fix: resolve exported type stuttering issues (revive)

- Rename VaultMetadata to Metadata in internal/vault package to avoid stuttering
- Rename BIP85DRNG to DRNG in pkg/bip85 package to avoid stuttering
- Update all references in code and tests

internal/secret/keychainunlocker.go

@@ -145,6 +145,7 @@ func (k *KeychainUnlocker) GetID() string {
 		// We cannot continue with a fallback ID as that would mask data corruption
 		panic(fmt.Sprintf("Keychain unlocker metadata is corrupt or missing keychain item name: %v", err))
 	}
+
 	return fmt.Sprintf("%s-keychain", keychainItemName)
 }
 
@@ -172,6 +173,7 @@ func (k *KeychainUnlocker) Remove() error {
 	}
 
 	Debug("Successfully removed keychain unlocker", "unlocker_id", k.GetID(), "keychain_item", keychainItemName)
+
 	return nil
 }
 
@@ -210,6 +212,7 @@ func generateKeychainUnlockerName(vaultName string) (string, error) {
 
 	// Format: secret-<vault>-<hostname>-<date>
 	enrollmentDate := time.Now().Format("2006-01-02")
+
 	return fmt.Sprintf("secret-%s-%s-%s", vaultName, hostname, enrollmentDate), nil
 }
 
@@ -377,7 +380,9 @@ func CreateKeychainUnlocker(fs afero.Fs, stateDir string) (*KeychainUnlocker, er
 		return nil, fmt.Errorf("failed to marshal unlocker metadata: %w", err)
 	}
 
-	if err := afero.WriteFile(fs, filepath.Join(unlockerDir, "unlocker-metadata.json"), metadataBytes, FilePerms); err != nil {
+	if err := afero.WriteFile(fs,
+		filepath.Join(unlockerDir, "unlocker-metadata.json"),
+		metadataBytes, FilePerms); err != nil {
 		return nil, fmt.Errorf("failed to write unlocker metadata: %w", err)
 	}
 
@@ -394,6 +399,7 @@ func checkMacOSAvailable() error {
 	if err := cmd.Run(); err != nil {
 		return fmt.Errorf("macOS security command not available: %w (keychain unlockers are only supported on macOS)", err)
 	}
+
 	return nil
 }
 
@@ -415,7 +421,7 @@ func storeInKeychain(itemName string, data []byte) error {
 	if err := validateKeychainItemName(itemName); err != nil {
 		return fmt.Errorf("invalid keychain item name: %w", err)
 	}
-	cmd := exec.Command("/usr/bin/security", "add-generic-password", //nolint:gosec // Input validated by validateKeychainItemName
+	cmd := exec.Command("/usr/bin/security", "add-generic-password", //nolint:gosec
 		"-a", itemName,
 		"-s", itemName,
 		"-w", string(data),
@@ -434,7 +440,7 @@ func retrieveFromKeychain(itemName string) ([]byte, error) {
 		return nil, fmt.Errorf("invalid keychain item name: %w", err)
 	}
 
-	cmd := exec.Command("/usr/bin/security", "find-generic-password", //nolint:gosec // Input validated by validateKeychainItemName
+	cmd := exec.Command("/usr/bin/security", "find-generic-password", //nolint:gosec
 		"-a", itemName,
 		"-s", itemName,
 		"-w") // Return password only
@@ -458,7 +464,7 @@ func deleteFromKeychain(itemName string) error {
 		return fmt.Errorf("invalid keychain item name: %w", err)
 	}
 
-	cmd := exec.Command("/usr/bin/security", "delete-generic-password", //nolint:gosec // Input validated by validateKeychainItemName
+	cmd := exec.Command("/usr/bin/security", "delete-generic-password", //nolint:gosec
 		"-a", itemName,
 		"-s", itemName)
 

internal/secret/metadata.go

@@ -6,11 +6,13 @@ import (
 
 // VaultMetadata contains information about a vault
 type VaultMetadata struct {
-	CreatedAt          time.Time `json:"createdAt"`
-	Description        string    `json:"description,omitempty"`
-	DerivationIndex    uint32    `json:"derivation_index"`
-	PublicKeyHash      string    `json:"public_key_hash,omitempty"`      // Double SHA256 hash of the actual long-term public key
-	MnemonicFamilyHash string    `json:"mnemonic_family_hash,omitempty"` // Double SHA256 hash of index-0 key (for grouping vaults from same mnemonic)
+	CreatedAt       time.Time `json:"createdAt"`
+	Description     string    `json:"description,omitempty"`
+	DerivationIndex uint32    `json:"derivation_index"`
+	// Double SHA256 hash of the actual long-term public key
+	PublicKeyHash string `json:"public_key_hash,omitempty"`
+	// Double SHA256 hash of index-0 key (for grouping vaults from same mnemonic)
+	MnemonicFamilyHash string `json:"mnemonic_family_hash,omitempty"`
 }
 
 // UnlockerMetadata contains information about an unlocker

internal/secret/passphraseunlocker.go

@@ -121,6 +121,7 @@ func (p *PassphraseUnlocker) Remove() error {
 	if err := p.fs.RemoveAll(p.Directory); err != nil {
 		return fmt.Errorf("failed to remove passphrase unlocker directory: %w", err)
 	}
+
 	return nil
 }
 

internal/secret/pgpunlocker.go

@@ -129,6 +129,7 @@ func (p *PGPUnlocker) GetID() string {
 		// We cannot continue with a fallback ID as that would mask data corruption
 		panic(fmt.Sprintf("PGP unlocker metadata is corrupt or missing GPG key ID: %v", err))
 	}
+
 	return fmt.Sprintf("%s-pgp", gpgKeyID)
 }
 
@@ -139,6 +140,7 @@ func (p *PGPUnlocker) Remove() error {
 	if err := p.fs.RemoveAll(p.Directory); err != nil {
 		return fmt.Errorf("failed to remove PGP unlocker directory: %w", err)
 	}
+
 	return nil
 }
 
@@ -177,6 +179,7 @@ func generatePGPUnlockerName() (string, error) {
 
 	// Format: hostname-pgp-YYYY-MM-DD
 	enrollmentDate := time.Now().Format("2006-01-02")
+
 	return fmt.Sprintf("%s-pgp-%s", hostname, enrollmentDate), nil
 }
 
@@ -320,7 +323,9 @@ func CreatePGPUnlocker(fs afero.Fs, stateDir string, gpgKeyID string) (*PGPUnloc
 		return nil, fmt.Errorf("failed to marshal unlocker metadata: %w", err)
 	}
 
-	if err := afero.WriteFile(fs, filepath.Join(unlockerDir, "unlocker-metadata.json"), metadataBytes, FilePerms); err != nil {
+	if err := afero.WriteFile(fs,
+		filepath.Join(unlockerDir, "unlocker-metadata.json"),
+		metadataBytes, FilePerms); err != nil {
 		return nil, fmt.Errorf("failed to write unlocker metadata: %w", err)
 	}
 
@@ -377,6 +382,7 @@ func checkGPGAvailable() error {
 	if err := cmd.Run(); err != nil {
 		return fmt.Errorf("GPG not available: %w (make sure 'gpg' command is installed and in PATH)", err)
 	}
+
 	return nil
 }
 

internal/secret/secret.go

@@ -78,6 +78,7 @@ func (s *Secret) Save(value []byte, force bool) error {
 	}
 
 	Debug("Successfully saved secret", "secret_name", s.Name)
+
 	return nil
 }
 
@@ -220,6 +221,7 @@ func (s *Secret) LoadMetadata() error {
 		CreatedAt: now,
 		UpdatedAt: now,
 	}
+
 	return nil
 }
 
@@ -278,6 +280,7 @@ func GetCurrentVault(fs afero.Fs, stateDir string) (VaultInterface, error) {
 	if getCurrentVaultFunc == nil {
 		return nil, fmt.Errorf("GetCurrentVault function not registered")
 	}
+
 	return getCurrentVaultFunc(fs, stateDir)
 }
 

internal/secret/secret_test.go

@@ -262,6 +262,7 @@ func isValidSecretName(name string) bool {
 			return false
 		}
 	}
+
 	return true
 }
 

internal/secret/version.go

@@ -51,6 +51,7 @@ func NewVersion(vault VaultInterface, secretName string, version string) *Versio
 	)
 
 	now := time.Now()
+
 	return &Version{
 		SecretName: secretName,
 		Version:    version,
@@ -219,6 +220,7 @@ func (sv *Version) Save(value []byte) error {
 	}
 
 	Debug("Successfully saved secret version", "version", sv.Version, "secret_name", sv.SecretName)
+
 	return nil
 }
 
@@ -277,6 +279,7 @@ func (sv *Version) LoadMetadata(ltIdentity *age.X25519Identity) error {
 
 	sv.Metadata = metadata
 	Debug("Successfully loaded version metadata", "version", sv.Version)
+
 	return nil
 }
 
@@ -344,6 +347,7 @@ func (sv *Version) GetValue(ltIdentity *age.X25519Identity) ([]byte, error) {
 		"version", sv.Version,
 		"value_length", len(value),
 		"is_empty", len(value) == 0)
+
 	return value, nil
 }
 
@@ -392,6 +396,7 @@ func GetCurrentVersion(fs afero.Fs, secretDir string) (string, error) {
 			if len(parts) >= 2 && parts[0] == "versions" {
 				return parts[1], nil
 			}
+
 			return "", fmt.Errorf("invalid current version symlink format: %s", target)
 		}
 	}