chore: import upstream snapshot with attribution

apps/sim/tools/google_vault/utils.ts

@@ -0,0 +1,41 @@
+/**
+ * Google Vault Error Enhancement Utilities
+ *
+ * Provides user-friendly error messages for common Google Vault authentication
+ * and credential issues, particularly RAPT (reauthentication policy) errors.
+ */
+
+/**
+ * Detects if an error message indicates a credential/reauthentication issue
+ */
+function isCredentialRefreshError(errorMessage: string): boolean {
+  const lowerMessage = errorMessage.toLowerCase()
+  return (
+    lowerMessage.includes('invalid_rapt') ||
+    lowerMessage.includes('reauth related error') ||
+    (lowerMessage.includes('invalid_grant') && lowerMessage.includes('rapt')) ||
+    lowerMessage.includes('failed to refresh token') ||
+    (lowerMessage.includes('failed to fetch access token') && lowerMessage.includes('401'))
+  )
+}
+
+/**
+ * Enhances Google Vault error messages with actionable guidance
+ *
+ * For credential/reauthentication errors (RAPT errors), provides specific
+ * instructions for resolving the issue through Google Admin Console settings.
+ */
+export function enhanceGoogleVaultError(errorMessage: string): string {
+  if (isCredentialRefreshError(errorMessage)) {
+    return (
+      `Google Vault authentication failed (likely due to reauthentication policy). ` +
+      `To resolve this, try disconnecting and reconnecting your Google Vault credential ` +
+      `in the Credentials settings. If the issue persists, ask your Google Workspace ` +
+      `administrator to disable "Reauthentication policy" for Sim Studio in the Google ` +
+      `Admin Console (Security > Access and data control > Context-Aware Access > ` +
+      `Reauthentication policy), or exempt Sim Studio from reauthentication requirements. ` +
+      `Learn more: https://support.google.com/a/answer/9368756`
+    )
+  }
+  return errorMessage
+}