expo-apple-targets

The apple-targets skill provides comprehensive guidance for a wide range of Apple extension and target types. These are organized into several functional categories:

• User Interface Extensions: Widgets, App Clips, Share Extensions, etc.
• Notifications: Push and local notification handling.
• Siri & Intents: Siri integration and App Intents.
• Networking & VPN: Network extensions and VPN configurations.
• File Management: Accessing and managing files via extensions.
• Communication & Telephony: Handling calls or messaging extensions.
• Content & Media: Media-related extensions.
• Education & Screen Time: Screen Time controls and educational integrations.

An App Clip is a lightweight, focused subset of your full application that users can launch instantly via NFC tags, QR codes, App Clip Codes, Safari banners, Maps, or Messages links without installing the full app from the App Store.

Key characteristics:

• Product Type: Uses com.apple.product-type.application.on-demand-install-capable.
• Not an Extension: It is a fully functional application target with specific size constraints.
• Lifecycle: The system downloads it on demand and automatically removes it after a period of inactivity.
• Data Sharing: App Clips share code and assets with the main app via shared targets. They transfer user data (like credentials or preferences) to the full app using App Groups and shared Keychain access groups.
• Size Limits:
  • Physical invocations: 15 MB (per WWDC 2022).
  • Digital invocations (iOS 17+): Up to 50 MB.

An Authentication Services SSO extension (authentication-services) is an enterprise tool that intercepts HTTP authentication requests destined for a specific Identity Provider (IdP) domain. Instead of loading a web-based login page in a browser, the system routes the authentication challenge directly to your extension.

This allows for:

• Silent authentication using cached tokens or device credentials.
• Native UI for logins instead of browser redirects.
• Secure Enclave integration for device-bound authentication.
• Multi-factor authentication (MFA) handled natively.

This mechanism is the foundation for enterprise SSO on Apple platforms, used by providers like Okta, Microsoft Entra ID, and Jamf Connect.

A network-dns-proxy is a network extension that intercepts all system DNS queries on a device and resolves them through a custom resolver. This allows for system-wide implementation of:

• Encrypted DNS (DoH / DoT): Forwarding plain DNS queries to trusted resolvers like Cloudflare (1.1.1.1) or Google (8.8.8.8) via DNS-over-HTTPS or DNS-over-TLS.
• DNS-Based Ad and Tracker Blocking: Returning NXDOMAIN or 0.0.0.0 for known advertising/tracking domains.
• Custom DNS Routing: Routing specific domains (e.g., corporate internal domains) to specific servers while using public resolvers for everything else.

An App Intents extension is a lightweight, ExtensionKit-based process that exposes your app's actions and entities to the system (Siri, Shortcuts, Spotlight, widgets, etc.) without launching your main application.

Unlike legacy SiriKit, App Intents are declared entirely in Swift using structs that conform to the AppIntent protocol. This approach keeps your app's startup cost out of the critical path, ensuring faster responses for voice commands and automations.

A WidgetKit extension (widget) renders small SwiftUI views on the Home Screen, Lock Screen, StandBy mode, and macOS Desktop. Widgets are powered by a system-managed timeline of data.

Starting with iOS 17, widgets can include interactive controls like buttons and toggles using App Intents. The same extension can also be used to power Live Activities (Lock Screen and Dynamic Island) and Control Center controls (iOS 18+).

A Share Extension adds your app to the system share sheet, allowing users to send content—such as URLs, images, text, or files—directly from any app into yours.

Key Characteristics

• Separate Process: The extension runs in its own process with tight resource constraints.
• Communication: It communicates with the containing app via App Groups (e.g., using UserDefaults(suiteName:) or shared files).
• UI Options:
  • Standard UI: Subclass SLComposeServiceViewController for a built-in compose-style interface with a text field and content preview.
  • Custom UI: Use a plain UIViewController (or UIHostingController for SwiftUI) for complete control over the presentation.
• Data Delivery: Content arrives via NSExtensionContext.inputItems as NSExtensionItem objects containing NSItemProvider attachments.

A CoreSpotlight delegate extension (spotlight-delegate) allows the system to request re-indexing of your app's searchable content even when the app is not running. This is critical for ensuring Spotlight results stay fresh after device restores from backups, when indexed items are about to expire, or when the on-device Spotlight index is rebuilt.

The extension works by subclassing CSIndexExtensionRequestHandler and implementing methods for both full re-indexing and partial re-indexing of specific items via identifiers.

A broadcast-setup-ui extension is a ReplayKit companion to a broadcast-upload extension. It displays a modal view controller when a user starts a live broadcast (via RPBroadcastActivityViewController or the system broadcast picker) but before any audio or video data begins flowing.

Its primary purpose is to collect configuration data—such as account credentials, stream titles, channel selections, or quality presets—and pass that data to the paired upload extension. This ensures the upload extension has the necessary metadata to begin streaming immediately upon launch.

extensionContext?.completeRequest(withBroadcast:setupInfo:)

An App Proxy Provider is a network extension that implements the client side of a custom app-layer proxy protocol. Unlike a packet tunnel provider that captures all device traffic as raw IP packets, the app proxy provider operates at the flow level. It receives individual TCP (NEAppProxyTCPFlow) and UDP (NEAppProxyUDPFlow) connections from specific apps matched by per-app VPN rules (NEAppRule).

This makes it ideal for:

• Enterprise Per-App VPN: Routing traffic from specific managed apps (e.g., corporate email) through a secure proxy while leaving personal traffic on the normal network path.
• App-Specific Proxy Servers: Performing inspection, logging, or transformation at the application flow level without needing to parse raw IP packets.
• Selective Traffic Routing: Directing traffic from specific apps through different network paths based on business rules.

A Smart Card Extension is a CryptoTokenKit-based app extension that acts as a driver for physical smart cards (such as PIV or CAC) and USB/NFC cryptographic tokens.

When a compatible card is inserted (via USB CCID reader or NFC on iOS), the extension:

1. Enumerates objects: Reads certificates, public keys, and key references from the card.
2. Exposes to keychain: Makes discovered certificates and identities available in the system keychain for any app using SecItem/SecKey APIs.
3. Performs crypto operations: Enables signing, decryption, and authentication using private keys that remain on the hardware token.

Platform Support:

• macOS: 10.12+ (for the extension mechanism)
• iOS/iPadOS: 16.0+ (requires USB-C or NFC; Lightning requires MFi adapters)