Enum ManagerError 

pub enum ManagerError {
    UnknownKey(String),
    UnknownBackend {
        key: String,
        backend: String,
    },
    OpNotValidForClass {
        op: &'static str,
        key: String,
        class: Class,
    },
    UnsupportedKeyType {
        backend: String,
        op: &'static str,
        key_type: KeyType,
    },
    Unsupported(&'static str),
    AlgorithmMismatch {
        key: String,
        requested: AeadAlgorithm,
        actual: &'static str,
    },
    KemAlgorithmMismatch {
        key: String,
        requested: &'static str,
        actual: &'static str,
    },
    ValueRotateNeedsSet(String),
    Sealing(SealingFailure),
    UnsealContextNotPermitted(String),
    Signing(SigningFailure),
    MissingPublicPath(String),
    Provider(ProviderError),
    Backend(BackendError),
}

An error from resolving or routing a catalog key. Fails closed; never panics.

Variants

UnknownKey(String)

The dotted name is not in the catalog’s key inventory.

UnknownBackend

A key entry names a backend instance that was not provided at construction. Caught at BackendManager::new; never surfaces at request time.

Fields

key: String

The offending key name.

backend: String

The backend name the key references.

OpNotValidForClass

The requested op is not valid for the resolved key’s Class (e.g. sign on a value key).

Fields

op: &'static str

The op that was attempted.

key: String

The key it was attempted on.

class: Class

The key’s class.

UnsupportedKeyType

The backend’s static capability preset does not declare support for this key type on a mint/import/generate path.

Fields

backend: String

Backend catalog name.

op: &'static str

Operation that required native key-type support.

key_type: KeyType

Requested wire key type.

Unsupported(&'static str)

The op is recognized but its Backend method does not exist yet (a later per-op issue + Backend-trait expansion backs it).

AlgorithmMismatch

An encrypt algorithm that does not match the key’s catalog keyType (e.g. chacha20-poly1305 against an aes-256-gcm key), or an encrypt on a key whose catalog keyType is not an AEAD suite. Maps to the wire invalid_request (§4.2).

Fields

key: String

The key whose catalog type was consulted.

requested: AeadAlgorithm

The requested AEAD suite.

actual: &'static str

The key’s catalog AEAD type (or a note that it is not symmetric).

KemAlgorithmMismatch

A KEM envelope requests an algorithm that does not match the sealing key’s catalog keyType.

Fields

key: String

The key whose catalog type was consulted.

requested: &'static str

Requested KEM algorithm token.

actual: &'static str

Catalog algorithm token.

ValueRotateNeedsSet(String)

rotate on a value key that has no generate recipe: there is no fresh value to write, so rotation is invalid_request: use set with out-of-band material instead (§7 / vault-a2p).

Sealing(SealingFailure)

A sealing op (wrap/unwrap/get_public_key) failed: a malformed materialized private key, a malformed envelope, or an AEAD authentication failure. The open-side failure is opaque (no oracle).

UnsealContextNotPermitted(String)

The caller holds op:decrypt on this sealing key, but the key pins an allowed COSE unseal context (KDF party identities and/or external_aad) that this envelope is not bound to (basil-2rqj). A least-privilege refusal: the grant authorizes only the pinned contexts, never any envelope addressed to the key. Fails closed as permission-denied. Carries no secret material: the party identities are cleartext header values and the external_aad is caller-supplied.

Signing(SigningFailure)

A value-store (engine=kv2) Ed25519 materialize-to-sign op (sign/verify/get_public_key) failed because the materialized seed or a verify input was malformed (wrong length). Carries no secret material.

MissingPublicPath(String)

A materialize-to-use key (sealing / asymmetric+engine=kv2) was asked for its public half but carries no public_path. A catalog loaded through crate::catalog::load always has one (loader guardrail, basil-o86); this fails closed when the manager was built from an unvalidated catalog rather than re-deriving the public from the private (which the op surface forbids).

Provider(ProviderError)

A provider-dispatched (ML-DSA software-custody) operation failed: an unsupported algorithm/provider combination, a policy denial of the local-software provider, or an opaque software-custody crypto failure. Carries no secret material.

Backend(BackendError)

The resolved backend returned an error for this op.

Trait Implementations

impl Debug for ManagerError

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for ManagerError

fn fmt(&self, __formatter: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Error for ManagerError

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.

impl From<BackendError> for ManagerError

fn from(source: BackendError) -> Self

Converts to this type from the input type.

impl From<ProviderError> for ManagerError

fn from(source: ProviderError) -> Self

Converts to this type from the input type.