One artefact of one published version, streamed, unauthenticated

The bytes the manifest's url points at, streamed from the private bucket as the runtime service account. The file must be one the version's own manifest.json lists, so this route serves nothing we did not publish; Content-Length is the size the publisher recorded. Streamed rather than buffered, because Cloud Run cuts a buffered response at 32 MiB. An installer (an installers entry) is served the same way; via=latest marks the redirect from the latest route, for the count alone.