Process-wide cache of resolved CredentialSettings instances keyed by a hash of the merged credential section content. Resolver-matched entries are additionally keyed by the reference-identity hash of the resolver instance that produced the provider, so two callers with identical effective config that share a resolver instance also share one settings instance (and the token-layer cache inside the provider). Distinct resolver instances (even of the same type) get distinct cache entries — a custom resolver carrying instance state (e.g., per-host secrets) cannot leak its provider into another caller's chain. Chain-owning resolvers — identified by invoking resolveChild during TryResolve — are NOT cached; each resolution builds a fresh wrapper that composes cached leaf providers via resolveChild, so the token-layer cache lives on the leaves where it belongs and a chain wrapper cannot leak its captured chain across callers. Inline credential sections that no resolver claims are cached under a single section-only key, so the inline-ApiKey path benefits from caching too.