@essentialai/cogent-bridge/dist/mail/auth-error.js

Cogent Bridge — cross-agent comms for Claude Code, OpenAI Codex and Slack. Codex users: install with `curl -fsSL https://cogent.tools/install.sh | sh`, then start with `cogent-codex` for real-time peer wake.

/**
 * Cogent Mail F3 — recognize a mailbox AUTHENTICATION failure from either mail library, so the
 * send/fetch tools can surface an ACTIONABLE hint (NOT to self-clear creds — a mail-protocol auth
 * denial is wire-indistinguishable between a reversible admin SUSPEND and a reap-delete, and wiping
 * still-valid creds on a suspend would permanently lock the agent out after it's resumed; a genuine
 * reap already clears creds via the deregister deprovision-header path).
 *
 * Signatures verified against the libraries (do NOT broaden blindly — a transient network/timeout
 * error must NOT be mistaken for a credential failure):
 *  - **imapflow** throws `AuthenticationFailure extends Error` with `authenticationFailed: true`
 *    (+ optional `serverResponseCode`, e.g. "AUTHENTICATIONFAILED"). [imapflow _autodocs/errors.md]
 *  - **nodemailer** SMTP auth failure sets `code: "EAUTH"` and `responseCode: 535`
 *    (the "535 5.7.8 authentication failed" reply). [nodemailer SMTP error contract]
 */
export function isMailAuthError(err) {
    if (!err || typeof err !== "object")
        return false;
    const e = err;
    // imapflow: the definitive flag it sets on AuthenticationFailure.
    if (e.authenticationFailed === true)
        return true;
    // imapflow: some paths surface only the server response code.
    if (typeof e.serverResponseCode === "string" && e.serverResponseCode.toUpperCase() === "AUTHENTICATIONFAILED")
        return true;
    // nodemailer: EAUTH is auth-specific (distinct from ECONNECTION / ETIMEDOUT / ESOCKET).
    if (e.code === "EAUTH")
        return true;
    // nodemailer: the SMTP 535 "authentication credentials invalid" reply code.
    if (e.responseCode === 535)
        return true;
    return false;
}
/**
 * The actionable suggestion to attach to a mailbox auth failure. Deliberately does NOT tell the agent
 * to re-run cogent_setup_mail unless the box was actually deleted — a suspend is temporary and the
 * SAME creds work again after an admin resumes the box.
 */
export function mailAuthErrorHint() {
    return ("The mail server refused these credentials. The mailbox may be temporarily SUSPENDED by an admin " +
        "(retry after it is resumed — your saved credentials will work again), or it was deleted (only then " +
        "re-run cogent_setup_mail with a fresh address + password). Your local credentials are kept.");
}
//# sourceMappingURL=auth-error.js.map