Takes a file digest and answers which released package version it is. Useful for an artefact found in a container layer, a build directory or an attachment with no metadata attached. Hex and base64 input are both accepted and normalised, the digest length is checked against the declared algorithm before anything is fetched, and the response names every matching package version, since one artefact can be published under more than one coordinate.

Returns the full version history of a package from a single normalised schema that covers seven ecosystems. Versions are ordered by semantic version, not alphabetically and not in registry order, so 1.10.0 sorts after 1.9.0 — the mistake that quietly breaks naive comparisons. For each version you get the publication timestamp, whether it is the registry default, whether it is deprecated and the deprecation reason as the registry states it.