@blamejs/pki 0.1.28 → 0.1.29

package/CHANGELOG.md

@@ -4,7 +4,16 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## v0.1.28 — 2026-07-11
+## v0.1.29 — 2026-07-11
+
+A detached-backed BufferSource now fails closed with a typed error at every byte-input boundary.
+
+### Fixed
+
+- pki.webcrypto digest / sign / verify no longer silently process a detached-backed Buffer as EMPTY input (a fail-open where a transferred backing ArrayBuffer left the view zero-length); a detached BufferSource is now rejected with a typed webcrypto/data error, as is getRandomValues.
+- pki.asn1.decode, pki.cbor.decode, and pki.ct.parseSctList reject a detached-backed Buffer or view with a typed error (asn1/not-buffer, cbor/not-buffer, ct/bad-input) instead of a raw TypeError or a misleading truncated-input verdict. The underlying byte-view failure is threaded as the error cause.
+
+## v0.1.28 — 2026-07-10
 
 Merkle transparency proof verification joins the toolkit as pki.merkle.
 

package/lib/asn1-der.js

@@ -105,8 +105,18 @@ function _className(bits) {
 }
 
 function _asBuffer(input, who) {
-  if (Buffer.isBuffer(input)) return input;
-  if (input instanceof Uint8Array) return Buffer.from(input);
+  // A Buffer is a Uint8Array, so it routes through the same guarded re-view --
+  // NOT a `Buffer.isBuffer` fast-path that returns it as-is. A detached backing
+  // ArrayBuffer (a transferred / structuredClone'd view) reads as zero-length;
+  // re-viewing through Buffer.from surfaces it as a typed error here rather than
+  // a misleading downstream truncated-DER verdict on an empty buffer.
+  if (Buffer.isBuffer(input) || input instanceof Uint8Array) {
+    try {
+      return Buffer.from(input.buffer, input.byteOffset, input.byteLength);
+    } catch (e) {
+      throw new Asn1Error("asn1/not-buffer", who + ": input is not a usable byte view (detached backing buffer?)", e);
+    }
+  }
   throw new Asn1Error("asn1/not-buffer", who + ": expected a Buffer / Uint8Array");
 }
 

package/lib/cbor-det.js

@@ -57,8 +57,20 @@ var _utf8 = new TextDecoder("utf-8", { fatal: true });
 var _MAX_EPOCH_SECONDS = 8640000000000n;
 
 function _asBuffer(input, who) {
-  if (Buffer.isBuffer(input)) return input;
-  if (input instanceof Uint8Array) return Buffer.from(input.buffer, input.byteOffset, input.byteLength);
+  // A Buffer is itself a Uint8Array, so it goes through the same guarded re-view
+  // -- NOT a `Buffer.isBuffer` fast-path that would return it as-is. A detached
+  // backing ArrayBuffer (a transferred / structuredClone'd view) has had its
+  // bytes removed and reads as zero-length; the fast-path would hand the byte
+  // walk an empty buffer. Always re-view through Buffer.from so a detached input
+  // fails closed here as a typed error rather than a raw TypeError deeper in the
+  // walk (or a misleading truncated-input verdict).
+  if (Buffer.isBuffer(input) || input instanceof Uint8Array) {
+    try {
+      return Buffer.from(input.buffer, input.byteOffset, input.byteLength);
+    } catch (e) {
+      throw new CborError("cbor/not-buffer", who + ": input is not a usable byte view (detached backing buffer?)", e);
+    }
+  }
   throw new CborError("cbor/not-buffer", who + ": expected a Buffer / Uint8Array");
 }
 

package/lib/ct.js

@@ -111,8 +111,18 @@ function _peelInner(extValue) {
 }
 
 function _toBuffer(v, field) {
-  if (Buffer.isBuffer(v)) return v;
-  if (v instanceof Uint8Array) return Buffer.from(v);
+  // A Buffer is a Uint8Array, so it routes through the same guarded re-view --
+  // NOT a `Buffer.isBuffer` fast-path that returns it as-is. A detached backing
+  // ArrayBuffer (a transferred / structuredClone'd view) reads as zero-length;
+  // re-viewing through Buffer.from surfaces it as a typed error here rather than
+  // a misleading downstream bad-DER verdict on an empty buffer.
+  if (Buffer.isBuffer(v) || v instanceof Uint8Array) {
+    try {
+      return Buffer.from(v.buffer, v.byteOffset, v.byteLength);
+    } catch (e) {
+      throw new CtError("ct/bad-input", field + " is not a usable byte view (detached backing buffer?)", e);
+    }
+  }
   throw new CtError("ct/bad-input", field + " must be a Buffer or Uint8Array");
 }
 
@@ -199,10 +209,7 @@ function _parseSct(r, sctLen) {
  *   }
  */
 function parseSctList(extValue) {
-  if (!Buffer.isBuffer(extValue) && !(extValue instanceof Uint8Array)) {
-    throw new CtError("ct/bad-input", "parseSctList expects the SCT-list extension value as a Buffer or Uint8Array");
-  }
-  var blob = _peelInner(Buffer.isBuffer(extValue) ? extValue : Buffer.from(extValue));
+  var blob = _peelInner(_toBuffer(extValue, "the SCT-list extension value"));
   if (blob.length > C.LIMITS.SCT_MAX_BYTES) {
     throw new CtError("ct/too-large", "SCT list " + blob.length + " bytes exceeds the cap " + C.LIMITS.SCT_MAX_BYTES);
   }

package/lib/framework-error.js

@@ -127,8 +127,9 @@ var ConstantsError = defineClass("ConstantsError");
 // Asn1Error -- malformed / non-canonical DER: truncated TLV, indefinite
 // length, non-minimal length or integer, leftover trailing bytes, depth
 // or size cap exceeded. DER is a canonical encoding, so anything the
-// decoder rejects is permanently invalid.
-var Asn1Error = defineClass("Asn1Error");
+// decoder rejects is permanently invalid. withCause threads a raw byte-view
+// failure (a detached backing ArrayBuffer) as the cause rather than discarding it.
+var Asn1Error = defineClass("Asn1Error", { withCause: true });
 
 // CborError -- malformed / non-deterministic CBOR: a reserved or indefinite
 // additional-info value, a stray break, a non-minimal ("preferred") argument,
@@ -136,8 +137,9 @@ var Asn1Error = defineClass("Asn1Error");
 // key, a non-minimal / oversized bignum, bad UTF-8, a wrong-typed tag body,
 // leftover trailing bytes, or a depth / size cap exceeded. RFC 8949 core-
 // deterministic encoding (sec. 4.2.1) is canonical, so anything the decoder
-// rejects is permanently invalid.
-var CborError = defineClass("CborError");
+// rejects is permanently invalid. withCause threads a raw byte-view failure
+// (a detached backing ArrayBuffer) as the cause rather than discarding it.
+var CborError = defineClass("CborError", { withCause: true });
 
 // OidError -- a malformed object-identifier: fewer than two arcs, a first
 // arc outside 0..2, a second arc >= 40 under arcs 0/1, or a non-minimal

package/lib/webcrypto.js

@@ -47,9 +47,20 @@ var MAX_RANDOM_BYTES = 65536;
 // ---- value helpers ---------------------------------------------------
 
 function _toBuf(data, who) {
-  if (Buffer.isBuffer(data)) return data;
-  if (data instanceof ArrayBuffer) return Buffer.from(data);
-  if (ArrayBuffer.isView(data)) return Buffer.from(data.buffer, data.byteOffset, data.byteLength);
+  var isAb = data instanceof ArrayBuffer;
+  // A Buffer is itself an ArrayBuffer view, so it is handled by the view arm --
+  // NOT a `Buffer.isBuffer` fast-path that would return it as-is. A detached
+  // backing ArrayBuffer (a transferred / structuredClone'd Buffer, view, or
+  // ArrayBuffer) has had its bytes removed and reads as zero-length; the
+  // fast-path would silently hash / sign EMPTY (a fail-OPEN). Always re-view
+  // through Buffer.from so a detached input fails closed here as a typed error.
+  if (isAb || ArrayBuffer.isView(data)) {
+    try {
+      return isAb ? Buffer.from(data) : Buffer.from(data.buffer, data.byteOffset, data.byteLength);
+    } catch (e) {
+      throw new WebCryptoError("webcrypto/data", (who || "input") + ": input is not a usable byte source (detached backing buffer?)", e);
+    }
+  }
   throw new WebCryptoError("webcrypto/data", (who || "input") + ": expected BufferSource (ArrayBuffer / TypedArray / Buffer)");
 }
 
@@ -718,7 +729,15 @@ Crypto.prototype.getRandomValues = function getRandomValues(typedArray) {
   if (typedArray.byteLength > MAX_RANDOM_BYTES) {
     throw new WebCryptoError("webcrypto/data", "getRandomValues: byteLength exceeds " + MAX_RANDOM_BYTES);
   }
-  nodeCrypto.randomFillSync(Buffer.from(typedArray.buffer, typedArray.byteOffset, typedArray.byteLength));
+  var view;
+  try {
+    // A detached backing ArrayBuffer surfaces as a typed error rather than a
+    // raw TypeError from Buffer.from over the transferred/cloned view.
+    view = Buffer.from(typedArray.buffer, typedArray.byteOffset, typedArray.byteLength);
+  } catch (e) {
+    throw new WebCryptoError("webcrypto/data", "getRandomValues: byte view is not usable (detached backing buffer?)", e);
+  }
+  nodeCrypto.randomFillSync(view);
   return typedArray;
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.1.28",
+  "version": "0.1.29",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:e10c86e3-914c-4324-abeb-585344830973",
+  "serialNumber": "urn:uuid:26032baa-c793-470f-863c-569dc97c186e",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-11T04:47:27.941Z",
+    "timestamp": "2026-07-11T05:58:59.165Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.1.28",
+      "bom-ref": "@blamejs/pki@0.1.29",
       "type": "application",
       "name": "pki",
-      "version": "0.1.28",
+      "version": "0.1.29",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.1.28",
+      "purl": "pkg:npm/%40blamejs/pki@0.1.29",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.1.28",
+      "ref": "@blamejs/pki@0.1.29",
       "dependsOn": []
     }
   ]