@codyswann/lisa 2.321.2 → 2.321.4

package/package.json

@@ -115,7 +115,7 @@
     "brace-expansion": ">=5.0.9"
   },
   "name": "@codyswann/lisa",
-  "version": "2.321.2",
+  "version": "2.321.4",
   "description": "Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects",
   "main": "dist/index.js",
   "exports": {

package/plugins/lisa/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.321.2",
+  "version": "2.321.4",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.321.2",
+  "version": "2.321.4",
   "description": "Universal governance: agents, skills, commands, hooks, and rules for all projects.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/scripts/doctor-secrets.mjs

@@ -19,7 +19,7 @@
 
 import { createHash } from "node:crypto";
 
-import { fetchAll } from "./providers.mjs";
+import { fetchAll, fetchRotatable } from "./providers.mjs";
 import { readMaterialized } from "./resolve-secret.mjs";
 import { readConfig } from "./surfaces.mjs";
 
@@ -220,7 +220,7 @@ function main() {
   checkRequired(cfg, provider, file, report);
   checkNaming(provider, report);
   checkNotes(provider, report);
-  checkRotating(cfg, provider, report);
+  checkRotating(cfg, fetchRotatable(cfg), report);
   checkTwoStores(provider, file, report);
 
   const order = { error: 0, warn: 1, ok: 2 };

package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/scripts/providers.mjs

@@ -243,6 +243,45 @@ export function fetchAll(cfg) {
   return normalizeRows(fetchRaw(cfg), cfg.narrow);
 }
 
+/**
+ * The provider view the rotation path reads.
+ *
+ * `excludeKeys` keeps a credential off a **surface's disk**. Applying it here
+ * too hid the provider record, making `rotating` and `excludeKeys` mutually
+ * exclusive — and a credential you cannot see is one you cannot write back to.
+ * That is backwards for a consumable credential: the kind you least want
+ * materialized is the kind that most needs a proven write path.
+ *
+ * Nothing here materializes anything. `fetchAll` remains the only view feeding
+ * a surface, so an excluded rotating credential still never reaches disk.
+ * @param {object} cfg Resolved configuration.
+ * @returns {Map<string, {value: string, note: string, id: string|null}>} Selected secrets by name.
+ */
+export function fetchRotatable(cfg) {
+  return normalizeRows(fetchRaw(cfg), rotationNarrow(cfg));
+}
+
+/**
+ * Narrowing for the rotation view: project grants intact, `excludeKeys` waived
+ * for declared rotating names only.
+ *
+ * The waiver reaches only names in `secrets.rotating` — config, and therefore
+ * reviewed, the same declared-never-inferred rule the write path enforces.
+ * Project narrowing is the provider's own boundary and is never widened. Split
+ * from {@link fetchRotatable} so the decision is testable without a provider.
+ * @param {object} cfg Resolved configuration.
+ * @returns {{projectIds: string[], excludeKeys: string[]}} Narrowing controls.
+ */
+export function rotationNarrow(cfg) {
+  const rotating = new Set(cfg.rotating ?? []);
+  return {
+    projectIds: cfg.narrow?.projectIds ?? [],
+    excludeKeys: (cfg.narrow?.excludeKeys ?? []).filter(
+      key => !rotating.has(key)
+    ),
+  };
+}
+
 /**
  * Find one raw row by exact key, bypassing the exposure boundary.
  *

package/plugins/lisa/.codex-plugin/skills/lisa-secrets-access/scripts/rotate-secret.mjs

@@ -30,7 +30,12 @@
 import { readFileSync } from "node:fs";
 import { hostname } from "node:os";
 
-import { LEASE_KEY, fetchAll, rawByKey, writeSecret } from "./providers.mjs";
+import {
+  LEASE_KEY,
+  fetchRotatable,
+  rawByKey,
+  writeSecret,
+} from "./providers.mjs";
 import { readConfig } from "./surfaces.mjs";
 
 /** How long a lease is honoured before it is treated as abandoned. */
@@ -63,7 +68,10 @@ function assertRotating(name, cfg) {
  * @returns {{value: string, id: string}} The current entry.
  */
 function entryFor(name, cfg) {
-  const hit = fetchAll(cfg).get(name);
+  // Rotation view, not the materialization view: a name may be excluded from
+  // every surface and still need its replacement persisted. assertRotating has
+  // already proved this name is declared in config.
+  const hit = fetchRotatable(cfg).get(name);
   if (!hit) throw new Error(`${name} is not available to this account`);
   if (!hit.id) {
     throw new Error(

package/plugins/lisa/.codex-plugin/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -37,7 +37,7 @@ import {
   rmSync,
   writeFileSync,
 } from "node:fs";
-import { basename, dirname, join, resolve } from "node:path";
+import { basename, delimiter, dirname, join, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
 import { assertPinned, extractVersion, planToolchain } from "./toolchain.mjs";
@@ -197,6 +197,22 @@ function applyToolchain(tools, dryRun) {
   mkdirSync(binDir, { recursive: true, mode: 0o755 });
   const byName = new Map((tools.install ?? []).map(t => [t.name, t]));
 
+  // Installing a binary somewhere nothing looks is the same as not installing
+  // it. `~/.local/bin` is on PATH by default on a developer workstation and is
+  // NOT on a minimal container, so the toolchain step reported `install bws`,
+  // the file landed at ~/.local/bin/bws mode 755, and the very next step died
+  // with `spawnSync bws ENOENT`.
+  //
+  // This was invisible in every local test because a workstation shell already
+  // exports the directory — the environment doing the hiding was the one used
+  // to verify the fix.
+  //
+  // Prepended, not appended: a pinned-and-checksummed binary must win over
+  // whatever an image happens to ship under the same name.
+  if (!pathContains(binDir)) {
+    process.env.PATH = `${binDir}${delimiter}${process.env.PATH ?? ""}`;
+  }
+
   for (const step of plan) {
     console.log(`  ${step.action.padEnd(8)} ${step.reason}`);
     if (step.action === "install" && !dryRun)
@@ -205,6 +221,19 @@ function applyToolchain(tools, dryRun) {
   return plan;
 }
 
+/**
+ * Whether a directory is already on PATH.
+ *
+ * Compared entry by entry rather than by substring: a substring test would
+ * consider `/root/.local/bin` present because `/root/.local/bin/extra` is, and
+ * would then skip the prepend that makes the tool findable.
+ * @param {string} dir Directory to look for.
+ * @returns {boolean} True when PATH already contains exactly that entry.
+ */
+export function pathContains(dir, path = process.env.PATH ?? "") {
+  return path.split(delimiter).filter(Boolean).includes(dir);
+}
+
 /**
  * Run the project's own setup hook when it has one.
  *

package/plugins/lisa/skills/lisa-secrets-access/scripts/doctor-secrets.mjs

@@ -19,7 +19,7 @@
 
 import { createHash } from "node:crypto";
 
-import { fetchAll } from "./providers.mjs";
+import { fetchAll, fetchRotatable } from "./providers.mjs";
 import { readMaterialized } from "./resolve-secret.mjs";
 import { readConfig } from "./surfaces.mjs";
 
@@ -220,7 +220,7 @@ function main() {
   checkRequired(cfg, provider, file, report);
   checkNaming(provider, report);
   checkNotes(provider, report);
-  checkRotating(cfg, provider, report);
+  checkRotating(cfg, fetchRotatable(cfg), report);
   checkTwoStores(provider, file, report);
 
   const order = { error: 0, warn: 1, ok: 2 };

package/plugins/lisa/skills/lisa-secrets-access/scripts/providers.mjs

@@ -243,6 +243,45 @@ export function fetchAll(cfg) {
   return normalizeRows(fetchRaw(cfg), cfg.narrow);
 }
 
+/**
+ * The provider view the rotation path reads.
+ *
+ * `excludeKeys` keeps a credential off a **surface's disk**. Applying it here
+ * too hid the provider record, making `rotating` and `excludeKeys` mutually
+ * exclusive — and a credential you cannot see is one you cannot write back to.
+ * That is backwards for a consumable credential: the kind you least want
+ * materialized is the kind that most needs a proven write path.
+ *
+ * Nothing here materializes anything. `fetchAll` remains the only view feeding
+ * a surface, so an excluded rotating credential still never reaches disk.
+ * @param {object} cfg Resolved configuration.
+ * @returns {Map<string, {value: string, note: string, id: string|null}>} Selected secrets by name.
+ */
+export function fetchRotatable(cfg) {
+  return normalizeRows(fetchRaw(cfg), rotationNarrow(cfg));
+}
+
+/**
+ * Narrowing for the rotation view: project grants intact, `excludeKeys` waived
+ * for declared rotating names only.
+ *
+ * The waiver reaches only names in `secrets.rotating` — config, and therefore
+ * reviewed, the same declared-never-inferred rule the write path enforces.
+ * Project narrowing is the provider's own boundary and is never widened. Split
+ * from {@link fetchRotatable} so the decision is testable without a provider.
+ * @param {object} cfg Resolved configuration.
+ * @returns {{projectIds: string[], excludeKeys: string[]}} Narrowing controls.
+ */
+export function rotationNarrow(cfg) {
+  const rotating = new Set(cfg.rotating ?? []);
+  return {
+    projectIds: cfg.narrow?.projectIds ?? [],
+    excludeKeys: (cfg.narrow?.excludeKeys ?? []).filter(
+      key => !rotating.has(key)
+    ),
+  };
+}
+
 /**
  * Find one raw row by exact key, bypassing the exposure boundary.
  *

package/plugins/lisa/skills/lisa-secrets-access/scripts/rotate-secret.mjs

@@ -30,7 +30,12 @@
 import { readFileSync } from "node:fs";
 import { hostname } from "node:os";
 
-import { LEASE_KEY, fetchAll, rawByKey, writeSecret } from "./providers.mjs";
+import {
+  LEASE_KEY,
+  fetchRotatable,
+  rawByKey,
+  writeSecret,
+} from "./providers.mjs";
 import { readConfig } from "./surfaces.mjs";
 
 /** How long a lease is honoured before it is treated as abandoned. */
@@ -63,7 +68,10 @@ function assertRotating(name, cfg) {
  * @returns {{value: string, id: string}} The current entry.
  */
 function entryFor(name, cfg) {
-  const hit = fetchAll(cfg).get(name);
+  // Rotation view, not the materialization view: a name may be excluded from
+  // every surface and still need its replacement persisted. assertRotating has
+  // already proved this name is declared in config.
+  const hit = fetchRotatable(cfg).get(name);
   if (!hit) throw new Error(`${name} is not available to this account`);
   if (!hit.id) {
     throw new Error(

package/plugins/lisa/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -37,7 +37,7 @@ import {
   rmSync,
   writeFileSync,
 } from "node:fs";
-import { basename, dirname, join, resolve } from "node:path";
+import { basename, delimiter, dirname, join, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
 import { assertPinned, extractVersion, planToolchain } from "./toolchain.mjs";
@@ -197,6 +197,22 @@ function applyToolchain(tools, dryRun) {
   mkdirSync(binDir, { recursive: true, mode: 0o755 });
   const byName = new Map((tools.install ?? []).map(t => [t.name, t]));
 
+  // Installing a binary somewhere nothing looks is the same as not installing
+  // it. `~/.local/bin` is on PATH by default on a developer workstation and is
+  // NOT on a minimal container, so the toolchain step reported `install bws`,
+  // the file landed at ~/.local/bin/bws mode 755, and the very next step died
+  // with `spawnSync bws ENOENT`.
+  //
+  // This was invisible in every local test because a workstation shell already
+  // exports the directory — the environment doing the hiding was the one used
+  // to verify the fix.
+  //
+  // Prepended, not appended: a pinned-and-checksummed binary must win over
+  // whatever an image happens to ship under the same name.
+  if (!pathContains(binDir)) {
+    process.env.PATH = `${binDir}${delimiter}${process.env.PATH ?? ""}`;
+  }
+
   for (const step of plan) {
     console.log(`  ${step.action.padEnd(8)} ${step.reason}`);
     if (step.action === "install" && !dryRun)
@@ -205,6 +221,19 @@ function applyToolchain(tools, dryRun) {
   return plan;
 }
 
+/**
+ * Whether a directory is already on PATH.
+ *
+ * Compared entry by entry rather than by substring: a substring test would
+ * consider `/root/.local/bin` present because `/root/.local/bin/extra` is, and
+ * would then skip the prepend that makes the tool findable.
+ * @param {string} dir Directory to look for.
+ * @returns {boolean} True when PATH already contains exactly that entry.
+ */
+export function pathContains(dir, path = process.env.PATH ?? "") {
+  return path.split(delimiter).filter(Boolean).includes(dir);
+}
+
 /**
  * Run the project's own setup hook when it has one.
  *

package/plugins/lisa-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.321.2",
+  "version": "2.321.4",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-agy/skills/lisa-secrets-access/scripts/doctor-secrets.mjs

@@ -19,7 +19,7 @@
 
 import { createHash } from "node:crypto";
 
-import { fetchAll } from "./providers.mjs";
+import { fetchAll, fetchRotatable } from "./providers.mjs";
 import { readMaterialized } from "./resolve-secret.mjs";
 import { readConfig } from "./surfaces.mjs";
 
@@ -220,7 +220,7 @@ function main() {
   checkRequired(cfg, provider, file, report);
   checkNaming(provider, report);
   checkNotes(provider, report);
-  checkRotating(cfg, provider, report);
+  checkRotating(cfg, fetchRotatable(cfg), report);
   checkTwoStores(provider, file, report);
 
   const order = { error: 0, warn: 1, ok: 2 };

package/plugins/lisa-agy/skills/lisa-secrets-access/scripts/providers.mjs

@@ -243,6 +243,45 @@ export function fetchAll(cfg) {
   return normalizeRows(fetchRaw(cfg), cfg.narrow);
 }
 
+/**
+ * The provider view the rotation path reads.
+ *
+ * `excludeKeys` keeps a credential off a **surface's disk**. Applying it here
+ * too hid the provider record, making `rotating` and `excludeKeys` mutually
+ * exclusive — and a credential you cannot see is one you cannot write back to.
+ * That is backwards for a consumable credential: the kind you least want
+ * materialized is the kind that most needs a proven write path.
+ *
+ * Nothing here materializes anything. `fetchAll` remains the only view feeding
+ * a surface, so an excluded rotating credential still never reaches disk.
+ * @param {object} cfg Resolved configuration.
+ * @returns {Map<string, {value: string, note: string, id: string|null}>} Selected secrets by name.
+ */
+export function fetchRotatable(cfg) {
+  return normalizeRows(fetchRaw(cfg), rotationNarrow(cfg));
+}
+
+/**
+ * Narrowing for the rotation view: project grants intact, `excludeKeys` waived
+ * for declared rotating names only.
+ *
+ * The waiver reaches only names in `secrets.rotating` — config, and therefore
+ * reviewed, the same declared-never-inferred rule the write path enforces.
+ * Project narrowing is the provider's own boundary and is never widened. Split
+ * from {@link fetchRotatable} so the decision is testable without a provider.
+ * @param {object} cfg Resolved configuration.
+ * @returns {{projectIds: string[], excludeKeys: string[]}} Narrowing controls.
+ */
+export function rotationNarrow(cfg) {
+  const rotating = new Set(cfg.rotating ?? []);
+  return {
+    projectIds: cfg.narrow?.projectIds ?? [],
+    excludeKeys: (cfg.narrow?.excludeKeys ?? []).filter(
+      key => !rotating.has(key)
+    ),
+  };
+}
+
 /**
  * Find one raw row by exact key, bypassing the exposure boundary.
  *

package/plugins/lisa-agy/skills/lisa-secrets-access/scripts/rotate-secret.mjs

@@ -30,7 +30,12 @@
 import { readFileSync } from "node:fs";
 import { hostname } from "node:os";
 
-import { LEASE_KEY, fetchAll, rawByKey, writeSecret } from "./providers.mjs";
+import {
+  LEASE_KEY,
+  fetchRotatable,
+  rawByKey,
+  writeSecret,
+} from "./providers.mjs";
 import { readConfig } from "./surfaces.mjs";
 
 /** How long a lease is honoured before it is treated as abandoned. */
@@ -63,7 +68,10 @@ function assertRotating(name, cfg) {
  * @returns {{value: string, id: string}} The current entry.
  */
 function entryFor(name, cfg) {
-  const hit = fetchAll(cfg).get(name);
+  // Rotation view, not the materialization view: a name may be excluded from
+  // every surface and still need its replacement persisted. assertRotating has
+  // already proved this name is declared in config.
+  const hit = fetchRotatable(cfg).get(name);
   if (!hit) throw new Error(`${name} is not available to this account`);
   if (!hit.id) {
     throw new Error(

package/plugins/lisa-agy/skills/lisa-setup-remote-env/scripts/setup-remote-env.mjs

@@ -37,7 +37,7 @@ import {
   rmSync,
   writeFileSync,
 } from "node:fs";
-import { basename, dirname, join, resolve } from "node:path";
+import { basename, delimiter, dirname, join, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
 import { assertPinned, extractVersion, planToolchain } from "./toolchain.mjs";
@@ -197,6 +197,22 @@ function applyToolchain(tools, dryRun) {
   mkdirSync(binDir, { recursive: true, mode: 0o755 });
   const byName = new Map((tools.install ?? []).map(t => [t.name, t]));
 
+  // Installing a binary somewhere nothing looks is the same as not installing
+  // it. `~/.local/bin` is on PATH by default on a developer workstation and is
+  // NOT on a minimal container, so the toolchain step reported `install bws`,
+  // the file landed at ~/.local/bin/bws mode 755, and the very next step died
+  // with `spawnSync bws ENOENT`.
+  //
+  // This was invisible in every local test because a workstation shell already
+  // exports the directory — the environment doing the hiding was the one used
+  // to verify the fix.
+  //
+  // Prepended, not appended: a pinned-and-checksummed binary must win over
+  // whatever an image happens to ship under the same name.
+  if (!pathContains(binDir)) {
+    process.env.PATH = `${binDir}${delimiter}${process.env.PATH ?? ""}`;
+  }
+
   for (const step of plan) {
     console.log(`  ${step.action.padEnd(8)} ${step.reason}`);
     if (step.action === "install" && !dryRun)
@@ -205,6 +221,19 @@ function applyToolchain(tools, dryRun) {
   return plan;
 }
 
+/**
+ * Whether a directory is already on PATH.
+ *
+ * Compared entry by entry rather than by substring: a substring test would
+ * consider `/root/.local/bin` present because `/root/.local/bin/extra` is, and
+ * would then skip the prepend that makes the tool findable.
+ * @param {string} dir Directory to look for.
+ * @returns {boolean} True when PATH already contains exactly that entry.
+ */
+export function pathContains(dir, path = process.env.PATH ?? "") {
+  return path.split(delimiter).filter(Boolean).includes(dir);
+}
+
 /**
  * Run the project's own setup hook when it has one.
  *

package/plugins/lisa-cdk/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.321.2",
+  "version": "2.321.4",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.321.2",
+  "version": "2.321.4",
   "description": "AWS CDK-specific Lisa plugin.",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-agy/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.321.2",
+  "version": "2.321.4",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.321.2",
+  "version": "2.321.4",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-cdk-cursor/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa-cdk",
-  "version": "2.321.2",
+  "version": "2.321.4",
   "description": "AWS CDK-specific plugin",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "lisa",
-  "version": "2.321.2",
+  "version": "2.321.4",
   "description": "Universal governance — agents, skills, commands, hooks, and rules for all projects",
   "author": {
     "name": "Cody Swann"

package/plugins/lisa-copilot/skills/lisa-secrets-access/scripts/doctor-secrets.mjs

@@ -19,7 +19,7 @@
 
 import { createHash } from "node:crypto";
 
-import { fetchAll } from "./providers.mjs";
+import { fetchAll, fetchRotatable } from "./providers.mjs";
 import { readMaterialized } from "./resolve-secret.mjs";
 import { readConfig } from "./surfaces.mjs";
 
@@ -220,7 +220,7 @@ function main() {
   checkRequired(cfg, provider, file, report);
   checkNaming(provider, report);
   checkNotes(provider, report);
-  checkRotating(cfg, provider, report);
+  checkRotating(cfg, fetchRotatable(cfg), report);
   checkTwoStores(provider, file, report);
 
   const order = { error: 0, warn: 1, ok: 2 };

package/plugins/lisa-copilot/skills/lisa-secrets-access/scripts/providers.mjs

@@ -243,6 +243,45 @@ export function fetchAll(cfg) {
   return normalizeRows(fetchRaw(cfg), cfg.narrow);
 }
 
+/**
+ * The provider view the rotation path reads.
+ *
+ * `excludeKeys` keeps a credential off a **surface's disk**. Applying it here
+ * too hid the provider record, making `rotating` and `excludeKeys` mutually
+ * exclusive — and a credential you cannot see is one you cannot write back to.
+ * That is backwards for a consumable credential: the kind you least want
+ * materialized is the kind that most needs a proven write path.
+ *
+ * Nothing here materializes anything. `fetchAll` remains the only view feeding
+ * a surface, so an excluded rotating credential still never reaches disk.
+ * @param {object} cfg Resolved configuration.
+ * @returns {Map<string, {value: string, note: string, id: string|null}>} Selected secrets by name.
+ */
+export function fetchRotatable(cfg) {
+  return normalizeRows(fetchRaw(cfg), rotationNarrow(cfg));
+}
+
+/**
+ * Narrowing for the rotation view: project grants intact, `excludeKeys` waived
+ * for declared rotating names only.
+ *
+ * The waiver reaches only names in `secrets.rotating` — config, and therefore
+ * reviewed, the same declared-never-inferred rule the write path enforces.
+ * Project narrowing is the provider's own boundary and is never widened. Split
+ * from {@link fetchRotatable} so the decision is testable without a provider.
+ * @param {object} cfg Resolved configuration.
+ * @returns {{projectIds: string[], excludeKeys: string[]}} Narrowing controls.
+ */
+export function rotationNarrow(cfg) {
+  const rotating = new Set(cfg.rotating ?? []);
+  return {
+    projectIds: cfg.narrow?.projectIds ?? [],
+    excludeKeys: (cfg.narrow?.excludeKeys ?? []).filter(
+      key => !rotating.has(key)
+    ),
+  };
+}
+
 /**
  * Find one raw row by exact key, bypassing the exposure boundary.
  *

package/plugins/lisa-copilot/skills/lisa-secrets-access/scripts/rotate-secret.mjs

@@ -30,7 +30,12 @@
 import { readFileSync } from "node:fs";
 import { hostname } from "node:os";
 
-import { LEASE_KEY, fetchAll, rawByKey, writeSecret } from "./providers.mjs";
+import {
+  LEASE_KEY,
+  fetchRotatable,
+  rawByKey,
+  writeSecret,
+} from "./providers.mjs";
 import { readConfig } from "./surfaces.mjs";
 
 /** How long a lease is honoured before it is treated as abandoned. */
@@ -63,7 +68,10 @@ function assertRotating(name, cfg) {
  * @returns {{value: string, id: string}} The current entry.
  */
 function entryFor(name, cfg) {
-  const hit = fetchAll(cfg).get(name);
+  // Rotation view, not the materialization view: a name may be excluded from
+  // every surface and still need its replacement persisted. assertRotating has
+  // already proved this name is declared in config.
+  const hit = fetchRotatable(cfg).get(name);
   if (!hit) throw new Error(`${name} is not available to this account`);
   if (!hit.id) {
     throw new Error(