Credential filter chain with DCQL and default selector

[stevenvegt]

Parent PRD

#4067 (see PRD comment)

What to build

Implement a DCQL-based CredentialSelector (as defined in #4088) that uses DCQL credential queries to select the right credential when multiple match a PD input descriptor. This replaces the previously proposed separate "filter chain" layer — the selection logic now lives inside the PD matcher via the CredentialSelector extension point.

When credential_query entries are provided:

1. For each input descriptor, check if a credential_query entry with a matching id exists
2. If yes: filter the candidates using the DCQL parser (DCQL credential query parser with claims/values matching #4087)
3. If no: fall back to the default selector (first match, from Refactor PD matching to return all candidates per input descriptor #4088)

The DCQL selector is a CredentialSelector implementation that:

• Takes the credential_query array as configuration
• For a given input descriptor + candidates, finds the matching credential_query by ID
• Calls dcql.Match(query, candidates) to filter
• Errors on zero matches with a descriptive message
• Errors on multiple matches with a descriptive message (the EHR must write a query specific enough to match exactly one credential — see decision comment)

The selector is wired into the presenter/wallet's buildSubmission flow, passed through to PresentationDefinition.Match.

See updated approach comment for design rationale.

Acceptance criteria

• DCQL CredentialSelector implementation that uses dcql.Match to filter candidates
• credential_query entries matched to input descriptors by id
• Zero DCQL matches produces a descriptive error
• Multiple DCQL matches produces a descriptive error
• Input descriptors without a matching credential_query fall through to the default selector
• Selector is wired into BuildSubmission / presenter layer
• credential_query is accepted as a parameter in the wallet/presenter
• End-to-end test: given wallet with multiple VCs of same type + credential_query, correct VC is selected
• End-to-end test: no credential_query = current behavior (backward compatible)

Blocked by

• Blocked by DCQL credential query parser with claims/values matching #4087 (DCQL parser)
• Blocked by Refactor PD matching to return all candidates per input descriptor #4088 (CredentialSelector extension point in PD matcher)

User stories addressed

• User story 1: specify which patient's credential to present
• User story 2: specify which organization type credential to present
• User story 3: only provide credential_query for ambiguous types
• User story 4: clear error on zero matches
• User story 5: clear error on ambiguous matches
• User story 9: credential_query ID maps to PD input descriptor ID
• User story 12: backward compatible for unqueried descriptors

[stevenvegt]

Superseded by #4120 (Selection CredentialSelector with named parameters). See updated PRD in #4067 (comment). Code on branch feature/4089-dcql-selector is reusable for the new selector's factory pattern and test structure.