<?xml version="1.0" encoding="UTF-8"?>
<!-- Per-app entitlements template. After `pnpm tauri ios init`, merge these keys
     into gen/apple/<app>_iOS/<app>_iOS.entitlements. Requires an Apple Developer
     team with these capabilities enabled on each App ID:
       - Push Notifications (APNs)
       - Keychain Sharing  (cross-app SSO)
       - App Groups        (share extension + file provider handoff)
     Replace REPLACE_TEAM_ID with your 10-char Apple Team ID. -->
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <!-- Push: 'development' for debug, 'production' for App Store / TestFlight. -->
  <key>aps-environment</key>
  <string>development</string>

  <!-- Cross-app SSO: ALL suite apps share ONE keychain access group so the
       OIDC tokens stored by ulti-core (service "space.ulti.suite") are visible
       to every app. -->
  <key>keychain-access-groups</key>
  <array>
    <string>$(AppIdentifierPrefix)space.ulti.suite</string>
  </array>

  <!-- App Group: shared container for the Share Extension and File Provider. -->
  <key>com.apple.security.application-groups</key>
  <array>
    <string>group.space.ulti.suite</string>
  </array>
</dict>
</plist>
