fix(varlock): type coercions, imported @currentEnv, and leak-scan end hang

[WalksWithASwagger]

Lands the still-valid expedition fixes on current main, including two upstream bugs that never actually reached this repo.

Fixes

• @type=enum: coerce string process.env / overrideValues to numeric and boolean members
• @type=url: treat allowedDomains comma-strings as host lists (no substring match); allow root / with noTrailingSlash=true
• @type=ip: accept IPv4-mapped IPv6 (::ffff:192.168.1.1)
• @type=md5: accept uppercase hex and normalize to lowercase
• @type=port: reject non-integers (including unquoted 80.5)
• Fixes [BUG]: environment flag "..." must be defined within this schema when importing #428: @currentEnv=$FLAG may reference a key brought in via @import
• Fixes [BUG]: Leak detection hang when ServerResponse.end throws on leaked secret #897: ServerResponse.end finishes the response (500 / destroy) when leak detection throws

Review follow-ups

• A dynamically disabled import no longer lets a values-only .env key act as @currentEnv or load env-specific files
• Imported directories load env-specific files after a later flag-providing import
• Ancestor env propagation stops at a nested directory that set its own @currentEnv
• The replacement 500 clears stale Content-Length / Content-Encoding and is covered with a real HTTP client

Not included (already on main or superseded)

• prependHttps skipping an existing protocol (already fixed)
• Registering numeric @sensitive values for leak scanning (superseded by Check that sensitive values can actually be redacted #1054: numbers are unredactable by design)

Docs for the changed behavior are in this PR (data-types, root-decorators, import, secrets). A follow-up docs PR covers the Python Homebrew re-exec note (#992) and guide cross-links.

Test plan

• cd packages/varlock && bunx vitest run src/env-graph/test/environments.test.ts src/runtime/test/patch-server-response.test.ts

[pullfrog]

Important

Two edge cases can still select the wrong environment or leave the replacement leak response invalid, so these should be addressed before merging.

Reviewed changes Reviewed the type coercion fixes, imported @currentEnv initialization flow, response leak termination behavior, tests, editor metadata, and documentation.

• Data type behavior: Normalizes enum overrides, URL allowlists, IPv4-mapped IPv6, integer ports, and uppercase MD5 values.
• Imported environment flags: Defers @currentEnv resolution when a matching import is expected, then loads environment-specific files after imports.
• Leak response termination: Attempts to finish an uncommitted response with a 500 before rethrowing a leak error.
• User-facing guidance: Updates the website and VS Code catalog for the changed contracts.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using azure/gpt-5.6-sol ｜ 𝕏}

[pullfrog]

Important

The new directory propagation can cross an explicit nested @currentEnv boundary and select the wrong environment-specific values.

Reviewed changes Reviewed the follow-up commit that tightened imported environment-flag provenance, propagated late environment selection into earlier directory imports, and normalized replacement leak-response headers.

• Environment declaration provenance: Required the resolved flag to have a schema or import definition, preventing a disabled dynamic import from validating an unrelated values-only key.
• Imported directory propagation: Added a post-import traversal so directories initialized before the flag provider can load their environment-specific files.
• Leak response headers: Replaced stale entity headers and added listening HTTP server/client tests for stale length and compression metadata.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using azure/gpt-5.6-sol ｜ 𝕏}

[pullfrog]

Important

The new one-shot env-file guard can preserve fallback-specific values after a late import resolves the real environment, so this should be addressed before merging.

Reviewed changes Reviewed the follow-up commit since the prior Pullfrog review that corrected nested environment propagation and tightened env-specific file loading.

• Nested environment boundaries: Stopped ancestor environment propagation at imported directories that define their own @currentEnv, with coverage for descendants inheriting the nearer environment.
• Env-specific loading guard: Changed directory loading to accept only the first selected environment, including when that first selection came from the CLI fallback before a later import supplied the real flag.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using azure/gpt-5.6-sol ｜ 𝕏}

[pullfrog]

This now skips every later environment, not just one already loaded, so an earlier directory import that loads the CLI fallback cannot switch when a later root import resolves the real @currentEnv. I reproduced fallbackEnv=prod plus a late imported DEPLOY_ENV=dev; the child retained .env.prod and returned from-prod instead of from-dev.

Technical details

# Late imported currentEnv cannot replace a child's fallback

## Affected sites
- `packages/varlock/src/env-graph/lib/data-source.ts:1085` - any prior env-specific load prevents the directory from loading a newly resolved environment
- `packages/varlock/src/env-graph/lib/data-source.ts:1156-1161` - an imported directory can finalize with `envFlagFallback` before its parent's later import resolves the actual flag

## Required outcome
- A directory that loaded fallback-specific files before the real `@currentEnv` became available must apply the real environment when the parent propagates it.
- Preserve the new stop at explicit nested `@currentEnv` boundaries.
- Add coverage with `fallbackEnv=prod`, an earlier directory import, and a later flag import selecting `dev`; the directory value must come from `.env.dev`.

## Suggested approach
- Keep `_applyCurrentEnvToImportedDirectories` from crossing explicit boundaries, but deduplicate only when `_loadedEnvSpecificFor === currentEnv` rather than after any prior load.

[theoephraim]

Thanks @WalksWithASwagger, this is good work and all three parts are landing. I split it into one PR per concern so they can be reviewed and released independently, since the file sets are disjoint:

• fix(varlock): enum, url, ip, md5, and port data type fixes #1064 — enum / url / ip / md5 / port data type fixes
• fix(varlock): finish the response when leak detection throws on end #1065 — ServerResponse.end finish-on-leak ([BUG]: Leak detection hang when ServerResponse.end throws on leaked secret #897)
• fix(varlock): allow @currentEnv to reference an imported key #1066 — imported @currentEnv ([BUG]: environment flag "..." must be defined within this schema when importing #428)

Your commit authorship is preserved on all three, and each is byte-for-byte identical to what was here. I left review notes on two things I want to decide explicitly rather than fold in silently: the noTrailingSlash root-/ change inverts an existing test (docs and code disagreed on main, so it is a real call to make), and the md5 lowercase coercion rewrites the value the app receives on top of the case-insensitive regex. Details are on #1064. #1066 has a note about importStaticallyProvidesKey duplicating the import-filter parsing.

Closing this one in favor of the three. Nice catch on the escaped \. in the IPv6 regex in particular.