{"record":{"id":"43166bc649ebd35e","repo":"nikivdev/code","slug":"failed-to-seal-message","errorCode":null,"errorMessage":"failed to seal message","messagePattern":"failed to seal message","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/sealer_crypto.rs","lineNumber":56,"sourceCode":"    ))\n}\n\npub fn seal(\n    message: &[u8],\n    sender_secret: &str,\n    recipient_id: &str,\n    nonce_material: &[u8],\n) -> Result<Vec<u8>> {\n    let sender_secret = decode_secret(sender_secret)?;\n    let recipient_public = decode_id(recipient_id)?;\n    let sender_key = StaticSecret::from(sender_secret);\n    let recipient_key = PublicKey::from(recipient_public);\n    let shared_secret = sender_key.diffie_hellman(&recipient_key).to_bytes();\n    let nonce = derive_nonce(nonce_material);\n    let cipher = XSalsa20Poly1305::new(&shared_secret.into());\n    let ciphertext = cipher\n        .encrypt(&nonce.into(), message)\n        .map_err(|_| anyhow::anyhow!(\"failed to seal message\"))?;\n    Ok(ciphertext)\n}\n\npub fn unseal(\n    sealed_message: &[u8],\n    recipient_secret: &str,\n    sender_id: &str,\n    nonce_material: &[u8],\n) -> Result<Vec<u8>> {\n    let recipient_secret = decode_secret(recipient_secret)?;\n    let sender_public = decode_id(sender_id)?;\n    let recipient_key = StaticSecret::from(recipient_secret);\n    let sender_key = PublicKey::from(sender_public);\n    let shared_secret = recipient_key.diffie_hellman(&sender_key).to_bytes();\n    let nonce = derive_nonce(nonce_material);\n    let cipher = XSalsa20Poly1305::new(&shared_secret.into());\n    let plaintext = cipher\n        .decrypt(&nonce.into(), sealed_message)","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/nikivdev/code/blob/a747e741ae92c09071d0ae946ab48488adcff1ce/src/sealer_crypto.rs#L38-L74","documentation":"seal performs an authenticated XSalsa20Poly1305 encryption of the message using a shared secret derived from the sender's private key and the recipient's public key (via x25519 Diffie-Hellman). The aead::encrypt call returning Err causes this error; with valid inputs encryption essentially never fails, so this usually indicates a cipher/state problem rather than a user-input issue.","triggerScenarios":"Calling seal (via seal_project_env_value or seal_private_key) where the XSalsa20Poly1305 encrypt operation fails — practically only when internal AEAD invariants break (e.g. oversized input per implementation limits or a corrupt key state).","commonSituations":"Rare in practice; may appear when sealing extremely large payloads beyond library limits, or as a symptom of a build/dependency mismatch in the crypto stack.","solutions":["Retry the seal operation; the failure is not key-dependent (any valid keypair pair works).","Check payload size and split or compress unusually large values before sealing.","Verify crypto dependency versions (crypto_secretbox, x25519_dalek) are consistent and rebuild.","Inspect the sender secret / recipient public key decode path — if keys fail to decode you would see earlier errors; if this fires alone, suspect the library environment."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"match seal(sender_secret, recipient_id, nonce_material, &message) {\n    Ok(ct) => ct,\n    Err(e) if e.to_string().contains(\"failed to seal message\") => {\n        // non-input failure: retry once, then surface\n        seal(sender_secret, recipient_id, nonce_material, &message)\n            .context(\"sealing failed repeatedly; check payload size and crypto stack\")?\n    }\n    Err(e) => return Err(e),\n}","preventionTips":["Keep sealed payloads within reasonable size limits; compress or chunk very large values.","Pin and audit crypto crate versions (crypto_secretbox, x25519_dalek).","Validate secrets/ids with decode-side checks first so seal failures are never key-related.","Log payload metadata (not contents) on seal failure to aid diagnosis."],"tags":["crypto","encryption","aead","sealing"],"backgroundTag":"encryption-failed","analyzedSha":"a747e741ae92c09071d0ae946ab48488adcff1ce","analyzedAt":"2026-09-01T22:43:55.719Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}