Add agentic auth provider infrastructure

[heyitsaamir]

Adds the auth provider abstraction layer that sits between the app and the API client:

• AuthProvider type — { token(options: { scope?, agenticIdentity? }) }
• AuthProviderInterceptor — HTTP interceptor that resolves tokens via AuthProvider, reads per-request agentic identity from extensions
• AppAuthProvider — default implementation backed by TokenManager, handles bot/agentic token routing
• Client (ApiClient) constructor extended to accept cloud, authProvider, agenticIdentity
• HttpClient interceptor interface updated to receive log in request context
• App.api wired to use provider-based auth

[heyitsaamir]

This change is part of the following stack:

• DNP - Feature Branch ACF support #627
  • Add Agent 365 token support #628
    • Support Entra inbound Agent ID tokens #629
      • Add agentic auth provider infrastructure #630 ◀
        • Add AgenticIdentity API surface #631
          • Add agentic send helpers #632

_{Change managed by git-spice.}

[Copilot]

Pull request overview

This PR introduces an auth-provider abstraction layer between the apps package and the API client, enabling token resolution via a pluggable AuthProvider and supporting per-request “agentic identity” metadata passed through HTTP request extensions.

Changes:

• Added AuthProvider contract and an AuthProviderInterceptor that injects Authorization headers based on provider-resolved tokens.
• Implemented AppAuthProvider backed by TokenManager and wired App.api to use provider-based auth instead of per-client token callbacks.
• Extended the common HTTP client infrastructure to support SDK-local request extensions and to expose registered interceptors.

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
packages/common/src/http/interceptor.ts	Extends request context config typing to include optional extensions.
packages/common/src/http/client.ts	Adds extensions to RequestConfig, renames internal interceptor registry, and exposes a read-only interceptors list.
packages/common/src/http/client.spec.ts	Updates interceptor registry assertions and adds coverage for preserving extensions.
packages/apps/src/index.ts	Exposes the new auth-provider module via the apps public API.
packages/apps/src/auth-provider.ts	Adds AppAuthProvider implementation backed by TokenManager.
packages/apps/src/auth-provider.spec.ts	Adds unit tests for app vs agentic token routing and default scopes.
packages/apps/src/app.ts	Wires App.api to use authProvider/cloud-managed settings and constructs AppAuthProvider.
packages/api/src/models/account.ts	Adds agentic identity-related fields to Account and a helper to extract AgenticIdentity.
packages/api/src/clients/user/token.ts	Threads cloud into settings merge for token client construction.
packages/api/src/clients/user/index.ts	Threads cloud into settings merge and token subclient construction.
packages/api/src/clients/index.ts	Adds auth-provider plumbing to API client construction and shared HttpClient reuse.
packages/api/src/clients/index.spec.ts	Tests that the auth provider interceptor is applied once and re-applied on HTTP client replacement.
packages/api/src/clients/bot/sign-in.ts	Threads cloud into settings merge for sign-in client construction.
packages/api/src/clients/bot/index.ts	Threads cloud into settings merge and sign-in subclient construction.
packages/api/src/clients/auth.ts	Introduces the AuthProvider type contract for resolving tokens.
packages/api/src/clients/auth-provider-interceptor.ts	Adds the interceptor that sets Authorization based on provider tokens and per-request agentic identity.
packages/api/src/clients/auth-provider-interceptor.spec.ts	Adds unit tests for interceptor behavior (auth header injection, override rules, agentic identity forwarding).
packages/api/src/clients/api-client-settings.ts	Extends ApiClientSettings with cloud, authProvider, and agenticIdentity.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated 2 comments.

[corinagum]

This interceptor-level defaultAgenticIdentity  is TS only concept, meaning default identity applies to all requests on the cflient. Can you confirm this is intentional vs PY's client-level threading?

[heyitsaamir]

https://github.com/microsoft/teams.py/pull/464/changes#diff-5cfc007331f6ea3521bbbb8b299f112ef73665fd30d3f324a517e7335606abf7R34 it's also here in py

[corinagum]

api nit: PY's token requires scope, whereas here it is optional. Should be consistent.

[heyitsaamir]

Token does, but AuthProvider.token doesn't - https://github.com/microsoft/teams.py/pull/464/changes#diff-5cfc007331f6ea3521bbbb8b299f112ef73665fd30d3f324a517e7335606abf7R19

[corinagum]

1. Default agentic identity lives in a different layer than PY. Here the interceptor holds defaultAgenticIdentity and falls back to it when no per-request extension is set. In PY the interceptor has no default: agentic_identity is threaded into the sub-clients, and the interceptor only reads the per-request extension. Is the interceptor-level default the intended TS design, or should it match PY's client-level threading?
2. The summary says the constructor was "extended", but it's actually a positional removal.  Client / ApiClient 's 4th cloud?  param was removed; That's a breaking change for new ApiClient(url, http, settings, cloud) (loud compile error for typed consumers, which is good). Should word as a breaking change and a quick check that no sample/doc constructs ApiClient with cloud positionally.

[heyitsaamir]

1. Default agentic identity lives in a different layer than PY. Here the interceptor holds defaultAgenticIdentity and falls back to it when no per-request extension is set. In PY the interceptor has no default: agentic_identity is threaded into the sub-clients, and the interceptor only reads the per-request extension. Is the interceptor-level default the intended TS design, or should it match PY's client-level threading?
2. The summary says the constructor was "extended", but it's actually a positional removal.  Client / ApiClient 's 4th cloud?  param was removed; That's a breaking change for new ApiClient(url, http, settings, cloud) (loud compile error for typed consumers, which is good). Should word as a breaking change and a quick check that no sample/doc constructs ApiClient with cloud positionally.

1. In Py, the interceptor also holds a default agentic identity (that's passed in from ApiClient). Lmk if you disagree with this design :).
2. Yeah, agree that cloud was removed. I moved it to apiclientsettings instead of keeping it as the 4th object. Agree it's breaking, but APIClient should be mostly an internal class, so there's a low chance of this being created independently. I'm proposing we move it to settings instead of keeping it an option (this way it can be included in the apisettings plumbing that already exists). Lmk if you're uncomfortable with this and I can move it back.