<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <!-- Network client — outbound to sync servers -->
    <key>com.apple.security.network.client</key>
    <true/>
    <!-- Network server — local web UI on one port -->
    <key>com.apple.security.network.server</key>
    <true/>
    <!-- Full Disk Access required to read chat.db -->
    <key>com.apple.security.files.all</key>
    <true/>
    <!-- Contacts -->
    <key>com.apple.security.personal-information.addressbook</key>
    <true/>
    <!--
      Access to CNContact.note (macOS 14+) is gated by Apple's restricted
      entitlement `com.apple.developer.contacts.notes`, which requires a
      provisioning profile from the Apple Developer Program. On
      self-signed builds taskgated-helper kills the app at launch with
      "Disallowing com.lilith.mac-sync because no eligible provisioning
      profiles found". The entitlement is intentionally omitted here;
      CNContact.note writes will silently no-op and the contacts-render
      branch falls back to first/last name only. Re-enable when shipping
      through the Apple Developer Program with a real profile.
    -->
    <!-- <key>com.apple.developer.contacts.notes</key><true/> -->

    <!-- Photos -->
    <key>com.apple.security.personal-information.photos-library</key>
    <true/>
    <!-- Calendars -->
    <key>com.apple.security.personal-information.calendars</key>
    <true/>
    <!-- Per-module keychain service IDs prevent token collision on revocation -->
    <key>com.apple.security.keychain-access-groups</key>
    <array>
        <string>$(AppIdentifierPrefix)com.lilith.mac-sync.imessage</string>
        <string>$(AppIdentifierPrefix)com.lilith.mac-sync.iphoto</string>
        <string>$(AppIdentifierPrefix)com.lilith.mac-sync.imail</string>
    </array>
    <!-- Mail.app AppleScript automation -->
    <key>com.apple.security.automation.apple-events</key>
    <true/>
</dict>
</plist>
