nikivdev/code · error

invalid sealer id prefix

Error message

invalid sealer id prefix

What it means

decode_id strips the "sealer_z" prefix from a sealer ID string before base58-decoding the embedded 32-byte public key. Called by seal and unseal on sender/recipient id arguments, it throws this error when the value lacks the "sealer_z" prefix — typically a secret was passed where an ID was expected, or the ID was truncated.

Source

Thrown at src/sealer_crypto.rs:95

}

fn decode_secret(value: &str) -> Result<[u8; 32]> {
    let encoded = value
        .strip_prefix(SECRET_PREFIX)
        .ok_or_else(|| anyhow::anyhow!("invalid sealer secret prefix"))?;
    let bytes = bs58::decode(encoded)
        .into_vec()
        .map_err(|e| anyhow::anyhow!("invalid base58 secret: {e}"))?;
    bytes
        .as_slice()
        .try_into()
        .map_err(|_| anyhow::anyhow!("invalid secret key length"))
}

fn decode_id(value: &str) -> Result<[u8; 32]> {
    let encoded = value
        .strip_prefix(ID_PREFIX)
        .ok_or_else(|| anyhow::anyhow!("invalid sealer id prefix"))?;
    let bytes = bs58::decode(encoded)
        .into_vec()
        .map_err(|e| anyhow::anyhow!("invalid base58 id: {e}"))?;
    bytes
        .as_slice()
        .try_into()
        .map_err(|_| anyhow::anyhow!("invalid public key length"))
}

fn derive_nonce(nonce_material: &[u8]) -> [u8; 24] {
    let hash = blake3::hash(nonce_material);
    let mut nonce = [0u8; 24];
    nonce.copy_from_slice(&hash.as_bytes()[..24]);
    nonce
}

View on GitHub (pinned to a747e741ae)

Solutions

1. Pass the sealer ID exactly as published, beginning with "sealer_z".
2. If you have the raw 32-byte public key, encode as "sealer_z" + base58(bytes).
3. Check you are not passing the sealer secret (prefix sealerSecret_z) where the id belongs.
4. Re-fetch the teammate's sealer id from the shared source if it was truncated.

Example fix

// before: secret passed as id
let id = decode_id("sealerSecret_zAbc...")?;
// after: actual sealer id
let id = decode_id("sealer_zDef456...")?;

fn require_prefixed_id(s: &str) -> Option<&str> {
    s.starts_with("sealer_z").then_some(s)
}

fn has_id_prefix(s: &str) -> bool {
    s.starts_with("sealer_z")
}

match seal(sender_secret, recipient_id, nonce, msg) {
    Err(e) if e.to_string().contains("invalid sealer id prefix") => {
        eprintln!("id must start with 'sealer_z' — a secret was likely passed where an id is expected");
        return Err(e);
    }
    other => other?,
}

When it happens

Trigger: Calling seal or unseal with a sender/recipient id argument not starting with "sealer_z" — e.g. passing a sealerSecret_z string, a bare base58 public key, or an empty/placeholder id.

Common situations: Swapping id and secret variables in config, storing the public key without its prefix, or referencing a teammate by secret instead of their published sealer id.

Related errors

• invalid sealer secret prefix
• invalid base58 sealer secret: {e}
• No exchanges found in session
• AI returned an empty response.
• Could not parse AI response: '{}'

AI-assisted analysis of nikivdev/code@a747e741ae (2026-09-01). Data as JSON: /api/errors/fd3a0e613370dd79. Report an issue: GitHub.