@rootzero/contracts 1.12.0 → 1.14.0

package/commands/admin/Dismiss.sol

@@ -1,33 +1,36 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import { AdminBase, CommandContext, Keys } from "./Base.sol";
-import { Cursors, Cur } from "../../Cursors.sol";
-using Cursors for Cur;
+import { AdminBase, Execution, Executions, Lanes, Specs } from "./Base.sol";
+using Executions for Execution;
 
 /// @title Dismiss
 /// @notice Admin command that revokes guardian status from a list of account IDs.
-/// Each ACCOUNT block in the request is disabled as a guardian on the host.
+/// Each ACCOUNT block in the input is disabled as a guardian on the host.
 /// Only callable by the admin account.
 abstract contract Dismiss is AdminBase {
-    bytes32 private immutable descriptor;
+    uint private immutable descriptor;
 
     constructor() {
-        (, descriptor) = command("dismiss", Keys.Empty, Keys.Account, Keys.Empty, 0, false, true);
+        (, descriptor) = command("dismiss", Specs.Empty, Specs.Account, Specs.Empty, 0, false, true);
     }
 
-    /// @notice Dismiss each ACCOUNT block in the admin request from guardian status.
-    /// @param c Admin command context; `c.input` must contain ACCOUNT blocks.
+    /// @notice Dismiss each ACCOUNT block in the admin input from guardian status.
+    /// @param input ACCOUNT block stream.
     /// @return Empty output state.
+    /// @return Empty transaction stream.
     function dismiss(
-        CommandContext calldata c
-    ) external onlyAdmin(c.account) returns (bytes memory) {
-        (Cur memory input, ) = openInput(c.input, descriptor);
+        bytes32 account,
+        bytes calldata,
+        bytes calldata input
+    ) external onlyAdmin(account) returns (bytes memory, bytes memory) {
+        Execution memory exec = openInput(input, descriptor, 0);
 
-        while (input.i < input.len) {
-            bytes32 account = input.unpackAccount();
-            setGuardian(account, false);
+        while (exec.more()) {
+            bytes32 guardian = exec.unpackAccount(Lanes.Input);
+            setGuardian(guardian, false);
         }
-        return "";
+
+        return close(exec, account);
     }
 }

package/commands/admin/Execute.sol

@@ -1,36 +1,38 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import {AdminBase, CommandContext, Keys} from "./Base.sol";
-import {Payable} from "../../core/Payable.sol";
-import {Cursors, Cur} from "../../Cursors.sol";
-import {Budget} from "../../utils/Value.sol";
+import {AdminBase, Execution, Executions, Lanes, Specs} from "./Base.sol";
 
-using Cursors for Cur;
+using Executions for Execution;
 
 /// @title ExecutePayable
 /// @notice Admin command that forwards raw calldata to one or more target nodes.
 /// Each CALL block specifies a target node ID, packed resources, and raw calldata payload.
 /// Only callable by the admin account.
-/// Unspent top-level `msg.value` remains on this host.
-abstract contract ExecutePayable is AdminBase, Payable {
-    bytes32 private immutable descriptor;
+/// Unspent top-level `msg.value` is returned as a refund transaction.
+abstract contract ExecutePayable is AdminBase {
+    uint private immutable descriptor;
 
     constructor() {
-        (, descriptor) = command("executePayable", Keys.Empty, Keys.Call, Keys.Empty, 0, true, true);
+        (, descriptor) = command("executePayable", Specs.Empty, Specs.Call, Specs.Empty, 0, true, true);
     }
 
-    /// @notice Execute each CALL block in the admin request.
-    /// @param c Admin command context; `c.input` must contain CALL blocks.
+    /// @notice Execute each CALL block in the admin input.
+    /// @param input CALL block stream.
     /// @return Empty output state.
-    function executePayable(CommandContext calldata c) external payable onlyAdmin(c.account) returns (bytes memory) {
-        (Cur memory input, ) = openInput(c.input, descriptor);
-        Budget memory budget = openValue();
+    /// @return Remaining native value as a refund transaction stream.
+    function executePayable(
+        bytes32 account,
+        bytes calldata,
+        bytes calldata input
+    ) external payable onlyAdmin(account) returns (bytes memory, bytes memory) {
+        Execution memory exec = openInput(input, descriptor, 0);
 
-        while (input.i < input.len) {
-            (uint target, uint resources, bytes calldata data) = input.unpackCall();
-            rawCall(target, useValue(budget, resources), data);
+        while (exec.more()) {
+            (uint target, uint resources, bytes calldata data) = exec.unpackCall(Lanes.Input);
+            rawCall(target, exec.useValue(resources), data);
         }
-        return "";
+
+        return close(exec, account);
     }
 }

package/commands/admin/Label.sol

@@ -1,31 +1,36 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import {AdminBase, CommandContext, Keys} from "./Base.sol";
-import {Cursors, Cur} from "../../Cursors.sol";
-using Cursors for Cur;
+import {AdminBase, Execution, Executions, Lanes, Specs} from "./Base.sol";
+using Executions for Execution;
 
 /// @title Label
 /// @notice Admin command that publishes namespaced labels for node IDs.
-/// Each LABEL block in the request emits one `Labeled` event. Only callable by
+/// Each LABEL block in the input emits one `Labeled` event. Only callable by
 /// the admin account.
 abstract contract Label is AdminBase {
-    bytes32 private immutable descriptor;
+    uint private immutable descriptor;
 
     constructor() {
-        (, descriptor) = command("label", Keys.Empty, Keys.Label, Keys.Empty, 0, false, true);
+        (, descriptor) = command("label", Specs.Empty, Specs.Label, Specs.Empty, 0, false, true);
     }
 
-    /// @notice Publish each LABEL block in the admin request.
-    /// @param c Admin command context; `c.input` must contain LABEL blocks.
+    /// @notice Publish each LABEL block in the admin input.
+    /// @param input LABEL block stream.
     /// @return Empty output state.
-    function label(CommandContext calldata c) external onlyAdmin(c.account) returns (bytes memory) {
-        (Cur memory input, ) = openInput(c.input, descriptor);
+    /// @return Empty transaction stream.
+    function label(
+        bytes32 account,
+        bytes calldata,
+        bytes calldata input
+    ) external onlyAdmin(account) returns (bytes memory, bytes memory) {
+        Execution memory exec = openInput(input, descriptor, 0);
 
-        while (input.i < input.len) {
-            (uint node, bytes32 namespace, string memory name) = input.unpackLabel();
+        while (exec.more()) {
+            (uint node, bytes32 namespace, string memory name) = exec.unpackLabel(Lanes.Input);
             emit Labeled(node, namespace, name);
         }
-        return "";
+
+        return close(exec, account);
     }
 }

package/commands/admin/Schemas.sol

@@ -1,31 +1,36 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import {AdminBase, CommandContext, Keys} from "./Base.sol";
-import {Cursors, Cur} from "../../Cursors.sol";
-using Cursors for Cur;
+import {AdminBase, Execution, Executions, Lanes, Specs} from "./Base.sol";
+using Executions for Execution;
 
 /// @title PublishSchema
 /// @notice Admin command that publishes block schemas for keys.
-/// Each SCHEMA block in the request emits one `Schema` event. Only callable by
+/// Each SCHEMA block in the input emits one `Schema` event. Only callable by
 /// the admin account.
 abstract contract PublishSchema is AdminBase {
-    bytes32 private immutable descriptor;
+    uint private immutable descriptor;
 
     constructor() {
-        (, descriptor) = command("publishSchema", Keys.Empty, Keys.Schema, Keys.Empty, 0, false, true);
+        (, descriptor) = command("publishSchema", Specs.Empty, Specs.Schema, Specs.Empty, 0, false, true);
     }
 
-    /// @notice Publish each SCHEMA block in the admin request.
-    /// @param c Admin command context; `c.input` must contain SCHEMA blocks.
+    /// @notice Publish each SCHEMA block in the admin input.
+    /// @param input SCHEMA block stream.
     /// @return Empty output state.
-    function publishSchema(CommandContext calldata c) external onlyAdmin(c.account) returns (bytes memory) {
-        (Cur memory input, ) = openInput(c.input, descriptor);
+    /// @return Empty transaction stream.
+    function publishSchema(
+        bytes32 account,
+        bytes calldata,
+        bytes calldata input
+    ) external onlyAdmin(account) returns (bytes memory, bytes memory) {
+        Execution memory exec = openInput(input, descriptor, 0);
 
-        while (input.i < input.len) {
-            (bytes4 key, string memory body, bytes32 name) = input.unpackSchema();
-            emit Schema(host, key, body, name);
+        while (exec.more()) {
+            (uint spec, string memory body, bytes32 name) = exec.unpackSchema(Lanes.Input);
+            emit Schema(host, spec, body, name);
         }
-        return "";
+
+        return close(exec, account);
     }
 }

package/commands/admin/Unauthorize.sol

@@ -1,32 +1,42 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import {AdminBase, CommandContext, Keys} from "./Base.sol";
-import {Cursors, Cur} from "../../Cursors.sol";
-using Cursors for Cur;
+import {AdminBase, Execution, Executions, Lanes, Specs} from "./Base.sol";
+using Executions for Execution;
 
 /// @title Unauthorize
 /// @notice Admin command that revokes authorization from a list of node IDs.
-/// Each NODE block in the request is deauthorized on the host.
+/// Each NODE block in the input is deauthorized on the host.
 /// Only callable by the admin account.
 abstract contract Unauthorize is AdminBase {
-    bytes32 private immutable descriptor;
-    uint internal immutable unauthorizeId;
+    uint private immutable descriptor;
+    uint private immutable id;
 
     constructor() {
-        (unauthorizeId, descriptor) = command("unauthorize", Keys.Empty, Keys.Node, Keys.Empty, 0, false, true);
+        (id, descriptor) = command("unauthorize", Specs.Empty, Specs.Node, Specs.Empty, 0, false, true);
     }
 
-    /// @notice Unauthorize each NODE block in the admin request.
-    /// @param c Admin command context; `c.input` must contain NODE blocks.
+    /// @notice Return the registered UNAUTHORIZE command ID.
+    function unauthorizeId() internal view returns (uint) {
+        return id;
+    }
+
+    /// @notice Unauthorize each NODE block in the admin input.
+    /// @param input NODE block stream.
     /// @return Empty output state.
-    function unauthorize(CommandContext calldata c) external onlyAdmin(c.account) returns (bytes memory) {
-        (Cur memory input, ) = openInput(c.input, descriptor);
+    /// @return Empty transaction stream.
+    function unauthorize(
+        bytes32 account,
+        bytes calldata,
+        bytes calldata input
+    ) external onlyAdmin(account) returns (bytes memory, bytes memory) {
+        Execution memory exec = openInput(input, descriptor, 0);
 
-        while (input.i < input.len) {
-            uint node = input.unpackNode();
+        while (exec.more()) {
+            uint node = exec.unpackNode(Lanes.Input);
             setNode(node, false);
         }
-        return "";
+
+        return close(exec, account);
     }
 }

package/core/Calls.sol

@@ -2,7 +2,6 @@
 pragma solidity ^0.8.33;
 
 import {AccessControl} from "./Access.sol";
-import {CommandContext} from "../commands/Base.sol";
 import {Nodes} from "../utils/Nodes.sol";
 
 /// @dev Emitted when a trusted inter-node call fails.
@@ -14,13 +13,6 @@ error FailedCall(address addr, bytes4 selector, bytes err);
 /// @title NodeCalls
 /// @notice Shared low-level inter-node call helpers for contracts that can talk to other nodes.
 abstract contract NodeCalls is AccessControl {
-    /// @notice Return the host node ID corresponding to the current caller.
-    /// @dev Encodes `msg.sender` as a host ID using the local-chain host layout.
-    /// @return Host node ID for `msg.sender`.
-    function caller() internal view returns (uint) {
-        return Nodes.toHost(msg.sender);
-    }
-
     /// @notice Try a raw low-level call to another node and return whether it succeeded.
     /// @param node Node ID of the callee.
     /// @param value Native value to forward in wei.
@@ -89,18 +81,19 @@ abstract contract CommandCalls is NodeCalls {
     /// @param value Native value to forward in wei.
     /// @param account Command account identifier.
     /// @param state Current command state block stream.
-    /// @param request Command input block stream.
-    /// @return Decoded command output block stream.
+    /// @param input Command input block stream.
+    /// @return nextState Decoded command output state block stream.
+    /// @return transactions Decoded command transaction block stream.
     function callCommand(
         uint command,
         uint128 value,
         bytes32 account,
         bytes memory state,
-        bytes calldata request
-    ) internal returns (bytes memory) {
+        bytes calldata input
+    ) internal returns (bytes memory nextState, bytes memory transactions) {
         bytes4 selector = Nodes.commandSelector(command);
-        bytes memory data = abi.encodeWithSelector(selector, CommandContext(account, state, request));
-        return abi.decode(trustedCall(command, value, data), (bytes));
+        bytes memory data = abi.encodeWithSelector(selector, account, state, input);
+        return abi.decode(trustedCall(command, value, data), (bytes, bytes));
     }
 }
 

package/core/Endpoint.sol

@@ -1,159 +1,76 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import {Cursors, Cur} from "../Cursors.sol";
-import {Keys} from "../blocks/Keys.sol";
+import {Specs} from "../codec/Specs.sol";
+import {Execution, Executions} from "../execution/Execution.sol";
 import {EndpointEvent} from "../events/Endpoint.sol";
 import {LabeledEvent} from "../events/Labeled.sol";
 import {SchemaEvent} from "../events/Schema.sol";
+import {Descriptors} from "../codec/Descriptors.sol";
 import {Runtime} from "./Runtime.sol";
 
-/// @title Lane
-/// @notice Bit offsets for endpoint descriptor lanes.
-library Lane {
-    /// @dev Descriptor shift for the state lane.
-    uint internal constant State = 184;
-    /// @dev Descriptor shift for the input lane.
-    uint internal constant Input = 112;
-    /// @dev Descriptor shift for the output lane.
-    uint internal constant Output = 40;
-}
-
 /// @title EndpointBase
 /// @notice Shared endpoint metadata helpers.
 abstract contract EndpointBase is Runtime, EndpointEvent, LabeledEvent, SchemaEvent {
-    /// @dev Pack endpoint lanes and flags into a descriptor.
-    /// A non-empty lane with group 0 defaults to group 1; a zero lane is absent.
-    /// Layout: `[state:8][group:1][input:8][group:1][output:8][group:1]`
-    /// `[flags:1][reserved:4]`. Flag bits: funded = 0, admin = 1.
-    /// @param state Packed state lane plus optional group byte.
-    /// @param input Packed input lane plus optional group byte.
-    /// @param output Packed output lane plus optional group byte.
-    /// @param funded Whether the endpoint accepts nonzero native value.
-    /// @param admin Whether the endpoint is restricted to the admin account.
-    /// @return value Packed endpoint descriptor as an integer.
-    function pack(
-        bytes9 state,
-        bytes9 input,
-        bytes9 output,
-        bool funded,
-        bool admin
-    ) private pure returns (uint value) {
-        value |= uint(uint72(state)) << Lane.State;
-        value |= uint(uint72(input)) << Lane.Input;
-        value |= uint(uint72(output)) << Lane.Output;
-        value |= uint(funded ? 1 : 0) << 32;
-        value |= uint(admin ? 1 : 0) << 33;
-    }
-
-    /// @dev Return a lane's effective group size, defaulting non-empty lanes to one.
-    /// @param descriptor Packed endpoint descriptor.
-    /// @param shift Bit offset of the lane to inspect.
-    /// @return size Effective group size, or zero when the lane is absent.
-    function laneGroup(bytes32 descriptor, uint shift) private pure returns (uint8 size) {
-        uint72 lane = uint72(uint(descriptor) >> shift);
-        if (lane == 0) return 0;
-
-        size = uint8(lane);
-        if (size == 0) size = 1;
-    }
-
-    /// @notice Return an 8-byte lane value for a generic LIST containing `item`.
-    /// @param item Block key expected inside each LIST payload.
-    /// @return Packed lane key `[Keys.List][item]`.
-    function many(bytes4 item) internal pure returns (bytes8) {
-        return bytes8(bytes.concat(Keys.List, item));
-    }
-
-    /// @notice Append an explicit group size to an 8-byte lane value.
-    /// @param value Packed lane key `[key][item]`.
-    /// @param size Explicit per-operation group size for the lane.
-    /// @return Packed lane key plus group byte.
-    function group(bytes8 value, uint8 size) internal pure returns (bytes9) {
-        return bytes9(bytes.concat(value, bytes1(size)));
-    }
-
-    /// @dev Open a descriptor lane and return its effective group and output counts.
-    /// An absent lane inherits `expected`; a present lane must match it when nonzero.
-    /// @param source Block stream to open for the requested lane.
-    /// @param descriptor Packed endpoint descriptor.
-    /// @param shift Bit offset of the lane to open.
-    /// @param expected Required group count, or zero to accept the lane's count.
-    /// @return cur Cursor scoped to the lane's first block run.
-    /// @return groups Number of lane groups in `cur`, or `expected` for an absent lane.
-    /// @return outputs Number of output blocks implied by `groups` and the descriptor output lane.
-    function openLane(
-        bytes calldata source,
-        bytes32 descriptor,
-        uint shift,
-        uint expected
-    ) internal pure returns (Cur memory cur, uint groups, uint outputs) {
-        (cur, groups) = Cursors.init(source, laneGroup(descriptor, shift));
-        if (groups == 0) groups = expected;
-        else if (expected != 0 && groups != expected) revert Cursors.BadRatio();
-        outputs = groups * laneGroup(descriptor, Lane.Output);
-    }
-
-    /// @notice Open an endpoint state stream and return the expected output block count.
-    /// @param source State block stream to open.
-    /// @param descriptor Packed endpoint descriptor.
-    /// @return state Cursor scoped to the state lane's first block run.
-    /// @return outputs Number of output blocks implied by the state group count.
-    function openState(
-        bytes calldata source,
-        bytes32 descriptor
-    ) internal pure returns (Cur memory state, uint outputs) {
-        (state, , outputs) = openLane(source, descriptor, Lane.State, 0);
-    }
-
-    /// @notice Open an endpoint input stream and return the expected output block count.
+    /// @notice Open an endpoint input stream with an expected batch count.
     /// @param source Input block stream to open.
     /// @param descriptor Packed endpoint descriptor.
-    /// @return input Cursor scoped to the input lane's first block run.
-    /// @return outputs Number of output blocks implied by the input group count.
+    /// @param batches Required batch count, or zero to accept the input count.
+    /// @return exec Execution with its output buffer metadata initialized for the input batch count.
     function openInput(
         bytes calldata source,
-        bytes32 descriptor
-    ) internal pure returns (Cur memory input, uint outputs) {
-        (input, , outputs) = openLane(source, descriptor, Lane.Input, 0);
+        uint descriptor,
+        uint batches
+    ) internal view returns (Execution memory exec) {
+        return Executions.openInput(source, descriptor, batches);
     }
 
-    /// @notice Publish the default local block schema and return `Keys.Local`.
-    /// @param body Schema DSL string describing the block payload body.
-    /// @return The default context-local block key.
-    function localSchema(string memory body) internal returns (bytes4) {
-        return localSchema(1, body);
+    /// @notice Finalize an execution output and return its encoded block stream.
+    /// @param exec Completed endpoint execution.
+    /// @return Encoded output block stream.
+    function close(Execution memory exec) internal pure returns (bytes memory) {
+        return Executions.finish(exec);
     }
 
-    /// @notice Publish a context-local block schema and return its key.
+    /// @notice Construct and publish a context-local block specification.
     /// @param key Context-local key value.
+    /// @param min Minimum accepted payload length.
+    /// @param max Maximum accepted payload length; zero means unbounded.
+    /// @param hint Initial per-block payload capacity.
     /// @param body Schema DSL string describing the block payload body.
-    /// @return The context-local block key.
-    function localSchema(uint32 key, string memory body) internal returns (bytes4) {
-        bytes4 k = Keys.local(key);
-        emit Schema(host, k, body, bytes32(0));
-        return k;
+    /// @param name Schema alias name, or zero for unnamed schemas.
+    /// @return spec The context-local block specification.
+    function schema(
+        uint32 key,
+        uint32 min,
+        uint32 max,
+        uint32 hint,
+        string memory body,
+        bytes32 name
+    ) internal returns (uint spec) {
+        spec = Specs.create(bytes4(key), min, max, hint);
+        emit Schema(host, spec, body, name);
     }
 
     /// @notice Create and publish endpoint metadata with a default label.
     /// @param id Endpoint node ID.
     /// @param name Default human-readable endpoint label.
-    /// @param state Packed state lane plus optional group byte.
-    /// @param input Packed input lane plus optional group byte.
-    /// @param output Packed output lane plus optional group byte.
-    /// @param funded Whether the endpoint accepts nonzero native value.
-    /// @param admin Whether the endpoint is restricted to the admin account.
+    /// @param state State block specification.
+    /// @param input Input block specification.
+    /// @param output Output block specification.
+    /// @param transactions Number of transaction blocks produced per batch, or zero for none.
+    /// @param flags Packed endpoint behavior flags.
     /// @return descriptor Packed endpoint lane metadata and flags.
     function endpoint(
         uint id,
         string memory name,
-        bytes9 state,
-        bytes9 input,
-        bytes9 output,
-        bool funded,
-        bool admin
-    ) internal returns (bytes32 descriptor) {
-        descriptor = bytes32(pack(state, input, output, funded, admin));
+        uint state,
+        uint input,
+        uint output,
+        uint8 transactions,
+        uint8 flags
+    ) internal returns (uint descriptor) {
+        descriptor = Descriptors.create(state, input, output, transactions, flags);
         emit Endpoint(host, id, descriptor);
         emit Labeled(id, bytes32(0), name);
     }

package/core/Host.sol

@@ -43,7 +43,15 @@ abstract contract Host is
     ///        on it during construction.
     constructor(address cmdr) AccessControl(cmdr) {
         if (cmdr == address(0) || cmdr == address(this) || cmdr.code.length == 0) return;
-        IHostIntroduction(cmdr).introduce(host, block.number);
+        introduceTo(Nodes.toHost(cmdr));
+    }
+
+    /// @notice Introduce this host to the contract address embedded in a local EVM node ID.
+    /// @dev Accepts host and endpoint IDs such as commands, ports, queries, and guards.
+    /// Reverts when `node` is not local or embeds the zero address.
+    /// @param node Local EVM node ID whose underlying contract receives the introduction.
+    function introduceTo(uint node) internal {
+        IHostIntroduction(Nodes.addr(node)).introduce(host, block.number);
     }
 
     /// @notice Record a host introduction claim.
@@ -51,7 +59,7 @@ abstract contract Host is
     /// @param peer Host node ID being introduced.
     /// @param blocknum Block number at which the host was deployed.
     function introduce(uint peer, uint blocknum) external {
-        emit Introduction(Nodes.matchHost(peer, msg.sender), blocknum);
+        emit Introduction(host, Nodes.matchHost(peer, msg.sender), blocknum);
     }
 
     /// @notice Accept native ETH transfers (e.g. from command value flows).

package/core/Pipeline.sol

@@ -1,34 +1,38 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import {Cursors, Cur} from "../Cursors.sol";
-import {Payable} from "./Payable.sol";
-import {Budget} from "../utils/Value.sol";
+import {Decoders, Cur, Readers, Reader} from "../Codec.sol";
+import {Settlement} from "./Settlement.sol";
+import {Budget, Budgets} from "../execution/Budget.sol";
 
-using Cursors for Cur;
+using Decoders for Cur;
+using Readers for Reader;
+using Budgets for Budget;
 
 /// @title Pipeline
 /// @notice Core pipeline functionality shared by higher-level surfaces.
-abstract contract Pipeline is Payable {
+abstract contract Pipeline is Settlement {
     /// @dev Thrown when the pipeline finishes with non-empty threaded state.
     error UnexpectedState();
 
     /// @notice Override to dispatch one piped step.
-    /// Called once per STEP block. The returned bytes become the state passed to
-    /// the next step, and the final returned state must be empty.
-    /// @param target Node ID to invoke or handle.
+    /// Called once per STEP block. The returned state becomes the state passed to
+    /// the next step, and the final returned state must be empty. Returned
+    /// transactions are decoded and passed individually to `settle` before the next step runs.
+    /// @param cmd Command node ID to invoke or handle.
     /// @param account Account identifier for the piped context.
     /// @param state Current threaded state block stream.
-    /// @param request Step request block stream.
+    /// @param input Step input block stream.
     /// @param value Native EVM value assigned to this step.
-    /// @return Updated state block stream for the next step.
+    /// @return output Updated state block stream for the next step.
+    /// @return transactions Transaction block stream produced by the command.
     function dispatch(
-        uint target,
+        uint cmd,
         bytes32 account,
         bytes memory state,
-        bytes calldata request,
+        bytes calldata input,
         uint128 value
-    ) internal virtual returns (bytes memory);
+    ) internal virtual returns (bytes memory output, bytes memory transactions);
 
     /// @notice Execute a STEP block stream through the pipeline.
     /// @dev Reverts with `UnexpectedState` if the final threaded state is non-empty.
@@ -37,20 +41,20 @@ abstract contract Pipeline is Payable {
     /// @param state Initial state block stream passed to the first step.
     /// @param steps STEP block stream to execute.
     /// @param budget Mutable native-value budget shared across all steps.
-    function pipe(
-        bytes32 account,
-        bytes memory state,
-        bytes calldata steps,
-        Budget memory budget
-    ) internal {
-        (Cur memory input, ) = Cursors.init(steps, 1);
-
-        while (input.i < input.len) {
-            (uint target, uint resources, bytes calldata request) = input.unpackStep();
-            state = dispatch(target, account, state, request, useValue(budget, resources));
+    function pipe(bytes32 account, bytes memory state, bytes calldata steps, Budget memory budget) internal {
+        Cur memory cur = Decoders.open(steps, 1);
+
+        while (cur.more()) {
+            (uint cmd, uint resources, bytes calldata input) = cur.unpackStep();
+            Reader memory txs;
+            (state, txs.source) = dispatch(cmd, account, state, input, budget.use(resources));
+
+            while (txs.more()) {
+                (bytes32 from, bytes32 to, bytes32 asset, uint amount) = txs.unpackTransaction();
+                settle(from, to, asset, amount);
+            }
         }
 
         if (state.length != 0) revert UnexpectedState();
-        input.complete();
     }
 }