Enum Error 

#[non_exhaustive]
pub enum Error {
    Acquisition {
        source: Cow<'static, str>,
        reason: String,
    },
    KeyNotFound,
    Fragment(String),
    Defragment(String),
    Decoy(String),
    Codex(String),
    LockedOut,
    MemoryLock(String),
    InvalidConfig(String),
    Internal(&'static str),
}

A redaction-safe error type covering every failure mode the vault can surface.

Variants are coarse on purpose: callers branch on category (acquisition vs. storage vs. policy) and use the embedded message for diagnostics. Variants must remain free of key material — see the module-level documentation.

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Acquisition

A KeyFetch implementation failed to obtain key material from its source.

The source is a short identifier for the fetcher (for example "keychain", "file", "env"). The reason is a redacted, human-readable explanation that must not include the key bytes, the credential, or any secret-equivalent value.

Fields

source: Cow<'static, str>

Short identifier for the fetcher that produced the failure.

reason: String

Sanitized explanation. Never key material.

KeyNotFound

A lookup failed because no key matching the requested identifier is registered in the vault.

Fragment(String)

Fragmenting the raw key into the configured storage layout failed.

Reasons include: invalid configuration (for example frag_max < frag_min), or an internal invariant being violated by a custom FragmentStrategy.

Defragment(String)

Reassembling fragments back into a usable key failed.

This is almost always an internal error: the fragmenter and defragmenter disagreed on the layout, or storage was corrupted.

Decoy(String)

A decoy strategy could not produce filler bytes for the configured output length.

Codex(String)

A Codex failed to encode or decode a byte. Custom codex implementations may return this if they want to refuse specific inputs; the built-in codices never do.

LockedOut

The vault is locked out: a SecurityMonitor threshold has been crossed and access is denied until the configured recovery condition is met.

MemoryLock(String)

Acquiring or releasing OS-level memory page locks (mlock / VirtualLock) failed. This typically means the process has hit its memlock rlimit and the operator must raise it.

InvalidConfig(String)

The configuration passed to the KeyVaultBuilder is internally inconsistent.

Internal(&'static str)

An internal invariant was violated. Indicates a bug in key-vault itself; please file an issue.

Trait Implementations

impl Debug for Error

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for Error

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Error for Error

Available on crate feature std only.

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.