--access-url is required when --data-source-type is stream

Error message

--access-url is required when --data-source-type is stream

What it means

When encrypt mode is combined with --data-source-type stream, there is no local source file; the data comes from an API endpoint. The Before hook therefore requires --access-url and rejects the invocation with this error when it is empty.

Solutions

Add --access-url <url> pointing at the streaming API endpoint
Or if a local file was intended, use --source with --data-source-type online or offline instead of stream

Example fix

// before
nhp-device run --mode encrypt --data-source-type stream --smart-policy policy.wasm
// after
nhp-device run --mode encrypt --data-source-type stream --access-url https://api.example.com/stream --smart-policy policy.wasm

Defensive patterns

Strategy: validation

Validate before calling

if (flags.mode === 'encrypt' && flags['data-source-type'] === 'stream' && !flags['access-url']) {
  throw new Error('--access-url is required when --data-source-type is stream');
}

Type guard

const isStreamEncrypt = (flags) => flags.mode === 'encrypt' && flags['data-source-type'] === 'stream';

Prevention

Validate the URL is reachable before the encrypt run
Keep stream and file encrypt commands in separate templates
Confirm ACCESS_URL env vars resolve to non-empty values

When it happens

Trigger: Running `nhp-device run --mode encrypt --data-source-type stream` without --access-url.

Common situations: Switching a previously file-based encrypt command to stream mode and forgetting to swap --source for --access-url; template scripts with an empty ACCESS_URL variable; confusing --access-url with --output.

Understand the failure class

Background: "--flag is required" and "must specify" CLI errors: how missing-required-flag validation works and how to fix it — this error's family across 20 libraries.

Related errors

AI-assisted analysis of OpenNHP/opennhp@6e04ca5ff0 (2026-09-07). Data as JSON: /api/errors/4dc3a4f19069bb4e. Report an issue: GitHub.

Appendix: source

Thrown at endpoints/db/main/main.go:68

			if c.String("mode") == "encrypt" {
				if c.String("data-source-type") != "" {
					if !slices.Contains([]string{"online", "offline", "stream"}, c.String("data-source-type")) {
						return fmt.Errorf("invalid --data-source-type, allowed values are online, offline and stream")
					}
				}

				if c.String("ztdo-id") != "" { // update ztdo
					if c.String("source") != "" || c.String("output") != "" || c.String("metadata") != "" || c.String("data-source-type") != "" {
						return fmt.Errorf("--source, --output, --data-source-type and --metadata are not allowed when --ztdo-id is specified")
					}
				} else { // create ztdo
					if c.String("data-source-type") != "stream" {
						if c.String("source") == "" {
							return fmt.Errorf("--source is required when --data-source-type is not stream and --ztdo-id is not specified")
						}
					} else {
						if c.String("access-url") == "" {
							return fmt.Errorf("--access-url is required when --data-source-type is stream")
						}
					}
				}

				if c.String("smart-policy") == "" {
					return fmt.Errorf("--smart-policy is required in encrypt mode")
				}

				// only be available in decrypt mode
				if c.String("ztdo") != "" || c.String("data-private-key") != "" || c.String("provider-public-key") != "" {
					return fmt.Errorf("--ztdo, --data-private-key and --provider-public-key are only allowed in decrypt mode")
				}
			} else if c.String("mode") == "decrypt" {
				if c.String("source") != "" || c.String("smart-policy") != "" || c.String("access-url") != "" {
					return fmt.Errorf("--source, --smart-policy and --access-url are only allowed in encrypt mode")
				}

				// only be available in encrypt mode

View on GitHub (pinned to 6e04ca5ff0)