Limits: IPC Command Authorization in Tauri 2.x

Goal: Identify which Rust functions are exposed to the webview via Tauri’s invoke IPC in a Tauri 2.x application and understand the default deny behavior that blocks unlisted commands.

Constraints: The permission schema in tauri.conf.json has changed from the v1 allowlist to a capabilities file in v2. A missing or malformed entry causes the invoke call to return an authorization error instead of executing the command, which can lead to silent failures in the UI.

Uncertainty: It is unclear how the runtime determines the set of allowed commands when the configuration contains multiple capability files, or whether a command can be partially authorized based on feature flags. The documentation notes that the default is deny, but does not detail fallback mechanisms or how to introspect the current permission state at runtime.

Questions: 1) What command does the runtime expose by default in Tauri 2.x when no capabilities are specified? 2) How can a developer programmatically query the list of permitted commands during development? 3) Does enabling the allowlist feature flag alter the default deny behavior for unlisted commands?