{"record":{"id":"8585cf37518fe277","repo":"zeroclaw-labs/zeroclaw","slug":"invalid-label-entry-s-each-entry-must-be-8585cf","errorCode":null,"errorMessage":"Invalid {label} entry(s): [{}]. Each entry must be an RFC 6052 NAT64 prefix written as <ipv6>/<length> with a length of 32, 40, 48, 56, 64, or 96 and no bits set beyond it, for example \\\"2001:db8:122:344::/96\\\".","messagePattern":"Invalid (.+?) entry\\(s\\): \\[(.+?)\\]\\. Each entry must be an RFC 6052 NAT64 prefix written as <ipv6>/<length> with a length of 32, 40, 48, 56, 64, or 96 and no bits set beyond it, for example \\\\\"2001:db8:122:344::/96\\\\\"\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/zeroclaw-infra/src/net_guard.rs","lineNumber":728,"sourceCode":"/// A malformed list is never silently reduced to its well-formed subset. One\n/// bad entry rejects the whole list so that a typo fails the caller closed\n/// instead of quietly narrowing the validation boundary — a list that parsed\n/// to \"no prefixes\" would look exactly like a deployment that runs no NAT64\n/// translator, and would disable network-specific classification without any\n/// signal.\npub fn parse_nat64_prefixes(prefixes: &[String], label: &str) -> anyhow::Result<Vec<Nat64Prefix>> {\n    let mut parsed = Vec::with_capacity(prefixes.len());\n    let mut rejected = Vec::new();\n\n    for entry in prefixes {\n        match Nat64Prefix::parse(entry) {\n            Ok(prefix) => parsed.push(prefix),\n            Err(err) => rejected.push(format!(\"'{entry}' ({err})\")),\n        }\n    }\n\n    if !rejected.is_empty() {\n        anyhow::bail!(\n            \"Invalid {label} entry(s): [{}]. Each entry must be an RFC 6052 NAT64 prefix written \\\n             as <ipv6>/<length> with a length of 32, 40, 48, 56, 64, or 96 and no bits set beyond \\\n             it, for example \\\"2001:db8:122:344::/96\\\".\",\n            rejected.join(\", \")\n        );\n    }\n\n    parsed.sort_unstable();\n    parsed.dedup();\n    Ok(parsed)\n}\n\n/// Decode `v6` under **every** configured prefix that contains it, yielding\n/// each such prefix alongside the IPv4 address it embeds.\n///\n/// Configured prefixes may overlap: a prefix is a CIDR range, so a declared\n/// `/96` can nest inside a declared `/32`, and one IPv6 address then sits in\n/// both. The two prefixes decode different octets, so they translate that one","sourceCodeStart":710,"sourceCodeEnd":746,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-infra/src/net_guard.rs#L710-L746","documentation":"Error \"Invalid {label} entry(s): [{}]. Each entry must be an RFC 6052 NAT64 prefix written as <ipv6>/<length> with a length of 32, 40, 48, 56, 64, or 96 and no bits set beyond it, for example \\\"2001:db8:122:344::/96\\\".\" thrown in zeroclaw-labs/zeroclaw.","triggerScenarios":"Thrown at crates/zeroclaw-infra/src/net_guard.rs:728 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Rewrite each entry as <ipv6>/<length> per RFC 6052, e.g. \"2001:db8:122:344::/96\"."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}