Seal the outbound invariants onto a request, idempotently. A followed redirect could re-send a credential cross-host or steer an anonymous fetch past the host allowlist.

Apply the ecosystem's injected credential attach, then seal the result through sealRequest. The attach runs first, so it cannot reopen redirect following.

One ecosystem's credential presentation, recovered as a value so an attach re-encodes rather than replaying a header. The constructor is hidden, so no adapter spells its own attach point.

Declare an ecosystem's credential presentation. The constructor is hidden, so this is the only way to build a CredentialMapping.

Nothing for a request carrying none in this ecosystem's form, which the edge gate denies rather than half-reading. The compare is over the secret half alone.

Attach a credential to an outbound request under the mapping's own header, then finalise it through finaliseRequest. A Nothing attaches no header, and the seal still applies.

The first Authorization header's remainder when it carries scheme (compared without case), with the separating spaces dropped. Another scheme or no header yields Nothing.

Build the artifact GET at the URL a projection preserved from upstream. Non-decompressing, so the bytes the served integrity digest is paired with are never gunzipped.

Parse a URL into the sealed request every adapter builds from (sealRequest). The URL comes from configuration and an already-safe name, so a parse failure here is a configuration fault.