Fix diamond dependency double-import handling

[Copilot]

When the same schema directory is reachable via multiple import paths (diamond dependency), it was being fully loaded multiple times. This caused plugin init decorators (e.g. @initAws) to execute twice, crashing with "Instance with id '_default' already initialized".

Example topology that triggers the bug:

apps/console/.env.schema
  # @import(../../)              ← loads root (runs @plugin + @initAws)
  # @import(../shared-infra/)   ← loads shared-infra
    → shared-infra/@import(../../)  ← tries to load root again → 💥

Changes

• EnvGraph — adds a private _loadedImportPaths: Set<string> and a checkAndRecordImportPath(path): boolean helper that atomically checks-and-records a path (returns true = already seen, skip it)
• _processImports() — calls the helper before creating any DirectoryDataSource or DotEnvFileDataSource for all four import variants (virtual dir, virtual file, real dir, real file); skips with continue if the path was already loaded
• Test plugin (test-plugin-with-init) — minimal plugin that registers an @initTestPlugin() root decorator with module-level singleton tracking, mirroring how real plugins like @varlock/aws-secrets-plugin behave
• import.test.ts — three new diamond-dependency tests: directory dedup, directory dedup with a plugin init decorator, and file dedup

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• api.iconify.design
  • Triggering command: /opt/hostedtoolcache/node/24.14.1/x64/bin/node /opt/hostedtoolcache/node/24.14.1/x64/bin/node --experimental-import-meta-resolve --require /home/REDACTED/work/varlock/varlock/node_modules/.bun/vitest@4.1.0+9d5cb286dd4627aa/node_modules/vitest/suppress-warnings.cjs --conditions node --conditions development /home/REDACTED/work/varlock/varlock/node_modules/.bun/vitest@4.1.0+9d5cb286dd4627aa/node_modules/vitest/dist/workers/forks.js (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[changeset-bot]

🦋 Changeset detected

Latest commit: b89789c

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 18 packages

Name	Type
varlock	Patch
@varlock/nextjs-integration	Patch
@varlock/astro-integration	Patch
@varlock/cloudflare-integration	Patch
@varlock/expo-integration	Patch
@varlock/vite-integration	Patch
@varlock/1password-plugin	Patch
@varlock/aws-secrets-plugin	Patch
@varlock/azure-key-vault-plugin	Patch
@varlock/bitwarden-plugin	Patch
@varlock/dashlane-plugin	Patch
@varlock/google-secret-manager-plugin	Patch
@varlock/hashicorp-vault-plugin	Patch
@varlock/infisical-plugin	Patch
@varlock/keepass-plugin	Patch
@varlock/pass-plugin	Patch
@varlock/passbolt-plugin	Patch
@varlock/proton-pass-plugin	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/varlock@553

npm i https://pkg.pr.new/@varlock/nextjs-integration@553

commit: b89789c

[bestickley]

@philmillman, I tried out this PR package (super cool, by the way!) and it fixes #552! Thank you very much. Looking forward to this getting merged.

[philmillman]

@philmillman, I tried out this PR package (super cool, by the way!) and it fixes #552! Thank you very much. Looking forward to this getting merged.

Ok thanks for testing! We'll get it out today or tomorrow at the latest