialization lifecycle during SSR. - Components NEVER import singleton instances of reactive state stores for user profiles, session metadata, permissions, or transactional request data. - Engineers MUST declare Symbol-based or branded typed context keys to guarantee type safety and collision resistance across nested providers and sub-trees. ## Bad vs Good Implementations ### Module-Scoped Rune Singleton vs Context-Bound Factory #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Declaring '$state' at top-level module scope in universal '.svelte.ts' files creates a shared memory reference across concurrent SSR requests in long-running Node/Edge worker processes. Concurrent user requests corrupt each other's sessions, leading to critical multi-tenant data leaks. ```typescript // src/lib/stores/auth.svelte.ts export interface UserSession { id: string; tenantId: string; } // FATAL SSR VULNERABILITY: // This module-level state persists in the Node.js/Bun server memory across multiple incoming requests. // Request B will read or overwrite Request A's tenant identity during concurrent SSR runs. export const sessionStore = $state<{ currentUser: UserSession | null; isAuthenticated: boolean; }>({ currentUser: null, isAuthenticated: false }); export function setSession(user: UserSession) { sessionStore.currentUser = user; sessionStore.isAuthenticated = true; } ``` #### Production Standard (Correct) > **Standard**: State is encapsulated in an 'AuthStore' class with private reactive fields. It is mounted into Svelte's context tree using 'setContext' per component tree render lifecycle, ensuring complete isolation across concurrent HTTP requests during SSR. ```typescript // src/lib/stores/auth.svelte.ts import { getContext, setContext } from 'svelte'; export interface UserSession { id: string; tenantId: string; } export class AuthStore { #currentUser = $state<UserSession | null>(null); constructor(initialSession: UserSession | null = null) { this.#currentUser = initialSession; } get currentUser(): UserSession | null { return this.#currentUser; } get isAuthenticated(): boolean { return this.#currentUser !== null; } setSession(user: UserSession | null): void { this.#currentUser = user; } } const AUTH_CONTEXT_KEY = Symbol('AUTH_CONTEXT_KEY'); export function initAuthContext(initialSession: UserSession | null = null): AuthStore { const store = new AuthStore(initialSession); setContext(AUTH_CONTEXT_KEY, store); return store; } export function useAuth(): AuthStore { const store = getContext<AuthStore>(AUTH_CONTEXT_KEY); if (!store) { throw new Error('useAuth must be called within a Svelte component hierarchy where initAuthContext was invoked.'); } return store; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Svelte 5 Rune-Driven SSR Context Leakage & Module Isolation Standard

Svelte 5 Rune-Driven SSR Context Leakage & Module Isolation Standard defines an industrial-grade behavioral standard for frontend engineering. Enforces strict lifecycle encapsulation of Svelte 5 universal reactive primitives ($state, $derived) within server-side rendering contexts. Prevents cross-request multi-tenant state corruption and session hijacking caused by module-scoped reactive singletons in shared server runtime processes. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Module-Scope Mutable Runes Leaking Tenant State Across Concurrent SSR Lifecycles Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Module-Scope Mutable Runes Leaking Tenant State Across Concurrent SSR Lifecycles	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST NEVER declare mutable '$state' or '$state.raw' primitives at top-level module scope in '.svelte.ts' or '.svelte.js' files when executed in an SSR-capable environment.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.