{"record":{"id":"3e14d757e2d7af53","repo":"denoland/deno","slug":"err-invalid-arg-type-3e14d7","errorCode":"ERR_INVALID_ARG_TYPE","errorMessage":"The \"${name}\" argument must be of type string or an instance of Buffer, TypedArray, or DataView. Received ${item}","messagePattern":"The \"(.+?)\" argument must be of type string or an instance of Buffer, TypedArray, or DataView\\. Received (.+?)","errorType":"error_code","errorClass":"TypeError","httpStatus":null,"severity":"error","filePath":"ext/node/polyfills/_tls_common.ts","lineNumber":386,"sourceCode":"}\n\nfunction validateKeyCertOption(\n  val: any,\n  name: string,\n  allowKeyObjects: boolean,\n) {\n  if (!val) return; // falsy values (false, null, undefined, 0, '') are skipped\n  if (isValidKeyCertValue(val)) return;\n  if (ArrayIsArray(val)) {\n    for (let i = 0; i < val.length; i++) {\n      const item = val[i];\n      if (!item) continue;\n      if (isValidKeyCertValue(item)) continue;\n      // For key, objects like { pem, passphrase } are allowed inside arrays\n      if (\n        allowKeyObjects && typeof item === \"object\" && item !== null\n      ) continue;\n      throw new ERR_INVALID_ARG_TYPE(\n        name,\n        [\"string\", \"Buffer\", \"TypedArray\", \"DataView\"],\n        item,\n      );\n    }\n    return;\n  }\n  throw new ERR_INVALID_ARG_TYPE(\n    name,\n    [\"string\", \"Buffer\", \"TypedArray\", \"DataView\"],\n    val,\n  );\n}\n\nfunction toUint8Array(val: any): Uint8Array {\n  if (typeof val === \"string\") {\n    return new TextEncoder().encode(val);\n  }","sourceCodeStart":368,"sourceCodeEnd":404,"githubUrl":"https://github.com/denoland/deno/blob/89f33cbef296a2b287f323d42de54c871fa69c77/ext/node/polyfills/_tls_common.ts#L368-L404","documentation":"The shared key/cert validator walks arrays element by element: falsy entries are skipped, valid PEM carriers (string, Buffer, TypedArray, DataView) pass, and for key arrays plain objects such as { pem, passphrase } are tolerated. Any other truthy item - a number, a Promise, or a random object inside a cert array - throws ERR_INVALID_ARG_TYPE for that item.","triggerScenarios":"tls.createSecureContext({ cert: [certPem, 42] }); passing fs.promises.readFile() results without await (Promise objects) inside a cert array; parsed JSON entries mixed into cert/key arrays; objects allowed only for key arrays used in cert arrays.","commonSituations":"Loading multiple certs or passphrase-protected keys with Promise.all where one await was forgotten; config arrays typed as any that pick up non-PEM values; utility functions that sometimes return parsed objects instead of raw buffers.","solutions":["Await all file reads before building the array","Map entries to strings/Buffers and filter out non-PEM values","Keep the { pem, passphrase } object form only where the API allows it (key arrays)","Validate items with an isPemValue guard before createSecureContext"],"exampleFix":"// before\nconst certs = [fs.promises.readFile('a.pem'), 'b.pem']; // Promise item throws\ntls.createSecureContext({ cert: certs });\n\n// after\nconst certs = await Promise.all([\n  fs.promises.readFile('a.pem'),\n  fs.promises.readFile('b.pem'),\n]);\ntls.createSecureContext({ cert: certs });","handlingStrategy":"type-guard","validationCode":"function isPemValue(v) {\n  if (!v) return true; // falsy entries are skipped by the API\n  if (typeof v === 'string') return true;\n  if (typeof v === 'object' && v !== null && typeof v.byteLength === 'number') return true; // Buffer/TypedArray/DataView\n  return false;\n}\nfunction validKeyCertArray(name, arr, allowKeyObjects) {\n  return arr.every((item) =>\n    isPemValue(item) || (allowKeyObjects && typeof item === 'object' && item !== null));\n}\nif (validKeyCertArray('cert', certs, false)) tls.createSecureContext({ cert: certs });","typeGuard":"const isPemCarrier = (v) =>\n  typeof v === 'string' || (v !== null && typeof v === 'object' && typeof v.byteLength === 'number');","tryCatchPattern":"try {\n  ctx = tls.createSecureContext({ key, cert });\n} catch (e) {\n  if (e.code === 'ERR_INVALID_ARG_TYPE' && /key|cert/.test(e.message)) {\n    // an array item was not a string/Buffer/TypedArray/DataView: log and reject config\n  } else throw e;\n}","preventionTips":["Await every fs.promises.readFile before building key/cert arrays","Filter arrays with the isPemCarrier guard before createSecureContext","Remember objects like { pem, passphrase } are only valid for key arrays"],"tags":["tls","validation","promises","node-compat"],"backgroundTag":null,"analyzedSha":"89f33cbef296a2b287f323d42de54c871fa69c77","analyzedAt":"2026-08-16T07:54:21.310Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}