remote_module_pattern matches dependency files named remote.js and breaks the build

[valentinschabschneider]

Describe the bug

After #16382 (@sveltejs/kit@3.0.0-next.11), remote_module_pattern (/[/.]remote(\.[^/]+)+$/) treats any file named remote.js as a remote module — including files in node_modules.

Reproduction

I encountered this with jose (via @auth/sveltekit): its jwks/remote.js was emitted as a remote entry and the build failed.

Logs

Error: `createRemoteJWKSet` exported from node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/jwks/remote.js is invalid — all exports from this file must be remote functions

System Info

Node: 26.5.0 - C:\nvm4w\nodejs\node.EXE
    Yarn: 1.22.17 - C:\Users\shaby\AppData\Roaming\npm\yarn.CMD
    npm: 11.17.0 - C:\nvm4w\nodejs\npm.CMD
    bun: 1.2.5 - C:\Users\shaby\AppData\Local\Microsoft\WinGet\Links\bun.EXE
    Deno: 2.2.4 - C:\Users\shaby\AppData\Local\Microsoft\WinGet\Packages\DenoLand.Deno_Microsoft.Winget.Source_8wekyb3d8bbwe\deno.EXE
  Browsers:
    Chrome: 150.0.7871.130
    Edge: Chromium (150.0.4078.83)
    Internet Explorer: 11.0.26100.8115
  npmPackages:
    @sveltejs/adapter-node: 6.0.0-next.5 => 6.0.0-next.5
    @sveltejs/kit: 3.0.0-next.11 => 3.0.0-next.11
    @sveltejs/vite-plugin-svelte: ^7.2.0 => 7.2.0
    svelte: ^5.56.5 => 5.56.5
    vite: ^8.1.4 => 8.1.4

Severity

blocking an upgrade

Additional Information

No response

[Rich-Harris]

Our plan for solving this is to only treat these files as remote modules if the package they belong to has a peer dependency on @sveltejs/kit (since it would need that in order to use $app/server, without which it can't export remote functions)