{"lexicon":1,"id":"money.atmosphere.payment.receipt","defs":{"main":{"type":"record","key":"tid","description":"An immutable settlement-evidence record for one settled payment. The processor profile requires immutable money.atmosphere.payment.proof attestations; evidence of settlement is not necessarily a tax invoice or accounting document. The same receipt bytes may be stored in the author's public repository or a future permissioned Space: authenticated record provenance identifies the author, and a submitting agent does not become that author. Later refunds and disputes append lifecycle evidence and never modify the receipt. A signed receiptRetraction at the receipt's rkey withdraws this exact assertion without creating a successor receipt. A bounded lifecycle read supplies only an authenticated prefix; current published status requires qualified source evidence under COMMITMENT_PROFILE.md and never replaces canonical real-time ledger authority.","record":{"type":"object","required":["recipient","value","settlement","settledAt","nonce","proofs"],"properties":{"recipient":{"type":"string","format":"did","description":"DID of the party receiving the payment."},"value":{"type":"union","refs":["money.atmosphere.payment.defs#fiatMinor","money.atmosphere.payment.defs#assetAtomic"],"description":"The single authoritative value satisfied by this settlement: either fiat minor units or fungible-asset atomic units. It is the final commercial obligation after discounts and inclusive of charged tax, not necessarily the payer's tender or the recipient's payout currency. The wire union stays open for AT Protocol compatibility, but money-atmosphere-v1 semantically admits exactly these two tags; legacy top-level amount/currency fields and mixed or unknown variants are record-invalid under COMMITMENT_PROFILE.md."},"settlement":{"type":"union","refs":["money.atmosphere.payment.defs#processorSettlement"],"description":"Committed open settlement union. This profile admits only #processorSettlement with its exact authority DID and visible-ASCII transactionId; flat transactionId/transactionIdAuthority fields, mixed branches and unknown branches are record-invalid. The processor branch requires at least one proof, including the producer's matching-authority proof. Future chain and Zone branches require separate reviewed semantics; no reserved name grants verification or execution authority."},"settledAt":{"type":"string","format":"datetime","description":"UTC instant at which the canonical accepted-settlement authority asserts the settlement transition occurred (millisecond precision, Z suffix). Not the checkout-creation time and not the record-publication time."},"nonce":{"type":"string","minLength":32,"maxLength":32,"description":"Exactly 32 lowercase hexadecimal characters (implementations MUST enforce ^[0-9a-f]{32}$) encoding 128 bits that MUST be generated by a cryptographically secure random generator, once per payment, never derived from other fields, never reused. Committed with the record. The hiding property (a public proof reveals nothing about an unpublished record's existence) holds only against parties who do not know the nonce and is conditional on its uniform randomness and SHA-256 preimage resistance."},"proofs":{"type":"array","minLength":0,"maxLength":10,"items":{"type":"ref","ref":"com.atproto.repo.strongRef"},"description":"References to immutable money.atmosphere.payment.proof records in each attester's own repository. Each URI authority identifies its attester; each cid is the exact canonical AT repository-record CID. The array is required and fixed at creation. Its schema permits zero entries to reserve later profiles, but the processor profile and every ATM-written receipt require at least one proof. Brokered proofs are written first. proofs is the only field removed from the commitment preimage; settlement remains committed. Receipts are immutable. The optional recipient acknowledgment is independently discovered at the full commitment-CID key specified by COMMITMENT_PROFILE.md; it may be published later and never edits this array. Every reference whose URI authority is committed settlement.authority must have a canonical 13-character TID key or the whole receipt is record-invalid. Only that committed broker role supplies lifecycle candidates; unrelated non-broker references are raw observations."},"entitlements":{"type":"array","minLength":1,"maxLength":100,"items":{"type":"ref","ref":"com.atproto.repo.strongRef"},"description":"Optional purchase-context strongRefs whose exact committed URI and CID values, when a verifier accepts a trusted proof for the receipt, are bound to the historical settlement assertion so an application can use them as purchase evidence after separately authenticating and validating each referenced record; the payment proof does not prove the target exists or authenticate its author, repository, schema, or meaning, does not make a handle authority durable, and the references are not live entitlement grants or bearer credentials (any lexicon). Every cid is the referenced record's canonical AT repository-record CID string (lowercase unpadded base32 CIDv1, DAG-CBOR, SHA-256/32). By themselves, these references never establish current, unconsumed, unexpired, or unrevoked access; an independent current entitlement authority or source of truth must make access decisions. Line-item detail (quantities, unit prices, per-item tax) is deliberately not public."},"discount":{"type":"ref","ref":"com.atproto.repo.strongRef","description":"Optional strongRef to the public offer terms (for example a money.atmosphere.discount record) under which this settlement's value was reduced. It is committed exactly like an entitlements entry: when a verifier accepts a trusted proof for the receipt, the exact committed uri and cid are bound to the historical settlement assertion, so a reduced or zero value is explainable by separately dereferencing, authenticating, and validating the referenced terms. The payment proof does not prove the target exists or authenticate its author, repository, schema, or meaning. The reference carries no customer-facing code, eligibility fact, or redemption state (codes and their counters stay private), and its absence asserts nothing about whether a discount applied. The cid is the referenced record's canonical AT repository-record CID string (lowercase unpadded base32 CIDv1, DAG-CBOR, SHA-256/32). The payment proof does not establish that the referenced terms were applied or that the value derives from them."},"price":{"type":"ref","ref":"com.atproto.repo.strongRef","description":"Optional strongRef to the public posted terms (for example a money.atmosphere.price record) under which this settlement's value was computed. It is committed exactly like an entitlements entry: when a verifier accepts a trusted proof for the receipt, the exact committed uri and cid are bound to the historical settlement assertion, so the value is explainable against the referenced terms by separately dereferencing, authenticating, and validating them. The payment proof does not prove the target exists or authenticate its author, repository, schema, or meaning. The reference carries no quantity, tax, or line-item breakdown, does not restate the amount (value remains the single authoritative settled obligation), and its absence asserts nothing about how the value was computed. The cid is the referenced record's canonical AT repository-record CID string (lowercase unpadded base32 CIDv1, DAG-CBOR, SHA-256/32). The payment proof does not establish that the referenced terms produced the value or that the value derives from them."}}}}}}