Give each failure one error value (closes #113)

internal/cli drops its copies of vault.ErrSecretNotFound, ErrVaultNotFound,
ErrVersionNotFound and ErrSecretExists and of the secret package's keychain
and Secure Enclave errors, and its second error for an unknown unlocker
type, an invalid mnemonic, a length below 1, an unsupported secret type and
an oversized secret. vault.ErrNilValueBuffer becomes
secret.ErrNilValueBuffer. Every error of secret.ReadPassphrase wraps
ErrPassphraseNotRead. ResolveGPGKeyFingerprint returns ErrGPGKeyNotFound for
a key the keyring lacks. storeInKeychain returns errNilDataBuffer. bip85's
ErrPasswordTooShort and ErrEncodedTooShort go with their unreachable checks,
as does the macOS check in macOS-only code. Tests that matched these
errors' text use errors.Is.

Model: opus-5-5

internal/cli/generate.go

@@ -20,11 +20,7 @@ const (
 
 // Sentinel errors for secret generation
 var (
-	errLengthTooSmall           = errors.New("length must be at least 1")
-	errLengthNotPositive        = errors.New("length must be positive")
-	errMnemonicTypeNotSupported = errors.New(
-		"mnemonic type not supported for secret generation, " +
-			"use 'secret generate mnemonic' instead")
+	errLengthTooSmall        = errors.New("length must be at least 1")
 	errUnsupportedSecretType = errors.New("unsupported type")
 )
 
@@ -148,7 +144,8 @@ func (cli *Instance) GenerateSecret(
 	case "alnum":
 		secretValue, err = generateRandomAlnum(length)
 	case "mnemonic":
-		return errMnemonicTypeNotSupported
+		return fmt.Errorf("%w: mnemonic (use 'secret generate mnemonic' instead)",
+			errUnsupportedSecretType)
 	default:
 		return fmt.Errorf("%w: %s (supported: base58, alnum)",
 			errUnsupportedSecretType, secretType)
@@ -204,8 +201,8 @@ func generateRandomAlnum(length int) (string, error) {
 // generateRandomString generates a random string of the specified length
 // using the given character set
 func generateRandomString(length int, charset string) (string, error) {
-	if length <= 0 {
-		return "", errLengthNotPositive
+	if length < 1 {
+		return "", errLengthTooSmall
 	}
 
 	result := make([]byte, length)