@rootzero/contracts 0.8.0 → 0.9.0

package/commands/Base.sol

@@ -1,17 +1,15 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import {OperationBase} from "../core/Operation.sol";
+import {NodeCalls} from "../core/Calls.sol";
 import {Cur} from "../Cursors.sol";
 import {CommandEvent} from "../events/Command.sol";
-import {State} from "../utils/State.sol";
+import {Keys} from "../blocks/Keys.sol";
 import {Ids, Selectors} from "../utils/Ids.sol";
 import {Budget, Values} from "../utils/Value.sol";
 
 /// @notice Execution context passed to every command invocation.
 struct CommandContext {
-    /// @dev Destination command node ID; zero means "any command on this host".
-    uint target;
     /// @dev Caller's account identifier.
     bytes32 account;
     /// @dev Current state block stream (previous command output or initial state).
@@ -20,22 +18,22 @@ struct CommandContext {
     bytes request;
 }
 
-/// @notice ABI-encode a command call from a target command ID and execution context.
-/// @dev Derives the function selector from `target` via `Ids.commandSelector(target)`.
-/// Reverts if `target` is not a valid command ID.
-/// @param target Destination command node ID embedding the target selector.
+/// @notice ABI-encode a command call from a command ID and execution context.
+/// @dev Derives the function selector from `cid` via `Ids.commandSelector(cid)`.
+/// Reverts if `cid` is not a valid command ID.
+/// @param cid Command node ID embedding the target selector.
 /// @param account Caller account identifier for the command context.
 /// @param state Current state block stream passed to the command.
 /// @param request Input block stream for the command invocation.
 /// @return ABI-encoded calldata for the command entry point.
 function encodeCommandCall(
-    uint target,
+    uint cid,
     bytes32 account,
     bytes memory state,
     bytes calldata request
 ) pure returns (bytes memory) {
-    bytes4 selector = Ids.commandSelector(target);
-    CommandContext memory ctx = CommandContext(target, account, state, request);
+    bytes4 selector = Ids.commandSelector(cid);
+    CommandContext memory ctx = CommandContext(account, state, request);
     return abi.encodeWithSelector(selector, ctx);
 }
 
@@ -43,26 +41,31 @@ function encodeCommandCall(
 /// @notice Abstract base for all rootzero command contracts.
 /// Provides access control modifiers, event emission, and the `commandId`
 /// helper used to derive stable identifiers for named commands.
-abstract contract CommandBase is OperationBase, CommandEvent {
+abstract contract CommandBase is NodeCalls, CommandEvent {
     /// @dev Thrown when `onlyActive` finds that `deadline` has already passed.
     error Expired();
+    /// @dev Thrown when the raw active account word in calldata does not match the decoded context account.
+    error ActiveAccountMismatch();
     /// @dev Thrown when `onlyAdmin` finds that `account` is not the admin account.
     error NotAdmin();
-    /// @dev Thrown when `onlyCommand` finds that `target` does not match this command's ID.
-    error UnexpectedEndpoint();
 
-    /// @dev Restrict execution to calls where `account` is the host's admin account.
+    /// @dev Restrict execution to trusted callers whose decoded context account matches the active calldata account.
+    modifier onlyCommand(bytes32 account) {
+        if (activeAccount() != account) revert ActiveAccountMismatch();
+        enforceCaller(msg.sender);
+        _;
+    }
+
+    /// @dev Restrict execution to trusted callers using the host's admin account.
     modifier onlyAdmin(bytes32 account) {
+        if (activeAccount() != account) revert ActiveAccountMismatch();
         if (account != adminAccount) revert NotAdmin();
+        enforceCaller(msg.sender);
         _;
     }
 
-    /// @dev Restrict execution to trusted callers targeting this specific command.
-    /// A zero `target` is treated as a wildcard and matches any command.
-    /// @param cid This command's node ID (from `commandId`).
-    /// @param target Requested destination from the `CommandContext`.
-    modifier onlyCommand(uint cid, uint target) {
-        if (target != 0 && target != cid) revert UnexpectedEndpoint();
+    /// @dev Restrict execution to callers whose host node is trusted.
+    modifier onlyTrusted() {
         enforceCaller(msg.sender);
         _;
     }
@@ -75,13 +78,20 @@ abstract contract CommandBase is OperationBase, CommandEvent {
     }
 
     /// @notice Derive the deterministic node ID for a named command on this contract.
-    /// The ID encodes the ABI selector of `name((uint256,bytes32,bytes,bytes))` and
+    /// The ID encodes the ABI selector of `name((bytes32,bytes,bytes))` and
     /// `address(this)`, making it unique per (function name, contract address) pair.
     /// @param name Command function name (without argument list).
     /// @return Command node ID.
     function commandId(string memory name) internal view returns (uint) {
         return Ids.toCommand(Selectors.command(name), address(this));
     }
+
+    /// @notice Return the active command account directly from the fixed tuple head in calldata.
+    /// @dev Command entrypoints use the ABI shape `name((bytes32,bytes,bytes))`, so the tuple head
+    /// starts at byte 36 of `msg.data`, with the account field at bytes [36:68).
+    function activeAccount() internal pure returns (bytes32 account) {
+        account = bytes32(msg.data[36:68]);
+    }
 }
 
 /// @title CommandPayable

package/commands/Burn.sol

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import { CommandBase, CommandContext, State } from "./Base.sol";
+import { CommandBase, CommandContext, Keys } from "./Base.sol";
 import { Cursors, Cur } from "../Cursors.sol";
 using Cursors for Cur;
 
@@ -25,10 +25,10 @@ abstract contract Burn is CommandBase, BurnHook {
     uint internal immutable burnId = commandId(NAME);
 
     constructor() {
-        emit Command(host, NAME, "", burnId, State.Balances, State.Empty, false);
+        emit Command(host, burnId, NAME, "", Keys.Balance, Keys.Empty, false);
     }
 
-    function burn(CommandContext calldata c) external onlyCommand(burnId, c.target) returns (bytes memory) {
+    function burn(CommandContext calldata c) external onlyCommand(c.account) returns (bytes memory) {
         (Cur memory state, , ) = cursor(c.state, 1);
 
         while (state.i < state.bound) {

package/commands/Credit.sol

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import { CommandBase, CommandContext, State } from "./Base.sol";
+import { CommandBase, CommandContext, Keys } from "./Base.sol";
 import { Cursors, Cur, Schemas } from "../Cursors.sol";
 string constant NAME = "creditAccount";
 
@@ -10,7 +10,7 @@ using Cursors for Cur;
 abstract contract CreditAccountHook {
     /// @notice Override to credit externally managed funds to `account`.
     /// Called once per BALANCE block in state.
-    /// @param account Recipient account identifier.
+    /// @param account Destination account identifier.
     /// @param asset Asset identifier.
     /// @param meta Asset metadata slot.
     /// @param amount Amount to credit.
@@ -20,20 +20,19 @@ abstract contract CreditAccountHook {
 /// @title CreditAccount
 /// @notice Command that delivers BALANCE state blocks to an account via a virtual hook.
 /// Use for internally recording credits that have already been settled externally.
-/// An optional RECIPIENT block in the request overrides the default `c.account` destination.
+/// An optional ACCOUNT block in the request overrides the default `c.account` destination.
 abstract contract CreditAccount is CommandBase, CreditAccountHook {
     uint internal immutable creditAccountId = commandId(NAME);
 
     constructor() {
-        emit Command(host, NAME, Schemas.Recipient, creditAccountId, State.Balances, State.Empty, false);
+        emit Command(host, creditAccountId, NAME, Schemas.Account, Keys.Balance, Keys.Empty, false);
     }
 
     function creditAccount(
         CommandContext calldata c
-    ) external onlyCommand(creditAccountId, c.target) returns (bytes memory) {
+    ) external onlyCommand(c.account) returns (bytes memory) {
         (Cur memory state, , ) = cursor(c.state, 1);
-        Cur memory request = cursor(c.request);
-        bytes32 to = request.recipientAfter(c.account);
+        bytes32 to = Cursors.resolveAccount(c.request, c.account);
 
         while (state.i < state.bound) {
             (bytes32 asset, bytes32 meta, uint amount) = state.unpackBalance();

package/commands/Debit.sol

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import { CommandContext, CommandBase, State } from "./Base.sol";
+import { CommandContext, CommandBase, Keys } from "./Base.sol";
 import { Cursors, Cur, Schemas, Writer, Writers } from "../Cursors.sol";
 
 string constant NAME = "debitAccount";
@@ -27,7 +27,7 @@ abstract contract DebitAccount is CommandBase, DebitAccountHook {
     uint internal immutable debitAccountId = commandId(NAME);
 
     constructor() {
-        emit Command(host, NAME, Schemas.Amount, debitAccountId, State.Empty, State.Balances, false);
+        emit Command(host, debitAccountId, NAME, Schemas.Amount, Keys.Empty, Keys.Balance, false);
     }
 
     /// @notice Override to customize request parsing or batching for debits.
@@ -48,7 +48,7 @@ abstract contract DebitAccount is CommandBase, DebitAccountHook {
 
     function debitAccount(
         CommandContext calldata c
-    ) external onlyCommand(debitAccountId, c.target) returns (bytes memory) {
+    ) external onlyCommand(c.account) returns (bytes memory) {
         return debitAccount(c.account, c.request);
     }
 }

package/commands/Deposit.sol

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import { CommandContext, CommandBase, CommandPayable, State } from "./Base.sol";
+import { CommandContext, CommandBase, CommandPayable, Keys } from "./Base.sol";
 import { Cursors, Cur, Schemas, Writer, Writers } from "../Cursors.sol";
 import { Budget, Values } from "../utils/Value.sol";
 
@@ -15,7 +15,7 @@ abstract contract DepositHook {
     /// @notice Override to receive externally sourced funds for `account`.
     /// Called once per AMOUNT block. A matching BALANCE block is appended to the
     /// output after each call.
-    /// @param account Recipient account identifier.
+    /// @param account Destination account identifier.
     /// @param asset Asset identifier.
     /// @param meta Asset metadata slot.
     /// @param amount Amount received.
@@ -26,7 +26,7 @@ abstract contract DepositPayableHook {
     /// @notice Override to receive externally sourced funds for `account`.
     /// Called once per AMOUNT block. A matching BALANCE block is appended to the
     /// output after each call.
-    /// @param account Recipient account identifier.
+    /// @param account Destination account identifier.
     /// @param asset Asset identifier.
     /// @param meta Asset metadata slot.
     /// @param amount Amount received.
@@ -42,12 +42,12 @@ abstract contract Deposit is CommandBase, DepositHook {
     uint internal immutable depositId = commandId(DEPOSIT);
 
     constructor() {
-        emit Command(host, DEPOSIT, Schemas.Amount, depositId, State.Empty, State.Balances, false);
+        emit Command(host, depositId, DEPOSIT, Schemas.Amount, Keys.Empty, Keys.Balance, false);
     }
 
     function deposit(
         CommandContext calldata c
-    ) external onlyCommand(depositId, c.target) returns (bytes memory) {
+    ) external onlyCommand(c.account) returns (bytes memory) {
         (Cur memory request, uint count, ) = cursor(c.request, 1);
         Writer memory writer = Writers.allocBalances(count);
 
@@ -68,12 +68,12 @@ abstract contract DepositPayable is CommandPayable, DepositPayableHook {
     uint internal immutable depositPayableId = commandId(DEPOSIT_PAYABLE);
 
     constructor() {
-        emit Command(host, DEPOSIT_PAYABLE, Schemas.Amount, depositPayableId, State.Empty, State.Balances, true);
+        emit Command(host, depositPayableId, DEPOSIT_PAYABLE, Schemas.Amount, Keys.Empty, Keys.Balance, true);
     }
 
     function depositPayable(
         CommandContext calldata c
-    ) external payable onlyCommand(depositPayableId, c.target) returns (bytes memory) {
+    ) external payable onlyCommand(c.account) returns (bytes memory) {
         (Cur memory request, uint count, ) = cursor(c.request, 1);
         Writer memory writer = Writers.allocBalances(count);
         Budget memory budget = Values.fromMsg();

package/commands/Pipe.sol

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import {CommandBase, CommandContext, CommandPayable} from "./Base.sol";
+import {CommandBase, CommandContext, CommandPayable, Keys} from "./Base.sol";
 import {Cursors, Cur, Schemas} from "../Cursors.sol";
 import {Accounts} from "../utils/Accounts.sol";
 import {Budget, Values} from "../utils/Value.sol";
@@ -29,7 +29,7 @@ abstract contract PipePayable is CommandPayable, PipePayableHook {
     uint internal immutable pipePayableId = commandId(NAME);
 
     constructor() {
-        emit Command(host, NAME, Schemas.Step, pipePayableId, 0, 0, true);
+        emit Command(host, pipePayableId, NAME, Schemas.Step, Keys.Empty, Keys.Empty, true);
     }
 
     function pipe(
@@ -54,7 +54,7 @@ abstract contract PipePayable is CommandPayable, PipePayableHook {
     /// @notice Execute the pipePayable command.
     function pipePayable(
         CommandContext calldata c
-    ) external payable onlyCommand(pipePayableId, c.target) returns (bytes memory) {
+    ) external payable onlyCommand(c.account) returns (bytes memory) {
         if (Accounts.isAdmin(c.account)) revert Accounts.InvalidAccount();
         Budget memory budget = Values.fromMsg();
         return pipe(c.account, c.state, c.request, budget);

package/commands/Provision.sol

@@ -1,24 +1,23 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import {CommandContext, CommandBase, CommandPayable, State} from "./Base.sol";
-import {Cursors, Cur, HostAmount, Schemas, Writer, Writers} from "../Cursors.sol";
+import {CommandContext, CommandBase, CommandPayable, Keys} from "./Base.sol";
+import {HostAmount, Cursors, Cur, Schemas, Writer, Writers} from "../Cursors.sol";
 import {Budget, Values} from "../utils/Value.sol";
 using Cursors for Cur;
 using Writers for Writer;
 
 string constant PROVISION = "provision";
 string constant PP = "provisionPayable";
-string constant PFB = "provisionFromBalance";
 
-/// @notice Shared provision hook used by both `Provision` and `ProvisionFromBalance`.
+/// @notice Shared provision hook used by `Provision`.
 abstract contract ProvisionHook {
     /// @notice Override to send or provision a custody value.
     /// Called once per provisioned asset. Implementations should perform only the
     /// side effect (e.g. transfer or record); output blocks are written by the caller.
     /// @param account Caller's account identifier.
-    /// @param custody Destination host plus asset amount to provision.
-    function provision(bytes32 account, HostAmount memory custody) internal virtual;
+    /// @param allocation Host-scoped amount to provision.
+    function provision(bytes32 account, HostAmount memory allocation) internal virtual;
 }
 
 /// @notice Shared provision hook used by `ProvisionPayable`.
@@ -27,29 +26,29 @@ abstract contract ProvisionPayableHook {
     /// Called once per provisioned asset. Implementations should perform only the
     /// side effect (e.g. transfer or record); output blocks are written by the caller.
     /// @param account Caller's account identifier.
-    /// @param custody Destination host plus asset amount to provision.
+    /// @param allocation Host-scoped amount to provision.
     /// @param budget Mutable native-value budget drawn from `msg.value`.
-    function provision(bytes32 account, HostAmount memory custody, Budget memory budget) internal virtual;
+    function provision(bytes32 account, HostAmount memory allocation, Budget memory budget) internal virtual;
 }
 
 /// @title Provision
-/// @notice Command that provisions assets to remote hosts from CUSTODY request blocks.
+/// @notice Command that provisions assets to remote hosts from ALLOCATION request blocks.
 /// Each request block supplies the target host plus an asset amount; the output is a CUSTODY state stream.
 abstract contract Provision is CommandBase, ProvisionHook {
     uint internal immutable provisionId = commandId(PROVISION);
 
     constructor() {
-        emit Command(host, PROVISION, Schemas.Custody, provisionId, State.Empty, State.Custodies, false);
+        emit Command(host, provisionId, PROVISION, Schemas.Allocation, Keys.Empty, Keys.Custody, false);
     }
 
-    function provision(CommandContext calldata c) external onlyCommand(provisionId, c.target) returns (bytes memory) {
+    function provision(CommandContext calldata c) external onlyCommand(c.account) returns (bytes memory) {
         (Cur memory request, uint count, ) = cursor(c.request, 1);
         Writer memory writer = Writers.allocCustodies(count);
 
         while (request.i < request.bound) {
-            HostAmount memory custody = request.unpackCustodyValue();
-            provision(c.account, custody);
-            writer.appendCustody(custody);
+            HostAmount memory allocation = request.unpackAllocationValue();
+            provision(c.account, allocation);
+            writer.appendCustody(allocation);
         }
 
         return request.complete(writer);
@@ -57,27 +56,27 @@ abstract contract Provision is CommandBase, ProvisionHook {
 }
 
 /// @title ProvisionPayable
-/// @notice Command that provisions assets to remote hosts from CUSTODY request blocks.
+/// @notice Command that provisions assets to remote hosts from ALLOCATION request blocks.
 /// Each request block supplies the target host plus an asset amount; the output is a CUSTODY state stream.
 /// The hook receives a mutable native-value budget drawn from `msg.value`.
 abstract contract ProvisionPayable is CommandPayable, ProvisionPayableHook {
     uint internal immutable provisionPayableId = commandId(PP);
 
     constructor() {
-        emit Command(host, PP, Schemas.Custody, provisionPayableId, State.Empty, State.Custodies, true);
+        emit Command(host, provisionPayableId, PP, Schemas.Allocation, Keys.Empty, Keys.Custody, true);
     }
 
     function provisionPayable(
         CommandContext calldata c
-    ) external payable onlyCommand(provisionPayableId, c.target) returns (bytes memory) {
+    ) external payable onlyCommand(c.account) returns (bytes memory) {
         (Cur memory request, uint count, ) = cursor(c.request, 1);
         Writer memory writer = Writers.allocCustodies(count);
         Budget memory budget = Values.fromMsg();
 
         while (request.i < request.bound) {
-            HostAmount memory custody = request.unpackCustodyValue();
-            provision(c.account, custody, budget);
-            writer.appendCustody(custody);
+            HostAmount memory allocation = request.unpackAllocationValue();
+            provision(c.account, allocation, budget);
+            writer.appendCustody(allocation);
         }
 
         settleValue(c.account, budget);
@@ -85,32 +84,3 @@ abstract contract ProvisionPayable is CommandPayable, ProvisionPayableHook {
     }
 }
 
-/// @title ProvisionFromBalance
-/// @notice Command that converts BALANCE state into CUSTODY state for a destination host.
-/// The destination node is read from an optional NODE trailing block; reverts if absent.
-abstract contract ProvisionFromBalance is CommandBase, ProvisionHook {
-    uint internal immutable provisionFromBalanceId = commandId(PFB);
-
-    constructor() {
-        emit Command(host, PFB, Schemas.Node, provisionFromBalanceId, State.Balances, State.Custodies, false);
-    }
-
-    function provisionFromBalance(
-        CommandContext calldata c
-    ) external onlyCommand(provisionFromBalanceId, c.target) returns (bytes memory) {
-        (Cur memory state, uint stateCount, ) = cursor(c.state, 1);
-        Cur memory request = cursor(c.request);
-        Writer memory writer = Writers.allocCustodies(stateCount);
-        uint peer = request.nodeAfter(0);
-        if (peer == 0) revert Cursors.ZeroNode();
-
-        while (state.i < state.bound) {
-            (bytes32 asset, bytes32 meta, uint amount) = state.unpackBalance();
-            HostAmount memory custody = HostAmount(peer, asset, meta, amount);
-            provision(c.account, custody);
-            writer.appendCustody(custody);
-        }
-
-        return state.complete(writer);
-    }
-}

package/commands/Transfer.sol

@@ -1,34 +1,33 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import { CommandContext, CommandBase, State } from "./Base.sol";
+import { CommandContext, CommandBase, Keys } from "./Base.sol";
 import { Cursors, Cur, Schemas, Tx } from "../Cursors.sol";
 import { Accounts } from "../utils/Accounts.sol";
 using Cursors for Cur;
 
 string constant NAME = "transfer";
-string constant INPUT = string.concat(Schemas.Amount, "&", Schemas.Recipient);
 
 abstract contract TransferHook {
     /// @notice Override to execute a single transfer record from the request pipeline.
-    /// Called once per bundled AMOUNT+RECIPIENT pair in the request.
+    /// Called once per PAYOUT block in the request.
     /// @param value Decoded transfer record (from, to, asset, meta, amount).
     function transfer(Tx memory value) internal virtual;
 }
 
 /// @title Transfer
 /// @notice Command that transfers assets from a caller to recipients specified in
-/// bundled AMOUNT+RECIPIENT request blocks. Produces no state output.
-/// The virtual `transfer(value)` hook is called once per bundle.
+/// PAYOUT request blocks. Produces no state output.
+/// The virtual `transfer(value)` hook is called once per entry.
 abstract contract Transfer is CommandBase, TransferHook {
     uint internal immutable transferId = commandId(NAME);
 
     constructor() {
-        emit Command(host, NAME, INPUT, transferId, State.Empty, State.Empty, false);
+        emit Command(host, transferId, NAME, Schemas.Payout, Keys.Empty, Keys.Empty, false);
     }
 
     /// @notice Override to customize request parsing or batching for transfers.
-    /// The default implementation iterates bundles and calls `transfer(value)` for each.
+    /// The default implementation iterates entry blocks and calls `transfer(value)` for each.
     /// @param from Source account identifier.
     /// @param request Full request bytes.
     /// @return Empty bytes (transfers produce no state output).
@@ -38,11 +37,9 @@ abstract contract Transfer is CommandBase, TransferHook {
         value.from = from;
 
         while (input.i < input.bound) {
-            uint next = input.bundle();
-            (value.asset, value.meta, value.amount) = input.unpackAmount();
-            value.to = Accounts.ensure(input.unpackRecipient());
+            (value.to, value.asset, value.meta, value.amount) = input.unpackPayout();
+            Accounts.ensure(value.to);
             transfer(value);
-            input.ensure(next);
         }
 
         input.complete();
@@ -51,14 +48,7 @@ abstract contract Transfer is CommandBase, TransferHook {
 
     function transfer(
         CommandContext calldata c
-    ) external onlyCommand(transferId, c.target) returns (bytes memory) {
+    ) external onlyCommand(c.account) returns (bytes memory) {
         return transfer(c.account, c.request);
     }
 }
-
-
-
-
-
-
-

package/commands/Withdraw.sol

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import { CommandContext, CommandBase, State } from "./Base.sol";
+import { CommandContext, CommandBase, Keys } from "./Base.sol";
 import { Cursors, Cur, Schemas } from "../Cursors.sol";
 using Cursors for Cur;
 
@@ -10,7 +10,7 @@ string constant NAME = "withdraw";
 abstract contract WithdrawHook {
     /// @notice Override to send funds to `account`.
     /// Called once per BALANCE block in state.
-    /// @param account Destination account identifier (resolved from RECIPIENT block or caller).
+    /// @param account Destination account identifier (resolved from ACCOUNT block or caller).
     /// @param asset Asset identifier.
     /// @param meta Asset metadata slot.
     /// @param amount Amount to deliver.
@@ -25,15 +25,14 @@ abstract contract Withdraw is CommandBase, WithdrawHook {
     uint internal immutable withdrawId = commandId(NAME);
 
     constructor() {
-        emit Command(host, NAME, Schemas.Recipient, withdrawId, State.Balances, State.Empty, false);
+        emit Command(host, withdrawId, NAME, Schemas.Account, Keys.Balance, Keys.Empty, false);
     }
 
     function withdraw(
         CommandContext calldata c
-    ) external onlyCommand(withdrawId, c.target) returns (bytes memory) {
+    ) external onlyCommand(c.account) returns (bytes memory) {
         (Cur memory state, , ) = cursor(c.state, 1);
-        Cur memory request = cursor(c.request);
-        bytes32 to = request.recipientAfter(c.account);
+        bytes32 to = Cursors.resolveAccount(c.request, c.account);
 
         while (state.i < state.bound) {
             (bytes32 asset, bytes32 meta, uint amount) = state.unpackBalance();

package/commands/admin/AllowAssets.sol

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import { CommandBase, CommandContext, State } from "../Base.sol";
+import { CommandBase, CommandContext, Keys } from "../Base.sol";
 import { Cursors, Cur, Schemas } from "../../Cursors.sol";
 using Cursors for Cur;
 
@@ -20,12 +20,12 @@ abstract contract AllowAssets is CommandBase, AllowAssetsHook {
     uint internal immutable allowAssetsId = commandId(NAME);
 
     constructor() {
-        emit Command(host, NAME, Schemas.Asset, allowAssetsId, State.Empty, State.Empty, false);
+        emit Command(host, allowAssetsId, NAME, Schemas.Asset, Keys.Empty, Keys.Empty, false);
     }
 
     function allowAssets(
         CommandContext calldata c
-    ) external onlyAdmin(c.account) onlyCommand(allowAssetsId, c.target) returns (bytes memory) {
+    ) external onlyAdmin(c.account) returns (bytes memory) {
         (Cur memory request, , ) = cursor(c.request, 1);
 
         while (request.i < request.bound) {

package/commands/admin/Allowance.sol

@@ -0,0 +1,43 @@
+// SPDX-License-Identifier: GPL-3.0-only
+pragma solidity ^0.8.33;
+
+import { CommandBase, CommandContext, Keys } from "../Base.sol";
+import { Cursors, Cur, Schemas } from "../../Cursors.sol";
+using Cursors for Cur;
+
+string constant NAME = "allowance";
+
+abstract contract AllowanceHook {
+    /// @notice Apply or revoke one host-scoped allowance.
+    /// Called once per ALLOWANCE block in the request. Implementations decide
+    /// how the allowance is represented, e.g. ERC-20 approval, an internal cap,
+    /// or another host-specific authorization record.
+    /// @param peer Host node receiving the allowed cap.
+    /// @param asset Asset identifier.
+    /// @param meta Asset metadata slot.
+    /// @param amount Allowed cap amount.
+    function allowance(uint peer, bytes32 asset, bytes32 meta, uint amount) internal virtual;
+}
+
+/// @title Allowance
+/// @notice Admin command that applies cross-host allowance entries via a virtual hook.
+/// Each ALLOWANCE block grants or updates a host-scoped asset cap. Only callable by the admin account.
+abstract contract Allowance is CommandBase, AllowanceHook {
+    uint internal immutable allowanceId = commandId(NAME);
+
+    constructor() {
+        emit Command(host, allowanceId, NAME, Schemas.Allowance, Keys.Empty, Keys.Empty, false);
+    }
+
+    function allowance(CommandContext calldata c) external onlyAdmin(c.account) returns (bytes memory) {
+        (Cur memory request, , ) = cursor(c.request, 1);
+
+        while (request.i < request.bound) {
+            (uint peer, bytes32 asset, bytes32 meta, uint amount) = request.unpackAllowance();
+            allowance(peer, asset, meta, amount);
+        }
+
+        request.complete();
+        return "";
+    }
+}

package/commands/admin/Authorize.sol

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import { CommandBase, CommandContext, State } from "../Base.sol";
+import { CommandBase, CommandContext, Keys } from "../Base.sol";
 import { Cursors, Cur, Schemas } from "../../Cursors.sol";
 using Cursors for Cur;
 
@@ -15,17 +15,17 @@ abstract contract Authorize is CommandBase {
     uint internal immutable authorizeId = commandId(NAME);
 
     constructor() {
-        emit Command(host, NAME, Schemas.Node, authorizeId, State.Empty, State.Empty, false);
+        emit Command(host, authorizeId, NAME, Schemas.Node, Keys.Empty, Keys.Empty, false);
     }
 
     function authorize(
         CommandContext calldata c
-    ) external onlyAdmin(c.account) onlyCommand(authorizeId, c.target) returns (bytes memory) {
+    ) external onlyAdmin(c.account) returns (bytes memory) {
         (Cur memory request, , ) = cursor(c.request, 1);
 
         while (request.i < request.bound) {
             uint node = request.unpackNode();
-            access(node, true);
+            authorize(node);
         }
 
         request.complete();