pkg/

Package crawler retrieves and integrity-checks a remote artifact: fetch (conditional-GET aware, SSRF-guarded, size-capped), digest-check, decode, and self-signature verification against a registry-resolved key.

Package decode turns already-digest-verified artifact bytes into decoded content.

Package crawlmanager is the crawl-side orchestration layer: the two entry points (PollIndexes, SyncNext) that discover indexes, detect which catalogs changed, and resolve+hand off each changed catalog's current content -- built on pkg/catalog's Fetcher and Resolve, which stay backend- and destination-agnostic.

Package publisher is the decentralized-catalog file spec's publish-side orchestration: given a publisher's catalog submissions and their prior state (as pkg/catalog/store already reconstructs it), diff, decide baseline/change/metadata/unchanged, and self-sign the resulting catalog-index entries and files -- RFC NFH-014's signing/diffing/ versioning rules, all of it.

Package store is the one shared, backend-agnostic assembler for a publisher's catalog index: it understands how an index, its catalogs' baselines, change files, and "latest" pointers fit together per the decentralized-catalog file spec, built on top of whichever BlobStore is configured (local disk, S3, GCS, git, an authenticated CDN write root, ...).

Package artifactsigner produces DeDi-style detached-JWS proofs for manifests and catalog indexes, the signing-side counterpart to artifactverifier.VerifyDetachedJWS.