TokenResolver type

A function that resolves an app-only OBS token for the given agent and tenant. Delegated (scp) tokens are not accepted by the S2S service. Implementations may perform synchronous lookup (e.g., in-memory cache) or asynchronous network calls. Used in both batch and per-request modes, independently of workload token context. Return null if a token cannot be provided; export fails without sending an HTTP request.

type TokenResolver = (
  agentId: string,
  tenantId: string
) => string | null | Promise<string | null>