chore(vendor): import pi 1.3.0

Imported as a linear vendor commit so forge rebases do not replay the upstream root tree.

git-subtree-dir: third_party/pi

git-subtree-split: 71023aec1546d6d677a65669c5665c0927ce0dd0

third_party/pi/packages/mcp/src/oauth/errors.ts

@@ -0,0 +1,55 @@
+export class OAuthError extends Error {
+	readonly code: string;
+	readonly errorUri: string | undefined;
+
+	constructor(code: string, message: string, errorUri?: string) {
+		super(message || code);
+		this.name = "OAuthError";
+		this.code = code;
+		this.errorUri = errorUri;
+	}
+}
+
+export class OAuthIssuerMismatchError extends Error {
+	/** `undefined` when no authorization server metadata was discovered. */
+	readonly expected: string | undefined;
+	/** `undefined` when an authorization response lacks the `iss` parameter its server promised (RFC 9207). */
+	readonly received: string | undefined;
+
+	constructor(expected: string | undefined, received: string | undefined) {
+		const format = (issuer: string | undefined) => (issuer === undefined ? "none" : JSON.stringify(issuer));
+		super(`OAuth issuer mismatch: expected ${format(expected)}, received ${format(received)}`);
+		this.name = "OAuthIssuerMismatchError";
+		this.expected = expected;
+		this.received = received;
+	}
+}
+
+export class OAuthInsecureEndpointError extends Error {
+	readonly endpoint: string;
+
+	constructor(endpoint: string) {
+		super(`Refusing to send OAuth credentials to non-HTTPS endpoint ${endpoint}`);
+		this.name = "OAuthInsecureEndpointError";
+		this.endpoint = endpoint;
+	}
+}
+
+export class OAuthRegistrationError extends Error {
+	readonly status: number;
+	readonly body: string;
+
+	constructor(status: number, body: string) {
+		super(`OAuth dynamic client registration failed with status ${status}: ${body}`);
+		this.name = "OAuthRegistrationError";
+		this.status = status;
+		this.body = body;
+	}
+}
+
+export class McpOAuthAuthorizationRequiredError extends Error {
+	constructor() {
+		super("MCP OAuth authorization requires user interaction");
+		this.name = "McpOAuthAuthorizationRequiredError";
+	}
+}