Ship the AutoFill extension and time-sensitive entitlement

apps/ios/Lab86Mail/Resources/Lab86Mail.entitlements

@@ -4,27 +4,17 @@
 <dict>
 	<key>aps-environment</key>
 	<string>$(APS_ENVIRONMENT)</string>
-	<!--
-	  Time Sensitive Notifications and the group.io.lab86.mail App Group both
-	  belong here, and the code for both is written and merged. They are held
-	  out because neither can be provisioned from the App Store Connect API:
-	  the time-sensitive capability is not a valid capabilityType, and the
-	  appGroups endpoint returns 404. Both need one visit to Certificates,
-	  Identifiers & Profiles. Shipping them unprovisioned fails the build
-	  outright, which blocks everything else in the release.
-
-	  To restore, in the developer portal:
-	    1. Identifiers > App Groups > create group.io.lab86.mail
-	    2. Identifiers > io.lab86.mail (and .dev) > App Groups > assign it
-	    3. Same App IDs > enable Time Sensitive Notifications
-	  then re-add the two keys below and the Lab86MailAutoFill target in
-	  apps/ios/project.yml.
-
-	  <key>com.apple.developer.usernotifications.time-sensitive</key>
-	  <true/>
-	  <key>com.apple.security.application-groups</key>
-	  <array><string>group.io.lab86.mail</string></array>
-	-->
+	<!-- Lets urgent mail break through Focus. The elevated level is applied per
+	     notification by the server, but the exemption is granted per app, which
+	     is why only 'urgent_mail' ever sets it. -->
+	<key>com.apple.developer.usernotifications.time-sensitive</key>
+	<true/>
+	<!-- Shared with the AutoFill extension, which reads one-time codes the app
+	     has already fetched. -->
+	<key>com.apple.security.application-groups</key>
+	<array>
+		<string>group.io.lab86.mail</string>
+	</array>
 
 	<key>com.apple.developer.associated-domains</key>
 	<array>

apps/ios/project.yml

@@ -98,39 +98,35 @@ targets:
         product: ClerkConvex
       - package: Convex
         product: ConvexMobile
+      - target: Lab86MailAutoFill
     scheme:
       testTargets:
         - Lab86MailTests
         - Lab86MailUITests
       gatherCoverageData: true
 
-  # DISABLED until group.io.lab86.mail exists in the developer portal.
-  # The App Groups capability is enabled on both App IDs, but the group
-  # identifier itself cannot be created through the App Store Connect API
-  # (the appGroups endpoint 404s), and without it this target cannot sign.
-  # Source is retained under apps/ios/Lab86MailAutoFill and apps/ios/Shared.
-#  # Supplies one-time codes from mail to system AutoFill. Deliberately depends
-#  # on nothing but the shared vault types: it runs in a short-lived, memory
-#  # constrained process and reads only what the app has already fetched.
-#  Lab86MailAutoFill:
-#    type: app-extension
-#    platform: iOS
-#    sources:
-#      - path: Lab86MailAutoFill
-#      - path: Shared
-#    configFiles:
-#      Debug: Config/Debug.xcconfig
-#      Release: Config/Release.xcconfig
-#    settings:
-#      base:
-#        PRODUCT_BUNDLE_IDENTIFIER: io.lab86.mail.autofill
-#        PRODUCT_NAME: Lab86MailAutoFill
-#        PRODUCT_MODULE_NAME: Lab86MailAutoFill
-#        INFOPLIST_FILE: Lab86MailAutoFill/Resources/Info.plist
-#        CODE_SIGN_ENTITLEMENTS: Lab86MailAutoFill/Resources/Lab86MailAutoFill.entitlements
-#        GENERATE_INFOPLIST_FILE: false
-#        SUPPORTS_MACCATALYST: false
-#        SKIP_INSTALL: true
+  # Supplies one-time codes from mail to system AutoFill. Deliberately depends
+  # on nothing but the shared vault types: it runs in a short-lived, memory
+  # constrained process and reads only what the app has already fetched.
+  Lab86MailAutoFill:
+    type: app-extension
+    platform: iOS
+    sources:
+      - path: Lab86MailAutoFill
+      - path: Shared
+    configFiles:
+      Debug: Config/Debug.xcconfig
+      Release: Config/Release.xcconfig
+    settings:
+      base:
+        PRODUCT_BUNDLE_IDENTIFIER: io.lab86.mail.autofill
+        PRODUCT_NAME: Lab86MailAutoFill
+        PRODUCT_MODULE_NAME: Lab86MailAutoFill
+        INFOPLIST_FILE: Lab86MailAutoFill/Resources/Info.plist
+        CODE_SIGN_ENTITLEMENTS: Lab86MailAutoFill/Resources/Lab86MailAutoFill.entitlements
+        GENERATE_INFOPLIST_FILE: false
+        SUPPORTS_MACCATALYST: false
+        SKIP_INSTALL: true
 
   Lab86MailTests:
     type: bundle.unit-test