{"lexicon":1,"id":"money.atmosphere.payment.recurringReceipt","defs":{"main":{"type":"record","key":"tid","description":"EXPERIMENTAL DRAFT — not published; record name decided in NAMING_RFC.md. An immutable SETTLEMENT-EVIDENCE record for the initial settled payment that begins a payer-confirmed recurring relationship, plus the cadence snapshot accepted at enrollment. Explicitly NOT current subscription state: automatic renewals, later tier or cadence changes, merely scheduling a future change, no-charge changes, cancellation, delinquency, and pauses neither create nor update this record. A separately confirmed immediate adjustment that settles money uses money.atmosphere.payment.receipt for that exact settlement; it does not rewrite this record or pretend to encode the new recurring price. The payer action is not by itself publication consent: any new receipt still requires that exact settlement's frozen publication choice and repository authority. A later cancellation followed by a genuinely new enrollment may create a new recurringReceipt for that new relationship's initial settlement. A separate record type is required because Lexicon has no conditional requiredness: the cadence snapshot is required here and absent from money.atmosphere.payment.receipt. Commitment, author-provenance, proof, and policy-dependent lifecycle semantics are identical to money.atmosphere.payment.receipt.","record":{"type":"object","required":["recipient","value","transactionId","transactionIdAuthority","settledAt","nonce","interval","intervalCount","proofs"],"properties":{"recipient":{"type":"string","format":"did","description":"DID of the party receiving the payment."},"value":{"type":"union","refs":["money.atmosphere.payment.defs#fiatMinor","money.atmosphere.payment.defs#assetAtomic"],"description":"The single authoritative value satisfied by the initial settlement that begins this recurring relationship, after applicable discounts and charged tax. It is NOT a promise of the future recurring price. Uses the exact shared fiat-minor or asset-atomic variants defined by money.atmosphere.payment.defs; money-atmosphere-v1 treats every unknown tag as record-invalid. Later adjustments and automatic renewal values are not represented here."},"transactionId":{"type":"string","minLength":1,"maxLength":64,"description":"Opaque public transaction identifier scoped to `transactionIdAuthority`, unique within that authority's namespace per payment, for deduplication; money-atmosphere-v1 requires the exact full-match grammar ^[\\x21-\\x7E]{1,64}$ (visible printable ASCII with no spaces). Lexicon supplies only the byte-length boundary. Never a processor identifier, never a bearer or session token, and not a hiding secret (see `nonce`)."},"transactionIdAuthority":{"type":"string","format":"did","description":"DID whose namespace owns `transactionId`. Producers MUST commit the canonical authority for the accepted settlement, never a caller hint, and include at least one proof reference whose intended authenticated author DID AND proof-URI repository authority both equal this DID. This producer/business-binding rule is separate from stateless proof selection: a money.atmosphere.payment.verifyReceipt#attested result means a trusted proof attested the committed bytes; it does not by itself authenticate this field or claim or authorize the transaction-id binding. Before claiming that binding, a stateful consumer MUST verify at least one applicable, policy-designated proof whose authenticated author DID AND proof-URI repository authority both equal this DID. This field does not by itself designate that proof as a lifecycle authority; lifecycle treatment is an independent verifier-policy decision. Other proof authors or hosting authorities are witnesses only and gain no ownership of this namespace."},"settledAt":{"type":"string","format":"datetime","description":"UTC instant at which the canonical accepted-settlement authority asserts the recurring relationship's initial settlement occurred (millisecond precision, Z suffix). Not the quote, confirmation, checkout-creation, or record-publication time."},"nonce":{"type":"string","minLength":32,"maxLength":32,"description":"Exactly 32 lowercase hexadecimal characters (implementations MUST enforce ^[0-9a-f]{32}$) encoding 128 bits that MUST be generated by a cryptographically secure random generator, once per payment, never derived from other fields, never reused. See money.atmosphere.payment.receipt."},"interval":{"type":"string","minLength":1,"maxLength":16,"knownValues":["day","week","month","year"],"description":"Billing interval unit accepted when the recurring relationship's initial settlement occurred (cadence snapshot)."},"intervalCount":{"type":"integer","minimum":1,"maximum":366,"description":"Multiplier applied to `interval` (e.g. interval=month, intervalCount=3 bills quarterly). The 366 ceiling admits an annual daily cadence including leap years while rejecting implausibly large immutable billing snapshots; ATM's operational subscription-change quote uses a broader 1095 limit because it is an app-private, expiring workflow object rather than this permanent public receipt. Required and always explicit — writers MUST NOT rely on validator-inserted defaults, so one set of terms has exactly one canonical byte form. Terms snapshot only."},"proofs":{"type":"array","maxLength":10,"items":{"type":"ref","ref":"com.atproto.repo.strongRef"},"description":"References to immutable money.atmosphere.payment.proof records in each attester's own repository. Each reference's URI authority identifies its attester, and every cid is the proof's canonical AT repository-record CID string (lowercase unpadded base32 CIDv1, DAG-CBOR, SHA-256/32). Required and fixed at creation: proofs are written FIRST, then the receipt referencing them; the receipt is never updated afterward. Excluded from the attestation commitment (stripped before hashing). V1 candidates are exactly the frozen references in this array. Any future later-attester design must use external discovery rather than editing this record; v1 defines no such discovery mechanism.","minLength":1},"entitlements":{"type":"array","minLength":1,"maxLength":100,"items":{"type":"ref","ref":"com.atproto.repo.strongRef"},"description":"Optional purchase-context strongRefs whose exact committed URI and CID values, when a verifier accepts a trusted proof for this recurring receipt, are bound only to the historical initial-settlement assertion for this recurring relationship so an application can use them as purchase evidence after separately authenticating and validating each referenced record; the proof establishes neither a renewal nor current subscription or term standing, does not prove the target exists or authenticate its author, repository, schema, or meaning, does not make a handle authority durable, and the references are not live entitlement grants or bearer credentials (any lexicon). Every cid is the referenced record's canonical AT repository-record CID string (lowercase unpadded base32 CIDv1, DAG-CBOR, SHA-256/32). By themselves, these references never establish current, unconsumed, unexpired, or unrevoked access; an independent current entitlement authority or source of truth must make access decisions. Line-item detail (quantities, unit prices, per-item tax) is deliberately not public."}}}}}}