Narrow a secret without its value

runtime secrets set NAME --keep-value with a narrower --host or --allow takes hosts, methods or paths away from a secret you stored, with no need to have its value at hand: a token that could push to a repository can be made fetch-only by anyone who may write secrets. Anything wider is refused, since a new place could learn the value. In the API, PUT /v1/egress-secrets/{name}/rules; in every SDK, secrets.narrow (withruntime 0.22.0 for JavaScript, 0.21.0 for Python); in the console, leave the value empty when you edit a secret to take hosts or rules away. The audit log records each one. See Secrets sandboxes never see.