{"lexicon":1,"id":"money.atmosphere.payment.receipt","defs":{"main":{"type":"record","key":"tid","description":"An immutable settlement-evidence record for one settled payment. The broker-attested profile requires immutable money.atmosphere.payment.proof attestations; evidence of settlement is not necessarily a tax invoice or accounting document. The same receipt bytes may be stored in the author's public repository or a future permissioned Space: authenticated record provenance identifies the author, and a submitting agent does not become that author. Later refunds and disputes append lifecycle evidence and never modify the receipt. A signed receiptRetraction at the receipt's rkey withdraws this exact assertion without creating a successor receipt. A bounded lifecycle read supplies only an authenticated prefix; current published status requires qualified source evidence under COMMITMENT_PROFILE.md and never replaces canonical real-time ledger authority.","record":{"type":"object","required":["recipients","value","settlement","settledAt","nonce","proofs"],"properties":{"recipients":{"type":"array","minLength":1,"maxLength":32,"items":{"type":"ref","ref":"money.atmosphere.payment.defs#recipientScope"},"description":"Authoritative recipient scopes for this single settled obligation, with optional historical purchase contexts. The money-atmosphere-v1 profile admits exactly one recipient scope; multiple scopes require a separately reviewed supported profile. The complete array is committed. It does not allocate the settlement total or grant access. The retired purchases field is not an alias."},"value":{"type":"union","refs":["money.atmosphere.payment.defs#fiatMinor","money.atmosphere.payment.defs#assetAtomic"],"description":"The single authoritative value satisfied by this settlement: either fiat minor units or fungible-asset atomic units. It is the final commercial obligation after discounts and inclusive of charged tax, not necessarily the payer's tender or the recipient's payout currency. The wire union stays open for AT Protocol compatibility, but money-atmosphere-v1 semantically admits exactly these two tags; legacy top-level amount/currency fields and mixed or unknown variants are record-invalid under COMMITMENT_PROFILE.md."},"settlement":{"type":"union","refs":["money.atmosphere.payment.defs#attestedSettlement"],"description":"Committed open settlement union. This profile admits only #attestedSettlement with its exact authority DID and visible-ASCII transactionId; flat transactionId/transactionIdAuthority fields, mixed branches and unknown branches are record-invalid. The attested branch requires at least one proof, including the producer's matching-authority proof. Future chain and Zone branches require separate reviewed semantics; no reserved name grants verification or execution authority."},"settledAt":{"type":"string","format":"datetime","description":"UTC instant at which the canonical accepted-settlement authority asserts the settlement transition occurred (millisecond precision, Z suffix). Not the checkout-creation time and not the record-publication time."},"nonce":{"type":"string","minLength":32,"maxLength":32,"description":"Exactly 32 lowercase hexadecimal characters (implementations MUST enforce ^[0-9a-f]{32}$) encoding 128 bits that MUST be generated by a cryptographically secure random generator, once per payment, never derived from other fields, never reused. Committed with the record. The hiding property (a public proof reveals nothing about an unpublished record's existence) holds only against parties who do not know the nonce and is conditional on its uniform randomness and SHA-256 preimage resistance."},"proofs":{"type":"array","minLength":0,"maxLength":10,"items":{"type":"ref","ref":"com.atproto.repo.strongRef"},"description":"References to immutable money.atmosphere.payment.proof records in each attester's own repository. Each URI authority identifies its attester; each cid is the exact canonical AT repository-record CID. The array is required and fixed at creation. Its schema permits zero entries to reserve later profiles, but the broker-attested profile and every ATM-written receipt require at least one proof. Brokered proofs are written first. proofs is the only field removed from the commitment preimage; settlement remains committed. Receipts are immutable. The optional recipient acknowledgment is independently discovered at the full commitment-CID key specified by COMMITMENT_PROFILE.md; it may be published later and never edits this array. Every reference whose URI authority is committed settlement.authority must have a canonical 13-character TID key or the whole receipt is record-invalid. Only that committed broker role supplies lifecycle candidates; unrelated non-broker references are raw observations."}}}}}}