[frdomovic]

What and why

Calimero core 1.0 removed /admin-api, /jsonrpc, relays, delegated execution and mero-auth. Clients now talk to attested cluster nodes over the sealed channel and sign in with passkeys. This PR moves the iOS app onto swift-sdk's 1.0 port. Android, the web app/ and logic/ are untouched.

• SDK pin: swift-sdk is pinned to 6c5f1167d1e586f556f59c326de5f51d034e80dd, the head of feat/calimero-1.0 (swift-sdk#85). The pin is set in project.yml and the Core Package.swift. The pin moves to the merge commit once swift-sdk#85 lands.
• Sign-in:
  • It uses a passkey on the cluster (MeroAppSession.signIn()), with "Create an account" for signUp(name:). The session lives in the Keychain and is refreshed at launch.
  • "Choose your cluster" / "Change" takes a node URL and a Development cluster switch, which sets allowMock for merod local. On such a node the app keeps a soft passkey and creates the account on first sign-in.
  • The cluster can also be set in project.yml with MeroNodeURL, MeroNodes and MeroAllowMock. The wallet, Cloud-manager and registry keys are gone.
• Approvals:
  • A "Needs your approval" section lists the pending node releases and app upgrades that are the account's to decide.
  • "Review" opens the node's consent page in the system browser (MeroAppSession.requestConsent), which returns to the app's ://consent URL.
  • The logic is ApprovalsModel in the Core package.
• Errors: the typed 1.0 errors read as words, including ReleaseDeadlineError, NotFound, LoginRequired, WrongNode, UnavailableError and AppError.
• Vocabulary: an arena lives in a Calimero organization (one link admits to every arena in it) and is an app instance there.
• Presence: the fighters' presence moves from the 0.x relay (RelayPresenceClient, removed) to the arena's 1.0 presence. CalimeroPresenceChannel publishes to POST /apps/{app}/presence and reads /apps/{app}/presence/stream. A fighter's JSON slice is far under the 4 KiB limit. SlicePublisher's newest-wins rule is unchanged.
• Game bridge: the page ↔ app protocol is unchanged.
• Invitations: the link payload is exactly swift-sdk's OrgInvitation, {invitation: "inv_…", namespaceId, contextId}. Joining redeems the token, and pre-1.0 links are refused (tested).
• Approvals show on the arenas list.
• Removed: the "no relay" empty state. KombatError.noRelay becomes .signedOut.
• Docs: the mobile README's iOS parts describe the pin and the 1.0 flow.

Verification

• swift test on the Core package (macOS): 33 tests pass, on InMemoryAppBackend.
• xcodegen generate, then xcodebuild build -destination 'generic/platform=iOS' CODE_SIGNING_ALLOWED=NO: BUILD SUCCEEDED, with no warnings in app sources.
• No simulator was used, and nothing ran against a live cluster or end to end.

Gaps

• Associated Domain: passkeys on a real cluster need the webcredentials:<rp-id> Associated Domain. The cluster's rp-id isn't known yet, so it isn't set. The README notes it.
• Android and web interop: the Android app still speaks 0.x, and so does the web app until mero-react is ported. Until then, invitation links minted on iOS don't open there, and the reverse.
• Fight latency on a live cluster is unmeasured: presence and action round trips haven't been measured against a real 1.0 cluster.

🤖 Generated with Claude Code