@@ -65,6 +65,27 @@ typedef struct ArrowArrayStream FFI_ArrowArrayStream;
 #endif
 """
 
+trailer = """
+#include <string.h>
+
+/**
+ * Create a vx_str view over a null-terminated C string.
+ * The view borrows the bytes; it is valid for as long as `str` is.
+ */
+#ifdef __cplusplus
+static inline vx_str vx_str_from_cstr(const char* str) {
+    vx_str s;
+    s.ptr = str;
+    s.len = strlen(str);
+    return s;
+}
+#else
+static inline vx_str vx_str_from_cstr(const char* str) {
+    return (vx_str){ str, strlen(str) };
+}
+#endif
+"""
+
 [export.rename]
 "f16" = "uint16_t"
 
 
@@ -66,7 +66,7 @@ typedef struct ArrowArrayStream FFI_ArrowArrayStream;
  * The version of the Vortex C ABI declared by this header.
  * Incremented on every backward-incompatible change to the C API.
  */
-#define VX_ABI_VERSION 1
+#define VX_ABI_VERSION 2
 
 /**
  * Maximum size of an inlined binary value.
@@ -497,11 +497,6 @@ typedef struct vx_array_iterator vx_array_iterator;
  */
 typedef struct vx_array_sink vx_array_sink;
 
-/**
- * Strings for use within Vortex.
- */
-typedef struct vx_binary vx_binary;
-
 /**
  * A reference to one or more (possibly remote) paths.
  * Creating vx_data_source opens the first matched path to read the schema.
@@ -569,11 +564,6 @@ typedef struct vx_scan vx_scan;
  */
 typedef struct vx_session vx_session;
 
-/**
- * Strings for use within Vortex.
- */
-typedef struct vx_string vx_string;
-
 typedef struct vx_struct_column_builder vx_struct_column_builder;
 
 /**
@@ -602,17 +592,38 @@ typedef struct {
     const vx_array *array;
 } vx_validity;
 
+/**
+ * A non-owning view over a byte range, used for strings crossing the FFI in both directions.
+ * Not a handle: there is nothing to `_free`/`_clone`. Inputs are copied by the callee and need
+ * only stay valid for the call; outputs borrow from the owned handle named in the function's
+ * doc and live as long as it. Bytes are NOT null-terminated; NULL `ptr` requires `len == 0`.
+ */
+typedef struct {
+    /**
+     * Pointer to the first byte of the string. NULL is allowed only when `len` is 0.
+     */
+    const char *ptr;
+    /**
+     * Length of the string in bytes.
+     */
+    size_t len;
+} vx_str;
+
 /**
  * Options for creating a data source.
  */
 typedef struct {
     /**
      * Required: paths to files, tables, or layout trees.
-     * May be a glob pattern like "*.vortex".
-     * If you want to include multiple paths, concat them with a comma:
-     * "file1.vortex,../file2.vortex".
+     * Each entry may be a glob pattern like "*.vortex".
+     * Must point to an array of `paths_len` entries, valid for the duration
+     * of the call; the bytes are copied.
+     */
+    const vx_str *paths;
+    /**
+     * Number of entries in `paths`.
      */
-    const char *paths;
+    size_t paths_len;
 } vx_data_source_options;
 
 /**
@@ -851,16 +862,18 @@ double vx_array_get_f64(const vx_array *array, size_t index);
 double vx_array_get_storage_f64(const vx_array *array, size_t index);
 
 /**
- * Return the utf-8 string at `index` in the array. The pointer will be null if the value at `index` is null.
- * The caller must free the returned pointer.
+ * Return the utf-8 string at `index` in a canonical Utf8 array. The view borrows from the
+ * array's buffers and is valid while the handle is alive; a null element yields `{NULL, 0}`
+ * without error. Errors on a non-canonical array (call `vx_array_canonicalize` first) or an
+ * out-of-bounds index.
  */
-const vx_string *vx_array_get_utf8(const vx_array *array, uint32_t index);
+vx_str vx_array_utf8_at(const vx_array *array, size_t index, vx_error **error_out);
 
 /**
- * Return the binary at `index` in the array. The pointer will be null if the value at `index` is null.
- * The caller must free the returned pointer.
+ * Return the binary value at `index` in a canonical Binary array.
+ * Same contract as `vx_array_utf8_at`.
  */
-const vx_binary *vx_array_get_binary(const vx_array *array, uint32_t index);
+vx_str vx_array_binary_at(const vx_array *array, size_t index, vx_error **error_out);
 
 /**
  * Return the value at `index` in a Bool-typed array.
@@ -910,31 +923,6 @@ void vx_array_iterator_free(const vx_array_iterator *ptr);
  */
 const vx_array *vx_array_iterator_next(vx_array_iterator *iter, vx_error **error_out);
 
-/**
- * Clone a vx_binary. Returned handle must be release with vx_binary_free
- */
-const vx_binary *vx_binary_clone(const vx_binary *ptr);
-
-/**
- * Free a vx_binary
- */
-void vx_binary_free(const vx_binary *ptr);
-
-/**
- * Create a new Vortex UTF-8 string by copying from a pointer and length.
- */
-const vx_binary *vx_binary_new(const char *ptr, size_t len);
-
-/**
- * Return the length of the string in bytes.
- */
-size_t vx_binary_len(const vx_binary *ptr);
-
-/**
- * Return the pointer to the string data.
- */
-const char *vx_binary_ptr(const vx_binary *ptr);
-
 /**
  * Clone a vx_data_source. Returned handle must be release with vx_data_source_free
  */
@@ -1108,9 +1096,12 @@ bool vx_dtype_is_timestamp(const DType *dtype);
 uint8_t vx_dtype_time_unit(const DType *dtype);
 
 /**
- * Returns the time zone, assuming the type is time. Caller is responsible for freeing the returned pointer.
+ * Returns the time zone, assuming the type is time.
+ *
+ * The returned view borrows from `dtype` and is valid while that handle is alive.
+ * Returns a `{NULL, 0}` view when the timestamp has no time zone.
  */
-const vx_string *vx_dtype_time_zone(const DType *dtype);
+vx_str vx_dtype_time_zone(const DType *dtype);
 
 /**
  * Convert a dtype to ArrowSchema.
@@ -1137,9 +1128,11 @@ const vx_dtype *vx_dtype_from_arrow_schema(FFI_ArrowSchema *schema, vx_error **e
 void vx_error_free(const vx_error *ptr);
 
 /**
- * Return an error message for this error
+ * Return the error message for this error.
+ *
+ * The returned view borrows from `error` and is valid while the error handle is alive.
  */
-const vx_string *vx_error_get_message(const vx_error *error);
+vx_str vx_error_message(const vx_error *error);
 
 /**
  * Return the stable category code for this error.
@@ -1217,7 +1210,7 @@ vx_expression *vx_expression_literal(const vx_scalar *scalar, vx_error **err);
  * vx_expression_free(select);
  * vx_expression_free(root);
  */
-vx_expression *vx_expression_select(const char *const *names, size_t len, const vx_expression *child);
+vx_expression *vx_expression_select(const vx_str *names, size_t len, const vx_expression *child);
 
 /**
  * Create an AND expression for multiple child expressions.
@@ -1279,8 +1272,11 @@ vx_expression *vx_expression_is_null(const vx_expression *child);
  *
  * Example: if child is Struct { name=u8, age=u16 } and we do
  * vx_expression_get_item("name", child), output type will be DTYPE_U8
+ *
+ * The `item` bytes are copied. Returns NULL if `child` is NULL or `item` is
+ * not valid UTF-8.
  */
-vx_expression *vx_expression_get_item(const char *item, const vx_expression *child);
+vx_expression *vx_expression_get_item(vx_str item, const vx_expression *child);
 
 /**
  * Create an expression that checks if a value is contained in a list.
@@ -1299,10 +1295,7 @@ const vx_file *vx_file_clone(const vx_file *ptr);
  */
 void vx_file_free(const vx_file *ptr);
 
-void vx_file_write_array(const vx_session *session,
-                         const char *path,
-                         const vx_array *array,
-                         vx_error **error_out);
+void vx_file_write_array(const vx_session *session, vx_str path, const vx_array *array, vx_error **error_out);
 
 /**
  * Set the stderr logger to output at the specified level.
@@ -1401,11 +1394,10 @@ vx_scalar *vx_scalar_new_f16_bits(uint16_t bits, bool is_nullable);
 /**
  * Create a UTF-8 scalar.
  *
- * The byte range is copied into the scalar. A NULL data pointer is allowed only
- * for an empty byte range. Invalid UTF-8 returns NULL and writes the error
- * output.
+ * The string bytes are copied into the scalar. Invalid UTF-8 returns NULL and
+ * writes the error output.
  */
-vx_scalar *vx_scalar_new_utf8(const char *ptr, size_t len, bool is_nullable, vx_error **err);
+vx_scalar *vx_scalar_new_utf8(vx_str value, bool is_nullable, vx_error **err);
 
 /**
  * Create a binary scalar.
@@ -1638,11 +1630,10 @@ vx_session *vx_session_clone(const vx_session *session);
 /**
  * Opens a writable array stream, where sink is used to push values into the stream.
  * To close the stream close the sink with `vx_array_sink_close`.
+ * The `path` bytes are copied.
  */
-vx_array_sink *vx_array_sink_open_file(const vx_session *session,
-                                       const char *path,
-                                       const vx_dtype *dtype,
-                                       vx_error **error_out);
+vx_array_sink *
+vx_array_sink_open_file(const vx_session *session, vx_str path, const vx_dtype *dtype, vx_error **error_out);
 
 /**
  * Push an array into a file sink.
@@ -1662,36 +1653,6 @@ void vx_array_sink_close(vx_array_sink *sink, vx_error **error_out);
  */
 void vx_array_sink_abort(vx_array_sink *sink);
 
-/**
- * Clone a vx_string. Returned handle must be release with vx_string_free
- */
-const vx_string *vx_string_clone(const vx_string *ptr);
-
-/**
- * Free a vx_string
- */
-void vx_string_free(const vx_string *ptr);
-
-/**
- * Create a new Vortex UTF-8 string by copying from a pointer and length.
- */
-const vx_string *vx_string_new(const char *ptr, size_t len);
-
-/**
- * Create a new Vortex UTF-8 string by copying from a null-terminated C-style string.
- */
-const vx_string *vx_string_new_from_cstr(const char *ptr);
-
-/**
- * Return the length of the string in bytes.
- */
-size_t vx_string_len(const vx_string *ptr);
-
-/**
- * Return the pointer to the string data.
- */
-const char *vx_string_ptr(const vx_string *ptr);
-
 /**
  * Free an owned [`vx_struct_column_builder`] object.
  */
@@ -1714,7 +1675,7 @@ vx_struct_column_builder *vx_struct_column_builder_new(const vx_validity *validi
  * deallocate it using vx_struct_column_builder_free.
  */
 void vx_struct_column_builder_add_field(vx_struct_column_builder *builder,
-                                        const char *name,
+                                        vx_str name,
                                         const vx_array *field,
                                         vx_error **error);
 
@@ -1754,10 +1715,12 @@ void vx_struct_fields_free(const vx_struct_fields *ptr);
 uint64_t vx_struct_fields_nfields(const vx_struct_fields *dtype);
 
 /**
- * Return an owned name of the field at a given index.
- * If index is out of bounds, returns NULL.
+ * Return the name of the field at a given index.
+ * If index is out of bounds, returns a `{NULL, 0}` view.
+ *
+ * The returned view borrows from `dtype` and is valid while that handle is alive.
  */
-const vx_string *vx_struct_fields_field_name(const vx_struct_fields *dtype, size_t idx);
+vx_str vx_struct_fields_field_name(const vx_struct_fields *dtype, size_t idx);
 
 /**
  * Return an owned dtype of the field at a given index.
@@ -1778,12 +1741,13 @@ vx_struct_fields_builder *vx_struct_fields_builder_new(void);
 /**
  * Add a field to the struct dtype builder.
  *
- * Takes ownership of both the `name` and `dtype` pointers.
+ * The `name` bytes are copied. Takes ownership of the `dtype` pointer.
  * Must either free or finalize the builder.
  */
 void vx_struct_fields_builder_add_field(vx_struct_fields_builder *builder,
-                                        const vx_string *name,
-                                        const vx_dtype *dtype);
+                                        vx_str name,
+                                        const vx_dtype *dtype,
+                                        vx_error **error_out);
 
 /**
  * Finalize the struct dtype builder, returning a new `vx_struct_fields`.
@@ -1795,3 +1759,22 @@ vx_struct_fields *vx_struct_fields_builder_finalize(vx_struct_fields_builder *bu
 #ifdef __cplusplus
 } // extern "C"
 #endif // __cplusplus
+
+#include <string.h>
+
+/**
+ * Create a vx_str view over a null-terminated C string.
+ * The view borrows the bytes; it is valid for as long as `str` is.
+ */
+#ifdef __cplusplus
+static inline vx_str vx_str_from_cstr(const char *str) {
+    vx_str s;
+    s.ptr = str;
+    s.len = strlen(str);
+    return s;
+}
+#else
+static inline vx_str vx_str_from_cstr(const char *str) {
+    return (vx_str) {str, strlen(str)};
+}
+#endif
@@ -58,10 +58,9 @@ void print_struct_dtype(const vx_dtype *dtype) {
     printf("struct(\n");
     for (uint64_t i = 0; i < vx_struct_fields_nfields(fields); ++i) {
         const vx_dtype *field_dtype = vx_struct_fields_field_dtype(fields, i);
-        const vx_string *field_name = vx_struct_fields_field_name(fields, i);
-        printf("    %.*s = ", (int)vx_string_len(field_name), vx_string_ptr(field_name));
+        const vx_str field_name = vx_struct_fields_field_name(fields, i);
+        printf("    %.*s = ", (int)field_name.len, field_name.ptr);
         print_dtype(field_dtype);
-        vx_string_free(field_name);
         vx_dtype_free(field_dtype);
     }
     printf(")");
@@ -124,8 +123,8 @@ void print_dtype(const vx_dtype *dtype) {
 }
 
 void print_error(const char *what, const vx_error *error) {
-    const vx_string *str = vx_error_get_message(error);
-    fprintf(stderr, "%s: %.*s\n", what, (int)vx_string_len(str), vx_string_ptr(str));
+    const vx_str str = vx_error_message(error);
+    fprintf(stderr, "%s: %.*s\n", what, (int)str.len, str.ptr);
 }
 
 int main(int argc, char **argv) {
@@ -141,7 +140,8 @@ int main(int argc, char **argv) {
         return 1;
     }
 
-    vx_data_source_options ds_options = {.paths = argv[1]};
+    vx_str path = vx_str_from_cstr(argv[1]);
+    vx_data_source_options ds_options = {.paths = &path, .paths_len = 1};
     const vx_data_source *data_source = vx_data_source_new(session, &ds_options, &error);
     if (data_source == NULL) {
         print_error("Failed to create data source", error);