@rootzero/contracts 0.9.8 → 1.0.0

package/blocks/Schema.sol

@@ -11,8 +11,11 @@ pragma solidity ^0.8.33;
 // - a block without braces has no payload, e.g. `#unit`
 // - commas separate siblings at every level
 // - braces define parent-child boundaries
-// - top-level item 0 is the prime item; later top-level items are globals
-// - prime items may repeat at top level for batching
+// - command requests start with the input run when the request schema is non-empty
+// - postcheck command requests include a constraint run after the input run; if the
+//   request schema is empty, the constraint run starts the request
+// - command state starts with the active state run; trailing state globals may follow
+// - run items may repeat at top level for batching
 // - `maybe #x { ... }` marks an optional block item
 // - `many #x { ... }` emits one generic list block containing repeated `#x` items
 // - fixed fields are packed in declaration order
@@ -30,8 +33,8 @@ pragma solidity ^0.8.33;
 // - while a balance or custody is in-flight as pipeline state, it is not simultaneously persisted
 //   in another ledger/store by this protocol
 // - commands must preserve, transform, settle, or intentionally consume pipeline state
-// - request blocks such as `amount(...)`, `allocation(...)`, `allowance(...)`, `payout(...)`,
-//   `minimum(...)`, and `maximum(...)` express intent, constraints, or references
+// - request blocks such as `amount(...)`, `allocation(...)`, and `allowance(...)`
+//   express intent, constraints, or references
 // - request and value/response blocks are not live state
 //
 // Signed blocks:
@@ -50,19 +53,20 @@ library Schemas {
     string constant Node = "#node { uint id }";
     string constant Account = "#account { bytes32 account }";
     string constant Asset = "#asset { bytes32 asset, bytes32 meta }";
-    string constant Balance = "#balance { bytes32 asset, bytes32 meta, uint amount }";
     string constant Amount = "#amount { bytes32 asset, bytes32 meta, uint amount }";
-    string constant Minimum = "#minimum { bytes32 asset, bytes32 meta, uint amount }";
-    string constant Maximum = "#maximum { bytes32 asset, bytes32 meta, uint amount }";
+    string constant Balance = "#balance { bytes32 asset, bytes32 meta, uint amount }";
+    string constant BalanceLimit = "#balanceLimit { bytes32 asset, bytes32 meta, uint min, uint max }";
     string constant Custody = "#custody { uint host, bytes32 asset, bytes32 meta, uint amount }";
-    string constant Payout = "#payout { bytes32 account, bytes32 asset, bytes32 meta, uint amount }";
+    string constant CustodyLimit = "#custodyLimit { uint host, bytes32 asset, bytes32 meta, uint min, uint max }";
     string constant Allocation = "#allocation { uint host, bytes32 asset, bytes32 meta, uint amount }";
     string constant Allowance = "#allowance { uint host, bytes32 asset, bytes32 meta, uint amount }";
     string constant Transaction = "#transaction { bytes32 from, bytes32 to, bytes32 asset, bytes32 meta, uint amount }";
     string constant Context = "#context { bytes32 account, #bytes as state, #bytes as request }";
-    string constant Pipe = "#pipe { uint value, #context { bytes32 account, #bytes as state, #bytes as request } }";
+    string constant Pipe = "#pipe { uint value, #context { bytes32 account, #bytes as state, #bytes as steps } }";
     string constant Call = "#call { uint target, uint value, #bytes as payload }";
     string constant Step = "#step { uint target, uint value, #bytes as request }";
+    string constant Relay = "#relay { uint chain, uint endowment, #bytes as steps }";
+    string constant Dispatch = "#dispatch { uint chain, uint endowment, #bytes as payload }";
     string constant Bounty = "#bounty { uint amount, bytes32 relayer }";
     string constant Fee = "#fee { uint amount }";
     string constant Auth = "#auth { uint cid, uint deadline, #bytes as proof }";
@@ -113,12 +117,16 @@ library Sizes {
     uint constant Amount = B96;
     /// @dev BALANCE block: 8 header + 32 asset + 32 meta + 32 amount = 104 bytes
     uint constant Balance = B96;
+    /// @dev BALANCE_LIMIT block: 8 header + 32 asset + 32 meta + 32 min + 32 max = 136 bytes
+    uint constant BalanceLimit = B128;
     /// @dev FEE block: 8 header + 32 amount = 40 bytes
     uint constant Fee = B32;
     /// @dev BOUNTY block: 8 header + 32 amount + 32 relayer = 72 bytes
     uint constant Bounty = B64;
     /// @dev ALLOCATION/CUSTODY block: 8 header + 32 host + 32 asset + 32 meta + 32 amount = 136 bytes
     uint constant HostAmount = B128;
+    /// @dev CUSTODY_LIMIT block: 8 header + 32 host + 32 asset + 32 meta + 32 min + 32 max = 168 bytes
+    uint constant CustodyLimit = B160;
     /// @dev TRANSACTION block: 8 header + 32 from + 32 to + 32 asset + 32 meta + 32 amount = 168 bytes
     uint constant Transaction = B160;
 }

package/blocks/Writers.sol

@@ -894,16 +894,16 @@ library Writers {
     /// @param value Native value assigned to the pipe.
     /// @param account Command account identifier.
     /// @param state Raw nested state payload.
-    /// @param request Raw nested request payload.
+    /// @param steps Raw nested step payload.
     function appendPipe(
         Writer memory writer,
         uint value,
         bytes32 account,
         bytes memory state,
-        bytes memory request
+        bytes memory steps
     ) internal pure {
         uint i = writer.i;
-        uint len = 64 + 3 * Sizes.Header + state.length + request.length;
+        uint len = 64 + 3 * Sizes.Header + state.length + steps.length;
         uint next = i + Sizes.Header + len;
         i = reserve(writer, next, next);
 
@@ -912,7 +912,7 @@ library Writers {
             mstore(add(p, 0x08), value)
         }
 
-        writeBlock32BytesBytes(writer.dst, i + Sizes.Header + 32, Keys.Context, account, state, request);
+        writeBlock32BytesBytes(writer.dst, i + Sizes.Header + 32, Keys.Context, account, state, steps);
     }
 
     /// @notice Append a STATUS form block.

package/commands/Burn.sol

@@ -25,18 +25,21 @@ abstract contract Burn is CommandBase, BurnHook {
     uint internal immutable burnId = commandId(NAME);
 
     constructor() {
-        emit Command(host, burnId, NAME, "0:1:0", "", Keys.Balance, Keys.Empty, false);
+        emit Command(host, burnId, NAME, "0:1:0", "", Keys.Balance, Keys.Empty, false, false);
     }
 
+    /// @notice Burn each BALANCE block from the command state.
+    /// @param c Command context; `c.state` must contain BALANCE blocks.
+    /// @return Empty output state.
     function burn(CommandContext calldata c) external onlyCommand returns (bytes memory) {
-        (Cur memory state, ) = cursor(c.state, 1);
+        (Cur memory state, , ) = Cursors.init(c.state, 0, 1);
 
-        while (state.i < state.bound) {
+        while (state.i < state.len) {
             (bytes32 asset, bytes32 meta, uint amount) = state.unpackBalance();
             burn(c.account, asset, meta, amount);
         }
 
-        state.close();
+        state.complete();
         return "";
     }
 }

package/commands/Credit.sol

@@ -2,7 +2,7 @@
 pragma solidity ^0.8.33;
 
 import { CommandBase, CommandContext, Keys } from "./Base.sol";
-import { Cursors, Cur, Schemas } from "../Cursors.sol";
+import { Cursors, Cur } from "../Cursors.sol";
 
 using Cursors for Cur;
 
@@ -19,29 +19,29 @@ abstract contract CreditAccountHook {
 /// @title CreditAccount
 /// @notice Command that delivers BALANCE state blocks to an account via a virtual hook.
 /// Use for internally recording credits that have already been settled externally.
-/// An optional ACCOUNT block in the request overrides the default `c.account` destination.
 abstract contract CreditAccount is CommandBase, CreditAccountHook {
     string private constant NAME = "creditAccount";
-    string private constant REQUEST = string.concat(Schemas.Unit, ", maybe ", Schemas.Account);
 
     uint internal immutable creditAccountId = commandId(NAME);
 
     constructor() {
-        emit Command(host, creditAccountId, NAME, "0:1:0", REQUEST, Keys.Balance, Keys.Empty, false);
+        emit Command(host, creditAccountId, NAME, "0:1:0", "", Keys.Balance, Keys.Empty, false, false);
     }
 
+    /// @notice Credit each BALANCE block from the command state to the command account.
+    /// @param c Command context; `c.state` must contain BALANCE blocks.
+    /// @return Empty output state.
     function creditAccount(
         CommandContext calldata c
     ) external onlyCommand returns (bytes memory) {
-        (Cur memory state, ) = cursor(c.state, 1);
-        bytes32 to = Cursors.resolveAccount(c.request, c.account);
+        (Cur memory state, , ) = Cursors.init(c.state, 0, 1);
 
-        while (state.i < state.bound) {
+        while (state.i < state.len) {
             (bytes32 asset, bytes32 meta, uint amount) = state.unpackBalance();
-            creditAccount(to, asset, meta, amount);
+            creditAccount(c.account, asset, meta, amount);
         }
 
-        state.close();
+        state.complete();
         return "";
     }
 }

package/commands/Debit.sol

@@ -27,26 +27,29 @@ abstract contract DebitAccount is CommandBase, DebitAccountHook {
     uint internal immutable debitAccountId = commandId(NAME);
 
     constructor() {
-        emit Command(host, debitAccountId, NAME, "1:0:1", Schemas.Amount, Keys.Empty, Keys.Balance, false);
+        emit Command(host, debitAccountId, NAME, "1:0:1", Schemas.Amount, Keys.Empty, Keys.Balance, false, false);
     }
 
     /// @notice Override to customize request parsing or batching for debits.
     /// The default implementation iterates AMOUNT blocks, calls
     /// `debitAccount`, and emits matching BALANCE blocks.
     function debitAccount(bytes32 account, bytes calldata request) internal virtual returns (bytes memory) {
-        (Cur memory input, uint groups) = cursor(request, 1);
+        (Cur memory input, uint groups, ) = Cursors.init(request, 0, 1);
         Writer memory writer = Writers.allocBalances(groups);
 
-        while (input.i < input.bound) {
+        while (input.i < input.len) {
             (bytes32 asset, bytes32 meta, uint amount) = input.unpackAmount();
             debitAccount(account, asset, meta, amount);
             writer.appendBalance(asset, meta, amount);
         }
 
-        input.close();
+        input.complete();
         return writer.finish();
     }
 
+    /// @notice Debit AMOUNT request blocks from the command account and output matching BALANCE blocks.
+    /// @param c Command context; `c.request` must contain AMOUNT blocks.
+    /// @return BALANCE block stream matching the debited amounts.
     function debitAccount(
         CommandContext calldata c
     ) external onlyCommand returns (bytes memory) {

package/commands/Deposit.sol

@@ -42,22 +42,25 @@ abstract contract Deposit is CommandBase, DepositHook {
     uint internal immutable depositId = commandId(NAME);
 
     constructor() {
-        emit Command(host, depositId, NAME, "1:0:1", Schemas.Amount, Keys.Empty, Keys.Balance, false);
+        emit Command(host, depositId, NAME, "1:0:1", Schemas.Amount, Keys.Empty, Keys.Balance, false, false);
     }
 
+    /// @notice Deposit AMOUNT request blocks into the command account and output matching BALANCE blocks.
+    /// @param c Command context; `c.request` must contain AMOUNT blocks.
+    /// @return BALANCE block stream matching the deposited amounts.
     function deposit(
         CommandContext calldata c
     ) external onlyCommand returns (bytes memory) {
-        (Cur memory request, uint groups) = cursor(c.request, 1);
+        (Cur memory request, uint groups, ) = Cursors.init(c.request, 0, 1);
         Writer memory writer = Writers.allocBalances(groups);
 
-        while (request.i < request.bound) {
+        while (request.i < request.len) {
             (bytes32 asset, bytes32 meta, uint amount) = request.unpackAmount();
             deposit(c.account, asset, meta, amount);
             writer.appendBalance(asset, meta, amount);
         }
 
-        request.close();
+        request.complete();
         return writer.finish();
     }
 }
@@ -71,24 +74,27 @@ abstract contract DepositPayable is CommandBase, Payable, DepositPayableHook {
     uint internal immutable depositPayableId = commandId(NAME);
 
     constructor() {
-        emit Command(host, depositPayableId, NAME, "1:0:1", Schemas.Amount, Keys.Empty, Keys.Balance, true);
+        emit Command(host, depositPayableId, NAME, "1:0:1", Schemas.Amount, Keys.Empty, Keys.Balance, false, true);
     }
 
+    /// @notice Deposit AMOUNT request blocks with access to a mutable native-value budget.
+    /// @param c Command context; `c.request` must contain AMOUNT blocks.
+    /// @return BALANCE block stream matching the deposited amounts.
     function depositPayable(
         CommandContext calldata c
     ) external payable onlyCommand returns (bytes memory) {
-        (Cur memory request, uint groups) = cursor(c.request, 1);
+        (Cur memory request, uint groups, ) = Cursors.init(c.request, 0, 1);
         Writer memory writer = Writers.allocBalances(groups);
         Budget memory budget = valueBudget();
 
-        while (request.i < request.bound) {
+        while (request.i < request.len) {
             (bytes32 asset, bytes32 meta, uint amount) = request.unpackAmount();
             deposit(c.account, asset, meta, amount, budget);
             writer.appendBalance(asset, meta, amount);
         }
 
         settleValue(c.account, budget);
-        request.close();
+        request.complete();
         return writer.finish();
     }
 }

package/commands/Payout.sol

@@ -0,0 +1,49 @@
+// SPDX-License-Identifier: GPL-3.0-only
+pragma solidity ^0.8.33;
+
+import {CommandContext, CommandBase, Keys} from "./Base.sol";
+import {Cursors, Cur, Schemas} from "../Cursors.sol";
+import {Accounts} from "../utils/Accounts.sol";
+
+using Cursors for Cur;
+
+abstract contract PayoutHook {
+    /// @notice Override to pay `amount` from `account` to `to`.
+    /// Called once per paired BALANCE state block and ACCOUNT request block.
+    /// @param account Source account identifier.
+    /// @param to Destination account identifier.
+    /// @param asset Asset identifier.
+    /// @param meta Asset metadata slot.
+    /// @param amount Amount to pay out.
+    function payout(bytes32 account, bytes32 to, bytes32 asset, bytes32 meta, uint amount) internal virtual;
+}
+
+/// @title Payout
+/// @notice Command that sinks BALANCE state blocks to matching ACCOUNT request blocks.
+/// Each BALANCE block is paired with one ACCOUNT block at the same position.
+abstract contract Payout is CommandBase, PayoutHook {
+    string private constant NAME = "payout";
+
+    uint internal immutable payoutId = commandId(NAME);
+
+    constructor() {
+        emit Command(host, payoutId, NAME, "1:1:0", Schemas.Account, Keys.Balance, Keys.Empty, false, false);
+    }
+
+    /// @notice Pay out BALANCE state blocks to matching ACCOUNT request blocks.
+    /// @param c Command context; `c.state` must contain BALANCE blocks and `c.request` matching ACCOUNT blocks.
+    /// @return Empty output state.
+    function payout(CommandContext calldata c) external onlyCommand returns (bytes memory) {
+        (Cur memory state, uint groups, ) = Cursors.init(c.state, 0, 1);
+        (Cur memory request, ) = Cursors.init(c.request, 0, 1, groups);
+
+        while (state.i < state.len) {
+            (bytes32 asset, bytes32 meta, uint amount) = state.unpackBalance();
+            bytes32 to = Accounts.ensure(request.unpackAccount());
+            payout(c.account, to, asset, meta, amount);
+        }
+
+        state.complete();
+        return "";
+    }
+}

package/commands/Provision.sol

@@ -38,20 +38,23 @@ abstract contract Provision is CommandBase, ProvisionHook {
     uint internal immutable provisionId = commandId(NAME);
 
     constructor() {
-        emit Command(host, provisionId, NAME, "1:0:1", Schemas.Allocation, Keys.Empty, Keys.Custody, false);
+        emit Command(host, provisionId, NAME, "1:0:1", Schemas.Allocation, Keys.Empty, Keys.Custody, false, false);
     }
 
+    /// @notice Provision ALLOCATION request blocks and output matching CUSTODY state blocks.
+    /// @param c Command context; `c.request` must contain ALLOCATION blocks.
+    /// @return CUSTODY block stream matching the provisioned allocations.
     function provision(CommandContext calldata c) external onlyCommand returns (bytes memory) {
-        (Cur memory request, uint groups) = cursor(c.request, 1);
+        (Cur memory request, uint groups, ) = Cursors.init(c.request, 0, 1);
         Writer memory writer = Writers.allocCustodies(groups);
 
-        while (request.i < request.bound) {
+        while (request.i < request.len) {
             HostAmount memory allocation = request.unpackAllocationValue();
             provision(c.account, allocation);
             writer.appendCustody(allocation);
         }
 
-        request.close();
+        request.complete();
         return writer.finish();
     }
 }
@@ -66,24 +69,27 @@ abstract contract ProvisionPayable is CommandBase, Payable, ProvisionPayableHook
     uint internal immutable provisionPayableId = commandId(NAME);
 
     constructor() {
-        emit Command(host, provisionPayableId, NAME, "1:0:1", Schemas.Allocation, Keys.Empty, Keys.Custody, true);
+        emit Command(host, provisionPayableId, NAME, "1:0:1", Schemas.Allocation, Keys.Empty, Keys.Custody, false, true);
     }
 
+    /// @notice Provision ALLOCATION request blocks with access to a mutable native-value budget.
+    /// @param c Command context; `c.request` must contain ALLOCATION blocks.
+    /// @return CUSTODY block stream matching the provisioned allocations.
     function provisionPayable(
         CommandContext calldata c
     ) external payable onlyCommand returns (bytes memory) {
-        (Cur memory request, uint groups) = cursor(c.request, 1);
+        (Cur memory request, uint groups, ) = Cursors.init(c.request, 0, 1);
         Writer memory writer = Writers.allocCustodies(groups);
         Budget memory budget = valueBudget();
 
-        while (request.i < request.bound) {
+        while (request.i < request.len) {
             HostAmount memory allocation = request.unpackAllocationValue();
             provision(c.account, allocation, budget);
             writer.appendCustody(allocation);
         }
 
         settleValue(c.account, budget);
-        request.close();
+        request.complete();
         return writer.finish();
     }
 }

package/commands/Relay.sol

@@ -0,0 +1,58 @@
+// SPDX-License-Identifier: GPL-3.0-only
+pragma solidity ^0.8.33;
+
+import {CommandBase, CommandContext, Keys} from "./Base.sol";
+import {Payable} from "../core/Payable.sol";
+import {Cursors, Cur, Schemas} from "../Cursors.sol";
+import {Budget} from "../utils/Value.sol";
+
+using Cursors for Cur;
+
+abstract contract RelayPayableHook {
+    /// @notice Override to relay `steps` to `chain` with the current account and state.
+    /// @param chain Destination chain node ID.
+    /// @param endowment Native value requested for the destination pipe. The hook
+    /// decides how much source-chain budget must be spent to fund this value on
+    /// the destination chain.
+    /// @param account Command account identifier.
+    /// @param state Current command state block stream.
+    /// @param steps Embedded destination step block stream.
+    /// @param budget Source-chain native-value budget available for transport
+    /// fees and destination endowment funding.
+    function relay(
+        uint chain,
+        uint endowment,
+        bytes32 account,
+        bytes calldata state,
+        bytes calldata steps,
+        Budget memory budget
+    ) internal virtual;
+}
+
+/// @title RelayPayable
+/// @notice Command that forwards one RELAY block to a host-defined relay hook.
+/// Reverts unless the request contains exactly one RELAY block, preventing
+/// the same state from being duplicated across multiple relays.
+/// Produces no output state.
+abstract contract RelayPayable is CommandBase, Payable, RelayPayableHook {
+    string private constant NAME = "relayPayable";
+
+    uint internal immutable relayPayableId = commandId(NAME);
+
+    constructor() {
+        emit Command(host, relayPayableId, NAME, "1:0:0", Schemas.Relay, Keys.Any, Keys.Empty, false, true);
+    }
+
+    /// @notice Relay one RELAY request block with the command account and current state.
+    /// @param c Command context; `c.request` must contain exactly one RELAY block.
+    /// @return output Empty output state.
+    function relayPayable(CommandContext calldata c) external payable onlyCommand returns (bytes memory output) {
+        (Cur memory request, ) = Cursors.init(c.request, 0, 1, 1);
+        Budget memory budget = valueBudget();
+
+        (uint chain, uint endowment, bytes calldata steps) = request.unpackRelay();
+        relay(chain, endowment, c.account, c.state, steps, budget);
+        request.complete();
+        return "";
+    }
+}

package/commands/Withdraw.sol

@@ -2,13 +2,13 @@
 pragma solidity ^0.8.33;
 
 import { CommandContext, CommandBase, Keys } from "./Base.sol";
-import { Cursors, Cur, Schemas } from "../Cursors.sol";
+import { Cursors, Cur } from "../Cursors.sol";
 using Cursors for Cur;
 
 abstract contract WithdrawHook {
     /// @notice Override to send funds to `account`.
     /// Called once per BALANCE block in state.
-    /// @param account Destination account identifier (resolved from ACCOUNT block or caller).
+    /// @param account Destination account identifier.
     /// @param asset Asset identifier.
     /// @param meta Asset metadata slot.
     /// @param amount Amount to deliver.
@@ -21,26 +21,27 @@ abstract contract WithdrawHook {
 /// For internal balance credits, use `creditAccount` instead.
 abstract contract Withdraw is CommandBase, WithdrawHook {
     string private constant NAME = "withdraw";
-    string private constant REQUEST = string.concat(Schemas.Unit, ", maybe ", Schemas.Account);
 
     uint internal immutable withdrawId = commandId(NAME);
 
     constructor() {
-        emit Command(host, withdrawId, NAME, "0:1:0", REQUEST, Keys.Balance, Keys.Empty, false);
+        emit Command(host, withdrawId, NAME, "0:1:0", "", Keys.Balance, Keys.Empty, false, false);
     }
 
+    /// @notice Withdraw each BALANCE block from the command state to the command account.
+    /// @param c Command context; `c.state` must contain BALANCE blocks.
+    /// @return Empty output state.
     function withdraw(
         CommandContext calldata c
     ) external onlyCommand returns (bytes memory) {
-        (Cur memory state, ) = cursor(c.state, 1);
-        bytes32 to = Cursors.resolveAccount(c.request, c.account);
+        (Cur memory state, , ) = Cursors.init(c.state, 0, 1);
 
-        while (state.i < state.bound) {
+        while (state.i < state.len) {
             (bytes32 asset, bytes32 meta, uint amount) = state.unpackBalance();
-            withdraw(to, asset, meta, amount);
+            withdraw(c.account, asset, meta, amount);
         }
 
-        state.close();
+        state.complete();
         return "";
     }
 }

package/commands/admin/AllowAssets.sol

@@ -9,6 +9,8 @@ using Cursors for Cur;
 abstract contract AllowAssetsHook {
     /// @dev Override to allow a single asset/meta pair.
     /// Called once per ASSET block in the request.
+    /// @param asset Asset identifier.
+    /// @param meta Asset metadata slot.
     function allowAsset(bytes32 asset, bytes32 meta) internal virtual;
 }
 
@@ -21,20 +23,23 @@ abstract contract AllowAssets is CommandBase, AdminEvent, AllowAssetsHook {
     uint internal immutable allowAssetsId = commandId(NAME);
 
     constructor() {
-        emit Admin(host, allowAssetsId, NAME, "1:0:0", Schemas.Asset, Keys.Empty, Keys.Empty, false);
+        emit Admin(host, allowAssetsId, NAME, "1:0:0", Schemas.Asset, Keys.Empty, Keys.Empty, false, false);
     }
 
+    /// @notice Allow each ASSET block in the admin request.
+    /// @param c Admin command context; `c.request` must contain ASSET blocks.
+    /// @return Empty output state.
     function allowAssets(
         CommandContext calldata c
     ) external onlyAdmin(c.account) returns (bytes memory) {
-        (Cur memory request, ) = cursor(c.request, 1);
+        (Cur memory request, , ) = Cursors.init(c.request, 0, 1);
 
-        while (request.i < request.bound) {
+        while (request.i < request.len) {
             (bytes32 asset, bytes32 meta) = request.unpackAsset();
             allowAsset(asset, meta);
         }
 
-        request.close();
+        request.complete();
         return "";
     }
 }

package/commands/admin/Allowance.sol

@@ -26,18 +26,21 @@ abstract contract Allowance is CommandBase, AdminEvent, AllowanceHook {
     uint internal immutable allowanceId = commandId(NAME);
 
     constructor() {
-        emit Admin(host, allowanceId, NAME, "1:0:0", Schemas.Allowance, Keys.Empty, Keys.Empty, false);
+        emit Admin(host, allowanceId, NAME, "1:0:0", Schemas.Allowance, Keys.Empty, Keys.Empty, false, false);
     }
 
+    /// @notice Apply each ALLOWANCE block in the admin request.
+    /// @param c Admin command context; `c.request` must contain ALLOWANCE blocks.
+    /// @return Empty output state.
     function allowance(CommandContext calldata c) external onlyAdmin(c.account) returns (bytes memory) {
-        (Cur memory request, ) = cursor(c.request, 1);
+        (Cur memory request, , ) = Cursors.init(c.request, 0, 1);
 
-        while (request.i < request.bound) {
+        while (request.i < request.len) {
             (uint peer, bytes32 asset, bytes32 meta, uint amount) = request.unpackAllowance();
             allowance(peer, asset, meta, amount);
         }
 
-        request.close();
+        request.complete();
         return "";
     }
 }

package/commands/admin/Appoint.sol

@@ -16,20 +16,23 @@ abstract contract Appoint is CommandBase, AdminEvent {
     uint internal immutable appointId = commandId(NAME);
 
     constructor() {
-        emit Admin(host, appointId, NAME, "1:0:0", Schemas.Account, Keys.Empty, Keys.Empty, false);
+        emit Admin(host, appointId, NAME, "1:0:0", Schemas.Account, Keys.Empty, Keys.Empty, false, false);
     }
 
+    /// @notice Appoint each ACCOUNT block in the admin request as a guardian.
+    /// @param c Admin command context; `c.request` must contain ACCOUNT blocks.
+    /// @return Empty output state.
     function appoint(
         CommandContext calldata c
     ) external onlyAdmin(c.account) returns (bytes memory) {
-        (Cur memory request, ) = cursor(c.request, 1);
+        (Cur memory request, , ) = Cursors.init(c.request, 0, 1);
 
-        while (request.i < request.bound) {
+        while (request.i < request.len) {
             bytes32 account = request.unpackAccount();
             setGuardian(account, true);
         }
 
-        request.close();
+        request.complete();
         return "";
     }
 }

package/commands/admin/Authorize.sol

@@ -16,20 +16,23 @@ abstract contract Authorize is CommandBase, AdminEvent {
     uint internal immutable authorizeId = commandId(NAME);
 
     constructor() {
-        emit Admin(host, authorizeId, NAME, "1:0:0", Schemas.Node, Keys.Empty, Keys.Empty, false);
+        emit Admin(host, authorizeId, NAME, "1:0:0", Schemas.Node, Keys.Empty, Keys.Empty, false, false);
     }
 
+    /// @notice Authorize each NODE block in the admin request.
+    /// @param c Admin command context; `c.request` must contain NODE blocks.
+    /// @return Empty output state.
     function authorize(
         CommandContext calldata c
     ) external onlyAdmin(c.account) returns (bytes memory) {
-        (Cur memory request, ) = cursor(c.request, 1);
+        (Cur memory request, , ) = Cursors.init(c.request, 0, 1);
 
-        while (request.i < request.bound) {
+        while (request.i < request.len) {
             uint node = request.unpackNode();
             setNode(node, true);
         }
 
-        request.close();
+        request.complete();
         return "";
     }
 }

package/commands/admin/DenyAssets.sol

@@ -9,6 +9,8 @@ using Cursors for Cur;
 abstract contract DenyAssetsHook {
     /// @dev Override to deny a single asset/meta pair.
     /// Called once per ASSET block in the request.
+    /// @param asset Asset identifier.
+    /// @param meta Asset metadata slot.
     function denyAsset(bytes32 asset, bytes32 meta) internal virtual;
 }
 
@@ -21,20 +23,23 @@ abstract contract DenyAssets is CommandBase, AdminEvent, DenyAssetsHook {
     uint internal immutable denyAssetsId = commandId(NAME);
 
     constructor() {
-        emit Admin(host, denyAssetsId, NAME, "1:0:0", Schemas.Asset, Keys.Empty, Keys.Empty, false);
+        emit Admin(host, denyAssetsId, NAME, "1:0:0", Schemas.Asset, Keys.Empty, Keys.Empty, false, false);
     }
 
+    /// @notice Deny each ASSET block in the admin request.
+    /// @param c Admin command context; `c.request` must contain ASSET blocks.
+    /// @return Empty output state.
     function denyAssets(
         CommandContext calldata c
     ) external onlyAdmin(c.account) returns (bytes memory) {
-        (Cur memory request, ) = cursor(c.request, 1);
+        (Cur memory request, , ) = Cursors.init(c.request, 0, 1);
 
-        while (request.i < request.bound) {
+        while (request.i < request.len) {
             (bytes32 asset, bytes32 meta) = request.unpackAsset();
             denyAsset(asset, meta);
         }
 
-        request.close();
+        request.complete();
         return "";
     }
 }