> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tinycloud.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Capability Registry

> Capability action URNs and status from the canonical TinyCloud node registry

This page is the source-attributed implementation reference for capability action names and status in the canonical `tinycloud-node` registry. For the authorization model behind these names, see [Capabilities](/concepts/capabilities).

<Info>
  Synced from canonical registry version 1 at [`390253a`](https://github.com/TinyCloudLabs/tinycloud-node/blob/390253aca30628f2ac2be28e64d8e3830da07aaa/capabilities.json) (source SHA-256 `1a70a4126bdfb0e75d3b93a28d1a1a49980bbe66d0790810c1e93b18e236ae7f`). The registry contains 29 active actions, 3 deprecated aliases, and 5 reserved actions.
</Info>

## Ability syntax

An ability combines a service namespace and an action:

```text theme={null}
tinycloud.{service}/{action}
```

The ability states **what** a delegate may do. The resource URI and capability caveats state **where** and under which constraints it may do it.

## Statuses

| Status           | Meaning                                                                                                                 |
| ---------------- | ----------------------------------------------------------------------------------------------------------------------- |
| Active           | Accepted as an active protocol action. SDK availability and runtime effects vary by service.                            |
| Deprecated alias | Accepted for compatibility and normalized to the listed canonical action. Use the canonical action in new integrations. |
| Reserved         | Recognized at the policy boundary but not dispatched to a service. Do not request reserved actions.                     |

<Warning>
  Registry inclusion describes the node's authorization boundary. It does not by itself guarantee a high-level SDK method, a dedicated side effect, or availability on every deployment. Treat this registry—not proposal-only whitepaper names—as the source of truth for action spelling, relationships, and status.
</Warning>

## `tinycloud.capabilities`

| Ability                       | Status | Relationship | Registry note |
| ----------------------------- | ------ | ------------ | ------------- |
| `tinycloud.capabilities/read` | active | —            | —             |

## `tinycloud.delegation`

| Ability                       | Status | Relationship | Registry note |
| ----------------------------- | ------ | ------------ | ------------- |
| `tinycloud.delegation/status` | active | —            | —             |

## `tinycloud.duckdb`

| Ability                   | Status           | Relationship                                                                                                                              | Registry note                                                                                                                                                                                                                                                                                                             |
| ------------------------- | ---------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `tinycloud.duckdb/*`      | active           | Implies `tinycloud.duckdb/read`, `tinycloud.duckdb/write`, `tinycloud.duckdb/admin`, `tinycloud.duckdb/import`, `tinycloud.duckdb/export` | Per-service wildcard. Matched node-side as admin-equivalent (routes/mod.rs:2140, duckdb/parser.rs:29) and as write+admin in validate\_sql; recognized by preferred\_database\_ability (routes/mod.rs:2118). Live in the SDK root delegation grant (TinyCloudNode.ts \~2279). Implies every concrete active duckdb action. |
| `tinycloud.duckdb/admin`  | active           | —                                                                                                                                         | —                                                                                                                                                                                                                                                                                                                         |
| `tinycloud.duckdb/export` | active           | —                                                                                                                                         | —                                                                                                                                                                                                                                                                                                                         |
| `tinycloud.duckdb/import` | active           | —                                                                                                                                         | —                                                                                                                                                                                                                                                                                                                         |
| `tinycloud.duckdb/read`   | active           | —                                                                                                                                         | —                                                                                                                                                                                                                                                                                                                         |
| `tinycloud.duckdb/select` | deprecated-alias | Alias of `tinycloud.duckdb/read`                                                                                                          | —                                                                                                                                                                                                                                                                                                                         |
| `tinycloud.duckdb/write`  | active           | —                                                                                                                                         | —                                                                                                                                                                                                                                                                                                                         |

## `tinycloud.encryption`

| Ability                               | Status | Relationship | Registry note |
| ------------------------------------- | ------ | ------------ | ------------- |
| `tinycloud.encryption/decrypt`        | active | —            | —             |
| `tinycloud.encryption/network.create` | active | —            | —             |
| `tinycloud.encryption/network.revoke` | active | —            | —             |

## `tinycloud.hooks`

| Ability                      | Status | Relationship | Registry note |
| ---------------------------- | ------ | ------------ | ------------- |
| `tinycloud.hooks/list`       | active | —            | —             |
| `tinycloud.hooks/register`   | active | —            | —             |
| `tinycloud.hooks/subscribe`  | active | —            | —             |
| `tinycloud.hooks/unregister` | active | —            | —             |

## `tinycloud.kv`

| Ability                 | Status           | Relationship                | Registry note |
| ----------------------- | ---------------- | --------------------------- | ------------- |
| `tinycloud.kv/del`      | active           | —                           | —             |
| `tinycloud.kv/delete`   | deprecated-alias | Alias of `tinycloud.kv/del` | —             |
| `tinycloud.kv/get`      | active           | —                           | —             |
| `tinycloud.kv/list`     | active           | —                           | —             |
| `tinycloud.kv/metadata` | active           | —                           | —             |
| `tinycloud.kv/put`      | active           | —                           | —             |

## `tinycloud.space`

| Ability                  | Status | Relationship | Registry note                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| ------------------------ | ------ | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `tinycloud.space/create` | active | —            | Invoked by the SDK against /invoke (SpaceService.ts create(); TinyCloud.ts lazy public-space create). The node authorizes it via the delegation chain in the invocation-verification path (not via accepted\_actions), but there is NO dedicated side-effect handler — db.rs invocation match falls through (\_ => \{}). Real space creation happens through space/host. 409/404 the SDK sees come from the space-existence check (TxError::SpaceNotFound), not a create handler. |
| `tinycloud.space/host`   | active | —            | Creates the space: a space/host delegation inserts the space row in transact() (tinycloud-core/src/db.rs \~818, matched on Delegation events).                                                                                                                                                                                                                                                                                                                                    |
| `tinycloud.space/info`   | active | —            | Invoked by the SDK (SpaceService.ts getSpaceInfo; TinyCloud.ts probe-before-create). Authorized via the delegation chain; no dedicated node side-effect handler. A nonexistent space yields TxError::SpaceNotFound -> 404, which is exactly the SDK's existence probe.                                                                                                                                                                                                            |
| `tinycloud.space/list`   | active | —            | Invoked by the SDK (SpaceService.ts listOwnedSpaces). Authorized via the delegation chain; no dedicated node side-effect handler (db.rs invocation match falls through). Owned-space discovery is served via the capabilities/read + host layers, not a space/list handler.                                                                                                                                                                                                       |

## `tinycloud.sql`

| Ability                | Status           | Relationship                                                                                       | Registry note                                                                                                                                                                                                                                                                                                                                                                |
| ---------------------- | ---------------- | -------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `tinycloud.sql/*`      | active           | Implies `tinycloud.sql/read`, `tinycloud.sql/write`, `tinycloud.sql/schema`, `tinycloud.sql/admin` | Per-service wildcard. Matched node-side as admin-equivalent in admin checks (routes/mod.rs:2139, sql/database.rs:177, sql/parser.rs:25) and as write+admin in validate\_sql. Live in the SDK root delegation grant (TinyCloudNode.ts \~2272). Modeled as implying every concrete active sql action so a wildcard grant authorizes any sql request via implication expansion. |
| `tinycloud.sql/admin`  | active           | Implies `tinycloud.sql/schema`                                                                     | —                                                                                                                                                                                                                                                                                                                                                                            |
| `tinycloud.sql/read`   | active           | —                                                                                                  | —                                                                                                                                                                                                                                                                                                                                                                            |
| `tinycloud.sql/schema` | active           | —                                                                                                  | —                                                                                                                                                                                                                                                                                                                                                                            |
| `tinycloud.sql/select` | deprecated-alias | Alias of `tinycloud.sql/read`                                                                      | —                                                                                                                                                                                                                                                                                                                                                                            |
| `tinycloud.sql/write`  | active           | —                                                                                                  | —                                                                                                                                                                                                                                                                                                                                                                            |

## `tinycloud.vfs`

| Ability                  | Status   | Relationship | Registry note |
| ------------------------ | -------- | ------------ | ------------- |
| `tinycloud.vfs/delete`   | reserved | —            | —             |
| `tinycloud.vfs/get`      | reserved | —            | —             |
| `tinycloud.vfs/list`     | reserved | —            | —             |
| `tinycloud.vfs/metadata` | reserved | —            | —             |
| `tinycloud.vfs/put`      | reserved | —            | —             |

## Related documentation

* [Capabilities](/concepts/capabilities) explains delegation, attenuation, and validation.
* [Delegations & Sharing](/guides/delegations) shows how to grant and use capabilities.
* [App manifests](/concepts/app-manifests) describes how applications request capabilities during sign-in.