Build a File Digest Manifest
file.generate_manifest
Overview
When you need to prove what files you are handing off, we build a deterministic digest inventory over your managed file references: logical name, byte size, cryptographic digest, and content-detected media type for each entry. You choose JSON, coreutils-compatible sha256sum, or CSV output (CSV cells are neutralized against spreadsheet formula injection). We validate logical names for path safety before reading any bytes. This is a digest inventory only — do not use it to create ZIP archives, sign attestations, or transform file content. Archive members cost 1 execution credit per 10 members, rounded up, minimum 1, capped at 500 members (50 credits).
Agents and pipelines need a verifiable, repeatable inventory before they move or process managed files — without guessing checksums or trusting filenames alone.
Reliability
Manifest contents are stable for a fixed format and sort order — the same files render the same manifest, and manifestDigest pins the exact text you received. A requested manifestFileRef is newly allocated and varies between calls, while retrying remains safe. Media types come from sniffing the leading bytes of each file, never from caller metadata. A reference resolves only inside your own tenant, and one that has expired comes back as a validation error saying it is not found or not accessible — upload the file again and call us with the fresh reference. None of the typed failures improve on retry. MANIFEST_FILE_LIMIT_EXCEEDED means you sent more than 500 references, so split the set into batches and combine the manifests yourself. MANIFEST_READ_BUDGET_EXCEEDED means the files together crossed the 256 MiB read budget (any single file may still reach 100 MiB), so batch them the same way. MANIFEST_LOGICAL_NAME_INVALID means a logicalName was blank or unsafe — absolute, backslashed, containing .. or a drive letter, or carrying control characters — so send a plain relative name instead. MANIFEST_LOGICAL_NAME_DUPLICATE means two entries resolved to the same logicalName, and a manifest keys on that name, so rename one of them and call again. MANIFEST_FORMAT_UNSUPPORTED means options.format fell outside json, sha256sum, and csv, while MANIFEST_ALGORITHM_UNSUPPORTED means options.algorithm fell outside SHA-256, SHA-512, and SHA3-256 — pick a listed value. MANIFEST_DUPLICATE_DIGEST behaves differently: it arrives in findings[] as a warning when identical bytes appear under two names, and the call still succeeds.
Context footprint
Returns structured entries, the rendered manifest (or a manifestFileRef when outputAs is file_ref), manifestDigest, and any findings. Archive members cost 1 execution credit per 10 members, rounded up, minimum 1, capped at 500 members (50 credits). The files array names those members, so we reserve from that count until settlement reports the members actually hashed.
When to use it
When you want digests, sizes, and detected media types for a set of managed file references in a shareable manifest format.
When you need a ZIP archive, a signed attestation, or to change file content. When any reference is a zero-byte upload — the file API does not accept empty uploads.
Scope
Non-goals
- No archive creation
- No manifest signing
- No content transformation
- No server filesystem traversal
Properties
Capabilities
Cost & billing
1 execution credit per 10 archive members, rounded up, reserved from the request and capped at 500 members (50 credits).
File handling
File limits
Constraints this skill applies to your input and generated files. The “Limited by” column shows the static source of each cap; none of these can be raised by upgrading your plan.
| Limit | Value | Limited by |
|---|---|---|
| Maximum size per input file | 50 MiB | Platform maximum |
| Maximum total input size | 256 MiB | Skill maximum |
| Maximum number of input files | 500 | Skill maximum |
How we handle your data
What this means
This skill may temporarily store files or intermediate data only to complete execution. Temporary data is protected and automatically deleted.
Squillify guarantees
- Runs inside Squillify
- This skill runs inside Squillify.
- Payloads are not sent to an external service by this skill.
- Temporary execution only storage
- Squillify does not permanently store submitted payloads.
- Telemetry records metadata only, not submitted content.
- Submitted payloads are not used for training.
- Submitted payloads are not reviewed by humans.
- This skill does not target sensitive data.
- The response may contain submitted or transformed content.
Your responsibility
Squillify does not determine whether submitted content is sensitive. Your application is responsible for deciding what data it is allowed to submit. Your application is responsible for securing the response.
Input schema
| Field | Type | Required | Description |
|---|---|---|---|
| files | array | Yes | From 1 through 500 closed {ref, logicalName} managed-file objects included in the manifest. |
| options | object | No | Closed algorithm, format, sort, outputAs, and includeMediaType options; omit it to apply every documented default. |
Output schema
| Field | Type | Required | Description |
|---|---|---|---|
| entries | array | Yes | From 1 through 500 closed digest entry objects sorted by the applied ordering policy. |
| fileCount | integer | Yes | Number of manifest entries. |
| totalBytes | integer | Yes | Total bytes read across all files. |
| algorithm | string | Yes | Digest algorithm applied. |
| manifestDigest | string | Yes | Digest of the exact rendered manifest text. |
| rendered | string | No | Rendered manifest text for inline delivery. |
| manifestFileRef | string | No | Managed output reference for file_ref delivery. |
| findings | array | Yes | From 0 through 500 closed duplicate-digest finding objects; empty when none occurred. |
| _meta | object | Yes | Closed receipt object containing the effective sort, format, and duplicateDigestCount properties. |
API contract
POST /v1/executecurl -sS -X POST "$BASE/v1/execute" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d '{"skillKey":"file.generate_manifest","input":{"files":[{"ref":"squillify://files/f-1","logicalName":"report.csv"}]}}'import { Squillify } from "@squillify/sdk";
const sq = new Squillify({ apiKey: process.env.SQUILLIFY_API_KEY });
const { output } = await sq.execute("file.generate_manifest", {"options":{"sort":"logical_name","format":"json"},"files":[{"ref":"squillify://files/f-alpha","logicalName":"a.txt"},{"ref":"squillify://files/f-beta","logicalName":"b.txt"}]});Errors
| Code | HTTP | Retryable | Description |
|---|---|---|---|
| VALIDATION_ERROR | 400 | No | The request payload failed schema validation. |
| UNAUTHORIZED | 401 | No | Missing or invalid API key. |
| SKILL_NOT_ACCESSIBLE | 403 | No | The API key is not granted access to this skill. |
| SKILL_NOT_AVAILABLE_FOR_PLAN | 403 | No | This skill is not included in your current plan. |
| PLAN_ELIGIBILITY_UNAVAILABLE | 503 | Yes | Plan eligibility could not be decided. Retry after backoff. |
| SKILL_NOT_FOUND | 404 | No | The requested skill or version does not exist. |
| TENANT_RATE_LIMITED | 429 | Yes | Request rate limit exceeded. Retry after backoff. |
| QUOTA_EXCEEDED | 429 | Yes | Plan quota exhausted. Retryable once the quota period resets. |
| EXECUTION_TIMEOUT | 504 | Yes | Execution exceeded the allowed time budget. |
| MANIFEST_FILE_LIMIT_EXCEEDED | 429 | No | A size, quota, rate, or time limit was exceeded. |
| MANIFEST_READ_BUDGET_EXCEEDED | 429 | No | A size, quota, rate, or time limit was exceeded. |
| MANIFEST_LOGICAL_NAME_INVALID | 400 | No | The request payload failed this skill's input validation. |
| MANIFEST_LOGICAL_NAME_DUPLICATE | 400 | No | The request payload failed this skill's input validation. |
| MANIFEST_FORMAT_UNSUPPORTED | 400 | No | The skill does not support the requested variant. |
| MANIFEST_ALGORITHM_UNSUPPORTED | 400 | No | The skill does not support the requested variant. |
Other limits
| Limit | Value |
|---|---|
| Recommended inline bytes | 32 KiB |
Limitations
- No archive creation
- No manifest signing
- No content transformation
- No server filesystem traversal
- Packaging files into a ZIP (use file.create_zip)
- Cryptographic attestation or signing (use security.generate_hmac)
- Upload policy enforcement (use file.validate_upload_constraints)
How to call
POST /v1/execute (requires authentication)
{
"skillKey": "file.generate_manifest",
"input": {
"options": {
"sort": "logical_name",
"format": "json"
},
"files": [
{
"ref": "squillify://files/f-alpha",
"logicalName": "a.txt"
},
{
"ref": "squillify://files/f-beta",
"logicalName": "b.txt"
}
]
}
}Examples
Verify a two-file export before handoff
{
"options": {
"sort": "logical_name",
"format": "json"
},
"files": [
{
"ref": "squillify://files/f-alpha",
"logicalName": "a.txt"
},
{
"ref": "squillify://files/f-beta",
"logicalName": "b.txt"
}
]
}{
"findings": [],
"algorithm": "SHA-256",
"entries": [
{
"logicalName": "a.txt",
"mediaTypeSource": "MAGIC_BYTES",
"mediaType": "text/plain",
"algorithm": "SHA-256",
"digest": "8ed3f6ad685b959ead7022518e1af76cd816f8e8ec7ccdda1ed4018e8f2223f8",
"sizeBytes": 5
},
{
"logicalName": "b.txt",
"mediaTypeSource": "MAGIC_BYTES",
"mediaType": "text/plain",
"algorithm": "SHA-256",
"digest": "f44e64e75f3948e9f73f8dfa94721c4ce8cbb4f265c4790c702b2d41cfbf2753",
"sizeBytes": 4
}
],
"fileCount": 2,
"manifestDigest": "af5a2b7b59259e458968738a69d08e9da73d854bddad0eb85ea7861e3b93a7df",
"rendered": "[{\"logicalName\":\"a.txt\",\"sizeBytes\":5,\"digest\":\"8ed3f6ad685b959ead7022518e1af76cd816f8e8ec7ccdda1ed4018e8f2223f8\",\"algorithm\":\"SHA-256\",\"mediaType\":\"text/plain\",\"mediaTypeSource\":\"MAGIC_BYTES\"},{\"logicalName\":\"b.txt\",\"sizeBytes\":4,\"digest\":\"f44e64e75f3948e9f73f8dfa94721c4ce8cbb4f265c4790c702b2d41cfbf2753\",\"algorithm\":\"SHA-256\",\"mediaType\":\"text/plain\",\"mediaTypeSource\":\"MAGIC_BYTES\"}]",
"_meta": {
"format": "json",
"sort": "logical_name",
"duplicateDigestCount": 0
},
"totalBytes": 9
}coreutils-compatible checksum list for a release bundle
{
"options": {
"sort": "logical_name",
"format": "sha256sum"
},
"files": [
{
"ref": "squillify://files/f-alpha",
"logicalName": "a.txt"
},
{
"ref": "squillify://files/f-beta",
"logicalName": "b.txt"
}
]
}{
"findings": [],
"algorithm": "SHA-256",
"entries": [
{
"logicalName": "a.txt",
"mediaTypeSource": "MAGIC_BYTES",
"mediaType": "text/plain",
"algorithm": "SHA-256",
"digest": "8ed3f6ad685b959ead7022518e1af76cd816f8e8ec7ccdda1ed4018e8f2223f8",
"sizeBytes": 5
},
{
"logicalName": "b.txt",
"mediaTypeSource": "MAGIC_BYTES",
"mediaType": "text/plain",
"algorithm": "SHA-256",
"digest": "f44e64e75f3948e9f73f8dfa94721c4ce8cbb4f265c4790c702b2d41cfbf2753",
"sizeBytes": 4
}
],
"fileCount": 2,
"manifestDigest": "6a5df6bc8625fca38b9b5a86bd2ca161f907b97569fc7f2b771f2883301740e8",
"rendered": "8ed3f6ad685b959ead7022518e1af76cd816f8e8ec7ccdda1ed4018e8f2223f8 a.txt\nf44e64e75f3948e9f73f8dfa94721c4ce8cbb4f265c4790c702b2d41cfbf2753 b.txt\n",
"_meta": {
"format": "sha256sum",
"sort": "logical_name",
"duplicateDigestCount": 0
},
"totalBytes": 9
}Spot identical content under different filenames
{
"files": [
{
"ref": "squillify://files/f-dup",
"logicalName": "one.txt"
},
{
"ref": "squillify://files/f-dup",
"logicalName": "two.txt"
}
]
}{
"findings": [
{
"digest": "0967115f2813a3541eaef77de9d9d5773f1c0c04314b0bbfe4ff3b3b1c55b5d5",
"logicalNames": [
"one.txt",
"two.txt"
],
"code": "MANIFEST_DUPLICATE_DIGEST",
"message": "Identical digest under multiple logical names",
"severity": "warning"
}
],
"algorithm": "SHA-256",
"entries": [
{
"logicalName": "one.txt",
"mediaTypeSource": "MAGIC_BYTES",
"mediaType": "text/plain",
"algorithm": "SHA-256",
"digest": "0967115f2813a3541eaef77de9d9d5773f1c0c04314b0bbfe4ff3b3b1c55b5d5",
"sizeBytes": 4
},
{
"logicalName": "two.txt",
"mediaTypeSource": "MAGIC_BYTES",
"mediaType": "text/plain",
"algorithm": "SHA-256",
"digest": "0967115f2813a3541eaef77de9d9d5773f1c0c04314b0bbfe4ff3b3b1c55b5d5",
"sizeBytes": 4
}
],
"fileCount": 2,
"manifestDigest": "e3202d475d09ee029e0b29976fcbebe61b53f10e23a73e4eb66f9a9b997488e2",
"rendered": "[{\"logicalName\":\"one.txt\",\"sizeBytes\":4,\"digest\":\"0967115f2813a3541eaef77de9d9d5773f1c0c04314b0bbfe4ff3b3b1c55b5d5\",\"algorithm\":\"SHA-256\",\"mediaType\":\"text/plain\",\"mediaTypeSource\":\"MAGIC_BYTES\"},{\"logicalName\":\"two.txt\",\"sizeBytes\":4,\"digest\":\"0967115f2813a3541eaef77de9d9d5773f1c0c04314b0bbfe4ff3b3b1c55b5d5\",\"algorithm\":\"SHA-256\",\"mediaType\":\"text/plain\",\"mediaTypeSource\":\"MAGIC_BYTES\"}]",
"_meta": {
"format": "json",
"sort": "logical_name",
"duplicateDigestCount": 1
},
"totalBytes": 8
}Recommended use cases
- Verify a bundle before transfer or ingestion
- Pin content digests for audit or reconciliation
- Detect identical bytes stored under different logical names
Avoid for
- Packaging files into a ZIP (use file.create_zip)
- Cryptographic attestation or signing (use security.generate_hmac)
- Upload policy enforcement (use file.validate_upload_constraints)
Related skills
Composable with
Safety & privacy
- Runs without calling any external service.
- Your payloads are never stored permanently.
- Telemetry captures metadata only — never your payload contents.
- We never train models on your payloads.
- No human reviews your payloads.