{
  "$type": "com.atproto.lexicon.schema",
  "defs": {
    "main": {
      "description": "A cryptographic grant allowing a streaming service to decrypt the artist's music catalog. This record contains the master content key encrypted with the service's public key.",
      "key": "tid",
      "record": {
        "properties": {
          "createdAt": {
            "description": "When the grant was created",
            "format": "datetime",
            "type": "string"
          },
          "expiresAt": {
            "description": "Optional expiration date. After this, the grant should be considered revoked.",
            "format": "datetime",
            "type": "string"
          },
          "serviceDid": {
            "description": "The DID of the streaming service being authorized",
            "format": "did",
            "maxLength": 256,
            "type": "string"
          },
          "wrappedMasterKey": {
            "description": "The Master Content Key (32 bytes) encrypted with the service's public key, base64-encoded. Only the service can decrypt this with their private key.",
            "maxLength": 512,
            "type": "string"
          },
          "wrappedMasterKeyIv": {
            "description": "Base64-encoded IV (12 bytes) used to encrypt the master key. Only present for AES-GCM wrapping; empty for RSA-OAEP.",
            "maxLength": 32,
            "type": "string"
          },
          "wrappingAlgorithm": {
            "default": "RSA-OAEP",
            "description": "The algorithm used to wrap the master key. Currently RSA-OAEP (asymmetric, using the service's public key).",
            "maxLength": 50,
            "type": "string"
          }
        },
        "required": [
          "serviceDid",
          "wrappedMasterKey",
          "createdAt"
        ],
        "type": "object"
      },
      "type": "record"
    }
  },
  "id": "ch.indiemusi.alpha.grant",
  "lexicon": 1
}