{
  "$schema": "https://mandateshield.com/schemas/release-manifest/v1",
  "schema_version": "1.0.0",
  "release": {
    "product": "MandateShield",
    "product_version": "1.4.0",
    "specification_version": "2.2.0",
    "released_at": "2026-07-25T22:05:00.000Z"
  },
  "attestation": {
    "first_party": true,
    "independent": false,
    "source_public": false,
    "reproducible": false
  },
  "integrity": {
    "algorithm": "SHA-256",
    "checksum_file": "/sdk/v1.4.0/SHA256SUMS",
    "artifacts": [
      {
        "name": "MandateShield JavaScript SDK",
        "media_type": "text/javascript",
        "path": "/sdk/v1.4.0/mandateshield.mjs",
        "bytes": 22461,
        "sha256": "2ae30689d8b487f9dec49ea9ad01e73ae3fb3a638fd10ac15e05cf3110fbf191"
      },
      {
        "name": "MandateShield CLI",
        "media_type": "text/javascript",
        "path": "/sdk/v1.4.0/mandateshield-cli.mjs",
        "bytes": 42805,
        "sha256": "fe565184a5916d2cfcff7c30ac08b5213d7554406b3a27e5455b6d6931dbcb66"
      },
      {
        "name": "MandateShield offline receipt verifier",
        "media_type": "text/javascript",
        "path": "/sdk/v1.4.0/mandateshield-receipt-verifier.mjs",
        "bytes": 12231,
        "sha256": "5f88048f4a5455d48c9c6897c32b4d8adfeb8b4f27e32d59fc8bdc0fcf12479a"
      },
      {
        "name": "MandateShield customer-side execution gateway",
        "media_type": "text/javascript",
        "path": "/sdk/v1.4.0/mandateshield-gateway.mjs",
        "bytes": 28458,
        "sha256": "038cff4da2a686da9c2af227d8a41f72a9e09fb7f3548a1b5643e0935f08f0ee"
      },
      {
        "name": "MandateShield Stripe PaymentIntents adapter",
        "media_type": "text/javascript",
        "path": "/sdk/v1.4.0/mandateshield-stripe-payment-intents.mjs",
        "bytes": 17816,
        "sha256": "344c124c5c10dc692d946d9d7d22df7ed26b7b7425b2a863a60993c602a3e984"
      },
      {
        "name": "SPDX software bill of materials",
        "media_type": "application/spdx+json",
        "path": "/evidence/v1.4.0/sbom.spdx.json",
        "bytes": 513766,
        "sha256": "70252cbdeebbabe9526b91d3f65af46c51af0f4e67db3bf205d607037c434ec3"
      }
    ]
  },
  "verification": {
    "scope": "Byte integrity of the listed public release artifacts at the stated paths.",
    "procedure": "Download every integrity.artifacts path into one directory using its final filename, download /sdk/v1.4.0/SHA256SUMS into that directory, then run sha256sum -c SHA256SUMS."
  },
  "limitations": [
    "This is a first-party release record, not an independent security audit.",
    "The product source is not public, so these artifacts do not establish source-to-binary reproducibility.",
    "Checksums establish byte identity only; they do not establish runtime security, availability, or protocol conformance."
  ]
}