--source, --smart-policy and --access-url are only allowed…

Error message

--source, --smart-policy and --access-url are only allowed in encrypt mode

What it means

Guard inside the nhp-db CLI 'encrypt' mode branch: while validating flags it detects that --source, --smart-policy or --access-url was passed together with decrypt-only options, which means the operator mixed flags from the two mutually exclusive modes. The specific input at fault is whichever of --ztdo / --data-private-key / --provider-public-key was non-empty while --mode=encrypt.

Solutions

Remove --source, --smart-policy and --access-url from the decrypt invocation
Keep only decrypt flags: --ztdo, --output, --data-private-key, --provider-public-key
Fix wrapper scripts to build flag sets per mode

Example fix

// before
nhp-device run --mode decrypt --ztdo a.ztdo --output out.csv --data-private-key K --provider-public-key P --source in.csv
// after
nhp-device run --mode decrypt --ztdo a.ztdo --output out.csv --data-private-key K --provider-public-key P

Defensive patterns

Strategy: validation

Validate before calling

if (flags.mode === 'decrypt' && ['source','smart-policy','access-url'].some(f => flags[f])) {
  throw new Error('encrypt-only flags passed in decrypt mode');
}

Type guard

const hasEncryptInputs = (flags) => Boolean(flags.source || flags['smart-policy'] || flags['access-url']);

Prevention

Build decrypt invocations from a minimal flag template
Strip source-side flags when converting encrypt commands to decrypt
Test wrapper scripts in both modes after edits

When it happens

Trigger: Running `nhp-device run --mode decrypt --ztdo ... --data-private-key ... --provider-public-key ...` while also passing --source, --smart-policy, or --access-url.

Common situations: A single command template carrying all possible flags; switching --mode from encrypt to decrypt without pruning source-side flags; automation that appends --access-url for telemetry URLs mistakenly.

Understand the failure class

Background: "mutually exclusive" flag errors: what "can't supply both nx and xx", "--raw is not compatible with -i" and "cannot be used with" mean, and how to fix them — this error's family across 29 libraries.

Related errors

AI-assisted analysis of OpenNHP/opennhp@6e04ca5ff0 (2026-09-07). Data as JSON: /api/errors/0df0072771999351. Report an issue: GitHub.

Appendix: source

Thrown at endpoints/db/main/main.go:83

						}
					} else {
						if c.String("access-url") == "" {
							return fmt.Errorf("--access-url is required when --data-source-type is stream")
						}
					}
				}

				if c.String("smart-policy") == "" {
					return fmt.Errorf("--smart-policy is required in encrypt mode")
				}

				// only be available in decrypt mode
				if c.String("ztdo") != "" || c.String("data-private-key") != "" || c.String("provider-public-key") != "" {
					return fmt.Errorf("--ztdo, --data-private-key and --provider-public-key are only allowed in decrypt mode")
				}
			} else if c.String("mode") == "decrypt" {
				if c.String("source") != "" || c.String("smart-policy") != "" || c.String("access-url") != "" {
					return fmt.Errorf("--source, --smart-policy and --access-url are only allowed in encrypt mode")
				}

				// only be available in encrypt mode
				if c.String("ztdo") == "" || c.String("output") == "" || c.String("data-private-key") == "" || c.String("provider-public-key") == "" {
					return fmt.Errorf("--ztdo, --output, --data-private-key and --provider-public-key are required in decrypt mode")
				}
			} else {
				return nil
			}

			return nil
		},
		Action: func(c *cli.Context) error {
			mode := c.String("mode")
			source := c.String("source")
			dsType := c.String("data-source-type")
			smartPolicy := c.String("smart-policy")
			metadata := c.String("metadata")

View on GitHub (pinned to 6e04ca5ff0)