--ztdo, --output, --data-private-key and…

Error message

--ztdo, --output, --data-private-key and --provider-public-key are required in decrypt mode

What it means

Decrypt mode requires all four of --ztdo (the encrypted ZTDO file), --output (decrypted file path), --data-private-key and --provider-public-key (base64 keys). The Before hook fires this error when any one of them is an empty string, since partial credentials can never decrypt a ZTDO.

Solutions

Supply all four flags: --ztdo <file>, --output <file>, --data-private-key <base64>, --provider-public-key <base64>
Generate/load keys with `nhp-device keygen` and export the provider public key from the data provider
Echo the values in the script before invoking to confirm none expand to empty

Example fix

// before
nhp-device run --mode decrypt --ztdo a.ztdo --data-private-key K
// after
nhp-device run --mode decrypt --ztdo a.ztdo --output out.csv --data-private-key K --provider-public-key P

Defensive patterns

Strategy: validation

Validate before calling

const required = ['ztdo','output','data-private-key','provider-public-key'];
if (flags.mode === 'decrypt') {
  const missing = required.filter(f => !flags[f]);
  if (missing.length) throw new Error('decrypt mode missing: ' + missing.join(', '));
}

Type guard

const isDecryptReady = (flags) => ['ztdo','output','data-private-key','provider-public-key'].every(f => Boolean(flags[f]));

Prevention

Store the base64 keys in a secret store and inject them explicitly
Echo/verify all four values are non-empty before invoking
Keep the ZTDO file path and output path distinct and verified

When it happens

Trigger: `nhp-device run --mode decrypt ...` missing any of --ztdo, --output, --data-private-key or --provider-public-key.

Common situations: Keys not yet provisioned in the environment; forgetting --output because it was also required in encrypt mode and assumed optional; a typo'd flag name leaving the real one empty; testing decrypt before exporting provider public key.

Understand the failure class

Background: "--flag is required" and "must specify" CLI errors: how missing-required-flag validation works and how to fix it — this error's family across 20 libraries.

Related errors

AI-assisted analysis of OpenNHP/opennhp@6e04ca5ff0 (2026-09-07). Data as JSON: /api/errors/e7e87f24ea0af8e7. Report an issue: GitHub.

Appendix: source

Thrown at endpoints/db/main/main.go:88

					}
				}

				if c.String("smart-policy") == "" {
					return fmt.Errorf("--smart-policy is required in encrypt mode")
				}

				// only be available in decrypt mode
				if c.String("ztdo") != "" || c.String("data-private-key") != "" || c.String("provider-public-key") != "" {
					return fmt.Errorf("--ztdo, --data-private-key and --provider-public-key are only allowed in decrypt mode")
				}
			} else if c.String("mode") == "decrypt" {
				if c.String("source") != "" || c.String("smart-policy") != "" || c.String("access-url") != "" {
					return fmt.Errorf("--source, --smart-policy and --access-url are only allowed in encrypt mode")
				}

				// only be available in encrypt mode
				if c.String("ztdo") == "" || c.String("output") == "" || c.String("data-private-key") == "" || c.String("provider-public-key") == "" {
					return fmt.Errorf("--ztdo, --output, --data-private-key and --provider-public-key are required in decrypt mode")
				}
			} else {
				return nil
			}

			return nil
		},
		Action: func(c *cli.Context) error {
			mode := c.String("mode")
			source := c.String("source")
			dsType := c.String("data-source-type")
			smartPolicy := c.String("smart-policy")
			metadata := c.String("metadata")
			output := c.String("output")
			ztdo := c.String("ztdo")
			ztdoId := c.String("ztdo-id")
			dataPrivateKey := c.String("data-private-key")
			accessUrl := c.String("access-url")

View on GitHub (pinned to 6e04ca5ff0)