@rootzero/contracts 1.5.0 → 1.7.0

package/commands/admin/Base.sol

@@ -0,0 +1,9 @@
+// SPDX-License-Identifier: GPL-3.0-only
+pragma solidity ^0.8.33;
+
+import {CommandBase, CommandContext, Keys} from "../Base.sol";
+import {AdminEvent} from "../../events/Admin.sol";
+
+/// @title AdminBase
+/// @notice Shared base for admin commands.
+abstract contract AdminBase is CommandBase, AdminEvent {}

package/commands/admin/DenyAssets.sol

@@ -1,9 +1,8 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import { CommandBase, CommandContext, Keys } from "../Base.sol";
+import { AdminBase, CommandContext, Keys } from "./Base.sol";
 import { Cursors, Cur, Schemas } from "../../Cursors.sol";
-import { AdminEvent } from "../../events/Admin.sol";
 using Cursors for Cur;
 
 abstract contract DenyAssetsHook {
@@ -16,7 +15,7 @@ abstract contract DenyAssetsHook {
 /// @title DenyAssets
 /// @notice Admin command that blocks a list of assets via a virtual hook.
 /// Each ASSET block in the request calls `denyAsset`. Only callable by the admin account.
-abstract contract DenyAssets is CommandBase, AdminEvent, DenyAssetsHook {
+abstract contract DenyAssets is AdminBase, DenyAssetsHook {
     uint internal immutable denyAssetsId = commandId(this.denyAssets.selector);
 
     constructor() {

package/commands/admin/Destroy.sol

@@ -1,9 +1,8 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import { CommandBase, CommandContext, Keys } from "../Base.sol";
+import { AdminBase, CommandContext, Keys } from "./Base.sol";
 import { Cursors, Cur } from "../../Cursors.sol";
-import { AdminEvent } from "../../events/Admin.sol";
 
 using Cursors for Cur;
 
@@ -16,7 +15,7 @@ abstract contract DestroyHook {
 /// @title Destroy
 /// @notice Admin command that runs host teardown logic via a virtual hook.
 /// The full request is passed to `destroy` as a cursor. Only callable by the admin account.
-abstract contract Destroy is CommandBase, AdminEvent, DestroyHook {
+abstract contract Destroy is AdminBase, DestroyHook {
     uint internal immutable destroyId = commandId(this.destroy.selector);
 
     constructor(string memory input) {

package/commands/admin/Dismiss.sol

@@ -1,16 +1,15 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import { CommandBase, CommandContext, Keys } from "../Base.sol";
+import { AdminBase, CommandContext, Keys } from "./Base.sol";
 import { Cursors, Cur, Schemas } from "../../Cursors.sol";
-import { AdminEvent } from "../../events/Admin.sol";
 using Cursors for Cur;
 
 /// @title Dismiss
 /// @notice Admin command that revokes guardian status from a list of account IDs.
 /// Each ACCOUNT block in the request is disabled as a guardian on the host.
 /// Only callable by the admin account.
-abstract contract Dismiss is CommandBase, AdminEvent {
+abstract contract Dismiss is AdminBase {
     uint internal immutable dismissId = commandId(this.dismiss.selector);
 
     constructor() {

package/commands/admin/Execute.sol

@@ -1,10 +1,9 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import {CommandBase, CommandContext, Keys} from "../Base.sol";
+import {AdminBase, CommandContext, Keys} from "./Base.sol";
 import {Payable} from "../../core/Payable.sol";
 import {Cursors, Cur, Schemas} from "../../Cursors.sol";
-import {AdminEvent} from "../../events/Admin.sol";
 import {Budget} from "../../utils/Value.sol";
 import {Nodes} from "../../utils/Nodes.sol";
 
@@ -15,7 +14,7 @@ using Cursors for Cur;
 /// Each CALL block specifies a target node ID, chain resources, and raw calldata payload.
 /// Only callable by the admin account.
 /// Unspent top-level `msg.value` remains on this host.
-abstract contract ExecutePayable is CommandBase, Payable, AdminEvent {
+abstract contract ExecutePayable is AdminBase, Payable {
     uint internal immutable executePayableId = commandId(this.executePayable.selector);
 
     constructor() {
@@ -28,7 +27,7 @@ abstract contract ExecutePayable is CommandBase, Payable, AdminEvent {
     /// @return Empty output state.
     function executePayable(CommandContext calldata c) external payable onlyAdmin(c.account) returns (bytes memory) {
         (Cur memory request, , ) = Cursors.init(c.request, 1);
-        Budget memory budget = valueBudget();
+        Budget memory budget = openValue();
 
         while (request.i < request.len) {
             (uint target, uint resources, bytes calldata data) = request.unpackCall();

package/commands/admin/Init.sol

@@ -1,9 +1,8 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import { CommandBase, CommandContext, Keys } from "../Base.sol";
+import { AdminBase, CommandContext, Keys } from "./Base.sol";
 import { Cursors, Cur } from "../../Cursors.sol";
-import { AdminEvent } from "../../events/Admin.sol";
 
 using Cursors for Cur;
 
@@ -16,7 +15,7 @@ abstract contract InitHook {
 /// @title Init
 /// @notice Admin command that runs host initialization logic via a virtual hook.
 /// The full request is passed to `init` as a cursor. Only callable by the admin account.
-abstract contract Init is CommandBase, AdminEvent, InitHook {
+abstract contract Init is AdminBase, InitHook {
     uint internal immutable initId = commandId(this.init.selector);
 
     constructor(string memory input) {

package/commands/admin/Label.sol

@@ -1,16 +1,15 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import {CommandBase, CommandContext, Keys} from "../Base.sol";
+import {AdminBase, CommandContext, Keys} from "./Base.sol";
 import {Cursors, Cur, Schemas} from "../../Cursors.sol";
-import {AdminEvent} from "../../events/Admin.sol";
 using Cursors for Cur;
 
 /// @title Label
 /// @notice Admin command that publishes namespaced labels for node IDs.
 /// Each LABEL block in the request emits one `Labeled` event. Only callable by
 /// the admin account.
-abstract contract Label is CommandBase, AdminEvent {
+abstract contract Label is AdminBase {
     uint internal immutable labelId = commandId(this.label.selector);
 
     constructor() {

package/commands/admin/Unauthorize.sol

@@ -1,16 +1,15 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import { CommandBase, CommandContext, Keys } from "../Base.sol";
+import { AdminBase, CommandContext, Keys } from "./Base.sol";
 import { Cursors, Cur, Schemas } from "../../Cursors.sol";
-import { AdminEvent } from "../../events/Admin.sol";
 using Cursors for Cur;
 
 /// @title Unauthorize
 /// @notice Admin command that revokes authorization from a list of node IDs.
 /// Each NODE block in the request is deauthorized on the host.
 /// Only callable by the admin account.
-abstract contract Unauthorize is CommandBase, AdminEvent {
+abstract contract Unauthorize is AdminBase {
     uint internal immutable unauthorizeId = commandId(this.unauthorize.selector);
 
     constructor() {

package/core/Commitments.sol

@@ -0,0 +1,19 @@
+// SPDX-License-Identifier: GPL-3.0-only
+pragma solidity ^0.8.33;
+
+import {CommitmentEvent} from "../events/Commitment.sol";
+
+/// @title Commitments
+/// @notice On-chain registry for digest commitments.
+abstract contract Commitments is CommitmentEvent {
+    /// @dev key -> committed digest.
+    mapping(bytes32 key => bytes32 digest) internal commitments;
+
+    /// @notice Clear the commitment under `key` and return the removed digest.
+    /// @param key Commitment lookup key.
+    /// @return digest Removed digest.
+    function uncommit(bytes32 key) internal returns (bytes32 digest) {
+        digest = commitments[key];
+        delete commitments[key];
+    }
+}

package/core/Escrows.sol

@@ -0,0 +1,34 @@
+// SPDX-License-Identifier: GPL-3.0-only
+pragma solidity ^0.8.33;
+
+/// @dev Thrown when a debit would reduce an escrow below zero.
+error InsufficientEscrow();
+
+/// @title Escrows
+/// @notice On-chain ledger for amounts reserved outside normal spendable balances.
+abstract contract Escrows {
+    /// @dev key -> escrowed amount.
+    mapping(bytes32 key => uint amount) internal escrows;
+
+    /// @notice Add `amount` to an escrow and return the new balance.
+    /// @param key Escrow key derived by the caller.
+    /// @param amount Amount to reserve.
+    /// @return balance New escrow balance after the credit.
+    function creditEscrow(bytes32 key, uint amount) internal returns (uint balance) {
+        balance = escrows[key] += amount;
+    }
+
+    /// @notice Deduct `amount` from an escrow and return the new balance.
+    /// Reverts with `InsufficientEscrow` if the current balance is less than `amount`.
+    /// @param key Escrow key derived by the caller.
+    /// @param amount Amount to release.
+    /// @return balance New escrow balance after the debit.
+    function debitEscrow(bytes32 key, uint amount) internal returns (uint balance) {
+        balance = escrows[key];
+        if (balance < amount) revert InsufficientEscrow();
+        unchecked {
+            balance -= amount;
+        }
+        escrows[key] = balance;
+    }
+}

package/core/Payable.sol

@@ -5,16 +5,14 @@ import {Budget, Values} from "../utils/Value.sol";
 
 /// @title Payable
 /// @notice Abstract mixin for entrypoints that accept native value (`msg.value`).
-/// Provides a shared settlement hook for any unspent value remaining in the
-/// mutable budget after execution completes.
+/// Provides shared helpers for mutable native-value budgets.
 abstract contract Payable {
     /// @dev Thrown when a payable entrypoint completes with unspent native value.
-    /// Override `settleValue` to implement refund or forwarding behavior instead.
     error UnusedValue(uint remaining);
 
-    /// @notice Create a native-value budget from the current call's `msg.value`.
-    /// @return Budget initialised with the full `msg.value`.
-    function valueBudget() internal view returns (Budget memory) {
+    /// @notice Open a native-value budget from the current call's `msg.value`.
+    /// @return Budget initialized with the full `msg.value`.
+    function openValue() internal view returns (Budget memory) {
         return Budget({remaining: msg.value});
     }
 
@@ -24,36 +22,25 @@ abstract contract Payable {
     /// @param resources Packed chain resources.
     /// @return value Native value to forward in wei.
     function useValue(Budget memory budget, uint resources) internal pure returns (uint128 value) {
-        return Values.use(budget, uint128(resources));
+        value = uint128(resources);
+        Values.use(budget, value);
     }
 
-    /// @notice Deduct the EVM value lane from a packed resource word as a new sub-budget.
-    /// @dev EVM resources use the low 128 bits as native value/endowment.
-    /// @param budget Mutable parent budget to deduct from.
-    /// @param resources Packed chain resources.
-    /// @return A new budget with the EVM value lane remaining.
-    function allocateValue(Budget memory budget, uint resources) internal pure returns (Budget memory) {
-        return Values.allocate(budget, uint128(resources));
-    }
-
-    /// @notice Drains the budget and settles any remaining native value.
-    /// @dev Calls the amount-based `settleValue` hook only when some value remains.
+    /// @notice Close a native-value budget and settle any drained value.
     /// @param account Account identifier for the current invocation.
-    /// @param budget Mutable native-value budget used during execution.
-    function settleValue(bytes32 account, Budget memory budget) internal {
-        uint value = budget.remaining;
+    /// @param budget Mutable native-value budget to close.
+    function closeValue(bytes32 account, Budget memory budget) internal {
+        uint value = Values.drain(budget);
         if (value == 0) return;
-        budget.remaining = 0;
         settleValue(account, value);
     }
 
-    /// @notice Handles leftover native value after payable execution has finished.
-    /// @dev Override this hook to refund or redirect unused value.
-    /// The default implementation rejects any leftover amount.
+    /// @notice Handle a drained native value amount.
+    /// @dev Override to refund or redirect unused value. The default rejects it.
     /// @param account Account identifier for the current invocation.
-    /// @param remaining Unspent native value left in the budget, in wei.
-    function settleValue(bytes32 account, uint remaining) internal virtual {
+    /// @param value Drained native value amount to settle, in wei.
+    function settleValue(bytes32 account, uint value) internal virtual {
         account;
-        revert UnusedValue(remaining);
+        revert UnusedValue(value);
     }
 }

package/core/Pipeline.sol

@@ -32,6 +32,7 @@ abstract contract Pipeline is Payable {
 
     /// @notice Execute a STEP block stream through the pipeline.
     /// @dev Reverts with `UnexpectedState` if the final threaded state is non-empty.
+    /// Callers remain responsible for settling any unspent value in `budget`.
     /// @param account Account identifier used for each dispatched step.
     /// @param state Initial state block stream passed to the first step.
     /// @param steps STEP block stream to execute.
@@ -50,7 +51,6 @@ abstract contract Pipeline is Payable {
         }
 
         if (state.length != 0) revert UnexpectedState();
-        settleValue(account, budget);
         input.complete();
     }
 }

package/core/Runtime.sol

@@ -4,11 +4,16 @@ pragma solidity ^0.8.33;
 import {Assets} from "../utils/Assets.sol";
 import {Nodes} from "../utils/Nodes.sol";
 
+/// @title NativeAsset
+/// @notice Shared native asset identity for host helpers.
+abstract contract NativeAsset {
+    /// @dev Asset ID for the native chain coin/token, bound to the current chain at deployment.
+    bytes32 internal immutable nativeAsset = Assets.toNative();
+}
+
 /// @title Runtime
 /// @notice Shared runtime for host identity and native asset identity.
-abstract contract Runtime {
+abstract contract Runtime is NativeAsset {
     /// @dev This contract's host node ID, set to `Nodes.toHost(address(this))` at construction.
     uint public immutable host = Nodes.toHost(address(this));
-    /// @dev Asset ID for the native chain coin/token, bound to the current chain at deployment.
-    bytes32 internal immutable nativeAsset = Assets.toNative();
 }

package/docs/Schema.md

@@ -58,7 +58,6 @@ Once a child block appears, no more fixed fields may follow.
 ```txt
 #call { uint target, uint resources, #bytes as payload }
 #context { bytes32 account, #bytes as state, #bytes as request }
-#pipe { uint resources, #context { bytes32 account, #bytes as state, #bytes as steps } }
 ```
 
 The tail is embedded directly as child block bytes. There is no wrapper around a
@@ -118,6 +117,18 @@ maybe #account { bytes32 account } as recipient
 
 Aliases may be used on any block item, including child blocks and prime items.
 
+A child block without an inline body may also be used as a schema reference:
+
+```txt
+#contextRecovery { uint port, bytes32 key, uint resources, #context as witness }
+```
+
+Alias resolution is context-dependent. A consumer may resolve `#context` from the
+standard `Schemas` table, from app-specific schemas, or from another active
+schema context. Consumers should reject schemas with unresolved aliases. The
+runtime encoding is still an embedded child block with the referenced key and
+layout.
+
 ## Field Paths
 
 Field names and aliases may use dotted paths for offchain projection. A dotted
@@ -271,7 +282,7 @@ Common protocol schemas live in `contracts/blocks/Schema.sol`:
 #call { uint target, uint resources, #bytes as payload }
 #step { uint target, uint resources, #bytes as request }
 #context { bytes32 account, #bytes as state, #bytes as request }
-#pipe { uint resources, #context { bytes32 account, #bytes as state, #bytes as steps } }
+#contextRecovery { uint port, bytes32 key, uint resources, #context as witness }
 #auth { uint cid, uint deadline, #bytes as proof }
 ```
 

package/events/Commitment.sol

@@ -0,0 +1,19 @@
+// SPDX-License-Identifier: GPL-3.0-only
+pragma solidity ^0.8.33;
+
+import { EventEmitter } from "./Emitter.sol";
+
+/// @notice Emitted when a host-scoped commitment is updated.
+abstract contract CommitmentEvent is EventEmitter {
+    string private constant ABI = "event Commitment(uint indexed host, bytes32 key, bytes32 digest, uint status)";
+
+    /// @param host Host node ID that manages the commitment.
+    /// @param key Commitment lookup key.
+    /// @param digest Committed digest. Zero may be used when clearing without revealing the previous digest.
+    /// @param status Commitment status. Zero means cleared; nonzero means committed or application-defined.
+    event Commitment(uint indexed host, bytes32 key, bytes32 digest, uint status);
+
+    constructor() {
+        emit EventAbi(ABI);
+    }
+}

package/events/Dispatch.sol

@@ -0,0 +1,20 @@
+// SPDX-License-Identifier: GPL-3.0-only
+pragma solidity ^0.8.33;
+
+import {EventEmitter} from "./Emitter.sol";
+
+/// @notice Emitted when a host records an outbound dispatch reference.
+abstract contract DispatchEvent is EventEmitter {
+    string private constant ABI = "event Dispatch(uint indexed host, uint chain, uint resources, bytes32 digest, bytes32 ref)";
+
+    /// @param host Host node ID that owns the dispatch.
+    /// @param chain Destination chain/domain node ID.
+    /// @param resources Chain-adapter-specific resources assigned to the dispatch.
+    /// @param digest Digest of the dispatched payload or canonical envelope.
+    /// @param ref Dispatch correlation or recovery reference.
+    event Dispatch(uint indexed host, uint chain, uint resources, bytes32 digest, bytes32 ref);
+
+    constructor() {
+        emit EventAbi(ABI);
+    }
+}

package/events/Port.sol

@@ -0,0 +1,22 @@
+// SPDX-License-Identifier: GPL-3.0-only
+pragma solidity ^0.8.33;
+
+import {EventEmitter} from "./Emitter.sol";
+
+/// @notice Emitted by hosts to advertise callable peer-facing ports.
+abstract contract PortEvent is EventEmitter {
+    string private constant ABI =
+        "event Port(uint indexed host, uint id, bytes32 shape, string request, string response, bool funded)";
+
+    /// @param host Host node ID that exposes the port.
+    /// @param id Port node ID.
+    /// @param shape Block shape/version descriptor.
+    /// @param request Human-readable request schema.
+    /// @param response Human-readable response schema.
+    /// @param funded True if the port accepts native value.
+    event Port(uint indexed host, uint id, bytes32 shape, string request, string response, bool funded);
+
+    constructor() {
+        emit EventAbi(ABI);
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rootzero/contracts",
-  "version": "1.5.0",
+  "version": "1.7.0",
   "description": "Solidity contracts and protocol building blocks for rootzero hosts and commands.",
   "private": false,
   "license": "GPL-3.0-only",

package/ports/AllowAssets.sol

@@ -0,0 +1,44 @@
+// SPDX-License-Identifier: GPL-3.0-only
+pragma solidity ^0.8.33;
+
+import { PortBase } from "./Base.sol";
+import { AllowAssetsHook } from "../commands/admin/AllowAssets.sol";
+import { Cursors, Cur, Schemas } from "../Cursors.sol";
+
+using Cursors for Cur;
+
+interface IPortAllowAssets {
+    function portAllowAssets(bytes calldata data) external returns (bytes memory);
+}
+
+/// @title PortAllowAssets
+/// @notice Port that permits a list of assets on behalf of a peer host.
+/// Each ASSET block in the request calls `allowAsset`. Restricted to trusted peers.
+abstract contract PortAllowAssets is PortBase, AllowAssetsHook, IPortAllowAssets {
+    uint internal immutable portAllowAssetsId = portId(this.portAllowAssets.selector);
+
+    constructor() {
+        emit Port(host, portAllowAssetsId, "1:0", Schemas.Asset, "", false);
+        emit Labeled(portAllowAssetsId, bytes32(0), "portAllowAssets");
+    }
+
+    /// @notice Execute the allow-assets peer call.
+    /// @param data ASSET block stream supplied by the trusted peer.
+    /// @return Empty response bytes.
+    function portAllowAssets(bytes calldata data) external onlyPeer returns (bytes memory) {
+        (Cur memory assets, , ) = Cursors.init(data, 1);
+
+        while (assets.i < assets.len) {
+            bytes32 asset = assets.unpackAsset();
+            allowAsset(asset);
+        }
+
+        assets.complete();
+        return "";
+    }
+}
+
+
+
+
+

package/ports/Allowance.sol

@@ -0,0 +1,41 @@
+// SPDX-License-Identifier: GPL-3.0-only
+pragma solidity ^0.8.33;
+
+import {PortBase} from "./Base.sol";
+import {AllowanceHook} from "../commands/admin/Allowance.sol";
+import {Cursors, Cur, Schemas} from "../Cursors.sol";
+
+using Cursors for Cur;
+
+interface IPortAllowance {
+    function portAllowance(bytes calldata data) external returns (bytes memory);
+}
+
+/// @title PortAllowance
+/// @notice Port that lets a trusted peer host request or refresh its own allowance.
+/// Each AMOUNT block in the request is scoped to the peer host and passed to the
+/// shared allowance hook as a host-scoped allowance. Restricted to trusted peers.
+abstract contract PortAllowance is PortBase, AllowanceHook, IPortAllowance {
+    uint internal immutable portAllowanceId = portId(this.portAllowance.selector);
+
+    constructor() {
+        emit Port(host, portAllowanceId, "1:0", Schemas.Amount, "", false);
+        emit Labeled(portAllowanceId, bytes32(0), "portAllowance");
+    }
+
+    /// @notice Execute the allowance port call.
+    /// @param data AMOUNT block stream requested by the trusted peer.
+    /// @return Empty response bytes.
+    function portAllowance(bytes calldata data) external onlyPeer returns (bytes memory) {
+        (Cur memory amounts, , ) = Cursors.init(data, 1);
+        uint peer = caller();
+
+        while (amounts.i < amounts.len) {
+            (bytes32 asset, uint amount) = amounts.unpackAmount();
+            allowance(peer, asset, amount);
+        }
+
+        amounts.complete();
+        return "";
+    }
+}

package/ports/Base.sol

@@ -0,0 +1,41 @@
+// SPDX-License-Identifier: GPL-3.0-only
+pragma solidity ^0.8.33;
+
+import { NodeCalls } from "../core/Calls.sol";
+import { PortEvent } from "../events/Port.sol";
+import { LabeledEvent } from "../events/Labeled.sol";
+import { Nodes } from "../utils/Nodes.sol";
+
+/// @notice ABI-encode a port call from a target port ID and data block stream.
+/// @dev Derives the function selector from `target` via `Nodes.portSelector(target)`.
+/// Reverts if `target` is not a valid port ID.
+/// @param target Destination port node ID embedding the target selector.
+/// @param data Input block stream for the port invocation.
+/// @return ABI-encoded calldata for the port entry point.
+function encodePortCall(uint target, bytes calldata data) pure returns (bytes memory) {
+    bytes4 selector = Nodes.portSelector(target);
+    return abi.encodeWithSelector(selector, data);
+}
+
+/// @title PortBase
+/// @notice Abstract base for peer-facing rootzero ports.
+/// Ports handle inter-host operations between cooperating hosts.
+/// Access is restricted to trusted peer callers via `onlyPeer`.
+abstract contract PortBase is NodeCalls, PortEvent, LabeledEvent {
+    /// @dev Thrown when the commander attempts to call a port entrypoint directly.
+    error CommanderNotAllowed();
+
+    /// @dev Restrict execution to trusted callers, excluding the commander.
+    modifier onlyPeer() {
+        if (msg.sender == commander) revert CommanderNotAllowed();
+        enforceCaller(msg.sender);
+        _;
+    }
+
+    /// @notice Derive the deterministic node ID for a port selector on this contract.
+    /// @param selector Port entrypoint selector.
+    /// @return Port node ID.
+    function portId(bytes4 selector) internal view returns (uint) {
+        return Nodes.toPort(selector, address(this));
+    }
+}

package/ports/Credit.sol

@@ -0,0 +1,39 @@
+// SPDX-License-Identifier: GPL-3.0-only
+pragma solidity ^0.8.33;
+
+import { PortBase } from "./Base.sol";
+import { CreditAccountHook } from "../commands/Credit.sol";
+import { Cursors, Cur, Forms } from "../Cursors.sol";
+
+using Cursors for Cur;
+
+interface IPortCreditAccount {
+    function portCreditAccount(bytes calldata data) external returns (bytes memory);
+}
+
+/// @title PortCreditAccount
+/// @notice Port that lets a trusted peer credit supplied accounts directly.
+/// Each ACCOUNT_AMOUNT block calls `creditAccount` for its account.
+abstract contract PortCreditAccount is PortBase, CreditAccountHook, IPortCreditAccount {
+    uint internal immutable portCreditAccountId = portId(this.portCreditAccount.selector);
+
+    constructor() {
+        emit Port(host, portCreditAccountId, "1:0", Forms.AccountAmount, "", false);
+        emit Labeled(portCreditAccountId, bytes32(0), "portCreditAccount");
+    }
+
+    /// @notice Execute the port-credit call.
+    /// @param data ACCOUNT_AMOUNT block stream supplied by the trusted peer.
+    /// @return Empty response bytes.
+    function portCreditAccount(bytes calldata data) external onlyPeer returns (bytes memory) {
+        (Cur memory amounts, , ) = Cursors.init(data, 1);
+
+        while (amounts.i < amounts.len) {
+            (bytes32 account, bytes32 asset, uint amount) = amounts.unpackAccountAmount();
+            creditAccount(account, asset, amount);
+        }
+
+        amounts.complete();
+        return "";
+    }
+}

package/ports/Debit.sol

@@ -0,0 +1,39 @@
+// SPDX-License-Identifier: GPL-3.0-only
+pragma solidity ^0.8.33;
+
+import { PortBase } from "./Base.sol";
+import { DebitAccountHook } from "../commands/Debit.sol";
+import { Cursors, Cur, Forms } from "../Cursors.sol";
+
+using Cursors for Cur;
+
+interface IPortDebitAccount {
+    function portDebitAccount(bytes calldata data) external returns (bytes memory);
+}
+
+/// @title PortDebitAccount
+/// @notice Port that lets a trusted peer debit supplied accounts directly.
+/// Each ACCOUNT_AMOUNT block calls `debitAccount` for its account.
+abstract contract PortDebitAccount is PortBase, DebitAccountHook, IPortDebitAccount {
+    uint internal immutable portDebitAccountId = portId(this.portDebitAccount.selector);
+
+    constructor() {
+        emit Port(host, portDebitAccountId, "1:0", Forms.AccountAmount, "", false);
+        emit Labeled(portDebitAccountId, bytes32(0), "portDebitAccount");
+    }
+
+    /// @notice Execute the port-debit call.
+    /// @param data ACCOUNT_AMOUNT block stream supplied by the trusted peer.
+    /// @return Empty response bytes.
+    function portDebitAccount(bytes calldata data) external onlyPeer returns (bytes memory) {
+        (Cur memory amounts, , ) = Cursors.init(data, 1);
+
+        while (amounts.i < amounts.len) {
+            (bytes32 account, bytes32 asset, uint amount) = amounts.unpackAccountAmount();
+            debitAccount(account, asset, amount);
+        }
+
+        amounts.complete();
+        return "";
+    }
+}