┌────────┐ Build & sign   ┌────────────┐ Digital Credentials ┌───────────┐  route   ┌────────────────┐
│Server  │──────────────▶│ Website    │────────────────────▶│ Browser   │──────────▶│      iOS       │
│backend │               │ frontend   │                     │ (Safari)  │          │  (System UI)   │
└────────┘               └────────────┘                     └───────────┘          ▼
                            Full request & consent                  ┌────────────────┐
                            release────────────────────────────────▶│ Document Source│
                                                                     └────────────────┘

// ① Generate HPKE keys + nonce
const { publicKey, privateKey } = hpke.generateKeyPair();
const nonce = crypto.randomBytes(16);

// ② Compose Device Request
const deviceRequest = {
  docType: "org.iso.18013.5.1.mDL",
  nameSpaces: {
    "org.iso.18013.5.1": {
      given_name: false,
      family_name: false,
      age_over_21: false,
      portrait: false,
      driving_privileges: false
    }
  },
  encryptionInfo: {
    recipientKey: publicKey,
    nonce
  }
};

// ③ Sign for Wallet & any other providers
const signedPayload = signWithABC(deviceRequest); // ABC = Apple Business Connect
// Optionally add more signatures for local apps and push into readerAuthenticationAll

return signedPayload;

// ④ Kick off the flow on click
async function verifyIdentity() {
  try {
    const requestData = await fetch("/build-mdoc-request").then(r => r.json());

    const credResponse = await navigator.credentials.get({
      mediation: "required",
      digital: {
        requests: [{ protocol: "org-iso-mdoc", data: requestData }]
      }
    });

    await fetch("/validate-mdoc", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify(credResponse)
    });
  } catch (e) {
    console.error("MDOC flow failed, falling back", e);
  }
}