Provider that authenticated and read this session. This is evidence about the charge, unlike the site's currently selected provider.

Total amount charged in smallest currency unit (cents), from the payment provider. Validated at the provider boundary alongside its currency, so a malformed amount never reaches a callback.

The three-letter currency the provider charged in. The callbacks refuse a charge in any currency other than the site's — it cannot be honored at the signed total — by treating it as a price mismatch.

When the provider created this checkout, in the ledger's canonical ISO 8601 form (YYYY-MM-DDTHH:mm:ss.sssZ), or undefined if the provider didn't supply a usable timestamp. Each provider normalises its own format (see toCanonicalIso) so this is safe to use directly as a ledger occurredAt. It is the customer's business time, so a payment processed late — a delayed webhook, an old redirect, a stale retry — is still recognised on the day it was paid, not the day we happened to process it.