{"record":{"id":"a03b0f48acd6aeaf","repo":"astrid-runtime/astrid","slug":"secret-value-for-key-exceeds-65536-byte-limit","errorCode":null,"errorMessage":"secret value for {key} exceeds 65536-byte limit","messagePattern":"secret value for (.+?) exceeds 65536-byte limit","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-cli/src/commands/capsule/install_daemon.rs","lineNumber":434,"sourceCode":"        if key.is_empty() || key.contains('\\0') || key.contains(':') {\n            bail!(\"--var has an invalid key (got {key:?})\");\n        }\n        if parsed.insert(key.to_owned(), value.to_owned()).is_some() {\n            bail!(\"--var '{key}' was supplied more than once\");\n        }\n    }\n\n    let mut values = Vec::with_capacity(parsed.len());\n    for (key, value) in parsed {\n        let definition = manifest.env.get(&key).ok_or_else(|| {\n            anyhow::anyhow!(\n                \"--var names no [env] field in {}: {key}\",\n                manifest.package.name\n            )\n        })?;\n        let kind = if definition.env_type.eq_ignore_ascii_case(\"secret\") {\n            if value.len() > 64 * 1024 {\n                bail!(\"secret value for {key} exceeds 65536-byte limit\");\n            }\n            EnvValueKind::Secret\n        } else {\n            if value.len() > 1 << 20 {\n                bail!(\"environment value for {key} exceeds 1048576-byte limit\");\n            }\n            EnvValueKind::Text\n        };\n        if !definition.enum_values.is_empty()\n            && !definition\n                .enum_values\n                .iter()\n                .any(|allowed| allowed == &value)\n        {\n            bail!(\n                \"invalid value for {}.{}: expected one of {}, got {value:?}\",\n                manifest.package.name,\n                key,","sourceCodeStart":416,"sourceCodeEnd":452,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-cli/src/commands/capsule/install_daemon.rs#L416-L452","documentation":"For [env] entries whose env_type is 'secret' (case-insensitive), validate_values enforces a 64 KiB (65536-byte) maximum value length. Larger secret values are rejected before being sent to the daemon.","triggerScenarios":"Passing --var KEY=<value> where the [env] KEY in Capsule.toml declares env_type = \"secret\" and value.len() > 64 * 1024 (e.g. an embedded PEM, keystore, or large token blob).","commonSituations":"Inlining a full TLS key/certificate chain or large credential blob as a secret var; base64-encoding a file into the flag pushing it past 64 KiB.","solutions":["Trim the secret to under 65536 bytes, or store only a reference/paths instead of the blob.","Upload large material through the daemon's dedicated secret mechanism rather than --var.","If it's genuinely not a secret, change the [env] env_type in Capsule.toml to text (1 MiB limit)."],"exampleFix":"// before (Capsule.toml)\n[env.CERT_BLOB]\nenv_type = \"secret\"\n// after\n[env.CERT_BLOB]\nenv_type = \"text\"  # if not actually secret; 1 MiB limit applies","handlingStrategy":"validation","validationCode":"if env_declared_secret && value.len() > 64 * 1024 { return Err(\"secret exceeds 64KiB\"); }","typeGuard":null,"tryCatchPattern":"on this error, stop and restructure the secret delivery (external store or file reference); retrying with the same value will always fail.","preventionTips":["Check secret sizes locally before passing them via --var.","Store large material in a secret manager and pass a reference.","Reserve env secrets for short tokens, not file blobs."],"tags":["validation","limit","secret","env"],"backgroundTag":"payload-too-large","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}