feat: deliver module database ABI by manifest

core/src/modules/runtime.ts

@@ -1,5 +1,6 @@
 import { pathToFileURL } from "node:url";
 import {
+  type AnyModuleRuntimeServices,
   type CapabilityId,
   type CapabilityRegistrar,
   type CapabilityResolver,
@@ -7,12 +8,15 @@ import {
   EMPTY_MODULE_CONFIGURATION,
   EMPTY_MODULE_STORAGE,
   type ModuleConfiguration,
+  type ModuleDatabase,
+  type ModuleDatabaseExecutor,
   type ModuleHttpRouteRegistrar,
   type ModuleId,
   ModuleRealtimeError,
   type ModuleRealtimePublisher,
   type ModuleRegistrationContext,
   type ModuleRouteDefinitionInput,
+  type ModuleRouteHandler,
   type ModuleRuntimeContext,
   type ModuleRuntimeDefinition,
   type ModuleRuntimeServices,
@@ -68,6 +72,7 @@ export type ModuleRuntimeIssueCode =
   | "MODULE_ROUTE_PERMISSION_INVALID"
   | "MODULE_ROUTE_PERMISSION_UNDECLARED"
   | "MODULE_RUNTIME_EXPORT_INVALID"
+  | "MODULE_RUNTIME_DATABASE_MISMATCH"
   | "MODULE_RUNTIME_ID_MISMATCH"
   | "MODULE_RUNTIME_IMPORT_FAILED"
   | "MODULE_RUNTIME_VERSION_MISMATCH"
@@ -105,9 +110,8 @@ export interface StartedModuleRuntime {
 /**
  * Per-module frozen configuration snapshots, keyed by module id (ADR 0029).
  *
- * A lookup rather than a field on `ModuleRuntimeServices`, because `services` is deliberately **one
- * shared object identity every module receives** — a property this runtime has a test for — while
- * configuration is per-module by definition. A module with no entry receives
+ * A lookup rather than a field on `ModuleRuntimeServices`, because configuration is resolved and
+ * frozen per module independently of its live service object. A module with no entry receives
  * `EMPTY_MODULE_CONFIGURATION` rather than `undefined`, so `context.config` is always present and
  * module code never branches on whether the platform supplied one.
  */
@@ -124,12 +128,33 @@ function configurationFor(
  * Per-module scoped object storage, keyed by module id (ADR 0030).
  *
  * A lookup for the same reason configuration is one, and emphatically **not** a field on
- * `ModuleRuntimeServices`: `services` is one shared object identity every module receives, while a
- * storage facade is scoped to exactly the buckets one module declared. Sharing it would hand every
+ * `ModuleRuntimeServices`: a storage facade is scoped to exactly the buckets one module declared.
+ * Sharing it would hand every
  * module every other module's storage.
  */
 export type ModuleStorageLookup = ReadonlyMap<string, ModuleStorage>;
 
+/** One frozen service object per module id. Legacy modules may point at objects wrapping the same
+ * facade; ABI-v1 modules each point at their own attributed executor. */
+export type ModuleRuntimeServicesLookup = ReadonlyMap<string, AnyModuleRuntimeServices>;
+export type ModuleRuntimeServicesSource = ModuleRuntimeServicesLookup | ModuleRuntimeServices;
+
+function servicesFor(
+  services: ModuleRuntimeServicesSource,
+  module: DiscoveredModule,
+): AnyModuleRuntimeServices {
+  const selected = "get" in services ? services.get(module.manifest.id) : services;
+  if (!selected) {
+    throw new TypeError(`Module ${module.manifest.id} has no runtime services.`);
+  }
+  const expectsAbi = module.manifest.database?.abi === 1;
+  const isAbi = "abiVersion" in selected.database && selected.database.abiVersion === 1;
+  if (expectsAbi !== isAbi) {
+    throw new TypeError(`Module ${module.manifest.id} has the wrong database service.`);
+  }
+  return selected;
+}
+
 function storageFor(storages: ModuleStorageLookup, moduleId: string): ModuleStorage {
   return storages.get(moduleId) ?? EMPTY_MODULE_STORAGE;
 }
@@ -164,10 +189,9 @@ export interface ModuleRuntimeCompositionOptions extends ModuleRuntimeTimeoutOpt
 export interface StartModuleRuntimeOptions
   extends ModuleDiscoveryOptions,
     ModuleRuntimeCompositionOptions {
-  /** The same frozen services object every started module's `start`/`stop` hooks and (once
-   * `apps/api` mounts routes) HTTP handlers receive for this runtime — a required production
-   * dependency, never an optional test-only global. See `ModuleRuntimeServices`. */
-  readonly services: ModuleRuntimeServices;
+  /** The manifest-selected service object for each module. One module's `start`/`stop` hooks and
+   * handlers receive its same entry; ABI-v1 entries carry distinct attributed executors. */
+  readonly services: ModuleRuntimeServicesSource;
 }
 
 interface LoadedModule {
@@ -175,6 +199,13 @@ interface LoadedModule {
   readonly discovered: DiscoveredModule;
 }
 
+type AnyRegistrationHook = (
+  context: ModuleRegistrationContext<ModuleDatabase | ModuleDatabaseExecutor>,
+) => unknown;
+type AnyRuntimeHook = (
+  context: ModuleRuntimeContext<ModuleDatabase | ModuleDatabaseExecutor>,
+) => unknown;
+
 interface CapabilityRegistrationStage {
   readonly capabilities: CapabilityRegistrar;
   commit(): readonly ModuleRuntimeIssue[];
@@ -469,7 +500,7 @@ class StagedModuleHttpRoutes {
         local.push(
           Object.freeze({
             bodyMode: parsed.data.bodyMode,
-            handler: parsed.data.handler,
+            handler: parsed.data.handler as ModuleRouteHandler,
             maxBodyBytes: parsed.data.maxBodyBytes,
             method: parsed.data.method,
             moduleId: module.manifest.id,
@@ -555,6 +586,19 @@ async function loadRuntimeDefinitions(
         ),
       );
     }
+    const runtimeDeclaresAbi = definition.database?.abi === 1;
+    const manifestDeclaresAbi = discovered.manifest.database?.abi === 1;
+    if (runtimeDeclaresAbi !== manifestDeclaresAbi) {
+      matchesManifest = false;
+      issues.push(
+        runtimeIssue(
+          "MODULE_RUNTIME_DATABASE_MISMATCH",
+          "load",
+          discovered.manifest.id,
+          `Module runtime database declaration does not match manifest ${discovered.manifest.id}.`,
+        ),
+      );
+    }
     if (matchesManifest) {
       loaded.push({ definition, discovered });
     }
@@ -580,15 +624,15 @@ async function registerModules(
       module.discovered.manifest.id,
       new Set(module.discovered.manifest.permissions.map((declaration) => declaration.id)),
     );
-    const context: ModuleRegistrationContext = Object.freeze({
+    const context = Object.freeze({
       capabilities: capabilityStage.capabilities,
       config: configurationFor(configurations, module.discovered.manifest.id),
       http: routeStage.http,
       moduleId: module.discovered.manifest.id,
       realtime: realtimeStage.realtime,
-    });
+    }) as ModuleRegistrationContext<ModuleDatabase | ModuleDatabaseExecutor>;
     try {
-      await module.definition.register?.(context);
+      await (module.definition.register as AnyRegistrationHook | undefined)?.(context);
     } catch (error) {
       if (error instanceof ModuleRuntimeSignal) {
         throw new ModuleRuntimeError([error.issue]);
@@ -685,7 +729,7 @@ async function stopModules(
   modules: readonly LoadedModule[],
   registry: StagedCapabilityRegistry,
   phase: "rollback" | "stop",
-  services: ModuleRuntimeServices,
+  services: ModuleRuntimeServicesSource,
   configurations: ModuleConfigurationLookup,
   storages: ModuleStorageLookup,
   realtimeRegistry: StagedModuleRealtimeRegistry,
@@ -698,7 +742,7 @@ async function stopModules(
     // A dependency may keep doing ordinary work while its dependents stop. Deactivate only the
     // module whose stop hook is about to run, not every publisher at the beginning of the sequence.
     realtimeRegistry.deactivateModule(moduleId);
-    const stop = module.definition.stop;
+    const stop = module.definition.stop as AnyRuntimeHook | undefined;
     if (!stop) {
       // No synthetic callback and no timer for a module that declares no stop hook.
       continue;
@@ -710,13 +754,13 @@ async function stopModules(
             registry.createRuntimeContext(
               module.discovered,
               phase,
-              services,
+              servicesFor(services, module.discovered) as ModuleRuntimeServices,
               configurationFor(configurations, moduleId),
               storageFor(storages, moduleId),
               realtimeRegistry.publisherFor(moduleId),
-            ),
+            ) as ModuleRuntimeContext<ModuleDatabase | ModuleDatabaseExecutor>,
           ),
-        ),
+        ).then(() => undefined),
         timeoutMs,
       );
       if (outcome === "timed-out") {
@@ -750,7 +794,7 @@ async function stopModules(
 async function startModules(
   modules: readonly LoadedModule[],
   registry: StagedCapabilityRegistry,
-  services: ModuleRuntimeServices,
+  services: ModuleRuntimeServicesSource,
   configurations: ModuleConfigurationLookup,
   storages: ModuleStorageLookup,
   realtimeRegistry: StagedModuleRealtimeRegistry,
@@ -766,15 +810,15 @@ async function startModules(
   for (const module of modules) {
     rollbackCandidates.push(module);
     try {
-      await module.definition.start?.(
+      await (module.definition.start as AnyRuntimeHook | undefined)?.(
         registry.createRuntimeContext(
           module.discovered,
           "start",
-          services,
+          servicesFor(services, module.discovered) as ModuleRuntimeServices,
           configurationFor(configurations, module.discovered.manifest.id),
           storageFor(storages, module.discovered.manifest.id),
           realtimeRegistry.publisherFor(module.discovered.manifest.id),
-        ),
+        ) as ModuleRuntimeContext<ModuleDatabase | ModuleDatabaseExecutor>,
       );
       const missingSnapshots = realtimeRegistry.missingSnapshots(module.discovered.manifest.id);
       if (missingSnapshots.length > 0) {
@@ -831,7 +875,7 @@ async function startModules(
  */
 export async function startDiscoveredModuleRuntime(
   discoveredModules: readonly DiscoveredModule[],
-  services: ModuleRuntimeServices,
+  services: ModuleRuntimeServicesSource,
   timeouts: ModuleRuntimeCompositionOptions = {},
 ): Promise<StartedModuleRuntime> {
   const modules = await loadRuntimeDefinitions(discoveredModules);