@rootzero/contracts 0.7.2 → 0.9.0

package/commands/Base.sol

@@ -1,17 +1,15 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import {OperationBase} from "../core/Operation.sol";
+import {NodeCalls} from "../core/Calls.sol";
 import {Cur} from "../Cursors.sol";
 import {CommandEvent} from "../events/Command.sol";
-import {State} from "../utils/State.sol";
+import {Keys} from "../blocks/Keys.sol";
 import {Ids, Selectors} from "../utils/Ids.sol";
 import {Budget, Values} from "../utils/Value.sol";
 
 /// @notice Execution context passed to every command invocation.
 struct CommandContext {
-    /// @dev Destination command node ID; zero means "any command on this host".
-    uint target;
     /// @dev Caller's account identifier.
     bytes32 account;
     /// @dev Current state block stream (previous command output or initial state).
@@ -20,22 +18,22 @@ struct CommandContext {
     bytes request;
 }
 
-/// @notice ABI-encode a command call from a target command ID and execution context.
-/// @dev Derives the function selector from `target` via `Ids.commandSelector(target)`.
-/// Reverts if `target` is not a valid command ID.
-/// @param target Destination command node ID embedding the target selector.
+/// @notice ABI-encode a command call from a command ID and execution context.
+/// @dev Derives the function selector from `cid` via `Ids.commandSelector(cid)`.
+/// Reverts if `cid` is not a valid command ID.
+/// @param cid Command node ID embedding the target selector.
 /// @param account Caller account identifier for the command context.
 /// @param state Current state block stream passed to the command.
 /// @param request Input block stream for the command invocation.
 /// @return ABI-encoded calldata for the command entry point.
 function encodeCommandCall(
-    uint target,
+    uint cid,
     bytes32 account,
     bytes memory state,
     bytes calldata request
 ) pure returns (bytes memory) {
-    bytes4 selector = Ids.commandSelector(target);
-    CommandContext memory ctx = CommandContext(target, account, state, request);
+    bytes4 selector = Ids.commandSelector(cid);
+    CommandContext memory ctx = CommandContext(account, state, request);
     return abi.encodeWithSelector(selector, ctx);
 }
 
@@ -43,26 +41,31 @@ function encodeCommandCall(
 /// @notice Abstract base for all rootzero command contracts.
 /// Provides access control modifiers, event emission, and the `commandId`
 /// helper used to derive stable identifiers for named commands.
-abstract contract CommandBase is OperationBase, CommandEvent {
+abstract contract CommandBase is NodeCalls, CommandEvent {
     /// @dev Thrown when `onlyActive` finds that `deadline` has already passed.
     error Expired();
+    /// @dev Thrown when the raw active account word in calldata does not match the decoded context account.
+    error ActiveAccountMismatch();
     /// @dev Thrown when `onlyAdmin` finds that `account` is not the admin account.
     error NotAdmin();
-    /// @dev Thrown when `onlyCommand` finds that `target` does not match this command's ID.
-    error UnexpectedEndpoint();
 
-    /// @dev Restrict execution to calls where `account` is the host's admin account.
+    /// @dev Restrict execution to trusted callers whose decoded context account matches the active calldata account.
+    modifier onlyCommand(bytes32 account) {
+        if (activeAccount() != account) revert ActiveAccountMismatch();
+        enforceCaller(msg.sender);
+        _;
+    }
+
+    /// @dev Restrict execution to trusted callers using the host's admin account.
     modifier onlyAdmin(bytes32 account) {
+        if (activeAccount() != account) revert ActiveAccountMismatch();
         if (account != adminAccount) revert NotAdmin();
+        enforceCaller(msg.sender);
         _;
     }
 
-    /// @dev Restrict execution to trusted callers targeting this specific command.
-    /// A zero `target` is treated as a wildcard and matches any command.
-    /// @param cid This command's node ID (from `commandId`).
-    /// @param target Requested destination from the `CommandContext`.
-    modifier onlyCommand(uint cid, uint target) {
-        if (target != 0 && target != cid) revert UnexpectedEndpoint();
+    /// @dev Restrict execution to callers whose host node is trusted.
+    modifier onlyTrusted() {
         enforceCaller(msg.sender);
         _;
     }
@@ -75,13 +78,20 @@ abstract contract CommandBase is OperationBase, CommandEvent {
     }
 
     /// @notice Derive the deterministic node ID for a named command on this contract.
-    /// The ID encodes the ABI selector of `name((uint256,bytes32,bytes,bytes))` and
+    /// The ID encodes the ABI selector of `name((bytes32,bytes,bytes))` and
     /// `address(this)`, making it unique per (function name, contract address) pair.
     /// @param name Command function name (without argument list).
     /// @return Command node ID.
     function commandId(string memory name) internal view returns (uint) {
         return Ids.toCommand(Selectors.command(name), address(this));
     }
+
+    /// @notice Return the active command account directly from the fixed tuple head in calldata.
+    /// @dev Command entrypoints use the ABI shape `name((bytes32,bytes,bytes))`, so the tuple head
+    /// starts at byte 36 of `msg.data`, with the account field at bytes [36:68).
+    function activeAccount() internal pure returns (bytes32 account) {
+        account = bytes32(msg.data[36:68]);
+    }
 }
 
 /// @title CommandPayable

package/commands/Burn.sol

@@ -1,22 +1,13 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import { CommandBase, CommandContext, State } from "./Base.sol";
+import { CommandBase, CommandContext, Keys } from "./Base.sol";
 import { Cursors, Cur } from "../Cursors.sol";
 using Cursors for Cur;
 
 string constant NAME = "burn";
 
-/// @title Burn
-/// @notice Command that irreversibly destroys each BALANCE state block via a virtual hook.
-/// Produces no output state.
-abstract contract Burn is CommandBase {
-    uint internal immutable burnId = commandId(NAME);
-
-    constructor() {
-        emit Command(host, NAME, "", burnId, State.Balances, State.Empty, false);
-    }
-
+abstract contract BurnHook {
     /// @notice Override to burn or consume the provided balance amount.
     /// Called once per BALANCE block in state.
     /// @param account Caller's account identifier.
@@ -25,8 +16,19 @@ abstract contract Burn is CommandBase {
     /// @param amount Amount to burn.
     /// @return Amount actually burned (may differ from `amount` for partial burns).
     function burn(bytes32 account, bytes32 asset, bytes32 meta, uint amount) internal virtual returns (uint);
+}
+
+/// @title Burn
+/// @notice Command that irreversibly destroys each BALANCE state block via a virtual hook.
+/// Produces no output state.
+abstract contract Burn is CommandBase, BurnHook {
+    uint internal immutable burnId = commandId(NAME);
+
+    constructor() {
+        emit Command(host, burnId, NAME, "", Keys.Balance, Keys.Empty, false);
+    }
 
-    function burn(CommandContext calldata c) external onlyCommand(burnId, c.target) returns (bytes memory) {
+    function burn(CommandContext calldata c) external onlyCommand(c.account) returns (bytes memory) {
         (Cur memory state, , ) = cursor(c.state, 1);
 
         while (state.i < state.bound) {

package/commands/Credit.sol

@@ -1,37 +1,38 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import { CommandBase, CommandContext, State } from "./Base.sol";
+import { CommandBase, CommandContext, Keys } from "./Base.sol";
 import { Cursors, Cur, Schemas } from "../Cursors.sol";
 string constant NAME = "creditAccount";
 
 using Cursors for Cur;
 
+abstract contract CreditAccountHook {
+    /// @notice Override to credit externally managed funds to `account`.
+    /// Called once per BALANCE block in state.
+    /// @param account Destination account identifier.
+    /// @param asset Asset identifier.
+    /// @param meta Asset metadata slot.
+    /// @param amount Amount to credit.
+    function creditAccount(bytes32 account, bytes32 asset, bytes32 meta, uint amount) internal virtual;
+}
+
 /// @title CreditAccount
 /// @notice Command that delivers BALANCE state blocks to an account via a virtual hook.
 /// Use for internally recording credits that have already been settled externally.
-/// An optional RECIPIENT block in the request overrides the default `c.account` destination.
-abstract contract CreditAccount is CommandBase {
+/// An optional ACCOUNT block in the request overrides the default `c.account` destination.
+abstract contract CreditAccount is CommandBase, CreditAccountHook {
     uint internal immutable creditAccountId = commandId(NAME);
 
     constructor() {
-        emit Command(host, NAME, Schemas.Recipient, creditAccountId, State.Balances, State.Empty, false);
+        emit Command(host, creditAccountId, NAME, Schemas.Account, Keys.Balance, Keys.Empty, false);
     }
 
-    /// @notice Override to credit externally managed funds to `account`.
-    /// Called once per BALANCE block in state.
-    /// @param account Recipient account identifier.
-    /// @param asset Asset identifier.
-    /// @param meta Asset metadata slot.
-    /// @param amount Amount to credit.
-    function creditAccount(bytes32 account, bytes32 asset, bytes32 meta, uint amount) internal virtual;
-
     function creditAccount(
         CommandContext calldata c
-    ) external onlyCommand(creditAccountId, c.target) returns (bytes memory) {
+    ) external onlyCommand(c.account) returns (bytes memory) {
         (Cur memory state, , ) = cursor(c.state, 1);
-        Cur memory request = cursor(c.request);
-        bytes32 to = request.recipientAfter(c.account);
+        bytes32 to = Cursors.resolveAccount(c.request, c.account);
 
         while (state.i < state.bound) {
             (bytes32 asset, bytes32 meta, uint amount) = state.unpackBalance();

package/commands/Debit.sol

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import { CommandContext, CommandBase, State } from "./Base.sol";
+import { CommandContext, CommandBase, Keys } from "./Base.sol";
 import { Cursors, Cur, Schemas, Writer, Writers } from "../Cursors.sol";
 
 string constant NAME = "debitAccount";
@@ -9,25 +9,27 @@ string constant NAME = "debitAccount";
 using Cursors for Cur;
 using Writers for Writer;
 
+abstract contract DebitAccountHook {
+    /// @notice Override to debit externally managed funds from `account`.
+    /// Called once per AMOUNT block before a matching BALANCE is emitted.
+    /// @param account Source account identifier.
+    /// @param asset Asset identifier.
+    /// @param meta Asset metadata slot.
+    /// @param amount Amount to debit.
+    function debitAccount(bytes32 account, bytes32 asset, bytes32 meta, uint amount) internal virtual;
+}
+
 /// @title DebitAccount
 /// @notice Command that deducts AMOUNT blocks from an account and emits matching BALANCE state.
 /// Use for internally recording debits. The virtual `debitAccount` hook is called once per
 /// AMOUNT block; the default batch implementation handles the full request loop.
-abstract contract DebitAccount is CommandBase {
+abstract contract DebitAccount is CommandBase, DebitAccountHook {
     uint internal immutable debitAccountId = commandId(NAME);
 
     constructor() {
-        emit Command(host, NAME, Schemas.Amount, debitAccountId, State.Empty, State.Balances, false);
+        emit Command(host, debitAccountId, NAME, Schemas.Amount, Keys.Empty, Keys.Balance, false);
     }
 
-    /// @notice Override to debit externally managed funds from `account`.
-    /// Called once per AMOUNT block before a matching BALANCE is emitted.
-    /// @param account Source account identifier.
-    /// @param asset Asset identifier.
-    /// @param meta Asset metadata slot.
-    /// @param amount Amount to debit.
-    function debitAccount(bytes32 account, bytes32 asset, bytes32 meta, uint amount) internal virtual;
-
     /// @notice Override to customize request parsing or batching for debits.
     /// The default implementation iterates AMOUNT blocks, calls
     /// `debitAccount`, and emits matching BALANCE blocks.
@@ -46,7 +48,7 @@ abstract contract DebitAccount is CommandBase {
 
     function debitAccount(
         CommandContext calldata c
-    ) external onlyCommand(debitAccountId, c.target) returns (bytes memory) {
+    ) external onlyCommand(c.account) returns (bytes memory) {
         return debitAccount(c.account, c.request);
     }
 }

package/commands/Deposit.sol

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import { CommandContext, CommandBase, CommandPayable, State } from "./Base.sol";
+import { CommandContext, CommandBase, CommandPayable, Keys } from "./Base.sol";
 import { Cursors, Cur, Schemas, Writer, Writers } from "../Cursors.sol";
 import { Budget, Values } from "../utils/Value.sol";
 
@@ -11,34 +11,43 @@ string constant DEPOSIT_PAYABLE = "depositPayable";
 using Cursors for Cur;
 using Writers for Writer;
 
+abstract contract DepositHook {
+    /// @notice Override to receive externally sourced funds for `account`.
+    /// Called once per AMOUNT block. A matching BALANCE block is appended to the
+    /// output after each call.
+    /// @param account Destination account identifier.
+    /// @param asset Asset identifier.
+    /// @param meta Asset metadata slot.
+    /// @param amount Amount received.
+    function deposit(bytes32 account, bytes32 asset, bytes32 meta, uint amount) internal virtual;
+}
+
+abstract contract DepositPayableHook {
+    /// @notice Override to receive externally sourced funds for `account`.
+    /// Called once per AMOUNT block. A matching BALANCE block is appended to the
+    /// output after each call.
+    /// @param account Destination account identifier.
+    /// @param asset Asset identifier.
+    /// @param meta Asset metadata slot.
+    /// @param amount Amount received.
+    /// @param budget Mutable native-value budget drawn from `msg.value`.
+    function deposit(bytes32 account, bytes32 asset, bytes32 meta, uint amount, Budget memory budget) internal virtual;
+}
+
 /// @title Deposit
 /// @notice Command that receives externally sourced assets and records them as BALANCE state.
 /// Use `deposit` for assets arriving from outside the protocol (e.g. ERC-20 transfers, ETH).
 /// For internal balance deductions, use `debitAccount` instead.
-abstract contract Deposit is CommandBase {
+abstract contract Deposit is CommandBase, DepositHook {
     uint internal immutable depositId = commandId(DEPOSIT);
 
     constructor() {
-        emit Command(host, DEPOSIT, Schemas.Amount, depositId, State.Empty, State.Balances, false);
+        emit Command(host, depositId, DEPOSIT, Schemas.Amount, Keys.Empty, Keys.Balance, false);
     }
 
-    /// @notice Override to receive externally sourced funds for `account`.
-    /// Called once per AMOUNT block. A matching BALANCE block is appended to the
-    /// output after each call.
-    /// @param account Recipient account identifier.
-    /// @param asset Asset identifier.
-    /// @param meta Asset metadata slot.
-    /// @param amount Amount received.
-    function deposit(
-        bytes32 account,
-        bytes32 asset,
-        bytes32 meta,
-        uint amount
-    ) internal virtual;
-
     function deposit(
         CommandContext calldata c
-    ) external onlyCommand(depositId, c.target) returns (bytes memory) {
+    ) external onlyCommand(c.account) returns (bytes memory) {
         (Cur memory request, uint count, ) = cursor(c.request, 1);
         Writer memory writer = Writers.allocBalances(count);
 
@@ -55,32 +64,16 @@ abstract contract Deposit is CommandBase {
 /// @title DepositPayable
 /// @notice Command that receives externally sourced assets and records them as BALANCE state.
 /// Use `depositPayable` when the hook needs tracked access to `msg.value` via a mutable budget.
-abstract contract DepositPayable is CommandPayable {
+abstract contract DepositPayable is CommandPayable, DepositPayableHook {
     uint internal immutable depositPayableId = commandId(DEPOSIT_PAYABLE);
 
     constructor() {
-        emit Command(host, DEPOSIT_PAYABLE, Schemas.Amount, depositPayableId, State.Empty, State.Balances, true);
+        emit Command(host, depositPayableId, DEPOSIT_PAYABLE, Schemas.Amount, Keys.Empty, Keys.Balance, true);
     }
 
-    /// @notice Override to receive externally sourced funds for `account`.
-    /// Called once per AMOUNT block. A matching BALANCE block is appended to the
-    /// output after each call.
-    /// @param account Recipient account identifier.
-    /// @param asset Asset identifier.
-    /// @param meta Asset metadata slot.
-    /// @param amount Amount received.
-    /// @param budget Mutable native-value budget drawn from `msg.value`.
-    function deposit(
-        bytes32 account,
-        bytes32 asset,
-        bytes32 meta,
-        uint amount,
-        Budget memory budget
-    ) internal virtual;
-
     function depositPayable(
         CommandContext calldata c
-    ) external payable onlyCommand(depositPayableId, c.target) returns (bytes memory) {
+    ) external payable onlyCommand(c.account) returns (bytes memory) {
         (Cur memory request, uint count, ) = cursor(c.request, 1);
         Writer memory writer = Writers.allocBalances(count);
         Budget memory budget = Values.fromMsg();

package/commands/Pipe.sol

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import {CommandBase, CommandContext, CommandPayable} from "./Base.sol";
+import {CommandBase, CommandContext, CommandPayable, Keys} from "./Base.sol";
 import {Cursors, Cur, Schemas} from "../Cursors.sol";
 import {Accounts} from "../utils/Accounts.sol";
 import {Budget, Values} from "../utils/Value.sol";
@@ -10,34 +10,28 @@ using Cursors for Cur;
 
 string constant NAME = "pipePayable";
 
+abstract contract PipePayableHook {
+    function dispatchStep(
+        uint target,
+        bytes32 account,
+        bytes memory state,
+        bytes calldata request,
+        uint value
+    ) internal virtual returns (bytes memory);
+}
+
 /// @title PipePayable
 /// @notice Command that sequences multiple sub-command STEP invocations in a single transaction.
 /// Each STEP block carries a target node, native value to forward, and an embedded request.
 /// State threads through the steps: each step's output becomes the next step's state.
 /// Admin accounts are not permitted to use `pipePayable`.
-abstract contract PipePayable is CommandPayable {
+abstract contract PipePayable is CommandPayable, PipePayableHook {
     uint internal immutable pipePayableId = commandId(NAME);
 
     constructor() {
-        emit Command(host, NAME, Schemas.Step, pipePayableId, 0, 0, true);
+        emit Command(host, pipePayableId, NAME, Schemas.Step, Keys.Empty, Keys.Empty, true);
     }
 
-    /// @notice Override to execute a single STEP and return the resulting state.
-    /// The returned state is passed as the `state` argument of the next STEP.
-    /// @param target Destination command node ID from the STEP block.
-    /// @param account Caller's account identifier.
-    /// @param state Current threaded state from the previous step.
-    /// @param request Embedded request bytes from the STEP block.
-    /// @param value Native value forwarded with this step.
-    /// @return Next state to thread into the following step.
-    function dispatchStep(
-        uint target,
-        bytes32 account,
-        bytes memory state,
-        bytes calldata request,
-        uint value
-    ) internal virtual returns (bytes memory);
-
     function pipe(
         bytes32 account,
         bytes memory state,
@@ -60,7 +54,7 @@ abstract contract PipePayable is CommandPayable {
     /// @notice Execute the pipePayable command.
     function pipePayable(
         CommandContext calldata c
-    ) external payable onlyCommand(pipePayableId, c.target) returns (bytes memory) {
+    ) external payable onlyCommand(c.account) returns (bytes memory) {
         if (Accounts.isAdmin(c.account)) revert Accounts.InvalidAccount();
         Budget memory budget = Values.fromMsg();
         return pipe(c.account, c.state, c.request, budget);

package/commands/Provision.sol

@@ -1,24 +1,23 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import {CommandContext, CommandBase, CommandPayable, State} from "./Base.sol";
-import {Cursors, Cur, HostAmount, Schemas, Writer, Writers} from "../Cursors.sol";
+import {CommandContext, CommandBase, CommandPayable, Keys} from "./Base.sol";
+import {HostAmount, Cursors, Cur, Schemas, Writer, Writers} from "../Cursors.sol";
 import {Budget, Values} from "../utils/Value.sol";
 using Cursors for Cur;
 using Writers for Writer;
 
 string constant PROVISION = "provision";
 string constant PP = "provisionPayable";
-string constant PFB = "provisionFromBalance";
 
-/// @notice Shared provision hook used by both `Provision` and `ProvisionFromBalance`.
+/// @notice Shared provision hook used by `Provision`.
 abstract contract ProvisionHook {
     /// @notice Override to send or provision a custody value.
     /// Called once per provisioned asset. Implementations should perform only the
     /// side effect (e.g. transfer or record); output blocks are written by the caller.
     /// @param account Caller's account identifier.
-    /// @param custody Destination host plus asset amount to provision.
-    function provision(bytes32 account, HostAmount memory custody) internal virtual;
+    /// @param allocation Host-scoped amount to provision.
+    function provision(bytes32 account, HostAmount memory allocation) internal virtual;
 }
 
 /// @notice Shared provision hook used by `ProvisionPayable`.
@@ -27,29 +26,29 @@ abstract contract ProvisionPayableHook {
     /// Called once per provisioned asset. Implementations should perform only the
     /// side effect (e.g. transfer or record); output blocks are written by the caller.
     /// @param account Caller's account identifier.
-    /// @param custody Destination host plus asset amount to provision.
+    /// @param allocation Host-scoped amount to provision.
     /// @param budget Mutable native-value budget drawn from `msg.value`.
-    function provision(bytes32 account, HostAmount memory custody, Budget memory budget) internal virtual;
+    function provision(bytes32 account, HostAmount memory allocation, Budget memory budget) internal virtual;
 }
 
 /// @title Provision
-/// @notice Command that provisions assets to remote hosts from CUSTODY request blocks.
+/// @notice Command that provisions assets to remote hosts from ALLOCATION request blocks.
 /// Each request block supplies the target host plus an asset amount; the output is a CUSTODY state stream.
 abstract contract Provision is CommandBase, ProvisionHook {
     uint internal immutable provisionId = commandId(PROVISION);
 
     constructor() {
-        emit Command(host, PROVISION, Schemas.Custody, provisionId, State.Empty, State.Custodies, false);
+        emit Command(host, provisionId, PROVISION, Schemas.Allocation, Keys.Empty, Keys.Custody, false);
     }
 
-    function provision(CommandContext calldata c) external onlyCommand(provisionId, c.target) returns (bytes memory) {
+    function provision(CommandContext calldata c) external onlyCommand(c.account) returns (bytes memory) {
         (Cur memory request, uint count, ) = cursor(c.request, 1);
         Writer memory writer = Writers.allocCustodies(count);
 
         while (request.i < request.bound) {
-            HostAmount memory custody = request.unpackCustodyValue();
-            provision(c.account, custody);
-            writer.appendCustody(custody);
+            HostAmount memory allocation = request.unpackAllocationValue();
+            provision(c.account, allocation);
+            writer.appendCustody(allocation);
         }
 
         return request.complete(writer);
@@ -57,27 +56,27 @@ abstract contract Provision is CommandBase, ProvisionHook {
 }
 
 /// @title ProvisionPayable
-/// @notice Command that provisions assets to remote hosts from CUSTODY request blocks.
+/// @notice Command that provisions assets to remote hosts from ALLOCATION request blocks.
 /// Each request block supplies the target host plus an asset amount; the output is a CUSTODY state stream.
 /// The hook receives a mutable native-value budget drawn from `msg.value`.
 abstract contract ProvisionPayable is CommandPayable, ProvisionPayableHook {
     uint internal immutable provisionPayableId = commandId(PP);
 
     constructor() {
-        emit Command(host, PP, Schemas.Custody, provisionPayableId, State.Empty, State.Custodies, true);
+        emit Command(host, provisionPayableId, PP, Schemas.Allocation, Keys.Empty, Keys.Custody, true);
     }
 
     function provisionPayable(
         CommandContext calldata c
-    ) external payable onlyCommand(provisionPayableId, c.target) returns (bytes memory) {
+    ) external payable onlyCommand(c.account) returns (bytes memory) {
         (Cur memory request, uint count, ) = cursor(c.request, 1);
         Writer memory writer = Writers.allocCustodies(count);
         Budget memory budget = Values.fromMsg();
 
         while (request.i < request.bound) {
-            HostAmount memory custody = request.unpackCustodyValue();
-            provision(c.account, custody, budget);
-            writer.appendCustody(custody);
+            HostAmount memory allocation = request.unpackAllocationValue();
+            provision(c.account, allocation, budget);
+            writer.appendCustody(allocation);
         }
 
         settleValue(c.account, budget);
@@ -85,32 +84,3 @@ abstract contract ProvisionPayable is CommandPayable, ProvisionPayableHook {
     }
 }
 
-/// @title ProvisionFromBalance
-/// @notice Command that converts BALANCE state into CUSTODY state for a destination host.
-/// The destination node is read from an optional NODE trailing block; reverts if absent.
-abstract contract ProvisionFromBalance is CommandBase, ProvisionHook {
-    uint internal immutable provisionFromBalanceId = commandId(PFB);
-
-    constructor() {
-        emit Command(host, PFB, Schemas.Node, provisionFromBalanceId, State.Balances, State.Custodies, false);
-    }
-
-    function provisionFromBalance(
-        CommandContext calldata c
-    ) external onlyCommand(provisionFromBalanceId, c.target) returns (bytes memory) {
-        (Cur memory state, uint stateCount, ) = cursor(c.state, 1);
-        Cur memory request = cursor(c.request);
-        Writer memory writer = Writers.allocCustodies(stateCount);
-        uint peer = request.nodeAfter(0);
-        if (peer == 0) revert Cursors.ZeroNode();
-
-        while (state.i < state.bound) {
-            (bytes32 asset, bytes32 meta, uint amount) = state.unpackBalance();
-            HostAmount memory custody = HostAmount(peer, asset, meta, amount);
-            provision(c.account, custody);
-            writer.appendCustody(custody);
-        }
-
-        return state.complete(writer);
-    }
-}

package/commands/Transfer.sol

@@ -1,34 +1,33 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import { CommandContext, CommandBase, State } from "./Base.sol";
+import { CommandContext, CommandBase, Keys } from "./Base.sol";
 import { Cursors, Cur, Schemas, Tx } from "../Cursors.sol";
 import { Accounts } from "../utils/Accounts.sol";
 using Cursors for Cur;
 
 string constant NAME = "transfer";
-string constant INPUT = string.concat(Schemas.Amount, "&", Schemas.Recipient);
 
 abstract contract TransferHook {
     /// @notice Override to execute a single transfer record from the request pipeline.
-    /// Called once per bundled AMOUNT+RECIPIENT pair in the request.
+    /// Called once per PAYOUT block in the request.
     /// @param value Decoded transfer record (from, to, asset, meta, amount).
     function transfer(Tx memory value) internal virtual;
 }
 
 /// @title Transfer
 /// @notice Command that transfers assets from a caller to recipients specified in
-/// bundled AMOUNT+RECIPIENT request blocks. Produces no state output.
-/// The virtual `transfer(value)` hook is called once per bundle.
+/// PAYOUT request blocks. Produces no state output.
+/// The virtual `transfer(value)` hook is called once per entry.
 abstract contract Transfer is CommandBase, TransferHook {
     uint internal immutable transferId = commandId(NAME);
 
     constructor() {
-        emit Command(host, NAME, INPUT, transferId, State.Empty, State.Empty, false);
+        emit Command(host, transferId, NAME, Schemas.Payout, Keys.Empty, Keys.Empty, false);
     }
 
     /// @notice Override to customize request parsing or batching for transfers.
-    /// The default implementation iterates bundles and calls `transfer(value)` for each.
+    /// The default implementation iterates entry blocks and calls `transfer(value)` for each.
     /// @param from Source account identifier.
     /// @param request Full request bytes.
     /// @return Empty bytes (transfers produce no state output).
@@ -38,9 +37,8 @@ abstract contract Transfer is CommandBase, TransferHook {
         value.from = from;
 
         while (input.i < input.bound) {
-            Cur memory bundle = input.bundle();
-            (value.asset, value.meta, value.amount) = bundle.unpackAmount();
-            value.to = Accounts.ensure(bundle.unpackRecipient());
+            (value.to, value.asset, value.meta, value.amount) = input.unpackPayout();
+            Accounts.ensure(value.to);
             transfer(value);
         }
 
@@ -50,14 +48,7 @@ abstract contract Transfer is CommandBase, TransferHook {
 
     function transfer(
         CommandContext calldata c
-    ) external onlyCommand(transferId, c.target) returns (bytes memory) {
+    ) external onlyCommand(c.account) returns (bytes memory) {
         return transfer(c.account, c.request);
     }
 }
-
-
-
-
-
-
-