varlock v1.13.0

• #917 (minor)
  Add array and object value types: @type=array(...) and @type=record(...) with per-element validation, native [a, b] / {k=v} literal values, JSON and separator string input, configurable serialization back to process.env, per-element redaction, and typed code generation across languages
• #918 (minor)
  Report load failures to error trackers. varlock/auto-load can now throw the load error (instead of exiting silently) so a reporter like Sentry can capture it. Opt in with a globalThis._varlockOnLoadError hook (called with the error and the values that did resolve), or set _VARLOCK_THROW_ON_LOAD_ERROR=1 when a reporter is already initialized. Default behavior is unchanged.
• #920 (patch)
  Fix refs in the @cache root decorator value (e.g. @cache=if($USE_CACHE, "memory", "disabled")) silently resolving as undefined
• #908 (patch) - Reject numeric Infinity/-Infinity in number coercion
• #911 (patch)
  Resolve dynamic arguments in forEnv(); a forEnv() argument that resolves to undefined is now an error instead of silently comparing against "undefined"
• #922 (patch) - Add --plain flag to generate-key for piping into platform CLIs
• #923 (patch) - Fix varlock run OOM when child command is a bare PATH binary like node (shebang probe no longer reads the whole file)
• #913 (patch) - Scan Buffer chunks in ServerResponse.end for leaks
• #910 (patch) - Honor falsy schema overrides for builtin vars like VARLOCK_IS_CI
• #895 (patch) Thanks @cturner8!
  install.sh now installs varlock-local-encrypt.exe on WSL so local encryption can use the Windows TPM/Hello backend (pass --skip-win-exe to opt out)

Published to

• ✅ npm