fix: require a @sveltejs/kit peer dependency for remote modules in node_modules

[Nic-Polumeyv]

Fixes #16473 by implementing the rule from #16473 (comment). Files in node_modules are only treated as remote modules when the package they belong to lists @sveltejs/kit in its peerDependencies; files outside node_modules behave as before.

The check walks up from the file to the owning package.json, past dist/package.json type stubs and stopping at the node_modules boundary, so pnpm virtual-store paths and scoped packages resolve correctly. Results are cached per directory. It gates the remote transform, the dev prebundle externalization from #16426, and the dev watcher. The chain check that picks the "enable remoteFunctions" error message still uses the raw pattern, because the import graph there holds root-relative ids that can't be reliably resolved to a package.

Reproducing the issue requires the dependency to be processed by Vite, so the new fixture package has a svelte field, which makes vite-plugin-svelte mark it ssr.noExternal like the reporter's @auth/sveltekit chain; a plain server-external package never reaches the transform. Without the fix, the async test app build fails with the exact error from the issue. The existing e2e-test-dep-remote fixture now declares the peer dependency, which keeps its test passing and covers the other side of the rule.

[pkg-svelte-dev]

Install the latest version of @sveltejs/kit from 15bfcd1:

pnpm add https://pkg.svelte.dev/@sveltejs/kit/c/15bfcd10719e2182d545715683e1f64064725657

Open in pkg.svelte.dev: https://pkg.svelte.dev/repos/kit/pr/16492

Note

This PR is from a fork. A maintainer must approve approve each commit before it can be built and installed.

[changeset-bot]

🦋 Changeset detected

Latest commit: 15bfcd1

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@sveltejs/kit	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR