Function seed_from_bytes 

pub fn seed_from_bytes(bytes: &[u8]) -> Result<[u8; 32], SeedError>

Checks decoded bytes into a seed, refusing the two shapes that are not one.

Takes bytes rather than a base64 string on purpose: this crate carries no encoder (crate docs), so each side decodes with the shared base64 crate and hands the result here. That keeps one validation for both sides, which is the half that has to agree — a host that accepted a seed the daemon refuses would report a launch as identity-capable and then fail every handshake against it.