Dynamic Imports Break Server Asset Discovery in hooks.server.ts

[Tjomas]

Describe the bug

Inside the hooks.server.ts file we import a file using the ?url syntax.
Everythings worked fine and the file was included in the build, copied to the asset folder with its hashed name, and was added to the server_assets list in the manifest.

import productsFileUrl from '$lib/assets/Products.xlsx?url';

We also use better-auth inside hooks.server.ts.
After the recent update (exact version better-auth 1.4.3 to 1.4.4 and above) better-auth uses dynamic imports to load different adapters and dialects. This results in a different result inside the generated manifest.json file inside the .sveltekit/output/server/.vite/manifest.json

Before the update:

{
  'src/hooks.server.ts': {
    file: 'chunks/hooks.server.js',
    name: 'hooks.server',
    src: 'src/hooks.server.ts',
    isDynamicEntry: true,
    imports: [
      '_environment.js',
      '_shared-server.js',
      '_range.util.js',
      '_assert.util.js',
      '_zod.utils.js',
      '_loc.utils.js',
      '_RedisService.js',
      '_private.js',
      '_client.js',
      '_index2.js'
    ],
    assets: [ '_app/immutable/assets/Products.BmxPNQzs.xlsx' ]
  },
}

After the update:

{
  '_hooks.server.js': {
    file: 'chunks/hooks.server.js',
    name: 'hooks.server',
    isDynamicEntry: true,
    imports: [
      '_environment.js',
      '_shared-server.js',
      '_range.util.js',
      '_assert.util.js',
      '_zod.utils.js',
      '_loc.utils.js',
      '_RedisService.js',
      '_index3.js',
      '_private.js',
      '_client.js',
      '_index2.js'
    ],
    dynamicImports: [
      '../../node_modules/.pnpm/better-auth@1.4.4_@sveltejs_2c05c91d5a58d8cc4c49e85a8498fc30/node_modules/better-auth/dist/bun-sqlite-dialect-4d24xHgm.mjs',
      '../../node_modules/.pnpm/better-auth@1.4.4_@sveltejs_2c05c91d5a58d8cc4c49e85a8498fc30/node_modules/better-auth/dist/node-sqlite-dialect-7hOpXgTN.mjs',
      '../../node_modules/.pnpm/better-auth@1.4.4_@sveltejs_2c05c91d5a58d8cc4c49e85a8498fc30/node_modules/better-auth/dist/adapters/memory-adapter/index.mjs',
      '../../node_modules/.pnpm/better-auth@1.4.4_@sveltejs_2c05c91d5a58d8cc4c49e85a8498fc30/node_modules/better-auth/dist/adapters/kysely-adapter/index.mjs',
      '../../node_modules/.pnpm/better-auth@1.4.4_@sveltejs_2c05c91d5a58d8cc4c49e85a8498fc30/node_modules/better-auth/dist/adapters/kysely-adapter/index.mjs'
    ],
    assets: [ '_app/immutable/assets/Products.BmxPNQzs.xlsx' ]
  },
}

Observations:

• Only the better-auth package was updated. Node, Vite, SvelteKit versions remain the same.
• Better-auth now uses dynamic imports
• The asset is still correctly included in the build and copied to the asset folder with its hashed name.
• The name of the hooks.server entry in the manifest changed from src/hooks.server.ts to _hooks.server.js

Note: I don't believe better-auth is the root cause here. The issue lies in how find_server_assets.js discovers assets. It only looks for the original src/hooks.server.ts key, but Vite may rename this entry when dynamic imports are present. This is why I'm opening this issue in the SvelteKit repository.

Workaround:

  // src\core\generate_manifest\find_server_assets.js:

	// This is -> src/hooks.server.ts
	if (build_data.manifest_data.hooks.server) {
		add_assets(build_data.manifest_data.hooks.server);
	}

I can manually add the _hooks.server.js entry to the server_assets inside find_server_assets.js as a workaround, but this feels wrong and fragile:

	// I added this line to find the server assets from hooks.server.ts
	add_assets("_hooks.server.js");

Reproduction

Open this stackblitz to reproduce the issue:

It comes with better-auth preinstalled and the problematic hooks.server.ts file.
This node adapter is used to make sure its a server build.

/release/server/manifest.js with empty server_assets.

https://stackblitz.com/~/github.com/Tjomas/sveltejs-kit-template-default-cv6bgzj3

Change the better-auth version to 1.4.3 in the package.json and do another build.
Run npm install and npm run build again.

Now the /release/server/manifest.js contains the correct server_assets entry.

Logs

System Info

System:
  OS: Windows 11 10.0.26200
  CPU: (20) x64 13th Gen Intel(R) Core(TM) i9-13900H
  Memory: 31.51 GB / 63.63 GB
Binaries:
  Node: 24.12.0 - C:\Users\USERNAME\AppData\Local\mise\installs\node\24.12.0\node.EXE
  npm: 11.6.2 - C:\Users\USERNAME\AppData\Local\mise\installs\node\24.12.0\npm.CMD
  pnpm: 10.27.0 - C:\Users\USERNAME\AppData\Local\mise\installs\pnpm\10.27.0\pnpm.EXE
  bun: 1.2.6 - C:\Users\USERNAME\.bun\bin\bun.EXE
  Deno: 2.1.4 - C:\Users\USERNAME\.deno\bin\deno.EXE
Browsers:
  Chrome: 143.0.7499.170
  Edge: Chromium (143.0.3650.66), ChromiumDev (144.0.3719.7)
  Firefox: 145.0.2 - C:\Program Files\Mozilla Firefox\firefox.exe
  Internet Explorer: 11.0.26100.7309

Severity

serious, but I can work around it

Additional Information

The issue exists in Windows and Docker Linux environment.

[teemingc]

On a side note, while trying to create a minimal failing test for this in Kit, it looks like it could be a bug in Vite/Rollup. According to the Vite manifest, it thinks it's dynamically importing something from better-auth which is statically importing the server hook. However, I can't really find any evidence of better-auth importing the server hook. I also tried to reproduce this but the Vite manifest stayed the same.