Simplify BYOK bearer-token contract: drop scope and expiry

Mirror the runtime contract simplification: the runtime no longer caches
provider tokens, it calls getBearerToken once per outbound request. Drop the
vestigial `scope`/`bearerTokenScope` (the callback closes over its own scope/
audience) and stop forwarding `expiresOnTimestamp` over the wire. The field is
retained on `ProviderBearerToken` so an Azure Identity `AccessToken` can be
returned verbatim, but it is now documented as ignored — caching and refresh
are the callback's responsibility (e.g. `@azure/identity` caches internally).

Rewrite the e2e suite to drive a local capturing HTTP server as the BYOK
endpoint instead of CAPI record/replay snapshots, so the tests assert on the
outbound Authorization header directly and pass identically in record and
replay mode. Delete the obsolete snapshots.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: SteveSandersonMS

nodejs/src/client.ts

@@ -171,9 +171,9 @@ type WireNamedProviderConfig = Omit<NamedProviderConfig, "getBearerToken"> & {
 /**
  * Strips the non-serializable {@link GetBearerToken} callbacks from the singular
  * and named provider configs before they cross the RPC boundary, replacing each
- * with a `hasBearerTokenProvider: true` wire flag. Any configured
- * {@link ProviderConfig.bearerTokenScope} is forwarded verbatim (the bearer-token
- * surface is provider-agnostic, so the SDK never substitutes a default scope).
+ * with a `hasBearerTokenProvider: true` wire flag. The callback closes over its
+ * own token scope/audience, so nothing scope-related crosses the wire — the
+ * runtime only forwards the provider name back when it needs a token.
  * Returns wire-safe provider configs alongside a map of provider name → callback
  * for session-side registration.
  */

nodejs/src/generated/rpc.ts

@@ -832,14 +832,12 @@ export class CopilotSession {
                 }
                 const result = await callback({
                     providerName: params.providerName,
-                    scope: params.scope,
                 });
                 if (typeof result === "string") {
                     return { token: result };
                 }
                 return {
                     token: result.token,
-                    expiresOnTimestamp: result.expiresOnTimestamp,
                 };
             },
         };

nodejs/src/session.ts

@@ -2204,17 +2204,11 @@ export interface ProviderTokenArgs {
      * Name of the BYOK provider needing a token. For the singular, whole-session
      * {@link ProviderConfig} this is the implicit provider name (`"default"`); for
      * {@link NamedProviderConfig} entries it is {@link NamedProviderConfig.name}.
+     *
+     * The callback closes over its own token scope/audience; the runtime is
+     * provider-agnostic and forwards only the provider name.
      */
     providerName: string;
-
-    /**
-     * Token scope to request, exactly as configured in the provider's
-     * {@link ProviderConfig.bearerTokenScope}. Empty when the provider did not
-     * configure a scope — in that case the callback is responsible for supplying
-     * the correct scope to its identity library. The bearer-token surface is
-     * provider-agnostic; no scope default is assumed.
-     */
-    scope: string;
 }
 
 /**
@@ -2232,10 +2226,11 @@ export interface ProviderBearerToken {
     token: string;
 
     /**
-     * Unix epoch time in milliseconds at which the token expires. When provided,
-     * the runtime caches the token and only re-invokes the callback shortly
-     * before expiry. When omitted, the runtime re-invokes the callback on every
-     * request.
+     * Unix epoch time in milliseconds at which the token expires. Accepted so an
+     * Azure Identity `AccessToken` can be returned verbatim, but currently
+     * **ignored**: the runtime performs no token caching and invokes the callback
+     * once per outbound request, so token caching and refresh are the callback's
+     * responsibility (e.g. `@azure/identity` caches internally).
      */
     expiresOnTimestamp?: number;
 }
@@ -2244,12 +2239,11 @@ export interface ProviderBearerToken {
  * Per-provider callback that resolves a bearer token on demand. The Copilot SDK
  * itself takes no Azure dependency: the consumer supplies this callback backed by
  * their own identity library (for example `@azure/identity`'s
- * `DefaultAzureCredential.getToken(scope)`), and the runtime calls it before
- * outbound model requests, caching and refreshing automatically based on the
- * returned {@link ProviderBearerToken.expiresOnTimestamp}.
+ * `DefaultAzureCredential.getToken(scope)`), and the runtime calls it once before
+ * each outbound model request. The runtime does no caching of its own, so the
+ * callback (or the identity library it wraps) owns token caching and refresh.
  *
- * Returning a bare string is equivalent to returning `{ token }` with no expiry
- * (re-invoked every request).
+ * Returning a bare string is equivalent to returning `{ token }`.
  *
  * @experimental Part of the experimental managed-identity / bearer-token-provider
  * surface and may change or be removed in future SDK or CLI releases.
@@ -2302,23 +2296,14 @@ export interface ProviderConfig {
      * Per-request bearer-token provider for managed-identity / on-demand auth.
      * When set, the SDK keeps this function client-side (it is never serialized)
      * and the runtime calls back into this client to acquire a token before each
-     * outbound request, caching and refreshing automatically. Mutually exclusive
-     * with {@link apiKey} / {@link bearerToken}.
+     * outbound request. The runtime does no caching of its own, so the callback
+     * owns token caching and refresh. Mutually exclusive with {@link apiKey} /
+     * {@link bearerToken}.
      *
      * @experimental
      */
     getBearerToken?: GetBearerToken;
 
-    /**
-     * Token scope forwarded to {@link getBearerToken} as
-     * {@link ProviderTokenArgs.scope}. Optional and provider-agnostic: when
-     * omitted, the callback receives an empty scope and is responsible for
-     * supplying the correct scope to its identity library.
-     *
-     * @experimental
-     */
-    bearerTokenScope?: string;
-
     /**
      * Azure-specific options
      */
@@ -2414,23 +2399,14 @@ export interface NamedProviderConfig {
      * Per-request bearer-token provider for managed-identity / on-demand auth.
      * When set, the SDK keeps this function client-side (it is never serialized)
      * and the runtime calls back into this client to acquire a token before each
-     * outbound request, caching and refreshing automatically. Mutually exclusive
-     * with {@link apiKey} / {@link bearerToken}.
+     * outbound request. The runtime does no caching of its own, so the callback
+     * owns token caching and refresh. Mutually exclusive with {@link apiKey} /
+     * {@link bearerToken}.
      *
      * @experimental
      */
     getBearerToken?: GetBearerToken;
 
-    /**
-     * Token scope forwarded to {@link getBearerToken} as
-     * {@link ProviderTokenArgs.scope}. Optional and provider-agnostic: when
-     * omitted, the callback receives an empty scope and is responsible for
-     * supplying the correct scope to its identity library.
-     *
-     * @experimental
-     */
-    bearerTokenScope?: string;
-
     /**
      * Azure-specific options.
      */