Lexicon Garden

dev.knotless.runnerKey

Kept in the runner's account. An owner seals each secret it gives the runner to this key, with HPKE (RFC 9180) in base mode: DHKEM(P-256, HKDF-SHA256), HKDF-SHA256 and AES-128-GCM, so only the runner, which keeps the private half, can open it. The runner writes it again when its key changes; a value sealed to an older key names that key.

Repository @lexicons.knotless.dev did:plc:yqsg7znbbhfmj3a2nrpnaerk namespace authority
Details · record, key literal:self
Kindrecord
Record keyliteral:self
Authorityknotless.dev
Indexed
Compare Edit in builder → Fork →

Record

record · key literal:self

Properties

createdAt

requiredstring · datetime

When the runner published this key.

key

requiredstring · did

The public key, as a P-256 did:key.

Similar lexicons

semantic match

Lexicons whose schemas describe something close to this one. Check them before publishing a new one that overlaps.

  • dev.knotless.putSecret

    procedure

    Leaves a secret for a repository with one of its runners, sealed to the runner's dev.knotless.runnerKey so the appview holds only ciphertext. The caller is the repository's owner, or an admin who joined the organization that owns it. One there already under the same repository, runner and name is replaced. Requires a service token from the caller's PDS, audience the appview's DID, for this method, or the appview's own pages' login, as their writes take it.

  • ink.resenha.ebookKey

    record

    Which key encrypts the account's ink.resenha.privateEbook files. The key itself stays on the reader's devices; this record only names it, and keeps a copy locked with a recovery key when the reader saved one.

  • ai.newnal.illi.private.custodyKey

    record not from the namespace authority

    The root admin's X25519 custody private key for one home (rkey = homeId), kept in their Private Sphere so logging out or reinstalling the app does not lose it; the app caches it in the Keystore/Keychain.