fmt: applied formatting

CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.5.0 (2026-06-02)
+
+### Feat
+
+- Added typed errors to improve library DevX and removed now deprecated migrate command
+
 ## v0.4.1 (2026-03-20)
 
 ### Feat

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "gman"
-version = "0.4.1"
+version = "0.5.0"
 edition = "2024"
 authors = ["Alex Clarke <alex.j.tusa@gmail.com>"]
 description = "Universal command line secret management and injection tool"

src/bin/gman/cli.rs

@@ -167,7 +167,7 @@ fn generate_files_secret_injections(
     secrets: HashMap<&str, String>,
     run_config: &RunConfig,
 ) -> Result<Vec<(PathBuf, String, String)>> {
-    let re = Regex::new(r"\{\{(.+)}}")?;
+    let re = Regex::new(r"\{\{\s*(.+?)\s*}}")?;
     let mut results = Vec::new();
     for file in run_config
         .files
@@ -358,6 +358,86 @@ mod tests {
         assert_str_eq!(result[0].2, "value1");
     }
 
+    #[test]
+    fn test_generate_files_secret_injections_tolerates_whitespace_around_key() {
+        let mut secrets = HashMap::new();
+        secrets.insert("api/gmail/email/meli_password", "hunter2".to_string());
+        let temp_dir = tempfile::tempdir().unwrap();
+        let file_path = temp_dir.path().join("test.toml");
+        fs::write(
+            &file_path,
+            "server_password = \"{{ api/gmail/email/meli_password }}\"\nother = \"{{\tapi/gmail/email/meli_password\t}}\"",
+        )
+        .unwrap();
+
+        let run_config = RunConfig {
+            name: Some("meli".to_string()),
+            provider: None,
+            secrets: Some(vec!["api/gmail/email/meli_password".to_string()]),
+            files: Some(vec![file_path.clone()]),
+            flag: None,
+            flag_position: None,
+            arg_format: None,
+        };
+
+        let result = generate_files_secret_injections(secrets, &run_config).unwrap();
+
+        assert_eq!(result.len(), 1);
+        assert_str_eq!(
+            result[0].2,
+            "server_password = \"hunter2\"\nother = \"hunter2\""
+        );
+    }
+
+    #[test]
+    fn test_generate_files_secret_injections_handles_multiple_placeholders_on_one_line() {
+        let mut secrets = HashMap::new();
+        secrets.insert("a", "alpha".to_string());
+        secrets.insert("b", "beta".to_string());
+        let temp_dir = tempfile::tempdir().unwrap();
+        let file_path = temp_dir.path().join("test.txt");
+        fs::write(&file_path, "{{a}} foo {{ b }}").unwrap();
+
+        let run_config = RunConfig {
+            name: Some("test".to_string()),
+            provider: None,
+            secrets: Some(vec!["a".to_string(), "b".to_string()]),
+            files: Some(vec![file_path.clone()]),
+            flag: None,
+            flag_position: None,
+            arg_format: None,
+        };
+
+        let result = generate_files_secret_injections(secrets, &run_config).unwrap();
+
+        assert_eq!(result.len(), 1);
+        assert_str_eq!(result[0].2, "alpha foo beta");
+    }
+
+    #[test]
+    fn test_generate_files_secret_injections_leaves_unknown_keys_untouched() {
+        let mut secrets = HashMap::new();
+        secrets.insert("known", "value".to_string());
+        let temp_dir = tempfile::tempdir().unwrap();
+        let file_path = temp_dir.path().join("test.txt");
+        fs::write(&file_path, "{{known}} {{ unknown }}").unwrap();
+
+        let run_config = RunConfig {
+            name: Some("test".to_string()),
+            provider: None,
+            secrets: Some(vec!["known".to_string()]),
+            files: Some(vec![file_path.clone()]),
+            flag: None,
+            flag_position: None,
+            arg_format: None,
+        };
+
+        let result = generate_files_secret_injections(secrets, &run_config).unwrap();
+
+        assert_eq!(result.len(), 1);
+        assert_str_eq!(result[0].2, "value {{ unknown }}");
+    }
+
     #[test]
     fn test_parse_args_insert_and_append() {
         let run_config = RunConfig {

src/providers/aws_secrets_manager.rs

@@ -4,8 +4,8 @@ use serde::{Deserialize, Serialize};
 use serde_with::skip_serializing_none;
 use validator::Validate;
 
-use crate::providers::error::{SecretError, classify_aws_error};
 use crate::providers::SecretProvider;
+use crate::providers::error::{SecretError, classify_aws_error};
 
 const PROVIDER: &str = "aws_secrets_manager";
 
@@ -120,10 +120,13 @@ impl AwsSecretsManagerProvider {
             provider: PROVIDER,
             message: "aws_region is required".to_string(),
         })?;
-        let profile = self.aws_profile.clone().ok_or_else(|| SecretError::Config {
+        let profile = self
-            provider: PROVIDER,
+            .aws_profile
-            message: "aws_profile is required".to_string(),
+            .clone()
-        })?;
+            .ok_or_else(|| SecretError::Config {
+                provider: PROVIDER,
+                message: "aws_profile is required".to_string(),
+            })?;
 
         let config = aws_config::from_env()
             .region(Region::new(region))

src/providers/azure_key_vault.rs

@@ -67,9 +67,9 @@ impl SecretProvider for AzureKeyVaultProvider {
             ..Default::default()
         };
 
-        let body = params
+        let body = params.try_into().map_err(|e: azure_core::Error| {
-            .try_into()
+            classify_azure_error(e.into(), Some(key), "set_secret")
-            .map_err(|e: azure_core::Error| classify_azure_error(e.into(), Some(key), "set_secret"))?;
+        })?;
 
         self.get_client()?
             .set_secret(key, body, None)
@@ -123,10 +123,13 @@ impl AzureKeyVaultProvider {
                 provider: PROVIDER,
                 source: e.into(),
             })?;
-        let vault_name = self.vault_name.as_ref().ok_or_else(|| SecretError::Config {
+        let vault_name = self
-            provider: PROVIDER,
+            .vault_name
-            message: "vault_name is required".to_string(),
+            .as_ref()
-        })?;
+            .ok_or_else(|| SecretError::Config {
+                provider: PROVIDER,
+                message: "vault_name is required".to_string(),
+            })?;
         let client = SecretClient::new(
             format!("https://{}.vault.azure.net", vault_name).as_str(),
             credential,

src/providers/error.rs

@@ -1,5 +1,5 @@
-use std::io;
 use anyhow::anyhow;
+use std::io;
 use thiserror::Error;
 
 use crate::providers::git_sync::SyncError;
@@ -105,13 +105,19 @@ pub(crate) fn classify_aws_error(
         || chain_text.contains("unauthorized")
         || chain_text.contains("unrecognizedclient")
     {
-        SecretError::AuthFailed { provider, source: err }
+        SecretError::AuthFailed {
+            provider,
+            source: err,
+        }
     } else if chain_text.contains("dispatch failure")
         || chain_text.contains("timeout")
         || chain_text.contains("connection")
         || chain_text.contains("dns")
     {
-        SecretError::Network { provider, source: err }
+        SecretError::Network {
+            provider,
+            source: err,
+        }
     } else {
         SecretError::Other(err)
     }
@@ -165,9 +171,15 @@ pub(crate) fn classify_gcp_error(
             provider,
         }
     } else if chain_text.contains("unauthenticated") || chain_text.contains("permissiondenied") {
-        SecretError::AuthFailed { provider, source: err }
+        SecretError::AuthFailed {
+            provider,
+            source: err,
+        }
     } else if chain_text.contains("unavailable") || chain_text.contains("deadlineexceeded") {
-        SecretError::Network { provider, source: err }
+        SecretError::Network {
+            provider,
+            source: err,
+        }
     } else {
         SecretError::Other(err)
     }
@@ -185,7 +197,10 @@ pub(crate) fn classify_azure_error(
         if let ErrorKind::HttpResponse { status, .. } = azure_err.kind() {
             let code = u16::from(*status);
             return match code {
-                401 | 403 => SecretError::AuthFailed { provider, source: err },
+                401 | 403 => SecretError::AuthFailed {
+                    provider,
+                    source: err,
+                },
                 404 => SecretError::NotFound {
                     key: key.unwrap_or("").to_string(),
                     provider,
@@ -213,12 +228,18 @@ pub(crate) fn classify_azure_error(
         || chain_text.contains("403")
         || chain_text.contains("authentication")
     {
-        SecretError::AuthFailed { provider, source: err }
+        SecretError::AuthFailed {
+            provider,
+            source: err,
+        }
     } else if chain_text.contains("timeout")
         || chain_text.contains("connection")
         || chain_text.contains("dns")
     {
-        SecretError::Network { provider, source: err }
+        SecretError::Network {
+            provider,
+            source: err,
+        }
     } else {
         SecretError::Other(err)
     }

src/providers/gcp_secret_manager.rs

@@ -72,9 +72,8 @@ impl SecretProvider for GcpSecretManagerProvider {
             provider: PROVIDER,
         })?;
         let secret_value = payload.data.ref_sensitive_value().to_vec();
-        let secret_string = String::from_utf8(secret_value).map_err(|_| {
+        let secret_string = String::from_utf8(secret_value)
-            SecretError::Other(anyhow!("secret value is not valid UTF-8"))
+            .map_err(|_| SecretError::Other(anyhow!("secret value is not valid UTF-8")))?;
-        })?;
 
         Ok(secret_string)
     }

src/providers/git_sync.rs

@@ -1,13 +1,13 @@
-use std::io;
-use std::path::{Path, PathBuf};
-use std::process::{Command, Stdio};
-use std::{env, fs};
 use anyhow::anyhow;
 use chrono::Utc;
 use dialoguer::Confirm;
 use dialoguer::theme::ColorfulTheme;
 use indoc::formatdoc;
 use log::debug;
+use std::io;
+use std::path::{Path, PathBuf};
+use std::process::{Command, Stdio};
+use std::{env, fs};
 use thiserror::Error;
 use validator::Validate;
 
@@ -78,9 +78,11 @@ pub fn sync_and_push(opts: &SyncOpts<'_>) -> SyncResult<()> {
     let repo_dir = config_dir.join(format!(".{}", repo_name));
     fs::create_dir_all(&repo_dir)?;
 
-    let default_vault = confy::get_configuration_file_path(&calling_app_name(), "vault")
+    let default_vault =
-        .map_err(|e| SyncError::Config {
+        confy::get_configuration_file_path(&calling_app_name(), "vault").map_err(|e| {
-            message: format!("get default vault path: {}", e),
+            SyncError::Config {
+                message: format!("get default vault path: {}", e),
+            }
         })?;
     let repo_vault = repo_dir.join("vault.yml");
     if default_vault.exists() && !repo_vault.exists() {
@@ -156,9 +158,7 @@ fn resolve_git_email(git: &Path, email: Option<&String>) -> SyncResult<String> {
     })
 }
 
-pub(in crate::providers) fn resolve_git(
+pub(in crate::providers) fn resolve_git(override_path: Option<&PathBuf>) -> SyncResult<PathBuf> {
-    override_path: Option<&PathBuf>,
-) -> SyncResult<PathBuf> {
     debug!("Resolving git executable");
     if let Some(p) = override_path {
         return Ok(p.to_path_buf());
@@ -199,11 +199,7 @@ pub(in crate::providers) fn ensure_git_available(git: &Path) -> SyncResult<()> {
 }
 
 fn run_git(git: &Path, repo: &Path, args: &[&str]) -> SyncResult<()> {
-    let out = Command::new(git)
+    let out = Command::new(git).arg("-C").arg(repo).args(args).output()?;
-        .arg("-C")
-        .arg(repo)
-        .args(args)
-        .output()?;
 
     if !out.status.success() {
         return Err(SyncError::GitCommandFailed {
@@ -305,12 +301,7 @@ fn init_repo_if_needed(git: &Path, repo: &Path, branch: &str) -> SyncResult<()>
     Ok(())
 }
 
-fn set_local_identity(
+fn set_local_identity(git: &Path, repo: &Path, username: String, email: String) -> SyncResult<()> {
-    git: &Path,
-    repo: &Path,
-    username: String,
-    email: String,
-) -> SyncResult<()> {
     run_git(git, repo, &["config", "user.name", &username]).map_err(|e| SyncError::Config {
         message: format!("failed to set git user.name: {}", e),
     })?;

src/providers/local.rs

@@ -128,8 +128,7 @@ impl SecretProvider for LocalProvider {
         }
 
         let password = self.get_password()?;
-        let envelope =
+        let envelope = encrypt_string(&password, value).map_err(SecretError::Other)?;
-            encrypt_string(&password, value).map_err(SecretError::Other)?;
         drop(password);
 
         vault.insert(key.to_string(), envelope);
@@ -142,8 +141,7 @@ impl SecretProvider for LocalProvider {
         let mut vault: HashMap<String, String> = load_vault(&vault_path).unwrap_or_default();
 
         let password = self.get_password()?;
-        let envelope =
+        let envelope = encrypt_string(&password, value).map_err(SecretError::Other)?;
-            encrypt_string(&password, value).map_err(SecretError::Other)?;
         drop(password);
 
         if vault.contains_key(key) {
@@ -373,12 +371,8 @@ impl LocalProvider {
                 }
             }
 
-            let password = SecretString::new(
+            let password =
-                fs::read_to_string(password_file)?
+                SecretString::new(fs::read_to_string(password_file)?.trim().to_string().into());
-                    .trim()
-                    .to_string()
-                    .into(),
-            );
 
             Ok(password)
         } else {
@@ -600,11 +594,12 @@ fn decrypt_string(password: &SecretString, envelope: &str) -> LocalResult<String
 
     let aad_current = format!("{};{};{};m={},t={},p={}", HEADER, VERSION, KDF, m, t, p);
 
-    let mut key = derive_key_with_params(password, &salt, m, t, p)
+    let mut key = derive_key_with_params(password, &salt, m, t, p).map_err(|source| {
-        .map_err(|source| SecretError::AuthFailed {
+        SecretError::AuthFailed {
             provider: PROVIDER,
             source,
-        })?;
+        }
+    })?;
     let cipher = XChaCha20Poly1305::new(&key);
 
     if let Ok(pt) = try_decrypt(&cipher, &nonce, &ct, aad_current.as_bytes()) {