{
  "$type": "com.atproto.lexicon.schema",
  "defs": {
    "main": {
      "description": "Leaves a secret for one of the caller's repositories with one of its runners, sealed to the runner's dev.knotless.runnerKey so the appview holds only ciphertext. The caller is the repository's owner. One there already under the same repository, runner and name is replaced. Requires a service token from the caller's PDS, audience the appview's DID, for this method, or the appview's own pages' login, as their writes take it.",
      "input": {
        "encoding": "application/json",
        "schema": {
          "properties": {
            "key": {
              "description": "The runner's key it is sealed to, a did:key.",
              "format": "did",
              "type": "string"
            },
            "name": {
              "description": "The secret's name, as a workflow's `secrets` lists it: a shell variable's name, not one starting KNOTLESS_RUN.",
              "maxLength": 64,
              "type": "string"
            },
            "refs": {
              "description": "The refs whose pushes it reaches, as a trigger's `refs` match them; absent for every push.",
              "items": {
                "ref": "dev.knotless.listSecrets#refPattern",
                "type": "ref"
              },
              "maxLength": 16,
              "type": "array"
            },
            "repo": {
              "description": "The repository's key, as its dev.knotless.repo record holds it: a rename keeps it.",
              "maxLength": 32,
              "type": "string"
            },
            "runner": {
              "description": "The runner it is sealed to.",
              "format": "did",
              "type": "string"
            },
            "sealed": {
              "description": "The value sealed with HPKE to `key`, bound to the caller, `repo`, `runner`, `name` and `refs`: the encapsulated key, then the ciphertext.",
              "maxLength": 16465,
              "type": "bytes"
            }
          },
          "required": [
            "repo",
            "runner",
            "name",
            "key",
            "sealed"
          ],
          "type": "object"
        }
      },
      "output": {
        "encoding": "application/json",
        "schema": {
          "properties": {},
          "type": "object"
        }
      },
      "type": "procedure"
    }
  },
  "id": "dev.knotless.putSecret",
  "lexicon": 1
}