Two more provider-API rotation drivers for the vibe-coder credential surface,
both following the create-new → verify → revoke-old pattern with the
self-contained blob form <provider>://<host>/?id=&secret=.
- vercel: POST /v3/user/tokens mints a new bearer; Verify lists tokens and
asserts the new id is present; RevokeOld DELETEs the old token by id.
- sendgrid: clones the old key's scopes (GET /v3/api_keys/<id>) onto the new
key so rotation is a faithful replacement, not a privilege downgrade; Verify
is a GET /v3/scopes auth proof; RevokeOld DELETEs the old key by id.
Both ship Bearer-enforcing httptest emulators that prove a real cutover (old
credential dead, new alive after RevokeOld) plus a leak check. Recorded as
MOCK-ONLY in proofs.go + docs/ROTATION-PROOFS.md (no self-host). go build/vet
clean; 77 rotate tests pass, -race clean.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
leetcrypt
88e603f3c0