Remote Functions don't work in node_modules

[ottomated]

Describe the bug

I want to define shared remote functions in a package of my monorepo. However, they can only live in src/lib and src/routes here.

Reproduction

N/A

Logs

System Info

System:
    OS: Linux 6.13 Fedora Linux 41 (Forty One)
    CPU: (24) x64 AMD Ryzen 9 7900 12-Core Processor
    Memory: 16.46 GB / 30.48 GB
    Container: Yes
    Shell: 3.7.1 - /bin/fish
  Binaries:
    Node: 22.15.1 - ~/.volta/tools/image/node/22.15.1/bin/node
    Yarn: 4.1.1 - ~/.volta/tools/image/yarn/4.1.1/bin/yarn
    npm: 10.9.2 - ~/.volta/tools/image/node/22.15.1/bin/npm
    pnpm: 10.12.4 - ~/.volta/bin/pnpm
    bun: 1.2.15 - ~/.bun/bin/bun
  Browsers:
    Chrome: 138.0.7204.49
  npmPackages:
    @sveltejs/adapter-cloudflare: catalog: => 7.0.5 
    @sveltejs/kit: catalog: => https://pkg.pr.new/sveltejs/kit/@sveltejs/kit@13957
    @sveltejs/vite-plugin-svelte: catalog: => 6.0.0-next.3 
    svelte: catalog: => https://pkg.pr.new/svelte@15844
    vite: catalog: => 7.0.3

Severity

blocking an upgrade

Additional Information

No response

[elliott-with-the-longest-name-on-github]

We talked about this in the discussion and are a little dubious about allowing it without some additional design -- it would be pretty easy for a library to just... create random endpoints in your app that expose whatever the heck they want without some serious controls.

[ottomated]

We talked about this in the discussion and are a little dubious about allowing it without some additional design[...]

Sure, I see the concerns, but I would suggest:
a. Adding a config option to whitelist paths, similar to vite's fs.allow
b. Throwing a warning whenever a remote function is imported like this:

import { some_query } from 'external/something.remote';

Warning

Remote functions from external/something.remote are not accessible by default. To whitelist it, add "../packages/external" to kit.remoteFunctions.allowedPaths in svelte.config.js.