@rootzero/contracts 1.13.0 → 1.15.0

package/commands/admin/DenyAssets.sol

@@ -1,41 +1,44 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import { AdminBase, CommandContext, Keys } from "./Base.sol";
-import { Cursors, Cur } from "../../Cursors.sol";
-using Cursors for Cur;
+import { AdminBase, Execution, Executions, Lanes, Specs } from "./Base.sol";
+using Executions for Execution;
 
+/// @notice Hook implemented by hosts that deny assets.
 abstract contract DenyAssetsHook {
     /// @dev Override to deny a single asset.
-    /// Called once per ASSET block in the request.
+    /// Called once per ASSET block in the input.
     /// @param asset Asset identifier.
     function denyAsset(bytes32 asset) internal virtual;
 }
 
 /// @title DenyAssets
 /// @notice Admin command that blocks a list of assets via a virtual hook.
-/// Each ASSET block in the request calls `denyAsset`. Only callable by the admin account.
+/// Each ASSET block in the input calls `denyAsset`. Only callable by the admin account.
 abstract contract DenyAssets is AdminBase, DenyAssetsHook {
-    bytes32 private immutable descriptor;
+    uint private immutable descriptor;
 
     constructor() {
-        (, descriptor) = command("denyAssets", Keys.Empty, Keys.Asset, Keys.Empty, 0, false, true);
+        (, descriptor) = command("denyAssets", Specs.Empty, Specs.Asset, Specs.Empty, 0, false, true);
     }
 
-    /// @notice Deny each ASSET block in the admin request.
-    /// @param c Admin command context; `c.input` must contain ASSET blocks.
+    /// @notice Deny each ASSET block in the admin input.
+    /// @param input ASSET block stream.
     /// @return Empty output state.
     /// @return Empty transaction stream.
     function denyAssets(
-        CommandContext calldata c
-    ) external onlyAdmin(c.account) returns (bytes memory, bytes memory) {
-        (Cur memory input, ) = openInput(c.input, descriptor);
-
-        while (input.i < input.len) {
-            bytes32 asset = input.unpackAsset();
+        bytes32 account,
+        bytes calldata,
+        bytes calldata input
+    ) external onlyAdmin(account) returns (bytes memory, bytes memory) {
+        Execution memory exec = openInput(input, descriptor, 0);
+
+        while (exec.more()) {
+            bytes32 asset = exec.unpackAsset(Lanes.Input);
             denyAsset(asset);
         }
-        return ("", "");
+
+        return close(exec, account);
     }
 }
 

package/commands/admin/Dismiss.sol

@@ -1,34 +1,37 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import { AdminBase, CommandContext, Keys } from "./Base.sol";
-import { Cursors, Cur } from "../../Cursors.sol";
-using Cursors for Cur;
+import { AdminBase, Execution, Executions, Lanes, Specs } from "./Base.sol";
+import { GuardianAccess } from "../../core/Access.sol";
+using Executions for Execution;
 
 /// @title Dismiss
 /// @notice Admin command that revokes guardian status from a list of account IDs.
-/// Each ACCOUNT block in the request is disabled as a guardian on the host.
+/// Each USER ACCOUNT block in the input loses the guardian role on the host.
 /// Only callable by the admin account.
-abstract contract Dismiss is AdminBase {
-    bytes32 private immutable descriptor;
+abstract contract Dismiss is GuardianAccess, AdminBase {
+    uint private immutable descriptor;
 
     constructor() {
-        (, descriptor) = command("dismiss", Keys.Empty, Keys.Account, Keys.Empty, 0, false, true);
+        (, descriptor) = command("dismiss", Specs.Empty, Specs.Account, Specs.Empty, 0, false, true);
     }
 
-    /// @notice Dismiss each ACCOUNT block in the admin request from guardian status.
-    /// @param c Admin command context; `c.input` must contain ACCOUNT blocks.
+    /// @notice Dismiss each user ACCOUNT block in the admin input from guardian status.
+    /// @param input ACCOUNT block stream.
     /// @return Empty output state.
     /// @return Empty transaction stream.
     function dismiss(
-        CommandContext calldata c
-    ) external onlyAdmin(c.account) returns (bytes memory, bytes memory) {
-        (Cur memory input, ) = openInput(c.input, descriptor);
+        bytes32 account,
+        bytes calldata,
+        bytes calldata input
+    ) external onlyAdmin(account) returns (bytes memory, bytes memory) {
+        Execution memory exec = openInput(input, descriptor, 0);
 
-        while (input.i < input.len) {
-            bytes32 account = input.unpackAccount();
-            setGuardian(account, false);
+        while (exec.more()) {
+            bytes32 guardian = exec.unpackAccount(Lanes.Input);
+            setGuardian(guardian, false);
         }
-        return ("", "");
+
+        return close(exec, account);
     }
 }

package/commands/admin/Execute.sol

@@ -1,37 +1,39 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import {AdminBase, CommandContext, Keys} from "./Base.sol";
-import {Payable} from "../../core/Payable.sol";
-import {Cursors, Cur} from "../../Cursors.sol";
-import {Budget} from "../../utils/Value.sol";
+import {AdminBase, Execution, Executions, Lanes, Specs} from "./Base.sol";
+import {RawNodeCalls} from "../../core/Calls.sol";
 
-using Cursors for Cur;
+using Executions for Execution;
 
 /// @title ExecutePayable
 /// @notice Admin command that forwards raw calldata to one or more target nodes.
 /// Each CALL block specifies a target node ID, packed resources, and raw calldata payload.
 /// Only callable by the admin account.
-/// Unspent top-level `msg.value` remains on this host.
-abstract contract ExecutePayable is AdminBase, Payable {
-    bytes32 private immutable descriptor;
+/// Unspent top-level `msg.value` is returned as a refund transaction.
+abstract contract ExecutePayable is RawNodeCalls, AdminBase {
+    uint private immutable descriptor;
 
     constructor() {
-        (, descriptor) = command("executePayable", Keys.Empty, Keys.Call, Keys.Empty, 0, true, true);
+        (, descriptor) = command("executePayable", Specs.Empty, Specs.Call, Specs.Empty, 0, true, true);
     }
 
-    /// @notice Execute each CALL block in the admin request.
-    /// @param c Admin command context; `c.input` must contain CALL blocks.
+    /// @notice Execute each CALL block in the admin input.
+    /// @param input CALL block stream.
     /// @return Empty output state.
-    /// @return Empty transaction stream.
-    function executePayable(CommandContext calldata c) external payable onlyAdmin(c.account) returns (bytes memory, bytes memory) {
-        (Cur memory input, ) = openInput(c.input, descriptor);
-        Budget memory budget = openValue();
+    /// @return Remaining native value as a refund transaction stream.
+    function executePayable(
+        bytes32 account,
+        bytes calldata,
+        bytes calldata input
+    ) external payable onlyAdmin(account) returns (bytes memory, bytes memory) {
+        Execution memory exec = openInput(input, descriptor, 0);
 
-        while (input.i < input.len) {
-            (uint target, uint resources, bytes calldata data) = input.unpackCall();
-            rawCall(target, useValue(budget, resources), data);
+        while (exec.more()) {
+            (uint target, uint resources, bytes calldata data) = exec.unpackCall(Lanes.Input);
+            rawCall(target, exec.useValue(resources), data);
         }
-        return ("", "");
+
+        return close(exec, account);
     }
 }

package/commands/admin/Unauthorize.sol

@@ -1,33 +1,42 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import {AdminBase, CommandContext, Keys} from "./Base.sol";
-import {Cursors, Cur} from "../../Cursors.sol";
-using Cursors for Cur;
+import {AdminBase, Execution, Executions, Lanes, Specs} from "./Base.sol";
+using Executions for Execution;
 
 /// @title Unauthorize
 /// @notice Admin command that revokes authorization from a list of node IDs.
-/// Each NODE block in the request is deauthorized on the host.
+/// Each NODE block in the input is deauthorized on the host.
 /// Only callable by the admin account.
 abstract contract Unauthorize is AdminBase {
-    bytes32 private immutable descriptor;
-    uint internal immutable unauthorizeId;
+    uint private immutable descriptor;
+    uint private immutable id;
 
     constructor() {
-        (unauthorizeId, descriptor) = command("unauthorize", Keys.Empty, Keys.Node, Keys.Empty, 0, false, true);
+        (id, descriptor) = command("unauthorize", Specs.Empty, Specs.Node, Specs.Empty, 0, false, true);
     }
 
-    /// @notice Unauthorize each NODE block in the admin request.
-    /// @param c Admin command context; `c.input` must contain NODE blocks.
+    /// @notice Return the registered UNAUTHORIZE command ID.
+    function unauthorizeId() internal view returns (uint) {
+        return id;
+    }
+
+    /// @notice Unauthorize each NODE block in the admin input.
+    /// @param input NODE block stream.
     /// @return Empty output state.
     /// @return Empty transaction stream.
-    function unauthorize(CommandContext calldata c) external onlyAdmin(c.account) returns (bytes memory, bytes memory) {
-        (Cur memory input, ) = openInput(c.input, descriptor);
+    function unauthorize(
+        bytes32 account,
+        bytes calldata,
+        bytes calldata input
+    ) external onlyAdmin(account) returns (bytes memory, bytes memory) {
+        Execution memory exec = openInput(input, descriptor, 0);
 
-        while (input.i < input.len) {
-            uint node = input.unpackNode();
+        while (exec.more()) {
+            uint node = exec.unpackNode(Lanes.Input);
             setNode(node, false);
         }
-        return ("", "");
+
+        return close(exec, account);
     }
 }

package/core/Access.sol

@@ -8,34 +8,75 @@ import {Accounts} from "../utils/Accounts.sol";
 import {Nodes} from "../utils/Nodes.sol";
 import {addrOr} from "../utils/Utils.sol";
 
-/// @title AccessControl
-/// @notice Host access control layer.
-/// Tracks an immutable trusted commander, the host's own node ID, and a
-/// mapping of externally trusted node IDs. Inbound trust is host-based:
-/// trusted hosts, the commander, and this contract itself may interact
-/// with the host through the guarded command and peer entrypoints.
-abstract contract AccessControl is Runtime, NodeEvent, GuardianEvent {
-    /// @dev Trusted commander address. All calls from this address are implicitly trusted.
-    /// Defaults to `address(this)` when no external commander is provided.
-    address internal immutable commander;
-    /// @dev Admin account ID derived from the commander address at construction time.
-    bytes32 internal immutable admin;
+/// @dev Thrown when a caller, account, or node lacks required access.
+error AccessDenied();
+error CommanderNotAllowed();
 
-    /// @dev Mapping from guardian account ID to guardian status.
-    mapping(bytes32 account => bool) internal guardians;
+/// @title CallerAccess
+/// @notice Authorization capability required by command entrypoints.
+abstract contract CallerAccess is Runtime {
+    /// @notice Assert that `caller` may invoke a command and return it.
+    function enforceCaller(address caller) internal view virtual returns (address);
+}
 
-    /// @dev Mapping from node ID to trust status.
-    mapping(uint node => bool) internal nodes;
+/// @title TrustAccess
+/// @notice Authorization capability required by trusted outbound node calls.
+abstract contract TrustAccess {
+    /// @notice Assert that `node` is trusted and return it.
+    function ensureTrusted(uint node) internal view virtual returns (uint);
+}
 
-    /// @dev Thrown when a caller, account, or node lacks required access.
-    error AccessDenied();
+/// @title CommanderAccess
+/// @notice Minimal commander-based access control shared by host access policies.
+abstract contract CommanderAccess is Runtime {
+    /// @dev Trusted commander address.
+    /// Defaults to `address(this)` when no external commander is provided.
+    address internal immutable commander;
 
     /// @param cmdr Commander address, or zero to make this contract self-managed.
     constructor(address cmdr) {
         commander = addrOr(cmdr, address(this));
+    }
+
+    /// @notice Assert that `caller` is the commander and return it.
+    /// @param caller Address to validate.
+    /// @return The same `caller` value if it is the commander.
+    function enforceCommander(address caller) internal view returns (address) {
+        if (caller == address(0) || caller != commander) {
+            revert AccessDenied();
+        }
+        return caller;
+    }
+
+}
+
+/// @title AdminAccess
+/// @notice Commander access with the admin account derived from the commander.
+abstract contract AdminAccess is CommanderAccess {
+    /// @dev Admin account ID derived from the commander address at construction time.
+    bytes32 internal immutable admin;
+
+    constructor() {
         admin = Accounts.toAdmin(commander);
     }
 
+    /// @notice Assert that `account` is the admin account and `caller` is the commander.
+    function enforceAdmin(bytes32 account, address caller) internal view returns (bytes32) {
+        if (account != admin) revert AccessDenied();
+        enforceCommander(caller);
+        return account;
+    }
+}
+
+/// @title NodeAccess
+/// @notice Admin access extended with externally trusted node IDs.
+/// Inbound trust is host-based:
+/// trusted hosts, the commander, and this contract itself may interact
+/// with the host through the guarded command and peer entrypoints.
+abstract contract NodeAccess is AdminAccess, TrustAccess, NodeEvent {
+    /// @dev Mapping from node ID to trust status.
+    mapping(uint node => bool) internal nodes;
+
     /// @notice Set authorization status for a node.
     /// @param node Node ID to update.
     /// @param active True to authorize the node, false to revoke it.
@@ -44,58 +85,59 @@ abstract contract AccessControl is Runtime, NodeEvent, GuardianEvent {
         emit Node(host, node, active);
     }
 
-    /// @notice Set guardian status for an account.
-    /// @param account Guardian account ID to update.
-    /// @param active True to enable the guardian, false to revoke it.
-    function setGuardian(bytes32 account, bool active) internal {
-        Accounts.guardian(account);
-        guardians[account] = active;
-        emit Guardian(host, account, active);
-    }
-
-    /// @notice Return true if `addr` is an active guardian.
-    /// @param addr EVM address to check as a guardian account.
-    function isGuardian(address addr) internal view returns (bool) {
-        return guardians[Accounts.toGuardian(addr)];
-    }
-
     /// @notice Return true if `caller` is an implicitly trusted address.
     /// Trusted callers: the commander, this contract itself, or any address
     /// whose host ID has been explicitly authorized.
     /// @param caller Address to check.
-    function isTrusted(address caller) internal view returns (bool) {
+    function isTrustedCaller(address caller) internal view returns (bool) {
         return caller == commander || caller == address(this) || nodes[Nodes.toHost(caller)];
     }
 
     /// @notice Assert that `node` is in the trusted set and return it.
     /// @param node Node ID to validate.
     /// @return The same `node` value if trusted.
-    function ensureTrusted(uint node) internal view returns (uint) {
+    function ensureTrusted(uint node) internal view override returns (uint) {
         if (node == 0 || !nodes[node]) {
             revert AccessDenied();
         }
         return node;
     }
 
-    /// @notice Assert that `caller` is trusted and return it.
-    /// Used by command and peer modifiers to gate execution to authorized senders.
-    /// @param caller Address to validate.
-    /// @return The same `caller` value if trusted.
-    function enforceCaller(address caller) internal view returns (address) {
-        if (caller == address(0) || !isTrusted(caller)) {
+    /// @notice Assert that `caller` is a trusted peer other than the commander.
+    function enforcePeer(address caller) internal view returns (address) {
+        if (caller == commander) revert CommanderNotAllowed();
+        if (caller == address(0) || !isTrustedCaller(caller)) {
             revert AccessDenied();
         }
         return caller;
     }
 
-    /// @notice Assert that `caller` is the commander and return it.
-    /// Used by admin modifiers to keep governance authority separate from peer trust.
-    /// @param caller Address to validate.
-    /// @return The same `caller` value if it is the commander.
-    function enforceCommander(address caller) internal view returns (address) {
-        if (caller == address(0) || caller != commander) {
-            revert AccessDenied();
-        }
+}
+
+/// @title GuardianAccess
+/// @notice Node access extended with guardian identity and authorization.
+abstract contract GuardianAccess is NodeAccess, GuardianEvent {
+    /// @dev Mapping from user account ID to guardian status.
+    mapping(bytes32 account => bool) internal guardians;
+
+    /// @notice Set guardian status for an account.
+    /// @param account User account ID whose guardian role is updated.
+    /// @param active True to enable the guardian, false to revoke it.
+    function setGuardian(bytes32 account, bool active) internal {
+        account = Accounts.user(account);
+        guardians[account] = active;
+        emit Guardian(host, account, active);
+    }
+
+    /// @notice Return true if `addr` is an active guardian.
+    /// @param addr EVM address to check for the guardian role.
+    function isGuardian(address addr) internal view returns (bool) {
+        return guardians[Accounts.toUser(addr)];
+    }
+
+    /// @notice Assert that `caller` is an active guardian and return it.
+    function enforceGuardian(address caller) internal view returns (address) {
+        if (caller == address(0) || !isGuardian(caller)) revert AccessDenied();
         return caller;
     }
 }

package/core/Calls.sol

@@ -1,8 +1,7 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import {AccessControl} from "./Access.sol";
-import {CommandContext} from "../commands/Base.sol";
+import {TrustAccess} from "./Access.sol";
 import {Nodes} from "../utils/Nodes.sol";
 
 /// @dev Emitted when a trusted inter-node call fails.
@@ -11,16 +10,9 @@ import {Nodes} from "../utils/Nodes.sol";
 /// @param err Revert data returned by the failed call.
 error FailedCall(address addr, bytes4 selector, bytes err);
 
-/// @title NodeCalls
-/// @notice Shared low-level inter-node call helpers for contracts that can talk to other nodes.
-abstract contract NodeCalls is AccessControl {
-    /// @notice Return the host node ID corresponding to the current caller.
-    /// @dev Encodes `msg.sender` as a host ID using the local-chain host layout.
-    /// @return Host node ID for `msg.sender`.
-    function caller() internal view returns (uint) {
-        return Nodes.toHost(msg.sender);
-    }
-
+/// @title RawNodeCalls
+/// @notice Low-level inter-node call helpers without target authorization.
+abstract contract RawNodeCalls {
     /// @notice Try a raw low-level call to another node and return whether it succeeded.
     /// @param node Node ID of the callee.
     /// @param value Native value to forward in wei.
@@ -31,15 +23,6 @@ abstract contract NodeCalls is AccessControl {
         (success, ) = payable(addr).call{value: value}(data);
     }
 
-    /// @notice Try a trusted low-level call to another node and return whether it succeeded.
-    /// @param node Node ID of the callee.
-    /// @param value Native value to forward in wei.
-    /// @param data Encoded calldata to send.
-    /// @return success True if the low-level call succeeded.
-    function tryTrustedCall(uint node, uint128 value, bytes memory data) internal returns (bool success) {
-        return tryRawCall(ensureTrusted(node), value, data);
-    }
-
     /// @notice Make a raw low-level call to another node and revert when it fails.
     /// @param node Node ID of the callee.
     /// @param value Native value to forward in wei.
@@ -52,15 +35,6 @@ abstract contract NodeCalls is AccessControl {
         if (!success) revert FailedCall(addr, bytes4(data), out);
     }
 
-    /// @notice Make a trusted low-level call to another node and revert when it fails.
-    /// @param node Node ID of the callee.
-    /// @param value Native value to forward in wei.
-    /// @param data Encoded calldata to send.
-    /// @return out Return data from the successful call.
-    function trustedCall(uint node, uint128 value, bytes memory data) internal returns (bytes memory out) {
-        return rawCall(ensureTrusted(node), value, data);
-    }
-
     /// @notice Make a raw low-level read-only query to another node and revert when it fails.
     /// @param node Node ID of the callee.
     /// @param data Encoded calldata to send.
@@ -72,6 +46,29 @@ abstract contract NodeCalls is AccessControl {
         if (!success) revert FailedCall(addr, bytes4(data), out);
     }
 
+}
+
+/// @title NodeCalls
+/// @notice Trusted low-level inter-node calls backed by a host-provided node policy.
+abstract contract NodeCalls is RawNodeCalls, TrustAccess {
+    /// @notice Try a trusted low-level call to another node and return whether it succeeded.
+    /// @param node Node ID of the callee.
+    /// @param value Native value to forward in wei.
+    /// @param data Encoded calldata to send.
+    /// @return success True if the low-level call succeeded.
+    function tryTrustedCall(uint node, uint128 value, bytes memory data) internal returns (bool success) {
+        return tryRawCall(ensureTrusted(node), value, data);
+    }
+
+    /// @notice Make a trusted low-level call to another node and revert when it fails.
+    /// @param node Node ID of the callee.
+    /// @param value Native value to forward in wei.
+    /// @param data Encoded calldata to send.
+    /// @return out Return data from the successful call.
+    function trustedCall(uint node, uint128 value, bytes memory data) internal returns (bytes memory out) {
+        return rawCall(ensureTrusted(node), value, data);
+    }
+
     /// @notice Make a trusted low-level read-only query to another node and revert when it fails.
     /// @param node Node ID of the callee.
     /// @param data Encoded calldata to send.
@@ -89,7 +86,7 @@ abstract contract CommandCalls is NodeCalls {
     /// @param value Native value to forward in wei.
     /// @param account Command account identifier.
     /// @param state Current command state block stream.
-    /// @param request Command input block stream.
+    /// @param input Command input block stream.
     /// @return nextState Decoded command output state block stream.
     /// @return transactions Decoded command transaction block stream.
     function callCommand(
@@ -97,10 +94,10 @@ abstract contract CommandCalls is NodeCalls {
         uint128 value,
         bytes32 account,
         bytes memory state,
-        bytes calldata request
+        bytes calldata input
     ) internal returns (bytes memory nextState, bytes memory transactions) {
         bytes4 selector = Nodes.commandSelector(command);
-        bytes memory data = abi.encodeWithSelector(selector, CommandContext(account, state, request));
+        bytes memory data = abi.encodeWithSelector(selector, account, state, input);
         return abi.decode(trustedCall(command, value, data), (bytes, bytes));
     }
 }