What causes "--smart-policy is required in encrypt mode" in OpenNHP/opennhp?

Add --smart-policy to the command

--smart-policy is required in encrypt mode

Error message

--smart-policy is required in encrypt mode

What it means

Encrypt mode always requires a wasm smart-policy file that defines how the data is encrypted/policy-enforced. The Before hook checks c.String("smart-policy") and returns this error for every encrypt-mode run (create or update) where the flag is empty.

Solutions

Add --smart-policy <path-to-wasm-policy-file> to the command
Verify the shell variable holding the policy path is non-empty before invoking
If you actually wanted decryption, use --mode decrypt with --ztdo/--data-private-key/--provider-public-key

Example fix

// before
nhp-device run --mode encrypt --source ./data.csv --output ./out.ztdo
// after
nhp-device run --mode encrypt --source ./data.csv --output ./out.ztdo --smart-policy ./policy.wasm

Defensive patterns

Strategy: validation

Validate before calling

if (flags.mode === 'encrypt' && !flags['smart-policy']) {
  throw new Error('--smart-policy wasm file is required in encrypt mode');
}

Type guard

const isEncryptMode = (flags) => flags.mode === 'encrypt';

Prevention

Ship the wasm policy alongside deployment artifacts and reference a fixed path
Check the file exists (test -f) before invoking
Remember encrypt always needs --smart-policy; decrypt does not

When it happens

Trigger: Any `nhp-device run --mode encrypt ...` invocation that omits --smart-policy, regardless of --ztdo-id or --data-source-type.

Common situations: Omitting the flag because decrypt mode does not need it; assuming a default policy exists; path variables expanding to empty in shell scripts.

Understand the failure class

Background: "--flag is required" and "must specify" CLI errors: how missing-required-flag validation works and how to fix it — this error's family across 20 libraries.

Related errors

AI-assisted analysis of OpenNHP/opennhp@6e04ca5ff0 (2026-09-07). Data as JSON: /api/errors/6910d295026c3555. Report an issue: GitHub.

Appendix: source

Thrown at endpoints/db/main/main.go:74

				if c.String("ztdo-id") != "" { // update ztdo
					if c.String("source") != "" || c.String("output") != "" || c.String("metadata") != "" || c.String("data-source-type") != "" {
						return fmt.Errorf("--source, --output, --data-source-type and --metadata are not allowed when --ztdo-id is specified")
					}
				} else { // create ztdo
					if c.String("data-source-type") != "stream" {
						if c.String("source") == "" {
							return fmt.Errorf("--source is required when --data-source-type is not stream and --ztdo-id is not specified")
						}
					} else {
						if c.String("access-url") == "" {
							return fmt.Errorf("--access-url is required when --data-source-type is stream")
						}
					}
				}

				if c.String("smart-policy") == "" {
					return fmt.Errorf("--smart-policy is required in encrypt mode")
				}

				// only be available in decrypt mode
				if c.String("ztdo") != "" || c.String("data-private-key") != "" || c.String("provider-public-key") != "" {
					return fmt.Errorf("--ztdo, --data-private-key and --provider-public-key are only allowed in decrypt mode")
				}
			} else if c.String("mode") == "decrypt" {
				if c.String("source") != "" || c.String("smart-policy") != "" || c.String("access-url") != "" {
					return fmt.Errorf("--source, --smart-policy and --access-url are only allowed in encrypt mode")
				}

				// only be available in encrypt mode
				if c.String("ztdo") == "" || c.String("output") == "" || c.String("data-private-key") == "" || c.String("provider-public-key") == "" {
					return fmt.Errorf("--ztdo, --output, --data-private-key and --provider-public-key are required in decrypt mode")
				}
			} else {
				return nil
			}

View on GitHub (pinned to 6e04ca5ff0)