micro509/pem

Canonical PEM boundary surface. Owns the stable micro509/pem entrypoint.

CategorizedPemBlocks

PEM blocks grouped by their label into well-known PKI categories. Blocks that don't match any known label land in others.

interface CategorizedPemBlocks {
	readonly certificates: readonly PemBlock[];
	readonly certificateRequests: readonly PemBlock[];
	readonly privateKeys: readonly PemBlock[];
	readonly publicKeys: readonly PemBlock[];
	readonly others: readonly PemBlock[];
}

Properties

• readonly certificates: readonly PemBlock[] — Blocks with label CERTIFICATE.
• readonly certificateRequests: readonly PemBlock[] — Blocks with label CERTIFICATE REQUEST.
• readonly privateKeys: readonly PemBlock[] — Blocks with label PRIVATE KEY, RSA PRIVATE KEY, or EC PRIVATE KEY.
• readonly publicKeys: readonly PemBlock[] — Blocks with label PUBLIC KEY.
• readonly others: readonly PemBlock[] — Blocks whose label doesn't match any of the above categories.

CategorizePemBlocksResult

Success-or-failure result from categorizePemBlocks.

type CategorizePemBlocksResult = {
  readonly ok: true;
  readonly value: CategorizedPemBlocks
} | ErrorResult<PemErrorCode, Record<never, never>, PemFailure>

PemBlock

A single decoded PEM block with its label, decoded DER bytes, and original PEM text.

interface PemBlock {
	readonly label: string;
	readonly bytes: Uint8Array;
	readonly pem: string;
}

Properties

• readonly label: string — RFC 7468 label between the BEGIN / END markers (e.g. "CERTIFICATE").
• readonly bytes: Uint8Array — Decoded DER content of this block.
• readonly pem: string — The original PEM text including BEGIN/END lines.

PemDecodeResult

Success-or-failure result from pemDecode.

type PemDecodeResult = {
  readonly ok: true;
  readonly value: Uint8Array
} | ErrorResult<PemErrorCode, Record<never, never>, PemFailure>

PemErrorCode

Machine-readable failure reason for the PEM decoders.

type PemErrorCode = malformed

PemFailure

Structured failure payload for PEM decoding.

interface PemFailure extends Micro509Error<PemErrorCode> {
	readonly ok: false;
}

Properties

• readonly ok: false — Always false for failures.

SplitPemBlocksResult

Success-or-failure result from splitPemBlocks.

type SplitPemBlocksResult = {
  readonly ok: true;
  readonly value: readonly PemBlock[]
} | ErrorResult<PemErrorCode, Record<never, never>, PemFailure>

categorizePemBlocks

Groups PEM blocks by label into well-known PKI categories (certificates, CSRs, private keys, public keys, and everything else). Accepts either raw PEM text or pre-split PemBlock entries.

Returns a typed failure (code: 'malformed') when raw text contains stray or truncated PEM markers. For the throwing form use categorizePemBlocksOrThrow.

function categorizePemBlocks(
	input: string | readonly PemBlock[],
): CategorizePemBlocksResult

Parameters

• input: string | readonly PemBlock[]

categorizePemBlocksOrThrow

Groups PEM blocks by label into well-known PKI categories (certificates, CSRs, private keys, public keys, and everything else). Accepts either raw PEM text or pre-split PemBlock entries.

function categorizePemBlocksOrThrow(
	input: string | readonly PemBlock[],
): CategorizedPemBlocks

Parameters

• input: string | readonly PemBlock[]

pemDecode

Extracts and base64-decodes the DER content from a PEM string.

Returns a typed failure (code: 'malformed') when the BEGIN/END markers don't match label or the body is not valid base64. For the throwing form use pemDecodeOrThrow.

function pemDecode(
	label: string,
	pem: string,
): PemDecodeResult

Parameters

• label: string
• pem: string

pemDecodeOrThrow

Throwing core for pemDecode: extracts and base64-decodes the DER content from a PEM string. Throws if the BEGIN/END markers don't match label.

function pemDecodeOrThrow(
	label: string,
	pem: string,
): Uint8Array

Parameters

• label: string — Expected PEM type label.
• pem: string — PEM-encoded text (may contain \r).

pemEncode

Wraps DER bytes in a PEM envelope with 64-character base64 lines.

function pemEncode(
	label: string,
	der: Uint8Array,
): string

Parameters

• label: string — PEM type label (e.g. "CERTIFICATE", "PRIVATE KEY").
• der: Uint8Array — Raw DER-encoded content.

splitPemBlocks

Finds all BEGIN/END-delimited PEM blocks in a string and returns them as parsed PemBlock entries. Handles concatenated PEM files and ignores non-PEM text between blocks.

Returns a typed failure (code: 'malformed') on stray or truncated PEM markers. For the throwing form use splitPemBlocksOrThrow.

function splitPemBlocks(
	input: string,
): SplitPemBlocksResult

Parameters

• input: string

splitPemBlocksOrThrow

Finds all BEGIN/END-delimited PEM blocks in a string and returns them as parsed PemBlock entries. Handles concatenated PEM files and ignores non-PEM text between blocks.

function splitPemBlocksOrThrow(
	input: string,
): readonly PemBlock[]

Parameters

• input: string