Between building an artifact and shipping it, plenty can change it: a partial copy, a stray log file, a rerun that quietly produced different bytes. A manifest pins exactly what the build produced, so a later step can prove the directory still holds it.
This walkthrough uses the tool's public README and checked-in example files. Run the command from a repository checkout with Node.js 22+.
Run the checked-in example
# record what the build produced
node bin/artifact-manifest-generator.mjs generate ./dist \
--build '{"id":"build-42","revision":"abc123"}' \
--output dist-manifest.json
# later, prove the directory still holds it
node bin/artifact-manifest-generator.mjs verify ./dist --manifest dist-manifest.json