Returns a currently-valid access token, acquiring or renewing it internally as needed (e.g. an OAuth2 client_credentials grant). Unlike TokenRefresher there is no pre-existing token to fall back to on the very first call, so implementations may throw when no valid token can be obtained at all — the executor lets that propagate as-is rather than forcing it through the HTTP-response-shaped error handling used for a failed tool call.
OAuth2 client_credentials-grant AccessTokenProvider: a machine-to-machine flow with no user involved and no refresh_token, so the only operation is "fetch a token, cache it, fetch a new one again once it's close to expiry." Out of scope by design (the caller's responsibility, not this library's): authorization_code/PKCE flows and refresh_token rotation — see Oauth2RefreshTokenRefresher for that grant type instead.