@rootzero/contracts 1.16.0 → 1.18.0

package/CHANGELOG.md

@@ -3,6 +3,63 @@
 Until the protocol reaches integration-stable status, minor versions may include
 breaking API changes. Breaking changes are called out explicitly.
 
+## 1.18.0
+
+### Added
+
+- Added the non-funded `repay` and funded `repayPayable` commands. Both consume
+  `Position` state, settle only its liability side, and return the released
+  asset side as `Balance` state.
+- Added the reusable non-funded `RepayHook` settlement primitive and the
+  execution-funded `RepayPayableHook`.
+- Added the opt-in `RevokeAsset` guardian endpoint, which accepts `Asset`
+  entries and denies each asset through the existing `DenyAssetsHook`.
+
+### Changed
+
+- `Settlement.settle` now delegates its liability leg to the virtual `repay`
+  primitive. The default behavior remains a nonzero `debitAccount` call, while
+  derived settlement implementations can customize repayment in one place.
+- Exported the repayment commands and hooks and the asset-revocation guard from
+  their corresponding public barrels.
+
+### Upgrade Compatibility
+
+- Hosts inheriting `Settlement` retain the previous default settlement
+  behavior. Hosts that already declare an internal
+  `repay(bytes32,bytes32,uint)` function may need to mark it as an override or
+  rename it when upgrading.
+
+## 1.17.0
+
+### Breaking Changes
+
+- `executeDebitAccount`, `executeCreditAccount`, and `executeSettle` now require
+  the pipeline step's `uint128 value` argument and reject nonzero value inside
+  the internal adapter.
+- `AllowanceHook` implementations must treat an amount of zero as revocation.
+
+### Added
+
+- Added the `HostAsset` structural block and complete codec support for
+  host-scoped asset references.
+- Added the opt-in `RevokeAllowance` guardian endpoint, which accepts
+  `HostAsset` entries and revokes each allowance through `AllowanceHook`.
+- Added the funded `settlePayable` command and `SettlePayableHook` for settlement
+  implementations that require access to the command's native-value budget.
+
+### Changed
+
+- Completed the endpoint barrel with `CommandBase` and exported the new command,
+  guard, hook, internal adapter, and structural type surfaces from their
+  corresponding package barrels.
+
+### Upgrade Compatibility
+
+- Pipeline hosts using the internal debit, credit, or settle adapters must pass
+  each step's assigned value into the adapter. Existing non-funded steps should
+  continue to pass zero.
+
 ## 1.16.0
 
 ### Breaking Changes
@@ -54,6 +111,8 @@ breaking API changes. Breaking changes are called out explicitly.
 - Pipeline transaction streams are posted before the next step, and position
   state is settled separately through the scalar asset, amount, liability, and
   debt hook.
+- Completed the public barrel exports for internal command adapters,
+  input-only endpoint bases, access errors, and low-level utility helpers.
 
 ### Upgrade Compatibility
 

package/Codec.sol

@@ -4,7 +4,7 @@ pragma solidity ^0.8.33;
 // Aggregator: re-exports the complete block encoding and decoding surface.
 // Import this file for low-level codec extensions and direct stream processing.
 
-import { AssetAmount, AccountAsset, AccountAmount, HostAmount, HostAccountAsset, HostAccountAmount, Position, Tx } from "./core/Types.sol";
+import { AssetAmount, AccountAsset, HostAsset, AccountAmount, HostAmount, HostAccountAsset, HostAccountAmount, Position, Tx } from "./core/Types.sol";
 import { Keys } from "./codec/Keys.sol";
 import { Sizes, Specs } from "./codec/Specs.sol";
 import { Descriptors } from "./codec/Descriptors.sol";

package/Commands.sol

@@ -11,4 +11,4 @@ import {Blocks} from "./codec/Blocks.sol";
 import {Sizes, Specs} from "./codec/Specs.sol";
 import {Decoders} from "./codec/Decoders.sol";
 import {Cursors, Cur} from "./utils/Cursors.sol";
-import {AssetAmount, AccountAsset, AccountAmount, HostAmount, HostAccountAsset, HostAccountAmount, Position, Tx} from "./core/Types.sol";
+import {AssetAmount, AccountAsset, HostAsset, AccountAmount, HostAmount, HostAccountAsset, HostAccountAmount, Position, Tx} from "./core/Types.sol";

package/Core.sol

@@ -7,18 +7,18 @@ pragma solidity ^0.8.33;
 import { Action } from "./annotations/Action.sol";
 import { Label } from "./annotations/Label.sol";
 import { Schema } from "./annotations/Schema.sol";
-import { AdminAccess, CallerAccess, CommanderAccess, GuardianAccess, NodeAccess, TrustAccess } from "./core/Access.sol";
+import { AccessDenied, AdminAccess, CallerAccess, CommanderAccess, CommanderNotAllowed, GuardianAccess, NodeAccess, TrustAccess } from "./core/Access.sol";
 import { Balances, InsufficientFunds } from "./core/Balances.sol";
 import { Escrows, InsufficientEscrow } from "./core/Escrows.sol";
 import { NativeAsset, Runtime } from "./core/Runtime.sol";
 import { Admins, CommandHost, Guardians, Host, HostIntroduction, IHostIntroduction } from "./core/Host.sol";
 import { CommandCalls, FailedCall, NodeCalls, PortCalls, RawNodeCalls } from "./core/Calls.sol";
-import { EndpointBase } from "./core/Endpoint.sol";
+import { EndpointBase, InputEndpointBase } from "./core/Endpoint.sol";
 import { Pipeline } from "./core/Pipeline.sol";
 import { Budget, Budgets } from "./execution/Budget.sol";
-import { CreditAccountHook, DebitAccountHook, PostHook, SettleHook, Settlement } from "./core/Settlement.sol";
+import { CreditAccountHook, DebitAccountHook, PostHook, RepayHook, SettleHook, Settlement } from "./core/Settlement.sol";
 import { Portal } from "./core/Portal.sol";
-import { AssetAmount, AccountAsset, AccountAmount, HostAmount, HostAccountAsset, HostAccountAmount, Position, Tx } from "./core/Types.sol";
+import { AssetAmount, AccountAsset, HostAsset, AccountAmount, HostAmount, HostAccountAsset, HostAccountAmount, Position, Tx } from "./core/Types.sol";
 import { Validator } from "./core/Validator.sol";
 
 

package/Endpoints.sol

@@ -5,19 +5,26 @@ pragma solidity ^0.8.33;
 // Import this file to inherit from the full rootzero callable host surface without managing individual paths.
 
 // Shared endpoint hooks
-import { CreditAccountHook, DebitAccountHook, PostHook, SettleHook } from "./core/Settlement.sol";
+import { CreditAccountHook, DebitAccountHook, PostHook, RepayHook, SettleHook } from "./core/Settlement.sol";
 
 // Commands
+import { CommandBase } from "./commands/Base.sol";
 import { Allocate, AllocateHook } from "./commands/Allocate.sol";
 import { Burn, BurnHook } from "./commands/Burn.sol";
-import { CreditAccount } from "./commands/Credit.sol";
-import { DebitAccount } from "./commands/Debit.sol";
+import { CreditAccount, InternalCreditAccount } from "./commands/Credit.sol";
+import { DebitAccount, InternalDebitAccount } from "./commands/Debit.sol";
 import { Deposit, DepositHook, DepositPayable, DepositPayableHook } from "./commands/Deposit.sol";
 import { Payout, PayoutHook } from "./commands/Payout.sol";
 import { Provision, ProvisionHook, ProvisionPayable, ProvisionPayableHook } from "./commands/Provision.sol";
 import { RecoverPayable, RecoverPayableHook } from "./commands/Recover.sol";
+import { Repay, RepayPayable, RepayPayableHook } from "./commands/Repay.sol";
 import { RelayPayable, RelayBalancePayable, RelayPayableHook } from "./commands/Relay.sol";
-import { Settle } from "./commands/Settle.sol";
+import {
+    InternalSettle,
+    Settle,
+    SettlePayable,
+    SettlePayableHook
+} from "./commands/Settle.sol";
 import { Withdraw, WithdrawHook } from "./commands/Withdraw.sol";
 
 // Admin commands
@@ -46,7 +53,7 @@ import { PortPost } from "./ports/Post.sol";
 
 // Guard endpoints
 import { GuardBase } from "./guards/Base.sol";
-import { Revoke } from "./guards/Revoke.sol";
+import { Revoke, RevokeAllowance, RevokeAsset } from "./guards/Revoke.sol";
 
 // Query endpoints
 import { QueryBase } from "./queries/Base.sol";

package/README.md

@@ -219,7 +219,10 @@ pipeline.
 
 The built-in surface is also available as two independent feature bundles:
 `Admins` provides annotate, authorize, unauthorize, and executePayable;
-`Guardians` provides appoint, dismiss, and revoke. The full `Host` composes
+`Guardians` provides appoint, dismiss, and node revocation. Hosts that implement
+the allowance hook can additionally inherit the opt-in `RevokeAllowance` guard,
+which accepts `hostAsset { uint host, bytes32 asset }` entries and always applies
+a zero allowance. The full `Host` composes
 both, while smaller hosts can inherit either bundle separately.
 
 Trust is explicit and minimal. Each host has an immutable **commander**
@@ -325,7 +328,8 @@ abstract contract MyCommand is CommandBase {
 ```
 
 The standard commands cover the common ledger movements: `deposit` and
-`depositPayable` (external funds in), `withdraw` and `burn` (funds out),
+`depositPayable` (external funds in), `settlePayable` (funded settlement),
+`withdraw` and `burn` (funds out),
 `debitAccount` and `creditAccount` (internal movements), `payout` (deliver
 state to other accounts), `allocate` (turn balance state into custody),
 `provision` (provision custody from an external allocation), `settle` (consume
@@ -378,8 +382,8 @@ Hosts that implement a pipeline locally can inherit `InternalDebitAccount`,
 `InternalCreditAccount`, and `InternalSettle` to advertise the canonical command
 endpoints while routing their local command IDs through `executeDebitAccount`,
 `executeCreditAccount`, and `executeSettle`. These adapters consume the
-memory-backed pipeline state directly and avoid an external self-call. The host
-dispatcher must reject nonzero step value before invoking them because all three
+memory-backed pipeline state directly and avoid an external self-call. Pass the
+step value into each adapter; all three reject nonzero value because the
 commands are non-funded.
 
 Positions also support backward-composed pipelines. In an exact-output route,

package/Utils.sol

@@ -13,7 +13,7 @@ import { Ids } from "./utils/Ids.sol";
 import { Nodes } from "./utils/Nodes.sol";
 import { Selectors } from "./utils/Selectors.sol";
 import { Layout } from "./utils/Layout.sol";
-import { addrOr, applyBps, beforeBps, bytes32ToInt, bytes32ToString, divisible, hash32, intToBytes32, isFamily, matchesBase, MAX_BPS, max8, max16, max24, max32, max40, max64, max96, max128, max160, NotDivisible, retryTicket, toLocalBase, toUnspecifiedBase, ValueOverflow } from "./utils/Utils.sol";
+import { addrOr, applyBps, beforeBps, bytes32ToInt, bytes32ToString, clear8, clear16, clear32, clear64, divisible, ensureAddr, hash32, intToBytes32, isFamily, matchesBase, MAX_BPS, max8, max16, max24, max32, max40, max64, max96, max128, max160, NotDivisible, replace8, replace16, replace32, replace64, retryTicket, toLocalBase, toUnspecifiedBase, ValueOverflow, ZeroAddress } from "./utils/Utils.sol";
 
 
 

package/codec/Blocks.sol

@@ -335,6 +335,22 @@ library Blocks {
         }
     }
 
+    /// @notice Write a HOST_ASSET block at `i`.
+    /// @dev DANGER: Unchecked memory write. Reserve `Sizes.B64` bytes first.
+    /// @param dst Destination buffer.
+    /// @param i Relative write position.
+    /// @param host Host identifier to encode.
+    /// @param asset Asset identifier to encode.
+    function writeHostAsset(bytes memory dst, uint i, uint host, bytes32 asset) internal pure {
+        uint spec = Specs.HostAsset;
+        assembly ("memory-safe") {
+            let p := add(add(dst, 0x20), i)
+            mstore(p, spec)
+            mstore(add(p, 0x08), host)
+            mstore(add(p, 0x28), asset)
+        }
+    }
+
     // Three-word payloads
 
     /// @notice Write an ALLOCATION block at `i`.
@@ -1285,6 +1301,22 @@ library Blocks {
         }
     }
 
+    /// @notice Decode a low-level fixed-width HOST_ASSET block at `abs`.
+    /// @param abs Absolute block position.
+    /// @return host Decoded host identifier.
+    /// @return asset Decoded asset identifier.
+    function unpackHostAsset(uint abs) internal pure returns (uint host, bytes32 asset) {
+        uint head;
+        assembly ("memory-safe") {
+            head := calldataload(abs)
+        }
+        if (head >> 192 != Specs.HostAsset >> 192) revert InvalidBlock();
+        assembly ("memory-safe") {
+            host := calldataload(add(abs, 0x08))
+            asset := calldataload(add(abs, 0x28))
+        }
+    }
+
     /// @notice Decode a low-level fixed-width TRANSACTION block at `abs`.
     /// @param abs Absolute block position.
     /// @return from Decoded debit account.

package/codec/Decoders.sol

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import {AssetAmount, AccountAsset, AccountAmount, HostAmount, HostAccountAsset, Position, Tx} from "../core/Types.sol";
+import {AssetAmount, AccountAsset, HostAsset, AccountAmount, HostAmount, HostAccountAsset, Position, Tx} from "../core/Types.sol";
 import {Blocks} from "./Blocks.sol";
 import {Sizes, Specs} from "./Specs.sol";
 import {Cursors, Cur} from "../utils/Cursors.sol";
@@ -276,6 +276,16 @@ library Decoders {
         (account, asset) = Blocks.unpackAccountAsset(abs);
     }
 
+    /// @notice Decode and consume one HOST_ASSET block.
+    /// @param cur Cursor advanced past the block.
+    /// @return host Decoded host identifier.
+    /// @return asset Decoded asset identifier.
+    function unpackHostAsset(Cur memory cur) internal pure returns (uint host, bytes32 asset) {
+        uint abs;
+        (cur.state, abs) = cur.state.consume(Sizes.HostAsset);
+        (host, asset) = Blocks.unpackHostAsset(abs);
+    }
+
     /// @notice Decode and consume one AMOUNT block.
     /// @param cur Cursor advanced past the block.
     /// @return asset Decoded asset identifier.
@@ -462,6 +472,13 @@ library Decoders {
         (value.account, value.asset) = unpackAccountAsset(cur);
     }
 
+    /// @notice Decode one HOST_ASSET block into its structured value.
+    /// @param cur Cursor advanced past the block.
+    /// @return value Structured host and asset.
+    function unpackHostAssetValue(Cur memory cur) internal pure returns (HostAsset memory value) {
+        (value.host, value.asset) = unpackHostAsset(cur);
+    }
+
     /// @notice Decode one AMOUNT block into its structured value.
     /// @param cur Cursor advanced past the block.
     /// @return value Structured asset amount.

package/codec/Keys.sol

@@ -62,6 +62,8 @@ library Keys {
     bytes4 constant Status = bytes4(keccak256("#status"));
     /// @dev Structural account asset form - (bytes32 account, bytes32 asset)
     bytes4 constant AccountAsset = bytes4(keccak256("#accountAsset"));
+    /// @dev Structural host asset form - (uint host, bytes32 asset)
+    bytes4 constant HostAsset = bytes4(keccak256("#hostAsset"));
     /// @dev Structural account amount form - (bytes32 account, bytes32 asset, uint amount)
     bytes4 constant AccountAmount = bytes4(keccak256("#accountAmount"));
     /// @dev Structural host amount form - (uint host, bytes32 asset, uint amount)

package/codec/Readers.sol

@@ -94,6 +94,18 @@ library Readers {
         }
     }
 
+    /// @notice Consume a HOST_ASSET block and return its fields.
+    /// @param cur Reader; advanced past the block.
+    /// @return host Host identifier.
+    /// @return asset Asset identifier.
+    function unpackHostAsset(Reader memory cur) internal pure returns (uint host, bytes32 asset) {
+        uint abs = consume(cur, Keys.HostAsset, 64, 64);
+        assembly ("memory-safe") {
+            host := mload(abs)
+            asset := mload(add(abs, 0x20))
+        }
+    }
+
     /// @notice Consume a POSITION block and return its fields.
     function unpackPosition(
         Reader memory cur

package/codec/Schema.sol

@@ -81,6 +81,7 @@ library Schemas {
     string constant Amount = "{ bytes32 asset, uint amount }";
     string constant Balance = "{ bytes32 asset, uint amount }";
     string constant AccountAsset = "{ bytes32 account, bytes32 asset }";
+    string constant HostAsset = "{ uint host, bytes32 asset }";
 
     // Three-word payloads
 

package/codec/Specs.sol

@@ -27,6 +27,8 @@ library Sizes {
     uint constant Amount = B64;
     /// @dev BALANCE block: 8 header + 32 asset + 32 amount = 72 bytes
     uint constant Balance = B64;
+    /// @dev HOST_ASSET block: 8 header + 32 host + 32 asset = 72 bytes
+    uint constant HostAsset = B64;
     /// @dev ALLOCATION/CUSTODY block: 8 header + 32 host + 32 asset + 32 amount = 104 bytes
     uint constant HostAmount = B96;
     /// @dev TRANSACTION block: 8 header + 32 from + 32 to + 32 asset + 32 amount = 136 bytes
@@ -88,6 +90,7 @@ library Specs {
 
     uint constant Status = uint(bytes32(Keys.Status)) | Exact32;
     uint constant AccountAsset = uint(bytes32(Keys.AccountAsset)) | Exact64;
+    uint constant HostAsset = uint(bytes32(Keys.HostAsset)) | Exact64;
     uint constant AccountAmount = uint(bytes32(Keys.AccountAmount)) | Exact96;
     uint constant HostAmount = uint(bytes32(Keys.HostAmount)) | Exact96;
     uint constant HostAccountAsset = uint(bytes32(Keys.HostAccountAsset)) | Exact96;

package/codec/Writers.sol

@@ -204,6 +204,15 @@ library Writers {
         Blocks.writeAccountAsset(writer.dst, i, account, asset);
     }
 
+    /// @notice Append a HOST_ASSET block.
+    /// @param writer Destination writer.
+    /// @param host Host identifier to encode.
+    /// @param asset Asset identifier to encode.
+    function appendHostAsset(Writer memory writer, uint host, bytes32 asset) internal pure {
+        uint i = reserve(writer, Sizes.HostAsset);
+        Blocks.writeHostAsset(writer.dst, i, host, asset);
+    }
+
     /// @notice Append an ALLOCATION block.
     /// @param writer Destination writer.
     /// @param host Host identifier to encode.

package/commands/Base.sol

@@ -22,6 +22,8 @@ using Executions for Execution;
 abstract contract CommandBase is CallerAccess, EndpointBase, ReceivedEvent {
     /// @dev Thrown when `onlyActive` finds that `deadline` has already passed.
     error Expired();
+    /// @dev Thrown when a non-funded internal command receives native value.
+    error ValueNotAllowed();
 
     /// @dev Restrict execution to trusted callers.
     modifier onlyCommand() {

package/commands/Credit.sol

@@ -54,13 +54,16 @@ abstract contract InternalCreditAccount is CreditAccount {
     /// @param account Account credited by each balance.
     /// @param state BALANCE block stream held in pipeline memory.
     /// @param input Empty input required by the command schema.
+    /// @param value Native value assigned to the command; must be zero.
     /// @return output Empty output state.
     /// @return transactions Empty transaction stream.
     function executeCreditAccount(
         bytes32 account,
         bytes memory state,
-        bytes calldata input
+        bytes calldata input,
+        uint128 value
     ) internal returns (bytes memory, bytes memory) {
+        if (value != 0) revert ValueNotAllowed();
         if (input.length != 0) revert Executions.ZeroStride();
         if (state.length == 0) revert Blocks.EmptyRun();
 

package/commands/Debit.sol

@@ -58,13 +58,16 @@ abstract contract InternalDebitAccount is DebitAccount {
     /// @param account Account whose funds are debited.
     /// @param state Empty pipeline state required by the command schema.
     /// @param input AMOUNT block stream.
+    /// @param value Native value assigned to the command; must be zero.
     /// @return output BALANCE block stream matching the debited amounts.
     /// @return transactions Empty transaction stream.
     function executeDebitAccount(
         bytes32 account,
         bytes memory state,
-        bytes calldata input
+        bytes calldata input,
+        uint128 value
     ) internal returns (bytes memory, bytes memory) {
+        if (value != 0) revert ValueNotAllowed();
         if (state.length != 0) revert Executions.ZeroStride();
         if (input.length == 0) revert Blocks.EmptyRun();
 

package/commands/Repay.sol

@@ -0,0 +1,83 @@
+// SPDX-License-Identifier: GPL-3.0-only
+pragma solidity ^0.8.33;
+
+import {Execution, Executions, CommandBase, Lanes, Specs} from "./Base.sol";
+import {RepayHook} from "../core/Settlement.sol";
+import {Action} from "../annotations/Action.sol";
+import {Actions} from "../utils/Actions.sol";
+
+using Executions for Execution;
+
+/// @notice Hook implemented by hosts that repay position liabilities using native value.
+abstract contract RepayPayableHook {
+    /// @notice Override to repay one liability for `account` with a shared value budget.
+    /// @param account Account whose liability is being repaid.
+    /// @param liability Identifier for the liability side.
+    /// @param debt Quantity on the liability side.
+    /// @param funds Mutable execution used only for its remaining native-value budget.
+    function repay(bytes32 account, bytes32 liability, uint debt, Execution memory funds) internal virtual;
+}
+
+/// @title Repay
+/// @notice Command that repays POSITION liabilities and returns their assets as BALANCE state.
+abstract contract Repay is CommandBase, RepayHook, Action {
+    uint private immutable descriptor;
+
+    constructor() {
+        uint id;
+        (id, descriptor) = command("repay", Specs.Position, Specs.Empty, Specs.Balance, 0, false, false);
+        action(id, Actions.Settle);
+    }
+
+    /// @notice Repay each POSITION liability and return its asset as BALANCE state.
+    /// @param state POSITION block stream.
+    /// @return BALANCE output state containing each released asset side.
+    /// @return Empty transaction stream.
+    function repay(
+        bytes32 account,
+        bytes calldata state,
+        bytes calldata input
+    ) external onlyCommand returns (bytes memory, bytes memory) {
+        Execution memory exec = openCommand(state, input, descriptor, 0);
+
+        while (exec.more()) {
+            (bytes32 asset, uint amount, bytes32 liability, uint debt) = exec.unpackPosition(Lanes.State);
+            repay(account, liability, debt);
+            exec.outputBalance(asset, amount);
+        }
+
+        return close(exec, account);
+    }
+}
+
+/// @title RepayPayable
+/// @notice Funded command that repays POSITION liabilities and returns their assets as BALANCE state.
+abstract contract RepayPayable is CommandBase, RepayPayableHook, Action {
+    uint private immutable descriptor;
+
+    constructor() {
+        uint id;
+        (id, descriptor) = command("repayPayable", Specs.Position, Specs.Empty, Specs.Balance, 0, true, false);
+        action(id, Actions.Settle);
+    }
+
+    /// @notice Repay each POSITION liability and return its asset as BALANCE state.
+    /// @param state POSITION block stream.
+    /// @return BALANCE output state containing each released asset side.
+    /// @return Remaining native value as a refund transaction stream.
+    function repayPayable(
+        bytes32 account,
+        bytes calldata state,
+        bytes calldata input
+    ) external payable onlyCommand returns (bytes memory, bytes memory) {
+        Execution memory exec = openCommand(state, input, descriptor, 0);
+
+        while (exec.more()) {
+            (bytes32 asset, uint amount, bytes32 liability, uint debt) = exec.unpackPosition(Lanes.State);
+            repay(account, liability, debt, exec);
+            exec.outputBalance(asset, amount);
+        }
+
+        return close(exec, account);
+    }
+}

package/commands/Settle.sol

@@ -11,6 +11,25 @@ import {Reader, Readers} from "../codec/Readers.sol";
 using Executions for Execution;
 using Readers for Reader;
 
+/// @notice Hook implemented by hosts that settle positions using native value.
+abstract contract SettlePayableHook {
+    /// @notice Override to settle one position for `account` with a shared value budget.
+    /// @param account Account whose position is being settled.
+    /// @param asset Identifier for the asset side.
+    /// @param amount Quantity on the asset side.
+    /// @param liability Identifier for the liability side.
+    /// @param debt Quantity on the liability side.
+    /// @param funds Mutable execution used only for its remaining native-value budget.
+    function settle(
+        bytes32 account,
+        bytes32 asset,
+        uint amount,
+        bytes32 liability,
+        uint debt,
+        Execution memory funds
+    ) internal virtual;
+}
+
 /// @title Settle
 /// @notice Command that consumes POSITION state blocks through a virtual hook.
 abstract contract Settle is CommandBase, SettleHook, Action {
@@ -47,6 +66,37 @@ abstract contract Settle is CommandBase, SettleHook, Action {
     }
 }
 
+/// @title SettlePayable
+/// @notice Funded command that consumes POSITION state blocks through a virtual hook.
+abstract contract SettlePayable is CommandBase, SettlePayableHook, Action {
+    uint private immutable descriptor;
+
+    constructor() {
+        uint id;
+        (id, descriptor) = command("settlePayable", Specs.Position, Specs.Empty, Specs.Empty, 0, true, false);
+        action(id, Actions.Settle);
+    }
+
+    /// @notice Settle each POSITION block with access to a shared native-value budget.
+    /// @param state POSITION block stream.
+    /// @return Empty output state.
+    /// @return Remaining native value as a refund transaction stream.
+    function settlePayable(
+        bytes32 account,
+        bytes calldata state,
+        bytes calldata input
+    ) external payable onlyCommand returns (bytes memory, bytes memory) {
+        Execution memory exec = openCommand(state, input, descriptor, 0);
+
+        while (exec.more()) {
+            (bytes32 asset, uint amount, bytes32 liability, uint debt) = exec.unpackPosition(Lanes.State);
+            settle(account, asset, amount, liability, debt, exec);
+        }
+
+        return close(exec, account);
+    }
+}
+
 /// @title InternalSettle
 /// @notice Extends the advertised settle command with memory-state pipeline dispatch.
 /// @dev This adapter is not a separate command. It uses the command ID and settlement hook
@@ -56,13 +106,16 @@ abstract contract InternalSettle is Settle {
     /// @param account Account for which each position is settled.
     /// @param state POSITION block stream held in pipeline memory.
     /// @param input Empty input required by the command schema.
+    /// @param value Native value assigned to the command; must be zero.
     /// @return output Empty output state.
     /// @return transactions Empty transaction stream.
     function executeSettle(
         bytes32 account,
         bytes memory state,
-        bytes calldata input
+        bytes calldata input,
+        uint128 value
     ) internal returns (bytes memory, bytes memory) {
+        if (value != 0) revert ValueNotAllowed();
         if (input.length != 0) revert Executions.ZeroStride();
         if (state.length == 0) revert Blocks.EmptyRun();
 

package/commands/admin/Allowance.sol

@@ -12,7 +12,7 @@ abstract contract AllowanceHook {
     /// or another host-specific authorization record.
     /// @param peer Host node receiving the allowed cap.
     /// @param asset Asset identifier.
-    /// @param amount Allowed cap amount.
+    /// @param amount Allowed cap amount. A zero amount MUST revoke the allowance.
     function allowance(uint peer, bytes32 asset, uint amount) internal virtual;
 }
 

package/core/Settlement.sol

@@ -28,22 +28,23 @@ abstract contract PostHook {
     function post(bytes32 from, bytes32 to, bytes32 asset, uint amount) internal virtual;
 }
 
+/// @title RepayHook
+/// @notice Hook for repaying one account liability.
+abstract contract RepayHook {
+    /// @notice Override to repay `debt` denominated in `liability` for `account`.
+    function repay(bytes32 account, bytes32 liability, uint debt) internal virtual;
+}
+
 /// @title SettleHook
 /// @notice Hook for settling one asset-liability position.
 abstract contract SettleHook {
     /// @notice Override to settle one position for `account`.
-    function settle(
-        bytes32 account,
-        bytes32 asset,
-        uint amount,
-        bytes32 liability,
-        uint debt
-    ) internal virtual;
+    function settle(bytes32 account, bytes32 asset, uint amount, bytes32 liability, uint debt) internal virtual;
 }
 
 /// @title Settlement
 /// @notice Default account-hook implementation for transaction posting and position settlement.
-abstract contract Settlement is PostHook, SettleHook, DebitAccountHook, CreditAccountHook {
+abstract contract Settlement is PostHook, SettleHook, RepayHook, DebitAccountHook, CreditAccountHook {
     /// @notice Post one transaction by debiting its source and crediting its destination.
     /// Returns without calling either hook when `amount` is zero and skips either
     /// operation when the corresponding account is zero.
@@ -53,6 +54,12 @@ abstract contract Settlement is PostHook, SettleHook, DebitAccountHook, CreditAc
         if (to != 0) creditAccount(to, asset, amount);
     }
 
+    /// @notice Repay one liability by debiting it from the account.
+    /// Skips the debit when `debt` is zero.
+    function repay(bytes32 account, bytes32 liability, uint debt) internal virtual override {
+        if (debt != 0) debitAccount(account, liability, debt);
+    }
+
     /// @notice Settle one position by crediting its asset and debiting its liability.
     /// Skips either operation when its corresponding amount is zero.
     function settle(

package/core/Types.sol

@@ -27,6 +27,14 @@ struct AccountAmount {
     uint amount;
 }
 
+/// @notice Host-scoped asset shape.
+struct HostAsset {
+    /// @dev Host node identifier.
+    uint host;
+    /// @dev Asset identifier.
+    bytes32 asset;
+}
+
 /// @notice Host-scoped asset and amount shape.
 struct HostAmount {
     /// @dev Host node identifier.

package/execution/Execution.sol

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import {AssetAmount, AccountAsset, AccountAmount, HostAmount, HostAccountAsset, Position, Tx} from "../core/Types.sol";
+import {AssetAmount, AccountAsset, HostAsset, AccountAmount, HostAmount, HostAccountAsset, Position, Tx} from "../core/Types.sol";
 import {Blocks} from "../codec/Blocks.sol";
 import {Buffers} from "../codec/Buffers.sol";
 import {Sizes, Specs} from "../codec/Specs.sol";
@@ -287,6 +287,31 @@ library Executions {
         (value.account, value.asset) = unpackAccountAsset(exec, lane);
     }
 
+    /// @notice Decode and consume one HOST_ASSET block from `lane`.
+    /// @param exec Execution whose decoder is advanced.
+    /// @param lane Decoder lane to consume.
+    /// @return host Decoded host identifier.
+    /// @return asset Decoded asset identifier.
+    function unpackHostAsset(
+        Execution memory exec,
+        uint8 lane
+    ) internal pure returns (uint host, bytes32 asset) {
+        uint abs;
+        (exec.decoders, abs) = exec.decoders.consume(lane, Sizes.HostAsset);
+        (host, asset) = Blocks.unpackHostAsset(abs);
+    }
+
+    /// @notice Decode one HOST_ASSET block into its structured value.
+    /// @param exec Execution whose decoder is advanced.
+    /// @param lane Decoder lane to consume.
+    /// @return value Decoded host and asset.
+    function unpackHostAssetValue(
+        Execution memory exec,
+        uint8 lane
+    ) internal pure returns (HostAsset memory value) {
+        (value.host, value.asset) = unpackHostAsset(exec, lane);
+    }
+
     /// @notice Decode and consume one AMOUNT block from `lane`.
     /// @param exec Execution whose decoder is advanced.
     /// @param lane Decoder lane to consume.
@@ -805,6 +830,15 @@ library Executions {
         Blocks.writeAccountAsset(exec.output, i, account, asset);
     }
 
+    /// @notice Append a HOST_ASSET block to execution output.
+    /// @param exec Execution receiving the block.
+    /// @param host Host identifier to encode.
+    /// @param asset Asset identifier to encode.
+    function outputHostAsset(Execution memory exec, uint host, bytes32 asset) internal pure {
+        uint i = reserve(exec, Sizes.HostAsset);
+        Blocks.writeHostAsset(exec.output, i, host, asset);
+    }
+
     /// @notice Append an ALLOCATION block to execution output.
     /// @param exec Execution receiving the block.
     /// @param host Host identifier to encode.

package/guards/Revoke.sol

@@ -1,6 +1,8 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
+import {AllowanceHook} from "../commands/admin/Allowance.sol";
+import {DenyAssetsHook} from "../commands/admin/DenyAssets.sol";
 import {GuardBase} from "./Base.sol";
 import {Specs} from "../Codec.sol";
 import {Execution, Executions, Lanes} from "../execution/Execution.sol";
@@ -25,6 +27,47 @@ abstract contract Revoke is GuardBase {
             uint node = exec.unpackNode(Lanes.Input);
             setNode(node, false);
         }
+    }
+}
+
+/// @title RevokeAllowance
+/// @notice Guardian action that revokes host-scoped asset allowances.
+/// @dev Opt-in guard. Hosts expose it by inheriting this contract and implementing AllowanceHook.
+abstract contract RevokeAllowance is GuardBase, AllowanceHook {
+    uint private immutable descriptor;
+
+    constructor() {
+        (, descriptor) = guard("revokeAllowance", Specs.HostAsset);
+    }
+
+    /// @notice Revoke every HOST_ASSET allowance in `input` as the active guardian.
+    function revokeAllowance(bytes calldata input) external onlyGuardian {
+        Execution memory exec = openInput(input, descriptor, 0);
 
+        while (exec.more()) {
+            (uint peer, bytes32 asset) = exec.unpackHostAsset(Lanes.Input);
+            allowance(peer, asset, 0);
+        }
+    }
+}
+
+/// @title RevokeAsset
+/// @notice Guardian action that denies assets through the host's existing asset hook.
+/// @dev Opt-in guard. Hosts expose it by inheriting this contract and implementing DenyAssetsHook.
+abstract contract RevokeAsset is GuardBase, DenyAssetsHook {
+    uint private immutable descriptor;
+
+    constructor() {
+        (, descriptor) = guard("revokeAsset", Specs.Asset);
+    }
+
+    /// @notice Deny every ASSET block in `input` as the active guardian.
+    function revokeAsset(bytes calldata input) external onlyGuardian {
+        Execution memory exec = openInput(input, descriptor, 0);
+
+        while (exec.more()) {
+            bytes32 asset = exec.unpackAsset(Lanes.Input);
+            denyAsset(asset);
+        }
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rootzero/contracts",
-  "version": "1.16.0",
+  "version": "1.18.0",
   "description": "Solidity contracts and protocol building blocks for rootzero hosts and commands.",
   "private": false,
   "license": "GPL-3.0-only",