chore(vendor): import pi 1.3.0

Imported as a linear vendor commit so forge rebases do not replay the upstream root tree.

git-subtree-dir: third_party/pi

git-subtree-split: 71023aec1546d6d677a65669c5665c0927ce0dd0

third_party/pi/packages/mcp/src/auth-provider.ts

@@ -0,0 +1,20 @@
+export type McpFetch = (input: string | URL, init?: RequestInit) => Promise<Response>;
+
+export interface UnauthorizedContext {
+	/** The 401 response, or a 403 response whose challenge reports `insufficient_scope`. */
+	response: Response;
+	serverUrl: URL;
+	fetch: McpFetch;
+	/** Access token the rejected request carried, if any. A different current token means another request already refreshed it. */
+	token?: string;
+}
+
+/** Supplies bearer tokens to an MCP HTTP transport and may refresh them after a 401 response. */
+export interface AuthProvider {
+	/**
+	 * Token for the next request. May refresh it over the network first, so the transport calls it only
+	 * before requests whose answer it waits for. Closing a session reuses the token of the last request.
+	 */
+	token(): Promise<string | undefined>;
+	onUnauthorized?(context: UnauthorizedContext): Promise<void>;
+}