`pnpm --filter '@objectstack/rest^...' build` fails on a dependency cycle with @objectstack/verify — the contract's prescribed closure build is unusable for rest

[claude]

Found while implementing #13280 (PR #13843). ⛔ No severity is asserted here; this records what was driven and what came back, for triage.

The shape

AGENTS.md / the dev contract prescribe building a package's dependency closure before running its tests, as:

pnpm --filter '<pkg>^...' build

For @objectstack/rest that command fails, and it fails in a way that reads exactly like "your change broke an import".

What was measured

On a clean worktree off origin/main at 6b285eca42, before any edit:

$ pnpm --filter '@objectstack/rest^...' build
packages/verify build: src/harness.ts(23,90): error TS2307: Cannot find module '@objectstack/runtime' or its corresponding type declarations.
packages/verify build: src/harness.ts(26,37): error TS2307: Cannot find module '@objectstack/rest' or its corresponding type declarations.
packages/verify build: src/harness.ts(27,28): error TS2307: Cannot find module '@objectstack/plugin-auth' or its corresponding type declarations.
packages/verify build: DTS Build error
 ERR_PNPM_RECURSIVE_RUN_FIRST_FAIL @objectstack/verify@17.2.0 build
Exit status 1

The cause, as far as it was driven

@objectstack/verify is resolved as a member of @objectstack/rest's dependency closure:

$ pnpm --filter '@objectstack/rest^...' list --depth -1
@objectstack/verify@17.2.0 /home/user/.../packages/verify

while @objectstack/verify itself depends on the packages it cannot find:

$ node -e "const p=require('./packages/verify/package.json'); ..."
verify deps incl rest? [ '@objectstack/plugin-auth', '@objectstack/rest', '@objectstack/runtime' ]

⇒ verify is ordered into the build of rest's dependencies, but verify needs rest (and runtime, plugin-auth) to be built first. The prescribed filter cannot satisfy both.

turbo is not affected — it orders the same graph correctly for a normal build:

$ pnpm exec turbo run build --filter=@objectstack/verify --dry=json
tasks turbo would run for verify build: 34
includes rest? True | includes runtime? True

Why this is worth a card rather than a shrug

The failure is pre-existing and unrelated to whatever the dev is changing, but it surfaces at the first command the contract tells a dev to run, and its message names three modules in the package under work. The reading it invites — "my edit broke an import" — is wrong, and confirming that costs a round. It also leaves @objectstack/rest without a working prescribed way to build its closure, which is the documented precondition for trusting that package's test results.

⚠️ Not asserted here: whether the right repair is to drop the cycle (verify's dependency on rest is a devDependency-shaped test-harness edge), to exclude verify from that closure, or to change what the contract prescribes for packages in a cycle. Those are different calls with different blast radii.

Refs

• [finding] at a RestServer provider seam a SYNCHRONOUS throw loses the whole execution context while an async rejection is absorbed — same fault, two different wire answers #13280 / PR fix(rest): a provider seam that throws synchronously no longer discards the whole execution context #13843 — the card this fell out of; its closure build hit this first.

Generated by Claude Code

---

Generated by Claude Code