.. index:: single: paseto
.. _paseto/0:

.. rst-class:: right

**object**

``paseto``
==========

Facade for PASETO v4 JSON claims encryption, signing, authentication, validation, and key selection.

| **Availability:** 
|    ``logtalk_load(paseto(loader))``

| **Author:** Paulo Moura
| **Version:** 1:0:0
| **Date:** 2026-08-08

| **Compilation flags:**
|    ``static, context_switching_calls``


| **Imports:**
|    ``public`` :ref:`paseto_helpers <paseto_helpers/0>`
|    ``public`` :ref:`paseto_claims_helpers <paseto_claims_helpers/0>`
| **Uses:**
|    :ref:`list <list/0>`
|    :ref:`paseto_claims <paseto_claims/0>`
|    :ref:`paseto_keys <paseto_keys/0>`
|    :ref:`paseto_v4 <paseto_v4/0>`

| **Remarks:**
|    (none)

| **Inherited public predicates:**
|     :ref:`options_protocol/0::check_option/1`  :ref:`options_protocol/0::check_options/1`  :ref:`options_protocol/0::default_option/1`  :ref:`options_protocol/0::default_options/1`  :ref:`options_protocol/0::option/2`  :ref:`options_protocol/0::option/3`  :ref:`options_protocol/0::valid_option/1`  :ref:`options_protocol/0::valid_options/1`  

.. contents::
   :local:
   :backlinks: top

Public predicates
-----------------

.. index:: encrypt/4
.. _paseto/0::encrypt/4:

``encrypt/4``
^^^^^^^^^^^^^

Encrypts a JSON claims object as a v4.local token.

| **Compilation flags:**
|    ``static``

| **Template:**
|    ``encrypt(Claims,Key,Token,Options)``
| **Mode and number of proofs:**
|    ``encrypt(+term,+list(byte),-atom,+list(compound))`` - ``one_or_error``

| **Exceptions:**
|    ``Claims`` is not a JSON object or contains duplicate members:
|        ``domain_error(paseto_json_object,Claims)``
|    ``Key`` is not a list of 32 bytes:
|        ``type_error(list(byte,32),Key)``
|    The footer ``kid`` conflicts with the ``key_id/1`` option:
|        ``domain_error(paseto_footer_key_id,Existing-KeyId)``
|    ``Options`` is a variable:
|        ``instantiation_error``
|    ``Options`` is neither a variable nor a list:
|        ``type_error(list,Options)``
|    An element ``Option`` of the list ``Options`` is a variable:
|        ``instantiation_error``
|    An element ``Option`` of the list ``Options`` is neither a variable nor a compound term:
|        ``type_error(compound,Option)``
|    An element ``Option`` of the list ``Options`` is a compound term but not a valid option:
|        ``domain_error(option,Option)``


------------

.. index:: decrypt/4
.. _paseto/0::decrypt/4:

``decrypt/4``
^^^^^^^^^^^^^

Authenticates and decrypts a v4.local claims token using a key or key set.

| **Compilation flags:**
|    ``static``

| **Template:**
|    ``decrypt(Token,KeyOrKeySet,Claims,Options)``
| **Mode and number of proofs:**
|    ``decrypt(+atom,+term,-term,+list(compound))`` - ``zero_or_one_or_error``

| **Exceptions:**
|    ``Token`` is not a canonical v4.local token:
|        ``domain_error(paseto_v4_token,Token)``
|    ``KeyOrKeySet`` is an invalid key set:
|        ``domain_error(paseto_key_set,KeyOrKeySet)``
|    No key can be selected from ``KeyOrKeySet``:
|        ``existence_error(paseto_key,local-KeyId)``
|    The authenticated payload is not a JSON object:
|        ``domain_error(paseto_json_object,Claims)``
|    The claims do not satisfy the validation policy:
|        ``domain_error(paseto_claims,Reason)``
|    ``Options`` is a variable:
|        ``instantiation_error``
|    ``Options`` is neither a variable nor a list:
|        ``type_error(list,Options)``
|    An element ``Option`` of the list ``Options`` is a variable:
|        ``instantiation_error``
|    An element ``Option`` of the list ``Options`` is neither a variable nor a compound term:
|        ``type_error(compound,Option)``
|    An element ``Option`` of the list ``Options`` is a compound term but not a valid option:
|        ``domain_error(option,Option)``


------------

.. index:: decrypt/5
.. _paseto/0::decrypt/5:

``decrypt/5``
^^^^^^^^^^^^^

Authenticates and decrypts a v4.local claims token and returns its authenticated footer JSON object.

| **Compilation flags:**
|    ``static``

| **Template:**
|    ``decrypt(Token,KeyOrKeySet,Claims,Footer,Options)``
| **Mode and number of proofs:**
|    ``decrypt(+atom,+term,-term,-term,+list(compound))`` - ``zero_or_one_or_error``

| **Exceptions:**
|    ``Token`` is not a canonical v4.local token:
|        ``domain_error(paseto_v4_token,Token)``
|    ``KeyOrKeySet`` is an invalid key set:
|        ``domain_error(paseto_key_set,KeyOrKeySet)``
|    No key can be selected from ``KeyOrKeySet``:
|        ``existence_error(paseto_key,local-KeyId)``
|    The authenticated payload or footer is not a JSON object:
|        ``domain_error(paseto_json_object,JSON)``
|    The claims do not satisfy the validation policy:
|        ``domain_error(paseto_claims,Reason)``
|    ``Options`` is a variable:
|        ``instantiation_error``
|    ``Options`` is neither a variable nor a list:
|        ``type_error(list,Options)``
|    An element ``Option`` of the list ``Options`` is a variable:
|        ``instantiation_error``
|    An element ``Option`` of the list ``Options`` is neither a variable nor a compound term:
|        ``type_error(compound,Option)``
|    An element ``Option`` of the list ``Options`` is a compound term but not a valid option:
|        ``domain_error(option,Option)``


------------

.. index:: sign/4
.. _paseto/0::sign/4:

``sign/4``
^^^^^^^^^^

Signs a JSON claims object as a v4.public token using an Ed25519 seed.

| **Compilation flags:**
|    ``static``

| **Template:**
|    ``sign(Claims,Seed,Token,Options)``
| **Mode and number of proofs:**
|    ``sign(+term,+list(byte),-atom,+list(compound))`` - ``one_or_error``

| **Exceptions:**
|    ``Claims`` is not a JSON object or contains duplicate members:
|        ``domain_error(paseto_json_object,Claims)``
|    ``Seed`` is not a list of 32 bytes:
|        ``type_error(list(byte,32),Seed)``
|    The footer ``kid`` conflicts with the ``key_id/1`` option:
|        ``domain_error(paseto_footer_key_id,Existing-KeyId)``
|    ``Options`` is a variable:
|        ``instantiation_error``
|    ``Options`` is neither a variable nor a list:
|        ``type_error(list,Options)``
|    An element ``Option`` of the list ``Options`` is a variable:
|        ``instantiation_error``
|    An element ``Option`` of the list ``Options`` is neither a variable nor a compound term:
|        ``type_error(compound,Option)``
|    An element ``Option`` of the list ``Options`` is a compound term but not a valid option:
|        ``domain_error(option,Option)``


------------

.. index:: verify/4
.. _paseto/0::verify/4:

``verify/4``
^^^^^^^^^^^^

Authenticates and validates a v4.public claims token using a public key or key set.

| **Compilation flags:**
|    ``static``

| **Template:**
|    ``verify(Token,KeyOrKeySet,Claims,Options)``
| **Mode and number of proofs:**
|    ``verify(+atom,+term,-term,+list(compound))`` - ``zero_or_one_or_error``

| **Exceptions:**
|    ``Token`` is not a canonical v4.public token:
|        ``domain_error(paseto_v4_token,Token)``
|    ``KeyOrKeySet`` is an invalid key set:
|        ``domain_error(paseto_key_set,KeyOrKeySet)``
|    No key can be selected from ``KeyOrKeySet``:
|        ``existence_error(paseto_key,(public-KeyId))``
|    The authenticated payload is not a JSON object:
|        ``domain_error(paseto_json_object,Claims)``
|    The claims do not satisfy the validation policy:
|        ``domain_error(paseto_claims,Reason)``
|    ``Options`` is a variable:
|        ``instantiation_error``
|    ``Options`` is neither a variable nor a list:
|        ``type_error(list,Options)``
|    An element ``Option`` of the list ``Options`` is a variable:
|        ``instantiation_error``
|    An element ``Option`` of the list ``Options`` is neither a variable nor a compound term:
|        ``type_error(compound,Option)``
|    An element ``Option`` of the list ``Options`` is a compound term but not a valid option:
|        ``domain_error(option,Option)``


------------

.. index:: verify/5
.. _paseto/0::verify/5:

``verify/5``
^^^^^^^^^^^^

Authenticates and validates a v4.public claims token and returns its authenticated footer JSON object.

| **Compilation flags:**
|    ``static``

| **Template:**
|    ``verify(Token,KeyOrKeySet,Claims,Footer,Options)``
| **Mode and number of proofs:**
|    ``verify(+atom,+term,-term,-term,+list(compound))`` - ``zero_or_one_or_error``

| **Exceptions:**
|    ``Token`` is not a canonical v4.public token:
|        ``domain_error(paseto_v4_token,Token)``
|    ``KeyOrKeySet`` is an invalid key set:
|        ``domain_error(paseto_key_set,KeyOrKeySet)``
|    No key can be selected from ``KeyOrKeySet``:
|        ``existence_error(paseto_key,(public-KeyId))``
|    The authenticated payload or footer is not a JSON object:
|        ``domain_error(paseto_json_object,JSON)``
|    The claims do not satisfy the validation policy:
|        ``domain_error(paseto_claims,Reason)``
|    ``Options`` is a variable:
|        ``instantiation_error``
|    ``Options`` is neither a variable nor a list:
|        ``type_error(list,Options)``
|    An element ``Option`` of the list ``Options`` is a variable:
|        ``instantiation_error``
|    An element ``Option`` of the list ``Options`` is neither a variable nor a compound term:
|        ``type_error(compound,Option)``
|    An element ``Option`` of the list ``Options`` is a compound term but not a valid option:
|        ``domain_error(option,Option)``


------------

.. index:: claims/2
.. _paseto/0::claims/2:

``claims/2``
^^^^^^^^^^^^

Decodes claims from a v4.public token without authenticating them. Rejects local tokens. The result must not be trusted.

| **Compilation flags:**
|    ``static``

| **Template:**
|    ``claims(Token,Claims)``
| **Mode and number of proofs:**
|    ``claims(+atom,-term)`` - ``one_or_error``

| **Exceptions:**
|    ``Token`` is a variable:
|        ``instantiation_error``
|    ``Token`` is neither a variable nor an atom:
|        ``type_error(atom,Token)``
|    ``Token`` is not a canonical v4.public token:
|        ``domain_error(paseto_v4_token,Token)``
|    ``Token`` has a malformed public payload:
|        ``domain_error(paseto_v4_public_payload,Token)``
|    ``Token`` payload is not a JSON object:
|        ``domain_error(paseto_json_object,Claims)``


------------

.. index:: claim/3
.. _paseto/0::claim/3:

``claim/3``
^^^^^^^^^^^

Looks up a value in a claims object.

| **Compilation flags:**
|    ``static``

| **Template:**
|    ``claim(Claims,Name,Value)``
| **Mode and number of proofs:**
|    ``claim(+term,+atom,-term)`` - ``zero_or_one``


------------

.. index:: validate_claims/3
.. _paseto/0::validate_claims/3:

``validate_claims/3``
^^^^^^^^^^^^^^^^^^^^^

Validates a claims object using a policy list and options.

| **Compilation flags:**
|    ``static``

| **Template:**
|    ``validate_claims(Claims,Policy,Options)``
| **Mode and number of proofs:**
|    ``validate_claims(+term,+list(compound),+list(compound))`` - ``one_or_error``

| **Exceptions:**
|    ``Claims`` is not a JSON object or contains duplicate members:
|        ``domain_error(paseto_json_object,Claims)``
|    ``Claims`` is missing a required claim ``Name``:
|        ``domain_error(paseto_claims,missing(Name))``
|    ``Policy`` contains an invalid claim policy:
|        ``domain_error(paseto_claim_policy,ClaimPolicy)``
|    A time claim has a non-numeric value:
|        ``type_error(time_number,Name-Value)``
|    ``Options`` is a variable:
|        ``instantiation_error``
|    ``Options`` is neither a variable nor a list:
|        ``type_error(list,Options)``
|    An element ``Option`` of the list ``Options`` is a variable:
|        ``instantiation_error``
|    An element ``Option`` of the list ``Options`` is neither a variable nor a compound term:
|        ``type_error(compound,Option)``
|    An element ``Option`` of the list ``Options`` is a compound term but not a valid option:
|        ``domain_error(option,Option)``


------------

.. index:: validate_claim/3
.. _paseto/0::validate_claim/3:

``validate_claim/3``
^^^^^^^^^^^^^^^^^^^^

Validates one claim policy.

| **Compilation flags:**
|    ``static``

| **Template:**
|    ``validate_claim(Claims,ClaimPolicy,Options)``
| **Meta-predicate template:**
|    ``validate_claim(*,*,*)``
| **Mode and number of proofs:**
|    ``validate_claim(+term,+compound,+list(compound))`` - ``one_or_error``

| **Exceptions:**
|    ``Claims`` is missing the required claim ``Name``:
|        ``domain_error(paseto_claims,missing(Name))``
|    The value of claim ``Name`` does not satisfy the policy:
|        ``domain_error(paseto_claim(Name),Value)``
|    ``ClaimPolicy`` is not a supported claim policy:
|        ``domain_error(paseto_claim_policy,ClaimPolicy)``
|    A time claim has an unknown validation kind:
|        ``domain_error(paseto_time_claim_kind,Kind)``
|    A time claim has a non-numeric value:
|        ``type_error(time_number,Name-Value)``
|    ``Options`` is a variable:
|        ``instantiation_error``
|    ``Options`` is neither a variable nor a list:
|        ``type_error(list,Options)``
|    An element ``Option`` of the list ``Options`` is a variable:
|        ``instantiation_error``
|    An element ``Option`` of the list ``Options`` is neither a variable nor a compound term:
|        ``type_error(compound,Option)``
|    An element ``Option`` of the list ``Options`` is a compound term but not a valid option:
|        ``domain_error(option,Option)``


------------

.. index:: peek_key_id/2
.. _paseto/0::peek_key_id/2:

``peek_key_id/2``
^^^^^^^^^^^^^^^^^

Reads a kid value from the unauthenticated token footer for key selection. The result must not be trusted.

| **Compilation flags:**
|    ``static``

| **Template:**
|    ``peek_key_id(Token,KeyId)``
| **Mode and number of proofs:**
|    ``peek_key_id(+atom,-atom)`` - ``zero_or_one_or_error``

| **Exceptions:**
|    ``Token`` is a variable:
|        ``instantiation_error``
|    ``Token`` is neither a variable nor an atom:
|        ``type_error(atom,Token)``
|    ``Token`` is not a canonical v4 token:
|        ``domain_error(paseto_v4_token,Token)``
|    ``Token`` footer is not a JSON object:
|        ``domain_error(paseto_json_object,Footer)``


------------

.. index:: validate_key_set/1
.. _paseto/0::validate_key_set/1:

``validate_key_set/1``
^^^^^^^^^^^^^^^^^^^^^^

Validates a native PASETO key_set/1 term.

| **Compilation flags:**
|    ``static``

| **Template:**
|    ``validate_key_set(KeySet)``
| **Mode and number of proofs:**
|    ``validate_key_set(+compound)`` - ``one_or_error``

| **Exceptions:**
|    ``KeySet`` is not a valid ``key_set/1`` term:
|        ``domain_error(paseto_key_set,KeySet)``
|    ``KeySet`` contains an invalid key record ``Record``:
|        ``domain_error(paseto_key_record,Record)``


------------

Protected predicates
--------------------

(no local declarations; see entity ancestors if any)

Private predicates
------------------

(no local declarations; see entity ancestors if any)

Operators
---------

(none)