keymap-cli 0.1.3 → 0.1.5

package/README.md

@@ -2,6 +2,8 @@
 
 A values-free map of every secret you run, where it lives, and one command to rotate it everywhere.
 
+![keymap incident railway, then a dry-run rotate](docs/keymap-demo.svg)
+
 **It is a map, not a vault.** keymap never stores a secret value. The manifest and its state hold names, locations, timestamps and short salted hashes. Values move only between your existing CLIs (`gh`, `railway`, …) and the host, over stdin or a mode-600 temp file, never through a shell string or on a command line.
 
 Built after the OpenCode (Oct 16, 2026) and Railway (Oct 21, 2026) key thefts, when "rotate every variable" met "I don't remember where half of these are used".
@@ -15,6 +17,7 @@ npm i -g keymap-cli            # or: npx keymap-cli
 cd your-project
 keymap init -s local:.env github:owner/repo railway:api/production
 # edit keymap.yaml: issuers, rotate_every, ignore list
+# (init skips config-looking names such as APP_URL, UPLOAD_DIR, MERCHANT_ID; pass --all to include them)
 keymap audit                   # exit 1 on missing / drift / overdue / unmapped
 keymap mark OPENAI_API_KEY     # you rotated it by hand today
 pbpaste | keymap rotate OPENAI_API_KEY   # push a new key everywhere, hosts first, laptop last
@@ -47,7 +50,7 @@ INCIDENT railway: 4 secrets to rotate, most dangerous first
 [2] Database and storage credentials
     DATABASE_URL        custom   exposed at railway:api; also lives at local:.env
 [4] Package registry credentials
-    NPM_TOKEN           custom   exposed at railway:worker; also lives at nowhere else
+    NPM_TOKEN           custom   exposed at railway:worker; lives nowhere else
 ```
 
 The order follows Railway's own disclosure guidance: AI keys, cloud and payments, databases, source control, package registries. `--walk` asks for each new value, pushes it everywhere, and ends with the list of anything still exposed.

package/dist/cli.js

@@ -11150,7 +11150,7 @@ var supportedSinks = Object.keys(registry);
 var import_yaml = __toESM(require_dist(), 1);
 import { readFile as readFile3, writeFile as writeFile4 } from "fs/promises";
 var MANIFEST_FILE = "keymap.yaml";
-var ISSUERS = /* @__PURE__ */ new Set(["openai", "anthropic", "openrouter", "google", "stripe", "supabase", "cloudflare", "custom"]);
+var ISSUERS = /* @__PURE__ */ new Set(["openai", "anthropic", "openrouter", "google", "stripe", "supabase", "cloudflare", "resend", "telegram", "github", "custom"]);
 var SINKS = /* @__PURE__ */ new Set(["local", "github", "railway", "vercel", "fly", "cloudflare", "supabase"]);
 var ManifestError = class extends Error {
 };
@@ -11175,8 +11175,14 @@ function checkFields(kind, fields, path) {
   return out;
 }
 var NOISE = /^(NODE_ENV|PORT|HOST|HOSTNAME|PATH|HOME|TZ|LANG|LC_|CI|DEBUG|LOG_LEVEL|NEXT_PUBLIC_|VITE_|PUBLIC_|RAILWAY_|VERCEL_)/;
+var CREDENTIAL = /(SECRET|KEY|TOKEN|PASSWORD|PASSWD|PRIVATE|CREDENTIAL|SIGNING|WEBHOOK|DATABASE|DIRECT_URL|SHADOW_URL|DSN|CONNECTION|REDIS|MONGO|POSTGRES|MYSQL)/;
+var CONFIG_SUFFIX = /(_URL|_URI|_HOST|_PORT|_DIR|_PATH|_FILE|_ID|_NAME|_FROM|_TO|_EMAIL|_PRICE|_AMOUNT|_LIMIT|_COUNT|_SIZE|_TIMEOUT|_INTERVAL|_REGION|_ZONE|_BUCKET|_VERSION|_MODE|_ENV|_FLAG|_ENABLED|_URL_PROD)$/;
+function looksLikeConfig(name) {
+  if (CREDENTIAL.test(name)) return false;
+  return CONFIG_SUFFIX.test(name);
+}
 function isIgnored(name, ignore = []) {
-  if (NOISE.test(name)) return true;
+  if (NOISE.test(name) || looksLikeConfig(name)) return true;
   return ignore.some((g) => g.endsWith("*") ? name.startsWith(g.slice(0, -1)) : name === g);
 }
 function normaliseSink(raw, path) {
@@ -11376,6 +11382,9 @@ function guessIssuer(name) {
   if (n.includes("STRIPE")) return "stripe";
   if (n.includes("SUPABASE")) return "supabase";
   if (n.includes("CLOUDFLARE") || n.startsWith("CF_")) return "cloudflare";
+  if (n.includes("RESEND")) return "resend";
+  if (n.includes("TELEGRAM")) return "telegram";
+  if (n.includes("GITHUB") || n.startsWith("GH_")) return "github";
   return "custom";
 }
 async function buildManifest(opts, ctx2) {
@@ -11463,6 +11472,19 @@ function manualChecklist(issuer, name) {
       return [
         "Delete the old key at https://openrouter.ai/settings/keys once traffic has moved (or set KEYMAP_OPENROUTER_MGMT_KEY to let keymap do this)."
       ];
+    case "resend":
+      return [
+        `Open https://resend.com/api-keys and confirm the new ${name} is listed.`,
+        "Delete the old key once every sink has the new one."
+      ];
+    case "telegram":
+      return [
+        `In Telegram, open @BotFather -> /revoke and pick the bot behind ${name}; the old token stops working at once, so push the new one everywhere first.`
+      ];
+    case "github":
+      return [
+        "GitHub -> Settings -> Developer settings -> tokens: delete the old token after every sink has the new one."
+      ];
     case "custom":
       return [`Tell the service that consumes ${name} about the new value (its own config, or a peer app) and retire the old one.`];
   }
@@ -11714,6 +11736,10 @@ function tierOf(name, issuer) {
   if (/(NPM_|PYPI|CARGO_|NUGET|DOCKER|GHCR|REGISTRY)/.test(n)) return 4;
   return 5;
 }
+function elsewhere(it) {
+  const rest = it.allSinks.filter((s) => !it.exposedAt.includes(s));
+  return rest.length ? `also lives at ${rest.join(", ")}` : "lives nowhere else";
+}
 function planIncident(manifest, host, filter) {
   const items = [];
   for (const [name, spec] of Object.entries(manifest.secrets)) {
@@ -11738,7 +11764,7 @@ function formatPlan(host, items) {
       lines.push(`[${it.tier}] ${TIER_LABEL[it.tier]}`);
       last = it.tier;
     }
-    lines.push(`    ${it.secret.padEnd(28)} ${it.issuer.padEnd(10)} exposed at ${it.exposedAt.join(", ")}; also lives at ${it.allSinks.filter((s) => !it.exposedAt.includes(s)).join(", ") || "nowhere else"}`);
+    lines.push(`    ${it.secret.padEnd(28)} ${it.issuer.padEnd(10)} exposed at ${it.exposedAt.join(", ")}; ${elsewhere(it)}`);
   }
   lines.push("", "Run `keymap incident <host> --walk` to rotate each one in turn, or `keymap rotate <SECRET>` individually.");
   return lines.join("\n");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "keymap-cli",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Values-free map of every secret you run, where it lives, and one command to rotate it everywhere.",
   "license": "MIT",
   "author": "Nekruz Kasimov",