space-data-module-sdk 0.8.4 → 0.8.6

package/src/compiler/invokeGlue.js

@@ -20,6 +20,47 @@ function uniqueOutputPorts(method) {
   return Array.isArray(method?.outputPorts) ? method.outputPorts : [];
 }
 
+function acceptedTypesForPort(port) {
+  const acceptedTypes = [];
+  for (const typeSet of Array.isArray(port?.acceptedTypeSets)
+    ? port.acceptedTypeSets
+    : []) {
+    for (const allowedType of Array.isArray(typeSet?.allowedTypes)
+      ? typeSet.allowedTypes
+      : []) {
+      acceptedTypes.push(allowedType ?? {});
+    }
+  }
+  return acceptedTypes;
+}
+
+function wireFormatLiteral(value) {
+  return String(value ?? "").toLowerCase() === "aligned-binary" ? "1u" : "0u";
+}
+
+function schemaHashBytes(value) {
+  if (typeof value === "string") {
+    const hex = value.startsWith("0x") ? value.slice(2) : value;
+    if (hex.length === 0 || hex.length % 2 !== 0 || !/^[0-9a-fA-F]+$/.test(hex)) {
+      return [];
+    }
+    const bytes = [];
+    for (let index = 0; index < hex.length; index += 2) {
+      bytes.push(Number.parseInt(hex.slice(index, index + 2), 16));
+    }
+    return bytes;
+  }
+  if (Array.isArray(value) || value instanceof Uint8Array) {
+    return Array.from(value, (entry) => Number(entry));
+  }
+  return [];
+}
+
+function unsignedLiteral(value) {
+  const numeric = Number(value ?? 0);
+  return `${Number.isFinite(numeric) ? Math.max(0, Math.trunc(numeric)) : 0}u`;
+}
+
 export function resolveInvokeSurfaces(manifest = {}) {
   if (!Array.isArray(manifest.invokeSurfaces) || manifest.invokeSurfaces.length === 0) {
     return [InvokeSurface.DIRECT, InvokeSurface.COMMAND];
@@ -62,18 +103,32 @@ typedef struct plugin_input_frame_t {
   const char *file_identifier;
   uint32_t wire_format;
   const char *root_type_name;
+  /* Legacy TABF-only metadata. SDS PIV/TAB inputs set this to 0. */
   uint16_t fixed_string_length;
+  /* SDS PIV/TAB inputs expose TYPE_REF.BYTE_LENGTH here (zero for canonical). */
   uint32_t byte_length;
   uint16_t required_alignment;
   uint16_t alignment;
   uint32_t size;
+  /* Legacy TABF-only metadata. SDS PIV/TAB inputs set this to 0. */
   uint32_t generation;
+  /* SDS PIV/TAB maps TAB.FRAME_ID here. */
   uint64_t trace_id;
+  /* Legacy TABF-only metadata. SDS PIV/TAB inputs set this to 0. */
   uint32_t stream_id;
+  /* SDS PIV/TAB decodes this from TAB.FRAME_ID as frame_id >> 1. */
   uint64_t sequence;
+  /* SDS PIV/TAB decodes this from TAB.FRAME_ID bit 0. */
   int32_t end_of_stream;
   const uint8_t *payload;
   uint32_t payload_length;
+  /* Exact SDS type identity and TAB access metadata; appended for ABI-prefix stability. */
+  const char *schema_version;
+  const uint8_t *schema_hash;
+  uint32_t schema_hash_length;
+  uint32_t ownership;
+  uint32_t mutability;
+  uint64_t frame_id;
 } plugin_input_frame_t;
 
 uint32_t plugin_get_input_count(void);
@@ -111,6 +166,12 @@ int32_t plugin_push_output_ex(
   const uint8_t *payload_ptr,
   uint32_t payload_length
 );
+int32_t plugin_set_output_frame_id(uint32_t output_index, uint64_t frame_id);
+int32_t plugin_set_output_stream_frame(
+  uint32_t output_index,
+  uint64_t sequence,
+  int32_t end_of_stream
+);
 
 void plugin_set_yielded(int32_t yielded);
 void plugin_set_backlog_remaining(uint32_t backlog_remaining);
@@ -132,17 +193,53 @@ uint32_t plugin_invoke_stream(
 `;
 }
 
+function renderAcceptedTypeArrays(method, ports, direction) {
+  return ports
+    .map((port, portIndex) => {
+      const acceptedTypes = acceptedTypesForPort(port);
+      if (acceptedTypes.length === 0) {
+        return "";
+      }
+      const arrayPrefix = `kMethod_${methodSymbol(method)}_${direction}_port_${portIndex}`;
+      const hashArrays = acceptedTypes
+        .map((type, typeIndex) => {
+          const bytes = schemaHashBytes(type.schemaHash);
+          if (bytes.length === 0) {
+            return "";
+          }
+          return `static const uint8_t ${arrayPrefix}_type_${typeIndex}_schema_hash[] = { ${bytes
+            .map((entry) => `0x${entry.toString(16).padStart(2, "0")}`)
+            .join(", ")} };\n`;
+        })
+        .join("");
+      return `${hashArrays}static const AcceptedTypeRef ${arrayPrefix}_accepted_types[] = {
+${acceptedTypes
+  .map((type, typeIndex) => {
+    const hash = schemaHashBytes(type.schemaHash);
+    return `  { ${boolLiteral(type.acceptsAnyFlatbuffer === true)}, ${quoteCString(type.schemaName)}, ${quoteCString(type.fileIdentifier)}, ${wireFormatLiteral(type.wireFormat)}, ${boolLiteral(type.wireFormat !== undefined)}, ${quoteCString(type.rootTypeName)}, ${quoteCString(type.schemaVersion)}, ${hash.length > 0 ? `${arrayPrefix}_type_${typeIndex}_schema_hash` : "nullptr"}, ${hash.length}u, ${unsignedLiteral(type.fixedStringLength)}, ${unsignedLiteral(type.byteLength)}, ${unsignedLiteral(type.requiredAlignment)} },`;
+  })
+  .join("\n")}
+};
+`;
+    })
+    .join("");
+}
+
 function renderInputPortArrays(method) {
   const inputPorts = uniqueInputPorts(method);
   if (inputPorts.length === 0) {
     return "";
   }
-  return `static const PortRequirement kMethod_${methodSymbol(method)}_input_ports[] = {
+  return `${renderAcceptedTypeArrays(method, inputPorts, "input")}static const PortRequirement kMethod_${methodSymbol(method)}_input_ports[] = {
 ${inputPorts
-  .map(
-    (port) =>
-      `  { ${quoteCString(port.portId)}, ${boolLiteral(port.required !== false)} },`,
-  )
+  .map((port, portIndex) => {
+    const acceptedTypes = acceptedTypesForPort(port);
+    return `  { ${quoteCString(port.portId)}, ${boolLiteral(port.required !== false)}, ${
+      acceptedTypes.length > 0
+        ? `kMethod_${methodSymbol(method)}_input_port_${portIndex}_accepted_types`
+        : "nullptr"
+    }, ${acceptedTypes.length}u },`;
+  })
   .join("\n")}
 };
 `;
@@ -153,8 +250,17 @@ function renderOutputPortArrays(method) {
   if (outputPorts.length === 0) {
     return "";
   }
-  return `static const char *kMethod_${methodSymbol(method)}_output_ports[] = {
-${outputPorts.map((port) => `  ${quoteCString(port.portId)},`).join("\n")}
+  return `${renderAcceptedTypeArrays(method, outputPorts, "output")}static const PortRequirement kMethod_${methodSymbol(method)}_output_ports[] = {
+${outputPorts
+  .map((port, portIndex) => {
+    const acceptedTypes = acceptedTypesForPort(port);
+    return `  { ${quoteCString(port.portId)}, ${boolLiteral(port.required !== false)}, ${
+      acceptedTypes.length > 0
+        ? `kMethod_${methodSymbol(method)}_output_port_${portIndex}_accepted_types`
+        : "nullptr"
+    }, ${acceptedTypes.length}u },`;
+  })
+  .join("\n")}
 };
 `;
 }
@@ -203,7 +309,9 @@ export function generateInvokeSupportSource({ manifest = {}, includeCommandMain
 #include <cstdio>
 #include <cstdlib>
 #include <cstring>
+#include <limits>
 #include <memory>
+#include <stdlib.h>
 #include <string>
 #include <string_view>
 #include <utility>
@@ -211,18 +319,54 @@ export function generateInvokeSupportSource({ manifest = {}, includeCommandMain
 
 #include <flatbuffers/flatbuffers.h>
 
-#include "PluginInvokeRequest_generated.h"
-#include "PluginInvokeResponse_generated.h"
-#include "TypedArenaBuffer_generated.h"
+#include "sds/PIV/main_generated.h"
 #include "space_data_module_invoke.h"
 
 ${renderMethodDeclarations(methods)}
 
 namespace {
 
+constexpr payloadWireFormat kPayloadWireFormatFlatbuffer =
+  static_cast<payloadWireFormat>(0);
+constexpr payloadWireFormat kPayloadWireFormatAlignedBinary =
+  static_cast<payloadWireFormat>(1);
+constexpr bufferMutability kBufferMutabilityImmutable =
+  static_cast<bufferMutability>(0);
+constexpr bufferMutability kBufferMutabilitySingleWriterMutable =
+  static_cast<bufferMutability>(1);
+constexpr bufferMutability kBufferMutabilityAppendOnly =
+  static_cast<bufferMutability>(2);
+constexpr bufferOwnership kBufferOwnershipHostOwned =
+  static_cast<bufferOwnership>(0);
+constexpr bufferOwnership kBufferOwnershipPluginOwned =
+  static_cast<bufferOwnership>(1);
+constexpr bufferOwnership kBufferOwnershipTransferred =
+  static_cast<bufferOwnership>(2);
+constexpr pivStatus kPivStatusOk = static_cast<pivStatus>(0);
+constexpr pivStatus kPivStatusNotFound = static_cast<pivStatus>(1);
+constexpr pivStatus kPivStatusYielded = static_cast<pivStatus>(2);
+constexpr pivStatus kPivStatusFailed = static_cast<pivStatus>(3);
+
+struct AcceptedTypeRef {
+  bool accepts_any_flatbuffer;
+  const char *schema_name;
+  const char *file_identifier;
+  uint32_t wire_format;
+  bool has_wire_format;
+  const char *root_type_name;
+  const char *schema_version;
+  const uint8_t *schema_hash;
+  uint32_t schema_hash_length;
+  uint16_t fixed_string_length;
+  uint32_t byte_length;
+  uint16_t required_alignment;
+};
+
 struct PortRequirement {
   const char *port_id;
   bool required;
+  const AcceptedTypeRef *accepted_types;
+  size_t accepted_type_count;
 };
 
 struct MethodDescriptor {
@@ -230,7 +374,7 @@ struct MethodDescriptor {
   int (*handler)(void);
   const PortRequirement *input_ports;
   size_t input_port_count;
-  const char *const *output_ports;
+  const PortRequirement *output_ports;
   size_t output_port_count;
   bool raw_shortcut_allowed;
   const char *raw_input_port_id;
@@ -243,24 +387,45 @@ struct InputFrameOwned {
   std::string schema_name{};
   std::string file_identifier{};
   std::string root_type_name{};
+  std::string schema_version{};
+  std::vector<uint8_t> schema_hash{};
+  uint32_t type_wire_format = 0;
+  // Owned storage is only used for the raw stdin shortcut path; the direct
+  // invoke path points views straight into the (8-aligned) request arena.
   std::vector<uint8_t> payload{};
+  const uint8_t *external_payload = nullptr;
+  uint32_t external_payload_length = 0;
 };
 
+// Alignment guaranteed for every FlatBuffer base crossing the host<->module
+// boundary: the host-allocated request region, the module-returned response
+// pointer, and the payload arena inside each invoke envelope.
+constexpr uint32_t kInvokeArenaAlignment = 8u;
+// plugin_alloc hands out 16-aligned regions so frames declaring
+// required_alignment up to 16 (e.g. SIMD/aligned-binary state vectors) hold
+// as absolute addresses in linear memory.
+constexpr uint32_t kInvokeAllocAlignment = 16u;
+
 struct OutputFrameOwned {
   std::string port_id{};
   std::string schema_name{};
   std::string file_identifier{};
   std::string root_type_name{};
+  std::string schema_version{};
+  std::vector<uint8_t> schema_hash{};
   uint32_t wire_format = 0;
   uint16_t fixed_string_length = 0;
   uint32_t byte_length = 0;
   uint16_t required_alignment = 0;
   uint16_t alignment = 8;
   uint32_t generation = 0;
-  uint64_t trace_id = 0;
+  bool has_frame_id = false;
+  uint64_t frame_id = 0;
   uint32_t stream_id = 0;
   uint64_t sequence = 0;
   bool end_of_stream = false;
+  const uint8_t *payload_ptr = nullptr;
+  uint32_t payload_length = 0;
   std::vector<uint8_t> payload{};
 };
 
@@ -268,19 +433,28 @@ struct InvokeContext {
   const MethodDescriptor *method = nullptr;
   std::vector<InputFrameOwned> inputs{};
   std::vector<OutputFrameOwned> outputs{};
+  uint64_t trace_id = 0;
   uint32_t backlog_remaining = 0;
   bool yielded = false;
+  bool direct_external_arena_outputs = false;
   int32_t status_code = 0;
   std::string error_code{};
   std::string error_message{};
 };
 
+struct AllocationRecord {
+  uint32_t ptr = 0;
+  uint32_t size = 0;
+};
+
 ${renderMethodTables(methods)}
 static const MethodDescriptor kMethodTable[] = {
 ${renderMethodDescriptors(methods)}
 };
 
 static InvokeContext g_invoke_context;
+static std::vector<AllocationRecord> g_allocations{};
+static bool g_direct_invoke_stream = false;
 
 static uintptr_t PtrFromU32(uint32_t value) {
   return static_cast<uintptr_t>(value);
@@ -298,6 +472,53 @@ static uint32_t *MutableU32Ptr(uint32_t value) {
   return reinterpret_cast<uint32_t *>(PtrFromU32(value));
 }
 
+static bool U32RangeExceeds(uint32_t offset, uint32_t size, uint32_t arena_size) {
+  return offset > arena_size || size > arena_size - offset;
+}
+
+static bool AllocationContains(uint32_t ptr, uint32_t length) {
+  if (length == 0u) {
+    return true;
+  }
+  if (ptr == 0u) {
+    return false;
+  }
+  for (const auto &allocation : g_allocations) {
+    if (ptr < allocation.ptr) {
+      continue;
+    }
+    const uint32_t offset = ptr - allocation.ptr;
+    if (!U32RangeExceeds(offset, length, allocation.size)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+static void TrackAllocation(uint32_t ptr, uint32_t size) {
+  if (ptr != 0u) {
+    g_allocations.push_back(AllocationRecord{ptr, size});
+  }
+}
+
+static bool UntrackAllocation(uint32_t ptr) {
+  if (ptr == 0u) {
+    return false;
+  }
+  const auto before = g_allocations.size();
+  g_allocations.erase(
+    std::remove_if(
+      g_allocations.begin(),
+      g_allocations.end(),
+      [ptr](const AllocationRecord &allocation) {
+        return allocation.ptr == ptr;
+      }
+    ),
+    g_allocations.end()
+  );
+  return g_allocations.size() != before;
+}
+
 static const MethodDescriptor *FindMethod(std::string_view method_id) {
   for (const auto &method : kMethodTable) {
     if (method_id == method.method_id) {
@@ -307,18 +528,258 @@ static const MethodDescriptor *FindMethod(std::string_view method_id) {
   return nullptr;
 }
 
-static bool MethodDeclaresOutputPort(const MethodDescriptor *method, const char *port_id) {
-  if (!method || !port_id || !port_id[0]) {
+static bool CStringExactlyMatches(const char *expected, const std::string &actual) {
+  return actual == (expected ? expected : "");
+}
+
+static bool SchemaHashExactlyMatches(
+  const AcceptedTypeRef &accepted,
+  const std::vector<uint8_t> &actual
+) {
+  if (accepted.schema_hash_length != actual.size()) {
     return false;
   }
-  for (size_t index = 0; index < method->output_port_count; index += 1) {
-    if (std::strcmp(method->output_ports[index], port_id) == 0) {
+  if (accepted.schema_hash_length == 0u) {
+    return true;
+  }
+  if (!accepted.schema_hash) {
+    return false;
+  }
+  return std::equal(
+    accepted.schema_hash,
+    accepted.schema_hash + accepted.schema_hash_length,
+    actual.begin()
+  );
+}
+
+static bool IsPowerOfTwo(uint32_t value) {
+  return value > 0u && (value & (value - 1u)) == 0u;
+}
+
+static const PortRequirement *FindInputPort(const MethodDescriptor *method, const std::string &port_id) {
+  if (!method) {
+    return nullptr;
+  }
+  for (size_t index = 0; index < method->input_port_count; index += 1) {
+    const auto &port = method->input_ports[index];
+    if (port.port_id && port_id == port.port_id) {
+      return &port;
+    }
+  }
+  return nullptr;
+}
+
+// A WILDCARD PORT IS BLIND TO FRAMING, NOT ONLY TO IDENTITY.
+//
+// acceptsAnyFlatbuffer declares application-blindness: the port cannot name
+// one SDS identity because its payloads are defined by a host op, a foreign
+// wire format, or an intra-flow control frame. Restricting it to the FLATBUFFER
+// wire format made the SDK refuse frames its own convenience API produces:
+// plugin_push_output_ex(..., PLUGIN_PAYLOAD_WIRE_FORMAT_ALIGNED_BINARY, ...)
+// is the only way to emit variable-length raw bytes (JSON control frames,
+// opaque byte routes), and every such frame was rejected as
+// "does not match a declared type on port". The flow compiler already routes a
+// wildcard edge as an OPAQUE byte route — that route IS aligned-binary bytes.
+//
+// An aligned-binary frame on a wildcard port still has to be self-consistent:
+// alignment must be declared (>= 1). There is nothing else to check it against,
+// because a wildcard declares no layout of its own.
+static bool WildcardAcceptsWireFormat(uint32_t wire_format, uint16_t required_alignment) {
+  if (wire_format == static_cast<uint32_t>(kPayloadWireFormatFlatbuffer)) {
+    return true;
+  }
+  if (wire_format == static_cast<uint32_t>(kPayloadWireFormatAlignedBinary)) {
+    return required_alignment > 0u;
+  }
+  return false;
+}
+
+static bool InputTypeMatches(const AcceptedTypeRef &accepted, const InputFrameOwned &frame) {
+  if (accepted.accepts_any_flatbuffer) {
+    return WildcardAcceptsWireFormat(
+      frame.view.wire_format,
+      frame.view.required_alignment
+    );
+  }
+  if (accepted.has_wire_format && frame.view.wire_format != accepted.wire_format) {
+    return false;
+  }
+  if (!accepted.has_wire_format &&
+      frame.view.wire_format != static_cast<uint32_t>(kPayloadWireFormatFlatbuffer)) {
+    return false;
+  }
+  if (frame.type_wire_format != frame.view.wire_format) {
+    return false;
+  }
+  if (
+    !CStringExactlyMatches(accepted.schema_name, frame.schema_name) ||
+    !CStringExactlyMatches(accepted.file_identifier, frame.file_identifier) ||
+    !CStringExactlyMatches(accepted.root_type_name, frame.root_type_name) ||
+    !CStringExactlyMatches(accepted.schema_version, frame.schema_version) ||
+    !SchemaHashExactlyMatches(accepted, frame.schema_hash)
+  ) {
+    return false;
+  }
+  if (
+    frame.view.fixed_string_length != accepted.fixed_string_length ||
+    frame.view.required_alignment != accepted.required_alignment
+  ) {
+    return false;
+  }
+  // A variable-length aligned stream (accepted.byte_length == 0) carries the
+  // frame's own size in byte_length, so an equality test would refuse every
+  // frame it accepts. The size contract is applied below, where the two shapes
+  // are distinguished.
+  if (accepted.byte_length != 0u && frame.view.byte_length != accepted.byte_length) {
+    return false;
+  }
+  if (frame.view.wire_format == static_cast<uint32_t>(kPayloadWireFormatAlignedBinary)) {
+    // byte_length == 0 declares a VARIABLE-LENGTH aligned stream (see the
+    // byteLength note in src/compliance/pluginCompliance.js): the frame must
+    // still be placed on the declared alignment, but there is no stride to
+    // check its size against. A declared stride is still enforced exactly.
+    if (
+      accepted.required_alignment == 0u ||
+      !IsPowerOfTwo(frame.view.alignment) ||
+      frame.view.alignment < accepted.required_alignment
+    ) {
+      return false;
+    }
+    if (accepted.byte_length != 0u && frame.view.size != accepted.byte_length) {
+      return false;
+    }
+  }
+  return true;
+}
+
+static bool InputTypeAllowed(const PortRequirement &port, const InputFrameOwned &frame) {
+  if (port.accepted_type_count == 0u) {
+    return true;
+  }
+  for (size_t index = 0; index < port.accepted_type_count; index += 1) {
+    if (InputTypeMatches(port.accepted_types[index], frame)) {
       return true;
     }
   }
   return false;
 }
 
+static const AcceptedTypeRef *FindCanonicalInputType(const PortRequirement &port) {
+  for (size_t index = 0; index < port.accepted_type_count; index += 1) {
+    const auto &accepted = port.accepted_types[index];
+    if (
+      accepted.wire_format == static_cast<uint32_t>(kPayloadWireFormatFlatbuffer) &&
+      !accepted.accepts_any_flatbuffer
+    ) {
+      return &accepted;
+    }
+  }
+  return nullptr;
+}
+
+static const PortRequirement *FindOutputPort(
+  const MethodDescriptor *method,
+  const char *port_id
+) {
+  if (!method || !port_id || !port_id[0]) {
+    return nullptr;
+  }
+  for (size_t index = 0; index < method->output_port_count; index += 1) {
+    const auto &port = method->output_ports[index];
+    if (port.port_id && std::strcmp(port.port_id, port_id) == 0) {
+      return &port;
+    }
+  }
+  return nullptr;
+}
+
+static bool OptionalCStringMatches(const char *actual, const char *expected) {
+  return !actual || !actual[0] || std::strcmp(actual, expected ? expected : "") == 0;
+}
+
+static bool OutputTypeMatches(
+  const AcceptedTypeRef &accepted,
+  const char *schema_name,
+  const char *file_identifier,
+  uint32_t wire_format,
+  const char *root_type_name,
+  uint16_t fixed_string_length,
+  uint32_t byte_length,
+  uint16_t required_alignment,
+  uint32_t payload_length
+) {
+  if (accepted.accepts_any_flatbuffer) {
+    // Mirror of InputTypeMatches — see WildcardAcceptsWireFormat.
+    return WildcardAcceptsWireFormat(wire_format, required_alignment);
+  }
+  if (
+    !schema_name || !schema_name[0] ||
+    !file_identifier || !file_identifier[0] ||
+    std::strcmp(schema_name, accepted.schema_name ? accepted.schema_name : "") != 0 ||
+    std::strcmp(file_identifier, accepted.file_identifier ? accepted.file_identifier : "") != 0 ||
+    !OptionalCStringMatches(root_type_name, accepted.root_type_name)
+  ) {
+    return false;
+  }
+  const uint32_t accepted_wire_format = accepted.has_wire_format
+    ? accepted.wire_format
+    : static_cast<uint32_t>(kPayloadWireFormatFlatbuffer);
+  if (wire_format != accepted_wire_format) {
+    return false;
+  }
+  if (wire_format == static_cast<uint32_t>(kPayloadWireFormatAlignedBinary)) {
+    if (
+      fixed_string_length != accepted.fixed_string_length ||
+      required_alignment != accepted.required_alignment ||
+      accepted.required_alignment == 0u
+    ) {
+      return false;
+    }
+    // accepted.byte_length == 0: VARIABLE-LENGTH aligned stream — any payload
+    // size, placed on the declared alignment. Otherwise a fixed stride, which
+    // both the declared byte_length and the payload must match exactly.
+    if (accepted.byte_length == 0u) {
+      return true;
+    }
+    return byte_length == accepted.byte_length && payload_length == accepted.byte_length;
+  }
+  return fixed_string_length == 0u && byte_length == 0u && required_alignment == 0u;
+}
+
+static const AcceptedTypeRef *ResolveOutputType(
+  const PortRequirement &port,
+  const char *schema_name,
+  const char *file_identifier,
+  uint32_t wire_format,
+  const char *root_type_name,
+  uint16_t fixed_string_length,
+  uint32_t byte_length,
+  uint16_t required_alignment,
+  uint32_t payload_length
+) {
+  const AcceptedTypeRef *match = nullptr;
+  for (size_t index = 0; index < port.accepted_type_count; index += 1) {
+    const auto &accepted = port.accepted_types[index];
+    if (!OutputTypeMatches(
+          accepted,
+          schema_name,
+          file_identifier,
+          wire_format,
+          root_type_name,
+          fixed_string_length,
+          byte_length,
+          required_alignment,
+          payload_length)) {
+      continue;
+    }
+    if (match) {
+      return nullptr;
+    }
+    match = &accepted;
+  }
+  return match;
+}
+
 static void ResetInvokeContext(const MethodDescriptor *method) {
   g_invoke_context = InvokeContext{};
   g_invoke_context.method = method;
@@ -341,63 +802,188 @@ static uint32_t AlignOffset(uint32_t offset, uint32_t alignment) {
   return remainder == 0u ? offset : offset + alignment - remainder;
 }
 
-static bool LoadInputsFromRequest(const orbpro::invoke::PluginInvokeRequestT &request) {
+static bool AlignOffsetChecked(size_t offset, uint32_t alignment, size_t *aligned_offset) {
+  if (!aligned_offset) {
+    return false;
+  }
+  if (alignment <= 1u) {
+    *aligned_offset = offset;
+    return true;
+  }
+  const size_t remainder = offset % static_cast<size_t>(alignment);
+  const size_t padding = remainder == 0u ? 0u : static_cast<size_t>(alignment) - remainder;
+  if (padding > std::numeric_limits<size_t>::max() - offset) {
+    return false;
+  }
+  *aligned_offset = offset + padding;
+  return true;
+}
+
+static std::string FlatBufferStringValue(const ::flatbuffers::String *value) {
+  return value ? std::string(value->c_str(), value->size()) : std::string();
+}
+
+static uint64_t DecodeSdsFrameSequence(uint64_t frame_id) {
+  return frame_id >> 1u;
+}
+
+static bool DecodeSdsFrameEndOfStream(uint64_t frame_id) {
+  return (frame_id & 1u) != 0u;
+}
+
+static uint64_t EncodeSdsFrameId(uint64_t sequence, bool end_of_stream) {
+  return (sequence << 1u) | (end_of_stream ? 1u : 0u);
+}
+
+static bool FrameRangeExceedsArena(
+  size_t payload_offset,
+  size_t payload_size,
+  size_t arena_size
+) {
+  return payload_offset > arena_size || payload_size > arena_size - payload_offset;
+}
+
+static void PopulateInputView(InputFrameOwned *owned) {
+  if (!owned) {
+    return;
+  }
+  owned->view.port_id = owned->port_id.empty() ? nullptr : owned->port_id.c_str();
+  owned->view.schema_name = owned->schema_name.empty() ? nullptr : owned->schema_name.c_str();
+  owned->view.file_identifier = owned->file_identifier.empty() ? nullptr : owned->file_identifier.c_str();
+  owned->view.root_type_name = owned->root_type_name.empty() ? nullptr : owned->root_type_name.c_str();
+  owned->view.schema_version = owned->schema_version.empty() ? nullptr : owned->schema_version.c_str();
+  owned->view.schema_hash = owned->schema_hash.empty() ? nullptr : owned->schema_hash.data();
+  owned->view.schema_hash_length = static_cast<uint32_t>(owned->schema_hash.size());
+  owned->view.frame_id = owned->view.trace_id;
+  if (owned->external_payload && owned->external_payload_length > 0u) {
+    owned->view.payload = owned->external_payload;
+    owned->view.payload_length = owned->external_payload_length;
+  } else {
+    owned->view.payload = owned->payload.empty() ? nullptr : owned->payload.data();
+    owned->view.payload_length = static_cast<uint32_t>(owned->payload.size());
+  }
+}
+
+static bool LoadInputsFromPivRequest(const PIVRequest &request) {
   g_invoke_context.inputs.clear();
-  g_invoke_context.inputs.reserve(request.input_frames.size());
 
-  for (const auto &frame_ptr : request.input_frames) {
-    if (!frame_ptr) {
+  const auto *input_frames = request.INPUTS();
+  const auto *payload_arena = request.PAYLOAD_ARENA();
+  const size_t input_count = input_frames ? input_frames->size() : 0u;
+  const size_t arena_size = payload_arena ? payload_arena->size() : 0u;
+  g_invoke_context.inputs.reserve(input_count);
+
+  for (size_t index = 0; index < input_count; index += 1) {
+    const auto *frame = input_frames->Get(static_cast<::flatbuffers::uoffset_t>(index));
+    if (!frame) {
       continue;
     }
 
-    const auto &frame = *frame_ptr;
-    const auto payload_offset = static_cast<size_t>(frame.offset);
-    const auto payload_size = static_cast<size_t>(frame.size);
-    if (payload_offset + payload_size > request.payload_arena.size()) {
+    const auto payload_offset = static_cast<size_t>(frame->OFFSET());
+    const auto payload_size = static_cast<size_t>(frame->SIZE());
+    const uint32_t frame_alignment = frame->ALIGNMENT() > 0u ? frame->ALIGNMENT() : 1u;
+    if (frame_alignment > std::numeric_limits<uint16_t>::max()) {
+      SetError("invalid-request-frame", "SDS PIV TAB alignment exceeds the module ABI limit.");
+      return false;
+    }
+    const uint8_t *payload_ptr = nullptr;
+    if (payload_size > 0u && arena_size == 0u) {
+      if (
+        payload_offset > std::numeric_limits<uint32_t>::max() ||
+        payload_size > std::numeric_limits<uint32_t>::max() ||
+        !AllocationContains(
+          static_cast<uint32_t>(payload_offset),
+          static_cast<uint32_t>(payload_size)
+        )
+      ) {
+        SetError(
+          "invalid-request-pointer",
+          "SDS PIV external arena TAB payload range is not owned by the module SDK allocator."
+        );
+        return false;
+      }
+      payload_ptr = ConstPtr(static_cast<uint32_t>(payload_offset));
+    } else if (FrameRangeExceedsArena(payload_offset, payload_size, arena_size)) {
       SetError("invalid-request-frame", "Input frame payload range exceeds request payload arena.");
       return false;
+    } else if (payload_size > 0u && payload_arena) {
+      payload_ptr = payload_arena->data() + static_cast<std::ptrdiff_t>(payload_offset);
+    }
+    if (
+      payload_ptr &&
+      frame_alignment > 1u &&
+      (reinterpret_cast<uintptr_t>(payload_ptr) % frame_alignment) != 0u
+    ) {
+      SetError("misaligned-input-frame", "SDS PIV TAB payload violates its declared alignment.");
+      return false;
     }
 
     g_invoke_context.inputs.emplace_back();
     auto &owned = g_invoke_context.inputs.back();
     owned = InputFrameOwned{};
-    owned.port_id = frame.port_id;
-    if (frame.type_ref) {
-      owned.schema_name = frame.type_ref->schema_name;
-      owned.file_identifier = frame.type_ref->file_identifier;
-      owned.root_type_name = frame.type_ref->root_type_name;
-    }
-    owned.payload.insert(
-      owned.payload.end(),
-      request.payload_arena.begin() + static_cast<std::ptrdiff_t>(payload_offset),
-      request.payload_arena.begin() + static_cast<std::ptrdiff_t>(payload_offset + payload_size)
-    );
-
-    owned.view.port_id = owned.port_id.empty() ? nullptr : owned.port_id.c_str();
-    owned.view.schema_name = owned.schema_name.empty() ? nullptr : owned.schema_name.c_str();
-    owned.view.file_identifier = owned.file_identifier.empty() ? nullptr : owned.file_identifier.c_str();
-    owned.view.wire_format =
-      frame.type_ref
-        ? static_cast<uint32_t>(frame.type_ref->wire_format)
-        : static_cast<uint32_t>(orbpro::stream::PayloadWireFormat_Flatbuffer);
-    owned.view.root_type_name = owned.root_type_name.empty() ? nullptr : owned.root_type_name.c_str();
-    owned.view.fixed_string_length = frame.type_ref ? frame.type_ref->fixed_string_length : 0;
-    owned.view.byte_length = frame.type_ref ? frame.type_ref->byte_length : static_cast<uint32_t>(payload_size);
-    owned.view.required_alignment = frame.type_ref ? frame.type_ref->required_alignment : 0;
-    owned.view.alignment = frame.alignment;
-    owned.view.size = frame.size;
-    owned.view.generation = frame.generation;
-    owned.view.trace_id = frame.trace_id;
-    owned.view.stream_id = frame.stream_id;
-    owned.view.sequence = frame.sequence;
-    owned.view.end_of_stream = frame.end_of_stream ? 1 : 0;
-    owned.view.payload = owned.payload.empty() ? nullptr : owned.payload.data();
-    owned.view.payload_length = static_cast<uint32_t>(owned.payload.size());
+    owned.port_id = FlatBufferStringValue(frame->PORT_ID());
+    if (const auto *type_ref = frame->TYPE_REF()) {
+      owned.schema_name = FlatBufferStringValue(type_ref->SCHEMA_NAME());
+      owned.file_identifier = FlatBufferStringValue(type_ref->FILE_IDENTIFIER());
+      owned.root_type_name = FlatBufferStringValue(type_ref->ROOT_TYPE());
+      owned.schema_version = FlatBufferStringValue(type_ref->SCHEMA_VERSION());
+      if (const auto *schema_hash = type_ref->SCHEMA_HASH()) {
+        owned.schema_hash.assign(schema_hash->begin(), schema_hash->end());
+      }
+      owned.type_wire_format = static_cast<uint32_t>(type_ref->WIRE_FORMAT());
+      // A compiled edge descriptor describes the canonical/aligned pair. A
+      // host may therefore carry the aligned peer's fixed-layout scalars on a
+      // canonical PIV type reference. They are not part of the canonical
+      // representation and the public input ABI promises canonical zeroes.
+      // Preserve them only for aligned-binary frames, where exact layout and
+      // alignment validation below remains mandatory.
+      if (owned.type_wire_format ==
+          static_cast<uint32_t>(kPayloadWireFormatAlignedBinary)) {
+        owned.view.fixed_string_length = type_ref->FIXED_STRING_LENGTH();
+        owned.view.byte_length = type_ref->BYTE_LENGTH();
+        owned.view.required_alignment = type_ref->REQUIRED_ALIGNMENT();
+      }
+    }
+    owned.external_payload = payload_ptr;
+    owned.external_payload_length = static_cast<uint32_t>(payload_size);
+
+    owned.view.wire_format = static_cast<uint32_t>(frame->WIRE_FORMAT());
+    owned.view.alignment = static_cast<uint16_t>(frame_alignment);
+    owned.view.size = frame->SIZE();
+    owned.view.generation = 0;
+    const auto frame_id = frame->FRAME_ID();
+    owned.view.trace_id = frame_id;
+    owned.view.stream_id = 0;
+    owned.view.sequence = DecodeSdsFrameSequence(frame_id);
+    owned.view.end_of_stream = DecodeSdsFrameEndOfStream(frame_id) ? 1 : 0;
+    owned.view.ownership = static_cast<uint32_t>(frame->OWNERSHIP());
+    owned.view.mutability = static_cast<uint32_t>(frame->MUTABILITY());
+    PopulateInputView(&owned);
   }
 
   return true;
 }
 
+static bool PivRequestUsesExternalPayloadArena(const PIVRequest &request) {
+  const auto *payload_arena = request.PAYLOAD_ARENA();
+  if (payload_arena && payload_arena->size() > 0u) {
+    return false;
+  }
+  const auto *input_frames = request.INPUTS();
+  if (!input_frames) {
+    return false;
+  }
+  for (size_t index = 0; index < input_frames->size(); index += 1) {
+    const auto *frame = input_frames->Get(
+      static_cast<::flatbuffers::uoffset_t>(index)
+    );
+    if (frame && frame->SIZE() > 0u) {
+      return true;
+    }
+  }
+  return false;
+}
+
 static bool ValidateRequiredInputs(const MethodDescriptor *method) {
   if (!method) {
     return false;
@@ -425,61 +1011,255 @@ static bool ValidateRequiredInputs(const MethodDescriptor *method) {
   return true;
 }
 
-static orbpro::invoke::PluginInvokeResponseT BuildResponseObject() {
-  orbpro::invoke::PluginInvokeResponseT response{};
-  response.status_code = g_invoke_context.status_code;
-  response.yielded = g_invoke_context.yielded;
-  response.backlog_remaining = g_invoke_context.backlog_remaining;
-  response.error_code = g_invoke_context.error_code;
-  response.error_message = g_invoke_context.error_message;
+static bool InputBufferContractAllowed(const plugin_input_frame_t &frame) {
+  const bool known_ownership =
+    frame.ownership == static_cast<uint32_t>(kBufferOwnershipHostOwned) ||
+    frame.ownership == static_cast<uint32_t>(kBufferOwnershipPluginOwned) ||
+    frame.ownership == static_cast<uint32_t>(kBufferOwnershipTransferred);
+  const bool immutable =
+    frame.mutability == static_cast<uint32_t>(kBufferMutabilityImmutable);
+  const bool mutable_or_append_only =
+    frame.mutability == static_cast<uint32_t>(kBufferMutabilitySingleWriterMutable) ||
+    frame.mutability == static_cast<uint32_t>(kBufferMutabilityAppendOnly);
+  if (!known_ownership || (!immutable && !mutable_or_append_only)) {
+    return false;
+  }
+  return immutable ||
+    frame.ownership == static_cast<uint32_t>(kBufferOwnershipTransferred);
+}
+
+static bool ValidateInputFrames(const MethodDescriptor *method) {
+  if (!method) {
+    return false;
+  }
+  for (const auto &frame : g_invoke_context.inputs) {
+    const auto *port = FindInputPort(method, frame.port_id);
+    if (!port) {
+      SetError(
+        "unknown-input-port",
+        std::string("Input frame uses undeclared port: ") + frame.port_id
+      );
+      return false;
+    }
+    if (!InputBufferContractAllowed(frame.view)) {
+      SetError(
+        "incompatible-input-buffer-contract",
+        std::string("Input frame ownership/mutability is incompatible with port: ") +
+          frame.port_id
+      );
+      return false;
+    }
+    if (!InputTypeAllowed(*port, frame)) {
+      SetError(
+        "unsupported-input-type",
+        std::string("Input frame type is not accepted by port: ") + frame.port_id
+      );
+      return false;
+    }
+  }
+  return ValidateRequiredInputs(method);
+}
+
+static pivStatus ResolvePivStatus(
+  int32_t status_code,
+  bool yielded,
+  const std::string &error_code
+) {
+  if (yielded) {
+    return kPivStatusYielded;
+  }
+  if (status_code == 404) {
+    return kPivStatusNotFound;
+  }
+  if (status_code != 0 || !error_code.empty()) {
+    return kPivStatusFailed;
+  }
+  return kPivStatusOk;
+}
 
-  uint32_t arena_offset = 0;
-  for (const auto &output : g_invoke_context.outputs) {
+static std::vector<uint8_t> SerializePivResponse(
+  int32_t status_code,
+  bool yielded,
+  uint32_t backlog_remaining,
+  const std::vector<OutputFrameOwned> &outputs,
+  const std::string &error_code,
+  const std::string &error_message,
+  uint64_t trace_id = 0,
+  bool external_payload_descriptors = false
+) {
+  struct PackedOutputFrame {
+    const OutputFrameOwned *output = nullptr;
+    uint32_t offset = 0;
+    uint32_t size = 0;
+    uint32_t alignment = 1;
+    bufferOwnership ownership = kBufferOwnershipHostOwned;
+  };
+
+  std::vector<uint8_t> payload_arena{};
+  std::vector<PackedOutputFrame> packed_outputs{};
+  size_t arena_offset = 0;
+  for (const auto &output : outputs) {
     const uint32_t alignment = std::max<uint32_t>(
       1u,
       output.required_alignment > 0 ? output.required_alignment : output.alignment
     );
-    const uint32_t aligned_offset = AlignOffset(arena_offset, alignment);
-    response.payload_arena.resize(aligned_offset, 0);
-    response.payload_arena.insert(
-      response.payload_arena.end(),
+    if (external_payload_descriptors) {
+      if (!output.payload_ptr && output.payload_length > 0u) {
+        return SerializePivResponse(
+          500,
+          false,
+          0,
+          {},
+          "invalid-output-payload",
+          "Direct output descriptor payload pointer is null but payload length is non-zero.",
+          trace_id,
+          false
+        );
+      }
+      const uintptr_t payload_address = reinterpret_cast<uintptr_t>(output.payload_ptr);
+      if (
+        payload_address > std::numeric_limits<uint32_t>::max() ||
+        output.payload_length >
+          static_cast<uint32_t>(std::numeric_limits<uint32_t>::max() - payload_address)
+      ) {
+        return SerializePivResponse(
+          500,
+          false,
+          0,
+          {},
+          "output-pointer-overflow",
+          "Direct output descriptor exceeds the 32-bit SDS TAB offset range.",
+          trace_id,
+          false
+        );
+      }
+      packed_outputs.push_back(PackedOutputFrame{
+        &output,
+        static_cast<uint32_t>(payload_address),
+        output.payload_length,
+        alignment,
+        kBufferOwnershipPluginOwned,
+      });
+      continue;
+    }
+
+    size_t aligned_offset = 0;
+    if (
+      !AlignOffsetChecked(arena_offset, alignment, &aligned_offset) ||
+      aligned_offset > std::numeric_limits<uint32_t>::max() ||
+      output.payload.size() >
+        static_cast<size_t>(std::numeric_limits<uint32_t>::max()) - aligned_offset
+    ) {
+      return SerializePivResponse(
+        500,
+        false,
+        0,
+        {},
+        "output-arena-overflow",
+        "Output payload arena exceeds the 32-bit SDS TAB offset range.",
+        trace_id,
+        false
+      );
+    }
+    payload_arena.resize(aligned_offset, 0);
+    payload_arena.insert(
+      payload_arena.end(),
       output.payload.begin(),
       output.payload.end()
     );
-    arena_offset = aligned_offset + static_cast<uint32_t>(output.payload.size());
-
-    auto type_ref = std::make_unique<orbpro::stream::FlatBufferTypeRefT>();
-    type_ref->schema_name = output.schema_name;
-    type_ref->file_identifier = output.file_identifier;
-    type_ref->wire_format =
-      static_cast<orbpro::stream::PayloadWireFormat>(output.wire_format);
-    type_ref->root_type_name = output.root_type_name;
-    type_ref->fixed_string_length = output.fixed_string_length;
-    type_ref->byte_length =
-      output.byte_length > 0 ? output.byte_length : static_cast<uint32_t>(output.payload.size());
-    type_ref->required_alignment = output.required_alignment;
-
-    auto frame = std::make_unique<orbpro::stream::TypedArenaBufferT>();
-    frame->type_ref = std::move(type_ref);
-    frame->port_id = output.port_id;
-    frame->alignment = static_cast<uint16_t>(alignment);
-    frame->offset = aligned_offset;
-    frame->size = static_cast<uint32_t>(output.payload.size());
-    frame->generation = output.generation;
-    frame->trace_id = output.trace_id;
-    frame->stream_id = output.stream_id;
-    frame->sequence = output.sequence;
-    frame->end_of_stream = output.end_of_stream;
-    response.output_frames.emplace_back(std::move(frame));
-  }
-
-  return response;
-}
-
-static std::vector<uint8_t> SerializeResponse(const orbpro::invoke::PluginInvokeResponseT &response) {
+    arena_offset = aligned_offset + output.payload.size();
+    packed_outputs.push_back(PackedOutputFrame{
+      &output,
+      static_cast<uint32_t>(aligned_offset),
+      static_cast<uint32_t>(output.payload.size()),
+      alignment,
+      kBufferOwnershipHostOwned,
+    });
+  }
+
   ::flatbuffers::FlatBufferBuilder builder(1024);
-  const auto root = orbpro::invoke::CreatePluginInvokeResponse(builder, &response);
-  orbpro::invoke::FinishPluginInvokeResponseBuffer(builder, root);
+  std::vector<::flatbuffers::Offset<TAB>> output_frames{};
+  output_frames.reserve(packed_outputs.size());
+  for (const auto &packed : packed_outputs) {
+    const auto *output = packed.output;
+    const auto wire_format =
+      output && output->wire_format == static_cast<uint32_t>(kPayloadWireFormatAlignedBinary)
+        ? kPayloadWireFormatAlignedBinary
+        : kPayloadWireFormatFlatbuffer;
+    const auto type_ref = CreateFlatBufferTypeRefDirect(
+      builder,
+      output && !output->schema_name.empty() ? output->schema_name.c_str() : nullptr,
+      output && !output->file_identifier.empty() ? output->file_identifier.c_str() : nullptr,
+      output && !output->schema_version.empty() ? output->schema_version.c_str() : nullptr,
+      output && !output->root_type_name.empty() ? output->root_type_name.c_str() : nullptr,
+      output && !output->schema_hash.empty() ? &output->schema_hash : nullptr,
+      false,
+      wire_format,
+      output ? output->fixed_string_length : 0u,
+      output ? output->byte_length : 0u,
+      output ? output->required_alignment : 0u
+    );
+    output_frames.push_back(CreateTABDirect(
+      builder,
+      packed.offset,
+      packed.size,
+      packed.alignment,
+      wire_format,
+      type_ref,
+      kBufferMutabilityImmutable,
+      packed.ownership,
+      output && output->has_frame_id ? output->frame_id : 0,
+      output && !output->port_id.empty() ? output->port_id.c_str() : nullptr
+    ));
+  }
+
+  const auto output_vector = builder.CreateVector(output_frames);
+  size_t arena_alignment = static_cast<size_t>(kInvokeArenaAlignment);
+  for (const auto &packed : packed_outputs) {
+    if (static_cast<size_t>(packed.alignment) > arena_alignment) {
+      arena_alignment = static_cast<size_t>(packed.alignment);
+    }
+  }
+  builder.ForceVectorAlignment(
+    payload_arena.size(),
+    sizeof(uint8_t),
+    arena_alignment
+  );
+  const auto arena_vector = builder.CreateVector(payload_arena);
+  const auto error_code_offset =
+    error_code.empty() ? 0 : builder.CreateString(error_code);
+  const auto error_message_offset =
+    error_message.empty() ? 0 : builder.CreateString(error_message);
+  const auto response = CreatePIVResponse(
+    builder,
+    status_code,
+    ResolvePivStatus(status_code, yielded, error_code),
+    yielded,
+    backlog_remaining,
+    output_vector,
+    arena_vector,
+    error_code_offset,
+    error_message_offset,
+    trace_id
+  );
+  const auto root = CreatePIV(builder, 0, response);
+  FinishPIVBuffer(builder, root);
+  if (!payload_arena.empty()) {
+    const auto *serialized =
+      GetPIV(builder.GetBufferPointer());
+    const auto *response_table = serialized ? serialized->RESPONSE() : nullptr;
+    const auto *serialized_arena = response_table ? response_table->PAYLOAD_ARENA() : nullptr;
+    if (!serialized_arena) {
+      std::abort();
+    }
+    const auto arena_offset = static_cast<size_t>(
+      serialized_arena->data() - builder.GetBufferPointer()
+    );
+    if (arena_offset % arena_alignment != 0u) {
+      std::abort();
+    }
+  }
+
   return std::vector<uint8_t>(
     builder.GetBufferPointer(),
     builder.GetBufferPointer() + builder.GetSize()
@@ -489,20 +1269,59 @@ static std::vector<uint8_t> SerializeResponse(const orbpro::invoke::PluginInvoke
 static std::vector<uint8_t> SerializeErrorResponse(
   int32_t status_code,
   const char *error_code,
-  const std::string &error_message
+  const std::string &error_message,
+  uint64_t trace_id = 0
 ) {
-  orbpro::invoke::PluginInvokeResponseT response{};
-  response.status_code = status_code;
-  response.error_code = error_code ? error_code : "invoke-error";
-  response.error_message = error_message;
-  return SerializeResponse(response);
+  return SerializePivResponse(
+    status_code,
+    false,
+    0,
+    {},
+    error_code ? error_code : "invoke-error",
+    error_message,
+    trace_id
+  );
 }
 
-static std::vector<uint8_t> DispatchRequestObject(
-  const orbpro::invoke::PluginInvokeRequestT &request,
+static std::vector<uint8_t> SerializeContextResponse() {
+  return SerializePivResponse(
+    g_invoke_context.status_code,
+    g_invoke_context.yielded,
+    g_invoke_context.backlog_remaining,
+    g_invoke_context.outputs,
+    g_invoke_context.error_code,
+    g_invoke_context.error_message,
+    g_invoke_context.trace_id,
+    g_invoke_context.direct_external_arena_outputs
+  );
+}
+
+static std::vector<uint8_t> DispatchLoadedContext(
+  const MethodDescriptor *method,
+  bool inputs_loaded,
   bool *runtime_error
 ) {
-  const auto *method = FindMethod(request.method_id);
+  if (!inputs_loaded || !ValidateInputFrames(method)) {
+    if (runtime_error) {
+      *runtime_error = true;
+    }
+    if (g_invoke_context.status_code == 0) {
+      g_invoke_context.status_code = 400;
+    }
+    return SerializeContextResponse();
+  }
+
+  g_invoke_context.status_code = method->handler ? method->handler() : -1;
+  return SerializeContextResponse();
+}
+
+static std::vector<uint8_t> DispatchPivRequestObject(
+  const PIVRequest &request,
+  bool *runtime_error
+) {
+  const auto method_id = FlatBufferStringValue(request.METHOD_ID());
+  const auto trace_id = request.TRACE_ID();
+  const auto *method = FindMethod(method_id);
   if (!method) {
     if (runtime_error) {
       *runtime_error = true;
@@ -510,23 +1329,20 @@ static std::vector<uint8_t> DispatchRequestObject(
     return SerializeErrorResponse(
       404,
       "unknown-method",
-      std::string("Unknown method: ") + request.method_id
+      std::string("Unknown method: ") + method_id,
+      trace_id
     );
   }
 
   ResetInvokeContext(method);
-  if (!LoadInputsFromRequest(request) || !ValidateRequiredInputs(method)) {
-    if (runtime_error) {
-      *runtime_error = true;
-    }
-    if (g_invoke_context.status_code == 0) {
-      g_invoke_context.status_code = 400;
-    }
-    return SerializeResponse(BuildResponseObject());
-  }
-
-  g_invoke_context.status_code = method->handler ? method->handler() : -1;
-  return SerializeResponse(BuildResponseObject());
+  g_invoke_context.trace_id = trace_id;
+  g_invoke_context.direct_external_arena_outputs =
+    g_direct_invoke_stream && PivRequestUsesExternalPayloadArena(request);
+  return DispatchLoadedContext(
+    method,
+    LoadInputsFromPivRequest(request),
+    runtime_error
+  );
 }
 
 static std::vector<uint8_t> DispatchRequestBytes(
@@ -541,17 +1357,30 @@ static std::vector<uint8_t> DispatchRequestBytes(
     return SerializeErrorResponse(400, "invalid-request", "Invoke request bytes are empty.");
   }
 
+  if (request_len < 8u || !PIVBufferHasIdentifier(request_bytes)) {
+    if (runtime_error) {
+      *runtime_error = true;
+    }
+    return SerializeErrorResponse(400, "invalid-request", "Invoke request must be an SDS PIV envelope.");
+  }
+
   ::flatbuffers::Verifier verifier(request_bytes, request_len);
-  if (!orbpro::invoke::VerifyPluginInvokeRequestBuffer(verifier)) {
+  if (!VerifyPIVBuffer(verifier)) {
     if (runtime_error) {
       *runtime_error = true;
     }
-    return SerializeErrorResponse(400, "invalid-request", "Invoke request FlatBuffer verification failed.");
+    return SerializeErrorResponse(400, "invalid-request", "SDS PIV invoke envelope verification failed.");
   }
 
-  const auto *request = orbpro::invoke::GetPluginInvokeRequest(request_bytes);
-  auto request_object = std::unique_ptr<orbpro::invoke::PluginInvokeRequestT>(request->UnPack());
-  return DispatchRequestObject(*request_object, runtime_error);
+  const auto *envelope = GetPIV(request_bytes);
+  const auto *request = envelope ? envelope->REQUEST() : nullptr;
+  if (!request) {
+    if (runtime_error) {
+      *runtime_error = true;
+    }
+    return SerializeErrorResponse(400, "invalid-request", "SDS PIV invoke envelope does not contain a request.");
+  }
+  return DispatchPivRequestObject(*request, runtime_error);
 }
 
 static bool ReadAllStdin(std::vector<uint8_t> *bytes_out) {
@@ -586,26 +1415,68 @@ static bool WriteAllStdout(const uint8_t *bytes, size_t length) {
   return std::fwrite(bytes, 1, length, stdout) == length && std::fflush(stdout) == 0;
 }
 
-static bool BuildRawShortcutRequest(
+static bool LoadRawShortcutInput(
   const MethodDescriptor *method,
-  const std::vector<uint8_t> &stdin_bytes,
-  orbpro::invoke::PluginInvokeRequestT *request
+  const std::vector<uint8_t> &stdin_bytes
 ) {
-  if (!method || !method->raw_shortcut_allowed || !request) {
+  if (!method || !method->raw_shortcut_allowed) {
     return false;
   }
-  request->method_id = method->method_id;
-  request->payload_arena = stdin_bytes;
-
-  auto frame = std::make_unique<orbpro::stream::TypedArenaBufferT>();
-  frame->port_id = method->raw_input_port_id ? method->raw_input_port_id : "";
-  frame->alignment = 1;
-  frame->offset = 0;
-  frame->size = static_cast<uint32_t>(stdin_bytes.size());
-  request->input_frames.emplace_back(std::move(frame));
+  g_invoke_context.inputs.clear();
+  g_invoke_context.inputs.emplace_back();
+  auto &owned = g_invoke_context.inputs.back();
+  owned = InputFrameOwned{};
+  if (method->input_port_count != 1u) {
+    return false;
+  }
+  const auto *accepted = FindCanonicalInputType(method->input_ports[0]);
+  if (!accepted) {
+    return false;
+  }
+  owned.port_id = method->raw_input_port_id ? method->raw_input_port_id : "";
+  owned.schema_name = accepted->schema_name ? accepted->schema_name : "";
+  owned.file_identifier = accepted->file_identifier ? accepted->file_identifier : "";
+  owned.root_type_name = accepted->root_type_name ? accepted->root_type_name : "";
+  owned.schema_version = accepted->schema_version ? accepted->schema_version : "";
+  if (accepted->schema_hash && accepted->schema_hash_length > 0u) {
+    owned.schema_hash.assign(
+      accepted->schema_hash,
+      accepted->schema_hash + accepted->schema_hash_length
+    );
+  }
+  owned.type_wire_format = accepted->wire_format;
+  owned.payload = stdin_bytes;
+  owned.view.wire_format = static_cast<uint32_t>(kPayloadWireFormatFlatbuffer);
+  owned.view.fixed_string_length = accepted->fixed_string_length;
+  owned.view.byte_length = accepted->byte_length;
+  owned.view.required_alignment = accepted->required_alignment;
+  owned.view.alignment = 1;
+  owned.view.size = static_cast<uint32_t>(stdin_bytes.size());
+  owned.view.generation = 0;
+  owned.view.trace_id = 0;
+  owned.view.stream_id = 0;
+  owned.view.sequence = 0;
+  owned.view.end_of_stream = 0;
+  owned.view.ownership = static_cast<uint32_t>(kBufferOwnershipHostOwned);
+  owned.view.mutability = static_cast<uint32_t>(kBufferMutabilityImmutable);
+  PopulateInputView(&owned);
   return true;
 }
 
+static std::vector<uint8_t> DispatchRawShortcut(
+  const MethodDescriptor *method,
+  const std::vector<uint8_t> &stdin_bytes,
+  bool *runtime_error
+) {
+  ResetInvokeContext(method);
+  g_invoke_context.trace_id = 0;
+  return DispatchLoadedContext(
+    method,
+    LoadRawShortcutInput(method, stdin_bytes),
+    runtime_error
+  );
+}
+
 }  // namespace
 
 extern "C" uint32_t plugin_get_input_count(void) {
@@ -655,7 +1526,7 @@ extern "C" int32_t plugin_push_output(
     port_id,
     schema_name,
     file_identifier,
-    static_cast<uint32_t>(orbpro::stream::PayloadWireFormat_Flatbuffer),
+    static_cast<uint32_t>(kPayloadWireFormatFlatbuffer),
     nullptr,
     0,
     0,
@@ -680,29 +1551,116 @@ extern "C" int32_t plugin_push_output_typed(
     SetError("invalid-output-port", "Output frames must declare a non-empty port id.");
     return -1;
   }
-  if (!MethodDeclaresOutputPort(g_invoke_context.method, port_id)) {
+  const PortRequirement *output_port = FindOutputPort(g_invoke_context.method, port_id);
+  if (!output_port) {
     SetError(
       "unknown-output-port",
       std::string("Output port is not declared on the active method: ") + port_id
     );
     return -1;
   }
+  if (!payload_ptr && payload_length > 0u) {
+    SetError("invalid-output-payload", "Output payload pointer is null but payload length is non-zero.");
+    return -1;
+  }
+  const AcceptedTypeRef *accepted_type = output_port->accepted_type_count > 0u
+    ? ResolveOutputType(
+        *output_port,
+        schema_name,
+        file_identifier,
+        wire_format,
+        root_type_name,
+        fixed_string_length,
+        byte_length,
+        required_alignment,
+        payload_length)
+    : nullptr;
+  if (output_port->accepted_type_count > 0u && !accepted_type) {
+    SetError(
+      "unsupported-output-type",
+      std::string("Output frame does not match a declared type on port: ") + port_id
+    );
+    return -1;
+  }
 
   OutputFrameOwned frame{};
   frame.port_id = ReadCString(port_id);
-  frame.schema_name = ReadCString(schema_name);
-  frame.file_identifier = ReadCString(file_identifier);
-  frame.root_type_name = ReadCString(root_type_name);
-  frame.wire_format = wire_format;
-  frame.fixed_string_length = fixed_string_length;
-  frame.byte_length = byte_length > 0u ? byte_length : payload_length;
-  frame.required_alignment = required_alignment;
-  frame.alignment = required_alignment > 0 ? required_alignment : 8;
+  // A MATCHED WILDCARD IS NOT A TYPE DESCRIPTION.
+  //
+  // The manifest is authoritative over a frame's identity and layout only when
+  // the matched entry actually DESCRIBES one. An acceptsAnyFlatbuffer entry
+  // describes nothing: no schema name, no root type, no byteLength, no
+  // alignment. Copying it over the caller's values stamped every wildcard frame
+  // with byteLength 0 / requiredAlignment 0 and then, for an aligned-binary
+  // payload, re-declared its wire format as flatbuffer — producing a TAB
+  // descriptor the SDK's own decoder rejects ("aligned type requiredAlignment
+  // must be a positive power of two"). A wildcard match overrides nothing; the
+  // frame keeps what the guest declared.
+  const AcceptedTypeRef *typed_match =
+    (accepted_type && !accepted_type->accepts_any_flatbuffer) ? accepted_type : nullptr;
+  frame.schema_name = typed_match
+    ? ReadCString(typed_match->schema_name)
+    : ReadCString(schema_name);
+  frame.file_identifier = typed_match
+    ? ReadCString(typed_match->file_identifier)
+    : ReadCString(file_identifier);
+  frame.root_type_name = typed_match
+    ? ReadCString(typed_match->root_type_name)
+    : ReadCString(root_type_name);
+  frame.schema_version = typed_match
+    ? ReadCString(typed_match->schema_version)
+    : std::string{};
+  if (typed_match && typed_match->schema_hash && typed_match->schema_hash_length > 0u) {
+    frame.schema_hash.assign(
+      typed_match->schema_hash,
+      typed_match->schema_hash + typed_match->schema_hash_length
+    );
+  }
+  frame.wire_format = typed_match && typed_match->has_wire_format
+    ? typed_match->wire_format
+    : wire_format;
+  const bool aligned_binary =
+    frame.wire_format == static_cast<uint32_t>(kPayloadWireFormatAlignedBinary);
+  frame.fixed_string_length = aligned_binary
+    ? (typed_match ? typed_match->fixed_string_length : fixed_string_length)
+    : 0u;
+  frame.byte_length = aligned_binary
+    ? (typed_match
+        ? typed_match->byte_length
+        : (byte_length > 0u ? byte_length : payload_length))
+    : 0u;
+  frame.required_alignment = aligned_binary
+    ? (typed_match ? typed_match->required_alignment : required_alignment)
+    : 0u;
+  frame.alignment = aligned_binary && frame.required_alignment > 0
+    ? frame.required_alignment
+    : 8;
+  frame.payload_ptr = payload_ptr;
+  frame.payload_length = payload_length;
+  bool payload_is_sdk_owned = false;
   if (payload_ptr && payload_length > 0u) {
+    const uintptr_t payload_address = reinterpret_cast<uintptr_t>(payload_ptr);
+    payload_is_sdk_owned =
+      payload_address <= std::numeric_limits<uint32_t>::max() &&
+      AllocationContains(static_cast<uint32_t>(payload_address), payload_length);
+  }
+  if (
+    payload_ptr &&
+    payload_length > 0u &&
+    (!g_invoke_context.direct_external_arena_outputs || !payload_is_sdk_owned)
+  ) {
     frame.payload.insert(frame.payload.end(), payload_ptr, payload_ptr + payload_length);
   }
 
   g_invoke_context.outputs.emplace_back(std::move(frame));
+  OutputFrameOwned &stored_frame = g_invoke_context.outputs.back();
+  if (
+    g_invoke_context.direct_external_arena_outputs &&
+    !stored_frame.payload.empty()
+  ) {
+    stored_frame.payload_ptr = stored_frame.payload.data();
+    stored_frame.payload_length = static_cast<uint32_t>(stored_frame.payload.size());
+  }
   return static_cast<int32_t>(g_invoke_context.outputs.size() - 1u);
 }
 
@@ -724,13 +1682,39 @@ extern "C" int32_t plugin_push_output_ex(
     wire_format,
     root_type_name,
     fixed_string_length,
-    payload_length,
+    wire_format == static_cast<uint32_t>(kPayloadWireFormatAlignedBinary)
+      ? payload_length
+      : 0u,
     required_alignment,
     payload_ptr,
     payload_length
   );
 }
 
+extern "C" int32_t plugin_set_output_frame_id(uint32_t output_index, uint64_t frame_id) {
+  if (output_index >= g_invoke_context.outputs.size()) {
+    SetError("invalid-output-frame", "Output frame index is out of range.");
+    return -1;
+  }
+  auto &frame = g_invoke_context.outputs[output_index];
+  frame.has_frame_id = true;
+  frame.frame_id = frame_id;
+  frame.sequence = DecodeSdsFrameSequence(frame_id);
+  frame.end_of_stream = DecodeSdsFrameEndOfStream(frame_id);
+  return 0;
+}
+
+extern "C" int32_t plugin_set_output_stream_frame(
+  uint32_t output_index,
+  uint64_t sequence,
+  int32_t end_of_stream
+) {
+  return plugin_set_output_frame_id(
+    output_index,
+    EncodeSdsFrameId(sequence, end_of_stream != 0)
+  );
+}
+
 extern "C" void plugin_set_yielded(int32_t yielded) {
   g_invoke_context.yielded = yielded != 0;
 }
@@ -745,14 +1729,30 @@ extern "C" void plugin_set_error(const char *error_code, const char *error_messa
 }
 
 extern "C" uint32_t plugin_alloc(uint32_t size) {
-  const auto allocation_size = size > 0u ? size : 1u;
-  void *ptr = std::malloc(allocation_size);
-  return ptr ? static_cast<uint32_t>(reinterpret_cast<uintptr_t>(ptr)) : 0u;
+  // Every region handed across the host boundary is 8-byte aligned so the
+  // FlatBuffer arena base stays aligned end-to-end. malloc already returns
+  // >=8-aligned blocks on wasm32; this asserts the invariant (fail hard, no
+  // realignment fallback) and rounds the size so allocator metadata cannot
+  // shrink the guarantee.
+  const uint32_t requested = size > 0u ? size : 1u;
+  const uint32_t allocation_size =
+    (requested + (kInvokeAllocAlignment - 1u)) & ~(kInvokeAllocAlignment - 1u);
+  void *ptr = nullptr;
+  if (posix_memalign(&ptr, static_cast<size_t>(kInvokeAllocAlignment), allocation_size) != 0) {
+    return 0u;
+  }
+  if ((reinterpret_cast<uintptr_t>(ptr) % kInvokeAllocAlignment) != 0u) {
+    std::free(ptr);
+    return 0u;
+  }
+  const uint32_t result = static_cast<uint32_t>(reinterpret_cast<uintptr_t>(ptr));
+  TrackAllocation(result, allocation_size);
+  return result;
 }
 
 extern "C" void plugin_free(uint32_t ptr, uint32_t size) {
   (void)size;
-  if (ptr != 0u) {
+  if (ptr != 0u && UntrackAllocation(ptr)) {
     std::free(reinterpret_cast<void *>(PtrFromU32(ptr)));
   }
 }
@@ -762,16 +1762,42 @@ extern "C" uint32_t plugin_invoke_stream(
   uint32_t request_len,
   uint32_t response_len_out_ptr
 ) {
+  if (response_len_out_ptr != 0u && !AllocationContains(response_len_out_ptr, 4u)) {
+    return 0u;
+  }
   if (response_len_out_ptr != 0u) {
     *MutableU32Ptr(response_len_out_ptr) = 0u;
   }
 
   bool runtime_error = false;
-  const auto response_bytes = DispatchRequestBytes(
-    ConstPtr(request_ptr),
-    static_cast<size_t>(request_len),
-    &runtime_error
-  );
+  std::vector<uint8_t> response_bytes;
+  if (request_len > 0u && !AllocationContains(request_ptr, request_len)) {
+    runtime_error = true;
+    response_bytes = SerializeErrorResponse(
+      400,
+      "invalid-request-pointer",
+      "Direct invoke request pointer range is not owned by the module SDK allocator."
+    );
+  } else if (request_ptr != 0u && (request_ptr % kInvokeArenaAlignment) != 0u) {
+    runtime_error = true;
+    response_bytes = SerializeErrorResponse(
+      400,
+      "misaligned-request",
+      "Invoke request buffer base is not 8-byte aligned."
+    );
+  } else {
+    const bool previous_direct_invoke_stream = g_direct_invoke_stream;
+    g_direct_invoke_stream = true;
+    response_bytes = DispatchRequestBytes(
+      ConstPtr(request_ptr),
+      static_cast<size_t>(request_len),
+      &runtime_error
+    );
+    g_direct_invoke_stream = previous_direct_invoke_stream;
+  }
+  if (response_bytes.size() > std::numeric_limits<uint32_t>::max()) {
+    return 0u;
+  }
 
   const uint32_t response_ptr = plugin_alloc(static_cast<uint32_t>(response_bytes.size()));
   if (response_ptr == 0u) {
@@ -819,45 +1845,48 @@ ${includeCommandMain
       return 64;
     }
 
-    orbpro::invoke::PluginInvokeRequestT shortcut_request{};
-    if (!BuildRawShortcutRequest(method, stdin_bytes, &shortcut_request)) {
-      std::fprintf(stderr, "Failed to construct raw shortcut request.\\n");
-      return 64;
-    }
-
     bool runtime_error = false;
-    const auto response_bytes = DispatchRequestObject(shortcut_request, &runtime_error);
+    const auto response_bytes = DispatchRawShortcut(method, stdin_bytes, &runtime_error);
     ::flatbuffers::Verifier verifier(response_bytes.data(), response_bytes.size());
-    if (!orbpro::invoke::VerifyPluginInvokeResponseBuffer(verifier)) {
+    if (!VerifyPIVBuffer(verifier)) {
       std::fprintf(stderr, "Shortcut response verification failed.\\n");
       return 70;
     }
 
-    auto response = std::unique_ptr<orbpro::invoke::PluginInvokeResponseT>(
-      orbpro::invoke::GetPluginInvokeResponse(response_bytes.data())->UnPack()
-    );
-    if (runtime_error || response->status_code != 0 || !response->error_code.empty()) {
-      if (!response->error_message.empty()) {
-        std::fprintf(stderr, "%s\\n", response->error_message.c_str());
+    const auto *response_envelope = GetPIV(response_bytes.data());
+    const auto *response = response_envelope ? response_envelope->RESPONSE() : nullptr;
+    if (!response) {
+      std::fprintf(stderr, "Shortcut response missing PIV response body.\\n");
+      return 70;
+    }
+    const auto error_code = FlatBufferStringValue(response->ERROR_CODE());
+    const auto error_message = FlatBufferStringValue(response->ERROR_MESSAGE());
+    if (runtime_error || response->STATUS_CODE() != 0 || !error_code.empty()) {
+      if (!error_message.empty()) {
+        std::fprintf(stderr, "%s\\n", error_message.c_str());
       }
       return 1;
     }
-    if (response->output_frames.size() > 1u) {
+    const auto *output_frames = response->OUTPUTS();
+    const auto output_count = output_frames ? output_frames->size() : 0u;
+    if (output_count > 1u) {
       std::fprintf(stderr, "Raw shortcut mode produced more than one output frame.\\n");
       return 65;
     }
-    if (response->output_frames.empty()) {
+    if (output_count == 0u) {
       return 0;
     }
 
-    const auto &frame = *response->output_frames[0];
-    const auto payload_offset = static_cast<size_t>(frame.offset);
-    const auto payload_size = static_cast<size_t>(frame.size);
-    if (payload_offset + payload_size > response->payload_arena.size()) {
+    const auto *frame = output_frames->Get(0);
+    const auto *payload_arena = response->PAYLOAD_ARENA();
+    const auto payload_offset = static_cast<size_t>(frame ? frame->OFFSET() : 0u);
+    const auto payload_size = static_cast<size_t>(frame ? frame->SIZE() : 0u);
+    const auto arena_size = payload_arena ? payload_arena->size() : 0u;
+    if (!frame || !payload_arena || FrameRangeExceedsArena(payload_offset, payload_size, arena_size)) {
       std::fprintf(stderr, "Raw shortcut output frame exceeds response payload arena.\\n");
       return 70;
     }
-    if (!WriteAllStdout(response->payload_arena.data() + payload_offset, payload_size)) {
+    if (!WriteAllStdout(payload_arena->data() + payload_offset, payload_size)) {
       std::fprintf(stderr, "Failed to write stdout.\\n");
       return 74;
     }