space-data-module-sdk 0.8.4 → 0.8.5

package/src/compliance/pluginCompliance.js

@@ -21,6 +21,21 @@ import {
   decodePlgManifest,
   isPlgManifestBuffer,
 } from "../manifest/plgCodec.js";
+import {
+  isPayloadSchemaHashValid,
+  payloadSchemaIdentitiesEqual,
+} from "../manifest/typeRefs.js";
+import { isLegacyWildcardPort } from "./legacyWildcardPorts.js";
+import { SDS_MANIFEST_SECTION_NAME } from "../bundle/constants.js";
+import {
+  decodeUnsignedLeb128,
+  getWasmCustomSections,
+  parseWasmModuleSections,
+} from "../bundle/wasm.js";
+import {
+  extractPublicationRecordCollection,
+  stripPublicationRecordCollection,
+} from "../transport/records.js";
 
 const RecommendedCapabilitySet = new Set(RecommendedCapabilityIds);
 const StandaloneWasiCapabilitySet = new Set(StandaloneWasiCapabilityIds);
@@ -42,7 +57,6 @@ const BrowserIncompatibleCapabilitySet = new Set([
   "mqtt",
   "tls",
   "database",
-  "storage_adapter",
   "storage_write",
   "protocol_dial",
   "protocol_handle",
@@ -97,57 +111,6 @@ function hasNonEmptyByteSequence(value) {
   return false;
 }
 
-function normalizeTypeIdentityString(value) {
-  if (!isNonEmptyString(value)) {
-    return null;
-  }
-  return value.trim().toLowerCase();
-}
-
-function normalizeTypeIdentityBytes(value) {
-  if (typeof value === "string") {
-    const trimmed = value.trim().toLowerCase();
-    return trimmed.length > 0 ? trimmed : null;
-  }
-  const bytes = ArrayBuffer.isView(value)
-    ? Array.from(value)
-    : Array.isArray(value)
-      ? value
-      : null;
-  if (!bytes || bytes.length === 0) {
-    return null;
-  }
-  return bytes
-    .map((entry) => Number(entry).toString(16).padStart(2, "0"))
-    .join("");
-}
-
-function allowedTypesReferToSameLogicalSchema(left, right) {
-  const leftSchemaName = normalizeTypeIdentityString(left?.schemaName);
-  const rightSchemaName = normalizeTypeIdentityString(right?.schemaName);
-  if (leftSchemaName && rightSchemaName && leftSchemaName === rightSchemaName) {
-    return true;
-  }
-
-  const leftFileIdentifier = normalizeTypeIdentityString(left?.fileIdentifier);
-  const rightFileIdentifier = normalizeTypeIdentityString(right?.fileIdentifier);
-  if (
-    leftFileIdentifier &&
-    rightFileIdentifier &&
-    leftFileIdentifier === rightFileIdentifier
-  ) {
-    return true;
-  }
-
-  const leftSchemaHash = normalizeTypeIdentityBytes(left?.schemaHash);
-  const rightSchemaHash = normalizeTypeIdentityBytes(right?.schemaHash);
-  if (leftSchemaHash && rightSchemaHash && leftSchemaHash === rightSchemaHash) {
-    return true;
-  }
-
-  return false;
-}
-
 function normalizePayloadWireFormatName(value) {
   if (value === undefined || value === null || value === "") {
     return "flatbuffer";
@@ -319,6 +282,263 @@ function normalizeProtocolRole(value) {
   return normalized;
 }
 
+/* ------------------------------------------------------------------------- *
+ * WILDCARD PORT BOUNDARY — ruled 2026-07-29 (P1 `upstream-module-sdk-1`).
+ *
+ * `acceptsAnyFlatbuffer` is a wildcard: the port declares that it does not know
+ * its payload's SDS identity. Both halves of that are real, so the boundary is
+ * mechanical, not editorial:
+ *
+ *  TIER A — PERMITTED, nothing to declare. The manifest PROVES it is
+ *    application-blind at the HOST boundary: it declares an `externalInterfaces`
+ *    entry of kind `host-service` whose `capability` it also declares in
+ *    `capabilities`. Such a port's payload is defined by a HOST OP, not by SDS
+ *    (`hostcap/http-request`, `storage-ingest`, `clock`, `random`, `file`,
+ *    `flatsql-query`, `p2p-discovery`, `data-source/retrieval`'s polymorphic row
+ *    stream). Compiled flows inherit their dependencies' host-service interfaces,
+ *    so the flow compiler's OWN synthesized wildcard ports (wildcardPortDefinition)
+ *    validate here with no change to compiler output and no artifact hash churn.
+ *
+ *  TIER B — PERMITTED when justified. A schema-aware module with a genuinely
+ *    untyped port declares `acceptedTypeSet.wildcardJustification = {kind, detail,
+ *    mediaType?}`, mirroring `sequentialJustification`: closed kind enum, each
+ *    kind carrying a predicate this checker enforces, `detail` substantive, and
+ *    `mediaType` (foreign/control frames) rejected outright when it is
+ *    FlatBuffer/SDS-bearing — you cannot claim "no SDS identity" while carrying
+ *    an SDS record.
+ *
+ *  TIER C — WARNING. The (pluginId, methodId, direction, portId) is in the frozen
+ *    legacy ledger (`legacyWildcardPorts.js`): shipped and hash-frozen before this
+ *    rule existed. Shrink-only debt, not permission.
+ *
+ *  TIER D — ERROR `wildcard-port-type`, unchanged. This is what correctly forced
+ *    the CCSDS 124 codec (`capabilities: []`, `externalInterfaces: []`, not in the
+ *    ledger) to declare typed `$CPS`/`$SPP` ports instead of shipping a wildcard.
+ *
+ * TWO LIMITS, STATED RATHER THAN HIDDEN:
+ *
+ *  1. Tier A is MANIFEST-scoped, not port-scoped: one matching host-service
+ *     interface permits every wildcard port of every method in that manifest. So
+ *     adding a host-service capability is a THIRD exit from the legacy ledger
+ *     alongside "declare the type" and "declare a justification", and a product
+ *     module that later acquires one stops warning about ports that do carry an
+ *     SDS identity. Scoping Tier A to the methods that actually bind the
+ *     interface is tracked, not done here.
+ *  2. The Tier A proof lives only in the JSON manifest. `externalInterfaces` is
+ *     NOT representable in the embedded FlatBuffer manifest (see
+ *     `src/manifest/normalize.js`), so a verifier holding only the compiled
+ *     `.wasm` cannot reproduce this verdict — `capabilities` is embedded, the
+ *     interfaces are not.
+ * ------------------------------------------------------------------------- */
+
+export const WildcardJustificationKind = Object.freeze({
+  /** Payload is defined by a host capability op, not by SDS. */
+  HostBoundaryOpaque: "host-boundary-opaque",
+  /** Payload is an external, non-SDS wire format (CSV/TLE/vendor JSON/...). */
+  ForeignWireFormat: "foreign-wire-format",
+  /** Control frame produced and consumed inside one flow; never persisted. */
+  IntraFlowControlFrame: "intra-flow-control-frame",
+});
+
+const WildcardJustificationKindSet = new Set(
+  Object.values(WildcardJustificationKind),
+);
+
+const WildcardJustificationKindsRequiringMediaType = new Set([
+  WildcardJustificationKind.ForeignWireFormat,
+  WildcardJustificationKind.IntraFlowControlFrame,
+]);
+
+const WILDCARD_JUSTIFICATION_MIN_DETAIL_LENGTH = 24;
+
+const MediaTypePattern =
+  /^[A-Za-z0-9][A-Za-z0-9!#$&^_.+-]*\/[A-Za-z0-9][A-Za-z0-9!#$&^_.+-]*(?:;[\x20-\x7e]*)?$/;
+
+function mediaTypeCarriesSdsFlatbuffer(mediaType) {
+  const value = String(mediaType).toLowerCase();
+  return (
+    value.includes("flatbuffer") ||
+    value.startsWith("application/vnd.sds") ||
+    value.startsWith("application/vnd.spacedatastandards")
+  );
+}
+
+// "I decline to name the format" is the evasion the wildcard rule exists to
+// stop, so a justification that claims a FOREIGN wire format must name a
+// specific one. A catch-all media type says nothing a bare wildcard did not.
+const OpaqueMediaTypes = new Set([
+  "*/*",
+  "application/*",
+  "application/binary",
+  "application/octet-stream",
+  "application/x-binary",
+  "application/unknown",
+  "binary/octet-stream",
+]);
+
+function mediaTypeIsOpaque(mediaType) {
+  const value = String(mediaType).split(";")[0].trim().toLowerCase();
+  return OpaqueMediaTypes.has(value);
+}
+
+/**
+ * TIER A predicate. True when the manifest mechanically proves that its ports
+ * face a HOST capability op rather than an SDS identity.
+ *
+ * @param {unknown} manifest
+ * @returns {boolean}
+ */
+export function manifestDeclaresHostBoundaryBlindness(manifest) {
+  if (!manifest || typeof manifest !== "object" || Array.isArray(manifest)) {
+    return false;
+  }
+  const interfaces = manifest.externalInterfaces;
+  if (!Array.isArray(interfaces)) {
+    return false;
+  }
+  // Capabilities are legal in BOTH forms — a bare id string, or a host
+  // capability record — so compare against the normalized id, not the raw
+  // entry. Comparing raw made a record-form manifest fail Tier A.
+  const declaredCapabilities = (
+    Array.isArray(manifest.capabilities) ? manifest.capabilities : []
+  )
+    .map((capability) =>
+      isNonEmptyString(capability)
+        ? capability
+        : capability &&
+            typeof capability === "object" &&
+            !Array.isArray(capability) &&
+            isNonEmptyString(capability.capability)
+          ? capability.capability
+          : null,
+    )
+    .filter((capability) => capability !== null);
+  return interfaces.some(
+    (entry) =>
+      entry &&
+      typeof entry === "object" &&
+      !Array.isArray(entry) &&
+      entry.kind === ExternalInterfaceKind.HOST_SERVICE &&
+      isNonEmptyString(entry.capability) &&
+      declaredCapabilities.includes(entry.capability),
+  );
+}
+
+/**
+ * TIER B. Validates `acceptedTypeSet.wildcardJustification` and enforces its
+ * kind predicate.
+ *
+ * @returns {boolean} true when the justification permits the wildcard.
+ */
+function validateWildcardJustification(justification, issues, location, context) {
+  const declare =
+    'Declare acceptedTypeSet.wildcardJustification = { "kind": <one of ' +
+    [...WildcardJustificationKindSet].map((kind) => `"${kind}"`).join(", ") +
+    '>, "detail": "<why this payload has no SDS identity>" } (kinds ' +
+    `"${WildcardJustificationKind.ForeignWireFormat}" and ` +
+    `"${WildcardJustificationKind.IntraFlowControlFrame}" also require "mediaType").`;
+
+  if (
+    !justification ||
+    typeof justification !== "object" ||
+    Array.isArray(justification)
+  ) {
+    pushIssue(
+      issues,
+      "error",
+      "invalid-wildcard-justification",
+      `wildcardJustification must be an object, got ${
+        Array.isArray(justification) ? "an array" : typeof justification
+      }. ${declare}`,
+      `${location}.wildcardJustification`,
+    );
+    return false;
+  }
+
+  let valid = true;
+  const { kind, detail, mediaType } = justification;
+
+  if (!WildcardJustificationKindSet.has(kind)) {
+    pushIssue(
+      issues,
+      "error",
+      "invalid-wildcard-justification",
+      `wildcardJustification.kind ${JSON.stringify(kind)} is not recognised. ${declare}`,
+      `${location}.wildcardJustification.kind`,
+    );
+    valid = false;
+  }
+
+  if (
+    !isNonEmptyString(detail) ||
+    detail.trim().length < WILDCARD_JUSTIFICATION_MIN_DETAIL_LENGTH
+  ) {
+    pushIssue(
+      issues,
+      "error",
+      "invalid-wildcard-justification",
+      "wildcardJustification.detail must be a substantive explanation of at least " +
+        `${WILDCARD_JUSTIFICATION_MIN_DETAIL_LENGTH} characters naming the payload this port carries.`,
+      `${location}.wildcardJustification.detail`,
+    );
+    valid = false;
+  }
+
+  if (WildcardJustificationKindsRequiringMediaType.has(kind)) {
+    if (!isNonEmptyString(mediaType) || !MediaTypePattern.test(mediaType)) {
+      pushIssue(
+        issues,
+        "error",
+        "invalid-wildcard-justification",
+        `wildcardJustification.kind "${kind}" requires mediaType as a "type/subtype" media type naming the non-SDS payload.`,
+        `${location}.wildcardJustification.mediaType`,
+      );
+      valid = false;
+    } else if (mediaTypeCarriesSdsFlatbuffer(mediaType)) {
+      pushIssue(
+        issues,
+        "error",
+        "unsupported-wildcard-justification",
+        `wildcardJustification.mediaType "${mediaType}" is a FlatBuffer/SDS media type: a port carrying an SDS record must declare that record's concrete identity, not a wildcard.`,
+        `${location}.wildcardJustification.mediaType`,
+      );
+      valid = false;
+    } else if (mediaTypeIsOpaque(mediaType)) {
+      pushIssue(
+        issues,
+        "error",
+        "unsupported-wildcard-justification",
+        `wildcardJustification.mediaType "${mediaType}" is a catch-all: naming the SPECIFIC non-SDS format the port carries is the entire point of this justification kind.`,
+        `${location}.wildcardJustification.mediaType`,
+      );
+      valid = false;
+    }
+  } else if (mediaType !== undefined) {
+    validateOptionalStringField(
+      issues,
+      mediaType,
+      `${location}.wildcardJustification.mediaType`,
+      "wildcardJustification mediaType",
+    );
+  }
+
+  if (
+    kind === WildcardJustificationKind.HostBoundaryOpaque &&
+    context?.hostBoundaryBlind !== true
+  ) {
+    pushIssue(
+      issues,
+      "error",
+      "unsupported-wildcard-justification",
+      `wildcardJustification.kind "${WildcardJustificationKind.HostBoundaryOpaque}" requires the manifest to declare an externalInterfaces entry of kind "${ExternalInterfaceKind.HOST_SERVICE}" whose capability is also declared in manifest.capabilities.`,
+      `${location}.wildcardJustification.kind`,
+    );
+    valid = false;
+  }
+
+  return valid;
+}
+
 function validateAllowedType(type, issues, location) {
   if (!type || typeof type !== "object" || Array.isArray(type)) {
     pushIssue(issues, "error", "invalid-type-record", "Allowed type entries must be objects.", location);
@@ -335,6 +555,27 @@ function validateAllowedType(type, issues, location) {
     );
     return;
   }
+  if (!isPayloadSchemaHashValid(type.schemaHash)) {
+    pushIssue(
+      issues,
+      "error",
+      "invalid-schema-hash",
+      "Allowed type schemaHash must be an even-length hexadecimal string or a byte sequence containing only integers from 0 through 255.",
+      `${location}.schemaHash`,
+    );
+  }
+  if (
+    isNonEmptyString(type.fileIdentifier) &&
+    !/^[\x20-\x7e]{4}$/.test(type.fileIdentifier)
+  ) {
+    pushIssue(
+      issues,
+      "error",
+      "invalid-file-identifier",
+      "Allowed type fileIdentifier must contain exactly four printable ASCII bytes.",
+      `${location}.fileIdentifier`,
+    );
+  }
   if (wireFormat === "aligned-binary") {
     if (type.acceptsAnyFlatbuffer === true) {
       pushIssue(
@@ -354,6 +595,15 @@ function validateAllowedType(type, issues, location) {
         `${location}.schemaName`,
       );
     }
+    if (!isNonEmptyString(type.fileIdentifier)) {
+      pushIssue(
+        issues,
+        "error",
+        "missing-aligned-file-identifier",
+        "Aligned-binary allowed types must declare fileIdentifier.",
+        `${location}.fileIdentifier`,
+      );
+    }
     if (!isNonEmptyString(type.rootTypeName)) {
       pushIssue(
         issues,
@@ -363,27 +613,63 @@ function validateAllowedType(type, issues, location) {
         `${location}.rootTypeName`,
       );
     }
+    validateOptionalStringField(
+      issues,
+      type.schemaVersion,
+      `${location}.schemaVersion`,
+      "Allowed type schemaVersion",
+    );
     validateOptionalIntegerField(
       issues,
       type.fixedStringLength,
       `${location}.fixedStringLength`,
       "Allowed type fixedStringLength",
-      { min: 0 },
+      { min: 0, max: 0xffff },
     );
+    // byteLength DECLARES A FIXED RECORD STRIDE. It is optional, because
+    // "aligned-binary" carries two distinct shapes and only one of them has a
+    // stride:
+    //
+    //   fixed record  — byteLength = N: every frame is exactly N bytes, so the
+    //                   shared arena can be indexed by stride and the frame size
+    //                   is checked against it.
+    //   aligned stream — byteLength absent: a variable-length run of bytes that
+    //                   must START on requiredAlignment (a size-prefixed
+    //                   FlatBuffer segment, a JSON control frame, an opaque byte
+    //                   route). There is no stride to declare and inventing one
+    //                   would be a false claim.
+    //
+    // Requiring it made the second shape inexpressible while 149 declarations
+    // across the shipped module fleet used exactly that shape — every flow that
+    // contained one failed `flow check` with "byteLength must be an integer".
+    // requiredAlignment stays MANDATORY: it is the property that makes the
+    // frame placeable in the arena at all.
     validateOptionalIntegerField(
       issues,
       type.byteLength,
       `${location}.byteLength`,
       "Aligned-binary allowed type byteLength",
-      { min: 1 },
+      { min: 1, max: 0xffffffff },
     );
-    validateIntegerField(
+    const alignmentValid = validateIntegerField(
       issues,
       type.requiredAlignment,
       `${location}.requiredAlignment`,
       "Aligned-binary allowed type requiredAlignment",
-      { min: 1 },
+      { min: 1, max: 0xffff },
     );
+    if (
+      alignmentValid &&
+      !Number.isInteger(Math.log2(type.requiredAlignment))
+    ) {
+      pushIssue(
+        issues,
+        "error",
+        "invalid-aligned-layout",
+        "Aligned-binary requiredAlignment must be a power of two.",
+        `${location}.requiredAlignment`,
+      );
+    }
     return;
   }
   if (type.acceptsAnyFlatbuffer === true) {
@@ -402,30 +688,63 @@ function validateAllowedType(type, issues, location) {
       location,
     );
   }
+  if (!isNonEmptyString(type.schemaName)) {
+    pushIssue(
+      issues,
+      "error",
+      "missing-canonical-schema-name",
+      "Canonical FlatBuffer allowed types must declare schemaName.",
+      `${location}.schemaName`,
+    );
+  }
+  if (!isNonEmptyString(type.fileIdentifier)) {
+    pushIssue(
+      issues,
+      "error",
+      "missing-canonical-file-identifier",
+      "Canonical FlatBuffer allowed types must declare fileIdentifier.",
+      `${location}.fileIdentifier`,
+    );
+  }
+  if (!isNonEmptyString(type.rootTypeName)) {
+    pushIssue(
+      issues,
+      "error",
+      "missing-canonical-root-type-name",
+      "Canonical FlatBuffer allowed types must declare rootTypeName.",
+      `${location}.rootTypeName`,
+    );
+  }
+  validateOptionalStringField(
+    issues,
+    type.schemaVersion,
+    `${location}.schemaVersion`,
+    "Allowed type schemaVersion",
+  );
   validateOptionalIntegerField(
     issues,
     type.fixedStringLength,
     `${location}.fixedStringLength`,
     "Allowed type fixedStringLength",
-    { min: 0 },
+    { min: 0, max: 0xffff },
   );
   validateOptionalIntegerField(
     issues,
     type.byteLength,
     `${location}.byteLength`,
     "Allowed type byteLength",
-    { min: 0 },
+    { min: 0, max: 0xffffffff },
   );
   validateOptionalIntegerField(
     issues,
     type.requiredAlignment,
     `${location}.requiredAlignment`,
     "Allowed type requiredAlignment",
-    { min: 0 },
+    { min: 0, max: 0xffff },
   );
 }
 
-function validateAcceptedTypeSet(typeSet, issues, location) {
+function validateAcceptedTypeSet(typeSet, issues, location, context) {
   if (!typeSet || typeof typeSet !== "object" || Array.isArray(typeSet)) {
     pushIssue(issues, "error", "invalid-type-set", "Accepted type sets must be objects.", location);
     return;
@@ -445,8 +764,9 @@ function validateAcceptedTypeSet(typeSet, issues, location) {
     validateAllowedType(allowedType, issues, `${location}.allowedTypes[${index}]`);
   });
 
-  const regularConcreteTypes = [];
+  const canonicalTypes = [];
   const alignedTypes = [];
+  const wildcardTypes = [];
 
   typeSet.allowedTypes.forEach((allowedType, index) => {
     const wireFormat = normalizePayloadWireFormatName(allowedType?.wireFormat);
@@ -454,28 +774,167 @@ function validateAcceptedTypeSet(typeSet, issues, location) {
       alignedTypes.push({ allowedType, index });
       return;
     }
-    if (wireFormat === "flatbuffer" && allowedType?.acceptsAnyFlatbuffer !== true) {
-      regularConcreteTypes.push({ allowedType, index });
+    if (wireFormat === "flatbuffer" && allowedType?.acceptsAnyFlatbuffer === true) {
+      wildcardTypes.push({ allowedType, index });
+      return;
+    }
+    if (wireFormat === "flatbuffer") {
+      canonicalTypes.push({ allowedType, index });
     }
   });
 
-  alignedTypes.forEach(({ allowedType, index }) => {
-    const hasRegularFallback = regularConcreteTypes.some(({ allowedType: regularType }) =>
-      allowedTypesReferToSameLogicalSchema(allowedType, regularType),
-    );
-    if (!hasRegularFallback) {
+  const declaredWireFormats =
+    typeSet.allowedWireFormats ??
+    typeSet.allowed_wire_formats ??
+    typeSet.ALLOWED_WIRE_FORMATS;
+  if (declaredWireFormats !== undefined) {
+    const normalized = Array.isArray(declaredWireFormats)
+      ? declaredWireFormats.map(normalizePayloadWireFormatName)
+      : [];
+    const unique = new Set(normalized);
+    if (
+      !Array.isArray(declaredWireFormats) ||
+      normalized.some((value) => value === null) ||
+      normalized.length !== 2 ||
+      unique.size !== 2 ||
+      !unique.has("flatbuffer") ||
+      !unique.has("aligned-binary")
+    ) {
+      pushIssue(
+        issues,
+        "error",
+        "allowed-wire-formats-mismatch",
+        "acceptedTypeSet.allowedWireFormats, when present, must declare exactly flatbuffer and aligned-binary to match the required type pair.",
+        `${location}.allowedWireFormats`,
+      );
+    }
+  }
+
+  if (wildcardTypes.length > 0) {
+    // See "WILDCARD PORT BOUNDARY" above: Tier A permitted, Tier B justified,
+    // Tier C frozen legacy debt (warning), Tier D error.
+    const hostBoundaryBlind = context?.hostBoundaryBlind === true;
+    const hasJustification = typeSet.wildcardJustification !== undefined;
+    let permitted = hostBoundaryBlind;
+
+    if (hasJustification) {
+      // A declared justification is ALWAYS validated, even when Tier A would
+      // have permitted the wildcard anyway — a malformed one is an error, never
+      // a silent pass.
+      permitted =
+        validateWildcardJustification(
+          typeSet.wildcardJustification,
+          issues,
+          location,
+          context,
+        ) || permitted;
+    }
+
+    if (!permitted) {
+      const legacy =
+        context?.allowLegacyWildcards !== false &&
+        isLegacyWildcardPort(
+          context?.pluginId,
+          context?.methodId,
+          context?.direction,
+          context?.portId,
+        );
+      wildcardTypes.forEach(({ index }) => {
+        if (legacy) {
+          pushIssue(
+            issues,
+            "warning",
+            "legacy-wildcard-port-type",
+            `Port "${context?.portId}" carries a wildcard (acceptsAnyFlatbuffer) that was frozen into a shipped artifact before the wildcard-port boundary landed. It is grandfathered, not permitted: declare the concrete SDS identity, or declare acceptedTypeSet.wildcardJustification, at the next rebuild.`,
+            `${location}.allowedTypes[${index}]`,
+          );
+          return;
+        }
+        pushIssue(
+          issues,
+          "error",
+          "wildcard-port-type",
+          "PLG input and output ports must declare one concrete SDS identity with canonical and aligned-binary peers; acceptsAnyFlatbuffer is not permitted.",
+          `${location}.allowedTypes[${index}]`,
+        );
+      });
+    }
+  }
+
+  if (canonicalTypes.length === 0 && alignedTypes.length > 0) {
+    alignedTypes.forEach(({ index }) => {
       pushIssue(
         issues,
         "error",
         "missing-flatbuffer-fallback",
-        "Aligned-binary allowed types must be paired with a regular flatbuffer fallback for the same schema in the same acceptedTypeSet.",
+        "Aligned-binary allowed types must be paired with a canonical FlatBuffer peer for the same SDS identity in the same acceptedTypeSet.",
+        `${location}.allowedTypes[${index}]`,
+      );
+    });
+  }
+
+  // THE ALIGNED PEER IS AN OPTIMIZATION, NOT A CONFORMANCE OBLIGATION.
+  //
+  // An aligned-binary type asserts a FIXED layout, and `byteLength` is not
+  // descriptive metadata about it — it is the exact frame size the compiled
+  // router enforces (flow_runtime.cpp route_output rejects any frame where
+  // `out.length != edge.aligned_byte_length`). Most SDS records are
+  // variable-length: $OEM carries EPHEMERIS_DATA_BLOCK[], $OMM/$OCM/$OBD/$ACW
+  // are likewise unbounded. There is no honest number to write for them.
+  // Writing one anyway is a lie the runtime enforces; writing 0 produces an
+  // edge that rejects every frame it is given.
+  //
+  // Requiring an aligned peer on EVERY canonical type therefore forced every
+  // hand-written manifest to declare a layout it could not honour, and then
+  // failed it for declaring it incompletely — which is why no shipped manifest
+  // in space-data-network-modules passed. (The declarations were inert anyway:
+  // the flow compiler only sets alignedEligible when BOTH ends supply a
+  // complete layout, so every OD app edge already compiled alignedEligible
+  // false.)
+  //
+  // Ruled: a canonical-only accepted type set is LEGAL. Declaring the aligned
+  // peer is opt-in, and once declared it must be COMPLETE — byteLength and a
+  // power-of-two requiredAlignment, both still errors above. The converse
+  // stays an error too: an aligned type without a canonical fallback has no
+  // way to cross a boundary that cannot take the shared arena.
+  if (alignedTypes.length === 0 && canonicalTypes.length > 0) {
+    canonicalTypes.forEach(({ index }) => {
+      pushIssue(
+        issues,
+        "warning",
+        "no-aligned-peer",
+        "Canonical FlatBuffer allowed type declares no aligned-binary peer, so this port never takes the shared-arena zero-copy route. That is correct for a variable-length record; declare the peer (with its exact byteLength) only if the record has a FIXED aligned layout.",
         `${location}.allowedTypes[${index}]`,
       );
+    });
+  }
+
+  if (canonicalTypes.length > 1 || alignedTypes.length > 1) {
+    pushIssue(
+      issues,
+      "error",
+      "invalid-representation-pair-count",
+      "Each accepted type set must contain exactly one canonical FlatBuffer type and one aligned-binary peer.",
+      `${location}.allowedTypes`,
+    );
+  }
+
+  if (canonicalTypes.length === 1 && alignedTypes.length === 1) {
+    const canonicalType = canonicalTypes[0].allowedType;
+    const alignedType = alignedTypes[0].allowedType;
+    if (!payloadSchemaIdentitiesEqual(canonicalType, alignedType)) {
+      pushIssue(
+        issues,
+        "error",
+        "paired-type-identity-mismatch",
+        "Canonical FlatBuffer and aligned-binary peers must declare identical schemaName, fileIdentifier, rootTypeName, and schemaVersion/schemaHash when present.",
+        location,
+      );
     }
-  });
+  }
 }
 
-function validatePort(port, issues, location, label) {
+function validatePort(port, issues, location, label, context) {
   if (!port || typeof port !== "object" || Array.isArray(port)) {
     pushIssue(issues, "error", "invalid-port", `${label} entries must be objects.`, location);
     return;
@@ -490,8 +949,22 @@ function validatePort(port, issues, location, label) {
       `${location}.acceptedTypeSets`,
     );
   } else {
+    if (port.acceptedTypeSets.length !== 1) {
+      pushIssue(
+        issues,
+        "error",
+        "invalid-accepted-type-set-count",
+        `${label} must declare exactly one acceptedTypeSet containing its canonical and aligned-binary representation pair.`,
+        `${location}.acceptedTypeSets`,
+      );
+    }
     port.acceptedTypeSets.forEach((typeSet, index) => {
-      validateAcceptedTypeSet(typeSet, issues, `${location}.acceptedTypeSets[${index}]`);
+      validateAcceptedTypeSet(
+        typeSet,
+        issues,
+        `${location}.acceptedTypeSets[${index}]`,
+        { ...context, portId: port.portId },
+      );
     });
   }
   const minStreamsValid = validateIntegerField(
@@ -1088,8 +1561,171 @@ function validateInvokeSurfaces(invokeSurfaces, issues, sourceName) {
   return normalized;
 }
 
+function validateFlowGraph(manifest, issues, sourceName) {
+  const arrayFields = [
+    ["flowNodes", "invalid-flow-nodes-array"],
+    ["flowEdges", "invalid-flow-edges-array"],
+    ["flowTriggers", "invalid-flow-triggers-array"],
+    ["flowTriggerBindings", "invalid-flow-trigger-bindings-array"],
+  ];
+  for (const [field, code] of arrayFields) {
+    if (manifest[field] !== undefined && !Array.isArray(manifest[field])) {
+      pushIssue(
+        issues,
+        "error",
+        code,
+        `manifest.${field} must be an array when present.`,
+        `${sourceName}.${field}`,
+      );
+    }
+  }
+
+  const nodeIds = new Set();
+  for (const [index, node] of (Array.isArray(manifest.flowNodes)
+    ? manifest.flowNodes
+    : []).entries()) {
+    const location = `${sourceName}.flowNodes[${index}]`;
+    if (!node || typeof node !== "object" || Array.isArray(node)) {
+      pushIssue(issues, "error", "invalid-flow-node", "Flow nodes must be objects.", location);
+      continue;
+    }
+    if (!isNonEmptyString(node.nodeId) || !isNonEmptyString(node.pluginId)) {
+      pushIssue(
+        issues,
+        "error",
+        "invalid-flow-node",
+        "Flow nodes must declare non-empty nodeId and pluginId fields.",
+        location,
+      );
+      continue;
+    }
+    if (nodeIds.has(node.nodeId)) {
+      pushIssue(
+        issues,
+        "error",
+        "duplicate-flow-node-id",
+        `Duplicate flow node id "${node.nodeId}".`,
+        `${location}.nodeId`,
+      );
+    }
+    nodeIds.add(node.nodeId);
+  }
+
+  for (const [index, edge] of (Array.isArray(manifest.flowEdges)
+    ? manifest.flowEdges
+    : []).entries()) {
+    const location = `${sourceName}.flowEdges[${index}]`;
+    if (
+      !edge ||
+      typeof edge !== "object" ||
+      Array.isArray(edge) ||
+      !isNonEmptyString(edge.fromNodeId) ||
+      !isNonEmptyString(edge.fromPortId) ||
+      !isNonEmptyString(edge.toNodeId) ||
+      !isNonEmptyString(edge.toPortId)
+    ) {
+      pushIssue(
+        issues,
+        "error",
+        "invalid-flow-edge",
+        "Flow edges must declare non-empty fromNodeId, fromPortId, toNodeId, and toPortId fields.",
+        location,
+      );
+    }
+    for (const field of ["fromNodeId", "toNodeId"]) {
+      if (isNonEmptyString(edge?.[field]) && !nodeIds.has(edge[field])) {
+        pushIssue(
+          issues,
+          "error",
+          "unknown-flow-node",
+          `Flow edge references unknown node "${edge[field]}".`,
+          `${location}.${field}`,
+        );
+      }
+    }
+  }
+
+  const triggerIds = new Set();
+  for (const [index, trigger] of (Array.isArray(manifest.flowTriggers)
+    ? manifest.flowTriggers
+    : []).entries()) {
+    const location = `${sourceName}.flowTriggers[${index}]`;
+    if (
+      !trigger ||
+      typeof trigger !== "object" ||
+      Array.isArray(trigger) ||
+      !isNonEmptyString(trigger.triggerId)
+    ) {
+      pushIssue(
+        issues,
+        "error",
+        "invalid-flow-trigger",
+        "Flow triggers must declare a non-empty triggerId.",
+        location,
+      );
+      continue;
+    }
+    if (triggerIds.has(trigger.triggerId)) {
+      pushIssue(
+        issues,
+        "error",
+        "duplicate-flow-trigger-id",
+        `Duplicate flow trigger id "${trigger.triggerId}".`,
+        `${location}.triggerId`,
+      );
+    }
+    triggerIds.add(trigger.triggerId);
+  }
+
+  for (const [index, binding] of (Array.isArray(manifest.flowTriggerBindings)
+    ? manifest.flowTriggerBindings
+    : []).entries()) {
+    const location = `${sourceName}.flowTriggerBindings[${index}]`;
+    if (
+      !binding ||
+      typeof binding !== "object" ||
+      Array.isArray(binding) ||
+      !isNonEmptyString(binding.triggerId) ||
+      !isNonEmptyString(binding.targetNodeId) ||
+      !isNonEmptyString(binding.targetPortId)
+    ) {
+      pushIssue(
+        issues,
+        "error",
+        "invalid-flow-trigger-binding",
+        "Flow trigger bindings must declare non-empty triggerId, targetNodeId, and targetPortId fields.",
+        location,
+      );
+    }
+    if (
+      isNonEmptyString(binding?.triggerId) &&
+      !triggerIds.has(binding.triggerId)
+    ) {
+      pushIssue(
+        issues,
+        "error",
+        "unknown-flow-trigger",
+        `Flow trigger binding references unknown trigger "${binding.triggerId}".`,
+        `${location}.triggerId`,
+      );
+    }
+    if (
+      isNonEmptyString(binding?.targetNodeId) &&
+      !nodeIds.has(binding.targetNodeId)
+    ) {
+      pushIssue(
+        issues,
+        "error",
+        "unknown-flow-node",
+        `Flow trigger binding references unknown node "${binding.targetNodeId}".`,
+        `${location}.targetNodeId`,
+      );
+    }
+  }
+}
+
 export function validatePluginManifest(manifest, options = {}) {
-  const { sourceName = "manifest" } = options;
+  const { sourceName = "manifest", allowLegacyWildcards = true } = options;
   const issues = [];
 
   if (!manifest || typeof manifest !== "object" || Array.isArray(manifest)) {
@@ -1103,6 +1739,14 @@ export function validatePluginManifest(manifest, options = {}) {
     });
   }
 
+  // Wildcard-port boundary context: resolved once per manifest, carried down to
+  // every acceptedTypeSet. See "WILDCARD PORT BOUNDARY" above.
+  const wildcardContext = Object.freeze({
+    pluginId: manifest.pluginId,
+    hostBoundaryBlind: manifestDeclaresHostBoundaryBlindness(manifest),
+    allowLegacyWildcards: allowLegacyWildcards !== false,
+  });
+
   validateStringField(issues, manifest.pluginId, `${sourceName}.pluginId`, "pluginId");
   validateStringField(issues, manifest.name, `${sourceName}.name`, "name");
   validateStringField(issues, manifest.version, `${sourceName}.version`, "version");
@@ -1215,17 +1859,23 @@ export function validatePluginManifest(manifest, options = {}) {
         seenMethodIds.add(method.methodId);
         methodLookup.set(method.methodId, method);
       }
-      if (!Array.isArray(method.inputPorts) || method.inputPorts.length === 0) {
+      if (!Array.isArray(method.inputPorts)) {
         pushIssue(
           issues,
           "error",
           "missing-input-ports",
-          "Methods must declare one or more inputPorts.",
+          "Methods must declare inputPorts as an array.",
           `${location}.inputPorts`,
         );
       } else {
         method.inputPorts.forEach((port, portIndex) => {
-          validatePort(port, issues, `${location}.inputPorts[${portIndex}]`, "Input port");
+          validatePort(
+            port,
+            issues,
+            `${location}.inputPorts[${portIndex}]`,
+            "Input port",
+            { ...wildcardContext, methodId: method.methodId, direction: "in" },
+          );
         });
       }
       if (!Array.isArray(method.outputPorts)) {
@@ -1238,7 +1888,13 @@ export function validatePluginManifest(manifest, options = {}) {
         );
       } else {
         method.outputPorts.forEach((port, portIndex) => {
-          validatePort(port, issues, `${location}.outputPorts[${portIndex}]`, "Output port");
+          validatePort(
+            port,
+            issues,
+            `${location}.outputPorts[${portIndex}]`,
+            "Output port",
+            { ...wildcardContext, methodId: method.methodId, direction: "out" },
+          );
         });
       }
       validateIntegerField(issues, method.maxBatch, `${location}.maxBatch`, "maxBatch", {
@@ -1311,6 +1967,7 @@ export function validatePluginManifest(manifest, options = {}) {
     issues,
     sourceName,
   );
+  validateFlowGraph(manifest, issues, sourceName);
 
   if (manifest.schemasUsed !== undefined && !Array.isArray(manifest.schemasUsed)) {
     pushIssue(
@@ -1352,7 +2009,9 @@ export async function loadManifestFromFile(manifestPath) {
 }
 
 export function getWasmExportNames(wasmBytes) {
-  const module = new WebAssembly.Module(wasmBytes);
+  // Tolerate signed/published artifacts: strip any appended publication
+  // record collection (signature/PNM/REC trailers) before compiling.
+  const module = new WebAssembly.Module(stripPublicationRecordCollection(wasmBytes));
   return WebAssembly.Module.exports(module).map((entry) => entry.name).sort();
 }
 
@@ -1385,6 +2044,222 @@ function indexOfBytes(haystack, needle, startIndex = 0) {
   return -1;
 }
 
+function isPlausibleEmbeddedManifestString(value, maxLength = 512) {
+  return (
+    isNonEmptyString(value) &&
+    value.length <= maxLength &&
+    /^[\x20-\x7e]+$/.test(value)
+  );
+}
+
+function readI32ConstExpression(bytes, offset, end) {
+  let cursor = offset;
+  const opcode = bytes[cursor++];
+  if (opcode !== 0x41) {
+    return null;
+  }
+  const valueInfo = decodeUnsignedLeb128(bytes, cursor);
+  cursor = valueInfo.nextOffset;
+  if (cursor >= end || bytes[cursor] !== 0x0b) {
+    return null;
+  }
+  return { value: valueInfo.value, nextOffset: cursor + 1 };
+}
+
+function extractWasmDataSegments(wasmBytes) {
+  let parsed;
+  try {
+    parsed = parseWasmModuleSections(wasmBytes);
+  } catch {
+    return [];
+  }
+  const segments = [];
+  for (const section of parsed.sections) {
+    if (section.id !== 11) {
+      continue;
+    }
+    const payload = parsed.bytes.subarray(section.payloadStart, section.payloadEnd);
+    let cursor = 0;
+    let countInfo;
+    try {
+      countInfo = decodeUnsignedLeb128(payload, cursor);
+    } catch {
+      continue;
+    }
+    cursor = countInfo.nextOffset;
+    for (let index = 0; index < countInfo.value && cursor < payload.length; index += 1) {
+      const flagsInfo = decodeUnsignedLeb128(payload, cursor);
+      const flags = flagsInfo.value;
+      cursor = flagsInfo.nextOffset;
+      let memoryOffset = null;
+      if (flags === 0) {
+        const expression = readI32ConstExpression(payload, cursor, payload.length);
+        if (!expression) {
+          break;
+        }
+        memoryOffset = expression.value;
+        cursor = expression.nextOffset;
+      } else if (flags === 2) {
+        const memoryIndexInfo = decodeUnsignedLeb128(payload, cursor);
+        cursor = memoryIndexInfo.nextOffset;
+        const expression = readI32ConstExpression(payload, cursor, payload.length);
+        if (!expression) {
+          break;
+        }
+        memoryOffset = expression.value;
+        cursor = expression.nextOffset;
+      }
+      const sizeInfo = decodeUnsignedLeb128(payload, cursor);
+      cursor = sizeInfo.nextOffset;
+      const dataStart = cursor;
+      const dataEnd = dataStart + sizeInfo.value;
+      if (dataEnd > payload.length) {
+        break;
+      }
+      segments.push({
+        memoryOffset,
+        bytes: payload.subarray(dataStart, dataEnd),
+      });
+      cursor = dataEnd;
+    }
+  }
+  return segments;
+}
+
+function concatenateWasmDataSegmentPayloads(wasmBytes) {
+  const segments = extractWasmDataSegments(wasmBytes);
+  if (segments.length === 0) {
+    return null;
+  }
+  const totalLength = segments.reduce(
+    (total, segment) => total + segment.bytes.length,
+    0,
+  );
+  if (totalLength <= 0) {
+    return null;
+  }
+  const out = new Uint8Array(totalLength);
+  let offset = 0;
+  for (const segment of segments) {
+    out.set(segment.bytes, offset);
+    offset += segment.bytes.length;
+  }
+  return out;
+}
+
+function reconstructWasmDataMemoryImage(wasmBytes) {
+  const segments = extractWasmDataSegments(wasmBytes).filter(
+    (segment) => segment.memoryOffset !== null,
+  );
+  if (segments.length === 0) {
+    return null;
+  }
+  const maxEnd = segments.reduce(
+    (max, segment) => Math.max(max, segment.memoryOffset + segment.bytes.length),
+    0,
+  );
+  if (!Number.isSafeInteger(maxEnd) || maxEnd <= 0) {
+    return null;
+  }
+  const memory = new Uint8Array(maxEnd);
+  for (const segment of segments) {
+    memory.set(segment.bytes, segment.memoryOffset);
+  }
+  return memory;
+}
+
+function scanForEmbeddedPlgManifest(bytes, options = {}) {
+  const expectedPluginId =
+    typeof options.expectedPluginId === "string" && options.expectedPluginId.length > 0
+      ? options.expectedPluginId
+      : null;
+  const expectedVersion =
+    typeof options.expectedVersion === "string" && options.expectedVersion.length > 0
+      ? options.expectedVersion
+      : null;
+  let fallback = null;
+  let searchStart = 0;
+  while (searchStart < bytes.length) {
+    const identifierOffset = indexOfBytes(
+      bytes,
+      PLG_IDENTIFIER_BYTES,
+      searchStart,
+    );
+    if (identifierOffset === -1) {
+      break;
+    }
+    searchStart = identifierOffset + PLG_IDENTIFIER_BYTES.length;
+    if (identifierOffset < 4) {
+      continue;
+    }
+    const start = identifierOffset - 4;
+    // Upper bound on the manifest size — grab up to 64KB and let the caller
+    // decide how much to trim. FlatBuffer decoders only read what they need.
+    const end = Math.min(bytes.length, start + 65536);
+    const candidate = bytes.slice(start, end);
+    if (!isPlgManifestBuffer(candidate)) {
+      continue;
+    }
+    let decoded = null;
+    try {
+      decoded = decodePlgManifest(candidate);
+    } catch {
+      continue;
+    }
+    if (
+      !isPlausibleEmbeddedManifestString(decoded?.pluginId) ||
+      !isPlausibleEmbeddedManifestString(decoded?.name) ||
+      !isPlausibleEmbeddedManifestString(decoded?.version, 128)
+    ) {
+      continue;
+    }
+    const located = { start, identifierOffset, bytes: candidate, decoded };
+    if (
+      (!expectedPluginId || decoded.pluginId === expectedPluginId) &&
+      (!expectedVersion || decoded.version === expectedVersion)
+    ) {
+      return located;
+    }
+    fallback ??= located;
+  }
+  return fallback;
+}
+
+function decodeManifestCandidate(candidate, options = {}) {
+  const bytes = candidate instanceof Uint8Array ? candidate.slice() : new Uint8Array(candidate);
+  if (!isPlgManifestBuffer(bytes)) {
+    return null;
+  }
+  let decoded = null;
+  try {
+    decoded = decodePlgManifest(bytes);
+  } catch {
+    return null;
+  }
+  if (
+    !isPlausibleEmbeddedManifestString(decoded?.pluginId) ||
+    !isPlausibleEmbeddedManifestString(decoded?.name) ||
+    !isPlausibleEmbeddedManifestString(decoded?.version, 128)
+  ) {
+    return null;
+  }
+  const expectedPluginId =
+    typeof options.expectedPluginId === "string" && options.expectedPluginId.length > 0
+      ? options.expectedPluginId
+      : null;
+  const expectedVersion =
+    typeof options.expectedVersion === "string" && options.expectedVersion.length > 0
+      ? options.expectedVersion
+      : null;
+  if (
+    (expectedPluginId && decoded.pluginId !== expectedPluginId) ||
+    (expectedVersion && decoded.version !== expectedVersion)
+  ) {
+    return null;
+  }
+  return { start: 0, identifierOffset: 4, bytes, decoded };
+}
+
 /**
  * Scan wasm bytes for the canonical `$PLG` FlatBuffer identifier and, when
  * found, return both the raw offset and the smallest aligned candidate buffer
@@ -1393,23 +2268,49 @@ function indexOfBytes(haystack, needle, startIndex = 0) {
  * so we walk backwards one 4-byte word and hand the caller a slice starting
  * there.
  */
-export function locateEmbeddedPlgManifest(wasmBytes) {
-  const bytes = wasmBytes instanceof Uint8Array
+export function locateEmbeddedPlgManifest(wasmBytes, options = {}) {
+  const inputBytes = wasmBytes instanceof Uint8Array
     ? wasmBytes
     : new Uint8Array(wasmBytes);
-  const identifierOffset = indexOfBytes(bytes, PLG_IDENTIFIER_BYTES);
-  if (identifierOffset < 4) {
-    return null;
+  const protectedArtifact = extractPublicationRecordCollection(inputBytes);
+  for (const entry of protectedArtifact?.mbl?.entries ?? []) {
+    if (
+      entry?.entryId !== "manifest" &&
+      entry?.sectionName !== SDS_MANIFEST_SECTION_NAME
+    ) {
+      continue;
+    }
+    const located = decodeManifestCandidate(
+      new Uint8Array(entry.payload ?? []),
+      options,
+    );
+    if (located) {
+      return { ...located, source: "bundle-manifest" };
+    }
   }
-  const start = identifierOffset - 4;
-  // Upper bound on the manifest size — grab up to 64KB and let the caller
-  // decide how much to trim. FlatBuffer decoders only read what they need.
-  const end = Math.min(bytes.length, start + 65536);
-  const candidate = bytes.subarray(start, end);
-  if (!isPlgManifestBuffer(candidate)) {
-    return null;
+  const bytes = protectedArtifact?.payloadBytes ?? inputBytes;
+  for (const sectionBytes of getWasmCustomSections(bytes, SDS_MANIFEST_SECTION_NAME)) {
+    const located = decodeManifestCandidate(sectionBytes, options);
+    if (located) {
+      return { ...located, source: "custom-section" };
+    }
+  }
+  const dataPayloads = concatenateWasmDataSegmentPayloads(bytes);
+  if (dataPayloads) {
+    const located = scanForEmbeddedPlgManifest(dataPayloads, options);
+    if (located) {
+      return { ...located, source: "data-payloads" };
+    }
+  }
+  const memoryImage = reconstructWasmDataMemoryImage(bytes);
+  if (memoryImage) {
+    const located = scanForEmbeddedPlgManifest(memoryImage, options);
+    if (located) {
+      return { ...located, source: "data-memory" };
+    }
   }
-  return { start, identifierOffset, bytes: candidate };
+  const located = scanForEmbeddedPlgManifest(bytes, options);
+  return located ? { ...located, source: "raw-wasm" } : null;
 }
 
 export function hasLegacyPmanManifest(wasmBytes) {
@@ -1435,7 +2336,12 @@ function validateEmbeddedManifestBytes({
     );
   }
 
-  const located = locateEmbeddedPlgManifest(wasmBytes);
+  const sourcePluginId = manifest?.pluginId ?? manifest?.plugin_id ?? null;
+  const sourceVersion = manifest?.version ?? null;
+  const located = locateEmbeddedPlgManifest(wasmBytes, {
+    expectedPluginId: sourcePluginId,
+    expectedVersion: sourceVersion,
+  });
   if (!located) {
     pushIssue(
       issues,
@@ -1447,9 +2353,9 @@ function validateEmbeddedManifestBytes({
     return;
   }
 
-  let decoded;
+  let decoded = located.decoded;
   try {
-    decoded = decodePlgManifest(located.bytes);
+    decoded ??= decodePlgManifest(located.bytes);
   } catch (error) {
     pushIssue(
       issues,
@@ -1461,7 +2367,6 @@ function validateEmbeddedManifestBytes({
     return;
   }
 
-  const sourcePluginId = manifest?.pluginId ?? manifest?.plugin_id ?? null;
   if (
     isNonEmptyString(sourcePluginId) &&
     isNonEmptyString(decoded?.pluginId) &&
@@ -1476,7 +2381,6 @@ function validateEmbeddedManifestBytes({
     );
   }
 
-  const sourceVersion = manifest?.version ?? null;
   if (
     isNonEmptyString(sourceVersion) &&
     isNonEmptyString(decoded?.version) &&