sha256 digest of the compose bundle this version pins.
OptionalimageRecorded tag→digest resolution for the compose images (re-pin source).
The .strict()-valid manifest (renderer input).
Optionalmanifestbase64(DER ECDSA_SHA_256) publish-time signature over the pinned
(name, version, bundleDigest) message (ADR-0012 D4). Absent when the stage
published without a signing key; verify with
verifyCatalogTemplateSignature (@edgible-team/sdk/node).
ISO publish timestamp.
Server-computed signature-verification result (webapp-usability-gaps-2026-07-08.md
§5 item 5) — the backend holds the signing key and self-verifies
manifestSignature at serve time, so the browser never re-implements
Node-only ECDSA verification. null means the platform has no signing key
configured (staged rollout — same case the CLI warns-and-proceeds on);
true/false is the actual verify result (fail-closed: any verification
error is false, never null).
OptionalverifiedISO timestamp of the last successful verification, when any.
Full template detail (GET /catalog/templates/{name}) — carries the manifest.