Wallet SDK — Integration Guide

Your App
    └─ WalletSdk (singleton)
          ├─ ProvisioningEngine  — OpenID4VCI credential issuance
          ├─ StorageEngine       — credential vault (StateFlow, delete)
          ├─ PresentationEngine  — QR/BLE, deep link, DC API
          └─ DocumentCaptureEngine — OCR / barcode extraction

// settings.gradle.kts or root build.gradle.kts
repositories {
    // CredenceID SDK — publicly readable, covers releases and snapshots
    maven("https://nexus.credenceid.com/repository/credenceid-sdk-group/")
    // Required only if you use the liveness module with Innovatrics provider
    maven("https://maven.innovatrics.com/releases")
}

// app/build.gradle.kts
dependencies {
    // Core Wallet SDK (includes document capture and MRTD reader transitively)
    implementation("com.credenceid:wallet-sdk:1.0.0-SNAPSHOT")

    // Optional — liveness capture module
    // Add this only if your app needs selfie or passive liveness capture.
    implementation("com.credenceid:wallet-sdk-liveness:1.0.0-SNAPSHOT")
}

// ❌ Wrong — @aar strips ALL transitive dependencies
implementation("com.credenceid:wallet-sdk:1.0.0-SNAPSHOT@aar")

// ❌ Wrong — -android-release is an internal variant; always use the root coordinate
implementation("com.credenceid:wallet-sdk-android-release:1.0.0-SNAPSHOT")

// ✅ Correct
implementation("com.credenceid:wallet-sdk:1.0.0-SNAPSHOT")

import com.credenceid.wallet.sdk.WalletSdk

// Obtain the singleton — safe to call from any thread, any time.
val sdk = WalletSdk.getInstance(apiKey = "your-api-key")

// Engines are lazily initialized on first access.
val provisioningEngine  = sdk.provisioningEngine
val storageEngine       = sdk.storageEngine
val presentationEngine  = sdk.presentationEngine
val documentCapture     = sdk.documentCaptureEngine

import com.credenceid.wallet.sdk.WalletSdk
import com.credenceid.wallet.sdk.domain.factory.provisioning.DigitalIdApplicationFactory
import com.credenceid.wallet.sdk.domain.model.provisioning.ProvisioningParameters

val sdk = WalletSdk.getInstance(apiKey = "your-api-key")

viewModelScope.launch {
    val params = ProvisioningParameters(
        issuerUrl              = "https://issuer.example.com/reviewcenter",
        credentialType         = "org.iso.18013.5.1.mDL",
        userAuthorizationToken = "pre-auth-token-from-your-backend",
        digitalIdApplication   = DigitalIdApplicationFactory.createSample(),
        // Replace createSample() with a real DigitalIDApplication built from
        // the applicant's captured document data and selfie.
    )

    sdk.provisioningEngine.submitProvisioningRequest(params)
        .onSuccess {
            // A PENDING DigitalCredential is now observable in storageEngine.storedCredentials.
            // Inform the user that their application is under review.
            showMessage("Application submitted — waiting for issuer approval.")
        }
        .onFailure { error ->
            showError("Submission failed: ${error.message}")
        }
}

// --- Deep link delivery ---
// Register your scheme in AndroidManifest.xml:
// <intent-filter>
//   <action android:name="android.intent.action.VIEW" />
//   <category android:name="android.intent.category.DEFAULT" />
//   <category android:name="android.intent.category.BROWSABLE" />
//   <data android:scheme="openid-credential-offer" />
// </intent-filter>
//
// Then handle the incoming intent in your Activity:
viewModelScope.launch {
    // Example URI (deep link or decoded from QR):
    // openid-credential-offer://?credential_offer_uri=https://issuer.example.com/offers/abc123
    val credentialOfferUri = intent.data?.toString() ?: return@launch

    sdk.provisioningEngine.fetchReadyCredential(
        credentialOfferUri = credentialOfferUri,
        timeoutMillis      = 30_000L, // Optional — default is 30 seconds
    )
    .onSuccess { credential ->
        // The credential is now VALID and observable in the storage engine.
        showSuccess("Credential ready: ${credential.displayMetadata["displayName"]}")
    }
    .onFailure { error ->
        when {
            error.message?.contains("TIMEOUT") == true ->
                showRetryDialog("The issuer did not respond in time. Try again?")
            else ->
                showError("Could not download credential: ${error.message}")
        }
    }
}

// --- QR code delivery ---
// After scanning a QR code with your chosen library:
fun onQrCodeScanned(rawValue: String) {
    if (rawValue.startsWith("openid-credential-offer://")) {
        viewModelScope.launch {
            sdk.provisioningEngine.fetchReadyCredential(rawValue)
                .onSuccess { credential -> showSuccess(credential) }
                .onFailure { error -> showError(error.message) }
        }
    }
}

class ProvisioningViewModel : ViewModel() {

    private val sdk = WalletSdk.getInstance(apiKey = "your-api-key")

    sealed interface UiState {
        object Idle : UiState
        object Submitting : UiState
        object AwaitingIssuer : UiState
        data class Ready(val credential: DigitalCredential) : UiState
        data class Error(val message: String) : UiState
    }

    private val _uiState = MutableStateFlow<UiState>(UiState.Idle)
    val uiState: StateFlow<UiState> = _uiState.asStateFlow()

    // Called when the user taps "Apply"
    fun submitApplication(params: ProvisioningParameters) {
        _uiState.value = UiState.Submitting
        viewModelScope.launch {
            sdk.provisioningEngine.submitProvisioningRequest(params)
                .onSuccess { _uiState.value = UiState.AwaitingIssuer }
                .onFailure { _uiState.value = UiState.Error(it.message ?: "Unknown error") }
        }
    }

    // Called when a deep link or QR code scan delivers the credential offer URI
    fun onCredentialOfferReceived(credentialOfferUri: String) {
        viewModelScope.launch {
            sdk.provisioningEngine.fetchReadyCredential(credentialOfferUri)
                .onSuccess { _uiState.value = UiState.Ready(it) }
                .onFailure { _uiState.value = UiState.Error(it.message ?: "Download failed") }
        }
    }
}

import kotlinx.coroutines.flow.collectLatest

// In a ViewModel:
viewModelScope.launch {
    sdk.storageEngine.storedCredentials.collectLatest { credentials ->
        // Emitted immediately with the current list, then again on every change.
        // credentials: List<DigitalCredential>
        _credentialList.value = credentials
    }
}

@Composable
fun CredentialList(viewModel: WalletViewModel) {
    val credentials by viewModel.credentials.collectAsStateWithLifecycle()

    LazyColumn {
        items(credentials) { credential ->
            CredentialCard(
                name   = credential.displayMetadata["displayName"] ?: credential.type,
                status = credential.provisioningStatus.name,
                // Show a visual indicator for PENDING credentials
                isPending = credential.provisioningStatus == ProvisioningStatus.PENDING,
            )
        }
    }
}

fun deleteCredential(credentialId: String) {
    viewModelScope.launch {
        sdk.storageEngine.deleteCredential(credentialId)
            .onSuccess {
                // storedCredentials flow automatically emits the updated list.
                showToast("Credential deleted.")
            }
            .onFailure { error ->
                showError("Could not delete credential: ${error.message}")
            }
    }
}

Idle
  └─> EngagementReady   (QR code ready — in-person only)
        └─> Connecting  (verifier is connecting)
              └─> RequestReceived  (verifier sent a request — show consent UI)
                    └─> ConsentGiven  (user approved — signing in progress)
                          ├─> Success        (credential delivered)
                          └─> Error          (something went wrong)

import com.credenceid.wallet.sdk.domain.model.presentation.PresentationState

viewModelScope.launch {
    sdk.presentationEngine
        .startInPersonPresentation()
        .collectLatest { state ->
            when (state) {
                is PresentationState.Idle -> {
                    // Initial state — no action needed.
                }

                is PresentationState.EngagementReady -> {
                    // Display the QR code for the verifier to scan.
                    // state.qrCodePayload is the raw string; encode it as a QR image.
                    showQrCode(payload = state.qrCodePayload)
                }

                is PresentationState.Connecting -> {
                    // Verifier scanned the QR code — hide the QR and show a spinner.
                    showConnectingSpinner()
                }

                is PresentationState.RequestReceived -> {
                    // Verifier sent a credential request. Display the consent screen.
                    showConsentScreen(
                        verifier = state.verifierIdentity,
                        claims   = state.requestedClaims,
                    )
                    // The user will call approveRequest() or rejectRequest() from the consent UI.
                }

                is PresentationState.Success -> {
                    showMessage("Credential shared successfully.")
                    navigateBack()
                }

                is PresentationState.Error -> {
                    val err = state.error
                    if (err.isRecoverable) {
                        showRetryDialog(err.code.name)
                    } else {
                        showError("Presentation failed: ${err.code.name}")
                    }
                }
            }
        }
}

// Called when the user taps "Share" on the consent screen
fun onUserApproved(selectedClaims: List<String>, biometricToken: ByteArray) {
    viewModelScope.launch {
        sdk.presentationEngine
            .approveRequest(claims = selectedClaims, biometricToken = biometricToken)
            .onFailure { showError("Could not sign response: ${it.message}") }
    }
}

// Called when the user taps "Decline"
fun onUserDeclined() {
    viewModelScope.launch {
        sdk.presentationEngine.rejectRequest()
    }
}

// In your Activity — handle incoming deep links:
override fun onNewIntent(intent: Intent) {
    super.onNewIntent(intent)
    val url = intent.data?.toString() ?: return

    viewModelScope.launch {
        sdk.presentationEngine
            .startOnlinePresentation(requestUrl = url)
            .collectLatest { state ->
                // Handle states identically to the in-person flow.
                // The EngagementReady state is skipped (no QR needed for online flows).
                handlePresentationState(state)
            }
    }
}

private fun handlePresentationState(state: PresentationState) {
    when (state) {
        is PresentationState.Connecting      -> showLoadingIndicator()
        is PresentationState.RequestReceived -> showConsentScreen(state.verifierIdentity, state.requestedClaims)
        is PresentationState.Success         -> showSuccess()
        is PresentationState.Error           -> showError(state.error.code.name)
        else -> { /* Idle / EngagementReady not expected in online flow */ }
    }
}

// Observe in your Application or a long-lived ViewModel:
viewModelScope.launch {
    sdk.presentationEngine.activeSession.collect { session ->
        if (session != null) {
            // A verifier request is pending. Show your consent UI.
            showConsentDialog(
                claims   = session.requestedClaims,
                verifier = session.verifierIdentity,
                onApprove = { lifecycleScope.launch { session.approve() } },
                onReject  = { lifecycleScope.launch { session.reject() } },
            )
        }
    }
}

data class ClaimRequest(
    val namespace: String,       // e.g. "org.iso.18013.5.1"
    val claimName: String,       // e.g. "family_name", "portrait", "age_over_18"
    val intentToRetain: Boolean  // true = verifier intends to store this data
)

data class VerifierInfo(
    val commonName: String,
    val organization: String?,
    val isCertificateValid: Boolean,
    val trustLevel: TrustLevel // TRUSTED, UNKNOWN, WARNING
)

@Composable
fun ConsentScreen(
    claims: List<ClaimRequest>,
    verifier: VerifierInfo?,
    onApprove: () -> Unit,
    onReject: () -> Unit,
) {
    Column(modifier = Modifier.padding(16.dp)) {

        // Verifier identity
        verifier?.let {
            TrustLevelBadge(level = it.trustLevel)
            Text("${it.commonName} is requesting access to:")
        }

        // Requested claims
        claims.forEach { claim ->
            Row {
                Text("• ${claim.claimName}")
                if (claim.intentToRetain) {
                    Text(
                        text = " (will be stored)",
                        color = MaterialTheme.colorScheme.error,
                        style = MaterialTheme.typography.labelSmall,
                    )
                }
            }
        }

        // Action buttons
        Row {
            Button(onClick = onApprove) { Text("Share") }
            OutlinedButton(onClick = onReject) { Text("Decline") }
        }
    }
}

@Composable
fun TrustLevelBadge(level: TrustLevel) {
    val (color, label) = when (level) {
        TrustLevel.TRUSTED  -> Color(0xFF2E7D32) to "Verified"
        TrustLevel.UNKNOWN  -> Color(0xFFF57F17) to "Unverified"
        TrustLevel.WARNING  -> Color(0xFFC62828) to "Warning — Certificate Issue"
    }
    Text(text = label, color = color, fontWeight = FontWeight.Bold)
}

Idle → CapturingFront → [CapturingBack] → Analyzing → Success
                                                     └─ Error

import com.credenceid.wallet.sdk.domain.model.documentcapture.*

val engine = sdk.documentCaptureEngine

// Step 1 — collect state changes to drive the UI.
viewModelScope.launch {
    engine.captureState.collectLatest { state ->
        when (state) {
            is DocumentCaptureState.Idle          -> showIdle()
            is DocumentCaptureState.CapturingFront -> showGuidance("Place the front of your ID in the frame")
            is DocumentCaptureState.CapturingBack  -> showGuidance("Now flip your ID over")
            is DocumentCaptureState.Analyzing      -> showSpinner("Reading document data…")

            is DocumentCaptureState.Success -> {
                val doc = state.document

                // Full-resolution JPEG images — send to your DocAuth / verification service.
                uploadToVerificationService(
                    front = doc.frontImageBytes,
                    back  = doc.backImageBytes,
                )

                // Parsed MRZ data (TD1) for pre-filling the provisioning form.
                when (val data = doc.extractedData) {
                    is DocumentExtractedData.Mrz -> {
                        autofillForm(
                            givenNames     = data.givenNames,
                            surname        = data.surname,
                            documentNumber = data.documentNumber,
                            dateOfBirth    = data.dateOfBirth,    // YYMMDD
                            dateOfExpiry   = data.dateOfExpiry,   // YYMMDD
                            nationality    = data.nationality,    // ISO 3166-1 alpha-3
                        )
                    }
                    null -> { /* extraction not applicable for this document */ }
                    else -> { /* unexpected type — handle gracefully */ }
                }
            }

            is DocumentCaptureState.Error -> {
                when (state.error.code) {
                    DocumentCaptureErrorCode.PERMISSION_DENIED  -> requestCameraPermission()
                    DocumentCaptureErrorCode.GLARE_DETECTED     -> showHint("Move away from direct light and try again")
                    DocumentCaptureErrorCode.EDGE_NOT_DETECTED  -> showHint("Keep the entire card within the frame")
                    DocumentCaptureErrorCode.CAPTURE_TIMEOUT    -> showRetryDialog()
                    DocumentCaptureErrorCode.LOW_QUALITY        -> showRetryDialog("Image quality too low. Try again in better light.")
                    else -> showError(state.error.technicalMessage)
                }
            }
        }
    }
}

// Step 2 — start the capture session.
// platformContext must be a FragmentActivity instance on Android.
engine.startCapture(
    platformContext = requireActivity(), // must be FragmentActivity
    parameters = DocumentCaptureParameters(
        documentType = CaptureDocumentType.ID_CARD,
        sides        = setOf(DocumentSide.FRONT, DocumentSide.BACK),
    ),
)

engine.startCapture(
    platformContext = requireActivity(),
    parameters = DocumentCaptureParameters(
        documentType = CaptureDocumentType.PASSPORT,
        sides        = setOf(DocumentSide.BIO_PAGE),
    ),
)

// In DocumentCaptureState.Success:
// doc.backImageBytes == null
// doc.extractedData  == DocumentExtractedData.Mrz (TD3 format)
//   mrz.rawLines contains the original 2 OCR lines for downstream DocAuth services.

engine.startCapture(
    platformContext = requireActivity(),
    parameters = DocumentCaptureParameters(
        documentType = CaptureDocumentType.DRIVING_LICENSE,
        sides        = setOf(DocumentSide.FRONT, DocumentSide.BACK),
    ),
)

// In DocumentCaptureState.Success:
// doc.extractedData == DocumentExtractedData.Pdf417
//   pdf417.rawData  == the complete AAMVA barcode string payload

// Safe to call at any time — resets captureState to Idle.
engine.cancelCapture()

let engine = walletSdk.documentCaptureEngine

Task {
    for await state in engine.captureState {
        switch state {
        case is DocumentCaptureStateIdle:
            showIdle()
        case is DocumentCaptureStateCapturingFront:
            showGuidance("Place the front of your ID in the frame")
        case is DocumentCaptureStateCapturingBack:
            showGuidance("Now flip your ID over")
        case is DocumentCaptureStateAnalyzing:
            showSpinner()
        case let success as DocumentCaptureStateSuccess:
            handleDocument(success.document)
        case let error as DocumentCaptureStateError:
            handleError(error.error.code.name)
        default:
            break
        }
    }
}

// Start capture
engine.startCapture(
    platformContext: nil, // iOS — pass nil; context is resolved internally
    parameters: DocumentCaptureParameters(
        documentType: .idCard,
        sides: [.front, .back]
    )
)

Idle → WaitingForChip → Authenticating → Reading → Success
                                                  └─ Error

// Requires: MRZ data extracted from the document (e.g. via DocumentCaptureEngine first)
val mrtdEngine = sdk.mrtdReaderEngine

viewModelScope.launch {
    mrtdEngine.readState.collectLatest { state ->
        when (state) {
            is MrtdReadState.Idle            -> showIdle()
            is MrtdReadState.WaitingForChip  -> showNfcPrompt("Hold your phone to the passport chip")
            is MrtdReadState.Authenticating  -> showSpinner("Authenticating…")
            is MrtdReadState.Reading         -> showSpinner("Reading chip data…")

            is MrtdReadState.Success -> {
                val result = state.result
                // Structured MRZ fields
                val name = "${result.dg1Data.givenNames} ${result.dg1Data.surname}"
                // Raw face biometric image (JPEG) — pass to your server for matching
                uploadFaceImage(result.dg2FaceImage)
            }

            is MrtdReadState.Error -> showError(state.error.technicalMessage)
        }
    }
}

// Start reading — pass MRZ fields extracted from the passport scan
mrtdEngine.startReading(
    platformContext = requireActivity(),
    parameters = MrtdReadParameters(
        documentNumber = mrz.documentNumber,   // from DocumentExtractedData.Mrz
        dateOfBirth    = mrz.dateOfBirth,      // YYMMDD format
        dateOfExpiry   = mrz.dateOfExpiry,     // YYMMDD format
    ),
)

// Cancel if the user navigates away
mrtdEngine.cancelReading()

implementation("com.credenceid:wallet-sdk-liveness:1.0.0-SNAPSHOT")

class MyActivity : FragmentActivity() {

    // Declare as a property — created in onCreate before onStart.
    private lateinit var livenessEngine: StandardCameraEngine

    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)
        livenessEngine = StandardCameraEngine(this) // ← must be before setContent / onStart
        setContent { MyApp(engine = livenessEngine) }
    }
}

// In a ViewModel or composable — trigger capture when the user reaches the selfie step:
viewModelScope.launch {
    runCatching { livenessEngine.capture() }
        .onSuccess { result ->
            val jpeg = (result as LivenessCaptureResult.Standard).jpegBytes
            // Send the JPEG to your backend for server-side liveness scoring.
            uploadSelfie(jpeg)
        }
        .onFailure { error ->
            // CaptureException is thrown if the user cancels or a hardware error occurs.
            showError("Capture failed: ${error.message}")
        }
}

import com.credenceid.wallet.sdk.security.*

class MyApplication : Application() {

    override fun onCreate() {
        super.onCreate()

        val config = RaspConfig.Builder()
            .enableRootDetection()
            .enableEmulatorDetection()
            .enableHookingDetection()
            // enforceBlock = false makes debugger detection observe-only in CI/debug builds:
            .enableDebuggerDetection(enforceBlock = BuildConfig.DEBUG.not())
            .enableOverlayDetection()
            .enableSecureWindowFlag() // Applies FLAG_SECURE to every Activity automatically
            .build()

        // RaspPlatformContext wraps applicationContext — do not pass `this` directly.
        RaspMonitor.initialize(RaspPlatformContext(applicationContext), config)
        RaspMonitor.start()
    }
}

let config = RaspConfigBuilder()
    .enableRootDetection()
    .enableEmulatorDetection()
    .enableHookingDetection()
    .enableDebuggerDetection()
    .enableOverlayDetection()
    .build()

RaspMonitor.shared.initialize(context: RaspPlatformContext(), config: config)
RaspMonitor.shared.start()

lifecycleScope.launch {
    RaspMonitor.violations.collect { violation ->
        // Log the threat internally — never expose raw codes or details to end-users.
        logger.warn("RASP violation: ${violation.threat.code}")

        when (violation.threat) {
            is RaspThreat.RootedDevice            -> blockSdkOperations()
            is RaspThreat.HookingFrameworkDetected -> blockSdkOperations()
            is RaspThreat.EmulatorDetected         -> blockSdkOperations()
            is RaspThreat.OverlayDetected          -> showOverlayWarningDialog()
            is RaspThreat.DebuggerAttached         -> logAndMonitor()
        }
    }
}

fun onPresentCredentialClicked() {
    if (!RaspMonitor.runImmediateCheck()) {
        // A blocking threat is active — abort the operation.
        showSecurityError("This operation is not available on this device.")
        return
    }
    // Safe to proceed.
    startPresentation()
}

// In Application.onTerminate() or your ViewModel's onCleared():
RaspMonitor.stop()

import com.credenceid.wallet.sdk.SdkLogger
import com.credenceid.wallet.sdk.logging.LogLevel

class MyApplication : Application() {

    override fun onCreate() {
        super.onCreate()

        SdkLogger.Builder()
            .setDiagnosticLogSink { json ->
                // Route to Logcat in debug builds — do not use in production.
                if (BuildConfig.DEBUG) Log.d("WalletSDK", json)
            }
            .setAuditLogSink { json ->
                // MANDATORY in production — route to an append-only, tamper-evident store.
                // Examples: write-once Room table, signed log stream, SIEM endpoint.
                myAuditRepository.persist(json)
            }
            .setMinDiagnosticLevel(
                if (BuildConfig.DEBUG) LogLevel.DEBUG else LogLevel.WARN
            )
            .setSdkVersion(BuildConfig.WALLET_SDK_VERSION)
            .build()
    }
}

SdkLoggerBuilder()
    .setDiagnosticLogSink { json in
        os_log("%{public}@", log: .default, type: .debug, json)
    }
    .setAuditLogSink { json in
        SecureAuditStore.shared.append(json)
    }
    .setMinDiagnosticLevel(.info)
    .build()

// Wrap immediately when received:
val accessToken: Redacted<String> = oauthResponse.token.redact()

// Safe to log — always outputs "***REDACTED***", never the actual value:
DiagnosticLogger.d("OidcClient") { "Token acquired: $accessToken" }

// Unwrap only at the single call site that requires the raw value:
httpClient.setBearer(accessToken.unwrap())
// Every unwrap() site must be code-reviewed and justified in a comment.

// Pattern 1 — onSuccess / onFailure callbacks (recommended for simple cases)
sdk.provisioningEngine.fetchReadyCredential(uri)
    .onSuccess { credential -> updateUi(credential) }
    .onFailure { error -> showError(error.message) }

// Pattern 2 — fold() for exhaustive handling
val result = sdk.storageEngine.deleteCredential(id)
result.fold(
    onSuccess = { showToast("Deleted.") },
    onFailure = { showError("Failed: ${it.message}") },
)

// Pattern 3 — structured error handling by type
sdk.provisioningEngine.fetchReadyCredential(uri)
    .onFailure { throwable ->
        when (throwable) {
            is ProvisioningError -> when (throwable.code) {
                ProvisioningErrorCode.TIMEOUT       -> retryLater() // isRecoverable = true
                ProvisioningErrorCode.NETWORK_ERROR -> showNetworkError()
                ProvisioningErrorCode.INVALID_OFFER -> showError("Invalid credential offer")
                else                                -> logAndReport(throwable)
            }
            is CancellationException -> throw throwable // always re-throw coroutine cancellation
            else                     -> logAndReport(throwable)
        }
    }

is PresentationState.Error -> {
    val err = state.error
    if (err.isRecoverable) {
        // Offer the user a retry without restarting the full presentation flow.
        showRetryButton()
    } else {
        // Unrecoverable — close the session and return to the credential list.
        showError("${err.code.name}: ${err.technicalMessage}")
        navigateBack()
    }
}

┌─────────────────────────────────────────────────────────────┐
│  Your Application                                           │
│  ViewModels, Composables, Activities, Fragments             │
├─────────────────────────────────────────────────────────────┤
│  Engine Interfaces (Domain Layer — commonMain)              │
│  ProvisioningEngine · StorageEngine · PresentationEngine    │
│  DocumentCaptureEngine · MrtdReaderEngine                   │
│                                                             │
│  Domain Models (pure Kotlin — no framework imports)         │
│  DigitalCredential · PresentationState · ClaimRequest …     │
├─────────────────────────────────────────────────────────────┤
│  Engine Implementations (Data Layer)                        │
│  androidMain: WalletSdkImpl, WalletPresentmentActivity …    │
│  iosMain:     PassportChipReaderProvider …                  │
├─────────────────────────────────────────────────────────────┤
│  Platform                                                   │
│  Android KeyStore · iOS Secure Enclave · NFC · BLE          │
└─────────────────────────────────────────────────────────────┘

# Install the Android sample app
./gradlew :walletsdksample:installDebug

# Run all unit tests with coverage
./gradlew test

# Generate an HTML coverage report
./gradlew koverHtmlReport

import io.mockk.*
import com.credenceid.wallet.sdk.domain.engine.StorageEngine
import com.credenceid.wallet.sdk.domain.model.DigitalCredential
import kotlinx.coroutines.flow.MutableStateFlow
import kotlinx.coroutines.test.runTest
import org.amshove.kluent.shouldBeEqualTo

class WalletViewModelTest {

    private val mockStorage = mockk<StorageEngine>()
    private val credentialFlow = MutableStateFlow<List<DigitalCredential>>(emptyList())

    @BeforeEach
    fun setUp() {
        every { mockStorage.storedCredentials } returns credentialFlow
    }

    @Test
    fun `credential list updates when new credential is added`() = runTest {
        // Arrange
        val credential = DigitalCredential(
            id                 = "test-id",
            type               = "org.iso.18013.5.1.mDL",
            provisioningStatus = ProvisioningStatus.VALID,
            displayMetadata    = mapOf("displayName" to "My Driver's License"),
        )

        // Act
        credentialFlow.emit(listOf(credential))

        // Assert
        mockStorage.storedCredentials.value.size shouldBeEqualTo 1
        mockStorage.storedCredentials.value.first().id shouldBeEqualTo "test-id"
    }
}

val config = RaspConfig.Builder()
    .enableRootDetection()
    .enableEmulatorDetection(enforceBlock = false) // observe-only in CI
    .enableHookingDetection()
    .enableDebuggerDetection(enforceBlock = false) // observe-only in CI
    .build()

// ✅ Correct
implementation("com.credenceid:wallet-sdk:1.0.0-SNAPSHOT")