/**
 * Turning rejected credentials into the one thing that fixes them.
 *
 * Both protocols report a bad password in their own dialect — imapflow
 * surfaces `AUTHENTICATIONFAILED`, nodemailer an `EAUTH` wrapping
 * `535-5.7.8 Username and Password not accepted`. Neither says what the user
 * must actually do, which for Gmail, Yahoo and iCloud is "a normal password
 * cannot work here, mint an app password". That guidance already exists
 * per-provider in the provider table; this maps a failure onto it.
 */
import type { AccountConfig } from '../types/index.js';
/**
 * Does this error mean the credentials were rejected, as opposed to the
 * server being unreachable? Only the former is worth a credential hint —
 * attaching one to a DNS failure would send the user down the wrong path.
 */
export declare function isAuthFailure(err: unknown): boolean;
/**
 * The remedy alone, for callers that already show the server's message and
 * the host — a CLI spinner line, say — and need the guidance beside it
 * rather than a prose block repeating what is on screen. Undefined when the
 * failure was not about credentials.
 */
export declare function authFailureHint(err: unknown, account: AccountConfig): string | undefined;
/**
 * Rephrase a rejected-credentials error as something actionable, keeping the
 * server's own words so a provider-specific reason is not lost.
 *
 * @param err the original failure
 * @param account whose credentials were refused
 * @param protocol which leg failed, so the user knows which host to fix
 */
export declare function describeAuthFailure(err: unknown, account: AccountConfig, protocol: 'IMAP' | 'SMTP'): string;
/**
 * Run a connect/login step, replacing a credentials rejection with guidance.
 * Anything else — timeouts, TLS failures, DNS — passes through untouched.
 */
export declare function withAuthGuidance<T>(account: AccountConfig, protocol: 'IMAP' | 'SMTP', run: () => Promise<T>): Promise<T>;
//# sourceMappingURL=auth-error.d.ts.map