diff --git a/.eslintrc.js b/.eslintrc.js
new file mode 100644
index 0000000..0b76b29
--- /dev/null
+++ b/.eslintrc.js
@@ -0,0 +1,33 @@
+module.exports = {
+    'env': {
+        'commonjs': true,
+        'es6': true,
+        'node': true
+    },
+    'extends': 'eslint:recommended',
+    'globals': {
+        'Atomics': 'readonly',
+        'SharedArrayBuffer': 'readonly'
+    },
+    'parserOptions': {
+        'ecmaVersion': 2018
+    },
+    'rules': {
+        'indent': [
+            'error',
+            4
+        ],
+        'linebreak-style': [
+            'error',
+            'unix'
+        ],
+        'quotes': [
+            'error',
+            'single'
+        ],
+        'semi': [
+            'error',
+            'always'
+        ]
+    }
+};
\ No newline at end of file
diff --git a/.gitignore b/.gitignore
index 25b70ae..bb14eca 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,6 @@
 node_modules/
 coverage
+npm-debug.log
+.nyc_output/
+package-lock.json
+
diff --git a/.mocharc.js b/.mocharc.js
new file mode 100644
index 0000000..1bb971f
--- /dev/null
+++ b/.mocharc.js
@@ -0,0 +1,5 @@
+module.exports = {
+  extension: ['.spec.js'],
+  recursive: true,
+  reporter: 'spec'
+}
diff --git a/.travis.yml b/.travis.yml
index 7ab9726..0570f30 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,5 +1,5 @@
 language: node_js
 node_js:
-  - 0.10
+  - 6
 script: "npm run-script travis"
 after_success: "<coverage/lcov.info ./node_modules/coveralls/bin/coveralls.js"
diff --git a/README.md b/README.md
index fc532c8..20dc801 100644
--- a/README.md
+++ b/README.md
@@ -1,8 +1,7 @@
-OConf
-=====
+# OConf
 
-[[![NPM version](https://badge.fury.io/js/oconf.svg)](http://badge.fury.io/js/oconf)
-![Build Status](https://travis-ci.org/One-com/node-oconf.svg)](https://travis-ci.org/One-com/node-oconf)
+[![NPM version](https://badge.fury.io/js/oconf.svg)](https://npmjs.com/package/oconf)
+[![Build Status](https://travis-ci.org/One-com/node-oconf.svg)](https://travis-ci.org/One-com/node-oconf)
 [![Coverage Status](https://coveralls.io/repos/One-com/node-oconf/badge.svg)](https://coveralls.io/r/One-com/node-oconf)
 [![Dependency Status](https://david-dm.org/One-com/node-oconf.png)](https://david-dm.org/One-com/node-oconf)
 
@@ -15,10 +14,13 @@ Load cjson (JSON + c-style) commentaries, with inheritance-sugar on top:
          "value": 50
     }
 
-Format
-------
+## The `#include` directive
 
-The basic idea is to experiment with applying `#include`-statements recusively
+Anywhere in your cjson file, you can `#include` another cjson file. The file containing the `#include` directive overrides any values from the file being included, in case of conflicts.
+
+### Format
+
+The basic idea is to experiment with applying `#include`-directives recusively
 inside JSON/cJSON documents:
 
 ```javascript
@@ -49,8 +51,7 @@ Will result in a config with:
 The extension of objects also work recursively, so setting a single sub-key
 somewhere doesn't override the entire thing.
 
-Structure
----------
+### Structure
 
 There are no restrictions in how includes work (except no loops). Usually a
 structure like this is used:
@@ -58,17 +59,84 @@ structure like this is used:
  * `project/config/default.cjson` has project-wide defaults.
  * `project/config/{dev,test,staging,production}.cjson` inherits the default
    and set keys relevant to respective environments
- * `project/config/$HOSTNAME.cjson` (optinal) machine-specifics that inherit
+ * `project/config/$HOSTNAME.cjson` (optional) machine-specifics that inherit
    from the relevant environment-file.
  * `/etc/$WORKNAME/$PROJECTNAME-secrets.cjson` inherits the machine-specific
    things and typically adds production secrets.
 
-Binary
-------
+## The `#public` directive
+
+With this directive, you can generate a json blob that can be safely exposed to client-side code. This is useful when some properties on the same object are safe to expose to client code, while others are not.
+
+### Restrictions
+
+In case of conflicts between a `#public` and a non-public key on the same object, an error is thrown - it is usually a sign that a new key needs to be introduced if the same key contains different values for client and server code.
+
+The `#include` directives are processed before `#public`.
+
+### Format
+
+Anywhere in your cjson file, you can add a `#public` property to an object, denoting some keys on that property you want grouped together on the `#public` property of the root of your config. 
+
+```javascript
+// some-public-settings.cjson
+{
+  "some-setting": "default value",
+  "value": 100,
+  "fancy-list": {
+    "expose-foo": true,
+    "#public": {
+      "scroll-timeout": 100
+    }
+  }
+}
+```
+
+Will result in a config with:
+
+```javascript
+{
+  "some-setting": "default-value",
+  "value": 100,
+  "fancy-list": {
+    "expose-foo": true,
+    "scroll-timeout": 100
+  },
+  "#public": {
+    "fancy-list": {
+      "scroll-timeout": 100
+    }
+  }
+}
+```
+
+### Returning only configuration marked as `#public`
+
+You can instruct `oconf.load` to only return configuration properties marked with `#public`:
+
+    > var oconf = require('oconf');
+    > oconf.load('config/some-public-settings.cjson', { public: true });
+    {
+        "fancy-list": {
+            "scroll-timeout": 100
+        }
+    }
+
+Of course you can also just grab the `#public` property from the result of `oconf.load`:
+
+    > var oconf = require('oconf');
+    > oconf.load('config/some-public-settings.cjson')['#public'];
+    {
+        "fancy-list": {
+            "scroll-timeout": 100
+        }
+    }
+
+## Binary
 
 To help resolve configuration on the command line oconf exports a CLI
-tool called oconf. In it's simplest form it takes a path to an cjson
-file, and outputs the resolved JSON object.
+tool called oconf. It takes a path to an cjson file, and outputs the
+resolved JSON object.
 
 ```
  $ oconf config.cjson
@@ -80,42 +148,80 @@ file, and outputs the resolved JSON object.
 }
 ```
 
-Oconf also takes a `--lint` option. It will make oconf not output any
-of the resolved configuration, but only exit with an error in case of
-any formatting errors in the files.
+You can lint your configuration files by using the `--lint` flag. It
+will not output any of the resolved configuration, but only exit with
+an error in case of any formatting errors in the files.
 
 ```
  $ oconf --lint config.cjson
 ```
 
-You can supply a path to a value as well:
+By using the `--extract-option` flag you can supply a path to a value
+as well:
 
 ```
- $ oconf config.cjson obj.foo
+ $ oconf --extract-option obj.foo config.cjson
+bar
+```
+
+The output from the above is the raw data. That is useful when you
+need to pass the configuration to other CLI tools. If you need the
+JSON formatted data, you can pass the `--option-as-json` option.
+
+```
+ $ oconf --extract-option obj.foo --json config.cjson
 "bar"
 ```
 
-The output from the above is the JSON.stringified format. If you need
-to pass it into another cli program, you'd most likely want it as a
-string literal and not quoted. That can be achieved like this:
+If the key is missing `oconf --extract-option` will exit with status
+code 1. If you need to overwrite that behaviour you can pass the
+`--allow-missing-option` flag to oconf which will make it exit with
+status code 0 if no value is found at the given path.
+
+You can also filter out values in the `#public` blob with the `--public` flag.
 
 ```
- $ oconf --bare config.cjson obj.foo
-bar
+ $ oconf --public some-public-settings.cjson
+{
+  "fancy-list": {
+    "scroll-timeout": 100
+  }
+}
+```
+
+## Support for relaxed JSON format
+**Reference:** https://www.npmjs.com/package/relaxed-json
+
+```js
+// Contents of config.rjson
+{
+  someConfig: 'someValue'
+}
 ```
 
-If the key is missing oconf will exit with exit code 1. If you need to
-overwrite that behaviour you can pass the `--allowmissing` flag to
-oconf which will make it exit with status code 0 if no value is found
-at the given path.
+### In terminal:
+```sh
+ $ oconf --relaxed config.rjson
+{
+    "someConfig": "someValue"
+}
+```
+
+In Node JS:
+```js
+var oconf = require('oconf');
+var data = oconf.load('config.rjson', { relaxed: true });
+console.log(JSON.stringify(data));
+
+// Output:
+{"someConfig": "someValue"}
+```
 
-Tests
------
+## Tests
 
 Download/clone, run `npm install` and then `npm test`.
 
-License
--------
+## License
 
-The software is provided under the Modified BSD License; See LICENSE for
-further details.
+The software is provided under the Modified BSD License; See
+[LICENSE](LICENSE) for further details.
diff --git a/bin/oconf b/bin/oconf
index 1d47a7b..26a9694 100755
--- a/bin/oconf
+++ b/bin/oconf
@@ -1,76 +1,119 @@
 #!/usr/bin/env node
-// ex: filetype=javascript
-
-var oconf = require('../lib/index'),
-    util = require('util'),
-    _ = require('underscore'),
-    argv = require('optimist')
-        .option('lint', {
-            type: 'boolean',
-            default: false
-        })
-        .option('ignore', {
-            type: 'string'
-        })
-        .option('bare', {
-            type: 'boolean'
-        })
-        .option('allowmissing', {
-            type: 'boolean'
-        })
-        .demand(1)
-        .usage('Usage: $0 [--lint] [--bare] [--allowmissing] [--ignore <filename>] <filename.cjson> [path.to.value...]')
-        .argv;
+const oconf = require('../lib/index');
+const { Command } = require('commander');
+const program = new Command();
 
-if (argv.lint) {
-    console.warn(
-        'The option --lint is deprecated and will be replaced by',
-        'a standalone binary with release 3.0.0 of oconf.'
-    );
+program
+    .name('oconf')
+    .usage('[--lint|--extract-option <option> [--allow-missing-option][--option-as-json]] <file>')
+    .option('-h, --help', 'This help text.')
+    .option('-i, --ignore <path>', 'Absolute path or glob pattern for ignoring included files.')
+    .option('-l, --lint', 'Lint the input file and report any errors.')
+    .option('-r, --relaxed', 'Use relaxed JSON format.')
+    .option('-p, --public', 'Only values in #public objects will be extracted.')
+    .option('-o, --extract-option <option>', 'Extract the value of an option.')
+    .option('-j, --option-as-json', 'The extracted value will be extracted as JSON.')
+    .option('-m, --allow-missing-option', 'Do not fail when no such value is present.')
+    .option('--json', 'JSON output.')
+    .option('--allowmissing', 'Allow missing options.')
+    .parse();
+
+const argv = program.opts();
+argv._ = program.args;
+
+// This is needed as optimist will not force exit when --help is
+// passed on it's own, and we want it to.
+if (argv.help || argv._.length < 1) {
+    program.outputHelp();
+    process.exit(0);
 }
 
-try {
-    var args = argv._.splice(1),
-        config = oconf.load(argv._[0], {ignore: argv.ignore}),
-        // Normalize oconf ... foo.bar quux => ['foo', 'bar', 'quux']
-        pathToValue = _.flatten(args.map(function (item) {
-            return item.split('.');
-        }));
-
-    if (pathToValue.length > 0) {
-        console.warn(
-            'Usage of oconf to print configuration values like below, is deprecated.',
-            'For example: "oconf file.cjson path.to.value".',
-            'In version 3.0.0 it will be removed. You can use oconf-extract-option instead.\n'
-        );
+//////////////////////////////////////////////////////////////////
+// This is here for backwards compatibility. Used to be an okay
+// flag. We can add a deprecation warning later.
+if (argv['json']) {
+    argv['optionAsJson'] = true;
+}
+if (argv['allowmissing']) {
+    argv['allowMissingOption'] = true;
+}
+//////////////////////////////////////////////////////////////////
+
+if (!argv['extractOption'] && (argv['optionAsJson'] || argv['allowMissingOption'])) {
+    if (argv['optionAsJson']) {
+        console.error('The flag --option-as-json does not make sense without the --extract-option flag.');
+    } else if (argv['allowMissingOption']) {
+        console.error('The flag --allow-missing-option does not make sense without the --extract-option flag.');
     }
+    
+    console.error('');
+    program.outputHelp();
+    process.exit(1);
+}
 
 
-    pathToValue.forEach(function (arg) {
-        if (!config || typeof config !== 'object' || !(arg in config)) {
-            if (argv.allowmissing) {
-                process.exit(0);
-            } else {
-                throw new Error('No such value: ' + pathToValue.join('.'));
-            }
-        }
-        config = config[arg];
-    });
-
-    if (!argv.lint) {
-        if (argv.bare) {
-            if (Array.isArray(config)) {
-                util.puts(config.join(' '));
-            } else if (typeof config === 'object' && config) {
-                util.puts(JSON.stringify(config));
-        } else {
-                util.puts(config);
-            }
-        } else {
-            util.puts(JSON.stringify(config, false, 4));
+function _getKey(keyname, testObj) {
+    if (typeof keyname === 'string') {
+        keyname = keyname.split(".");
+    }
+
+    // An non-existing key doesn't exist!
+    if (keyname.length === 0) {
+        return {error: 'Not found'};
+    }
+
+    const key = keyname.shift();
+
+    // Is it an object -- and does it have the key
+    if (testObj !== new Object(testObj) || !(key in testObj)) {
+        if (argv['allowMissingOption']) {
+            process.exit(0);
         }
+        throw new Error('Key ' + key + ' not found in ' + JSON.stringify(testObj));
+    }
+
+    // Try more!
+    if (keyname.length >= 1) {
+        return _getKey(keyname, testObj[key]);
     }
+
+    // We're at the end.
+    return testObj[key];
+}
+
+let config;
+
+try {
+    config = oconf.load(argv._, { ignore: argv.ignore, public: argv.public, relaxed: argv.relaxed });
 } catch (error) {
     console.error("Error:", error.message);
     process.exit(1);
 }
+
+if (argv.lint) {
+    console.warn('No linting errors found.');
+    process.exit(0);
+}
+
+if (argv['extractOption']) {
+    try {
+        let data = config;
+
+        data = _getKey(argv['extractOption'], data);
+
+        if (!argv['optionAsJson'] && Array.isArray(data)) {
+            data = data.join(' ');
+        } else if (argv['optionAsJson'] || (typeof data !== 'string' && typeof data !== 'number')) {
+            data = JSON.stringify(data, false, 4);
+        }
+
+        console.log(data);
+    } catch (error) {
+        if (!argv['allowMissingOption']) {
+            console.error("Error:", error.message);
+            process.exit(1);
+        }
+    }
+} else {
+    console.log(JSON.stringify(config, false, 4));
+}
diff --git a/bin/oconf-extract-option b/bin/oconf-extract-option
index 12537a3..6c7c5a3 100755
--- a/bin/oconf-extract-option
+++ b/bin/oconf-extract-option
@@ -1,69 +1,26 @@
-#!/usr/bin/env node
-// ex: filetype=javascript
-
-var oconf = require('../lib/index'),
-    util = require('util'),
-    optimist = require('optimist');
-
-var argp = optimist
-            .options('j', {
-                alias: 'json',
-                default: false,
-                description: 'Force JSON output'
-            })
-            .options('h', {
-                alias: 'help',
-                default: false,
-            })
-            .boolean(['j', 'h'])
-            .demand(1)
-            .usage('Usage: $0 <filename.cjson> <dotted.option.path>');
-var argv = argp.argv;
-
-if (argv.h) {
-    argp.showHelp();
-    process.exit();
-}
-
-function _getKey(keyname, testObj) {
-    if (typeof keyname === 'string') {
-        keyname = keyname.split(".");
-    }
-
-    // An non-existing key doesn't exist!
-    if (keyname.length === 0) {
-        return {error: 'Not found'};
-    }
-
-    var key = keyname.shift();
-
-    // Is it an object -- and does it have the key
-    if (testObj !== new Object(testObj) || !(key in testObj)) {
-        throw new Error('Key ' + key + ' not found in ' + JSON.stringify(testObj));
-    }
-
-    // Try more!
-    if (keyname.length >= 1) {
-        return _getKey(keyname, testObj[key]);
-    }
-
-    // We're at the end.
-    return testObj[key];
-}
-
-try {
-    var data = oconf.load(argv._[0], 99, false);
-
-    // Refine if we got a query
-    if (argv._.length >= 2) {
-        data = _getKey(argv._[1], data);
-    }
-
-    if (argv.json || (typeof data !== 'string' && typeof data !== 'number')) {
-        data = JSON.stringify(data, 4, false);
-    }
-
-    util.puts(data);
-} catch (error) {
-    console.error("Error:", error.message);
-}
+#!/bin/bash
+# oneline dir: http://stackoverflow.com/a/246128
+DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )
+
+JSON=
+MISS=
+FILE=
+PROP=
+
+for n in 1 2 3 4 ; do
+    if [ "${!n}" == "--json" ] ; then
+        JSON=--option-as-json
+    elif [ "${!n}" == "--allowmissing" ] ; then
+        MISS=--allow-missing-option
+    else
+        if [ "${!n}" != "" ] ; then
+            if [ "$FILE" == "" ] ; then
+                FILE=${!n}
+            elif [ "$PROP" == "" ] ; then
+                PROP=${!n}
+            fi
+        fi
+    fi
+done
+
+$DIR/oconf $FILE --extract-option $PROP $JSON $MISS
diff --git a/bin/oconf-lint b/bin/oconf-lint
new file mode 100755
index 0000000..5328f03
--- /dev/null
+++ b/bin/oconf-lint
@@ -0,0 +1,4 @@
+#!/bin/bash
+# oneline dir: http://stackoverflow.com/a/246128
+DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )
+$DIR/oconf --lint $@
\ No newline at end of file
diff --git a/lib/index.d.ts b/lib/index.d.ts
new file mode 100644
index 0000000..a15a19b
--- /dev/null
+++ b/lib/index.d.ts
@@ -0,0 +1,30 @@
+declare module "oconf" {
+    interface OconfOptions {
+        /**
+         * Current working directory.
+         */
+        cwd?: string;
+
+        /**
+         * Use relaxed JSON format.
+         */
+        relaxed?: boolean;
+
+        /**
+         * Absolute path or glob pattern for ignoring included files.
+         */
+        ignore?: string | string[];
+
+        /**
+         * Only values in #public objects will be extracted.
+         */
+        public?: boolean;
+    }
+
+    interface Oconf {
+        load(rootFileName: string | string[], options?: OconfOptions): any;
+    }
+
+    const oconf: Oconf;
+    export = oconf;
+}
diff --git a/lib/index.js b/lib/index.js
index 785345d..8715ce9 100644
--- a/lib/index.js
+++ b/lib/index.js
@@ -3,13 +3,17 @@
  */
 
 var Path = require('path'),
+    fs = require('fs'),
     minimatch = require('minimatch'),
     _ = require('underscore'),
+    rjson = require('relaxed-json'),
     cjson = require('cjson');
 
 module.exports.load = function load(rootFileName, options) {
     options = options || {};
 
+    var relaxed = options.relaxed || false;
+
     var cwd = options.cwd || process.cwd();
     var isIgnored = (typeof options.ignore !== 'undefined' ? _.flatten([options.ignore]) : []).map(function (ignoreString) {
         return function (string) {
@@ -19,23 +23,107 @@ module.exports.load = function load(rootFileName, options) {
         return function (string) { return currentValue(string) || previousValue(string); };
     }, function () { return false; });
 
-    var loadedAbsoluteFileNames = []; // Do some housekeeping to avoid cycles
+    var stack = []; // Do some housekeeping to avoid cycles
+
+    if (Array.isArray(rootFileName)) {
+        var config = {};
+        rootFileName.forEach(function (configFileName) {
+            config = cjson.extend(true, config, load(configFileName, options));
+        });
+
+        return config;
+    }
+
+    // Have to always keep public keys separate within resolvePublic
+    // If a private key is overwritten by a public key, it's an error, and vice-versa. Name your config keys something else!
+    // Empty object leaves and non-public keys are filtered out when requesting with public:true
+
+    function resolvePublic(obj, isToplevel, publicOnly) {
+        if (typeof obj === 'object' && obj !== null) {
+            var publicObj = Array.isArray(obj) ? [] : {};
+
+            var hashPublicSuffixedKeys = [];
+            Object.keys(obj).forEach(function (key) {
+                if (/.+#public$/.test(key)) {
+                    hashPublicSuffixedKeys.push(key);
+                } else if (key !== '#public') {
+                    // Have to extract public and non-public keys separately, otherwise we lose information
+                    var resolvedPublic = resolvePublic(obj[key], false, true);
+                    if (typeof resolvedPublic === 'object' && resolvedPublic !== null && Object.keys(resolvedPublic).length > 0) {
+                        publicObj[key] = resolvedPublic;
+                    }
+
+                    obj[key] = resolvePublic(obj[key], false, false);
+                }
+            });
+            if (hashPublicSuffixedKeys.length > 0) {
+                obj['#public'] = obj['#public'] || {};
+                hashPublicSuffixedKeys.forEach(function (hashPublicSuffixedKey) {
+                    var keyWithoutSuffix = hashPublicSuffixedKey.replace(/#public$/, '');
+                    if (keyWithoutSuffix in obj['#public']) {
+                        throw new Error(hashPublicSuffixedKey + ' clashes with ' + keyWithoutSuffix + ' inside #public block');
+                    }
+                    obj['#public'][keyWithoutSuffix] = obj[hashPublicSuffixedKey];
+                    delete obj[hashPublicSuffixedKey];
+                });
+            }
+
+            if (typeof obj['#public'] !== 'undefined') {
+                if (!(typeof obj['#public'] === 'object' && obj['#public'] !== null && !Array.isArray(obj['#public']))) {
+                    throw new Error('#public must always be an object');
+                }
+
+                Object.keys(obj['#public']).forEach(function (key) {
+                    if (key in obj) {
+                        throw new Error('Unsupported combination of public and non-public properties for key "' + key + '", check your tree structure: ' + JSON.stringify(obj));
+                    }
 
-    return (function readFileAndResolveIncludes(fileName) {
+                    if (obj['#public'][key] !== 'undefined') {
+                        publicObj[key] = obj['#public'][key];
+                    }
+                });
+
+                delete obj['#public'];
+            }
+
+            if (isToplevel && typeof publicObj === 'object' && publicObj !== null && Object.keys(publicObj).length > 0) {
+                obj['#public'] = publicObj;
+            }
+
+            if (publicOnly) {
+                return publicObj;
+            } else {
+                return cjson.extend(true, obj, publicObj);
+            }
+        }
+
+        return obj;
+    }
+
+    return resolvePublic((function readFileAndResolveIncludes(fileName) {
         var absoluteFileName = Path.resolve(cwd, fileName);
 
-        if (loadedAbsoluteFileNames.indexOf(absoluteFileName) !== -1) {
-            throw new Error("Loop in loaded files: \n\t→ " + loadedAbsoluteFileNames.join("\n\t→ "));
+        if (stack.indexOf(absoluteFileName) !== -1) {
+            throw new Error('Loop in loaded files: \n\t→ ' + stack.join('\n\t→ '));
         }
 
-        loadedAbsoluteFileNames.push(absoluteFileName);
+        stack.push(absoluteFileName);
+
+        var loadedData = null;
+        if (relaxed) {
+            loadedData = rjson.parse(fs.readFileSync(absoluteFileName, 'utf8'));
+        } else {
+            loadedData = cjson.load(absoluteFileName);
+        }
 
         return (function resolveIncludes(obj) {
             if (Array.isArray(obj)) {
+                // An array that should be resolved into an array
                 return obj.map(resolveIncludes);
             } else if (typeof obj === 'object' && obj !== null) {
                 if (typeof obj['#include'] !== 'undefined') {
                     _.flatten([obj['#include']]).reverse().forEach(function (fileNameToInclude) {
+                        // Have to resolve from location of current file, not from cwd
                         var absoluteFileNameToInclude = Path.resolve(Path.dirname(fileName), fileNameToInclude);
                         if (!isIgnored(absoluteFileNameToInclude)) {
                             obj = cjson.extend(true, readFileAndResolveIncludes(absoluteFileNameToInclude), obj);
@@ -47,7 +135,9 @@ module.exports.load = function load(rootFileName, options) {
                     obj[key] = resolveIncludes(obj[key]);
                 });
             }
+            stack.pop();
             return obj;
-        }(cjson.load(absoluteFileName)));
-    }(rootFileName));
+
+        }(loadedData));
+    }(rootFileName)), true, options.public);
 };
diff --git a/lib/lint.js b/lib/lint.js
new file mode 100644
index 0000000..1505bdb
--- /dev/null
+++ b/lib/lint.js
@@ -0,0 +1,34 @@
+var fs = require('fs');
+var cjson = require('cjson');
+var passError = require('passerror');
+var glob = require('glob');
+var async = require('async');
+var Path = require('path');
+
+function lintFile(path, cb) {
+    fs.readFile(path, 'utf-8', passError(cb, function (data) {
+        try {
+            cjson.parse(data);
+        } catch (e) {
+            e.file = path;
+            return cb(e);
+        }
+        cb();
+    }));
+}
+
+
+module.exports = function oconfLint(path, callback) {
+    fs.stat(path, passError(callback, function (stat) {
+        if (stat.isDirectory()) {
+            glob('**/*.cjson', { cwd: path }, passError(callback, function (files) {
+                var resolvedFiles = files.map(function (partialPath) {
+                    return Path.resolve(path, partialPath);
+                });
+                async.eachSeries(resolvedFiles, lintFile, callback);
+            }));
+        } else {
+            return lintFile(path, callback);
+        }
+    }));
+};
diff --git a/package.json b/package.json
index c4eef17..e6afd06 100644
--- a/package.json
+++ b/package.json
@@ -2,13 +2,18 @@
   "author": "Morten Siebuhr <sbhr@sbhr.dk>",
   "name": "oconf",
   "description": "Configuration",
-  "version": "2.2.0",
+  "version": "5.7.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/One-com/node-oconf.git"
   },
+  "contributors": [
+    "Andreas Lind <andreas@one.com>",
+    "Gustav Nikolaj Olsen <gno@one.com>"
+  ],
   "homepage": "https://github.com/One-com/node-oconf",
   "main": "lib/index.js",
+  "types": "lib/index.d.ts",
   "keywords": [
     "cjson",
     "config",
@@ -19,26 +24,30 @@
   ],
   "bin": {
     "oconf": "bin/oconf",
+    "oconf-lint": "bin/oconf-lint",
     "oconf-extract-option": "bin/oconf-extract-option"
   },
   "scripts": {
-    "coverage": "NODE_ENV=development istanbul cover --include-all-sources _mocha -- --reporter dot",
-    "lint": "jshint . && jscs .",
-    "test": "mocha",
+    "coverage": "NODE_ENV=development nyc npm test --reporter=dot",
+    "lint": "eslint .",
+    "test": "mocha test",
     "travis": "npm run lint && npm run test && npm run coverage"
   },
   "dependencies": {
-    "cjson": "0.3.0",
-    "minimatch": "2.0.1",
-    "optimist": "0.6.1",
-    "underscore": "*"
+    "async": "0.9.0",
+    "cjson": "^0.5.0",
+    "commander": "^12.1.0",
+    "glob": "^7.1.3",
+    "minimatch": "^3.0.4",
+    "passerror": "1.1.0",
+    "relaxed-json": "1.0.3",
+    "underscore": "^1.13.6"
   },
   "devDependencies": {
-    "coveralls": "2.11.2",
-    "istanbul": "0.3.5",
-    "jscs": "1.10.0",
-    "jshint": "2.5.11",
-    "mocha": "*",
-    "unexpected": "5.5.2"
+    "coveralls": "^3.0.3",
+    "eslint": "^5.16.0",
+    "mocha": "^10.2.0",
+    "nyc": "^14.0.0",
+    "unexpected": "10.15.0"
   }
 }
diff --git a/test/bin/oconf-extract-option.spec.js b/test/bin/oconf-extract-option.spec.js
new file mode 100644
index 0000000..3e20f04
--- /dev/null
+++ b/test/bin/oconf-extract-option.spec.js
@@ -0,0 +1,54 @@
+/* global describe, it */
+var exec = require('child_process').exec;
+var expect = require('unexpected');
+
+var pathToBin = require('path').resolve(__dirname, '../../bin/', 'oconf-extract-option');
+
+describe('bin/oconf-extract-option', function () {
+    it('should return the option value', function (done) {
+        var testFile = require('path').resolve(__dirname, '..', 'files', 'base.cjson');
+        exec(pathToBin + ' ' + testFile + ' foo', function (err, stdout, stderr) {
+            expect(err, 'to be null');
+            expect(stdout, 'to equal', 'overwrite this\n');
+            expect(stderr, 'to equal', '');
+            done();
+        });
+    });
+    it('should return the option value as json when passed --json', function (done) {
+        var testFile = require('path').resolve(__dirname, '..', 'files', 'base.cjson');
+        exec(pathToBin + ' --json ' + testFile + ' foo', function (err, stdout, stderr) {
+            expect(err, 'to be null');
+            expect(stdout, 'to equal', '"overwrite this"\n');
+            expect(stderr, 'to equal', '');
+            done();
+        });
+    });
+    it('should fail when no such option exists', function (done) {
+        var testFile = require('path').resolve(__dirname, '..', 'files', 'base.cjson');
+        exec(pathToBin + ' ' + testFile + ' bar', function (err, stdout, stderr) {
+            expect(err, 'to be an', Error);
+            expect(err, 'to have property', 'code', 1);
+            expect(stdout, 'to equal', '');
+            expect(stderr, 'to match', /Key bar not found/);
+            done();
+        });
+    });
+    it('should not fail when no such option exists when --allowmissing passed', function (done) {
+        var testFile = require('path').resolve(__dirname, '..', 'files', 'base.cjson');
+        exec(pathToBin + ' --allowmissing ' + testFile + ' bar', function (err, stdout, stderr) {
+            expect(err, 'to be null');
+            expect(stdout, 'to equal', '');
+            expect(stderr, 'to equal', '');
+            done();
+        });
+    });
+    it('should support dotting out properties (foo.bar)', function (done) {
+        var testFile = require('path').resolve(__dirname, '..', 'files', 'deep.cjson');
+        exec(pathToBin + ' ' + testFile + ' foo.bar', function (err, stdout, stderr) {
+            expect(err, 'to be null');
+            expect(stdout, 'to equal', 'qux\n');
+            expect(stderr, 'to equal', '');
+            done();
+        });
+    });
+});
diff --git a/test/bin/oconf-lint.spec.js b/test/bin/oconf-lint.spec.js
new file mode 100644
index 0000000..2561e82
--- /dev/null
+++ b/test/bin/oconf-lint.spec.js
@@ -0,0 +1,66 @@
+/* global describe, it */
+var exec = require('child_process').exec;
+var expect = require('unexpected');
+
+var pathToBin = require('path').resolve(__dirname, '../../bin/', 'oconf-lint');
+
+expect.addAssertion('when oconf-linted', function (expect, subject) {
+    this.errorMode = 'nested';
+    var that = this;
+    return expect.promise(function (resolve, reject) {
+        var args;
+        if (typeof subject === 'string') {
+            args = subject;
+        } else {
+            if (Array.isArray(subject)) {
+                args = subject.join(' ');
+            } else {
+                return reject(new Error('arguments must be supplied as string or array'));
+            }
+        }
+
+        exec(pathToBin + ' ' + args, function (err, stdout, stderr) {
+            resolve({
+                err: err,
+                code: err && err.code || 0,
+                stdout: stdout,
+                stderr: stderr
+            });
+        });
+    }).then(function (value) {
+        return that.shift(value, 0);
+    });
+});
+
+function testFile(fileName) {
+    if (!(/\.cjson$/.test(fileName))) {
+        fileName += '.cjson';
+    }
+    return require('path').resolve(__dirname, '..', 'files', fileName);
+}
+
+describe('bin/oconf-lint', function () {
+    it('should exit with no errors if valid', function () {
+        return expect(testFile('lint/valid'), 'when oconf-linted', 'to satisfy', {
+            err: null,
+            code: 0,
+            stdout: '',
+            stderr: 'No linting errors found.\n'
+        });
+    });
+    it('should report the errors if invalid', function () {
+        var filePath = testFile('lint/invalid');
+        return expect(filePath, 'when oconf-linted', 'to satisfy', {
+            err: expect.it('to be an', Error),
+            code: 1,
+            stdout: '',
+            stderr: [
+                'Error: Unexpected token \'}\' at 2:17',
+                '    "foo": "bar',
+                '               ^',
+                'File: "' + filePath + '"',
+                ''
+            ].join('\n')
+        });
+    });
+});
diff --git a/test/bin/oconf.spec.js b/test/bin/oconf.spec.js
new file mode 100644
index 0000000..d9b944c
--- /dev/null
+++ b/test/bin/oconf.spec.js
@@ -0,0 +1,326 @@
+/* global describe, it */
+var exec = require('child_process').exec;
+var expect = require('unexpected');
+
+var pathToBin = require('path').resolve(__dirname, '../../bin/', 'oconf');
+
+function formattedJson(obj) {
+    return JSON.stringify(obj, null, 4) + '\n';
+}
+
+function testFile(fileName) {
+    if (!(/\.cjson$/.test(fileName)) && !(/\.rjson$/.test(fileName))) {
+        fileName += '.cjson';
+    }
+    return require('path').resolve(__dirname, '..', 'files', fileName);
+}
+
+expect.addAssertion('when passed as arguments to oconf', function (expect, subject) {
+    this.errorMode = 'nested';
+    var that = this;
+    return expect.promise(function (resolve, reject) {
+        var args;
+        if (typeof subject === 'string') {
+            args = subject;
+        } else {
+            if (Array.isArray(subject)) {
+                args = subject.join(' ');
+            } else {
+                return reject(new Error('arguments must be supplied as string or array'));
+            }
+        }
+
+        exec(pathToBin + ' ' + args, function (err, stdout, stderr) {
+            resolve({
+                err: err,
+                code: err && err.code || 0,
+                stdout: stdout,
+                stderr: stderr
+            });
+        });
+    }).then(function (value) {
+        return that.shift(value, 0);
+    });
+});
+
+describe('bin/oconf', function () {
+    describe('basic functionality', function () {
+        it('should print the resolved json structure to stdout', function () {
+            return expect(testFile('base'), 'when passed as arguments to oconf', 'to satisfy', {
+                err: null,
+                stdout: formattedJson({
+                    foo: 'overwrite this',
+                    what: 'this is from default.cjson.'
+                }),
+                stderr: ''
+            });
+        });
+        it('should support including multiple files, and print the resolved json structure to stdout', function () {
+            return expect([testFile('extend-base'), testFile('deep')], 'when passed as arguments to oconf', 'to satisfy', {
+                err: null,
+                stdout: formattedJson({
+                    foo: {
+                        bar: 'qux'
+                    },
+                    what: 'this is from default.cjson.'
+                }),
+                stderr: ''
+            });
+        });
+        describe('--relaxed flag', function () {
+            it('should support including multiple files (including relaxed json format), and print the resolved json structure to stdout', function () {
+                return expect([
+                    '--relaxed',
+                    testFile('extend-base.rjson'),
+                    testFile('deep')
+                ], 'when passed as arguments to oconf', 'to satisfy', {
+                    err: null,
+                    stdout: formattedJson({
+                        foo: {
+                            bar: 'qux'
+                        },
+                        what: 'this is from default.cjson.'
+                    }),
+                    stderr: ''
+                });
+            });
+        });
+        it('should fail when asked for nonexistant file', function () {
+            return expect(testFile('nonExistent'), 'when passed as arguments to oconf', 'to satisfy', {
+                err: expect.it('to be an', Error),
+                stderr: expect.it('to match', /ENOENT/)
+            });
+        });
+        it('should fail when resolved file includes non existing file', function () {
+            return expect(testFile('includeNonExistentFile'), 'when passed as arguments to oconf', 'to satisfy', {
+                err: expect.it('to be an', Error),
+                stderr: expect.it('to match', /ENOENT/)
+                    .and('to match', /nonExistentFile.cjson/)
+            });
+        });
+        it('should not fail when resolved file includes non existing file when passed --ignore', function () {
+            return expect([
+                testFile('includeNonExistentFile'),
+                '--ignore',
+                testFile('nonExistentFile.cjson')
+
+            ], 'when passed as arguments to oconf', 'to satisfy', {
+                err: null,
+                stdout: formattedJson({
+                    foo: 123
+                })
+            });
+        });
+    });
+    describe('--help', function () {
+        it('should exit with no errors and show the help', function () {
+            return expect('--help', 'when passed as arguments to oconf', 'to satisfy', {
+                err: null,
+                code: 0,
+                stdout: expect.it('to match', /Options/),
+                stderr: ''
+            });
+        });
+    });
+    describe('--lint', function () {
+        it('should exit with no errors if valid', function () {
+            return expect([
+                testFile('lint/valid.cjson'),
+                '--lint'
+            ], 'when passed as arguments to oconf', 'to satisfy', {
+                err: null,
+                stdout: '',
+                stderr: 'No linting errors found.\n'
+            });
+        });
+        it('should report the errors if invalid', function () {
+            var filePath = testFile('lint/invalid.cjson');
+            return expect([
+                filePath,
+                '--lint'
+            ], 'when passed as arguments to oconf', 'to satisfy', {
+                err: expect.it('to be an', Error),
+                stdout: '',
+                stderr: [
+                    'Error: Unexpected token \'}\' at 2:17',
+                    '    "foo": "bar',
+                    '               ^',
+                    'File: "' + filePath + '"',
+                    ''
+                ].join('\n')
+            });
+        });
+    });
+    describe('--extract-option', function () {
+        it('should return the option value', function () {
+            return expect([
+                testFile('base'),
+                '--extract-option',
+                'foo'
+            ], 'when passed as arguments to oconf', 'to satisfy', {
+                err: null,
+                stdout: 'overwrite this\n',
+                stderr: ''
+            });
+        });
+        it('should return the option value when the value is a list', function () {
+            return expect([
+                testFile('list'),
+                '--extract-option',
+                'list'
+            ], 'when passed as arguments to oconf', 'to satisfy', {
+                err: null,
+                stdout: 'foo bar\n',
+                stderr: ''
+            });
+        });
+        it('should return the option value as json when passed --option-as-json', function () {
+            return expect([
+                testFile('base'),
+                '--extract-option',
+                'foo',
+                '--option-as-json'
+            ], 'when passed as arguments to oconf', 'to satisfy', {
+                err: null,
+                stdout: formattedJson('overwrite this'),
+                stderr: ''
+            });
+        });
+        it('should fail when no such option exists', function () {
+            return expect([
+                testFile('base'),
+                '--extract-option',
+                'bar'
+            ], 'when passed as arguments to oconf', 'to satisfy', {
+                err: expect.it('to be an', Error),
+                code: 1,
+                stdout: '',
+                stderr: expect.it('to match', /Key bar not found/)
+            });
+        });
+        it('should not fail when no such option exists when --allow-missing-option passed', function () {
+            return expect([
+                testFile('base'),
+                '--extract-option',
+                'bar',
+                '--allow-missing-option'
+            ], 'when passed as arguments to oconf', 'to satisfy', {
+                err: null,
+                code: 0,
+                stdout: '',
+                stderr: ''
+            });
+        });
+        it('should support dotting out properties (foo.bar)', function () {
+            return expect([
+                testFile('deep'),
+                '--extract-option',
+                'foo.bar'
+            ], 'when passed as arguments to oconf', 'to satisfy', {
+                err: null,
+                stdout: 'qux\n',
+                stderr: ''
+            });
+        });
+    });
+    describe('--ignore flag', function () {
+        it('should work with no other options', function () {
+            return expect([
+                testFile('includeNonExistentFile'),
+                '--ignore',
+                testFile('nonExistentFile.cjson')
+
+            ], 'when passed as arguments to oconf', 'to satisfy', {
+                err: null,
+                code: 0,
+                stdout: formattedJson({
+                    foo: 123
+                })
+            });
+        });
+        it('should work with --extract-option', function () {
+            return expect([
+                testFile('includeNonExistentFile'),
+                '--ignore',
+                testFile('nonExistentFile.cjson'),
+                '--extract-option foo'
+
+            ], 'when passed as arguments to oconf', 'to satisfy', {
+                err: null,
+                code: 0,
+                stdout: formattedJson(123)
+            });
+        });
+        it('should work with --lint', function () {
+            return expect([
+                testFile('includeNonExistentFile'),
+                '--ignore',
+                testFile('nonExistentFile.cjson'),
+                '--lint'
+            ], 'when passed as arguments to oconf', 'to satisfy', {
+                err: null,
+                code: 0,
+                stdout: '',
+                stderr: 'No linting errors found.\n'
+            });
+        });
+    });
+    describe('should complain about nonsensical flag combinations', function () {
+        it('should not allow --allow-option-missing with --lint', function () {
+            return expect([
+                'foo.cjson',
+                '--lint',
+                '--allow-missing-option'
+            ], 'when passed as arguments to oconf', 'to satisfy', {
+                code: 1,
+                stderr: /^The flag --allow-missing-option does not make sense/
+            });
+        });
+        it('should not allow --option-as-json with --lint', function () {
+            return expect([
+                'foo.cjson',
+                '--lint',
+                '--option-as-json'
+            ], 'when passed as arguments to oconf', 'to satisfy', {
+                code: 1,
+                stderr: /^The flag --option-as-json does not make sense/
+            });
+        });
+        it('should not allow --option-as-json with no other flags', function () {
+            return expect([
+                'foo.cjson',
+                '--option-as-json'
+            ], 'when passed as arguments to oconf', 'to satisfy', {
+                code: 1,
+                stderr: /^The flag --option-as-json does not make sense/
+            });
+        });
+    });
+    describe('backwards compatibility for removed options', function () {
+        it('should return the option value as json when passed --json instead of --option-as-json', function () {
+            return expect([
+                testFile('base'),
+                '--extract-option',
+                'foo',
+                '--json'
+            ], 'when passed as arguments to oconf', 'to satisfy', {
+                err: null,
+                stdout: formattedJson('overwrite this'),
+                stderr: ''
+            });
+        });
+        it('should not fail when no such option exists when passing --allowmissing instead of --allow-missing-option', function () {
+            return expect([
+                testFile('base'),
+                '--extract-option',
+                'bar',
+                '--allowmissing'
+            ], 'when passed as arguments to oconf', 'to satisfy', {
+                err: null,
+                code: 0,
+                stdout: '',
+                stderr: ''
+            });
+        });
+    });
+});
diff --git a/test/files/array-with-object-with-array-with-object-with-public.cjson b/test/files/array-with-object-with-array-with-object-with-public.cjson
new file mode 100644
index 0000000..8fdcf9e
--- /dev/null
+++ b/test/files/array-with-object-with-array-with-object-with-public.cjson
@@ -0,0 +1,11 @@
+[
+    {
+        "foo": [
+            {
+                "#public": {
+                    "bar": "quux"
+                }
+            }
+        ]
+    }
+]
diff --git a/test/files/array-with-object-with-public.cjson b/test/files/array-with-object-with-public.cjson
new file mode 100644
index 0000000..9016dfe
--- /dev/null
+++ b/test/files/array-with-object-with-public.cjson
@@ -0,0 +1,9 @@
+{
+    "foo": [
+        {
+            "#public": {
+                "bar": "quux"
+            }
+        }
+    ]
+}
diff --git a/test/files/deep.cjson b/test/files/deep.cjson
new file mode 100644
index 0000000..586f3e5
--- /dev/null
+++ b/test/files/deep.cjson
@@ -0,0 +1,5 @@
+{
+    "foo": {
+        "bar": "qux"
+    }
+}
diff --git a/test/files/extend-base.rjson b/test/files/extend-base.rjson
new file mode 100644
index 0000000..247c378
--- /dev/null
+++ b/test/files/extend-base.rjson
@@ -0,0 +1,7 @@
+/*
+ * Example rjson file.
+ */
+{
+	foo: "bar",
+	"#include": "./base.cjson"
+}
diff --git a/test/files/extend-wrap.cjson b/test/files/extend-wrap.cjson
new file mode 100644
index 0000000..a34d46b
--- /dev/null
+++ b/test/files/extend-wrap.cjson
@@ -0,0 +1,3 @@
+{
+    "#include": [ "extend-base.cjson", "deep.cjson"]
+}
\ No newline at end of file
diff --git a/test/files/lint/invalid.cjson b/test/files/lint/invalid.cjson
new file mode 100644
index 0000000..c1ec2f7
--- /dev/null
+++ b/test/files/lint/invalid.cjson
@@ -0,0 +1,3 @@
+{
+    "foo": "bar
+}
diff --git a/test/files/lint/invalidDirectory/1.cjson b/test/files/lint/invalidDirectory/1.cjson
new file mode 100644
index 0000000..c8c4105
--- /dev/null
+++ b/test/files/lint/invalidDirectory/1.cjson
@@ -0,0 +1,3 @@
+{
+  "foo": "bar"
+}
diff --git a/test/files/lint/invalidDirectory/2.cjson b/test/files/lint/invalidDirectory/2.cjson
new file mode 100644
index 0000000..c1ec2f7
--- /dev/null
+++ b/test/files/lint/invalidDirectory/2.cjson
@@ -0,0 +1,3 @@
+{
+    "foo": "bar
+}
diff --git a/test/files/lint/valid.cjson b/test/files/lint/valid.cjson
new file mode 100644
index 0000000..c8c4105
--- /dev/null
+++ b/test/files/lint/valid.cjson
@@ -0,0 +1,3 @@
+{
+  "foo": "bar"
+}
diff --git a/test/files/lint/validDirectory/1.cjson b/test/files/lint/validDirectory/1.cjson
new file mode 100644
index 0000000..c8c4105
--- /dev/null
+++ b/test/files/lint/validDirectory/1.cjson
@@ -0,0 +1,3 @@
+{
+  "foo": "bar"
+}
diff --git a/test/files/lint/validDirectory/2.cjson b/test/files/lint/validDirectory/2.cjson
new file mode 100644
index 0000000..c8c4105
--- /dev/null
+++ b/test/files/lint/validDirectory/2.cjson
@@ -0,0 +1,3 @@
+{
+  "foo": "bar"
+}
diff --git a/test/files/list.cjson b/test/files/list.cjson
new file mode 100644
index 0000000..1ea144f
--- /dev/null
+++ b/test/files/list.cjson
@@ -0,0 +1,3 @@
+{
+    "list": ["foo", "bar"]
+}
diff --git a/test/files/public-array.cjson b/test/files/public-array.cjson
new file mode 100644
index 0000000..b155dd1
--- /dev/null
+++ b/test/files/public-array.cjson
@@ -0,0 +1,10 @@
+{
+    "foo": "do not expose to public",
+    "#public": [
+        {
+            "what": {
+                "quux": "what is public"
+            }
+        }
+    ]
+}
diff --git a/test/files/public-base.cjson b/test/files/public-base.cjson
new file mode 100644
index 0000000..0941cc7
--- /dev/null
+++ b/test/files/public-base.cjson
@@ -0,0 +1,6 @@
+{
+    "foo": "do not expose to public",
+    "#public": {
+        "what": "what is public"
+    }
+}
diff --git a/test/files/public-conflict.cjson b/test/files/public-conflict.cjson
new file mode 100644
index 0000000..1a12eb3
--- /dev/null
+++ b/test/files/public-conflict.cjson
@@ -0,0 +1,15 @@
+{
+    "some-setting": "default value",
+    "value": 100,
+    "fancy-list": {
+        "expose-foo": true,
+        "#public": {
+            "scroll-timeout": 100
+        }
+    },
+    "#public": {
+        "fancy-list": {
+            "scroll-timeout": 200
+        }
+    }
+}
diff --git a/test/files/public-deep-with-include.cjson b/test/files/public-deep-with-include.cjson
new file mode 100644
index 0000000..8c3ef4a
--- /dev/null
+++ b/test/files/public-deep-with-include.cjson
@@ -0,0 +1,13 @@
+{
+    "foo": "do not expose to public",
+    "bar": {
+        "quux": "super secret"
+    },
+    "hello": {
+        "earth": "mostly harmless",
+        "#public": {
+            "answer": "Insufficient data for meaningful answer"
+        },
+        "#include": "./public-included.cjson"
+    }
+}
diff --git a/test/files/public-deep-with-public-include.cjson b/test/files/public-deep-with-public-include.cjson
new file mode 100644
index 0000000..5455ce4
--- /dev/null
+++ b/test/files/public-deep-with-public-include.cjson
@@ -0,0 +1,13 @@
+{
+    "foo": "do not expose to public",
+    "bar": {
+        "quux": "super secret"
+    },
+    "hello": {
+        "earth": "mostly harmless",
+        "#public": {
+            "answer": "Insufficient data for meaningful answer"
+        },
+        "#include": "./public-included-public.cjson"
+    }
+}
diff --git a/test/files/public-deep.cjson b/test/files/public-deep.cjson
new file mode 100644
index 0000000..a16a910
--- /dev/null
+++ b/test/files/public-deep.cjson
@@ -0,0 +1,12 @@
+{
+    "foo": "do not expose to public",
+    "bar": {
+        "quux": "super secret"
+    },
+    "hello": {
+        "earth": "mostly harmless",
+        "#public": {
+            "answer": 42
+        }
+    }
+}
diff --git a/test/files/public-included-public.cjson b/test/files/public-included-public.cjson
new file mode 100644
index 0000000..b0fb57a
--- /dev/null
+++ b/test/files/public-included-public.cjson
@@ -0,0 +1,5 @@
+{
+    "#public": {
+        "answer": 42
+    }
+}
diff --git a/test/files/public-included.cjson b/test/files/public-included.cjson
new file mode 100644
index 0000000..7cbb9fa
--- /dev/null
+++ b/test/files/public-included.cjson
@@ -0,0 +1,3 @@
+{
+    "answer": 42
+}
diff --git a/test/files/public-left-right-wrap.cjson b/test/files/public-left-right-wrap.cjson
new file mode 100644
index 0000000..b9a9cc1
--- /dev/null
+++ b/test/files/public-left-right-wrap.cjson
@@ -0,0 +1,3 @@
+{
+    "#include": [ "public-left.cjson", "public-right.cjson"]
+}
diff --git a/test/files/public-left.cjson b/test/files/public-left.cjson
new file mode 100644
index 0000000..dd58037
--- /dev/null
+++ b/test/files/public-left.cjson
@@ -0,0 +1,8 @@
+{
+    "foo": {
+        "bar": "public-left.cjson"
+    },
+    "#public": {
+        "what": "this is from public-left.cjson."
+    }
+}
diff --git a/test/files/public-non-object.cjson b/test/files/public-non-object.cjson
new file mode 100644
index 0000000..a606014
--- /dev/null
+++ b/test/files/public-non-object.cjson
@@ -0,0 +1,4 @@
+{
+    "foo": "do not expose to public",
+    "#public": "not an object"
+}
diff --git a/test/files/public-right.cjson b/test/files/public-right.cjson
new file mode 100644
index 0000000..e5360b9
--- /dev/null
+++ b/test/files/public-right.cjson
@@ -0,0 +1,5 @@
+{
+    "#public": {
+        "what": "this is from public-right.cjson."
+    }
+}
diff --git a/test/fixtures/include-non-loopy.cjson b/test/fixtures/include-non-loopy.cjson
new file mode 100644
index 0000000..e7260dc
--- /dev/null
+++ b/test/fixtures/include-non-loopy.cjson
@@ -0,0 +1,8 @@
+{
+  "foo": {
+    "#include": "non-loopy.cjson"
+  },
+  "bar": {
+    "#include": "non-loopy.cjson"
+  }
+}
diff --git a/test/fixtures/invalid-public.cjson b/test/fixtures/invalid-public.cjson
new file mode 100644
index 0000000..afd756e
--- /dev/null
+++ b/test/fixtures/invalid-public.cjson
@@ -0,0 +1,8 @@
+{
+  "foo": {
+    "#public": {
+      "foo": 123
+    },
+    "foo#public": 456
+  }
+}
diff --git a/test/fixtures/non-loopy.cjson b/test/fixtures/non-loopy.cjson
new file mode 100644
index 0000000..fc185cd
--- /dev/null
+++ b/test/fixtures/non-loopy.cjson
@@ -0,0 +1,3 @@
+{
+  "abc": 123
+}
diff --git a/test/fixtures/public-block-include-public-key.cjson b/test/fixtures/public-block-include-public-key.cjson
new file mode 100644
index 0000000..6b79b4f
--- /dev/null
+++ b/test/fixtures/public-block-include-public-key.cjson
@@ -0,0 +1,8 @@
+{
+  "#include": "/testdata/included.cjson",
+  "foo": {
+    "#public": {
+      "abc": 123
+    }
+  }
+}
diff --git a/test/fixtures/public-block.cjson b/test/fixtures/public-block.cjson
new file mode 100644
index 0000000..e288264
--- /dev/null
+++ b/test/fixtures/public-block.cjson
@@ -0,0 +1,7 @@
+{
+  "foo": {
+    "#public": {
+      "abc": 456
+    }
+  }
+}
diff --git a/test/fixtures/public-key-include-public-block.cjson b/test/fixtures/public-key-include-public-block.cjson
new file mode 100644
index 0000000..fb41f47
--- /dev/null
+++ b/test/fixtures/public-key-include-public-block.cjson
@@ -0,0 +1,6 @@
+{
+  "#include": "public-block.cjson",
+  "foo": {
+      "abc#public": 123
+  }
+}
diff --git a/test/fixtures/public-key.cjson b/test/fixtures/public-key.cjson
new file mode 100644
index 0000000..37fb157
--- /dev/null
+++ b/test/fixtures/public-key.cjson
@@ -0,0 +1,5 @@
+{
+  "foo": {
+    "abc#public": 456
+  }
+}
diff --git a/test/fixtures/valid-public.cjson b/test/fixtures/valid-public.cjson
new file mode 100644
index 0000000..b372d24
--- /dev/null
+++ b/test/fixtures/valid-public.cjson
@@ -0,0 +1,6 @@
+{
+  "foo": {
+    "bar#public": 123,
+    "quux": 456
+  }
+}
diff --git a/test/lib/index.spec.js b/test/lib/index.spec.js
index 5b4bd26..9fa30b3 100644
--- a/test/lib/index.spec.js
+++ b/test/lib/index.spec.js
@@ -1,9 +1,10 @@
 /*global describe, it, before*/
-var expect = require('unexpected');
+var pathModule = require('path');
+var expect = require('unexpected').clone();
 var oconf = require('../../lib/index');
 
 function testFile(filename) {
-    return require('path').resolve(__dirname, '..', 'files', filename);
+    return pathModule.resolve(__dirname, '..', 'files', filename);
 }
 
 describe('Basic tests', function () {
@@ -22,6 +23,20 @@ describe('Basic tests', function () {
             expect(data, 'to only have keys', ['foo', 'what']);
         });
     });
+
+    describe('calling load method with an array of config file names', function () {
+        var data, dataInclude;
+        before(function () {
+            data = oconf.load([testFile('extend-base.cjson'), testFile('deep.cjson')]);
+            dataInclude = oconf.load(testFile('extend-wrap.cjson'));
+        });
+        it('functions like calling #include with an array of filenames in the same order', function () {
+            expect(data, 'to equal', dataInclude);
+        });
+    });
+});
+
+describe('#include behaviour', function () {
     describe('extend-base.cjson', function () {
         var data;
         before(function () {
@@ -91,19 +106,40 @@ describe('Basic tests', function () {
         it('Loading loop1.cjson throws error', function () {
             expect(function () {
                 oconf.load(testFile('loop1.cjson'));
-            }, 'to throw', /^Loop in loaded files: /);
+            }, 'to throw', /^Loop in loaded files/);
         });
         it('Loading loop2.cjson throws error', function () {
             expect(function () {
                 oconf.load(testFile('loop2.cjson'));
-            }, 'to throw', /^Loop in loaded files:/);
+            }, 'to throw', /^Loop in loaded files/);
         });
     });
+
+    it('should support the same file being included multiple times when there are no loops', function () {
+        expect(
+            oconf.load(
+                pathModule.resolve(
+                    __dirname,
+                    '../fixtures/include-non-loopy.cjson'
+                )
+            ),
+            'to equal',
+            {
+                foo: {
+                    abc: 123
+                },
+                bar: {
+                    abc: 123
+                }
+            }
+        );
+    });
+
     describe('includeNonExistentFile.cjson', function () {
         it('should throw an error when nonExistentFile.cjson is not ignored', function () {
             expect(function () {
                 oconf.load(testFile('includeNonExistentFile.cjson'));
-            }, 'to throw', /^ENOENT, no such file or directory/);
+            }, 'to throw', /^ENOENT/);
         });
         it('should not throw an error when nonExistentFile.cjson is ignored', function () {
             expect(function () {
@@ -135,7 +171,326 @@ describe('Basic tests', function () {
         it('should throw an error when ignoring by glob but including file not matched by glob', function () {
             expect(function () {
                 oconf.load(testFile('includeNonExistentFile.cjson'), { ignore: testFile('foo/*cjson') });
-            }, 'to throw', /^ENOENT, no such file or directory/);
+            }, 'to throw', /^ENOENT/);
+        });
+    });
+});
+
+describe('#public behaviour', function () {
+    describe('when loading with public:false (the default)', function () {
+        describe('where the root object contains a #public property', function () {
+            var data;
+            before(function () {
+                data = oconf.load(testFile('public-base.cjson'));
+            });
+            it('should fold the #public properties down into the base structure', function () {
+                expect(data, 'to equal', {
+                    foo: 'do not expose to public',
+                    what: 'what is public',
+                    '#public': {
+                        what: 'what is public'
+                    }
+                });
+            });
+        });
+
+        describe('where a child object contains some #public properties', function () {
+            var data;
+            before(function () {
+                data = oconf.load(testFile('public-deep.cjson'));
+            });
+            it('should fold the #public properties down into the base structure', function () {
+                expect(data, 'to equal', {
+                    foo: 'do not expose to public',
+                    bar: {
+                        quux: 'super secret'
+                    },
+                    hello: {
+                        earth: 'mostly harmless',
+                        answer: 42
+                    },
+                    '#public': {
+                        hello: {
+                            answer: 42
+                        }
+                    }
+                });
+            });
+        });
+
+        describe('where a child object in a child array contains some #public properties', function () {
+            var data;
+            before(function () {
+                data = oconf.load(testFile('array-with-object-with-public.cjson'));
+            });
+            it('should fold the #public properties down into the base structure', function () {
+                expect(data, 'to equal', {
+                    foo: [
+                        {
+                            bar: 'quux'
+                        }
+                    ],
+                    '#public': {
+                        foo: [
+                            {
+                                bar: 'quux'
+                            }
+                        ]
+                    }
+                });
+            });
+        });
+
+        describe('where a child object in a child array contains some #public properties', function () {
+            var data;
+            before(function () {
+                data = oconf.load(testFile('array-with-object-with-array-with-object-with-public.cjson'));
+            });
+            it('should fold the #public properties down into the base structure', function () {
+                expect(data, 'to exhaustively satisfy', {
+                    0: {
+                        foo: [
+                            {
+                                bar: 'quux'
+                            }
+                        ]
+                    },
+                    '#public': [{
+                        foo: [
+                            {
+                                bar: 'quux'
+                            }
+                        ]
+                    }]
+                }).and('to be an array');
+            });
+        });
+
+        describe('when trying to overwrite a public property with a property that was declared public at another level', function () {
+            it('should throw an error', function () {
+                expect(function () {
+                    oconf.load(testFile('public-conflict.cjson'));
+                }, 'to throw', /^Unsupported combination of public and non/);
+            });
+        });
+
+        describe('where trying to overwrite a non-public property with a #public one', function () {
+            it('should throw an error', function () {
+                expect(function () {
+                    oconf.load(testFile('public-deep-with-include.cjson'));
+                }, 'to throw', /^Unsupported combination of public and non/);
+            });
+        });
+
+        describe('where trying to overwrite a #public property with a non-public one', function () {
+            it('should throw an error', function () {
+                expect(function () {
+                    oconf.load(testFile('public-deep-with-include.cjson'));
+                }, 'to throw', /^Unsupported combination of public and non/);
+            });
+        });
+
+        describe('where including a file that already has a #public property which we try to overwrite', function () {
+            var data;
+            before(function () {
+                data = oconf.load(testFile('public-deep-with-public-include.cjson'));
+            });
+            it('should overwrite the included #public property with our value', function () {
+                expect(data, 'to equal', {
+                    foo: 'do not expose to public',
+                    bar: {
+                        quux: 'super secret'
+                    },
+                    hello: {
+                        earth: 'mostly harmless',
+                        answer: 'Insufficient data for meaningful answer'
+                    },
+                    '#public': {
+                        hello: {
+                            answer: 'Insufficient data for meaningful answer'
+                        }
+                    }
+                });
+            });
+        });
+
+        describe('when calling load method with an array of config file names containing public properties', function () {
+            var data, dataInclude;
+            before(function () {
+                data = oconf.load([testFile('public-left.cjson'), testFile('public-right.cjson')]);
+                dataInclude = oconf.load(testFile('public-left-right-wrap.cjson'));
+            });
+            it('functions like calling #include with an array of filenames in the same order', function () {
+                expect(data, 'to equal', dataInclude);
+            });
+        });
+    });
+
+    describe('when loading with public:true', function () {
+        describe('where the root object contains a #public property', function () {
+            var data;
+            before(function () {
+                data = oconf.load(testFile('public-base.cjson'), { public: true });
+            });
+            it('should fold the #public properties down into the base structure, and omit secret properties and leaves', function () {
+                expect(data, 'to equal', {
+                    what: 'what is public'
+                });
+            });
+        });
+
+        describe('where a child object contains some #public properties', function () {
+            var data;
+            before(function () {
+                data = oconf.load(testFile('public-deep.cjson'), { public: true });
+            });
+            it('should fold the #public properties down into the base structure, and omit secret properties and leaves', function () {
+                expect(data, 'to equal', {
+                    hello: {
+                        answer: 42
+                    }
+                });
+            });
+        });
+
+        describe('where trying to overwrite a non-public property with a #public one', function () {
+            it('should throw an error', function () {
+                expect(function () {
+                    oconf.load(testFile('public-deep-with-include.cjson'), { public: true });
+                }, 'to throw', /^Unsupported combination of public and non/);
+            });
+        });
+
+        describe('where trying to overwrite a #public property with a non-public one', function () {
+            it('should throw an error', function () {
+                expect(function () {
+                    oconf.load(testFile('public-deep-with-include.cjson'), { public: true });
+                }, 'to throw', /^Unsupported combination of public and non/);
+            });
+        });
+
+        describe('where including a file that overwrites a #public property with another public one', function () {
+            var data;
+            before(function () {
+                data = oconf.load(testFile('public-deep-with-public-include.cjson'), { public: true });
+            });
+            it('should overwrite the included #public property with our value, and omit secret properties and leaves', function () {
+                expect(data, 'to equal', {
+                    hello: {
+                        answer: 'Insufficient data for meaningful answer'
+                    }
+                });
+            });
+        });
+
+        describe('when there are no #public properties at all', function () {
+            var data;
+            before(function () {
+                data = oconf.load(testFile('base.cjson'), { public: true });
+            });
+            it('should return an empty object', function () {
+                expect(data, 'to equal', {});
+            });
+        });
+    });
+
+    describe('with public-array.cjson', function () {
+        it('throws an error', function () {
+            expect(function () {
+                oconf.load(testFile('public-array.cjson'));
+            }, 'to throw', /^#public must always be an object/);
+        });
+    });
+
+    describe('with public-non-object.cjson', function () {
+        it('throws an error', function () {
+            expect(function () {
+                oconf.load(testFile('public-non-object.cjson'));
+            }, 'to throw', /^#public must always be an object/);
+        });
+    });
+
+    describe('with a #public-suffixed key', function () {
+        it('treats the key as if contained inside a #public block', function () {
+            expect(
+                oconf.load(
+                    pathModule.resolve(
+                        __dirname,
+                        '../fixtures/valid-public.cjson'
+                    )
+                ),
+                'to equal',
+                {
+                    foo: {
+                        bar: 123,
+                        quux: 456
+                    },
+                    '#public': {
+                        foo: {
+                            bar: 123
+                        }
+                    }
+                }
+            );
+        });
+
+        it('complains if a #public-suffixed key shadows an entry inside a #public block', function () {
+            expect(
+                function () {
+                    oconf.load(
+                        pathModule.resolve(
+                            __dirname,
+                            '../fixtures/invalid-public.cjson'
+                        )
+                    );
+                },
+                'to throw',
+                new Error('foo#public clashes with foo inside #public block')
+            );
+        });
+
+        it.skip('should allow overwriting a key inside a #public block with a #public-suffixed key of the same name', function () {
+            expect(
+                oconf.load(
+                    pathModule.resolve(
+                        __dirname,
+                        '../fixtures/public-key-include-public-block.cjson'
+                    )
+                ),
+                'to equal',
+                {
+                    foo: {
+                        abc: 123
+                    },
+                    '#public': {
+                        foo: {
+                            abc: 123
+                        }
+                    }
+                }
+            );
+        });
+
+        it.skip('should allow overwriting a #public-suffixed key with a key of the same name inside a #public block', function () {
+            expect(
+                oconf.load(
+                    pathModule.resolve(
+                        __dirname,
+                        '../fixtures/public-block-include-public-key.cjson'
+                    )
+                ),
+                'to equal',
+                {
+                    foo: {
+                        abc: 123
+                    },
+                    '#public': {
+                        foo: {
+                            abc: 123
+                        }
+                    }
+                }
+            );
         });
     });
 });
diff --git a/test/lib/lint.spec.js b/test/lib/lint.spec.js
new file mode 100644
index 0000000..f992545
--- /dev/null
+++ b/test/lib/lint.spec.js
@@ -0,0 +1,57 @@
+/* global describe, it */
+var Path = require('path');
+var lint = require('../../lib/lint');
+var expect = require('unexpected')
+    .clone()
+    .addAssertion('to be an error', function (expect, subject, value) {
+        expect(subject, 'to be an', Error);
+        expect(subject, 'to satisfy', {
+            message: value
+        });
+    });
+
+function testData(filename) {
+    return Path.resolve(__dirname, '..', 'files', 'lint', filename);
+}
+
+
+describe('lib/lint', function () {
+    it('should export a function', function () {
+        expect(lint, 'to be a function');
+    });
+    it('should throw an error if path does not exist', function (done) {
+        lint(testData('nonExistant.cjson'), function (err) {
+            expect(err, 'to be an error', /^ENOENT/);
+            done();
+        });
+    });
+    it('should not complain when given a valid file', function (done) {
+        lint(testData('valid.cjson'), function (err) {
+            expect(err, 'to be undefined');
+            done();
+        });
+    });
+    it('should complain when given an invalid file', function (done) {
+        lint(testData('invalid.cjson'), function (err) {
+            expect(err, 'to be an error', /^Unexpected token '.' at 2:/);
+            done();
+        });
+    });
+    describe('should be able to lint a directory', function () {
+        it('should not complain if no invalid files are found', function (done) {
+            lint(testData('validDirectory'), function (err) {
+                expect(err, 'to be undefined');
+                done();
+            });
+        });
+        it('should complain if at least one file is invalid', function (done) {
+            lint(testData('invalidDirectory'), function (err) {
+                expect(err, 'to satisfy', {
+                    message: /^Unexpected token '.' at 2:/,
+                    file: /invalidDirectory\/2.cjson$/
+                });
+                done();
+            });
+        });
+    });
+});