Capability Registry

This page is the source-attributed implementation reference for capability action names and status in the canonical tinycloud-node registry. For the authorization model behind these names, see Capabilities.

Synced from canonical registry version 1 at 390253a (source SHA-256 1a70a4126bdfb0e75d3b93a28d1a1a49980bbe66d0790810c1e93b18e236ae7f). The registry contains 29 active actions, 3 deprecated aliases, and 5 reserved actions.

Ability syntax

An ability combines a service namespace and an action:

tinycloud.{service}/{action}

The ability states what a delegate may do. The resource URI and capability caveats state where and under which constraints it may do it.

Statuses

Status	Meaning
Active	Accepted as an active protocol action. SDK availability and runtime effects vary by service.
Deprecated alias	Accepted for compatibility and normalized to the listed canonical action. Use the canonical action in new integrations.
Reserved	Recognized at the policy boundary but not dispatched to a service. Do not request reserved actions.

Registry inclusion describes the node’s authorization boundary. It does not by itself guarantee a high-level SDK method, a dedicated side effect, or availability on every deployment. Treat this registry—not proposal-only whitepaper names—as the source of truth for action spelling, relationships, and status.

`tinycloud.capabilities`

Ability	Status	Relationship	Registry note
`tinycloud.capabilities/read`	active	—	—

`tinycloud.delegation`

Ability	Status	Relationship	Registry note
`tinycloud.delegation/status`	active	—	—

`tinycloud.duckdb`

Ability	Status	Relationship	Registry note
`tinycloud.duckdb/*`	active	Implies `tinycloud.duckdb/read`, `tinycloud.duckdb/write`, `tinycloud.duckdb/admin`, `tinycloud.duckdb/import`, `tinycloud.duckdb/export`	Per-service wildcard. Matched node-side as admin-equivalent (routes/mod.rs:2140, duckdb/parser.rs:29) and as write+admin in validate_sql; recognized by preferred_database_ability (routes/mod.rs:2118). Live in the SDK root delegation grant (TinyCloudNode.ts ~2279). Implies every concrete active duckdb action.
`tinycloud.duckdb/admin`	active	—	—
`tinycloud.duckdb/export`	active	—	—
`tinycloud.duckdb/import`	active	—	—
`tinycloud.duckdb/read`	active	—	—
`tinycloud.duckdb/select`	deprecated-alias	Alias of `tinycloud.duckdb/read`	—
`tinycloud.duckdb/write`	active	—	—

`tinycloud.encryption`

Ability	Status	Relationship	Registry note
`tinycloud.encryption/decrypt`	active	—	—
`tinycloud.encryption/network.create`	active	—	—
`tinycloud.encryption/network.revoke`	active	—	—

`tinycloud.hooks`

Ability	Status	Relationship	Registry note
`tinycloud.hooks/list`	active	—	—
`tinycloud.hooks/register`	active	—	—
`tinycloud.hooks/subscribe`	active	—	—
`tinycloud.hooks/unregister`	active	—	—

`tinycloud.kv`

Ability	Status	Relationship	Registry note
`tinycloud.kv/del`	active	—	—
`tinycloud.kv/delete`	deprecated-alias	Alias of `tinycloud.kv/del`	—
`tinycloud.kv/get`	active	—	—
`tinycloud.kv/list`	active	—	—
`tinycloud.kv/metadata`	active	—	—
`tinycloud.kv/put`	active	—	—

`tinycloud.space`

Ability	Status	Relationship	Registry note
`tinycloud.space/create`	active	—	Invoked by the SDK against /invoke (SpaceService.ts create(); TinyCloud.ts lazy public-space create). The node authorizes it via the delegation chain in the invocation-verification path (not via accepted_actions), but there is NO dedicated side-effect handler — db.rs invocation match falls through (_ => {}). Real space creation happens through space/host. 409/404 the SDK sees come from the space-existence check (TxError::SpaceNotFound), not a create handler.
`tinycloud.space/host`	active	—	Creates the space: a space/host delegation inserts the space row in transact() (tinycloud-core/src/db.rs ~818, matched on Delegation events).
`tinycloud.space/info`	active	—	Invoked by the SDK (SpaceService.ts getSpaceInfo; TinyCloud.ts probe-before-create). Authorized via the delegation chain; no dedicated node side-effect handler. A nonexistent space yields TxError::SpaceNotFound -> 404, which is exactly the SDK’s existence probe.
`tinycloud.space/list`	active	—	Invoked by the SDK (SpaceService.ts listOwnedSpaces). Authorized via the delegation chain; no dedicated node side-effect handler (db.rs invocation match falls through). Owned-space discovery is served via the capabilities/read + host layers, not a space/list handler.

`tinycloud.sql`

Ability	Status	Relationship	Registry note
`tinycloud.sql/*`	active	Implies `tinycloud.sql/read`, `tinycloud.sql/write`, `tinycloud.sql/schema`, `tinycloud.sql/admin`	Per-service wildcard. Matched node-side as admin-equivalent in admin checks (routes/mod.rs:2139, sql/database.rs:177, sql/parser.rs:25) and as write+admin in validate_sql. Live in the SDK root delegation grant (TinyCloudNode.ts ~2272). Modeled as implying every concrete active sql action so a wildcard grant authorizes any sql request via implication expansion.
`tinycloud.sql/admin`	active	Implies `tinycloud.sql/schema`	—
`tinycloud.sql/read`	active	—	—
`tinycloud.sql/schema`	active	—	—
`tinycloud.sql/select`	deprecated-alias	Alias of `tinycloud.sql/read`	—
`tinycloud.sql/write`	active	—	—

`tinycloud.vfs`

Ability	Status	Relationship	Registry note
`tinycloud.vfs/delete`	reserved	—	—
`tinycloud.vfs/get`	reserved	—	—
`tinycloud.vfs/list`	reserved	—	—
`tinycloud.vfs/metadata`	reserved	—	—
`tinycloud.vfs/put`	reserved	—	—

Capabilities explains delegation, attenuation, and validation.
Delegations & Sharing shows how to grant and use capabilities.
App manifests describes how applications request capabilities during sign-in.

​Ability syntax

​Statuses

​tinycloud.capabilities

​tinycloud.delegation

​tinycloud.duckdb

​tinycloud.encryption

​tinycloud.hooks

​tinycloud.kv

​tinycloud.space

​tinycloud.sql

​tinycloud.vfs

​Related documentation

Ability syntax

Statuses

`tinycloud.capabilities`

`tinycloud.delegation`

`tinycloud.duckdb`

`tinycloud.encryption`

`tinycloud.hooks`

`tinycloud.kv`

`tinycloud.space`

`tinycloud.sql`

`tinycloud.vfs`

Related documentation