The credential that signed the mandate — publicKey is COSE, base64url.
null when the passkey has since been removed from the account: the
server then has no key to verify with, and verified is null too
(0.59.1 — typed non-null before, which read a revoked passkey as a
TypeError at credential.publicKey).
The canonical intent the digest covers: { v, confirmId, tool, args, scope, createdAt, action }.
The server's own re-verification: true / false (see verifyError),
or null when it could not run (no credential) — "could not verify" is
not "did not verify"; a counterparty verifies offline either way.
OptionalverifyWhy verified is false (absent otherwise).
getMandate's response (0.59.0) — the full user-signed approval themandatereceipt summarizes. Field shapes follow the WebAuthn assertion the server kept;verifiedis the server's own re-verification.