keymap-cli 0.1.2 → 0.1.4

package/README.md

@@ -4,19 +4,18 @@ A values-free map of every secret you run, where it lives, and one command to ro
 
 **It is a map, not a vault.** keymap never stores a secret value. The manifest and its state hold names, locations, timestamps and short salted hashes. Values move only between your existing CLIs (`gh`, `railway`, …) and the host, over stdin or a mode-600 temp file, never through a shell string or on a command line.
 
-Built for solo and vibe-coded deployments after the OpenCode (Oct 16, 2026) and Railway (Oct 21, 2026) key thefts, when "rotate every variable" met "I don't remember where half of these are used".
+Built after the OpenCode (Oct 16, 2026) and Railway (Oct 21, 2026) key thefts, when "rotate every variable" met "I don't remember where half of these are used".
 
-## Status
-
-Day 4. All planned commands exist: `init`, `audit`, `mark`, `rotate`, `incident`, `remind`, `doctor`, for `local` (.env files), `github` (Actions secrets), `railway`, `vercel`, `fly`, `cloudflare` (Workers) and `supabase` (Edge Function secrets). OpenRouter keys can be minted by API. Not yet published to npm.
+Commands: `init`, `audit`, `mark`, `rotate`, `incident`, `remind`, `doctor`. Hosts: `local` (.env files), `github` (Actions secrets), `railway`, `vercel`, `fly`, `cloudflare` (Workers), `supabase` (Edge Function secrets). OpenRouter keys can be minted by API.
 
 ## Quick start
 
 ```sh
-npm i -g keymap-cli            # or: npx keymap-cli   (not published yet; see Status)
+npm i -g keymap-cli            # or: npx keymap-cli
 cd your-project
 keymap init -s local:.env github:owner/repo railway:api/production
 # edit keymap.yaml: issuers, rotate_every, ignore list
+# (init skips config-looking names such as APP_URL, UPLOAD_DIR, MERCHANT_ID; pass --all to include them)
 keymap audit                   # exit 1 on missing / drift / overdue / unmapped
 keymap mark OPENAI_API_KEY     # you rotated it by hand today
 pbpaste | keymap rotate OPENAI_API_KEY   # push a new key everywhere, hosts first, laptop last

package/dist/cli.js

@@ -11175,8 +11175,14 @@ function checkFields(kind, fields, path) {
   return out;
 }
 var NOISE = /^(NODE_ENV|PORT|HOST|HOSTNAME|PATH|HOME|TZ|LANG|LC_|CI|DEBUG|LOG_LEVEL|NEXT_PUBLIC_|VITE_|PUBLIC_|RAILWAY_|VERCEL_)/;
+var CREDENTIAL = /(SECRET|KEY|TOKEN|PASSWORD|PASSWD|PRIVATE|CREDENTIAL|SIGNING|WEBHOOK|DATABASE|DIRECT_URL|SHADOW_URL|DSN|CONNECTION|REDIS|MONGO|POSTGRES|MYSQL)/;
+var CONFIG_SUFFIX = /(_URL|_URI|_HOST|_PORT|_DIR|_PATH|_FILE|_ID|_NAME|_FROM|_TO|_EMAIL|_PRICE|_AMOUNT|_LIMIT|_COUNT|_SIZE|_TIMEOUT|_INTERVAL|_REGION|_ZONE|_BUCKET|_VERSION|_MODE|_ENV|_FLAG|_ENABLED|_URL_PROD)$/;
+function looksLikeConfig(name) {
+  if (CREDENTIAL.test(name)) return false;
+  return CONFIG_SUFFIX.test(name);
+}
 function isIgnored(name, ignore = []) {
-  if (NOISE.test(name)) return true;
+  if (NOISE.test(name) || looksLikeConfig(name)) return true;
   return ignore.some((g) => g.endsWith("*") ? name.startsWith(g.slice(0, -1)) : name === g);
 }
 function normaliseSink(raw, path) {
@@ -11376,6 +11382,9 @@ function guessIssuer(name) {
   if (n.includes("STRIPE")) return "stripe";
   if (n.includes("SUPABASE")) return "supabase";
   if (n.includes("CLOUDFLARE") || n.startsWith("CF_")) return "cloudflare";
+  if (n.includes("RESEND")) return "resend";
+  if (n.includes("TELEGRAM")) return "telegram";
+  if (n.includes("GITHUB") || n.startsWith("GH_")) return "github";
   return "custom";
 }
 async function buildManifest(opts, ctx2) {
@@ -11463,6 +11472,19 @@ function manualChecklist(issuer, name) {
       return [
         "Delete the old key at https://openrouter.ai/settings/keys once traffic has moved (or set KEYMAP_OPENROUTER_MGMT_KEY to let keymap do this)."
       ];
+    case "resend":
+      return [
+        `Open https://resend.com/api-keys and confirm the new ${name} is listed.`,
+        "Delete the old key once every sink has the new one."
+      ];
+    case "telegram":
+      return [
+        `In Telegram, open @BotFather -> /revoke and pick the bot behind ${name}; the old token stops working at once, so push the new one everywhere first.`
+      ];
+    case "github":
+      return [
+        "GitHub -> Settings -> Developer settings -> tokens: delete the old token after every sink has the new one."
+      ];
     case "custom":
       return [`Tell the service that consumes ${name} about the new value (its own config, or a peer app) and retire the old one.`];
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "keymap-cli",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Values-free map of every secret you run, where it lives, and one command to rotate it everywhere.",
   "license": "MIT",
   "author": "Nekruz Kasimov",