Browser-mode's per-call AM credential source: cloud browser-login mints a
fresh, short-lived, mint-and-discard RFC 8693-exchanged token immediately
before every AM-domain call (see ops/BrowserAuthenticateOps.ts's
exchangeTokenForScope) instead of reusing a cached one. Set on state
by getTokensInteractive() so api/BaseApi.ts — which must never import
from ops/ — can invoke it without knowing anything about token exchange.
Unset for every non-browser auth mode.
Browser-mode's per-call AM credential source: cloud browser-login mints a fresh, short-lived, mint-and-discard RFC 8693-exchanged token immediately before every AM-domain call (see
ops/BrowserAuthenticateOps.ts'sexchangeTokenForScope) instead of reusing a cached one. Set onstatebygetTokensInteractive()soapi/BaseApi.ts— which must never import fromops/— can invoke it without knowing anything about token exchange. Unset for every non-browser auth mode.