feat(WAL-752): add native mobile Digital Credentials API presentation

[szijpeter]

Summary

Adds production-shaped Digital Credentials API presentation support across the KMP mobile wallet SDK, Android Credential Manager, and iOS 26 IdentityDocumentServices.

What changed

• Adds OpenID4VP 1.0 Appendix A handling for unsigned and signed requests, with verified-origin binding, request-object verification, DCQL matching, explicit consent previews, and unencrypted or JWE-protected responses.
• Adds ISO/IEC 18013-7 Annex C handling with parsed/raw request consistency checks, reader authentication and trust evaluation, exact mdoc disclosure, DeviceResponse construction, and HPKE response protection.
• Keeps platform registries synchronized with minimal matcher metadata after wallet bootstrap, receipt, and deletion while retaining raw credentials and key material inside the wallet.
• Integrates Android Credential Manager registration and provider handling, including caller allowlisting, native origin propagation, cancellation/error mapping, and a consent UI in the Compose demo.
• Adds an iOS 26 IdentityDocumentServices provider extension, registration coordinator, App Group database migration, shared keychain configuration, and extension-accessible Secure Enclave key provisioning.
• Exposes capability and presentation APIs through the KMP and Swift SDK surfaces.
• Fixes verifier-side Annex C reader-authentication payload construction to sign the exact tagged ISO structures consumed by wallets.

Platform support

Platform	Supported paths
Android Credential Manager	openid4vp-v1-unsigned and openid4vp-v1-signed for mdoc and SD-JWT VC with clear/JWE responses; org-iso-mdoc with HPKE
iOS/iPadOS 26 IdentityDocumentServices	org-iso-mdoc for mdoc with reader authentication and HPKE
Explicitly unavailable	openid4vp-v1-multisigned fails closed until JWS JSON Serialization verification is available; Apple does not expose OpenID4VP to third-party identity-document providers

Dependency and caveats

• This PR is stacked on Feature/wal 896 #1885 and targets its feature/wal-896 branch.
• Apple system-sheet completion still requires a production-entitled physical iOS 26 device. The iOS 26.5 simulator reports registration as notSupported even when the App Group registry contains an eligible mdoc.
• The currently deployed public verifier's signed Annex C example signs non-standard empty payloads. This branch fixes the generator and covers the corrected payloads; deployed unsigned Annex C and OpenID4VP examples interoperate with the Android wallet.

Breaking changes

None. The mobile SDK ABI is extended with the new capability, registry, preview, and submission APIs.

[linear-code]

WAL-752

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f193ecf4-ca47-4b4e-b1a6-65db4a8d8bdd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud