extract

Locates the protocol request Credential Manager's selection belongs to and derives the origin from authenticated caller data. A populated privileged origin is rejected unless the caller package and signing certificate match privilegedAppsJson.

A selected credential set is mandatory: continuing without one would produce an empty selectedRegistryEntryIds, which MobileWallet.previewDigitalCredentialPresentation reads as "match the whole wallet".