capabilities.json

{
  "$schema": "./capabilities.schema.json",
  "version": 1,
  "description": "Canonical single source of truth (SSOT) for TinyCloud capability action URNs (TC-112). Truth lives with the enforcer (tinycloud-node). Codegen (scripts/gen-capabilities.mjs) emits a Rust module and a TypeScript module from this file; the checked-in artifacts are verified against this registry in CI. Every entry is grounded in actual node dispatch code, not SDK declarations.",
  "capabilities": [
    {
      "urn": "tinycloud.kv/get",
      "service": "tinycloud.kv",
      "status": "active"
    },
    {
      "urn": "tinycloud.kv/list",
      "service": "tinycloud.kv",
      "status": "active"
    },
    {
      "urn": "tinycloud.kv/metadata",
      "service": "tinycloud.kv",
      "status": "active"
    },
    {
      "urn": "tinycloud.kv/put",
      "service": "tinycloud.kv",
      "status": "active"
    },
    {
      "urn": "tinycloud.kv/del",
      "service": "tinycloud.kv",
      "status": "active"
    },
    {
      "urn": "tinycloud.kv/delete",
      "service": "tinycloud.kv",
      "status": "deprecated-alias",
      "aliasOf": "tinycloud.kv/del"
    },
    {
      "urn": "tinycloud.kv/sync",
      "service": "tinycloud.kv",
      "status": "active",
      "notes": "TC-732: read-only, ordered, prefix-scoped KV change feed invoked through /invoke. Discloses key, etag, deleted flag and metadata for entries under the granted prefix; value content still requires tinycloud.kv/get. Must be granted explicitly: no wildcard (`*`) or registry action implies it."
    },
    {
      "urn": "tinycloud.kv/retain",
      "service": "tinycloud.kv",
      "status": "active",
      "notes": "TC-732: never invoked. Presented only via the `x-tinycloud-retention-grant` header on a tinycloud.kv/sync request to attest owner-approved offline retention (`authority.retainUntil`). Must be granted explicitly: no wildcard (`*`) or registry action implies it."
    },
    {
      "urn": "tinycloud.sql/read",
      "service": "tinycloud.sql",
      "status": "active"
    },
    {
      "urn": "tinycloud.sql/select",
      "service": "tinycloud.sql",
      "status": "deprecated-alias",
      "aliasOf": "tinycloud.sql/read"
    },
    {
      "urn": "tinycloud.sql/write",
      "service": "tinycloud.sql",
      "status": "active"
    },
    {
      "urn": "tinycloud.sql/schema",
      "service": "tinycloud.sql",
      "status": "active"
    },
    {
      "urn": "tinycloud.sql/admin",
      "service": "tinycloud.sql",
      "status": "active",
      "implies": ["tinycloud.sql/schema"]
    },
    {
      "urn": "tinycloud.sql/*",
      "service": "tinycloud.sql",
      "status": "active",
      "implies": ["tinycloud.sql/read", "tinycloud.sql/write", "tinycloud.sql/schema", "tinycloud.sql/admin"],
      "notes": "Per-service wildcard. Matched node-side as admin-equivalent in admin checks (routes/mod.rs:2139, sql/database.rs:177, sql/parser.rs:25) and as write+admin in validate_sql. Live in the SDK root delegation grant (TinyCloudNode.ts ~2272). Modeled as implying every concrete active sql action so a wildcard grant authorizes any sql request via implication expansion."
    },
    {
      "urn": "tinycloud.duckdb/read",
      "service": "tinycloud.duckdb",
      "status": "active"
    },
    {
      "urn": "tinycloud.duckdb/write",
      "service": "tinycloud.duckdb",
      "status": "active"
    },
    {
      "urn": "tinycloud.duckdb/admin",
      "service": "tinycloud.duckdb",
      "status": "active"
    },
    {
      "urn": "tinycloud.duckdb/import",
      "service": "tinycloud.duckdb",
      "status": "active"
    },
    {
      "urn": "tinycloud.duckdb/export",
      "service": "tinycloud.duckdb",
      "status": "active"
    },
    {
      "urn": "tinycloud.duckdb/select",
      "service": "tinycloud.duckdb",
      "status": "deprecated-alias",
      "aliasOf": "tinycloud.duckdb/read"
    },
    {
      "urn": "tinycloud.duckdb/*",
      "service": "tinycloud.duckdb",
      "status": "active",
      "implies": ["tinycloud.duckdb/read", "tinycloud.duckdb/write", "tinycloud.duckdb/admin", "tinycloud.duckdb/import", "tinycloud.duckdb/export"],
      "notes": "Per-service wildcard. Matched node-side as admin-equivalent (routes/mod.rs:2140, duckdb/parser.rs:29) and as write+admin in validate_sql; recognized by preferred_database_ability (routes/mod.rs:2118). Live in the SDK root delegation grant (TinyCloudNode.ts ~2279). Implies every concrete active duckdb action."
    },
    {
      "urn": "tinycloud.capabilities/read",
      "service": "tinycloud.capabilities",
      "status": "active"
    },
    {
      "urn": "tinycloud.delegation/status",
      "service": "tinycloud.delegation",
      "status": "active"
    },
    {
      "urn": "tinycloud.delegation/list",
      "service": "tinycloud.delegation",
      "status": "active"
    },
    {
      "urn": "tinycloud.hooks/subscribe",
      "service": "tinycloud.hooks",
      "status": "active"
    },
    {
      "urn": "tinycloud.hooks/register",
      "service": "tinycloud.hooks",
      "status": "active"
    },
    {
      "urn": "tinycloud.hooks/list",
      "service": "tinycloud.hooks",
      "status": "active"
    },
    {
      "urn": "tinycloud.hooks/unregister",
      "service": "tinycloud.hooks",
      "status": "active"
    },
    {
      "urn": "tinycloud.encryption/decrypt",
      "service": "tinycloud.encryption",
      "status": "active"
    },
    {
      "urn": "tinycloud.encryption/network.create",
      "service": "tinycloud.encryption",
      "status": "active"
    },
    {
      "urn": "tinycloud.encryption/network.revoke",
      "service": "tinycloud.encryption",
      "status": "active"
    },
    {
      "urn": "tinycloud.space/host",
      "service": "tinycloud.space",
      "status": "active",
      "notes": "Creates the space: a space/host delegation inserts the space row in transact() (tinycloud-core/src/db.rs ~818, matched on Delegation events)."
    },
    {
      "urn": "tinycloud.space/create",
      "service": "tinycloud.space",
      "status": "active",
      "notes": "Invoked by the SDK against /invoke (SpaceService.ts create(); TinyCloud.ts lazy public-space create). The node authorizes it via the delegation chain in the invocation-verification path (not via accepted_actions), but there is NO dedicated side-effect handler — db.rs invocation match falls through (_ => {}). Real space creation happens through space/host. 409/404 the SDK sees come from the space-existence check (TxError::SpaceNotFound), not a create handler."
    },
    {
      "urn": "tinycloud.space/list",
      "service": "tinycloud.space",
      "status": "active",
      "notes": "Invoked by the SDK (SpaceService.ts listOwnedSpaces). Authorized via the delegation chain; no dedicated node side-effect handler (db.rs invocation match falls through). Owned-space discovery is served via the capabilities/read + host layers, not a space/list handler."
    },
    {
      "urn": "tinycloud.space/info",
      "service": "tinycloud.space",
      "status": "active",
      "notes": "Invoked by the SDK (SpaceService.ts getSpaceInfo; TinyCloud.ts probe-before-create). Authorized via the delegation chain; no dedicated node side-effect handler. A nonexistent space yields TxError::SpaceNotFound -> 404, which is exactly the SDK's existence probe."
    },
    {
      "urn": "tinycloud.vfs/get",
      "service": "tinycloud.vfs",
      "status": "reserved"
    },
    {
      "urn": "tinycloud.vfs/list",
      "service": "tinycloud.vfs",
      "status": "reserved"
    },
    {
      "urn": "tinycloud.vfs/metadata",
      "service": "tinycloud.vfs",
      "status": "reserved"
    },
    {
      "urn": "tinycloud.vfs/put",
      "service": "tinycloud.vfs",
      "status": "reserved"
    },
    {
      "urn": "tinycloud.vfs/delete",
      "service": "tinycloud.vfs",
      "status": "reserved"
    }
  ]
}