chore(vendor): import pi 1.3.0

Imported as a linear vendor commit so forge rebases do not replay the upstream root tree.

git-subtree-dir: third_party/pi

git-subtree-split: 71023aec1546d6d677a65669c5665c0927ce0dd0

third_party/pi/packages/ai/test/radius-oauth.test.ts

@@ -3,6 +3,7 @@ import { createRadiusOAuth } from "../src/auth/oauth/radius.ts";
 import type { AuthEvent, ProviderAuthInteraction } from "../src/auth/types.ts";
 
 const GATEWAY = "https://radius.example";
+const nativeFetch = globalThis.fetch;
 
 function jsonResponse(body: unknown, status = 200): Response {
 	return new Response(JSON.stringify(body), {
@@ -126,4 +127,56 @@ describe("Radius OAuth", () => {
 		await expect(oauth.login(interaction("browser"))).rejects.toThrow(`Invalid Radius OAuth config from ${GATEWAY}`);
 		expect(fetchMock).toHaveBeenCalledOnce();
 	});
+
+	it("exchanges the browser callback code before showing the sign-in page", async () => {
+		let tokenStatus = 400;
+		vi.stubGlobal(
+			"fetch",
+			vi.fn(async (input: unknown, init?: RequestInit) => {
+				const url = requestUrl(input);
+				if (url === `${GATEWAY}/v1/oauth`) return jsonResponse({ authorizationEndpoint: `${GATEWAY}/authorize` });
+				if (url === `${GATEWAY}/v1/oauth/token`) {
+					const body = new URLSearchParams(String(init?.body));
+					expect(body.get("code")).toBe("browser-code");
+					return tokenStatus === 200
+						? jsonResponse({ access_token: "access", refresh_token: "refresh", expires_in: 3600 })
+						: jsonResponse({ error: "invalid_grant", error_description: "code expired" }, tokenStatus);
+				}
+				return nativeFetch(url, init);
+			}),
+		);
+
+		const oauth = createRadiusOAuth({ name: "Radius", gateway: GATEWAY });
+		const login = async () => {
+			let callbackPage: Promise<Response> | undefined;
+			const result = oauth.login({
+				...interaction("browser"),
+				notify: (event) => {
+					if (event.type !== "auth_url") return;
+					const authorize = new URL(event.url);
+					const callback = new URL(authorize.searchParams.get("redirect_uri") ?? "");
+					callback.searchParams.set("code", "browser-code");
+					callback.searchParams.set("state", authorize.searchParams.get("state") ?? "");
+					callbackPage = nativeFetch(callback);
+				},
+			});
+			const outcome = await result.then(
+				(credential) => ({ credential }),
+				(error: Error) => ({ error }),
+			);
+			const response = await callbackPage;
+			return { ...outcome, status: response?.status, page: await response?.text() };
+		};
+
+		const failed = await login();
+		expect("error" in failed && failed.error.message).toContain("invalid_grant: code expired");
+		expect(failed.status).toBe(502);
+		expect(failed.page).toContain("code expired");
+
+		tokenStatus = 200;
+		const succeeded = await login();
+		expect("credential" in succeeded && succeeded.credential.access).toBe("access");
+		expect(succeeded.status).toBe(200);
+		expect(succeeded.page).toContain("Signed in to Radius.");
+	});
 });