Module error 

Typed errors for content-addressing operations.

Every fallible operation in this crate returns ContentError. We use thiserror (not anyhow) so callers can match on the exact failure mode — encoding, decoding, verification, non-canonical input, or CID parsing — and so the error type stays part of the crate’s public contract.

Operation → variant map (FROZEN at 0.1.0)

This table is the legible contract: which operation can produce which variant. It is part of the frozen 0.1.0 error surface (README gate item #7) — adding a new operation/variant pair later is allowed (the enum is #[non_exhaustive]), but the rows below will not change meaning.

Operation	Variant(s) it can return
to_canonical_dagcbor	EncodingError
from_canonical_dagcbor	DecodingError
ContentId::from_canonical_bytes_checked	DecodingError (not dag-cbor), NonCanonical (valid but non-canonical), EncodingError (re-encode failed)
ContentId::from_bytes / FromStr / TryFrom<Cid> / binary Deserialize	InvalidCid (not a CID at all) or InvalidCidProfile (a valid CID that is not the frozen profile)
content_id	propagates canonical_form’s error only (typically EncodingError)
verify	propagates content_id only; a mismatch is Ok(false), never an Err
ensure_content_id	propagates content_id, plus VerificationFailed on mismatch
from_canonical_bytes / from_blake3_content_digest	infallible — never returns an error

Frozen freeze decisions (0.1.0)

• #[non_exhaustive] is retained on purpose so a future variant (e.g. an UnsupportedCodec / DigestLength) can be added without a major version bump. Callers already must carry a _ => … arm. Do not remove it to chase exhaustive matching — that would forfeit additive evolution.
• No #[from] impls. Auto-From conversions are deliberately not provided: a #[from] bakes the source type into the public contract just as firmly as a field, and the two codec sources are exactly the unstable serde_ipld_dagcbor generics we hide behind a boxed dyn Error (see below). Construction stays explicit via map_err at the call sites. Do not “helpfully” add a #[from] — it re-leaks the generics into the frozen API.
• The codec source types are boxed. EncodingError/DecodingError carry their #[source] as a Box<dyn std::error::Error + Send + Sync + 'static> rather than the concrete serde_ipld_dagcbor::EncodeError<…> / DecodeError<…>. This keeps .source()/{source} diagnostics while decoupling the frozen signature from a codec-crate patch bump that changes those generics.

Enums

ContentError

The error type returned by all fallible operations in this crate.