TokenResolver type
A function that resolves an app-only OBS token for the given agent and tenant. Delegated (scp) tokens are not accepted by the S2S service. Implementations may perform synchronous lookup (e.g., in-memory cache) or asynchronous network calls. Used in both batch and per-request modes, independently of workload token context. Return null if a token cannot be provided; export fails without sending an HTTP request.
type TokenResolver = (
agentId: string,
tenantId: string
) => string | null | Promise<string | null>