@rootzero/contracts 0.9.0 → 0.9.1

package/Commands.sol

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-// Aggregator: re-exports command, admin, and peer abstractions.
+// Aggregator: re-exports command, control, and remote abstractions.
 // Import this file to inherit from the full rootzero command surface without managing individual paths.
 
 import { CommandBase, CommandContext, CommandPayable, encodeCommandCall } from "./commands/Base.sol";
@@ -14,21 +14,20 @@ import { PipePayable, PipePayableHook } from "./commands/Pipe.sol";
 import { Provision, ProvisionHook, ProvisionPayable, ProvisionPayableHook } from "./commands/Provision.sol";
 import { Transfer, TransferHook } from "./commands/Transfer.sol";
 import { Withdraw, WithdrawHook } from "./commands/Withdraw.sol";
-import { AllowAssets, AllowAssetsHook } from "./commands/admin/AllowAssets.sol";
-import { Destroy, DestroyHook } from "./commands/admin/Destroy.sol";
-import { ExecutePayable } from "./commands/admin/Execute.sol";
-import { Authorize } from "./commands/admin/Authorize.sol";
-import { DenyAssets, DenyAssetsHook } from "./commands/admin/DenyAssets.sol";
-import { Init, InitHook } from "./commands/admin/Init.sol";
-import { RelocatePayable } from "./commands/admin/Relocate.sol";
-import { Allowance, AllowanceHook } from "./commands/admin/Allowance.sol";
-import { Unauthorize } from "./commands/admin/Unauthorize.sol";
-import { PeerBase, encodePeerCall } from "./peer/Base.sol";
-import { PeerAllowance } from "./peer/Allowance.sol";
-import { PeerAssetPull, PeerAssetPullHook } from "./peer/AssetPull.sol";
-import { PeerAllowAssets } from "./peer/AllowAssets.sol";
-import { PeerDenyAssets } from "./peer/DenyAssets.sol";
-import { PeerSettle } from "./peer/Settle.sol";
+import { AllowAssets, AllowAssetsHook } from "./commands/control/AllowAssets.sol";
+import { Destroy, DestroyHook } from "./commands/control/Destroy.sol";
+import { ExecutePayable } from "./commands/control/Execute.sol";
+import { Authorize } from "./commands/control/Authorize.sol";
+import { DenyAssets, DenyAssetsHook } from "./commands/control/DenyAssets.sol";
+import { Init, InitHook } from "./commands/control/Init.sol";
+import { Allowance, AllowanceHook } from "./commands/control/Allowance.sol";
+import { Unauthorize } from "./commands/control/Unauthorize.sol";
+import { RemoteBase, encodeRemoteCall } from "./remote/Base.sol";
+import { RemoteAllowance } from "./remote/Allowance.sol";
+import { RemoteAssetPull, AssetPullHook } from "./remote/AssetPull.sol";
+import { RemoteAllowAssets } from "./remote/AllowAssets.sol";
+import { RemoteDenyAssets } from "./remote/DenyAssets.sol";
+import { RemoteSettle } from "./remote/Settle.sol";
 
 
 

package/Events.sol

@@ -5,6 +5,7 @@ pragma solidity ^0.8.33;
 // Import this file to get access to every event emitter in one import.
 
 import { AccessEvent } from "./events/Access.sol";
+import { ControlEvent } from "./events/Control.sol";
 import { AssetEvent } from "./events/Asset.sol";
 import { BalanceEvent } from "./events/Balance.sol";
 import { CollateralEvent } from "./events/Collateral.sol";
@@ -16,7 +17,7 @@ import { EventEmitter } from "./events/Emitter.sol";
 import { GovernedEvent } from "./events/Governed.sol";
 import { HostAnnouncedEvent } from "./events/Host.sol";
 import { ListingEvent } from "./events/Listing.sol";
-import { PeerEvent } from "./events/Peer.sol";
+import { RemoteEvent } from "./events/Remote.sol";
 import { QueryEvent } from "./events/Query.sol";
 import { RootZeroEvent } from "./events/RootZero.sol";
 import { SwapEvent } from "./events/Swap.sol";

package/blocks/Cursors.sol

@@ -47,9 +47,6 @@ library Cursors {
     error UnexpectedValue();
     /// @dev Input and output block counts are not proportional to their declared group sizes.
     error BadRatio();
-    /// @dev A fixed-width low-level unpacker received an invalid final-word keep length.
-    error InvalidKeep();
-
     // -------------------------------------------------------------------------
     // Cursor construction and navigation
     // -------------------------------------------------------------------------
@@ -218,17 +215,6 @@ library Cursors {
         cur.i = next;
     }
 
-    /// @notice Load a payload word and mask away any omitted tail bytes on the right.
-    /// @param abs Absolute calldata offset of the word start.
-    /// @param tail Number of trailing bytes omitted from the logical payload (0..31).
-    /// @return value Decoded word with omitted tail bytes zeroed.
-    function mask(uint abs, uint tail) internal pure returns (bytes32 value) {
-        assembly ("memory-safe") {
-            value := calldataload(abs)
-        }
-        if (tail != 0) value &= bytes32(type(uint256).max << (tail * 8));
-    }
-
     /// @notice Enter a Bundle block at the current position and return the next offset.
     /// Advances `cur.i` past the bundle header so the bundled members can be parsed
     /// directly from the same cursor. The returned `next` is the byte offset
@@ -561,12 +547,9 @@ library Cursors {
     /// @param cur Cursor; advanced past the block.
     /// @param key Expected dynamic block key.
     /// @return value Decoded bytes32.
-    /// @param keep Number of bytes to keep from the final payload word (1..32).
-    function unpack32(Cur memory cur, bytes4 key, uint keep) internal pure returns (bytes32 value) {
-        if (keep == 0 || keep > 32) revert InvalidKeep();
-        uint len = keep;
-        uint abs = consume(cur, key, len, len);
-        value = mask(abs, 32 - keep);
+    function unpack32(Cur memory cur, bytes4 key) internal pure returns (bytes32 value) {
+        uint abs = consume(cur, key, 32, 32);
+        value = bytes32(msg.data[abs:abs + 32]);
     }
 
     /// @notice Consume a dynamic block with two bytes32 payload words.
@@ -574,13 +557,10 @@ library Cursors {
     /// @param key Expected dynamic block key.
     /// @return a First decoded bytes32.
     /// @return b Second decoded bytes32.
-    /// @param keep Number of bytes to keep from the final payload word (1..32).
-    function unpack64(Cur memory cur, bytes4 key, uint keep) internal pure returns (bytes32 a, bytes32 b) {
-        if (keep == 0 || keep > 32) revert InvalidKeep();
-        uint len = 32 + keep;
-        uint abs = consume(cur, key, len, len);
+    function unpack64(Cur memory cur, bytes4 key) internal pure returns (bytes32 a, bytes32 b) {
+        uint abs = consume(cur, key, 64, 64);
         a = bytes32(msg.data[abs:abs + 32]);
-        b = mask(abs + 32, 32 - keep);
+        b = bytes32(msg.data[abs + 32:abs + 64]);
     }
 
     /// @notice Consume a dynamic block with three bytes32 payload words.
@@ -589,14 +569,11 @@ library Cursors {
     /// @return a First decoded bytes32.
     /// @return b Second decoded bytes32.
     /// @return c Third decoded bytes32.
-    /// @param keep Number of bytes to keep from the final payload word (1..32).
-    function unpack96(Cur memory cur, bytes4 key, uint keep) internal pure returns (bytes32 a, bytes32 b, bytes32 c) {
-        if (keep == 0 || keep > 32) revert InvalidKeep();
-        uint len = 64 + keep;
-        uint abs = consume(cur, key, len, len);
+    function unpack96(Cur memory cur, bytes4 key) internal pure returns (bytes32 a, bytes32 b, bytes32 c) {
+        uint abs = consume(cur, key, 96, 96);
         a = bytes32(msg.data[abs:abs + 32]);
         b = bytes32(msg.data[abs + 32:abs + 64]);
-        c = mask(abs + 64, 32 - keep);
+        c = bytes32(msg.data[abs + 64:abs + 96]);
     }
 
     /// @notice Consume a dynamic block with a 128-byte payload (four 32-byte words).
@@ -606,19 +583,15 @@ library Cursors {
     /// @return b Second decoded bytes32.
     /// @return c Third decoded bytes32.
     /// @return d Fourth decoded bytes32.
-    /// @param keep Number of bytes to keep from the final payload word (1..32).
     function unpack128(
         Cur memory cur,
-        bytes4 key,
-        uint keep
+        bytes4 key
     ) internal pure returns (bytes32 a, bytes32 b, bytes32 c, bytes32 d) {
-        if (keep == 0 || keep > 32) revert InvalidKeep();
-        uint len = 96 + keep;
-        uint abs = consume(cur, key, len, len);
+        uint abs = consume(cur, key, 128, 128);
         a = bytes32(msg.data[abs:abs + 32]);
         b = bytes32(msg.data[abs + 32:abs + 64]);
         c = bytes32(msg.data[abs + 64:abs + 96]);
-        d = mask(abs + 96, 32 - keep);
+        d = bytes32(msg.data[abs + 96:abs + 128]);
     }
 
     /// @notice Consume a dynamic block with a 160-byte payload (five 32-byte words).
@@ -629,20 +602,16 @@ library Cursors {
     /// @return c Third decoded bytes32.
     /// @return d Fourth decoded bytes32.
     /// @return e Fifth decoded bytes32.
-    /// @param keep Number of bytes to keep from the final payload word (1..32).
     function unpack160(
         Cur memory cur,
-        bytes4 key,
-        uint keep
+        bytes4 key
     ) internal pure returns (bytes32 a, bytes32 b, bytes32 c, bytes32 d, bytes32 e) {
-        if (keep == 0 || keep > 32) revert InvalidKeep();
-        uint len = 128 + keep;
-        uint abs = consume(cur, key, len, len);
+        uint abs = consume(cur, key, 160, 160);
         a = bytes32(msg.data[abs:abs + 32]);
         b = bytes32(msg.data[abs + 32:abs + 64]);
         c = bytes32(msg.data[abs + 64:abs + 96]);
         d = bytes32(msg.data[abs + 96:abs + 128]);
-        e = mask(abs + 128, 32 - keep);
+        e = bytes32(msg.data[abs + 128:abs + 160]);
     }
 
     /// @notice Consume a dynamic block with a single uint payload.
@@ -650,7 +619,7 @@ library Cursors {
     /// @param key Expected dynamic block key.
     /// @return value Decoded uint value.
     function unpackUint(Cur memory cur, bytes4 key) internal pure returns (uint value) {
-        value = uint(unpack32(cur, key, 32));
+        value = uint(unpack32(cur, key));
     }
 
     /// @notice Consume a dynamic block with two uint payload words.
@@ -659,7 +628,7 @@ library Cursors {
     /// @return a First decoded uint.
     /// @return b Second decoded uint.
     function unpack2Uint(Cur memory cur, bytes4 key) internal pure returns (uint a, uint b) {
-        (bytes32 x, bytes32 y) = unpack64(cur, key, 32);
+        (bytes32 x, bytes32 y) = unpack64(cur, key);
         return (uint(x), uint(y));
     }
 
@@ -670,7 +639,7 @@ library Cursors {
     /// @return b Second decoded uint.
     /// @return c Third decoded uint.
     function unpack3Uint(Cur memory cur, bytes4 key) internal pure returns (uint a, uint b, uint c) {
-        (bytes32 x, bytes32 y, bytes32 z) = unpack96(cur, key, 32);
+        (bytes32 x, bytes32 y, bytes32 z) = unpack96(cur, key);
         return (uint(x), uint(y), uint(z));
     }
 
@@ -839,35 +808,35 @@ library Cursors {
     /// @param cur Cursor; advanced past the block.
     /// @return account Account identifier.
     function unpackAccount(Cur memory cur) internal pure returns (bytes32 account) {
-        account = unpack32(cur, Keys.Account, 32);
+        account = unpack32(cur, Keys.Account);
     }
 
     /// @notice Consume a NODE block and return the node ID.
     /// @param cur Cursor; advanced past the block.
     /// @return node Node identifier.
     function unpackNode(Cur memory cur) internal pure returns (uint node) {
-        node = uint(unpack32(cur, Keys.Node, 32));
+        node = uint(unpack32(cur, Keys.Node));
     }
 
     /// @notice Consume a RATE block and return the value.
     /// @param cur Cursor; advanced past the block.
     /// @return value Encoded ratio or rate.
     function unpackRate(Cur memory cur) internal pure returns (uint value) {
-        value = uint(unpack32(cur, Keys.Rate, 32));
+        value = uint(unpack32(cur, Keys.Rate));
     }
 
     /// @notice Consume a QUANTITY block and return the amount.
     /// @param cur Cursor; advanced past the block.
     /// @return amount Scalar quantity value.
     function unpackQuantity(Cur memory cur) internal pure returns (uint amount) {
-        amount = uint(unpack32(cur, Keys.Quantity, 32));
+        amount = uint(unpack32(cur, Keys.Quantity));
     }
 
     /// @notice Consume a FEE block and return the amount.
     /// @param cur Cursor; advanced past the block.
     /// @return amount Fee amount.
     function unpackFee(Cur memory cur) internal pure returns (uint amount) {
-        amount = uint(unpack32(cur, Keys.Fee, 32));
+        amount = uint(unpack32(cur, Keys.Fee));
     }
 
     /// @notice Consume an ASSET block and return the asset descriptor fields.
@@ -875,7 +844,7 @@ library Cursors {
     /// @return asset Asset identifier.
     /// @return meta Asset metadata slot.
     function unpackAsset(Cur memory cur) internal pure returns (bytes32 asset, bytes32 meta) {
-        (asset, meta) = unpack64(cur, Keys.Asset, 32);
+        (asset, meta) = unpack64(cur, Keys.Asset);
     }
 
     /// @notice Consume an ACCOUNT_ASSET form block and return its fields as separate values.
@@ -897,20 +866,12 @@ library Cursors {
         (value.account, value.asset, value.meta) = unpackAccountAsset(cur);
     }
 
-    /// @notice Consume a RELOCATION block and return the host and amount.
-    /// @param cur Cursor; advanced past the block.
-    /// @return host Host node ID receiving the funding.
-    /// @return amount Funding amount.
-    function unpackRelocation(Cur memory cur) internal pure returns (uint host, uint amount) {
-        (host, amount) = unpack2Uint(cur, Keys.Relocation);
-    }
-
     /// @notice Consume a BOUNTY block and return the reward amount and relayer.
     /// @param cur Cursor; advanced past the block.
     /// @return amount Relayer reward amount.
     /// @return relayer Relayer account identifier.
     function unpackBounty(Cur memory cur) internal pure returns (uint amount, bytes32 relayer) {
-        (bytes32 x, bytes32 y) = unpack64(cur, Keys.Bounty, 32);
+        (bytes32 x, bytes32 y) = unpack64(cur, Keys.Bounty);
         amount = uint(x);
         relayer = y;
     }

package/blocks/Keys.sol

@@ -68,8 +68,6 @@ library Keys {
     bytes4 constant Asset = bytes4(keccak256("asset(bytes32 asset, bytes32 meta)"));
     /// @dev Node identifier - (uint id)
     bytes4 constant Node = bytes4(keccak256("node(uint id)"));
-    /// @dev Native value relocation entry - (uint host, uint amount)
-    bytes4 constant Relocation = bytes4(keccak256("relocation(uint host, uint amount)"));
     /// @dev Relayer bounty - (uint amount, bytes32 relayer)
     bytes4 constant Bounty = bytes4(keccak256("bounty(uint amount, bytes32 relayer)"));
 

package/blocks/Schema.sol

@@ -114,7 +114,6 @@ library Schemas {
     string constant Allocation = "allocation(uint host, bytes32 asset, bytes32 meta, uint amount)";
     string constant Allowance = "allowance(uint host, bytes32 asset, bytes32 meta, uint amount)";
     string constant Transaction = "transaction(bytes32 from, bytes32 to, bytes32 asset, bytes32 meta, uint amount)";
-    string constant Relocation = "relocation(uint host, uint amount)";
     string constant Call = "call(uint target, uint value, bytes data)";
     string constant Step = "step(uint target, uint value, bytes request)";
     string constant Bounty = "bounty(uint amount, bytes32 relayer)";

package/commands/Burn.sol

@@ -5,8 +5,6 @@ import { CommandBase, CommandContext, Keys } from "./Base.sol";
 import { Cursors, Cur } from "../Cursors.sol";
 using Cursors for Cur;
 
-string constant NAME = "burn";
-
 abstract contract BurnHook {
     /// @notice Override to burn or consume the provided balance amount.
     /// Called once per BALANCE block in state.
@@ -22,6 +20,8 @@ abstract contract BurnHook {
 /// @notice Command that irreversibly destroys each BALANCE state block via a virtual hook.
 /// Produces no output state.
 abstract contract Burn is CommandBase, BurnHook {
+    string private constant NAME = "burn";
+
     uint internal immutable burnId = commandId(NAME);
 
     constructor() {

package/commands/Credit.sol

@@ -3,7 +3,6 @@ pragma solidity ^0.8.33;
 
 import { CommandBase, CommandContext, Keys } from "./Base.sol";
 import { Cursors, Cur, Schemas } from "../Cursors.sol";
-string constant NAME = "creditAccount";
 
 using Cursors for Cur;
 
@@ -22,6 +21,8 @@ abstract contract CreditAccountHook {
 /// Use for internally recording credits that have already been settled externally.
 /// An optional ACCOUNT block in the request overrides the default `c.account` destination.
 abstract contract CreditAccount is CommandBase, CreditAccountHook {
+    string private constant NAME = "creditAccount";
+
     uint internal immutable creditAccountId = commandId(NAME);
 
     constructor() {

package/commands/Debit.sol

@@ -4,8 +4,6 @@ pragma solidity ^0.8.33;
 import { CommandContext, CommandBase, Keys } from "./Base.sol";
 import { Cursors, Cur, Schemas, Writer, Writers } from "../Cursors.sol";
 
-string constant NAME = "debitAccount";
-
 using Cursors for Cur;
 using Writers for Writer;
 
@@ -24,6 +22,8 @@ abstract contract DebitAccountHook {
 /// Use for internally recording debits. The virtual `debitAccount` hook is called once per
 /// AMOUNT block; the default batch implementation handles the full request loop.
 abstract contract DebitAccount is CommandBase, DebitAccountHook {
+    string private constant NAME = "debitAccount";
+
     uint internal immutable debitAccountId = commandId(NAME);
 
     constructor() {

package/commands/Deposit.sol

@@ -5,9 +5,6 @@ import { CommandContext, CommandBase, CommandPayable, Keys } from "./Base.sol";
 import { Cursors, Cur, Schemas, Writer, Writers } from "../Cursors.sol";
 import { Budget, Values } from "../utils/Value.sol";
 
-string constant DEPOSIT = "deposit";
-string constant DEPOSIT_PAYABLE = "depositPayable";
-
 using Cursors for Cur;
 using Writers for Writer;
 
@@ -39,10 +36,12 @@ abstract contract DepositPayableHook {
 /// Use `deposit` for assets arriving from outside the protocol (e.g. ERC-20 transfers, ETH).
 /// For internal balance deductions, use `debitAccount` instead.
 abstract contract Deposit is CommandBase, DepositHook {
-    uint internal immutable depositId = commandId(DEPOSIT);
+    string private constant NAME = "deposit";
+
+    uint internal immutable depositId = commandId(NAME);
 
     constructor() {
-        emit Command(host, depositId, DEPOSIT, Schemas.Amount, Keys.Empty, Keys.Balance, false);
+        emit Command(host, depositId, NAME, Schemas.Amount, Keys.Empty, Keys.Balance, false);
     }
 
     function deposit(
@@ -65,10 +64,12 @@ abstract contract Deposit is CommandBase, DepositHook {
 /// @notice Command that receives externally sourced assets and records them as BALANCE state.
 /// Use `depositPayable` when the hook needs tracked access to `msg.value` via a mutable budget.
 abstract contract DepositPayable is CommandPayable, DepositPayableHook {
-    uint internal immutable depositPayableId = commandId(DEPOSIT_PAYABLE);
+    string private constant NAME = "depositPayable";
+
+    uint internal immutable depositPayableId = commandId(NAME);
 
     constructor() {
-        emit Command(host, depositPayableId, DEPOSIT_PAYABLE, Schemas.Amount, Keys.Empty, Keys.Balance, true);
+        emit Command(host, depositPayableId, NAME, Schemas.Amount, Keys.Empty, Keys.Balance, true);
     }
 
     function depositPayable(

package/commands/Pipe.sol

@@ -8,8 +8,6 @@ import {Budget, Values} from "../utils/Value.sol";
 
 using Cursors for Cur;
 
-string constant NAME = "pipePayable";
-
 abstract contract PipePayableHook {
     function dispatchStep(
         uint target,
@@ -26,6 +24,8 @@ abstract contract PipePayableHook {
 /// State threads through the steps: each step's output becomes the next step's state.
 /// Admin accounts are not permitted to use `pipePayable`.
 abstract contract PipePayable is CommandPayable, PipePayableHook {
+    string private constant NAME = "pipePayable";
+
     uint internal immutable pipePayableId = commandId(NAME);
 
     constructor() {

package/commands/Provision.sol

@@ -7,9 +7,6 @@ import {Budget, Values} from "../utils/Value.sol";
 using Cursors for Cur;
 using Writers for Writer;
 
-string constant PROVISION = "provision";
-string constant PP = "provisionPayable";
-
 /// @notice Shared provision hook used by `Provision`.
 abstract contract ProvisionHook {
     /// @notice Override to send or provision a custody value.
@@ -35,10 +32,12 @@ abstract contract ProvisionPayableHook {
 /// @notice Command that provisions assets to remote hosts from ALLOCATION request blocks.
 /// Each request block supplies the target host plus an asset amount; the output is a CUSTODY state stream.
 abstract contract Provision is CommandBase, ProvisionHook {
-    uint internal immutable provisionId = commandId(PROVISION);
+    string private constant NAME = "provision";
+
+    uint internal immutable provisionId = commandId(NAME);
 
     constructor() {
-        emit Command(host, provisionId, PROVISION, Schemas.Allocation, Keys.Empty, Keys.Custody, false);
+        emit Command(host, provisionId, NAME, Schemas.Allocation, Keys.Empty, Keys.Custody, false);
     }
 
     function provision(CommandContext calldata c) external onlyCommand(c.account) returns (bytes memory) {
@@ -60,10 +59,12 @@ abstract contract Provision is CommandBase, ProvisionHook {
 /// Each request block supplies the target host plus an asset amount; the output is a CUSTODY state stream.
 /// The hook receives a mutable native-value budget drawn from `msg.value`.
 abstract contract ProvisionPayable is CommandPayable, ProvisionPayableHook {
-    uint internal immutable provisionPayableId = commandId(PP);
+    string private constant NAME = "provisionPayable";
+
+    uint internal immutable provisionPayableId = commandId(NAME);
 
     constructor() {
-        emit Command(host, provisionPayableId, PP, Schemas.Allocation, Keys.Empty, Keys.Custody, true);
+        emit Command(host, provisionPayableId, NAME, Schemas.Allocation, Keys.Empty, Keys.Custody, true);
     }
 
     function provisionPayable(

package/commands/Transfer.sol

@@ -6,8 +6,6 @@ import { Cursors, Cur, Schemas, Tx } from "../Cursors.sol";
 import { Accounts } from "../utils/Accounts.sol";
 using Cursors for Cur;
 
-string constant NAME = "transfer";
-
 abstract contract TransferHook {
     /// @notice Override to execute a single transfer record from the request pipeline.
     /// Called once per PAYOUT block in the request.
@@ -20,6 +18,8 @@ abstract contract TransferHook {
 /// PAYOUT request blocks. Produces no state output.
 /// The virtual `transfer(value)` hook is called once per entry.
 abstract contract Transfer is CommandBase, TransferHook {
+    string private constant NAME = "transfer";
+
     uint internal immutable transferId = commandId(NAME);
 
     constructor() {

package/commands/Withdraw.sol

@@ -5,8 +5,6 @@ import { CommandContext, CommandBase, Keys } from "./Base.sol";
 import { Cursors, Cur, Schemas } from "../Cursors.sol";
 using Cursors for Cur;
 
-string constant NAME = "withdraw";
-
 abstract contract WithdrawHook {
     /// @notice Override to send funds to `account`.
     /// Called once per BALANCE block in state.
@@ -22,6 +20,8 @@ abstract contract WithdrawHook {
 /// Use `withdraw` for assets being sent outside the protocol (e.g. ERC-20 transfers, ETH sends).
 /// For internal balance credits, use `creditAccount` instead.
 abstract contract Withdraw is CommandBase, WithdrawHook {
+    string private constant NAME = "withdraw";
+
     uint internal immutable withdrawId = commandId(NAME);
 
     constructor() {

package/commands/{admin → control}/AllowAssets.sol

@@ -3,24 +3,25 @@ pragma solidity ^0.8.33;
 
 import { CommandBase, CommandContext, Keys } from "../Base.sol";
 import { Cursors, Cur, Schemas } from "../../Cursors.sol";
+import { ControlEvent } from "../../events/Control.sol";
 using Cursors for Cur;
 
-string constant NAME = "allowAssets";
-
 abstract contract AllowAssetsHook {
     /// @dev Override to allow a single asset/meta pair.
     /// Called once per ASSET block in the request.
-    function allowAsset(bytes32 asset, bytes32 meta) internal virtual returns (bool);
+    function allowAsset(bytes32 asset, bytes32 meta) internal virtual;
 }
 
 /// @title AllowAssets
-/// @notice Admin command that permits a list of (asset, meta) pairs via a virtual hook.
+/// @notice Control command that permits a list of (asset, meta) pairs via a virtual hook.
 /// Each ASSET block in the request calls `allowAsset`. Only callable by the admin account.
-abstract contract AllowAssets is CommandBase, AllowAssetsHook {
+abstract contract AllowAssets is CommandBase, ControlEvent, AllowAssetsHook {
+    string private constant NAME = "allowAssets";
+
     uint internal immutable allowAssetsId = commandId(NAME);
 
     constructor() {
-        emit Command(host, allowAssetsId, NAME, Schemas.Asset, Keys.Empty, Keys.Empty, false);
+        emit Control(host, allowAssetsId, NAME, Schemas.Asset, Keys.Empty, Keys.Empty, false);
     }
 
     function allowAssets(

package/commands/{admin → control}/Allowance.sol

@@ -1,40 +1,40 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import { CommandBase, CommandContext, Keys } from "../Base.sol";
-import { Cursors, Cur, Schemas } from "../../Cursors.sol";
+import {CommandBase, CommandContext, Keys} from "../Base.sol";
+import {Cursors, Cur, Schemas} from "../../Cursors.sol";
+import {ControlEvent} from "../../events/Control.sol";
 using Cursors for Cur;
 
-string constant NAME = "allowance";
-
 abstract contract AllowanceHook {
     /// @notice Apply or revoke one host-scoped allowance.
     /// Called once per ALLOWANCE block in the request. Implementations decide
     /// how the allowance is represented, e.g. ERC-20 approval, an internal cap,
     /// or another host-specific authorization record.
-    /// @param peer Host node receiving the allowed cap.
+    /// @param remote Host node receiving the allowed cap.
     /// @param asset Asset identifier.
     /// @param meta Asset metadata slot.
     /// @param amount Allowed cap amount.
-    function allowance(uint peer, bytes32 asset, bytes32 meta, uint amount) internal virtual;
+    function allowance(uint remote, bytes32 asset, bytes32 meta, uint amount) internal virtual;
 }
 
 /// @title Allowance
-/// @notice Admin command that applies cross-host allowance entries via a virtual hook.
+/// @notice Control command that applies cross-host allowance entries via a virtual hook.
 /// Each ALLOWANCE block grants or updates a host-scoped asset cap. Only callable by the admin account.
-abstract contract Allowance is CommandBase, AllowanceHook {
+abstract contract Allowance is CommandBase, ControlEvent, AllowanceHook {
+    string private constant NAME = "allowance";
     uint internal immutable allowanceId = commandId(NAME);
 
     constructor() {
-        emit Command(host, allowanceId, NAME, Schemas.Allowance, Keys.Empty, Keys.Empty, false);
+        emit Control(host, allowanceId, NAME, Schemas.Allowance, Keys.Empty, Keys.Empty, false);
     }
 
     function allowance(CommandContext calldata c) external onlyAdmin(c.account) returns (bytes memory) {
         (Cur memory request, , ) = cursor(c.request, 1);
 
         while (request.i < request.bound) {
-            (uint peer, bytes32 asset, bytes32 meta, uint amount) = request.unpackAllowance();
-            allowance(peer, asset, meta, amount);
+            (uint remote, bytes32 asset, bytes32 meta, uint amount) = request.unpackAllowance();
+            allowance(remote, asset, meta, amount);
         }
 
         request.complete();

package/commands/{admin → control}/Authorize.sol

@@ -3,19 +3,20 @@ pragma solidity ^0.8.33;
 
 import { CommandBase, CommandContext, Keys } from "../Base.sol";
 import { Cursors, Cur, Schemas } from "../../Cursors.sol";
+import { ControlEvent } from "../../events/Control.sol";
 using Cursors for Cur;
 
-string constant NAME = "authorize";
-
 /// @title Authorize
-/// @notice Admin command that grants authorization to a list of node IDs.
+/// @notice Control command that grants authorization to a list of node IDs.
 /// Each NODE block in the request is authorized on the host.
 /// Only callable by the admin account.
-abstract contract Authorize is CommandBase {
+abstract contract Authorize is CommandBase, ControlEvent {
+    string private constant NAME = "authorize";
+
     uint internal immutable authorizeId = commandId(NAME);
 
     constructor() {
-        emit Command(host, authorizeId, NAME, Schemas.Node, Keys.Empty, Keys.Empty, false);
+        emit Control(host, authorizeId, NAME, Schemas.Node, Keys.Empty, Keys.Empty, false);
     }
 
     function authorize(

package/commands/{admin → control}/DenyAssets.sol

@@ -3,24 +3,25 @@ pragma solidity ^0.8.33;
 
 import { CommandBase, CommandContext, Keys } from "../Base.sol";
 import { Cursors, Cur, Schemas } from "../../Cursors.sol";
+import { ControlEvent } from "../../events/Control.sol";
 using Cursors for Cur;
 
-string constant NAME = "denyAssets";
-
 abstract contract DenyAssetsHook {
     /// @dev Override to deny a single asset/meta pair.
     /// Called once per ASSET block in the request.
-    function denyAsset(bytes32 asset, bytes32 meta) internal virtual returns (bool);
+    function denyAsset(bytes32 asset, bytes32 meta) internal virtual;
 }
 
 /// @title DenyAssets
-/// @notice Admin command that blocks a list of (asset, meta) pairs via a virtual hook.
+/// @notice Control command that blocks a list of (asset, meta) pairs via a virtual hook.
 /// Each ASSET block in the request calls `denyAsset`. Only callable by the admin account.
-abstract contract DenyAssets is CommandBase, DenyAssetsHook {
+abstract contract DenyAssets is CommandBase, ControlEvent, DenyAssetsHook {
+    string private constant NAME = "denyAssets";
+
     uint internal immutable denyAssetsId = commandId(NAME);
 
     constructor() {
-        emit Command(host, denyAssetsId, NAME, Schemas.Asset, Keys.Empty, Keys.Empty, false);
+        emit Control(host, denyAssetsId, NAME, Schemas.Asset, Keys.Empty, Keys.Empty, false);
     }
 
     function denyAssets(