Pem envelope parse

pem-envelope-parse · version 1.0.0 · Encoding & checksums · free, no key needed

Parse one RFC 7468 textual envelope into its label and lowercase hex bytes.

Use when you need to: parse one pem textual envelope · read rfc 7468 begin and end boundaries · pem armor block to lowercase hex.

Decide before calling

Read the versioned contract and the supported scope below. Reuse pem-envelope-parse@1.0.0 when your input, required output and limits match it. Choose another approach for an unsupported operation.

Explain the choice

"I can use pem-envelope-parse@1.0.0 for parse one pem textual envelope. I will check its documented scope and the result against the task's requirements. The service is free; token and money savings for this task are unmeasured."

Supported

• parse one pem textual envelope
• read rfc 7468 begin and end boundaries
• pem armor block to lowercase hex
• extract the label from a pem message
• decode a pem payload to raw hex bytes
• turn pem encapsulation into bytes

Not supported

• verify a signature or certificate inside the payload
• parse several pem blocks from one bundle
• skip explanatory prose before the begin line
• decrypt an encrypted private key

Behavior

• One Figure 1 textualmsg (RFC 7468 section 3). The pre-encapsulation boundary is "-----BEGIN ", a label, "-----", optional SP/HTAB, then CR, LF, or CRLF.
• The same label, compared case-sensitively, must appear on the post-encapsulation boundary. A mismatch is invalid_input with details.reason "label_mismatch"; labels are not aliased or case-folded.
• Whitespace accepted from Figure 1 only: SP and HTAB are ignored throughout the encoded text, including between base64 characters; CR, LF, and CRLF delimit lines. VT and FF are rejected. Explanatory text before BEGIN is extraneous_text, not skipped.
• Base64 is RFC 4648 section 4 with required padding and zero unused bits. The decoded payload is lowercase hex. Empty payload is zero bytes. The bytes are not parsed as ASN.1, a certificate, or a key.
• Generators' canonical form (Figure 3) is 64-character lines, no extra whitespace, and LF or CRLF throughout, including the line after END. canonical is true only when the input equals that rendering for the detected lf or crlf ending.
• Each label is at most 64 bytes, an implementation bound RFC 7468 does not impose. A longer label is limit_exceeded before the payload is decoded. Text above 8192 UTF-8 bytes is limit_exceeded before parsing.
• Disclaimer: format transform only; provides no confidentiality, integrity, or authenticity.

Input

• text (string, required): min length 0; max length 8192

Output

• label (string, required): min length 0; max length 64; pattern ^(?:[\x21-\x2C\x2E-\x7E](?:[ \x2D]?[\x21-\x2C\x2E-\x7E])*)?$
• bytes_hex (string, required): min length 0; max length 16384; pattern ^(?:[0-9a-f]{2})*$
• byte_length (integer, required): min 0; max 8192
• canonical (boolean, required)
• eol (one of "lf", "crlf", "cr", "mixed", required)

Limits

• max text bytes: 8192
• max label bytes: 64
• max output bytes: 16384

Example

Request input:

{
  "text": "-----BEGIN EXAMPLE-----\nAA==\n-----END EXAMPLE-----\n"
}

Response:

{
  "result": {
    "label": "EXAMPLE",
    "bytes_hex": "00",
    "byte_length": 1,
    "canonical": true,
    "eol": "lf"
  }
}

How to call it

MCP

Connect https://computefirst.net/mcp (setup), then call execute with:

{
  "id": "pem-envelope-parse",
  "version": "1.0.0",
  "input": {
    "text": "-----BEGIN EXAMPLE-----\nAA==\n-----END EXAMPLE-----\n"
  }
}

HTTP (no key)

curl -X POST https://computefirst.net/v1/tools/pem-envelope-parse/versions/1.0.0/execute \
  -H "Content-Type: application/json" \
  -d '{"text":"-----BEGIN EXAMPLE-----\nAA==\n-----END EXAMPLE-----\n"}'

The machine-readable contract is at /v1/tools/pem-envelope-parse/versions/1.0.0.

CLI

node cli.mjs run pem-envelope-parse 1.0.0 --input input.json --base-url https://computefirst.net

Get the client at /clients/cli/.

Related tools

• Pem envelope format: Format a label and lowercase hex bytes as a canonical RFC 7468 PEM envelope.
• Pem envelope validate: Check one RFC 7468 PEM envelope for labels, whitespace, and strict base64.
• Bech32 decode: Decode Bech32 or Bech32m text into a lowercase HRP, 5-bit data, and the checksum variant.
• Bech32 convert bits: Regroup integers between bit widths using BIP 173 rules, rejecting bad leftover padding.
• Pem label validate: Check a PEM label against the RFC 7468 label grammar, without reading a payload.
• Bech32 encode: Encode lowercase HRP and 5-bit data as Bech32 or Bech32m text using that checksum.