Give each failure one error value (closes #113)

internal/cli's copies of vault.ErrSecretNotFound, ErrVaultNotFound,
ErrVersionNotFound and ErrSecretExists are removed; the commands wrap the
vault errors. errUnsupportedUnlockerType is removed for
errInvalidUnlockerType, which names the same failure. Every error of
secret.ReadPassphrase wraps ErrPassphraseNotRead, so its callers no longer
add those words. ResolveGPGKeyFingerprint returns ErrGPGKeyNotFound for a
key the keyring lacks, recognised by gpg's status line. storeInKeychain
returns errNilDataBuffer. bip85's ErrPasswordTooShort and
ErrEncodedTooShort go with their unreachable checks. Tests that matched
these errors' text use errors.Is.

Model: opus-5-5

TODO.md

@@ -23,7 +23,9 @@ https://git.eeqj.de/sneak/secret/milestone/12
   keeps its own copies of `vault.ErrSecretNotFound`, `ErrVaultNotFound`,
   `ErrVersionNotFound` and `ErrSecretExists`: `secret mv`, `rm`, `decrypt`,
   `vault import`, `vault remove` and `version list`, `promote` and `rm` wrap
-  the `vault` errors. Messages are unchanged, except that `secret decrypt`
+  the `vault` errors. `errUnsupportedUnlockerType` is removed: `secret
+  unlocker add` gives `errInvalidUnlockerType` for an unknown type, whichever
+  check rejects it. Messages are unchanged, except that `secret decrypt`
   of a missing secret says "not found", as `secret get` does, not "does not
   exist". Every error of `secret.ReadPassphrase` wraps
   `secret.ErrPassphraseNotRead`, which supplies the words "failed to read

internal/cli/move_test.go

@@ -61,16 +61,29 @@ func TestRejectedMoveWithinVaultLeavesStateUnchanged(t *testing.T) {
 		})
 	}
 
-	// A missing secret, and a missing vault: only an existing vault is used.
-	for source, want := range map[string]error{
-		"work:nosuch": vault.ErrSecretNotFound,
-		"nosuch:x":    vault.ErrVaultNotFound,
-	} {
-		t.Run("mv --force "+source+" work:y", func(t *testing.T) {
+	missing := []struct {
+		command      string
+		source, dest string
+		force        bool
+		want         error
+	}{
+		{
+			"mv work:nosuch work:y", "work:nosuch", "work:y", false,
+			vault.ErrSecretNotFound,
+		},
+		// Only an existing vault is used.
+		{
+			"mv --force nosuch:x nosuch:y", "nosuch:x", "nosuch:y", true,
+			vault.ErrVaultNotFound,
+		},
+	}
+
+	for _, tt := range missing {
+		t.Run(tt.command, func(t *testing.T) {
 			t.Parallel()
 
-			requireRejectedAndUnchanged(t, before, want, func(c *cli.Instance) error {
-				return c.MoveSecret(&cobra.Command{}, source, "work:y", true)
+			requireRejectedAndUnchanged(t, before, tt.want, func(c *cli.Instance) error {
+				return c.MoveSecret(&cobra.Command{}, tt.source, tt.dest, tt.force)
 			})
 		})
 	}

internal/cli/unlockers.go

@@ -47,7 +47,6 @@ var (
 	// composes "GPG key <id> is already added as an unlocker".
 	errGPGKeyAlreadyUnlocker = errors.New(
 		"is already added as an unlocker")
-	errUnsupportedUnlockerType = errors.New("unsupported unlocker type")
 )
 
 // UnlockerInfo represents unlocker information for display
@@ -439,7 +438,7 @@ func (cli *Instance) UnlockersAdd(unlockerType string, cmd *cobra.Command) error
 		}
 
 		return fmt.Errorf("%w: %s (supported: %s)",
-			errUnsupportedUnlockerType, unlockerType, supportedTypes)
+			errInvalidUnlockerType, unlockerType, supportedTypes)
 	}
 }