iOS SDK for offline QR scanning and ticket validation with crypto signature and logging (Swift, iOS 15+)

Initial situation: we have an iOS application for controlling access to events. Currently, tickets are checked through a server, which is why there is a queue at venues with poor internet. We need to create an internal iOS SDK module that will allow us to validate tickets completely offline and synchronize the results later.

Technical environment and subject area: iOS 15+, Swift 5.9+, Xcode 15+, SPM. Scanning - AVFoundation. Storage - CoreData or SQLite (we'll discuss it, but we need to work offline and be resistant to crashes). Cryptography - CryptoKit. The ticket format is QR, inside the base64url payload in the form of JSON. Validation - Ed25519 signature verification and rules verification (event, date, zone, reuse).

What should be the result: 1) Swift Package (SPM) with a public API that can be connected to our application. 2) Integration example (small demo target or sample app inside the repository) just to show API calls and data flow. 3) A set of unit tests and basic performance tests for critical parts (parsing, validation, event recording).

Functional requirements: 1) QR scanning via AVFoundation with continuous stream support - returning the result in the form of a structured object (ticketId, eventId, zoneId, issuedAt, validFrom, validTo, signature). 2) Offline validation - verification of the Ed25519 signature using the public key of the event, verification of the time window and zone, protection against ticket reuse on one device (local anti-reuse). 3) Event queue - all scanning attempts and decisions (accepted/denied + reason) are written to local storage and can be uploaded later in batches. 4) Synchronization - an SDK method that accepts a callback/protocol to send a packet to our API (we have our own network layer, so the SDK should not impose a specific HTTP library). There should be retrays, deduplication and marking of successfully sent events. 5) Key management - the ability to update a set of publicprivate keys (for example, keys for several eventIds) through the config and saved locally. There must be a version of the configuration and a safe replacement without losing the ability to verify previously issued tickets.

Limitations: 1) Work strictly offline when scanning - no network requests at the time of scanning. 2) You cannot use third-party heavy SDKs for scanning or databases - only standard Apple frameworks or very light dependencies through SPM as agreed. 3) The public API of the package should be minimal and documented in comments (SwiftDoc). 4) The code must be compatible with iOS 15 and later, without private API.

Acceptance criteria (measurable): 1) Validation of a correct ticket with signature verification takes no longer than 30 ms on iPhone 12 in the release build, with an average of 100 runs. 2) The SDK correctly rejects at least 6 types of errors with clear codes/reasons - incorrect signature, expired, not yet active, invalid zone, reuse, unknown eventId/key. 3) After 500 offline scans, all events are available in the queue and are not lost when the application is forced to terminate (kill) and then restarted. 4) Unit tests cover at least 70% of the parsing/validation/queue logic (using Xcode coverage). 5) Sample integration demonstrates: starting the scanner, getting the result, calling validate, recording an event and starting sync.

Stages of implementation: 1) Clarification of the payload format and synchronization protocol, fixation of the public API SDK. 2) Core implementation - parser, cryptographic verification, validation rules. 3) Implementation of storage and event queue + deduplication. 4) Scanner integration, sample, tests and optimization.

We will provide: QR payload examples, test Ed25519 keys, mock API specification for uploading events and a list of business rules by zone/time.