blue.hearth.entitlement
Proof that a subscriber currently holds a tier. This is the record attested.network deliberately leaves undefined: its payment records prove a payment happened but carry no expiry, revocation or status, so they cannot answer 'is this subscription active right now'. Lives in the SUBSCRIBER's repository, alongside the payment record that granted it. Entitlements are short-lived and RENEWED, never long-lived and revoked: each successful billing cycle writes a fresh record, so cancellation is the observable absence of a renewal rather than a revocation list a verifier must fetch and trust.
Details · record, key tid
| Kind | record |
|---|---|
| Record key | tid |
| Authority | hearth.blue |
| Indexed |
Record
record · key tidProperties
The creator this entitlement is for. Derivable from tier's AT-URI, but stated explicitly so a verifier answering 'does X subscribe to Y' can filter without dereferencing every tier record.
The network.attested.payment.recurring record that granted this. Normally in the same repository, since both the payment record and the entitlement live with the subscriber.
signatures
arraybadge.blue attestations over this record: the creator's proof and the broker's. Left as unknown because badge.blue defines both the inline (ECDSA in-record) and remote (strongRef to a proof record) shapes, and pinning either here would break the other. An entitlement with no signatures is worthless to a verifier and must not be trusted.
active is the normal case and the only one written on renewal. cancelled is optional and terminal, written when a subscriber cancels, so propagation is immediate rather than waiting out validUntil. lapsed marks a known payment failure. A verifier must still check validUntil against the current time: status alone is never sufficient, since an active record whose window has passed is expired. Closed rather than knownValues on purpose — an un-enumerated status is exactly the defect in the spec this record exists to fix, and a verifier that meets a status it does not know cannot safely decide either way, so such a record should fail validation rather than reach the verifier at all. The cost is real: adding a value later (say paused) is a lexicon revision that older validators will reject.
enum: active | cancelled | lapsed
The blue.hearth.tier record granted. A strongRef, so the tier's terms at grant time are pinned by CID and cannot be edited out from under an existing entitlement.
End of the billing period PLUS a grace window. The grace exists because recurring payments bill on anniversary dates with automatic retry: without slack, a card merely awaiting retry reads as lapsed to every independent verifier, and hearth could not correct that, because verifiers do not call hearth.
Similar lexicons
semantic matchLexicons whose schemas describe something close to this one. Check them before publishing a new one that overlaps.
-
blue.hearth.tier
recordA subscription tier offered by a creator. Lives in the creator's repository, so the creator is the repo owner and is not repeated as a field. Tiers are tied to the creator's DID rather than to any publication or app.
-
A recurring payment commitment. Immutable once created — supporters cancel and create new subscriptions to change terms. Bills on anniversary dates with automatic retry on failure.
-
com.atiproto.subscription
recordA record representing a subscription from one user to another
-
support.supper.entitlement
recordA Supper-owned entitlement anchor referenced from attested.network payment records. The record identifies what Supper should unlock or recognize; payment state remains in network.attested.payment.* records and private fulfillment details stay off-protocol.