It requires the format SPI, the storage SPI and Jackson (to read a manifest's media type and the token-auth response, and to write the tag list), no core - because an OCI blob is addressed by its {@code sha256} digest, exactly the {@code blobs/<hex>} the store already uses. Discovered through {@code provides}.