keymap-cli 0.1.4 → 0.1.5

package/README.md

@@ -2,6 +2,8 @@
 
 A values-free map of every secret you run, where it lives, and one command to rotate it everywhere.
 
+![keymap incident railway, then a dry-run rotate](docs/keymap-demo.svg)
+
 **It is a map, not a vault.** keymap never stores a secret value. The manifest and its state hold names, locations, timestamps and short salted hashes. Values move only between your existing CLIs (`gh`, `railway`, …) and the host, over stdin or a mode-600 temp file, never through a shell string or on a command line.
 
 Built after the OpenCode (Oct 16, 2026) and Railway (Oct 21, 2026) key thefts, when "rotate every variable" met "I don't remember where half of these are used".
@@ -48,7 +50,7 @@ INCIDENT railway: 4 secrets to rotate, most dangerous first
 [2] Database and storage credentials
     DATABASE_URL        custom   exposed at railway:api; also lives at local:.env
 [4] Package registry credentials
-    NPM_TOKEN           custom   exposed at railway:worker; also lives at nowhere else
+    NPM_TOKEN           custom   exposed at railway:worker; lives nowhere else
 ```
 
 The order follows Railway's own disclosure guidance: AI keys, cloud and payments, databases, source control, package registries. `--walk` asks for each new value, pushes it everywhere, and ends with the list of anything still exposed.

package/dist/cli.js

@@ -11150,7 +11150,7 @@ var supportedSinks = Object.keys(registry);
 var import_yaml = __toESM(require_dist(), 1);
 import { readFile as readFile3, writeFile as writeFile4 } from "fs/promises";
 var MANIFEST_FILE = "keymap.yaml";
-var ISSUERS = /* @__PURE__ */ new Set(["openai", "anthropic", "openrouter", "google", "stripe", "supabase", "cloudflare", "custom"]);
+var ISSUERS = /* @__PURE__ */ new Set(["openai", "anthropic", "openrouter", "google", "stripe", "supabase", "cloudflare", "resend", "telegram", "github", "custom"]);
 var SINKS = /* @__PURE__ */ new Set(["local", "github", "railway", "vercel", "fly", "cloudflare", "supabase"]);
 var ManifestError = class extends Error {
 };
@@ -11736,6 +11736,10 @@ function tierOf(name, issuer) {
   if (/(NPM_|PYPI|CARGO_|NUGET|DOCKER|GHCR|REGISTRY)/.test(n)) return 4;
   return 5;
 }
+function elsewhere(it) {
+  const rest = it.allSinks.filter((s) => !it.exposedAt.includes(s));
+  return rest.length ? `also lives at ${rest.join(", ")}` : "lives nowhere else";
+}
 function planIncident(manifest, host, filter) {
   const items = [];
   for (const [name, spec] of Object.entries(manifest.secrets)) {
@@ -11760,7 +11764,7 @@ function formatPlan(host, items) {
       lines.push(`[${it.tier}] ${TIER_LABEL[it.tier]}`);
       last = it.tier;
     }
-    lines.push(`    ${it.secret.padEnd(28)} ${it.issuer.padEnd(10)} exposed at ${it.exposedAt.join(", ")}; also lives at ${it.allSinks.filter((s) => !it.exposedAt.includes(s)).join(", ") || "nowhere else"}`);
+    lines.push(`    ${it.secret.padEnd(28)} ${it.issuer.padEnd(10)} exposed at ${it.exposedAt.join(", ")}; ${elsewhere(it)}`);
   }
   lines.push("", "Run `keymap incident <host> --walk` to rotate each one in turn, or `keymap rotate <SECRET>` individually.");
   return lines.join("\n");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "keymap-cli",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Values-free map of every secret you run, where it lives, and one command to rotate it everywhere.",
   "license": "MIT",
   "author": "Nekruz Kasimov",