{
  "$type": "com.atproto.lexicon.schema",
  "defs": {
    "main": {
      "description": "One per account. Written once, by the first device that makes a key, so two devices can't each make their own.",
      "key": "literal:self",
      "record": {
        "properties": {
          "createdAt": {
            "format": "datetime",
            "type": "string"
          },
          "keyId": {
            "description": "A fingerprint of the key, derived from it, that can't be used to find the key.",
            "maxLength": 64,
            "type": "string"
          },
          "recovery": {
            "description": "The key, encrypted with a recovery key that only the reader holds. Absent until the reader saves a recovery key.",
            "maxLength": 256,
            "type": "bytes"
          }
        },
        "required": [
          "keyId",
          "createdAt"
        ],
        "type": "object"
      },
      "type": "record"
    }
  },
  "description": "Which key encrypts the account's ink.resenha.privateEbook files. The key itself stays on the reader's devices; this record only names it, and keeps a copy locked with a recovery key when the reader saved one.",
  "id": "ink.resenha.ebookKey",
  "lexicon": 1
}