fix: route error messages to stderr in varlock load to prevent JSON parse failures

[Copilot]

When a plugin (e.g. AWS secrets) fails during varlock load --format json-full --compact, error messages were written to stdout via console.log, contaminating the JSON payload. Since import 'varlock/config' captures stdout via execSync and passes it directly to JSON.parse(), any non-JSON text causes a hard crash:

SyntaxError: JSON Parse error: Unrecognized token '🚨'
    at initVarlockEnv (node_modules/varlock/dist/chunk-IMB5QAZS.js:163:30)

Changes

• showErrorLocationDetails — switched console.log → console.error
• checkForSchemaErrors — switched all error output (console.log → console.error) for loading errors, schema errors, and stack traces
• checkForConfigErrors — switched root decorator resolution error output to console.error

Stdout is now exclusively used for the intended machine-readable output (JSON, env, shell formats), while all diagnostic error messages go to stderr.

Tests

Added a vanilla-node smoke test that exercises the dotenv drop-in replacement (import 'varlock/config') with a bad schema (a @required variable with no value):

• varlock load --format json-full stdout is valid JSON when schema has errors — runs the CLI command directly and asserts that stdout is either empty or valid JSON; error messages must only appear on stderr
• importing varlock/config with a bad schema does not cause a JSON parse error — runs a plain Node.js script (node app.mjs) that imports varlock/config and confirms the process fails with a proper schema error on stderr, not with SyntaxError: JSON Parse error: Unrecognized token '🚨'

---

💬 Send tasks to Copilot coding agent from Slack and Teams to turn conversations into code. Copilot posts an update in your thread when it's finished.

[changeset-bot]

🦋 Changeset detected

Latest commit: 6dd1bf6

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 13 packages

Name	Type
varlock	Patch
@varlock/astro-integration	Patch
@varlock/nextjs-integration	Patch
@varlock/vite-integration	Patch
@varlock/1password-plugin	Patch
@varlock/aws-secrets-plugin	Patch
@varlock/azure-key-vault-plugin	Patch
@varlock/bitwarden-plugin	Patch
@varlock/google-secret-manager-plugin	Patch
@varlock/hashicorp-vault-plugin	Patch
@varlock/infisical-plugin	Patch
@varlock/pass-plugin	Patch
@varlock/proton-pass-plugin	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/varlock@495

npm i https://pkg.pr.new/@varlock/proton-pass-plugin@495

commit: 2b45e3a

[theoephraim]

@copilot - I believe this problem appeared for a user while using the dotenv drop-in replacement. Lets add a framework test - can be called "vanilla-node" which checks with a bad schema that it doesnt fail parsing json.

[theoephraim]

@copilot - I believe this problem appeared for a user while using the dotenv drop-in replacement. Lets add a framework test - can be called "vanilla-node" which checks with a bad schema that it doesnt fail parsing json.

[Copilot]

@copilot - I believe this problem appeared for a user while using the dotenv drop-in replacement. Lets add a framework test - can be called "vanilla-node" which checks with a bad sch...

Added a "vanilla-node" smoke test in commit 8fee148 (updated in 6dd1bf6).

New files:

• smoke-tests/smoke-test-vanilla-node/.env.schema — schema with a @required variable that has no value, triggering a validation error
• smoke-tests/smoke-test-vanilla-node/app.mjs — Node.js script using import 'varlock/config' (the dotenv drop-in)
• smoke-tests/tests/vanilla-node.test.ts — two tests:
  1. Verifies varlock load --format json-full --compact stdout is either empty or valid JSON when there are schema errors (errors must be on stderr only)
  2. Verifies running app.mjs with a bad schema fails gracefully — not with JSON Parse error: Unrecognized token '🚨' — and confirms error messages appear on stderr, not stdout