--ztdo, --data-private-key and --provider-public-key are…

Error message

--ztdo, --data-private-key and --provider-public-key are only allowed in decrypt mode

What it means

The run command's Before hook enforces mode separation: --ztdo, --data-private-key and --provider-public-key are decryption inputs and are rejected when --mode encrypt is selected. This prevents silently mixing encrypt inputs with decrypt credentials.

Solutions

Remove --ztdo, --data-private-key and --provider-public-key from the encrypt invocation
If decryption was intended, change --mode to decrypt and supply the full required decrypt flag set
Split wrapper scripts so encrypt and decrypt paths pass disjoint flag sets

Example fix

// before
nhp-device run --mode encrypt --source ./data.csv --smart-policy p.wasm --ztdo ./out.ztdo --data-private-key KEY
// after
nhp-device run --mode encrypt --source ./data.csv --smart-policy p.wasm --output ./out.ztdo

Defensive patterns

Strategy: validation

Validate before calling

if (flags.mode === 'encrypt' && ['ztdo','data-private-key','provider-public-key'].some(f => flags[f])) {
  throw new Error('decrypt-only flags passed in encrypt mode');
}

Type guard

const hasDecryptCredentials = (flags) => Boolean(flags['ztdo'] || flags['data-private-key'] || flags['provider-public-key']);

Prevention

Keep encrypt and decrypt flag sets disjoint in wrapper scripts
Review aliases/Makefile targets for stale decrypt flags
Flip --mode only after pruning the opposite mode's flags

When it happens

Trigger: Running `nhp-device run --mode encrypt ...` while any of --ztdo, --data-private-key, or --provider-public-key is set to a non-empty value.

Common situations: A generic wrapper script that always forwards all flags; reusing a decrypt command line and flipping only --mode to encrypt; leftover credentials in an alias or Makefile target.

Understand the failure class

Background: "mutually exclusive" flag errors: what "can't supply both nx and xx", "--raw is not compatible with -i" and "cannot be used with" mean, and how to fix them — this error's family across 29 libraries.

Related errors

AI-assisted analysis of OpenNHP/opennhp@6e04ca5ff0 (2026-09-07). Data as JSON: /api/errors/4248edcaf3626a46. Report an issue: GitHub.

Appendix: source

Thrown at endpoints/db/main/main.go:79

				} else { // create ztdo
					if c.String("data-source-type") != "stream" {
						if c.String("source") == "" {
							return fmt.Errorf("--source is required when --data-source-type is not stream and --ztdo-id is not specified")
						}
					} else {
						if c.String("access-url") == "" {
							return fmt.Errorf("--access-url is required when --data-source-type is stream")
						}
					}
				}

				if c.String("smart-policy") == "" {
					return fmt.Errorf("--smart-policy is required in encrypt mode")
				}

				// only be available in decrypt mode
				if c.String("ztdo") != "" || c.String("data-private-key") != "" || c.String("provider-public-key") != "" {
					return fmt.Errorf("--ztdo, --data-private-key and --provider-public-key are only allowed in decrypt mode")
				}
			} else if c.String("mode") == "decrypt" {
				if c.String("source") != "" || c.String("smart-policy") != "" || c.String("access-url") != "" {
					return fmt.Errorf("--source, --smart-policy and --access-url are only allowed in encrypt mode")
				}

				// only be available in encrypt mode
				if c.String("ztdo") == "" || c.String("output") == "" || c.String("data-private-key") == "" || c.String("provider-public-key") == "" {
					return fmt.Errorf("--ztdo, --output, --data-private-key and --provider-public-key are required in decrypt mode")
				}
			} else {
				return nil
			}

			return nil
		},
		Action: func(c *cli.Context) error {
			mode := c.String("mode")

View on GitHub (pinned to 6e04ca5ff0)