@agent-native/toolkit 0.227.0 → 0.228.0-nightly-20261111004142

package/src/app/settings/api-keys/ApiKeyDialogs.tsx

@@ -37,6 +37,7 @@ import {
 } from "@agent-native/toolkit/ui/select";
 import { Skeleton } from "@agent-native/toolkit/ui/skeleton";
 import { Spinner } from "@agent-native/toolkit/ui/spinner";
+import { Textarea } from "@agent-native/toolkit/ui/textarea";
 import {
   IconAlertCircle,
   IconExternalLink,
@@ -53,7 +54,11 @@ import {
 } from "../../integrations/index.js";
 import { effectText } from "../model/RemoveProviderDialog.js";
 import { normalizeKeyName } from "../NewKeyMenu.js";
-import { saveApiKeyValue, notifyKeysChanged } from "./api-keys-client.js";
+import {
+  saveApiKeyValue,
+  updateApiKeyOrigins,
+  notifyKeysChanged,
+} from "./api-keys-client.js";
 import {
   addableSuggestions,
   addKeyTarget,
@@ -64,6 +69,26 @@ import {
 const K = "agentChat.settingsApiKeys.";
 const M = "agentChat.settingsModel.";
 
+function parseExactOrigins(raw: string): string[] | null {
+  const origins = raw
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter(Boolean);
+  for (const origin of origins) {
+    if (!URL.canParse(origin)) return null;
+    const url = new URL(origin);
+    const local = ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+    if (
+      url.origin !== origin ||
+      url.username ||
+      url.password ||
+      (url.protocol !== "https:" && !(url.protocol === "http:" && local))
+    )
+      return null;
+  }
+  return [...new Set(origins)];
+}
+
 function refreshKeys(queryClient: ReturnType<typeof useQueryClient>) {
   return queryClient.invalidateQueries({ queryKey: ["action"] });
 }
@@ -119,6 +144,98 @@ export function KeyValueDialog(props: KeyValueDialogProps) {
   );
 }
 
+/** A saved custom key's policy can be approved without exposing its value. */
+export function KeyOriginsDialog({
+  entry,
+  open,
+  onOpenChange,
+}: {
+  entry: ApiKeyEntry;
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+}) {
+  const t = useT();
+  const queryClient = useQueryClient();
+  const id = useId();
+  const [origins, setOrigins] = useState(entry.urlAllowlist?.join("\n") ?? "");
+  const [saving, setSaving] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  const save = async () => {
+    const parsed = parseExactOrigins(origins);
+    if (parsed === null) {
+      setError(t(`${K}invalidOrigins`));
+      return;
+    }
+    setSaving(true);
+    setError(null);
+    try {
+      await updateApiKeyOrigins({
+        name: entry.name,
+        scope: entry.storedScope,
+        owner: entry.scope,
+        urlAllowlist: parsed,
+      });
+      await refreshKeys(queryClient);
+      toast.success(t(`${K}originsSaved`));
+      onOpenChange(false);
+    } catch (cause) {
+      setError(cause instanceof Error ? cause.message : String(cause));
+    } finally {
+      setSaving(false);
+    }
+  };
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="max-w-lg" aria-describedby={undefined}>
+        <DialogHeader>
+          <DialogTitle>{t(`${K}editOrigins`)}</DialogTitle>
+        </DialogHeader>
+        <form
+          className="grid gap-4"
+          onSubmit={(event) => {
+            event.preventDefault();
+            void save();
+          }}
+        >
+          <div className="grid gap-2">
+            <Label htmlFor={id}>{t(`${K}approvedOrigins`)}</Label>
+            <Textarea
+              id={id}
+              value={origins}
+              rows={3}
+              spellCheck={false}
+              placeholder="https://api.example.com"
+              onChange={(event) => {
+                setOrigins(event.target.value);
+                setError(null);
+              }}
+            />
+            <p className="text-xs text-muted-foreground">
+              {t(`${K}originsHint`)}
+            </p>
+          </div>
+          <FormError message={error} />
+          <DialogFooter>
+            <Button
+              type="button"
+              variant="secondary"
+              onClick={() => onOpenChange(false)}
+            >
+              {t(`${M}cancel`)}
+            </Button>
+            <Button type="submit" disabled={saving}>
+              {saving ? <Spinner aria-hidden /> : null}
+              {t(`${M}save`)}
+            </Button>
+          </DialogFooter>
+        </form>
+      </DialogContent>
+    </Dialog>
+  );
+}
+
 /** False once the dialog content unmounts, so a late save can't close a newer dialog. */
 function useMounted() {
   const mounted = useRef(true);
@@ -161,6 +278,7 @@ function KeyValueDialogContent({
     nameHint: useId(),
     value: useId(),
     who: useId(),
+    origins: useId(),
   };
   const replacing = dialog.mode === "replace" ? dialog.entry : null;
   const forService = dialog.mode === "add" && dialog.forService === true;
@@ -169,6 +287,9 @@ function KeyValueDialogContent({
       (dialog.mode === "add" ? (dialog.initialName ?? "") : ""),
   );
   const [value, setValue] = useState("");
+  const [origins, setOrigins] = useState(
+    replacing?.urlAllowlist?.join("\n") ?? "",
+  );
   const [shared, setShared] = useState(true);
   const [saving, setSaving] = useState(false);
   const [error, setError] = useState<string | null>(null);
@@ -205,9 +326,15 @@ function KeyValueDialogContent({
     lockedShared === null && listing.hasOrganization && listing.canManageOrg;
   const isShared = lockedShared ?? (canChoose && shared);
   const valid = !blocked && target.kind !== "empty" && !!value.trim();
+  const customOrigins =
+    target.kind === "custom" ? parseExactOrigins(origins) : [];
 
   const save = async () => {
     if (saving || !valid) return;
+    if (customOrigins === null) {
+      setError(t(`${K}invalidOrigins`));
+      return;
+    }
     setSaving(true);
     onSavingChange?.(true);
     setError(null);
@@ -218,6 +345,7 @@ function KeyValueDialogContent({
           value: value.trim(),
           registered: target.kind === "registered",
           shared: isShared,
+          ...(target.kind === "custom" ? { urlAllowlist: customOrigins } : {}),
         }),
       );
       void refreshKeys(queryClient);
@@ -328,6 +456,25 @@ function KeyValueDialogContent({
             </a>
           ) : null}
         </div>
+        {target.kind === "custom" ? (
+          <div className="grid gap-2">
+            <Label htmlFor={ids.origins}>{t(`${K}approvedOrigins`)}</Label>
+            <Textarea
+              id={ids.origins}
+              value={origins}
+              rows={2}
+              spellCheck={false}
+              placeholder="https://api.example.com"
+              onChange={(event) => {
+                setOrigins(event.target.value);
+                setError(null);
+              }}
+            />
+            <p className="text-xs text-muted-foreground">
+              {t(`${K}originsHint`)}
+            </p>
+          </div>
+        ) : null}
         {listing.hasOrganization && !blocked ? (
           <div className="grid gap-2">
             <span

package/src/app/settings/api-keys/ApiKeysSettingsPage.spec.tsx

@@ -18,6 +18,7 @@ const callActionMock = vi.hoisted(() => vi.fn());
 const navigateMock = vi.hoisted(() => vi.fn());
 const clientMock = vi.hoisted(() => ({
   save: vi.fn(),
+  updateOrigins: vi.fn(),
   test: vi.fn(),
   notify: vi.fn(),
 }));
@@ -73,6 +74,7 @@ vi.mock("../model/ProviderDialog.js", () => ({
 
 vi.mock("./api-keys-client.js", () => ({
   saveApiKeyValue: clientMock.save,
+  updateApiKeyOrigins: clientMock.updateOrigins,
   testSavedApiKey: clientMock.test,
   notifyKeysChanged: clientMock.notify,
 }));
@@ -121,6 +123,7 @@ function entry(overrides: Partial<ApiKeyEntry>): ApiKeyEntry {
     registered: false,
     usedFor: [],
     canReplace: true,
+    canEditOrigins: true,
     canDelete: true,
     canTest: false,
     ...overrides,
@@ -216,6 +219,15 @@ function typeInto(input: HTMLInputElement, value: string) {
   input.dispatchEvent(new Event("input", { bubbles: true }));
 }
 
+function typeTextarea(input: HTMLTextAreaElement, value: string) {
+  const setter = Object.getOwnPropertyDescriptor(
+    HTMLTextAreaElement.prototype,
+    "value",
+  )!.set!;
+  setter.call(input, value);
+  input.dispatchEvent(new Event("input", { bubbles: true }));
+}
+
 describe("ApiKeysSettingsPage", () => {
   let container: HTMLDivElement;
   let root: Root;
@@ -229,6 +241,7 @@ describe("ApiKeysSettingsPage", () => {
     callActionMock.mockReset();
     navigateMock.mockReset();
     clientMock.save.mockReset();
+    clientMock.updateOrigins.mockReset();
     clientMock.test.mockReset();
     onboardingOutcomeMock.mockReset();
     onboardingAbandonmentRequestMock.mockReset();
@@ -412,6 +425,7 @@ describe("ApiKeysSettingsPage", () => {
       value: "fake-linear-value",
       registered: false,
       shared: false,
+      urlAllowlist: [],
     });
   });
 
@@ -443,6 +457,180 @@ describe("ApiKeysSettingsPage", () => {
       value: "fake-linear-value",
       registered: false,
       shared: true,
+      urlAllowlist: [],
+    });
+  });
+
+  it("sends approved exact origins with a new custom key", async () => {
+    clientMock.save.mockResolvedValue(undefined);
+    await render();
+    const header = await renderHeader();
+    await act(async () => buttonByText("Add key", header).click());
+    const dialog = document.querySelector('[role="dialog"]') as HTMLElement;
+    const [name, value] = [
+      ...dialog.querySelectorAll("input"),
+    ] as HTMLInputElement[];
+    await act(async () => typeInto(name!, "WEBHOOK_TOKEN"));
+    await act(async () => typeInto(value!, "fake-value"));
+    await act(async () =>
+      typeTextarea(
+        dialog.querySelector("textarea")!,
+        "https://api.example.test",
+      ),
+    );
+    await act(async () =>
+      dialog
+        .querySelector("form")!
+        .dispatchEvent(
+          new Event("submit", { bubbles: true, cancelable: true }),
+        ),
+    );
+    expect(clientMock.save).toHaveBeenCalledWith({
+      name: "WEBHOOK_TOKEN",
+      value: "fake-value",
+      registered: false,
+      shared: false,
+      urlAllowlist: ["https://api.example.test"],
+    });
+  });
+
+  it("edits an existing custom key's origins without asking for its value", async () => {
+    state.listing = listing({ keys: [entry({ urlAllowlist: null })] });
+    clientMock.updateOrigins.mockResolvedValue(undefined);
+    await render();
+    expect(row("secrets:STRIPE_SECRET_KEY").textContent).toContain(
+      "No approved origins",
+    );
+    await act(async () =>
+      pointerDown(
+        row("secrets:STRIPE_SECRET_KEY").querySelector(
+          '[aria-label="Manage STRIPE_SECRET_KEY"]',
+        ),
+      ),
+    );
+    const item = [...document.querySelectorAll('[role="menuitem"]')].find(
+      (node) => node.textContent?.trim() === "Edit origins",
+    );
+    if (!item) throw new Error("No origin policy menu item");
+    await act(async () =>
+      item.dispatchEvent(new MouseEvent("click", { bubbles: true })),
+    );
+    const dialog = document.querySelector('[role="dialog"]') as HTMLElement;
+    expect(dialog.querySelector('input[type="password"]')).toBeNull();
+    await act(async () =>
+      typeTextarea(
+        dialog.querySelector("textarea")!,
+        "https://api.example.test",
+      ),
+    );
+    await act(async () =>
+      dialog
+        .querySelector("form")!
+        .dispatchEvent(
+          new Event("submit", { bubbles: true, cancelable: true }),
+        ),
+    );
+    expect(clientMock.updateOrigins).toHaveBeenCalledWith({
+      name: "STRIPE_SECRET_KEY",
+      scope: "user",
+      owner: "user",
+      urlAllowlist: ["https://api.example.test"],
+    });
+    expect(clientMock.save).not.toHaveBeenCalled();
+  });
+
+  it("offers policy editing for a legacy solo row without replacing its value", async () => {
+    state.listing = listing({
+      keys: [
+        entry({
+          name: "OLD_TOKEN",
+          storedScope: "workspace",
+          canReplace: false,
+          canEditOrigins: true,
+          urlAllowlist: null,
+        }),
+      ],
+    });
+    clientMock.updateOrigins.mockResolvedValue(undefined);
+    await render();
+    await act(async () =>
+      pointerDown(
+        row("secrets:user-workspace:OLD_TOKEN").querySelector(
+          '[aria-label="Manage OLD_TOKEN"]',
+        ),
+      ),
+    );
+    const item = [...document.querySelectorAll('[role="menuitem"]')].find(
+      (node) => node.textContent?.trim() === "Edit origins",
+    );
+    if (!item) throw new Error("No origin policy menu item");
+    await act(async () =>
+      item.dispatchEvent(new MouseEvent("click", { bubbles: true })),
+    );
+    const dialog = document.querySelector('[role="dialog"]') as HTMLElement;
+    await act(async () =>
+      typeTextarea(
+        dialog.querySelector("textarea")!,
+        "https://api.example.test",
+      ),
+    );
+    await act(async () =>
+      dialog
+        .querySelector("form")!
+        .dispatchEvent(
+          new Event("submit", { bubbles: true, cancelable: true }),
+        ),
+    );
+    expect(clientMock.updateOrigins).toHaveBeenCalledWith({
+      name: "OLD_TOKEN",
+      scope: "workspace",
+      owner: "user",
+      urlAllowlist: ["https://api.example.test"],
+    });
+    expect(clientMock.save).not.toHaveBeenCalled();
+  });
+
+  it("keeps approved origins when rotating a custom key", async () => {
+    state.listing = listing({
+      keys: [entry({ urlAllowlist: ["https://api.example.test"] })],
+    });
+    clientMock.save.mockResolvedValue(undefined);
+    await render();
+    await act(async () =>
+      pointerDown(
+        row("secrets:STRIPE_SECRET_KEY").querySelector(
+          '[aria-label="Manage STRIPE_SECRET_KEY"]',
+        ),
+      ),
+    );
+    const item = [...document.querySelectorAll('[role="menuitem"]')].find(
+      (node) => node.textContent?.trim() === "Replace value",
+    );
+    if (!item) throw new Error("No replacement menu item");
+    await act(async () =>
+      item.dispatchEvent(new MouseEvent("click", { bubbles: true })),
+    );
+    const dialog = document.querySelector('[role="dialog"]') as HTMLElement;
+    expect(dialog.querySelector("textarea")?.value).toBe(
+      "https://api.example.test",
+    );
+    const value = dialog.querySelector(
+      'input[type="password"]',
+    ) as HTMLInputElement;
+    await act(async () => typeInto(value, "new-fake-value"));
+    await act(async () =>
+      dialog
+        .querySelector("form")!
+        .dispatchEvent(
+          new Event("submit", { bubbles: true, cancelable: true }),
+        ),
+    );
+    expect(clientMock.save).toHaveBeenCalledWith({
+      name: "STRIPE_SECRET_KEY",
+      value: "new-fake-value",
+      registered: false,
+      shared: false,
+      urlAllowlist: ["https://api.example.test"],
     });
   });
 
@@ -532,6 +720,7 @@ describe("ApiKeysSettingsPage", () => {
       value: "fake-custom-value",
       registered: false,
       shared: false,
+      urlAllowlist: [],
     });
 
     await act(async () => buttonByText("Close", dialog).click());
@@ -769,6 +958,7 @@ describe("DeleteKeyDialog", () => {
       value: "fake-voyage-value",
       registered: false,
       shared: true,
+      urlAllowlist: [],
     });
     expect(onSaved).toHaveBeenCalled();
     expect(onOpenChange).toHaveBeenCalledWith(false);

package/src/app/settings/api-keys/ApiKeysSettingsPage.tsx

@@ -23,6 +23,7 @@ import { Skeleton } from "@agent-native/toolkit/ui/skeleton";
 import { TooltipProvider } from "@agent-native/toolkit/ui/tooltip";
 import {
   IconDots,
+  IconLock,
   IconKey,
   IconPlugConnected,
   IconPlus,
@@ -56,6 +57,7 @@ import {
 } from "./api-keys-state.js";
 import {
   DeleteKeyDialog,
+  KeyOriginsDialog,
   KeyValueDialog,
   type KeyValueDialogMode,
 } from "./ApiKeyDialogs.js";
@@ -98,6 +100,9 @@ export default function ApiKeysSettingsPage({ context }: SettingsPageProps) {
     null,
   );
   const [deleting, setDeleting] = useState<ApiKeyEntry | null>(null);
+  const [editingOrigins, setEditingOrigins] = useState<ApiKeyEntry | null>(
+    null,
+  );
   const [provider, setProvider] = useState<ProviderDialogState | null>(null);
   const hashKey = useSecretKeyHash();
   const handledHashKey = useRef<string | null>(null);
@@ -178,6 +183,7 @@ export default function ApiKeysSettingsPage({ context }: SettingsPageProps) {
     onReplace: (entry: ApiKeyEntry) =>
       setValueDialog({ mode: "replace", entry }),
     onDelete: setDeleting,
+    onEditOrigins: setEditingOrigins,
   };
 
   return (
@@ -260,6 +266,15 @@ export default function ApiKeysSettingsPage({ context }: SettingsPageProps) {
           orgName={orgName}
         />
       ) : null}
+      {editingOrigins ? (
+        <KeyOriginsDialog
+          entry={editingOrigins}
+          open
+          onOpenChange={(open) => {
+            if (!open) setEditingOrigins(null);
+          }}
+        />
+      ) : null}
       <ProviderDialog
         open={provider !== null}
         onOpenChange={(open) => {
@@ -311,20 +326,31 @@ function KeyRow({
   onManageProvider,
   onReplace,
   onDelete,
+  onEditOrigins,
 }: {
   entry: ApiKeyEntry;
   onManageProvider: (entry: ApiKeyEntry) => void;
   onReplace: (entry: ApiKeyEntry) => void;
   onDelete: (entry: ApiKeyEntry) => void;
+  onEditOrigins: (entry: ApiKeyEntry) => void;
 }) {
   const t = useT();
   const usedBy = <UsedBy entry={entry} />;
   const hasUse = !!entry.provider || usedByFeatures(entry).length > 0;
+  const custom = !entry.registered && !entry.provider;
   const description: ReactNode = (
     <>
       {entry.masked ? <span className="font-mono">{entry.masked}</span> : null}
       {entry.masked && hasUse ? " · " : null}
       {hasUse ? usedBy : null}
+      {custom && entry.canEditOrigins && (entry.masked || hasUse)
+        ? " · "
+        : null}
+      {custom && entry.canEditOrigins
+        ? entry.urlAllowlist?.length
+          ? t(`${K}originsCount`, { count: entry.urlAllowlist.length })
+          : t(`${K}noApprovedOrigins`)
+        : null}
     </>
   );
 
@@ -353,6 +379,7 @@ function KeyRow({
         entry={entry}
         onReplace={() => onReplace(entry)}
         onDelete={() => onDelete(entry)}
+        onEditOrigins={() => onEditOrigins(entry)}
       />
     );
   }
@@ -365,7 +392,11 @@ function KeyRow({
           <span className="font-mono text-[13px]">{entry.name}</span>
         )
       }
-      description={entry.masked || hasUse ? description : undefined}
+      description={
+        entry.masked || hasUse || (custom && entry.canEditOrigins)
+          ? description
+          : undefined
+      }
       control={control}
     />
   );
@@ -375,10 +406,12 @@ function KeyMenu({
   entry,
   onReplace,
   onDelete,
+  onEditOrigins,
 }: {
   entry: ApiKeyEntry;
   onReplace: () => void;
   onDelete: () => void;
+  onEditOrigins: () => void;
 }) {
   const t = useT();
   const test = async () => {
@@ -400,6 +433,12 @@ function KeyMenu({
         </Button>
       </DropdownMenuTrigger>
       <DropdownMenuContent align="end" className="w-44">
+        {entry.canEditOrigins ? (
+          <DropdownMenuItem onSelect={onEditOrigins}>
+            <IconLock className="size-4" aria-hidden />
+            {t(`${K}editOrigins`)}
+          </DropdownMenuItem>
+        ) : null}
         {entry.canTest ? (
           <DropdownMenuItem onSelect={() => void test()}>
             <IconPlugConnected className="size-4" aria-hidden />

package/src/app/settings/api-keys/api-keys-client.spec.ts

@@ -0,0 +1,49 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import { saveApiKeyValue, updateApiKeyOrigins } from "./api-keys-client.js";
+
+afterEach(() => vi.unstubAllGlobals());
+
+describe("custom key requests", () => {
+  it("sends an approved origin with a new key, then edits only policy metadata", async () => {
+    const requests: Array<{ url: string; init: RequestInit }> = [];
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(async (url: string, init: RequestInit) => {
+        requests.push({ url, init });
+        return new Response(JSON.stringify({ ok: true }), { status: 200 });
+      }),
+    );
+
+    await saveApiKeyValue({
+      name: "WEBHOOK_TOKEN",
+      value: "fake-value",
+      registered: false,
+      shared: true,
+      urlAllowlist: ["https://api.example.test"],
+    });
+    await updateApiKeyOrigins({
+      name: "WEBHOOK_TOKEN",
+      scope: "workspace",
+      owner: "org",
+      urlAllowlist: ["https://new.example.test"],
+    });
+
+    expect(requests[0]?.url).toContain("/_agent-native/secrets/adhoc");
+    expect(JSON.parse(String(requests[0]?.init.body))).toEqual({
+      name: "WEBHOOK_TOKEN",
+      value: "fake-value",
+      scope: "workspace",
+      urlAllowlist: ["https://api.example.test"],
+    });
+    expect(requests[1]?.init.method).toBe("PATCH");
+    expect(requests[1]?.url).toContain(
+      "/_agent-native/secrets/adhoc/WEBHOOK_TOKEN",
+    );
+    expect(JSON.parse(String(requests[1]?.init.body))).toEqual({
+      scope: "workspace",
+      owner: "org",
+      urlAllowlist: ["https://new.example.test"],
+    });
+  });
+});

package/src/app/settings/api-keys/api-keys-client.ts

@@ -11,6 +11,8 @@ export interface SaveApiKeyValueInput {
   registered: boolean;
   /** Ad-hoc keys only: save for everyone in the organization. */
   shared?: boolean;
+  /** Exact outbound origins for a custom key. Omit when rotating to retain the policy. */
+  urlAllowlist?: string[];
 }
 
 async function readError(res: Response): Promise<string | null> {
@@ -41,6 +43,7 @@ export async function saveApiKeyValue({
   value,
   registered,
   shared,
+  urlAllowlist,
 }: SaveApiKeyValueInput): Promise<void> {
   const res = registered
     ? await fetch(`${secretsEndpoint()}/${encodeURIComponent(name)}`, {
@@ -55,6 +58,7 @@ export async function saveApiKeyValue({
           name,
           value,
           scope: shared ? "workspace" : "user",
+          ...(urlAllowlist === undefined ? {} : { urlAllowlist }),
         }),
       });
   if (!res.ok) {
@@ -65,6 +69,34 @@ export async function saveApiKeyValue({
   notifyKeysChanged();
 }
 
+/** Edit a saved custom key's outbound policy without sending its value. */
+export async function updateApiKeyOrigins(input: {
+  name: string;
+  scope: "user" | "org" | "workspace";
+  owner: "user" | "org";
+  urlAllowlist: string[];
+}): Promise<void> {
+  const res = await fetch(
+    `${secretsEndpoint()}/adhoc/${encodeURIComponent(input.name)}`,
+    {
+      method: "PATCH",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        scope: input.scope,
+        owner: input.owner,
+        urlAllowlist: input.urlAllowlist,
+      }),
+    },
+  );
+  if (!res.ok) {
+    throw new Error(
+      (await readError(res)) ??
+        `Could not update ${input.name} (${res.status})`,
+    );
+  }
+  notifyKeysChanged();
+}
+
 /** Remove a registered key's saved value. Throws the server's message. */
 export async function removeApiKeyValue(name: string): Promise<void> {
   const res = await fetch(`${secretsEndpoint()}/${encodeURIComponent(name)}`, {