Enum Error 

#[non_exhaustive]
pub enum Error {
    Codex32(Error),
    MnemUnknownLanguage(u8),
    WrongHrp {
        got: String,
    },
    ThresholdNotZero {
        got: u8,
    },
    ShareIndexNotSecret {
        got: char,
    },
    TagInvalidAlphabet {
        got: [u8; 4],
    },
    UnknownTag {
        got: [u8; 4],
    },
    ReservedTagNotEmittedInV01 {
        got: [u8; 4],
    },
    ReservedPrefixViolation {
        got: u8,
    },
    UnexpectedStringLength {
        got: usize,
        allowed: &'static [usize],
    },
    PayloadLengthMismatch {
        tag: [u8; 4],
        expected: &'static [usize],
        got: usize,
    },
    TooManyErrors {
        bound: u8,
    },
    InvalidShareCount {
        k: u8,
        n: usize,
    },
    InvalidThreshold(u8),
    IsShareNotSingleString {
        threshold: char,
        index: char,
    },
    SecretShareSuppliedToCombine,
    InconsistentShareSet,
}

ms-codec error type.

Debug is hand-implemented (NOT derived) so that neither Display nor Debug of this type can echo ≥8 contiguous chars of secret input (ms-codec-error-display-echoes-input, 0.4.4). A derived Debug would print every field — including the raw input carried by the inner crate::codex32::Error (InvalidChecksum/MismatchedHrp/MismatchedId) and the WrongHrp.got HRP — so it is replaced by a delegation to the sanitized Display. This is load-bearing for downstream #[derive(Debug)] wrappers (toolkit ToolkitError/CliError) whose {:?} transitively renders this type via panics / expect / logging. Replacing the derive is NOT a SemVer break (the Debug IMPL is preserved; its exact output is not contractual).

Variants (Non-exhaustive)

Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.

Codex32(Error)

codex32 parse / checksum failure, delegated from the vendored codex32 module (crate::codex32::Error; Cycle-B inlined the formerly-external codex32 = "=0.1.0" crate). The variant NAME and field SHAPE are unchanged from the external-dep era; only the inner type’s crate-path moved (codex32::Error → crate::codex32::Error) — a pre-1.0 breaking change for any downstream matcher that named the old extern type (the toolkit’s friendly.rs is exactly such a matcher → its paired bump).

MnemUnknownLanguage(u8)

Mnem wordlist-language byte was not in the valid range 0..=9 (SPEC v0.2 §3).

WrongHrp

HRP was not “ms” (SPEC §4 rule 2).

Fields

got: String

The HRP that was observed.

ThresholdNotZero

Threshold was not 0 (SPEC §4 rule 3).

Fields

got: u8

The threshold-position byte (ASCII digit) that was observed.

ShareIndexNotSecret

Share-index was not ‘s’ — BIP-93 requires ‘s’ for threshold=0 (SPEC §4 rule 4).

Fields

got: char

The share-index character that was observed.

TagInvalidAlphabet

Tag bytes were not in the codex32 alphabet (SPEC §4 rule 5).

Fields

got: [u8; 4]

The 4-byte id-field bytes that failed alphabet validation.

UnknownTag

Tag was structurally valid but not in RESERVED_TAG_TABLE (SPEC §4 rule 6).

Fields

got: [u8; 4]

The 4-byte tag that was not recognized.

ReservedTagNotEmittedInV01

Tag was in RESERVED_TAG_TABLE but reserved-not-emitted in v0.1 (SPEC §4 rule 7, SPEC §3.5.1 encoder symmetry).

Fields

got: [u8; 4]

The 4-byte reserved tag (one of seed/xprv/mnem/prvk in v0.1).

ReservedPrefixViolation

Reserved-prefix byte was not 0x00 (SPEC §4 rule 8).

Fields

got: u8

The non-zero prefix byte that was observed.

UnexpectedStringLength

Total string length was outside the v0.1 emittable set (SPEC §4 rule 9).

Fields

got: usize

The total string length that was observed.

allowed: &'static [usize]

The set of v0.1-emittable lengths.

PayloadLengthMismatch

Payload byte length did not match the tag’s spec (SPEC §3.5, §4 rule 10).

Fields

tag: [u8; 4]

The 4-byte tag whose length set was checked against.

expected: &'static [usize]

The set of valid byte lengths for this tag.

got: usize

The observed payload byte length (after stripping the prefix byte).

TooManyErrors

BCH error-correction (bch_decode) reported the input is uncorrectable — the number of symbol errors exceeds the regular code’s t = 4 correction capacity (singleton bound d = 8). Surfaced by crate::decode_with_correction when bch_decode::decode_regular_errors returns None, or when a post-correction re-verification step fails (catches pathological 5+-error patterns that fool the decoder into producing a “consistent” but invalid locator). Added v0.2.0 per plan §1 D29 + §2.B.2.

bound = 8 is the BCH(93,80,8) singleton bound. ms1 is single-chunk only — no chunk_index field (cf. md-codec’s TooManyErrors which carries chunk-set context).

Fields

bound: u8

Singleton bound for the BCH regular code (always 8).

InvalidShareCount

Share count n was outside the valid range for threshold k (need k <= n <= 31; there are exactly 31 valid non-s share indices).

Fields

k: u8

The threshold k that was requested.

n: usize

The share count n that was requested (out of range).

InvalidThreshold(u8)

Threshold k was not in the valid share range 2..=9 (Threshold::ZERO is the unshared single-string sentinel, a const).

IsShareNotSingleString

A single-string decode was handed one share of a K-of-N share-set (threshold char 2..9). Use ms combine to recombine K shares.

Fields

threshold: char

The threshold char observed on the wire ('2'..'9').

index: char

The share-index char observed on the wire.

SecretShareSuppliedToCombine

combine_shares was handed the secret-at-S (index s) as an input. The secret-at-S is the recovery target, never a combine input; codex32’s interpolate_at would short-circuit on it and bypass validation (C1).

InconsistentShareSet

combine_shares was handed a same-id (same hrp/id/threshold/length) but cross-polynomial share set: the first k shares define one polynomial, but at least one EXTRA supplied share does not lie on it. Beyond-BIP-93 defense-in-depth (codex32 K-of-N carries no digest share) — without this check the combine would silently return a WRONG secret. The supplied shares are not all from the same split.

Trait Implementations

impl Debug for Error

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Hand-rolled to match Display’s sanitization — see the type doc. Delegates to the (non-echoing) Display so the leaky inner crate::codex32::Error String fields and the (already construction-bounded) WrongHrp.got can never reach a derived field dump. Wrapped as Error("…") so the output still reads as a debug value.

impl Display for Error

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Error for Error

fn source(&self) -> Option<&(dyn Error + 'static)>

Returns the lower-level source of this error, if any.

fn description(&self) -> &str

👎Deprecated since 1.42.0:

use the Display impl or to_string()

fn cause(&self) -> Option<&dyn Error>

👎Deprecated since 1.33.0:

replaced by Error::source, which can support downcasting

fn provide<'a>(&'a self, request: &mut Request<'a>)

🔬This is a nightly-only experimental API. (error_generic_member_access)

Provides type-based access to context intended for error reports.

impl From<Error> for Error

fn from(e: Error) -> Self

Converts to this type from the input type.