What causes "secret value for {key} exceeds 65536-byte limit" in astrid-runtime/astrid?

Trim the secret to under 65536 bytes, or store only a reference/paths instead of the blob.

secret value for {key} exceeds 65536-byte limit

Error message

secret value for {key} exceeds 65536-byte limit

What it means

For [env] entries whose env_type is 'secret' (case-insensitive), validate_values enforces a 64 KiB (65536-byte) maximum value length. Larger secret values are rejected before being sent to the daemon.

Source

Thrown at crates/astrid-cli/src/commands/capsule/install_daemon.rs:434

        if key.is_empty() || key.contains('\0') || key.contains(':') {
            bail!("--var has an invalid key (got {key:?})");
        }
        if parsed.insert(key.to_owned(), value.to_owned()).is_some() {
            bail!("--var '{key}' was supplied more than once");
        }
    }

    let mut values = Vec::with_capacity(parsed.len());
    for (key, value) in parsed {
        let definition = manifest.env.get(&key).ok_or_else(|| {
            anyhow::anyhow!(
                "--var names no [env] field in {}: {key}",
                manifest.package.name
            )
        })?;
        let kind = if definition.env_type.eq_ignore_ascii_case("secret") {
            if value.len() > 64 * 1024 {
                bail!("secret value for {key} exceeds 65536-byte limit");
            }
            EnvValueKind::Secret
        } else {
            if value.len() > 1 << 20 {
                bail!("environment value for {key} exceeds 1048576-byte limit");
            }
            EnvValueKind::Text
        };
        if !definition.enum_values.is_empty()
            && !definition
                .enum_values
                .iter()
                .any(|allowed| allowed == &value)
        {
            bail!(
                "invalid value for {}.{}: expected one of {}, got {value:?}",
                manifest.package.name,
                key,

View on GitHub (pinned to affd8760f4)

Solutions

Trim the secret to under 65536 bytes, or store only a reference/paths instead of the blob.
Upload large material through the daemon's dedicated secret mechanism rather than --var.
If it's genuinely not a secret, change the [env] env_type in Capsule.toml to text (1 MiB limit).

Example fix

// before (Capsule.toml)
[env.CERT_BLOB]
env_type = "secret"
// after
[env.CERT_BLOB]
env_type = "text"  # if not actually secret; 1 MiB limit applies

Defensive patterns

Strategy: validation

Validate before calling

if env_declared_secret && value.len() > 64 * 1024 { return Err("secret exceeds 64KiB"); }

Try / catch

on this error, stop and restructure the secret delivery (external store or file reference); retrying with the same value will always fail.

Prevention

Check secret sizes locally before passing them via --var.
Store large material in a secret manager and pass a reference.
Reserve env secrets for short tokens, not file blobs.

When it happens

Trigger: Passing --var KEY=<value> where the [env] KEY in Capsule.toml declares env_type = "secret" and value.len() > 64 * 1024 (e.g. an embedded PEM, keystore, or large token blob).

Common situations: Inlining a full TLS key/certificate chain or large credential blob as a secret var; base64-encoding a file into the flag pushing it past 64 KiB.

Understand the failure class

Background: payload too large / request exceeds maximum size: why libraries cap bytes and how to fix oversize payloads — this error's family across 50 libraries.

Related errors

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/a03b0f48acd6aeaf. Report an issue: GitHub.