Give each failure one error value (closes #113)

internal/cli drops its copies of vault.ErrSecretNotFound, ErrVaultNotFound,
ErrVersionNotFound and ErrSecretExists and of the secret package's keychain
and Secure Enclave errors, and its second error for an unknown unlocker
type, an invalid mnemonic, a length below 1, an unsupported secret type and
an oversized secret. vault.ErrNilValueBuffer becomes
secret.ErrNilValueBuffer. Every error of secret.ReadPassphrase wraps
ErrPassphraseNotRead. ResolveGPGKeyFingerprint returns ErrGPGKeyNotFound for
a key the keyring lacks. storeInKeychain returns errNilDataBuffer. bip85's
ErrPasswordTooShort and ErrEncodedTooShort go with their unreachable checks,
as does the macOS check in macOS-only code. Tests that matched these
errors' text use errors.Is.

Model: opus-5-5

pkg/bip85/bip85.go

@@ -59,16 +59,6 @@ var (
 	// ErrInvalidBase85PwdLen is returned when the Base85 password length
 	// is out of range.
 	ErrInvalidBase85PwdLen = errors.New("pwdLen must be between 10 and 80")
-	// ErrPasswordTooShort is returned when the derived material is
-	// shorter than the requested password length. It carries only the
-	// middle of the message, which the caller composes as
-	// "derived password length <n> is shorter than requested length <m>",
-	// so the emitted text is unchanged.
-	ErrPasswordTooShort = errors.New("is shorter than requested length")
-	// ErrEncodedTooShort is returned when the encoded material is shorter
-	// than the requested password length. Composed as
-	// "encoded length <n> is less than requested length <m>".
-	ErrEncodedTooShort = errors.New("is less than requested length")
 )
 
 // Version bytes for extended keys
@@ -381,14 +371,8 @@ func DeriveBase64Password(
 	// Remove any padding
 	encodedStr = strings.TrimRight(encodedStr, "=")
 
-	// Slice to the desired password length
-	if len(encodedStr) < int(pwdLen) {
-		return "", fmt.Errorf(
-			"derived password length %d %w %d",
-			len(encodedStr), ErrPasswordTooShort, pwdLen,
-		)
-	}
-
+	// Slice to the desired password length: 64 bytes of entropy leave 86
+	// characters, the most pwdLen allows
 	return encodedStr[:pwdLen], nil
 }
 
@@ -411,14 +395,8 @@ func DeriveBase85Password(
 	// Base85 encode all 64 bytes of entropy using the RFC1924 character set
 	encoded := encodeBase85WithRFC1924Charset(entropy)
 
-	// Slice to the desired password length
-	if len(encoded) < int(pwdLen) {
-		return "", fmt.Errorf(
-			"encoded length %d %w %d",
-			len(encoded), ErrEncodedTooShort, pwdLen,
-		)
-	}
-
+	// Slice to the desired password length: 64 bytes of entropy give 80
+	// characters, the most pwdLen allows
 	return encoded[:pwdLen], nil
 }