# ATM Dashboard Integration

ATM holds payment truth and the ticketing control plane. Tickets stores canonical
inventory, issued tickets, forms, delivery, grants and admission state inside
ATM. Event apps can provide their own event-branded organizer and buyer UX.

## Current organizer and app surfaces

The organizer event workspace manages types, event/type capacity, attendee
forms, check-in lists, codes, collaborators and lifecycle actions. Dashboard
roles do not replace event ownership. App-owned and creator-owned events use
current organizer control; originating a sale or creating a config does not
permit editing another organizer's event or reading unrelated app sales.

App Tickets exposes event management and scoped sales/delivery tools in the
selected environment. Management includes authorized configuration even for an
event with no paid sales. The app control plane also configures module flags,
fee policy, service-auth, HTTP/XRPC receivers, test events, redrive, scanner
staff grants, QR/wallet options and separate test/live settings.

Use current `manageUrl` and `scannerUrl` locators from ATM responses instead of
constructing dashboard routes. Opening either URL revalidates user authority.
The October dashboard work uses dedicated event workspaces and modal editors;
old deleted summary panels and tab names are not integration contracts.

## Money and attendance

Paid ticket purchases remain in ATM's unified payment ledger and are labeled as
tickets. Authorized details may include event/type, quantity, originating app,
organizer, amount/fees, receipt and proof status. Private ticket tables remain
authoritative for entitlement, check-in and attendance counts.

- Fresh free claims create issued tickets without a payment-ledger row.
- Paid tickets with a 100%-off coupon have a $0 payment row but no public proof.
- Revenue aggregates exclude zero amounts; attendance counts issued tickets.
- Collaboration `revenueShareBps` is manual reconciliation intent, not an
  automatic organizer payout split.

Buyers open their private tickets via `tickets.atmosphere.tickets`; the optional
ATM-hosted event picker/OAuth is on `events.atmosphere.tickets`. Scanner staff
use `scan.atmosphere.tickets`, with explicit event/list grants.

## Visibility boundaries

Apps see their scoped orders, fees, ticket delivery and event operations.
Organizers see only event controls and attendee data permitted by current event
authority. Staff receive only authorized admission and safe display context.
No surface grants unrelated creator KYC/bank/payout access, cross-app sales,
webhook secrets, raw token hashes or reusable pass secrets in dashboard logs.

Generic Products remains the payment catalog. Event types, private capacity,
questions and check-in belong to ticket operations. Transfers, offline admission
and resale need separately supported lifecycle contracts; a feature-map row is
not proof that a public API is available.