{
  "lexicon": 1,
  "id": "net.bisks.keytags.set",
  "defs": {
    "main": {
      "type": "record",
      "description": "A private tag set for one atproto DID, stored under a record key that is HMAC-SHA256(secret, targetDid) as lowercase hex rather than the target's DID itself — the secret is a passphrase typed fresh into the browser each visit and never persisted or transmitted, so the record is publicly readable but the tagged identity stays opaque to anyone without the same secret. One record per tagged DID; re-tagging the same DID with the same secret overwrites this record in place (com.atproto.repo.putRecord) since it hashes to the same rkey. If the tag list is cleared to empty, the client deletes the record outright rather than writing an empty one. Written and read by keytags (https://keytags.bisks.net).",
      "key": "any",
      "record": {
        "type": "object",
        "required": ["tags", "updatedAt"],
        "properties": {
          "tags": {
            "type": "array",
            "maxLength": 64,
            "description": "Free-text tags applied to the (hash-obscured) target DID. The UI enforces no explicit length cap on the array or on individual tags beyond what's listed here — sizes are a generous guess around the chip-input UI.",
            "items": {
              "type": "string",
              "minLength": 1,
              "maxLength": 100,
              "maxGraphemes": 100
            }
          },
          "updatedAt": {
            "type": "string",
            "format": "datetime",
            "description": "When this tag set was last saved, as an ISO 8601 datetime."
          }
        }
      }
    }
  }
}