Adopt root-level tsswift app layout

Move the app payload under swift/ while keeping git, package.json, and .smartconfig.json at the repo root. This standardizes the Swift app setup so build, test, run, and watch workflows match the other repos.

swift/Sources/Core/Services/MockIDPService.swift

@@ -0,0 +1,290 @@
+import Foundation
+
+protocol IDPServicing {
+    func bootstrap() async throws -> BootstrapContext
+    func signIn(with request: PairingAuthenticationRequest) async throws -> SignInResult
+    func identify(with request: PairingAuthenticationRequest) async throws -> DashboardSnapshot
+    func refreshDashboard() async throws -> DashboardSnapshot
+    func approveRequest(id: UUID) async throws -> DashboardSnapshot
+    func rejectRequest(id: UUID) async throws -> DashboardSnapshot
+    func simulateIncomingRequest() async throws -> DashboardSnapshot
+    func markNotificationRead(id: UUID) async throws -> DashboardSnapshot
+}
+
+actor MockIDPService: IDPServicing {
+    private let profile = MemberProfile(
+        name: "Phil Kunz",
+        handle: "phil@idp.global",
+        organization: "idp.global",
+        deviceCount: 4,
+        recoverySummary: "Recovery kit healthy with 2 of 3 backup paths verified."
+    )
+
+    private var requests: [ApprovalRequest] = []
+    private var notifications: [AppNotification] = []
+
+    init() {
+        requests = Self.seedRequests()
+        notifications = Self.seedNotifications()
+    }
+
+    func bootstrap() async throws -> BootstrapContext {
+        try await Task.sleep(for: .milliseconds(120))
+        return BootstrapContext(
+            suggestedPairingPayload: "idp.global://pair?token=swiftapp-demo-berlin&origin=code.foss.global&device=Safari%20on%20Berlin%20MBP"
+        )
+    }
+
+    func signIn(with request: PairingAuthenticationRequest) async throws -> SignInResult {
+        try await Task.sleep(for: .milliseconds(260))
+
+        try validateSignedGPSPosition(in: request)
+        let session = try parseSession(from: request)
+        notifications.insert(
+            AppNotification(
+                title: "Passport activated",
+                message: pairingMessage(for: session),
+                sentAt: .now,
+                kind: .security,
+                isUnread: true
+            ),
+            at: 0
+        )
+
+        return SignInResult(
+            session: session,
+            snapshot: snapshot()
+        )
+    }
+
+    func identify(with request: PairingAuthenticationRequest) async throws -> DashboardSnapshot {
+        try await Task.sleep(for: .milliseconds(180))
+
+        try validateSignedGPSPosition(in: request)
+        let context = try PairingPayloadParser.parse(request.pairingPayload)
+        notifications.insert(
+            AppNotification(
+                title: "Identity proof completed",
+                message: identificationMessage(for: context, signedGPSPosition: request.signedGPSPosition),
+                sentAt: .now,
+                kind: .security,
+                isUnread: true
+            ),
+            at: 0
+        )
+
+        return snapshot()
+    }
+
+    func refreshDashboard() async throws -> DashboardSnapshot {
+        try await Task.sleep(for: .milliseconds(180))
+        return snapshot()
+    }
+
+    func approveRequest(id: UUID) async throws -> DashboardSnapshot {
+        try await Task.sleep(for: .milliseconds(150))
+
+        guard let index = requests.firstIndex(where: { $0.id == id }) else {
+            throw AppError.requestNotFound
+        }
+
+        requests[index].status = .approved
+        notifications.insert(
+            AppNotification(
+                title: "Identity verified",
+                message: "\(requests[index].title) was completed for \(requests[index].source).",
+                sentAt: .now,
+                kind: .approval,
+                isUnread: true
+            ),
+            at: 0
+        )
+
+        return snapshot()
+    }
+
+    func rejectRequest(id: UUID) async throws -> DashboardSnapshot {
+        try await Task.sleep(for: .milliseconds(150))
+
+        guard let index = requests.firstIndex(where: { $0.id == id }) else {
+            throw AppError.requestNotFound
+        }
+
+        requests[index].status = .rejected
+        notifications.insert(
+            AppNotification(
+                title: "Identity proof declined",
+                message: "\(requests[index].title) was declined before the session could continue.",
+                sentAt: .now,
+                kind: .security,
+                isUnread: true
+            ),
+            at: 0
+        )
+
+        return snapshot()
+    }
+
+    func simulateIncomingRequest() async throws -> DashboardSnapshot {
+        try await Task.sleep(for: .milliseconds(120))
+
+        let syntheticRequest = ApprovalRequest(
+            title: "Prove identity for web sign-in",
+            subtitle: "A browser session is asking this passport to prove that it is really you.",
+            source: "auth.idp.global",
+            createdAt: .now,
+            kind: .signIn,
+            risk: .routine,
+            scopes: ["proof:basic", "client:web", "method:qr"],
+            status: .pending
+        )
+
+        requests.insert(syntheticRequest, at: 0)
+        notifications.insert(
+            AppNotification(
+                title: "Fresh identity proof request",
+                message: "A new relying party is waiting for your identity proof.",
+                sentAt: .now,
+                kind: .approval,
+                isUnread: true
+            ),
+            at: 0
+        )
+
+        return snapshot()
+    }
+
+    func markNotificationRead(id: UUID) async throws -> DashboardSnapshot {
+        try await Task.sleep(for: .milliseconds(80))
+
+        guard let index = notifications.firstIndex(where: { $0.id == id }) else {
+            return snapshot()
+        }
+
+        notifications[index].isUnread = false
+        return snapshot()
+    }
+
+    private func snapshot() -> DashboardSnapshot {
+        DashboardSnapshot(
+            profile: profile,
+            requests: requests,
+            notifications: notifications
+        )
+    }
+
+    private func validateSignedGPSPosition(in request: PairingAuthenticationRequest) throws {
+        if request.transport == .nfc,
+           request.signedGPSPosition == nil {
+            throw AppError.missingSignedGPSPosition
+        }
+
+        if let signedGPSPosition = request.signedGPSPosition,
+           !signedGPSPosition.verified(for: request.pairingPayload) {
+            throw AppError.invalidSignedGPSPosition
+        }
+    }
+
+    private func parseSession(from request: PairingAuthenticationRequest) throws -> AuthSession {
+        let context = try PairingPayloadParser.parse(request.pairingPayload)
+
+        return AuthSession(
+            deviceName: context.deviceName,
+            originHost: context.originHost,
+            pairedAt: .now,
+            tokenPreview: context.tokenPreview,
+            pairingCode: request.pairingPayload,
+            pairingTransport: request.transport,
+            signedGPSPosition: request.signedGPSPosition
+        )
+    }
+
+    private func pairingMessage(for session: AuthSession) -> String {
+        let transportSummary: String
+        switch session.pairingTransport {
+        case .qr:
+            transportSummary = "activated via QR"
+        case .nfc:
+            transportSummary = "activated via NFC with a signed GPS position"
+        case .manual:
+            transportSummary = "activated via manual payload"
+        case .preview:
+            transportSummary = "activated via preview payload"
+        }
+
+        if let signedGPSPosition = session.signedGPSPosition {
+            return "\(session.deviceName) is now acting as a passport, \(transportSummary) against \(session.originHost) from \(signedGPSPosition.coordinateSummary) \(signedGPSPosition.accuracySummary)."
+        }
+
+        return "\(session.deviceName) is now acting as a passport, \(transportSummary) against \(session.originHost)."
+    }
+
+    private func identificationMessage(for context: PairingPayloadContext, signedGPSPosition: SignedGPSPosition?) -> String {
+        if let signedGPSPosition {
+            return "A signed GPS proof was sent for \(context.deviceName) on \(context.originHost) from \(signedGPSPosition.coordinateSummary) \(signedGPSPosition.accuracySummary)."
+        }
+
+        return "An identity proof was completed for \(context.deviceName) on \(context.originHost)."
+    }
+
+    private static func seedRequests() -> [ApprovalRequest] {
+        [
+            ApprovalRequest(
+                title: "Prove identity for Safari sign-in",
+                subtitle: "The portal wants this passport to prove that the browser session is really you.",
+                source: "code.foss.global",
+                createdAt: .now.addingTimeInterval(-60 * 12),
+                kind: .signIn,
+                risk: .routine,
+                scopes: ["proof:basic", "client:web", "origin:trusted"],
+                status: .pending
+            ),
+            ApprovalRequest(
+                title: "Prove identity for workstation unlock",
+                subtitle: "Your secure workspace is asking for a stronger proof before it unlocks.",
+                source: "berlin-mbp.idp.global",
+                createdAt: .now.addingTimeInterval(-60 * 42),
+                kind: .elevatedAction,
+                risk: .elevated,
+                scopes: ["proof:high", "client:desktop", "presence:required"],
+                status: .pending
+            ),
+            ApprovalRequest(
+                title: "Prove identity for CLI session",
+                subtitle: "The CLI session asked for proof earlier and was completed from this passport.",
+                source: "cli.idp.global",
+                createdAt: .now.addingTimeInterval(-60 * 180),
+                kind: .signIn,
+                risk: .routine,
+                scopes: ["proof:basic", "client:cli"],
+                status: .approved
+            )
+        ]
+    }
+
+    private static func seedNotifications() -> [AppNotification] {
+        [
+            AppNotification(
+                title: "Two identity checks are waiting",
+                message: "One routine web proof and one stronger workstation proof are waiting for this passport.",
+                sentAt: .now.addingTimeInterval(-60 * 8),
+                kind: .approval,
+                isUnread: true
+            ),
+            AppNotification(
+                title: "Recovery health check passed",
+                message: "Backup recovery channels were verified in the last 24 hours.",
+                sentAt: .now.addingTimeInterval(-60 * 95),
+                kind: .system,
+                isUnread: false
+            ),
+            AppNotification(
+                title: "Passport quiet hours active",
+                message: "Routine identity checks will be delivered silently until the morning.",
+                sentAt: .now.addingTimeInterval(-60 * 220),
+                kind: .security,
+                isUnread: false
+            )
+        ]
+    }
+}