OpenNHP/opennhp · error

--source is required when --data-source-type is not stream…

Error message

--source is required when --data-source-type is not stream and --ztdo-id is not specified

What it means

In encrypt mode without --ztdo-id, the CLI creates a new ZTDO and requires the source of the data to encrypt. When --data-source-type is anything other than 'stream' (online/offline or unset), --source must point at the file to encrypt; otherwise this validation error fires in the Before hook.

Solutions

  1. Add --source <path-to-file> to the encrypt command
  2. Or switch to streaming by passing --data-source-type stream and providing --access-url instead
  3. Or pass --ztdo-id if the intent was to update an existing ZTDO, where --source is not needed

Example fix

// before
nhp-device run --mode encrypt --data-source-type offline --smart-policy policy.wasm --output out.ztdo
// after
nhp-device run --mode encrypt --data-source-type offline --source ./data.csv --smart-policy policy.wasm --output out.ztdo
Defensive patterns

Strategy: validation

Validate before calling

if (flags.mode === 'encrypt' && !flags['ztdo-id'] && flags['data-source-type'] !== 'stream' && !flags.source) {
  throw new Error('--source (or stream --access-url) is required for create-encrypt');
}

Type guard

const needsSource = (flags) => flags.mode === 'encrypt' && !flags['ztdo-id'] && flags['data-source-type'] !== 'stream';

Prevention

When it happens

Trigger: Running `nhp-device run --mode encrypt --smart-policy ... --output ...` while omitting --source, or passing --data-source-type online/offline without --source.

Common situations: Users assuming streaming defaults supply the source implicitly; scripts that conditionally set --data-source-type stream but fail to set --source on the non-stream path; typos like --src instead of --source leaving the flag empty.

Understand the failure class

Background: "--flag is required" and "must specify" CLI errors: how missing-required-flag validation works and how to fix it — this error's family across 20 libraries.

Related errors

AI-assisted analysis of OpenNHP/opennhp@6e04ca5ff0 (2026-09-07). Data as JSON: /api/errors/d582aad98e3aacf3. Report an issue: GitHub.

Appendix: source

Thrown at endpoints/db/main/main.go:64

			&cli.StringFlag{Name: "data-private-key", Value: "", Usage: "data private key with base64 format"},
			&cli.StringFlag{Name: "provider-public-key", Value: "", Usage: "provider public key with base64 format"},
		},
		Before: func(c *cli.Context) error {
			if c.String("mode") == "encrypt" {
				if c.String("data-source-type") != "" {
					if !slices.Contains([]string{"online", "offline", "stream"}, c.String("data-source-type")) {
						return fmt.Errorf("invalid --data-source-type, allowed values are online, offline and stream")
					}
				}

				if c.String("ztdo-id") != "" { // update ztdo
					if c.String("source") != "" || c.String("output") != "" || c.String("metadata") != "" || c.String("data-source-type") != "" {
						return fmt.Errorf("--source, --output, --data-source-type and --metadata are not allowed when --ztdo-id is specified")
					}
				} else { // create ztdo
					if c.String("data-source-type") != "stream" {
						if c.String("source") == "" {
							return fmt.Errorf("--source is required when --data-source-type is not stream and --ztdo-id is not specified")
						}
					} else {
						if c.String("access-url") == "" {
							return fmt.Errorf("--access-url is required when --data-source-type is stream")
						}
					}
				}

				if c.String("smart-policy") == "" {
					return fmt.Errorf("--smart-policy is required in encrypt mode")
				}

				// only be available in decrypt mode
				if c.String("ztdo") != "" || c.String("data-private-key") != "" || c.String("provider-public-key") != "" {
					return fmt.Errorf("--ztdo, --data-private-key and --provider-public-key are only allowed in decrypt mode")
				}
			} else if c.String("mode") == "decrypt" {
				if c.String("source") != "" || c.String("smart-policy") != "" || c.String("access-url") != "" {

View on GitHub (pinned to 6e04ca5ff0)