{
  "lexicon": 1,
  "id": "net.bisks.alicemeetsbob.crush",
  "defs": {
    "main": {
      "type": "record",
      "description": "An encrypted 'crush' note, filed against a rkey that only the sender and the intended recipient can ever compute (an HKDF-derived tag over an ECDH shared secret between the two accounts' net.bisks.alicemeetsbob.pubkey keys). The record carries no subject/recipient field by design — unlinkability is the point, a repo browser sees only an opaque tag and ciphertext. A match is detected client-side by checking whether the other person's crush collection contains a record at the same tag-derived rkey. Written and read by alice-meets-bob (https://alice-meets-bob.bisks.net).",
      "key": "any",
      "record": {
        "type": "object",
        "required": ["ciphertext", "iv", "createdAt"],
        "properties": {
          "ciphertext": {
            "type": "string",
            "maxLength": 2000,
            "description": "Base64-encoded AES-256-GCM ciphertext of the crush note (plaintext capped at 200 UTF-16 code units by the UI's input field), encrypted with a key derived via HKDF from the ECDH shared secret between sender and recipient."
          },
          "iv": {
            "type": "string",
            "maxLength": 64,
            "description": "Base64-encoded 12-byte AES-GCM initialization vector used to encrypt ciphertext."
          },
          "createdAt": {
            "type": "string",
            "format": "datetime",
            "description": "When this crush was filed, as an ISO 8601 datetime."
          }
        }
      }
    }
  }
}