pds-spaces-alpha image: lexicon resolution fails with "varint.decode is not a function"

running ghcr.io/bluesky-social/atproto:pds-spaces-alpha (digest sha256:481a87733c639966139e34dc6425eddf30d6218327fb489649e76edf2c3c9252, pds 0.5.32 inside), any oauth login that requests a space scope fails with invalid_scope / "unable to retrieve space declarations". the consent screen never renders

repro, no configuration needed (platform flag included because it was complaining on apple silicon):

docker run --rm --platform linux/amd64 --entrypoint node ghcr.io/bluesky-social/atproto:pds-spaces-alpha -e 'import("@atproto/lex-resolver").then(async ({ LexResolver }) => { try { await new LexResolver({}).get("app.bsky.feed.post"); console.log("resolved ok"); } catch (e) { console.log(e.cause?.stack ?? e); } })'

prints:

TypeError: varint.decode is not a function
    at decodeVarInt (file:///app/packages/car/dist/lib/varint.js:9:19)
    at BufferReader.readFrameSize (file:///app/packages/car/dist/lib/bytes-reader.js:33:16)
    ...

cause: @atproto/[email protected] in the image compiles import * as varint from 'varint' (packages/car/src/lib/varint.ts). [email protected] is CJS with dynamically attached exports, so the namespace import has no named decode. everything before the CAR parse works (DNS TXT authority lookup, plc resolution, sync.getRecord fetch); it dies reading the CAR proof

fix: use the default import (import varint from 'varint') in packages/car/src/lib/varint.ts

verified the workaround on a live dev PDS: bind-mounting a patched dist file over /app/packages/car/dist/lib/varint.js (default-import interop) makes lexicon resolution and oauth consent for space scopes work end to end

found while testing spaces alpha against a self-hosted dev PDS with a published space declaration. happy to provide more detail if it would be helpful!