Add CIMD and grant-aware token issuance

.github/workflows/codeql-analysis.yml

@@ -35,21 +35,21 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a
+      uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a
       with:
         languages: 'csharp'
         build-mode: none
         queries: security-and-quality
 
-    - uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1
+    - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68
       with:
         global-json-file: global.json
 
     - name: Autobuild
       if: ${{ github.actor != 'dependabot[bot]' }}
-      uses: github/codeql-action/autobuild@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a
+      uses: github/codeql-action/autobuild@7188fc363630916deb702c7fdcf4e481b751f97a
 
     - name: CodeQL Analysis
       if: ${{ github.actor != 'dependabot[bot]' }}
-      uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a
+      uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a
       timeout-minutes: 100

.github/workflows/main.yml

@@ -85,6 +85,14 @@ env:
     s.symcb.com:80
     ocsp.digicert.com:80
 
+    # BouncyCastle's NuGet package signature chains to Sectigo/Comodo/UserTrust;
+    # its CRL/OCSP endpoints must be reachable to verify the signature's revocation.
+    crl.sectigo.com:443
+    ocsp.sectigo.com:443
+    crl.comodoca.com:443
+    ocsp.comodoca.com:443
+    crl.usertrust.com:443
+
     # Dotnet tools download CRL list from here.
     www.microsoft.com:80
 
@@ -112,20 +120,29 @@ jobs:
     steps:
     - name: Harden Runner
       if: ${{ matrix.os == 'ubuntu-latest' || matrix.os == 'ubuntu-24.04-arm' }}
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411
+      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920
       with:
         disable-sudo: true
         egress-policy: block
         allowed-endpoints: ${{ env.COMMON_ALLOWED_ENDPOINTS }}
 
+    # Windows has no sudo to disable; otherwise the same block-mode allowlist so the
+    # workflow governs egress on the Windows host (package-signature revocation included).
+    - name: Harden Runner
+      if: ${{ matrix.os == 'windows-latest' }}
+      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920
+      with:
+        egress-policy: block
+        allowed-endpoints: ${{ env.COMMON_ALLOWED_ENDPOINTS }}
+
     - name: Checkout code
       uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
       with:
         fetch-depth: 0
         fetch-tags: true
 
     - name: Set up .NET SDK
-      uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1
+      uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68
       with:
         cache: true
         cache-dependency-path: '**/packages.lock.json'
@@ -382,7 +399,7 @@ jobs:
       if: ${{ matrix.os == 'ubuntu-latest' || matrix.os == 'ubuntu-24.04-arm' }}
       # Note: disable-sudo is intentionally omitted here because apt-get is
       # needed below to install native AOT prerequisites (clang, zlib1g-dev).
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411
+      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920
       with:
         egress-policy: block
         allowed-endpoints: ${{ env.COMMON_ALLOWED_ENDPOINTS }}
@@ -394,7 +411,7 @@ jobs:
         fetch-tags: true
 
     - name: Set up .NET SDK
-      uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1
+      uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68
       with:
         cache: true
         cache-dependency-path: '**/packages.lock.json'
@@ -523,7 +540,7 @@ jobs:
 
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411
+      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920
       with:
         disable-sudo: true
         egress-policy: block
@@ -536,7 +553,7 @@ jobs:
         fetch-tags: true
 
     - name: Set up .NET SDK
-      uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1
+      uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68
       with:
         cache: true
         cache-dependency-path: '**/packages.lock.json'
@@ -672,7 +689,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920
         with:
           disable-sudo: true
           egress-policy: block
@@ -727,7 +744,7 @@ jobs:
     environment: Release
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920
         with:
           disable-sudo: true
           egress-policy: block

Directory.Packages.props

@@ -16,17 +16,17 @@
     <PackageVersion Include="Lumoin.Veridical.Bbs" Version="0.0.4" />
     <PackageVersion Include="Microsoft.CodeAnalysis.BannedApiAnalyzers" Version="5.6.0" />
     <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="10.0.9" />
-    <PackageVersion Include="Microsoft.Extensions.Hosting" Version="10.0.9" />
+    <PackageVersion Include="Microsoft.Extensions.Hosting" Version="10.0.10" />
     <PackageVersion Include="Microsoft.Sbom.Targets" Version="4.1.5" />
     <PackageVersion Include="Microsoft.Testing.Extensions.CodeCoverage" Version="18.8.0" />
     <PackageVersion Include="NSec.Cryptography" Version="26.4.0" />
     <PackageVersion Include="BouncyCastle.Cryptography" Version="2.6.2" />
     <PackageVersion Include="System.Collections.Immutable" Version="10.0.9" />
-    <PackageVersion Include="System.Formats.Cbor" Version="10.0.9" />
+    <PackageVersion Include="System.Formats.Cbor" Version="10.0.10" />
     <PackageVersion Include="System.Net.Http.Json" Version="10.0.9" />
-    <PackageVersion Include="System.Security.Cryptography.ProtectedData" Version="10.0.9" />
+    <PackageVersion Include="System.Security.Cryptography.ProtectedData" Version="10.0.10" />
     <PackageVersion Include="System.Text.Json" Version="10.0.9" />
-    <PackageVersion Include="Microsoft.Extensions.TimeProvider.Testing" Version="10.7.0" />
+    <PackageVersion Include="Microsoft.Extensions.TimeProvider.Testing" Version="10.8.0" />
     <PackageVersion Include="System.Security.Cryptography.Xml" Version="10.0.9" />
     <PackageVersion Include="SIL.ReleaseTasks" Version="3.2.0" />
   </ItemGroup>
@@ -37,9 +37,11 @@
   -->
   <ItemGroup Label="CLI">
     <PackageVersion Include="dotNetRdf" Version="3.5.2" />
-    <PackageVersion Include="SimpleBase" Version="5.6.1" />
-    <PackageVersion Include="System.CommandLine" Version="2.0.9" />
-    <PackageVersion Include="ModelContextProtocol" Version="1.4.0" />
+    <!-- Transitive of dotNetRdf, pinned to a patched version to clear GHSA-pgww-w46g-26qg (vulnerable < 1.5.0). -->
+    <PackageVersion Include="AngleSharp" Version="1.5.2" />
+    <PackageVersion Include="SimpleBase" Version="5.6.2" />
+    <PackageVersion Include="System.CommandLine" Version="2.0.10" />
+    <PackageVersion Include="ModelContextProtocol" Version="1.4.1" />
   </ItemGroup>
   <!--
     Test packages used only in *.Tests projects.
@@ -48,11 +50,11 @@
   -->
   <ItemGroup Label="Test">
     <PackageVersion Include="CsCheck" Version="4.7.0" />
-    <PackageVersion Include="MessagePack" Version="3.1.4" />
+    <PackageVersion Include="MessagePack" Version="3.1.8" />
     <PackageVersion Include="LiquidTestReports.Markdown" Version="1.4.3-beta" />
     <PackageVersion Include="System.Reactive" Version="6.1.0" />
     <PackageVersion Include="Microsoft.Reactive.Testing" Version="6.1.0" />
-    <PackageVersion Include="Microsoft.IdentityModel.Tokens" Version="8.19.1" />
+    <PackageVersion Include="Microsoft.IdentityModel.Tokens" Version="8.19.2" />
   </ItemGroup>
   <!--
     Benchmark packages used only in *.Benchmarks projects.

README.md

@@ -88,7 +88,7 @@ The library includes the following protocol flows, each with tests. The test sui
 - **DID resolution** — a multi-method resolver for did:key, did:web, did:peer, [did:webvh](https://identity.foundation/didwebvh/) (DID Log replay, SCID and key pre-rotation, witness verification, portability, version queries, and DID-URL dereferencing), and [did:webs](https://trustoverip.github.io/kswg-did-method-webs-specification/) (KERI-backed: resolution to the `did.json` and `keri.cesr` URLs, with the CESR event stream replayed to a verified KERI key state), with a [DID Resolution](https://w3c-ccg.github.io/did-resolution/) HTTP binding.
 - **WebFinger ([RFC 7033](https://www.rfc-editor.org/rfc/rfc7033))** — handle-to-resource discovery: a client that resolves a query target to a JSON Resource Descriptor over the guarded outbound path, and a capability-gated `/.well-known/webfinger` endpoint on the multi-tenant host, used to discover a subject's DID from an `acct:` handle.
 - **Passkeys ([WebAuthn Level 3](https://www.w3.org/TR/webauthn-3/) and CTAP 2.3)** — relying-party registration and authentication ceremonies over the Level 3 JSON wire, attestation statement verification (packed, tpm, android-key, fido-u2f, none) with FIDO Metadata Service BLOB validation, and a CTAP 2.3 authenticator and client covering clientPIN (PIN/UV auth protocols 1 and 2), credentialManagement, authenticatorConfig, reset, bioEnrollment, largeBlobs, enterprise attestation, and the credProtect, minPinLength, largeBlobKey, hmac-secret, and hmac-secret-mc extensions — exercised over an NFC/APDU transport and a Kestrel-hosted HTTP relying party.
-- **OAuth 2.0 / OpenID Connect** — authorization code with [PKCE](https://www.rfc-editor.org/rfc/rfc7636), [pushed authorization requests](https://www.rfc-editor.org/rfc/rfc9126), [signed request objects](https://www.rfc-editor.org/rfc/rfc9101), [DPoP](https://www.rfc-editor.org/rfc/rfc9449), [rich authorization requests](https://www.rfc-editor.org/rfc/rfc9396) with a per-type handler registry, [JWT-secured authorization responses](https://openid.net/specs/oauth-v2-jarm.html), [token introspection](https://www.rfc-editor.org/rfc/rfc7662) with [JWT responses](https://www.rfc-editor.org/rfc/rfc9701), token refresh and revocation, [dynamic client registration](https://www.rfc-editor.org/rfc/rfc7591), and [server](https://www.rfc-editor.org/rfc/rfc8414) and [protected-resource](https://www.rfc-editor.org/rfc/rfc9728) metadata, including the [FAPI 2.0](https://openid.net/specs/fapi-2_0-security-profile.html) security profile and [message signing](https://openid.net/specs/fapi-2_0-message-signing.html) constraints.
+- **OAuth 2.0 / OpenID Connect** — authorization code with [PKCE](https://www.rfc-editor.org/rfc/rfc7636), [pushed authorization requests](https://www.rfc-editor.org/rfc/rfc9126), [signed request objects](https://www.rfc-editor.org/rfc/rfc9101), [DPoP](https://www.rfc-editor.org/rfc/rfc9449), [rich authorization requests](https://www.rfc-editor.org/rfc/rfc9396) with a per-type handler registry, [JWT-secured authorization responses](https://openid.net/specs/oauth-v2-jarm.html), [token introspection](https://www.rfc-editor.org/rfc/rfc7662) with [JWT responses](https://www.rfc-editor.org/rfc/rfc9701), token refresh and revocation, [dynamic client registration](https://www.rfc-editor.org/rfc/rfc7591), and [server](https://www.rfc-editor.org/rfc/rfc8414) and [protected-resource](https://www.rfc-editor.org/rfc/rfc9728) metadata, including the [FAPI 2.0](https://openid.net/specs/fapi-2_0-security-profile.html) security profile and [message signing](https://openid.net/specs/fapi-2_0-message-signing.html) constraints. Clients identify by [Client ID Metadata Document](https://datatracker.ietf.org/doc/draft-ietf-oauth-client-id-metadata-document/) — an `https` `client_id` resolved and validated at first use, with no pre-registration — and authenticate the code-exchange and refresh legs by `private_key_jwt` or a client secret. The authorization server emits [issuer identification](https://www.rfc-editor.org/rfc/rfc9207) and [JWT access tokens](https://www.rfc-editor.org/rfc/rfc9068), anchors OpenID Connect identity to an authenticated end-user across grants and refresh, and both mints ID Tokens and validates a received one per OpenID Connect Core §3.1.3.7. Identity and authorization chaining across trust domains combines [token exchange](https://www.rfc-editor.org/rfc/rfc8693) and the [JWT bearer grant](https://www.rfc-editor.org/rfc/rfc7523) into a cross-domain mint-and-redeem exercised end to end across two authorization servers.
 - **[OpenID Federation 1.0](https://openid.net/specs/openid-federation-1_0.html)** — entity configurations, trust chain resolution, metadata policy, trust marks, and client registration.
 - **Shared Signals ([SSF](https://openid.net/specs/openid-sharedsignals-framework-1_0.html), [CAEP](https://openid.net/specs/openid-caep-1_0.html), RISC)** — transmitter and receiver, with push and poll delivery and stream management.
 - **[AuthZEN](https://openid.net/specs/authorization-api-1_0.html)** — access evaluation, single and batch.