…1436)

Supersedes #1433, which GitHub auto-closed when its base branch
(`medieval-fibre`, merged as #1428) was deleted. Same commit, now based
on main.

## What

First implementation slice of the CapTarget design from #1428 (design of
record: `src/itx/types.ts`).

**A capability is now a name plus a typed target.** `caps.define`
accepts:

```ts
// raw platform binding — members replay applies the path onto env.AI
await itx.caps.define({
  name: "ai",
  target: { type: "rpc", worker: { type: "binding", binding: "AI" } },
});
await itx.ai.models();

// the same binding through the thin policy wrapper (itx-next §2 pattern)
await itx.caps.define({
  invoke: "path-call",
  name: "aiWrapped",
  target: { type: "rpc", worker: { type: "loopback" }, entrypoint: "BindingCapability", props: { binding: "AI" } },
});
```

- `registry.borrowTarget()` is the two-case switch the design promised:
live table, or resolve the stored target.
- Implemented worker refs: `binding`, `loopback`, `source` (the old
worker/facet paths, unchanged underneath). `url` / `durable-object` /
`project-worker` fail with informative not-implemented errors **at
define time**.
- `BindingCapability`: new loopback entrypoint, the thin policy wrapper
for bindings — gateway/quota policy slots in there later.
- `kind: "facet"` is gone from the API (legacy input still accepted):
statefulness is `source.exportType: "worker-entrypoint" |
"durable-object"`. `cacheKey` replaces `codeId` (deprecated alias kept).
- `CapMeta` is open metadata with the `instructions` convention, lifted
into `describe()` output.

## Security

`binding` and `loopback` refs reach **platform** resources (an open list
would let any project handle reach the deployment D1, or mint itx
handles on arbitrary projects via ItxEntrypoint props). They are gated
on hardcoded allowlists — `DIALABLE_BINDINGS = {AI}`,
`DIALABLE_LOOPBACKS = {BindingCapability}` — checked at define time
(fail fast) and again at dial time (authoritative). `BindingCapability`
re-checks the binding allowlist itself since its props are
definer-controlled. Config-driven lists are a follow-up.

## Compatibility

- `caps.define({ source, kind: "worker" | "facet" })` still works —
normalizes to an rpc/source target.
- Stored rows from before this PR (kind worker/facet + source_json)
normalize on read; new rows also write `source_json` for source targets
so a rollback can still read them. New `target_json` column added via
guarded ALTER.
- `describe()` now reports `kind: "rpc"` for stored-source caps (e2e
assertion updated).

## Testing

- `pnpm typecheck` / `lint` / `format` / `test` (190 unit tests) all
green.
- **Full `pnpm e2e:itx` suite ran green against a live deployment** (19
tests, 5 files, via the dev_jonas tunnel serving this branch):
`itx.ai.models()` through the real AI binding raw + wrapped, allowlist
refusals, and all pre-existing egress/facet/fork/HTTP tests — no
regressions.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **High Risk**
> Introduces platform binding and loopback dialing gated only on small
hardcoded allowlists; misconfiguration or future allowlist expansion
could expose env bindings like D1 or arbitrary loopback exports to
project handles.
> 
> **Overview**
> **Capabilities are now a name plus a typed `SerializableCapTarget`**,
not legacy `source` + `kind: worker | facet`. `caps.define` accepts
`target` (e.g. `rpc` with `binding`, `loopback`, or `source` worker
refs); old `source`/`kind` input still normalizes to `rpc`/`source`.
> 
> **Registry dispatch** is refactored to the two-case model: live
in-memory connections, or `resolveTarget()` at invoke time for stored
targets. SQLite gains `target_json` (with legacy row normalization via
`targetOf()`); `describe()` reports `kind: "rpc"` and lifts
`meta.instructions`.
> 
> **Platform binding exposure** adds `BindingCapability` (loopback
path-call wrapper), host `binding` resolvers on Project/Context DOs, and
**allowlists** `DIALABLE_BINDINGS` / `DIALABLE_LOOPBACKS` enforced at
define and dial time.
> 
> **Protocol updates**: `CapKind` becomes `live | rpc | url`; `cacheKey`
replaces `codeId`; `exportType` replaces facet kind; `url` /
`project-worker` / `durable-object` refs fail at define time until
implemented.
> 
> **E2E** covers raw `AI` binding caps, wrapped `BindingCapability`, and
allowlist rejections.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
13ab9e5. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

<!-- CLOUDFLARE_PREVIEW -->
## Environment Config Lease
<!-- CLOUDFLARE_PREVIEW_STATE -->
<!--
{
  "apps": {
    "os": {
      "appDisplayName": "OS",
      "appSlug": "os",
      "status": "deployed",
      "updatedAt": "2026-06-10T12:11:14.008Z",
      "headSha": "13ab9e5ccc39a1348d29b74fd55086747b727bd6",
      "message": null,
      "publicUrl": "https://os.iterate-preview-2.com",
"runUrl": "https://github.com/iterate/iterate/actions/runs/27275038072",
      "shortSha": "13ab9e5"
    }
  },
  "environmentConfigLease": {
    "dopplerConfig": "preview_2",
    "leasedUntil": 1781096892787,
    "leaseId": "f42f975c-7672-4369-bcb7-2db7a29b7c06",
    "slug": "preview-2",
    "type": "environment-config-lease"
  }
}
-->
<!-- /CLOUDFLARE_PREVIEW_STATE -->
Lease: `preview-2`
Doppler config: `preview_2`
Type: `environment-config-lease`
Leased until: 2026-06-10T13:08:12.787Z

### OS
Status: deployed
Commit: `13ab9e5`
Preview: https://os.iterate-preview-2.com
[Workflow
run](https://github.com/iterate/iterate/actions/runs/27275038072)
Updated: 2026-06-10T12:11:14.008Z
<!-- /CLOUDFLARE_PREVIEW -->

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>