keyring

var (
	ErrNotFound = errors.New("password not found in keyring")

	// ErrUnavailable indicates the OS keyring backend cannot be reached (for
	// example a headless Linux/CI host with no D-Bus session bus). Callers
	// should treat secure storage as absent and fall back to the config file.
	ErrUnavailable = errors.New("keyring unavailable")

	// ErrAccessDenied is a specific ErrUnavailable: the session bus exists but
	// the sandbox or D-Bus policy refused the connection — most commonly a
	// strict snap whose password-manager-service interface is not connected.
	// Unlike a missing provider, this is something the user can fix, so callers
	// may surface a hint. It wraps ErrUnavailable so the file-storage fallback
	// still triggers.
	ErrAccessDenied = fmt.Errorf("%w: access to the secret service was denied", ErrUnavailable)
)