@sdxc/jwt 2026.10.24 → 2026.10.25

package/README.md

@@ -1,6 +1,6 @@
 # @sdxc/jwt
 
-JWT payload classes and the ES256, RS256 and EdDSA keys that sign them.
+JWT payload classes and the ES256, RS256 and Ed25519 keys that sign them.
 
 Each kind of token is a class: the registered claims arrive as typed accessors, a subclass adds
 its own, and signing, verifying and decoding all hand back an instance of that class. The `JWK`
@@ -15,7 +15,7 @@ npm add @sdxc/jwt
 
 Signing and verification run on [`jose`](https://www.npmjs.com/package/jose), and duration strings
 for the time claims come from [`@sdxc/duration`](https://www.npmjs.com/package/@sdxc/duration);
-both install with the package. Three entry points: `@sdxc/jwt` (`JWT`, `JWK`, `KeyStorage`),
+both install with the package. Three entry points: `@sdxc/jwt` (`JWT`, `SecurityEventToken`, `JWK`, `KeyStorage`),
 `@sdxc/jwt/algorithm` (the algorithm names alone) and `@sdxc/jwt/r2` (key storage over a
 Cloudflare R2 bucket).
 
@@ -95,6 +95,29 @@ idToken.subject; // "user-123"
 idToken.email; // "ada@example.com"
 ```
 
+### Issue a Security Event Token
+
+`SecurityEventToken` is an RFC 8417 SET: typed `secevent+jwt`, with `iss`, `iat`, `jti`, `aud`
+and a map of event URI to payload. `create` fills `jti` and `iat`; `verify` refuses a SET with no
+events or with an `exp`.
+
+```typescript
+import { JWK, SecurityEventToken } from "@sdxc/jwt";
+
+let set = await SecurityEventToken.create({
+	issuer: "https://idp.example.com/",
+	audience: "https://rp.example.com/",
+	subjectId: { format: "email", email: "user@example.com" },
+	events: {
+		"https://schemas.openid.net/secevent/risc/event-type/account-disabled": { reason: "hijacking" },
+	},
+}).sign(JWK.Algorithm.ES256, keys);
+
+let event = await SecurityEventToken.verify(set, issuerKeys, { issuer, audience });
+event.events; // { "https://schemas.openid.net/…/account-disabled": { reason: "hijacking" } }
+event.subjectId; // { format: "email", email: "user@example.com" }
+```
+
 ## API
 
 ### `JWT`
@@ -143,6 +166,12 @@ expiry.
 Signs with the first key generated for `algorithm`, writes its id as the header `kid`, and answers
 the compact token. Throws when no key matches. `JWT.sign(jwt, algorithm, jwks)` is the static form.
 
+#### `jwt.signEmbedded(keyPair: JWT.EmbeddableKey): Promise<string>`
+
+Signs with the pair's own algorithm and carries its public JWK in the header instead of a `kid`,
+as an RFC 9449 DPoP proof does. `JWT.verifyEmbedded(token, options?)` verifies such a token
+against that header key and answers `{ token, jwk }`; a header carrying a private key fails.
+
 #### `jwt.toJSON(): Record<string, unknown>`
 
 The getters declared on the instance's own class, as a plain object.
@@ -151,25 +180,41 @@ The getters declared on the instance's own class, as a plain object.
 
 Checks the signature, `exp`, `nbf` and any `issuer`/`audience` given, and answers an instance of
 the calling class; any failure throws. The key is picked per token by its `kid`, key type and
-algorithm, so a set can hold several keys. Pass `algorithms` to accept only the ones you expect.
+algorithm, so a set can hold several keys. Pass `algorithms` to accept only the ones you expect;
+left out, it is every `JWK.Algorithm`, so `none`, HMAC and anything else is refused. `Ed25519`
+also accepts tokens and key sets that use the deprecated `EdDSA` name (RFC 9864).
+
+A subclass that sets `static override type = "at+jwt"` signs with that `typ` header, and its
+`verify` refuses a token of any other type (explicit typing, RFC 8725).
 
 #### `JWT.decode(token: string): JWT`
 
 Reads the claims without verifying them, as an instance of the calling class. Use it to decide how
 to verify (reading `iss` to pick a key set), then `verify`.
 
+### `SecurityEventToken`
+
+A `JWT` subclass for RFC 8417 Security Event Tokens; subclass it for a SET profile.
+
+- `SecurityEventToken.create(input)`: `issuer`, `audience` and `events`, plus optional `id`
+  (`jti`), `issuedAt`, `subject`, `subjectId`, `transaction` (`txn`) and `timeOfEvent` (`toe`)
+- `SecurityEventToken.verify(...)`: `JWT.verify` plus RFC 8417's claim rules; a failure throws
+  jose's `JWTClaimValidationFailed` naming the claim
+- `events`, `transaction`, `timeOfEvent` and `subjectId` accessors; `subjectId` types RFC 9493's
+  `email`, `iss_sub` and `opaque` formats and reads any other format as given
+
 ### `JWK`
 
 #### `JWK.Algorithm`
 
 The supported algorithms: `JWK.Algorithm.ES256` (`EC`, what `signingKeys` mints), `.RS256`
-(`RSA`, common among upstream identity providers) and `.EdDSA` (`OKP`, deterministic nonces). The
+(`RSA`, common among upstream identity providers) and `.Ed25519` (`OKP`, deterministic nonces). The
 names also ship alone from `@sdxc/jwt/algorithm`:
 
 ```typescript
 import * as Algorithm from "@sdxc/jwt/algorithm";
 
-Object.values(Algorithm); // ["ES256", "RS256", "EdDSA"]
+Object.values(Algorithm); // ["ES256", "RS256", "Ed25519"]
 ```
 
 #### `JWK.generateKeyPair(alg: JWK.Algorithm): Promise<JWK.SerializedKeyPair>`
@@ -204,6 +249,11 @@ The JWKS document for `/.well-known/jwks.json`: each entry carries `kty`, `kid`,
 public parameters (`crv`/`x`/`y` for `EC`, `crv`/`x` for `OKP`, `e`/`n` for `RSA`). Throws on any
 other key type.
 
+#### `JWK.thumbprint(jwk: jose.JWK): Promise<Result<string, Error>>`
+
+The key's RFC 7638 SHA-256 thumbprint, base64url, which Web Bot Auth uses as `keyid`. A private
+JWK and its public half share one thumbprint; a key missing a required member is a failure.
+
 #### Types
 
 ```typescript

package/dist/algorithm.d.ts

@@ -19,7 +19,8 @@ export declare const ES256 = "ES256";
 /** Verifies tokens from upstream identity providers. */
 export declare const RS256 = "RS256";
 /**
- * Derives its nonce from the key and message, keeping the ECDSA nonce-reuse
- * leak that exposes a private key out of reach.
+ * EdDSA over the Ed25519 curve, under the fully-specified name RFC 9864 registers;
+ * its nonce derives from the key and message, keeping the ECDSA nonce-reuse leak
+ * that exposes a private key out of reach.
  */
-export declare const EdDSA = "EdDSA";
+export declare const Ed25519 = "Ed25519";

package/dist/algorithm.js

@@ -19,7 +19,8 @@ export const ES256 = "ES256";
 /** Verifies tokens from upstream identity providers. */
 export const RS256 = "RS256";
 /**
- * Derives its nonce from the key and message, keeping the ECDSA nonce-reuse
- * leak that exposes a private key out of reach.
+ * EdDSA over the Ed25519 curve, under the fully-specified name RFC 9864 registers;
+ * its nonce derives from the key and message, keeping the ECDSA nonce-reuse leak
+ * that exposes a private key out of reach.
  */
-export const EdDSA = "EdDSA";
+export const Ed25519 = "Ed25519";

package/dist/fixtures/rfc8417.d.ts

@@ -0,0 +1,105 @@
+/**
+ * Security Event Tokens from RFC 8417's figures, RFC 8935's transmission example and RFC
+ * 9493's subject identifiers, as the RFCs print them, so `SecurityEventToken` is checked
+ * against the specifications' own examples.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+/** RFC 8417 Figure 1: a SCIM password reset with an extension event. */
+export declare const SCIM_PASSWORD_RESET: {
+    iss: string;
+    iat: number;
+    jti: string;
+    aud: string[];
+    sub: string;
+    events: {
+        "urn:ietf:params:scim:event:passwordReset": {
+            id: string;
+        };
+        "https://example.com/scim/event/passwordResetExt": {
+            resetAttempts: number;
+        };
+    };
+};
+/** RFC 8417 Figure 2: an OpenID Back-Channel Logout event with an empty payload. */
+export declare const BACKCHANNEL_LOGOUT: {
+    iss: string;
+    sub: string;
+    aud: string;
+    iat: number;
+    jti: string;
+    sid: string;
+    events: {
+        "http://schemas.openid.net/event/backchannel-logout": {};
+    };
+};
+/** RFC 8417 Figure 3: a consent event whose payload `iss` names the subject's issuer. */
+export declare const CONSENT: {
+    iss: string;
+    iat: number;
+    jti: string;
+    aud: string[];
+    events: {
+        "https://openid.net/heart/specs/consent.html": {
+            iss: string;
+            sub: string;
+            consentUri: string[];
+        };
+    };
+};
+/** RFC 8417 Figure 4: a RISC account-disabled event. */
+export declare const RISC_ACCOUNT_DISABLED: {
+    iss: string;
+    jti: string;
+    iat: number;
+    aud: string;
+    events: {
+        "https://schemas.openid.net/secevent/risc/event-type/account-disabled": {
+            subject: {
+                subject_type: string;
+                iss: string;
+                sub: string;
+            };
+            reason: string;
+        };
+    };
+};
+/** RFC 8417 Figure 5: the SCIM create event Figure 6 encodes. */
+export declare const SCIM_CREATE: {
+    iss: string;
+    iat: number;
+    jti: string;
+    aud: string[];
+    events: {
+        "urn:ietf:params:scim:event:create": {
+            ref: string;
+            attributes: string[];
+        };
+    };
+};
+/** RFC 8417 Figure 6: Figure 5 as an unsecured SET typed `secevent+jwt`. */
+export declare const UNSECURED_SCIM_CREATE: string;
+/** RFC 8935 Figure 1: the HS256 RISC SET a transmitter POSTs, carrying Figure 4's claims. */
+export declare const TRANSMITTED_RISC_EVENT: string;
+/** RFC 9493 Figure 5: an `email` subject identifier. */
+export declare const EMAIL_SUBJECT: {
+    readonly format: "email";
+    readonly email: "user@example.com";
+};
+/** RFC 9493 Figure 6: an `iss_sub` subject identifier. */
+export declare const ISSUER_SUBJECT: {
+    readonly format: "iss_sub";
+    readonly iss: "https://issuer.example.com/";
+    readonly sub: "145234573";
+};
+/** RFC 9493 Figure 7: an `opaque` subject identifier. */
+export declare const OPAQUE_SUBJECT: {
+    readonly format: "opaque";
+    readonly id: "11112222333344445555";
+};
+/** RFC 9493 Figure 8: a `phone_number` subject identifier, a format read as given. */
+export declare const PHONE_SUBJECT: {
+    readonly format: "phone_number";
+    readonly phone_number: "+12065550100";
+};

package/dist/fixtures/rfc8417.js

@@ -0,0 +1,113 @@
+/**
+ * Security Event Tokens from RFC 8417's figures, RFC 8935's transmission example and RFC
+ * 9493's subject identifiers, as the RFCs print them, so `SecurityEventToken` is checked
+ * against the specifications' own examples.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+/** RFC 8417 Figure 1: a SCIM password reset with an extension event. */
+export const SCIM_PASSWORD_RESET = {
+    iss: "https://scim.example.com",
+    iat: 1458496025,
+    jti: "3d0c3cf797584bd193bd0fb1bd4e7d30",
+    aud: [
+        "https://jhub.example.com/Feeds/98d52461fa5bbc879593b7754",
+        "https://jhub.example.com/Feeds/5d7604516b1d08641d7676ee7",
+    ],
+    sub: "https://scim.example.com/Users/44f6142df96bd6ab61e7521d9",
+    events: {
+        "urn:ietf:params:scim:event:passwordReset": { id: "44f6142df96bd6ab61e7521d9" },
+        "https://example.com/scim/event/passwordResetExt": { resetAttempts: 5 },
+    },
+};
+/** RFC 8417 Figure 2: an OpenID Back-Channel Logout event with an empty payload. */
+export const BACKCHANNEL_LOGOUT = {
+    iss: "https://server.example.com",
+    sub: "248289761001",
+    aud: "s6BhdRkqt3",
+    iat: 1471566154,
+    jti: "bWJq",
+    sid: "08a5019c-17e1-4977-8f42-65a12843ea02",
+    events: { "http://schemas.openid.net/event/backchannel-logout": {} },
+};
+/** RFC 8417 Figure 3: a consent event whose payload `iss` names the subject's issuer. */
+export const CONSENT = {
+    iss: "https://my.med.example.org",
+    iat: 1458496025,
+    jti: "fb4e75b5411e4e19b6c0fe87950f7749",
+    aud: ["https://rp.example.com"],
+    events: {
+        "https://openid.net/heart/specs/consent.html": {
+            iss: "https://connect.example.com",
+            sub: "248289761001",
+            consentUri: ["https://terms.med.example.org/labdisclosure.html#Agree"],
+        },
+    },
+};
+/** RFC 8417 Figure 4: a RISC account-disabled event. */
+export const RISC_ACCOUNT_DISABLED = {
+    iss: "https://idp.example.com/",
+    jti: "756E69717565206964656E746966696572",
+    iat: 1508184845,
+    aud: "636C69656E745F6964",
+    events: {
+        "https://schemas.openid.net/secevent/risc/event-type/account-disabled": {
+            subject: { subject_type: "iss-sub", iss: "https://idp.example.com/", sub: "7375626A656374" },
+            reason: "hijacking",
+        },
+    },
+};
+/** RFC 8417 Figure 5: the SCIM create event Figure 6 encodes. */
+export const SCIM_CREATE = {
+    iss: "https://scim.example.com",
+    iat: 1458496404,
+    jti: "4d3559ec67504aaba65d40b0363faad8",
+    aud: [
+        "https://scim.example.com/Feeds/98d52461fa5bbc879593b7754",
+        "https://scim.example.com/Feeds/5d7604516b1d08641d7676ee7",
+    ],
+    events: {
+        "urn:ietf:params:scim:event:create": {
+            ref: "https://scim.example.com/Users/44f6142df96bd6ab61e7521d9",
+            attributes: ["id", "name", "userName", "password", "emails"],
+        },
+    },
+};
+/** RFC 8417 Figure 6: Figure 5 as an unsecured SET typed `secevent+jwt`. */
+export const UNSECURED_SCIM_CREATE = [
+    "eyJ0eXAiOiJzZWNldmVudCtqd3QiLCJhbGciOiJub25lIn0",
+    "eyJpc3MiOiJodHRwczovL3NjaW0uZXhhbXBsZS5jb20iLCJpYXQiOjE0NTg0OTY0M" +
+        "DQsImp0aSI6IjRkMzU1OWVjNjc1MDRhYWJhNjVkNDBiMDM2M2ZhYWQ4IiwiYXVkIj" +
+        "pbImh0dHBzOi8vc2NpbS5leGFtcGxlLmNvbS9GZWVkcy85OGQ1MjQ2MWZhNWJiYzg" +
+        "3OTU5M2I3NzU0IiwiaHR0cHM6Ly9zY2ltLmV4YW1wbGUuY29tL0ZlZWRzLzVkNzYw" +
+        "NDUxNmIxZDA4NjQxZDc2NzZlZTciXSwiZXZlbnRzIjp7InVybjppZXRmOnBhcmFtc" +
+        "zpzY2ltOmV2ZW50OmNyZWF0ZSI6eyJyZWYiOiJodHRwczovL3NjaW0uZXhhbXBsZS" +
+        "5jb20vVXNlcnMvNDRmNjE0MmRmOTZiZDZhYjYxZTc1MjFkOSIsImF0dHJpYnV0ZXM" +
+        "iOlsiaWQiLCJuYW1lIiwidXNlck5hbWUiLCJwYXNzd29yZCIsImVtYWlscyJdfX19",
+    "",
+].join(".");
+/** RFC 8935 Figure 1: the HS256 RISC SET a transmitter POSTs, carrying Figure 4's claims. */
+export const TRANSMITTED_RISC_EVENT = [
+    "eyJ0eXAiOiJzZWNldmVudCtqd3QiLCJhbGciOiJIUzI1NiJ9Cg",
+    "eyJpc3MiOiJodHRwczovL2lkcC5leGFtcGxlLmNvbS8iLCJqdGkiOiI3NTZFNjk" +
+        "3MTc1NjUyMDY5NjQ2NTZFNzQ2OTY2Njk2NTcyIiwiaWF0IjoxNTA4MTg0ODQ1LC" +
+        "JhdWQiOiI2MzZDNjk2NTZFNzQ1RjY5NjQiLCJldmVudHMiOnsiaHR0cHM6Ly9zY" +
+        "2hlbWFzLm9wZW5pZC5uZXQvc2VjZXZlbnQvcmlzYy9ldmVudC10eXBlL2FjY291" +
+        "bnQtZGlzYWJsZWQiOnsic3ViamVjdCI6eyJzdWJqZWN0X3R5cGUiOiJpc3Mtc3V" +
+        "iIiwiaXNzIjoiaHR0cHM6Ly9pZHAuZXhhbXBsZS5jb20vIiwic3ViIjoiNzM3NT" +
+        "YyNkE2NTYzNzQifSwicmVhc29uIjoiaGlqYWNraW5nIn19fQ",
+    "Y4rXxMD406P2edv00cr9Wf3_XwNtLjB9n-jTqN1_lLc",
+].join(".");
+/** RFC 9493 Figure 5: an `email` subject identifier. */
+export const EMAIL_SUBJECT = { format: "email", email: "user@example.com" };
+/** RFC 9493 Figure 6: an `iss_sub` subject identifier. */
+export const ISSUER_SUBJECT = {
+    format: "iss_sub",
+    iss: "https://issuer.example.com/",
+    sub: "145234573",
+};
+/** RFC 9493 Figure 7: an `opaque` subject identifier. */
+export const OPAQUE_SUBJECT = { format: "opaque", id: "11112222333344445555" };
+/** RFC 9493 Figure 8: a `phone_number` subject identifier, a format read as given. */
+export const PHONE_SUBJECT = { format: "phone_number", phone_number: "+12065550100" };

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 /**
- * Public surface of `@sdxc/jwt`: the `JWT` payload class, the `JWK` key namespace,
- * and the storage contract signing-key rotation is written against.
+ * Public surface of `@sdxc/jwt`: the `JWT` payload class and its RFC 8417
+ * `SecurityEventToken` subclass, the `JWK` key namespace, and the storage contract
+ * signing-key rotation is written against.
  *
  * The claim parser behind `JWT`'s accessors stays internal, existing solely for
  * token classes to read their own claims through.
@@ -11,3 +12,4 @@
 export type { KeyStorage, KeyStorageListOptions, KeyStorageListResult } from "./key-storage.js";
 export { JWK } from "./jwk.js";
 export { JWT } from "./jwt.js";
+export { SecurityEventToken } from "./security-event-token.js";

package/dist/index.js

@@ -1,6 +1,7 @@
 /**
- * Public surface of `@sdxc/jwt`: the `JWT` payload class, the `JWK` key namespace,
- * and the storage contract signing-key rotation is written against.
+ * Public surface of `@sdxc/jwt`: the `JWT` payload class and its RFC 8417
+ * `SecurityEventToken` subclass, the `JWK` key namespace, and the storage contract
+ * signing-key rotation is written against.
  *
  * The claim parser behind `JWT`'s accessors stays internal, existing solely for
  * token classes to read their own claims through.
@@ -10,3 +11,4 @@
  */
 export { JWK } from "./jwk.js";
 export { JWT } from "./jwt.js";
+export { SecurityEventToken } from "./security-event-token.js";

package/dist/jwk.d.ts

@@ -12,6 +12,21 @@
 import * as jose from "jose";
 import type { KeyStorage } from "./key-storage.js";
 import * as SignatureAlgorithm from "./algorithm.js";
+import { thumbprint as jwkThumbprint } from "./thumbprint.js";
+/**
+ * The polymorphic name RFC 9864 deprecates in favour of `Ed25519`. Keys and tokens
+ * written under it before the rename still import and verify as Ed25519.
+ */
+export declare const LEGACY_EDDSA = "EdDSA";
+/**
+ * A key's public half as a header or a key set carries it: `kty` and the members its type
+ * publishes, so `kid`, `use` and every private member stay out.
+ *
+ * @param jwk - A public or private JWK.
+ * @returns The public members.
+ * @throws When the key type has no published shape on record.
+ */
+export declare function publicJwk(jwk: jose.JWK): jose.JWK;
 /**
  * Everything about the keys a token is signed with or verified against.
  *
@@ -21,12 +36,19 @@ import * as SignatureAlgorithm from "./algorithm.js";
 export declare namespace JWK {
     /**
      * ES256 is issued here; RS256 verifies tokens from upstream identity
-     * providers; EdDSA derives its nonce from the key and message, keeping the
+     * providers; Ed25519 derives its nonce from the key and message, keeping the
      * ECDSA nonce-reuse leak that exposes a private key out of reach.
      */
     export const Algorithm: typeof SignatureAlgorithm;
     /** One of the supported signature algorithms. */
     export type Algorithm = (typeof SignatureAlgorithm)[keyof typeof SignatureAlgorithm];
+    /**
+     * A key's RFC 7638 SHA-256 thumbprint, base64url: the `keyid` Web Bot Auth signs under
+     * and the `kid` its key directory publishes. A key pair's halves share one thumbprint.
+     *
+     * @example let keyid = await JWK.thumbprint(keyPair.jwk);
+     */
+    export const thumbprint: typeof jwkThumbprint;
     /** A key pair imported into a usable form, with the public half in JWK format. */
     export interface KeyPair {
         /** Identifier published as the `kid`, and written into every token header. */
@@ -53,8 +75,11 @@ export declare namespace JWK {
     export interface SerializedKeyPair {
         /** Identifier that becomes the `kid`. */
         id: `${string}-${string}-${string}-${string}-${string}`;
-        /** Algorithm the pair was generated for. */
-        alg: Algorithm;
+        /**
+         * Algorithm the pair was generated for. A pair stored as `EdDSA`, the name RFC
+         * 9864 deprecates, imports as `Ed25519`, so stored Edwards keys keep working.
+         */
+        alg: Algorithm | typeof LEGACY_EDDSA;
         /** Public key in SPKI PEM form. */
         publicKey: string;
         /** Private key in PKCS#8 PEM form. */

package/dist/jwk.js

@@ -12,6 +12,12 @@
 import { generateUUID } from "@sdxc/uuid/v4";
 import * as jose from "jose";
 import * as SignatureAlgorithm from "./algorithm.js";
+import { thumbprint as jwkThumbprint } from "./thumbprint.js";
+/**
+ * The polymorphic name RFC 9864 deprecates in favour of `Ed25519`. Keys and tokens
+ * written under it before the rename still import and verify as Ed25519.
+ */
+export const LEGACY_EDDSA = "EdDSA";
 /**
  * Prefix every stored signing key is written under.
  *
@@ -34,6 +40,21 @@ const PUBLISHED_JWK_FIELDS = {
     OKP: ({ crv, x }) => ({ crv, x }),
     RSA: ({ e, n }) => ({ e, n }),
 };
+/**
+ * A key's public half as a header or a key set carries it: `kty` and the members its type
+ * publishes, so `kid`, `use` and every private member stay out.
+ *
+ * @param jwk - A public or private JWK.
+ * @returns The public members.
+ * @throws When the key type has no published shape on record.
+ */
+export function publicJwk(jwk) {
+    let kty = jwk.kty;
+    let publish = kty ? PUBLISHED_JWK_FIELDS[kty] : undefined;
+    if (!kty || !publish)
+        throw new Error(`Cannot publish a key of type ${String(kty)}`);
+    return { kty, ...publish(jwk) };
+}
 /**
  * Everything about the keys a token is signed with or verified against.
  *
@@ -44,10 +65,17 @@ export var JWK;
 (function (JWK) {
     /**
      * ES256 is issued here; RS256 verifies tokens from upstream identity
-     * providers; EdDSA derives its nonce from the key and message, keeping the
+     * providers; Ed25519 derives its nonce from the key and message, keeping the
      * ECDSA nonce-reuse leak that exposes a private key out of reach.
      */
     JWK.Algorithm = SignatureAlgorithm;
+    /**
+     * A key's RFC 7638 SHA-256 thumbprint, base64url: the `keyid` Web Bot Auth signs under
+     * and the `kid` its key directory publishes. A key pair's halves share one thumbprint.
+     *
+     * @example let keyid = await JWK.thumbprint(keyPair.jwk);
+     */
+    JWK.thumbprint = jwkThumbprint;
     /**
      * Generates a new key pair in serialized form.
      *
@@ -83,14 +111,15 @@ export var JWK;
      * let keyPair = await JWK.importKeyPair({ id, alg, publicKey, privateKey, created });
      */
     async function importKeyPair(value) {
-        let publicKey = await jose.importSPKI(value.publicKey, value.alg, { extractable: true });
-        let privateKey = await jose.importPKCS8(value.privateKey, value.alg);
+        let alg = value.alg === LEGACY_EDDSA ? JWK.Algorithm.Ed25519 : value.alg;
+        let publicKey = await jose.importSPKI(value.publicKey, alg, { extractable: true });
+        let privateKey = await jose.importPKCS8(value.privateKey, alg);
         let jwk = await jose.exportJWK(publicKey);
         jwk.kid = value.id;
         jwk.use = "sig";
         return {
             id: value.id,
-            alg: value.alg,
+            alg,
             created: new Date(value.created),
             expired: value.expired,
             public: publicKey,
@@ -173,11 +202,8 @@ export var JWK;
     function toJSON(keys) {
         return {
             keys: keys.map(({ alg, id, jwk }) => {
-                let kty = jwk.kty;
-                let publish = kty ? PUBLISHED_JWK_FIELDS[kty] : undefined;
-                if (!kty || !publish)
-                    throw new Error(`Cannot publish a key of type ${String(kty)}`);
-                return { ...publish(jwk), kty, kid: id, alg };
+                let { kty, ...members } = publicJwk(jwk);
+                return { ...members, kty: kty, kid: id, alg };
             }),
         };
     }

package/dist/jwt.d.ts

@@ -32,6 +32,14 @@ import { ObjectParser } from "./lib/parser.js";
  * }
  */
 export declare class JWT implements jose.JWTPayload {
+    /**
+     * The `typ` header this class signs with. A subclass naming its own media type
+     * (`static override type = "at+jwt"`) is explicitly typed per RFC 8725: `verify`
+     * on it refuses a token of any other type, so one kind never passes as another.
+     *
+     * @default "JWT"
+     */
+    static type: string;
     /** The raw claim set, readable whole for callers that want the payload itself. */
     readonly payload: JWT.Payload;
     /** Type-checked reads over `payload`, for the accessors a subclass defines. */
@@ -144,6 +152,17 @@ export declare class JWT implements jose.JWTPayload {
      * let signed = await token.sign(JWK.Algorithm.ES256, await JWK.signingKeys(storage));
      */
     sign(algorithm: JWK.Algorithm, jwks: JWK.SigningKey[]): Promise<string>;
+    /**
+     * Signs with a key pair's own algorithm, carrying the pair's public half in the `jwk`
+     * header (RFC 7515 §4.1.3) in place of a `kid`, for a token whose verifier learns the
+     * key from the token itself, as with an RFC 9449 DPoP proof.
+     *
+     * @param keyPair - The pair to sign with; only its public members reach the header.
+     * @returns The compact-serialized token.
+     * @example
+     * let proof = await new DPoPProof({ htm: "POST", htu, iat: 0, jti }).signEmbedded(keyPair);
+     */
+    signEmbedded(keyPair: JWT.EmbeddableKey): Promise<string>;
     /**
      * The claims a subclass exposes, as a plain object.
      *
@@ -157,7 +176,8 @@ export declare class JWT implements jose.JWTPayload {
      * Signs a token with the first key matching the algorithm.
      *
      * The keys arrive newest first, so the newest signs while older ones stay
-     * published to verify what they already signed, keyed by the `kid` header.
+     * published to verify what they already signed, keyed by the `kid` header. The
+     * `typ` header is the token class's {@link JWT.type}.
      *
      * @param jwt - The token to sign.
      * @param algorithm - Algorithm to sign with; also selects the key.
@@ -166,11 +186,33 @@ export declare class JWT implements jose.JWTPayload {
      * @throws When no key in the set was generated for that algorithm.
      */
     static sign(jwt: JWT, algorithm: JWK.Algorithm, jwks: JWK.SigningKey[]): Promise<string>;
+    /**
+     * Signs a token with the key pair's own algorithm and its public JWK in the header.
+     *
+     * @param jwt - The token to sign.
+     * @param keyPair - The pair to sign with.
+     * @returns The compact-serialized token.
+     */
+    static signEmbedded(jwt: JWT, keyPair: JWT.EmbeddableKey): Promise<string>;
+    /**
+     * Verifies a token against the public key its own `jwk` header carries, answering the
+     * key beside the token so the caller can hold it to a binding, such as the `cnf.jkt`
+     * thumbprint a DPoP-bound access token names. A header carrying a private key fails.
+     *
+     * @param token - The compact-serialized token.
+     * @param options - Expected algorithms, clock tolerance, `typ`, and so on.
+     * @returns The verified token and the public JWK it was signed under.
+     * @throws When the header has no usable public key, or a check on the token fails.
+     * @example
+     * let { token: proof, jwk } = await DPoPProof.verifyEmbedded(header, { algorithms });
+     */
+    static verifyEmbedded<M extends JWT>(this: (new (payload: JWT.Payload) => M) & Pick<typeof JWT, "type">, token: string, options?: JWT.VerifyOptions): Promise<JWT.Embedded<M>>;
     /**
      * Verifies a token and returns it as an instance of the class this was called on.
      *
-     * The key is picked by the token's `kid`, letting a retired key keep verifying
-     * what it already signed through a rotation; `algorithms` pins accepted ones.
+     * The key is picked by the token's `kid`, so a retired key keeps verifying what it
+     * signed. `algorithms` defaults to every supported one; `Ed25519` also accepts the
+     * deprecated `EdDSA`. An explicitly typed class requires its `typ` by default.
      *
      * @param token - The compact-serialized token.
      * @param jwks - The keys themselves, or a resolver from `JWK.importLocal` /
@@ -186,7 +228,7 @@ export declare class JWT implements jose.JWTPayload {
      * 	algorithms: [JWK.Algorithm.ES256],
      * });
      */
-    static verify<M extends JWT>(this: new (payload: JWT.Payload) => M, token: string, jwks: JWK.VerificationKeys, options?: JWT.VerifyOptions): Promise<M>;
+    static verify<M extends JWT>(this: (new (payload: JWT.Payload) => M) & Pick<typeof JWT, "type">, token: string, jwks: JWK.VerificationKeys, options?: JWT.VerifyOptions): Promise<M>;
     /**
      * Reads a token's claims as the token presents them, prior to verification.
      *
@@ -214,4 +256,23 @@ export declare namespace JWT {
     };
     /** The checks `JWT.verify` can be asked to run beyond the signature. */
     type VerifyOptions = jose.JWTVerifyOptions;
+    /** A key pair that signs with its public half embedded: `JWK.KeyPair` satisfies it. */
+    interface EmbeddableKey {
+        /** Algorithm the pair was generated for, written as the header's `alg`. */
+        alg: string;
+        /** The private half. */
+        private: jose.CryptoKey;
+        /** The public half, whose public members become the header's `jwk`. */
+        jwk: jose.JWK;
+    }
+    /**
+     * A token verified against the key its header carried.
+     *
+     * @template M - The token class it was verified as.
+     */
+    interface Embedded<M extends JWT> {
+        token: M;
+        /** The public members of the key the token was signed under. */
+        jwk: jose.JWK;
+    }
 }

package/dist/jwt.js

@@ -12,9 +12,58 @@
  */
 import { toSeconds } from "@sdxc/duration";
 import * as jose from "jose";
+import * as SignatureAlgorithm from "./algorithm.js";
+import { LEGACY_EDDSA, publicJwk } from "./jwk.js";
 import { ObjectParser } from "./lib/parser.js";
 /** Milliseconds in a second, for converting between epoch claims and `Date`. */
 const MS_PER_SECOND = 1000;
+/** The `typ` header a token carries when its class names no media type of its own. */
+const DEFAULT_TYPE = "JWT";
+/**
+ * Algorithms `verify` accepts when the caller pins none: every supported one plus
+ * the deprecated `EdDSA` name, so a token presenting `none`, an HMAC or any other
+ * algorithm is refused before its key is looked up.
+ */
+const DEFAULT_ALGORITHMS = [...Object.values(SignatureAlgorithm), LEGACY_EDDSA];
+/**
+ * The two names an Ed25519 signature goes by, each mapped to the other. RFC 9864
+ * deprecates `EdDSA` for `Ed25519`; tokens and key sets written under either name
+ * verify against keys published under the other.
+ */
+const EDWARDS_ALIASES = {
+    [SignatureAlgorithm.Ed25519]: LEGACY_EDDSA,
+    [LEGACY_EDDSA]: SignatureAlgorithm.Ed25519,
+};
+/**
+ * The accepted algorithms with each Ed25519 name joined by its alias, so pinning
+ * `Ed25519` keeps accepting tokens signed before the rename.
+ *
+ * @param algorithms - What the caller pinned, if anything.
+ */
+function acceptedAlgorithms(algorithms = DEFAULT_ALGORITHMS) {
+    let aliases = algorithms.flatMap((alg) => EDWARDS_ALIASES[alg] ?? []);
+    return [...new Set([...algorithms, ...aliases])];
+}
+/**
+ * Retries a key lookup under a token's other Ed25519 name when the first finds no
+ * key, since a key set matches `alg` exactly and one published before or after the
+ * rename names the key differently than the token does.
+ *
+ * @param resolver - The key set the token is verified against.
+ */
+function withEdwardsAliases(resolver) {
+    return async (header, token) => {
+        try {
+            return await resolver(header, token);
+        }
+        catch (error) {
+            let alias = header.alg === undefined ? undefined : EDWARDS_ALIASES[header.alg];
+            if (!alias || !(error instanceof jose.errors.JWKSNoMatchingKey))
+                throw error;
+            return await resolver({ ...header, alg: alias }, token);
+        }
+    };
+}
 /** Claims that may be written as a length of time from now. */
 const RELATIVE_CLAIMS = ["exp", "iat", "nbf"];
 /**
@@ -53,6 +102,14 @@ function resolveRelativeClaims(payload) {
  * }
  */
 export class JWT {
+    /**
+     * The `typ` header this class signs with. A subclass naming its own media type
+     * (`static override type = "at+jwt"`) is explicitly typed per RFC 8725: `verify`
+     * on it refuses a token of any other type, so one kind never passes as another.
+     *
+     * @default "JWT"
+     */
+    static type = DEFAULT_TYPE;
     /** The raw claim set, readable whole for callers that want the payload itself. */
     payload;
     /** Type-checked reads over `payload`, for the accessors a subclass defines. */
@@ -241,6 +298,19 @@ export class JWT {
     sign(algorithm, jwks) {
         return JWT.sign(this, algorithm, jwks);
     }
+    /**
+     * Signs with a key pair's own algorithm, carrying the pair's public half in the `jwk`
+     * header (RFC 7515 §4.1.3) in place of a `kid`, for a token whose verifier learns the
+     * key from the token itself, as with an RFC 9449 DPoP proof.
+     *
+     * @param keyPair - The pair to sign with; only its public members reach the header.
+     * @returns The compact-serialized token.
+     * @example
+     * let proof = await new DPoPProof({ htm: "POST", htu, iat: 0, jti }).signEmbedded(keyPair);
+     */
+    signEmbedded(keyPair) {
+        return JWT.signEmbedded(this, keyPair);
+    }
     /**
      * The claims a subclass exposes, as a plain object.
      *
@@ -261,7 +331,8 @@ export class JWT {
      * Signs a token with the first key matching the algorithm.
      *
      * The keys arrive newest first, so the newest signs while older ones stay
-     * published to verify what they already signed, keyed by the `kid` header.
+     * published to verify what they already signed, keyed by the `kid` header. The
+     * `typ` header is the token class's {@link JWT.type}.
      *
      * @param jwt - The token to sign.
      * @param algorithm - Algorithm to sign with; also selects the key.
@@ -274,14 +345,56 @@ export class JWT {
         if (!key)
             throw new Error(`No key available to sign JWT with algorithm ${algorithm}`);
         return new jose.SignJWT(jwt.payload)
-            .setProtectedHeader({ alg: algorithm, typ: "JWT", kid: key.id })
+            .setProtectedHeader({
+            alg: algorithm,
+            typ: jwt.constructor.type,
+            kid: key.id,
+        })
             .sign(key.private);
     }
+    /**
+     * Signs a token with the key pair's own algorithm and its public JWK in the header.
+     *
+     * @param jwt - The token to sign.
+     * @param keyPair - The pair to sign with.
+     * @returns The compact-serialized token.
+     */
+    static signEmbedded(jwt, keyPair) {
+        return new jose.SignJWT(jwt.payload)
+            .setProtectedHeader({
+            alg: keyPair.alg,
+            typ: jwt.constructor.type,
+            jwk: publicJwk(keyPair.jwk),
+        })
+            .sign(keyPair.private);
+    }
+    /**
+     * Verifies a token against the public key its own `jwk` header carries, answering the
+     * key beside the token so the caller can hold it to a binding, such as the `cnf.jkt`
+     * thumbprint a DPoP-bound access token names. A header carrying a private key fails.
+     *
+     * @param token - The compact-serialized token.
+     * @param options - Expected algorithms, clock tolerance, `typ`, and so on.
+     * @returns The verified token and the public JWK it was signed under.
+     * @throws When the header has no usable public key, or a check on the token fails.
+     * @example
+     * let { token: proof, jwk } = await DPoPProof.verifyEmbedded(header, { algorithms });
+     */
+    static async verifyEmbedded(token, options) {
+        let result = await jose.jwtVerify(token, jose.EmbeddedJWK, {
+            ...options,
+            algorithms: acceptedAlgorithms(options?.algorithms),
+            typ: options?.typ ?? (this.type === DEFAULT_TYPE ? undefined : this.type),
+        });
+        let jwk = publicJwk(result.protectedHeader.jwk ?? {});
+        return { token: new this(result.payload), jwk };
+    }
     /**
      * Verifies a token and returns it as an instance of the class this was called on.
      *
-     * The key is picked by the token's `kid`, letting a retired key keep verifying
-     * what it already signed through a rotation; `algorithms` pins accepted ones.
+     * The key is picked by the token's `kid`, so a retired key keeps verifying what it
+     * signed. `algorithms` defaults to every supported one; `Ed25519` also accepts the
+     * deprecated `EdDSA`. An explicitly typed class requires its `typ` by default.
      *
      * @param token - The compact-serialized token.
      * @param jwks - The keys themselves, or a resolver from `JWK.importLocal` /
@@ -304,7 +417,11 @@ export class JWT {
         let key = Array.isArray(jwks)
             ? jose.createLocalJWKSet({ keys: jwks.map((candidate) => candidate.jwk) })
             : jwks;
-        let result = await jose.jwtVerify(token, key, options);
+        let result = await jose.jwtVerify(token, withEdwardsAliases(key), {
+            ...options,
+            algorithms: acceptedAlgorithms(options?.algorithms),
+            typ: options?.typ ?? (this.type === DEFAULT_TYPE ? undefined : this.type),
+        });
         return new this(result.payload);
     }
     /**

package/dist/security-event-token.d.ts

@@ -0,0 +1,139 @@
+/**
+ * The Security Event Token of RFC 8417: a JWT typed `secevent+jwt` whose `events` claim
+ * states what happened to a subject, with `txn`, `toe` and RFC 9493's `sub_id` as typed
+ * accessors, so every SET profile builds and verifies its tokens through one class.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+import type { JWK } from "./jwk.js";
+import { JWT } from "./jwt.js";
+/**
+ * A Security Event Token. Build one with `SecurityEventToken.create`, sign it with
+ * `token.sign(algorithm, keys)`, and verify a received one with `SecurityEventToken.verify`,
+ * which requires the `secevent+jwt` type, `iss`, `iat`, `jti`, `aud` and a non-empty
+ * `events` claim, and refuses an `exp`: a SET records something that already happened.
+ *
+ * Subclass it for a SET profile, adding accessors for the profile's own claims; `create`
+ * and `verify` then produce the subclass.
+ *
+ * @example let set = await SecurityEventToken.create({ issuer, audience, events }).sign(JWK.Algorithm.ES256, keys);
+ * @example let event = await SecurityEventToken.verify(raw, jwks, { issuer, audience });
+ */
+export declare class SecurityEventToken extends JWT {
+    /**
+     * RFC 8417 §2.3's media type, which keeps a SET from verifying as an access token or
+     * any other explicitly typed JWT.
+     */
+    static type: string;
+    /**
+     * Builds an unsigned SET with every claim RFC 8417 requires: a fresh random `jti` and
+     * `iat` now unless given, and each event payload under its event URI.
+     *
+     * @param input - Issuer, audience, events, and the optional envelope claims
+     * @returns The token, ready to sign, as the class this is called on
+     * @example
+     * SecurityEventToken.create({
+     * 	issuer: "https://idp.example.com/",
+     * 	audience: "https://rp.example.com/",
+     * 	subjectId: { format: "email", email: "user@example.com" },
+     * 	events: { "https://schemas.openid.net/secevent/risc/event-type/account-disabled": { reason: "hijacking" } },
+     * });
+     */
+    static create<M extends SecurityEventToken>(this: new (payload: JWT.Payload) => M, input: SecurityEventToken.Input): M;
+    /**
+     * Verifies a SET as {@link JWT.verify} does, then holds it to RFC 8417: `iss`, `iat`,
+     * `jti` and `aud` present, `events` an object of one or more event objects, and no
+     * `exp`. A failed check throws jose's `JWTClaimValidationFailed` naming the claim.
+     *
+     * @param token - The compact-serialized SET
+     * @param jwks - The issuer's keys, or a resolver over them
+     * @param options - Expected issuer, audience, algorithms and clock tolerance
+     * @returns The verified token, as the class this is called on
+     * @throws When the signature, the type or any claim check fails
+     */
+    static verify<M extends JWT>(this: (new (payload: JWT.Payload) => M) & Pick<typeof JWT, "type">, token: string, jwks: JWK.VerificationKeys, options?: JWT.VerifyOptions): Promise<M>;
+    /**
+     * The `events` claim: each event's payload under its event URI, every member describing
+     * an aspect of the same state change.
+     *
+     * @returns The payloads by URI; empty when the claim is absent or malformed
+     */
+    get events(): SecurityEventToken.Events;
+    /** @param value - The events to carry, replacing any already set. */
+    set events(value: SecurityEventToken.Events);
+    /**
+     * The `txn` claim, shared by every token one transaction produces so a receiver can
+     * correlate them.
+     *
+     * @returns The transaction identifier, or `null` when absent
+     */
+    get transaction(): string | null;
+    /** @param value - The transaction identifier, or `null` to drop the claim. */
+    set transaction(value: string | null);
+    /**
+     * The `toe` claim: when the event happened, which may precede `iat` by any amount.
+     *
+     * @returns The time of the event, or `null` when the issuer shares none
+     */
+    get timeOfEvent(): Date | null;
+    /** @param value - The time of the event, or `null` to drop the claim. */
+    set timeOfEvent(value: Date | null);
+    /**
+     * The `sub_id` claim (RFC 9493 §4.1). An `email`, `iss_sub` or `opaque` identifier
+     * missing its required members reads as `null`; any other format is returned as given.
+     *
+     * @returns The subject identifier, or `null` when absent or malformed
+     */
+    get subjectId(): SecurityEventToken.SubjectIdentifier | null;
+    /** @param value - The subject identifier, or `null` to drop the claim. */
+    set subjectId(value: SecurityEventToken.SubjectIdentifier | null);
+}
+export declare namespace SecurityEventToken {
+    /** Each event's payload under its event URI; an event with no claims is `{}`. */
+    type Events = Record<string, Record<string, unknown>>;
+    /** An RFC 9493 `email` identifier. */
+    interface EmailSubject {
+        format: "email";
+        email: string;
+    }
+    /**
+     * An RFC 9493 `iss_sub` identifier: a subject as an ID token names it, where `iss` may
+     * differ from the SET's own issuer.
+     */
+    interface IssuerSubject {
+        format: "iss_sub";
+        iss: string;
+        sub: string;
+    }
+    /** An RFC 9493 `opaque` identifier, carrying no meaning beyond identifying the subject. */
+    interface OpaqueSubject {
+        format: "opaque";
+        id: string;
+    }
+    /** Any other registered or profile-defined format, such as `phone_number` or `scim`. */
+    interface OtherSubject {
+        format: string;
+        [member: string]: unknown;
+    }
+    /** An RFC 9493 subject identifier, as `sub_id` carries it. */
+    type SubjectIdentifier = EmailSubject | IssuerSubject | OpaqueSubject | OtherSubject;
+    /** What `SecurityEventToken.create` builds a token from. */
+    interface Input {
+        issuer: string;
+        audience: string | string[];
+        /** One or more aspects of the same state change, each payload under its event URI. */
+        events: Events;
+        /** The token's `jti`, unique within the event feed; a fresh random one when omitted. */
+        id?: string;
+        /** @default new Date() */
+        issuedAt?: Date;
+        /** The `sub` claim, for a profile that defines what it holds. */
+        subject?: string;
+        subjectId?: SubjectIdentifier;
+        /** The `txn` claim, shared by every token one transaction produces. */
+        transaction?: string;
+        /** The `toe` claim; omitted, the token shares no time of event. */
+        timeOfEvent?: Date;
+    }
+}

package/dist/security-event-token.js

@@ -0,0 +1,187 @@
+/**
+ * The Security Event Token of RFC 8417: a JWT typed `secevent+jwt` whose `events` claim
+ * states what happened to a subject, with `txn`, `toe` and RFC 9493's `sub_id` as typed
+ * accessors, so every SET profile builds and verifies its tokens through one class.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+import { generateUUID } from "@sdxc/uuid/v4";
+import * as jose from "jose";
+import { JWT } from "./jwt.js";
+/** Milliseconds in a second, for converting between epoch claims and `Date`. */
+const MS_PER_SECOND = 1000;
+/** The claims RFC 8417 §2.2 requires, plus the audience every SET here is addressed to. */
+const REQUIRED_CLAIMS = ["iss", "iat", "jti", "aud"];
+/**
+ * The members each RFC 9493 format this class types must carry as a non-empty string; a
+ * `sub_id` of one of these formats missing any of them reads as `null`.
+ */
+const SUBJECT_MEMBERS = {
+    email: ["email"],
+    iss_sub: ["iss", "sub"],
+    opaque: ["id"],
+};
+/**
+ * A Security Event Token. Build one with `SecurityEventToken.create`, sign it with
+ * `token.sign(algorithm, keys)`, and verify a received one with `SecurityEventToken.verify`,
+ * which requires the `secevent+jwt` type, `iss`, `iat`, `jti`, `aud` and a non-empty
+ * `events` claim, and refuses an `exp`: a SET records something that already happened.
+ *
+ * Subclass it for a SET profile, adding accessors for the profile's own claims; `create`
+ * and `verify` then produce the subclass.
+ *
+ * @example let set = await SecurityEventToken.create({ issuer, audience, events }).sign(JWK.Algorithm.ES256, keys);
+ * @example let event = await SecurityEventToken.verify(raw, jwks, { issuer, audience });
+ */
+export class SecurityEventToken extends JWT {
+    /**
+     * RFC 8417 §2.3's media type, which keeps a SET from verifying as an access token or
+     * any other explicitly typed JWT.
+     */
+    static type = "secevent+jwt";
+    /**
+     * Builds an unsigned SET with every claim RFC 8417 requires: a fresh random `jti` and
+     * `iat` now unless given, and each event payload under its event URI.
+     *
+     * @param input - Issuer, audience, events, and the optional envelope claims
+     * @returns The token, ready to sign, as the class this is called on
+     * @example
+     * SecurityEventToken.create({
+     * 	issuer: "https://idp.example.com/",
+     * 	audience: "https://rp.example.com/",
+     * 	subjectId: { format: "email", email: "user@example.com" },
+     * 	events: { "https://schemas.openid.net/secevent/risc/event-type/account-disabled": { reason: "hijacking" } },
+     * });
+     */
+    static create(input) {
+        let payload = {
+            iss: input.issuer,
+            iat: toEpochSeconds(input.issuedAt ?? new Date()),
+            jti: input.id ?? generateUUID(),
+            aud: input.audience,
+            events: input.events,
+        };
+        if (input.subject !== undefined)
+            payload.sub = input.subject;
+        if (input.subjectId !== undefined)
+            payload.sub_id = input.subjectId;
+        if (input.transaction !== undefined)
+            payload.txn = input.transaction;
+        if (input.timeOfEvent !== undefined)
+            payload.toe = toEpochSeconds(input.timeOfEvent);
+        return new this(payload);
+    }
+    /**
+     * Verifies a SET as {@link JWT.verify} does, then holds it to RFC 8417: `iss`, `iat`,
+     * `jti` and `aud` present, `events` an object of one or more event objects, and no
+     * `exp`. A failed check throws jose's `JWTClaimValidationFailed` naming the claim.
+     *
+     * @param token - The compact-serialized SET
+     * @param jwks - The issuer's keys, or a resolver over them
+     * @param options - Expected issuer, audience, algorithms and clock tolerance
+     * @returns The verified token, as the class this is called on
+     * @throws When the signature, the type or any claim check fails
+     */
+    static async verify(token, jwks, options) {
+        let requiredClaims = [...new Set([...REQUIRED_CLAIMS, ...(options?.requiredClaims ?? [])])];
+        let verified = (await JWT.verify.call(this, token, jwks, { ...options, requiredClaims }));
+        assertSecurityEventClaims(verified.payload);
+        return verified;
+    }
+    /**
+     * The `events` claim: each event's payload under its event URI, every member describing
+     * an aspect of the same state change.
+     *
+     * @returns The payloads by URI; empty when the claim is absent or malformed
+     */
+    get events() {
+        let value = this.payload.events;
+        if (!isObject(value))
+            return {};
+        return value;
+    }
+    /** @param value - The events to carry, replacing any already set. */
+    set events(value) {
+        this.payload.events = value;
+    }
+    /**
+     * The `txn` claim, shared by every token one transaction produces so a receiver can
+     * correlate them.
+     *
+     * @returns The transaction identifier, or `null` when absent
+     */
+    get transaction() {
+        return typeof this.payload.txn === "string" ? this.payload.txn : null;
+    }
+    /** @param value - The transaction identifier, or `null` to drop the claim. */
+    set transaction(value) {
+        this.payload.txn = value ?? undefined;
+    }
+    /**
+     * The `toe` claim: when the event happened, which may precede `iat` by any amount.
+     *
+     * @returns The time of the event, or `null` when the issuer shares none
+     */
+    get timeOfEvent() {
+        if (typeof this.payload.toe !== "number")
+            return null;
+        return new Date(this.payload.toe * MS_PER_SECOND);
+    }
+    /** @param value - The time of the event, or `null` to drop the claim. */
+    set timeOfEvent(value) {
+        this.payload.toe = value === null ? undefined : toEpochSeconds(value);
+    }
+    /**
+     * The `sub_id` claim (RFC 9493 §4.1). An `email`, `iss_sub` or `opaque` identifier
+     * missing its required members reads as `null`; any other format is returned as given.
+     *
+     * @returns The subject identifier, or `null` when absent or malformed
+     */
+    get subjectId() {
+        let value = this.payload.sub_id;
+        if (!isObject(value) || typeof value.format !== "string")
+            return null;
+        let members = SUBJECT_MEMBERS[value.format] ?? [];
+        let complete = members.every((name) => typeof value[name] === "string" && value[name] !== "");
+        return complete ? value : null;
+    }
+    /** @param value - The subject identifier, or `null` to drop the claim. */
+    set subjectId(value) {
+        this.payload.sub_id = value ?? undefined;
+    }
+}
+/**
+ * Holds a verified claim set to the parts of RFC 8417 a signature check cannot see.
+ *
+ * @param payload - The verified claims
+ * @throws `JWTClaimValidationFailed` naming `exp` or `events`
+ */
+function assertSecurityEventClaims(payload) {
+    if (payload.exp !== undefined) {
+        throw new jose.errors.JWTClaimValidationFailed('a SET must not carry an "exp" claim', payload, "exp", "check_failed");
+    }
+    let events = payload.events;
+    let valid = isObject(events) &&
+        Object.keys(events).length > 0 &&
+        Object.values(events).every((event) => isObject(event));
+    if (!valid) {
+        throw new jose.errors.JWTClaimValidationFailed('"events" claim must be an object of one or more event objects', payload, "events", "invalid");
+    }
+}
+/**
+ * Whether a value is a JSON object, the shape RFC 8417 requires of `events` and each event.
+ *
+ * @param value - The claim value
+ */
+function isObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+ * A `Date` as the whole seconds since the epoch a NumericDate claim holds.
+ *
+ * @param date - The instant
+ */
+function toEpochSeconds(date) {
+    return Math.floor(date.getTime() / MS_PER_SECOND);
+}

package/dist/thumbprint.d.ts

@@ -0,0 +1,20 @@
+/**
+ * The RFC 7638 JWK thumbprint: a key's identifier derived from its public members, so a
+ * signer and a verifier name the same key without agreeing on a `kid` first. Web Bot
+ * Auth and DPoP both identify keys this way.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+import type { Result } from "@sdxc/result";
+import * as jose from "jose";
+/**
+ * The base64url SHA-256 thumbprint of a key (RFC 7638 §3, and RFC 8037 Appendix A.3 for
+ * `OKP` keys). Only the members the key type requires are hashed, so a private JWK and its
+ * public half share one thumbprint, and `kid`, `alg` or `use` never change it.
+ *
+ * @param jwk - A JWK of type `EC`, `RSA`, `OKP` or `oct`, public or private.
+ * @returns The thumbprint, or a failure naming the missing or unsupported member.
+ * @example await thumbprint({ kty: "OKP", crv: "Ed25519", x: "11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo" })
+ */
+export declare function thumbprint(jwk: jose.JWK): Promise<Result<string, Error>>;

package/dist/thumbprint.js

@@ -0,0 +1,27 @@
+/**
+ * The RFC 7638 JWK thumbprint: a key's identifier derived from its public members, so a
+ * signer and a verifier name the same key without agreeing on a `kid` first. Web Bot
+ * Auth and DPoP both identify keys this way.
+ *
+ * @author [Sergio Xalambrí](https://sergiodxa.com)
+ * @copyright Sergio Xalambrí 2026
+ */
+import { failure, success } from "@sdxc/result";
+import * as jose from "jose";
+/**
+ * The base64url SHA-256 thumbprint of a key (RFC 7638 §3, and RFC 8037 Appendix A.3 for
+ * `OKP` keys). Only the members the key type requires are hashed, so a private JWK and its
+ * public half share one thumbprint, and `kid`, `alg` or `use` never change it.
+ *
+ * @param jwk - A JWK of type `EC`, `RSA`, `OKP` or `oct`, public or private.
+ * @returns The thumbprint, or a failure naming the missing or unsupported member.
+ * @example await thumbprint({ kty: "OKP", crv: "Ed25519", x: "11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo" })
+ */
+export async function thumbprint(jwk) {
+    try {
+        return success(await jose.calculateJwkThumbprint(jwk, "sha256"));
+    }
+    catch (error) {
+        return failure(error instanceof Error ? error : new Error(String(error)));
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@sdxc/jwt",
-	"version": "2026.10.24",
+	"version": "2026.10.25",
 	"description": "JWT payload classes and the keys that sign them",
 	"license": "MIT",
 	"type": "module",
@@ -11,10 +11,11 @@
 	},
 	"dependencies": {
 		"@sdxc/duration": "2026.10.13",
+		"@sdxc/result": "2026.10.13",
 		"@sdxc/uuid": "2026.10.13",
 		"jose": "^6.2.13"
 	},
-	"gitHead": "f9db0f8f1f51a256e74b94b0f4b1db4be9880370",
+	"gitHead": "1440b969c0a3e3808dfcee3f17d2ef43915f32a8",
 	"publishConfig": {
 		"access": "public"
 	},