{
  "$schema": "../gen/schemas/desktop-schema.json",
  "identifier": "default",
  "description": "Minimal capability set for the kiosk shell. The window only needs to render the SPA; it is granted NOTHING that touches the filesystem, shell, or devices — those stay server-side. Add a named permission here only when a concrete need arises (deny-by-default). See wiki/decisions/desktop-shell-tauri.md.",
  "windows": ["main"],
  "permissions": [
    "core:default",
    "updater:default",
    "process:default",
    "websocket:default",
    {
      "identifier": "http:default",
      "allow": [
        { "url": "http://127.0.0.1:3000" },
        { "url": "http://localhost:3000" }
      ]
    }
  ]
}