[igoramadas]

Summary

SetMeUp 2.0.0: native ESM support, a new authenticated encryption format, exported TypeScript types, and a batch of bug fixes.

Major changes

New enc2- encryption format

• Values are encrypted with AES-256-GCM using a random IV per value, stored as enc2-type:iv:tag:data. The value type is authenticated, so tampered or swapped values fail to decrypt.
• The encryption key can have any length, as the actual key is derived from it via scrypt.
• Legacy enc- values can still be loaded and decrypted. SMU_CRYPTO_CIPHER and SMU_CRYPTO_IV now only apply to them.
• Loading a file with legacy enc- values logs a deprecation warning, as legacy encryption will be deprecated in the next release.
• New setmeup crypto-migrate <file> CLI command converts legacy enc- values to enc2- in memory, leaving all other values untouched.
• Encrypting a file that has nothing to change no longer rewrites it, which fixes endless reloads of a watched settings.secret.json.

ESM and TypeScript

• Native ESM entry point via package exports, sharing the same singleton instance with CommonJS.
• Types SetMeUp, LoadOptions, LoadEnvOptions, LoadedFile and CryptoOptions can be imported by name, on both CommonJS and ESM.

Environment variables

• true / false (case insensitive) are loaded as booleans, and numeric values as numbers. Values that would change when converted (like 007 or very large IDs) are kept as strings.
• When a variable is set both as a value and as a parent (SMU_a and SMU_a_b), the nested one now wins deterministically instead of throwing.

Breaking changes

• Requires Node.js 22 or newer.
• loadFromEnv() casts booleans and numbers.
• Read only mode is detected based on the app root folder (current working directory).
• The CLI exits with code 1 on errors.

Other changes

• load and loadFromEnv events are emitted after the settings were updated.
• Files reloaded by watch() keep their original load options, and reload failures no longer throw inside the file watcher.
• unwatch() only removes its own file listeners.
• Fixed once() triggering listeners multiple times.
• Fixed prototype pollution via __proto__, constructor and prototype keys.
• Fixed duplicate files entries when loading the same file multiple times.
• Fixed decrypting files with plain numbers mixed in.
• loadJson() returns the loaded data.
• Files with a UTF-8 BOM can be loaded, and parse errors now include the filename.
• CLI help fixed (print instead of load), and running it without an action shows the help.
• Removed the generated typedoc site.

[greptile-apps]

Confidence Score: 5/5

[High risk] Major version bump with breaking changes and encryption algorithm shift.

The latest changes appear safe to merge.

What we checked:

• Migration keeps secrets encrypted: cryptoMigrate throws before the file write when encryption leaves a decrypted value unchanged.
• Nested settings survive parent variables: loadFromEnv skips the parent assignment when a nested object already exists, including with lowercase names.

_{Reviews (2) · Last reviewed commit: "Specs for review agents." · Reviewed by Greptile}

[cubic-dev-ai]

We detected this is a high-risk PR and are running a free ultrareview. An ultrareview is a deeper, multi-pass review that catches hard-to-find bugs a standard review can miss. We'll post the findings when it completes.

This PR appears to change authentication, authorization, or input validation, where a missed bug can expose data or grant the wrong access, so a deeper multi-pass review is worth running.

Want an ultrareview on every high-risk PR? Set up automated ultrareviews.

[cubic-dev-ai]

We detected this is a high-risk PR and ran a free ultrareview. An ultrareview is a deeper, multi-pass review that catches hard-to-find bugs a standard review can miss.

This PR appears to change authentication, authorization, or input validation, where a missed bug can expose data or grant the wrong access, so a deeper multi-pass review is worth running.

Want an ultrareview on every high-risk PR? Set up automated ultrareviews.

2 issues found across 36 files

Confidence score: 4/5

• The CHANGELOG.md entry overstates when SetMeUp warns about loading a legacy file; the warning depends on the optional anyhow module. Qualify the release note or make the warning unconditional.
• The README.md load() example leaves out the NODE_ENV fallback, so it gives the wrong file list when NODE_ENV=production and APP_ENV is unset. Include settings.production.json.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="CHANGELOG.md">

<violation number="1" location="CHANGELOG.md:8">
P3: This entry promises a warning whenever a legacy file is loaded, but SetMeUp emits it only when the optional `anyhow` module is installed. Qualify the release note as Anyhow-dependent or add an unconditional warning path.</violation>
</file>

<file name="README.md">

<violation number="1" location="README.md:34">
P3: The `load()` example omits the `NODE_ENV` fallback documented above: with `NODE_ENV=production` and no `APP_ENV`, it loads `settings.production.json`, not `settings.APP_ENV.json`. Include that fallback in the file list.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic</sub>

[cubic-dev-ai]

P3: This entry promises a warning whenever a legacy file is loaded, but SetMeUp emits it only when the optional anyhow module is installed. Qualify the release note as Anyhow-dependent or add an unconditional warning path.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At CHANGELOG.md, line 8:

<comment>This entry promises a warning whenever a legacy file is loaded, but SetMeUp emits it only when the optional `anyhow` module is installed. Qualify the release note as Anyhow-dependent or add an unconditional warning path.</comment>

<file context>
@@ -0,0 +1,141 @@
+- NEW: Native ESM support via package exports, alongside CommonJS.
+- NEW: Values are now encrypted as `enc2-` (AES-256-GCM, random IV per value, key of any length). Legacy `enc-` values can still be decrypted.
+- NEW: `setmeup crypto-migrate` CLI command to convert legacy `enc-` values to `enc2-`.
+- DEPRECATED: Legacy `enc-` encryption will be deprecated in the next release, loading files with `enc-` values logs a warning.
+- NEW: Types `SetMeUp`, `LoadOptions`, `LoadEnvOptions`, `LoadedFile` and `CryptoOptions` are exported.
+- BREAKING: Requires Node.js 22 or newer.
</file context>

[cubic-dev-ai]

P3: The load() example omits the NODE_ENV fallback documented above: with NODE_ENV=production and no APP_ENV, it loads settings.production.json, not settings.APP_ENV.json. Include that fallback in the file list.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At README.md, line 34:

<comment>The `load()` example omits the `NODE_ENV` fallback documented above: with `NODE_ENV=production` and no `APP_ENV`, it loads `settings.production.json`, not `settings.APP_ENV.json`. Include that fallback in the file list.</comment>

<file context>
@@ -4,31 +4,42 @@
-// By default it will load from settings.default.json, settings.json and settings.NODE_ENV.json
-// automatically. Here we load settings from a custom file as well.
+// Settings are not loaded automatically, so load the default files
+// (settings.default.json, settings.json, settings.APP_ENV.json and settings.secret.json).
+setmeup.load()
+
</file context>

Suggested change

	// (settings.default.json, settings.json, settings.APP_ENV.json and settings.secret.json).
	// (settings.default.json, settings.json, settings.APP_ENV.json or settings.NODE_ENV.json when APP_ENV is unset, and settings.secret.json).