Jetstream 4.x defaultApiTokenPermissions ability format conflicts with UI comma-separated input

Direct Answer

Jetstream 4.x does not automatically transform the defaultApiTokenPermissions PHP array into a comma-separated string for the Livewire ApiTokenManager component. The configuration array is passed directly as the defaultPermissions property, but the component's permissions state (bound to the UI input) remains an empty string unless you override mount() to join the array yourself. On token creation, the component splits the permissions string by commas, trims each segment, and stores the resulting array in the abilities JSON column. Ability names containing commas will be split incorrectly; spaces within a segment are preserved.

Confirmed Behavior

• Config → Component: config/jetstream.php defaultApiTokenPermissions (array) → ApiTokenManager::$defaultPermissions (array). No join occurs in the stock component.
• Component → UI: ApiTokenManager::$permissions (string) drives the comma-separated input. Default scaffolding leaves it empty on mount.
• UI → Storage: store() does array_filter(array_map('trim', explode(',', $this->permissions))) before passing to createToken(). The abilities JSON column receives this array verbatim.
• Validation: No server-side sanitization beyond Sanctum's requirement that abilities be strings. Commas in ability names break the split; leading/trailing spaces per segment are trimmed.

Required Developer Action

1. Publish the Livewire component (if not already): php artisan vendor:publish --tag=jetstream-views (includes Livewire components in Jetstream 4.x).
2. Override mount() in your App\Http\Livewire\ApiTokenManager (or the published path) to pre-fill the UI:

   public function mount()
   {
       parent::mount();
       $this->permissions = implode(', ', $this->defaultPermissions);
   }

3. If you need abilities with commas, either avoid commas in names or extend store() with a custom parser (e.g., CSV-aware splitting).

Verification Checklist

• Set defaultApiTokenPermissions => ['read access', 'write access'] in config/jetstream.php.
• Load the API tokens page — the permissions input should show read access, write access after the mount() override.
• Create a token and inspect the personal_access_tokens.abilities column: it should store ["read access","write access"].

One Diagnostic Detail Needed

Are you using the Livewire stack or the Inertia (Vue/React) stack? The Inertia components handle permissions differently (array props, no comma-separated string), so the fix above applies only to Livewire.