{
  "$type": "com.atproto.lexicon.schema",
  "defs": {
    "main": {
      "description": "A signed kvcs tag record. Pins a patch by its hex multihash and is itself addressed by the canonical-JSON digest of its tag payload, mirrored on disk as a SignedTag.",
      "key": "any",
      "record": {
        "properties": {
          "digest": {
            "description": "Lower-case hex BLAKE3 multihash of the canonical-JSON tag payload — equals the record's rkey. 128 chars covers the longest hashes in current use.",
            "maxLength": 128,
            "type": "string"
          },
          "jws": {
            "description": "Detached compact JWS over `tag`. 8192 chars covers Ed25519 / ES256 / ES256K compact-JWS sizes with a comfortable margin.",
            "maxLength": 8192,
            "type": "string"
          },
          "name": {
            "description": "Human-readable tag label (e.g. \"v0.1.0\"). Capped at 256 chars — kvcs tag labels are short identifiers similar to git tag names.",
            "maxLength": 256,
            "type": "string"
          },
          "patchId": {
            "description": "Hex multihash of the patch this tag pins. 128 chars covers the longest hashes in current use (BLAKE3, SHA-512, etc.).",
            "maxLength": 128,
            "type": "string"
          },
          "tag": {
            "description": "Canonical JSON of the Tag payload, bytewise identical to the JWS input. 16 KiB is well under goat's 20 KiB `large-string` lint threshold while still being generous for the small structured payloads kvcs emits today; future fields (e.g. signed annotations) still fit comfortably.",
            "maxLength": 16384,
            "type": "string"
          },
          "taggerDid": {
            "description": "DID of the signer, mirrored at the top level so listRecords summaries don't need to parse `tag`. Capped at 2048 chars to accommodate did:jwk values whose method-specific id embeds a base64url-encoded JWK.",
            "maxLength": 2048,
            "type": "string"
          }
        },
        "required": [
          "name",
          "digest",
          "taggerDid",
          "patchId",
          "tag",
          "jws"
        ],
        "type": "object"
      },
      "type": "record"
    }
  },
  "description": "A signed kvcs tag, addressable on the tagger's atproto PDS. The rkey is the canonical-JSON digest of the tag payload (lower-case hex BLAKE3 multihash).",
  "id": "tech.lenooby09.kvcs.tag",
  "lexicon": 1
}