@rootzero/contracts 1.9.0 → 1.11.0

package/blocks/Schema.sol

@@ -7,31 +7,36 @@ pragma solidity ^0.8.33;
 // - payload layout is block-specific
 //
 // Schema:
-// - blocks are written as `#name { fields }`
-// - a block without braces has no payload, e.g. `#unit`
+// - block aliases are published separately from payload schemas
+// - payload schemas are written as `{ fields }`
+// - an empty schema string means the block has no structured payload
 // - commas separate siblings at every level
-// - braces define parent-child boundaries
+// - braces define the current block payload body
 // - command requests are a single run when the request schema is non-empty
 // - command state is a single active state run without trailing globals
 // - run items may repeat at top level for batching
-// - `maybe #x { ... }` marks an optional block item
-// - `many #x { ... }` emits one generic list block containing repeated `#x` items
+// - `maybe #x` marks an optional block item
+// - `many #x` emits one generic list block containing repeated `#x` items
+// - endpoint descriptor lanes are `[key bytes4][item bytes4]`; normal keys widen to `[key][0]`
+// - descriptor lanes for `many #x` use `[Keys.List][keyOfX]`; bare `[Keys.List][0]`
+//   is incomplete discovery metadata and should be rejected by tooling
 // - `portal` fields are routing identifiers, often destination host IDs
 // - `resources` fields are chain-specific resource words. A portal adapter
 //   interprets them for the destination runtime. EVM resources use the low
 //   128 bits as native value.
 // - dotted field names and aliases, e.g. `dst.portal` or `#bytes as dst.payload`,
 //   are offchain projection metadata only and do not change runtime encoding
-// - a child block without an inline body, e.g. `#context as witness`, may resolve
-//   to a known schema in the active schema context; unresolved aliases are invalid
+// - child blocks resolve by alias in the active schema context; unresolved aliases are invalid
+// - schema strings describe the payload body only; the `Block` event carries the alias
 // - fixed fields are packed in declaration order
 // - blocks have fixed fields followed by a dynamic child-block tail
 // - child block tails are embedded directly, without an extra stream wrapper
 // - `#bytes` is a reserved child block that stores raw bytes and has no body
 // - `#string` is a reserved child block that stores UTF-8 string bytes and has no body
-// - generic `#data` uses the stable key derived from `#data`
 // - generic lists use the stable key derived from `#list`
-// - keys are derived from block names, e.g. bytes4(keccak256("#amount"))
+// - standard keys are derived from block aliases, e.g. bytes4(keccak256("#amount"))
+// - custom keys are opaque bytes4 tags and only need to be unique in their
+//   active context; use `Schema(host, key, schema, name)` to publish their meaning
 // - see `docs/Schema.md` for the full working spec
 //
 // Pipeline state:
@@ -57,48 +62,48 @@ pragma solidity ^0.8.33;
 /// @title Schemas
 /// @notice Human-readable schema string constants for each block type.
 /// These strings describe payload layout for discovery events and docs; block
-/// keys are derived only from block names.
+/// aliases map to standard keys by convention. Custom blocks may use any unique
+/// bytes4 key in their active context.
 library Schemas {
-    string constant Unit = "#unit";
-    string constant Node = "#node { uint id }";
-    string constant Account = "#account { bytes32 account }";
-    string constant Asset = "#asset { bytes32 asset }";
-    string constant Amount = "#amount { bytes32 asset, uint amount }";
-    string constant Balance = "#balance { bytes32 asset, uint amount }";
-    string constant BalanceLimit = "#balanceLimit { bytes32 asset, uint min, uint max }";
-    string constant Custody = "#custody { uint host, bytes32 asset, uint amount }";
-    string constant CustodyLimit = "#custodyLimit { uint host, bytes32 asset, uint min, uint max }";
-    string constant Allocation = "#allocation { uint host, bytes32 asset, uint amount }";
-    string constant Allowance = "#allowance { uint host, bytes32 asset, uint amount }";
-    string constant Transaction = "#transaction { bytes32 from, bytes32 to, bytes32 asset, uint amount }";
-    string constant Context = "#context { bytes32 account, #bytes as state, #bytes as request }";
-    string constant Recover = "#recover { uint handler, uint resources, bytes32 key, #bytes as witness }";
-    string constant Call = "#call { uint target, uint resources, #bytes as payload }";
-    string constant Step = "#step { uint target, uint resources, #bytes as request }";
-    string constant Relay = "#relay { uint portal, uint resources, #bytes as request }";
-    string constant Dispatch = "#dispatch { uint portal, uint resources, #bytes as payload }";
-    string constant Bounty = "#bounty { uint amount, bytes32 relayer }";
-    string constant Fee = "#fee { uint amount }";
-    string constant Auth = "#auth { uint cid, uint deadline, #bytes as proof }";
-    string constant Label = "#label { uint id, bytes32 namespace, #string as name }";
-    string constant Bytes = "#bytes";
-    string constant String = "#string";
-    string constant Data = "#data";
-    string constant List = "#list";
-    string constant Evm = "#evm";
+    string constant Unit = "";
+    string constant Node = "{ uint id }";
+    string constant Account = "{ bytes32 account }";
+    string constant Asset = "{ bytes32 asset }";
+    string constant Amount = "{ bytes32 asset, uint amount }";
+    string constant Balance = "{ bytes32 asset, uint amount }";
+    string constant BalanceLimit = "{ bytes32 asset, uint min, uint max }";
+    string constant Custody = "{ uint host, bytes32 asset, uint amount }";
+    string constant CustodyLimit = "{ uint host, bytes32 asset, uint min, uint max }";
+    string constant Allocation = "{ uint host, bytes32 asset, uint amount }";
+    string constant Allowance = "{ uint host, bytes32 asset, uint amount }";
+    string constant Transaction = "{ bytes32 from, bytes32 to, bytes32 asset, uint amount }";
+    string constant Context = "{ bytes32 account, #bytes as state, #bytes as request }";
+    string constant Recover = "{ uint handler, uint resources, bytes32 key, #bytes as witness }";
+    string constant Call = "{ uint target, uint resources, #bytes as payload }";
+    string constant Step = "{ uint target, uint resources, #bytes as request }";
+    string constant Relay = "{ uint portal, uint resources, #bytes as request }";
+    string constant Dispatch = "{ uint portal, uint resources, #bytes as payload }";
+    string constant Bounty = "{ uint amount, bytes32 relayer }";
+    string constant Fee = "{ uint amount }";
+    string constant Auth = "{ uint cid, uint deadline, #bytes as proof }";
+    string constant Label = "{ uint id, bytes32 namespace, #string as name }";
+    string constant Bytes = "";
+    string constant String = "";
+    string constant List = "";
+    string constant Evm = "";
 }
 
 /// @title Forms
 /// @notice Reusable structural block schemas for core tuple shapes.
 /// These describe payload form without assigning command or query semantics.
 library Forms {
-    string constant Status = "#status { uint code }";
-    string constant AssetAmount = "#assetAmount { bytes32 asset, uint amount }";
-    string constant AccountAsset = "#accountAsset { bytes32 account, bytes32 asset }";
-    string constant AccountAmount = "#accountAmount { bytes32 account, bytes32 asset, uint amount }";
-    string constant HostAmount = "#hostAmount { uint host, bytes32 asset, uint amount }";
-    string constant HostAccountAsset = "#hostAccountAsset { uint host, bytes32 account, bytes32 asset }";
-    string constant HostAccountAmount = "#hostAccountAmount { uint host, bytes32 account, bytes32 asset, uint amount }";
+    string constant Status = "{ uint code }";
+    string constant AssetAmount = "{ bytes32 asset, uint amount }";
+    string constant AccountAsset = "{ bytes32 account, bytes32 asset }";
+    string constant AccountAmount = "{ bytes32 account, bytes32 asset, uint amount }";
+    string constant HostAmount = "{ uint host, bytes32 asset, uint amount }";
+    string constant HostAccountAsset = "{ uint host, bytes32 account, bytes32 asset }";
+    string constant HostAccountAmount = "{ uint host, bytes32 account, bytes32 asset, uint amount }";
 }
 
 /// @title Sizes

package/commands/Base.sol

@@ -2,10 +2,11 @@
 pragma solidity ^0.8.33;
 
 import {NodeCalls} from "../core/Calls.sol";
-import {CommandEvent} from "../events/Command.sol";
-import {LabeledEvent} from "../events/Labeled.sol";
+import {EndpointBase, Lane} from "../core/Endpoint.sol";
+import {Cur} from "../Cursors.sol";
 import {Keys} from "../blocks/Keys.sol";
 import {Nodes} from "../utils/Nodes.sol";
+import {Selectors} from "../utils/Selectors.sol";
 
 /// @notice Execution context passed to every command invocation.
 struct CommandContext {
@@ -14,14 +15,13 @@ struct CommandContext {
     /// @dev Current state block stream (previous command output or initial state).
     bytes state;
     /// @dev Input block stream for this invocation.
-    bytes request;
+    bytes input;
 }
 
 /// @title CommandBase
 /// @notice Abstract base for all rootzero command contracts.
-/// Provides access control modifiers, event emission, and the `commandId`
-/// helper used to derive stable identifiers for command selectors.
-abstract contract CommandBase is NodeCalls, CommandEvent, LabeledEvent {
+/// Provides access control modifiers and command endpoint metadata helpers.
+abstract contract CommandBase is NodeCalls, EndpointBase {
     /// @dev Thrown when `onlyActive` finds that `deadline` has already passed.
     error Expired();
 
@@ -45,12 +45,42 @@ abstract contract CommandBase is NodeCalls, CommandEvent, LabeledEvent {
         _;
     }
 
-    /// @notice Derive the deterministic node ID for a command selector on this contract.
-    /// The ID encodes the ABI selector and `address(this)`, making it unique
-    /// per (function selector, contract address) pair.
-    /// @param selector Command entrypoint selector.
-    /// @return Command node ID.
-    function commandId(bytes4 selector) internal view returns (uint) {
-        return Nodes.toCommand(selector, address(this));
+    /// @notice Publish command metadata and a default label.
+    /// @param name Default human-readable command label and selector name.
+    /// @param state Packed state lane plus optional group byte.
+    /// @param input Packed input lane plus optional group byte.
+    /// @param output Packed output lane plus optional group byte.
+    /// @param selector Command ABI selector, or zero to derive it from `name`.
+    /// @param funded Whether the command accepts nonzero native value.
+    /// @param admin Whether the command is restricted to the admin account.
+    /// @return id Command node ID.
+    /// @return descriptor Packed endpoint lane metadata and flags.
+    function command(
+        string memory name,
+        bytes9 state,
+        bytes9 input,
+        bytes9 output,
+        bytes4 selector,
+        bool funded,
+        bool admin
+    ) internal returns (uint id, bytes32 descriptor) {
+        selector = selector == bytes4(0) ? Selectors.command(name) : selector;
+        id = Nodes.toCommand(selector, address(this));
+        descriptor = endpoint(id, name, state, input, output, funded, admin);
+    }
+
+    /// @notice Open input/state cursors and return the expected output block count.
+    /// @param c Command invocation context.
+    /// @param descriptor Packed command endpoint descriptor.
+    /// @return input Cursor scoped to the command input lane.
+    /// @return state Cursor scoped to the command state lane.
+    /// @return outputs Number of output blocks implied by the matched group count.
+    function openCommand(
+        CommandContext calldata c,
+        bytes32 descriptor
+    ) internal pure returns (Cur memory input, Cur memory state, uint outputs) {
+        uint groups;
+        (input, groups, ) = openLane(c.input, descriptor, Lane.Input, 0);
+        (state, , outputs) = openLane(c.state, descriptor, Lane.State, groups);
     }
 }

package/commands/Burn.sol

@@ -19,25 +19,22 @@ abstract contract BurnHook {
 /// @notice Command that irreversibly destroys each BALANCE state block via a virtual hook.
 /// Produces no output state.
 abstract contract Burn is CommandBase, BurnHook {
-    uint internal immutable burnId = commandId(this.burn.selector);
+    bytes32 private immutable descriptor;
 
     constructor() {
-        emit Command(host, burnId, "0:1:0", "", Keys.Balance, Keys.Empty, false);
-        emit Labeled(burnId, bytes32(0), "burn");
+        (, descriptor) = command("burn", Keys.Balance, Keys.Empty, Keys.Empty, 0, false, false);
     }
 
     /// @notice Burn each BALANCE block from the command state.
     /// @param c Command context; `c.state` must contain BALANCE blocks.
     /// @return Empty output state.
     function burn(CommandContext calldata c) external onlyCommand returns (bytes memory) {
-        (Cur memory state, , ) = Cursors.init(c.state, 1);
+        (Cur memory state, ) = openState(c.state, descriptor);
 
         while (state.i < state.len) {
             (bytes32 asset, uint amount) = state.unpackBalance();
             burn(c.account, asset, amount);
         }
-
-        state.complete();
         return "";
     }
 }

package/commands/Credit.sol

@@ -19,11 +19,16 @@ abstract contract CreditAccountHook {
 /// @notice Command that delivers BALANCE state blocks to an account via a virtual hook.
 /// Use for internally recording credits that have already been settled externally.
 abstract contract CreditAccount is CommandBase, CreditAccountHook {
-    uint internal immutable creditAccountId = commandId(this.creditAccount.selector);
+    bytes32 private immutable descriptor;
+    uint private immutable id;
 
     constructor() {
-        emit Command(host, creditAccountId, "0:1:0", "", Keys.Balance, Keys.Empty, false);
-        emit Labeled(creditAccountId, bytes32(0), "creditAccount");
+        (id, descriptor) = command("creditAccount", Keys.Balance, Keys.Empty, Keys.Empty, 0, false, false);
+    }
+
+    /// @notice Return true if `candidate` is this command's credit account ID.
+    function isCreditAccount(uint candidate) internal view returns (bool) {
+        return candidate == id;
     }
 
     /// @notice Credit each BALANCE block from the command state to the command account.
@@ -32,14 +37,12 @@ abstract contract CreditAccount is CommandBase, CreditAccountHook {
     function creditAccount(
         CommandContext calldata c
     ) external onlyCommand returns (bytes memory) {
-        (Cur memory state, , ) = Cursors.init(c.state, 1);
+        (Cur memory state, ) = openState(c.state, descriptor);
 
         while (state.i < state.len) {
             (bytes32 asset, uint amount) = state.unpackBalance();
             creditAccount(c.account, asset, amount);
         }
-
-        state.complete();
         return "";
     }
 }

package/commands/Debit.sol

@@ -2,7 +2,7 @@
 pragma solidity ^0.8.33;
 
 import { CommandContext, CommandBase, Keys } from "./Base.sol";
-import { Cursors, Cur, Schemas, Writer, Writers } from "../Cursors.sol";
+import { Cursors, Cur, Writer, Writers } from "../Cursors.sol";
 
 using Cursors for Cur;
 using Writers for Writer;
@@ -21,37 +21,41 @@ abstract contract DebitAccountHook {
 /// Use for internally recording debits. The virtual `debitAccount` hook is called once per
 /// AMOUNT block; the default batch implementation handles the full request loop.
 abstract contract DebitAccount is CommandBase, DebitAccountHook {
-    uint internal immutable debitAccountId = commandId(this.debitAccount.selector);
+    bytes32 private immutable descriptor;
+    uint private immutable id;
 
     constructor() {
-        emit Command(host, debitAccountId, "1:0:1", Schemas.Amount, Keys.Empty, Keys.Balance, false);
-        emit Labeled(debitAccountId, bytes32(0), "debitAccount");
+        (id, descriptor) = command("debitAccount", Keys.Empty, Keys.Amount, Keys.Balance, 0, false, false);
+    }
+
+    /// @notice Return true if `candidate` is this command's debit account ID.
+    function isDebitAccount(uint candidate) internal view returns (bool) {
+        return candidate == id;
     }
 
     /// @notice Override to customize request parsing or batching for debits.
     /// The default implementation iterates AMOUNT blocks, calls
     /// `debitAccount`, and emits matching BALANCE blocks.
     function debitAccount(bytes32 account, bytes calldata request) internal virtual returns (bytes memory) {
-        (Cur memory input, uint groups, ) = Cursors.init(request, 1);
-        Writer memory writer = Writers.allocBalances(groups);
+        (Cur memory input, uint outputs) = openInput(request, descriptor);
+        Writer memory output = Writers.allocBalances(outputs);
 
         while (input.i < input.len) {
             (bytes32 asset, uint amount) = input.unpackAmount();
             debitAccount(account, asset, amount);
-            writer.appendBalance(asset, amount);
+            output.appendBalance(asset, amount);
         }
 
-        input.complete();
-        return writer.finish();
+        return output.finish();
     }
 
     /// @notice Debit AMOUNT request blocks from the command account and output matching BALANCE blocks.
-    /// @param c Command context; `c.request` must contain AMOUNT blocks.
+    /// @param c Command context; `c.input` must contain AMOUNT blocks.
     /// @return BALANCE block stream matching the debited amounts.
     function debitAccount(
         CommandContext calldata c
     ) external onlyCommand returns (bytes memory) {
-        return debitAccount(c.account, c.request);
+        return debitAccount(c.account, c.input);
     }
 }
 

package/commands/Deposit.sol

@@ -3,7 +3,7 @@ pragma solidity ^0.8.33;
 
 import { CommandContext, CommandBase, Keys } from "./Base.sol";
 import { Payable } from "../core/Payable.sol";
-import { Cursors, Cur, Schemas, Writer, Writers } from "../Cursors.sol";
+import { Cursors, Cur, Writer, Writers } from "../Cursors.sol";
 import { Budget } from "../utils/Value.sol";
 
 using Cursors for Cur;
@@ -35,30 +35,28 @@ abstract contract DepositPayableHook {
 /// Use `deposit` for assets arriving from outside the protocol (e.g. ERC-20 transfers, ETH).
 /// For internal balance deductions, use `debitAccount` instead.
 abstract contract Deposit is CommandBase, DepositHook {
-    uint internal immutable depositId = commandId(this.deposit.selector);
+    bytes32 private immutable descriptor;
 
     constructor() {
-        emit Command(host, depositId, "1:0:1", Schemas.Amount, Keys.Empty, Keys.Balance, false);
-        emit Labeled(depositId, bytes32(0), "deposit");
+        (, descriptor) = command("deposit", Keys.Empty, Keys.Amount, Keys.Balance, 0, false, false);
     }
 
     /// @notice Deposit AMOUNT request blocks into the command account and output matching BALANCE blocks.
-    /// @param c Command context; `c.request` must contain AMOUNT blocks.
+    /// @param c Command context; `c.input` must contain AMOUNT blocks.
     /// @return BALANCE block stream matching the deposited amounts.
     function deposit(
         CommandContext calldata c
     ) external onlyCommand returns (bytes memory) {
-        (Cur memory request, uint groups, ) = Cursors.init(c.request, 1);
-        Writer memory writer = Writers.allocBalances(groups);
+        (Cur memory input, uint outputs) = openInput(c.input, descriptor);
+        Writer memory output = Writers.allocBalances(outputs);
 
-        while (request.i < request.len) {
-            (bytes32 asset, uint amount) = request.unpackAmount();
+        while (input.i < input.len) {
+            (bytes32 asset, uint amount) = input.unpackAmount();
             deposit(c.account, asset, amount);
-            writer.appendBalance(asset, amount);
+            output.appendBalance(asset, amount);
         }
 
-        request.complete();
-        return writer.finish();
+        return output.finish();
     }
 }
 
@@ -66,32 +64,30 @@ abstract contract Deposit is CommandBase, DepositHook {
 /// @notice Command that receives externally sourced assets and records them as BALANCE state.
 /// Use `depositPayable` when the hook needs tracked access to `msg.value` via a mutable budget.
 abstract contract DepositPayable is CommandBase, Payable, DepositPayableHook {
-    uint internal immutable depositPayableId = commandId(this.depositPayable.selector);
+    bytes32 private immutable descriptor;
 
     constructor() {
-        emit Command(host, depositPayableId, "1:0:1", Schemas.Amount, Keys.Empty, Keys.Balance, true);
-        emit Labeled(depositPayableId, bytes32(0), "depositPayable");
+        (, descriptor) = command("depositPayable", Keys.Empty, Keys.Amount, Keys.Balance, 0, true, false);
     }
 
     /// @notice Deposit AMOUNT request blocks with access to a mutable native-value budget.
-    /// @param c Command context; `c.request` must contain AMOUNT blocks.
+    /// @param c Command context; `c.input` must contain AMOUNT blocks.
     /// @return BALANCE block stream matching the deposited amounts.
     function depositPayable(
         CommandContext calldata c
     ) external payable onlyCommand returns (bytes memory) {
-        (Cur memory request, uint groups, ) = Cursors.init(c.request, 1);
-        Writer memory writer = Writers.allocBalances(groups);
+        (Cur memory input, uint outputs) = openInput(c.input, descriptor);
+        Writer memory output = Writers.allocBalances(outputs);
         Budget memory budget = openValue();
 
-        while (request.i < request.len) {
-            (bytes32 asset, uint amount) = request.unpackAmount();
+        while (input.i < input.len) {
+            (bytes32 asset, uint amount) = input.unpackAmount();
             deposit(c.account, asset, amount, budget);
-            writer.appendBalance(asset, amount);
+            output.appendBalance(asset, amount);
         }
 
         closeValue(c.account, budget);
-        request.complete();
-        return writer.finish();
+        return output.finish();
     }
 }
 

package/commands/Payout.sol

@@ -2,7 +2,7 @@
 pragma solidity ^0.8.33;
 
 import {CommandContext, CommandBase, Keys} from "./Base.sol";
-import {Cursors, Cur, Schemas} from "../Cursors.sol";
+import {Cursors, Cur} from "../Cursors.sol";
 
 using Cursors for Cur;
 
@@ -20,26 +20,22 @@ abstract contract PayoutHook {
 /// @notice Command that sinks BALANCE state blocks to matching ACCOUNT request blocks.
 /// Each BALANCE block is paired with one ACCOUNT block at the same position.
 abstract contract Payout is CommandBase, PayoutHook {
-    uint internal immutable payoutId = commandId(this.payout.selector);
+    bytes32 private immutable descriptor;
 
     constructor() {
-        emit Command(host, payoutId, "1:1:0", Schemas.Account, Keys.Balance, Keys.Empty, false);
-        emit Labeled(payoutId, bytes32(0), "payout");
+        (, descriptor) = command("payout", Keys.Balance, Keys.Account, Keys.Empty, 0, false, false);
     }
 
     /// @notice Pay out BALANCE state blocks to matching ACCOUNT request blocks.
-    /// @param c Command context; `c.state` must contain BALANCE blocks and `c.request` matching ACCOUNT blocks.
+    /// @param c Command context; `c.state` must contain BALANCE blocks and `c.input` matching ACCOUNT blocks.
     /// @return Empty output state.
     function payout(CommandContext calldata c) external onlyCommand returns (bytes memory) {
-        (Cur memory state, uint groups, ) = Cursors.init(c.state, 1);
-        (Cur memory request, ) = Cursors.init(c.request, 1, groups);
+        (Cur memory input, Cur memory state, ) = openCommand(c, descriptor);
 
         while (state.i < state.len) {
             (bytes32 asset, uint amount) = state.unpackBalance();
-            payout(c.account, request.unpackAccount(), asset, amount);
+            payout(c.account, input.unpackAccount(), asset, amount);
         }
-
-        state.complete();
         return "";
     }
 }

package/commands/Provision.sol

@@ -3,7 +3,7 @@ pragma solidity ^0.8.33;
 
 import {CommandContext, CommandBase, Keys} from "./Base.sol";
 import {Payable} from "../core/Payable.sol";
-import {HostAmount, Cursors, Cur, Schemas, Writer, Writers} from "../Cursors.sol";
+import {HostAmount, Cursors, Cur, Writer, Writers} from "../Cursors.sol";
 import {Budget} from "../utils/Value.sol";
 using Cursors for Cur;
 using Writers for Writer;
@@ -33,28 +33,26 @@ abstract contract ProvisionPayableHook {
 /// @notice Command that provisions assets to peer hosts from ALLOCATION request blocks.
 /// Each request block supplies the target host plus an asset amount; the output is a CUSTODY state stream.
 abstract contract Provision is CommandBase, ProvisionHook {
-    uint internal immutable provisionId = commandId(this.provision.selector);
+    bytes32 private immutable descriptor;
 
     constructor() {
-        emit Command(host, provisionId, "1:0:1", Schemas.Allocation, Keys.Empty, Keys.Custody, false);
-        emit Labeled(provisionId, bytes32(0), "provision");
+        (, descriptor) = command("provision", Keys.Empty, Keys.Allocation, Keys.Custody, 0, false, false);
     }
 
     /// @notice Provision ALLOCATION request blocks and output matching CUSTODY state blocks.
-    /// @param c Command context; `c.request` must contain ALLOCATION blocks.
+    /// @param c Command context; `c.input` must contain ALLOCATION blocks.
     /// @return CUSTODY block stream matching the provisioned allocations.
     function provision(CommandContext calldata c) external onlyCommand returns (bytes memory) {
-        (Cur memory request, uint groups, ) = Cursors.init(c.request, 1);
-        Writer memory writer = Writers.allocCustodies(groups);
+        (Cur memory input, uint outputs) = openInput(c.input, descriptor);
+        Writer memory output = Writers.allocCustodies(outputs);
 
-        while (request.i < request.len) {
-            HostAmount memory allocation = request.unpackAllocationValue();
+        while (input.i < input.len) {
+            HostAmount memory allocation = input.unpackAllocationValue();
             provision(c.account, allocation);
-            writer.appendCustody(allocation);
+            output.appendCustody(allocation);
         }
 
-        request.complete();
-        return writer.finish();
+        return output.finish();
     }
 }
 
@@ -63,32 +61,30 @@ abstract contract Provision is CommandBase, ProvisionHook {
 /// Each request block supplies the target host plus an asset amount; the output is a CUSTODY state stream.
 /// The hook receives a mutable native-value budget drawn from `msg.value`.
 abstract contract ProvisionPayable is CommandBase, Payable, ProvisionPayableHook {
-    uint internal immutable provisionPayableId = commandId(this.provisionPayable.selector);
+    bytes32 private immutable descriptor;
 
     constructor() {
-        emit Command(host, provisionPayableId, "1:0:1", Schemas.Allocation, Keys.Empty, Keys.Custody, true);
-        emit Labeled(provisionPayableId, bytes32(0), "provisionPayable");
+        (, descriptor) = command("provisionPayable", Keys.Empty, Keys.Allocation, Keys.Custody, 0, true, false);
     }
 
     /// @notice Provision ALLOCATION request blocks with access to a mutable native-value budget.
-    /// @param c Command context; `c.request` must contain ALLOCATION blocks.
+    /// @param c Command context; `c.input` must contain ALLOCATION blocks.
     /// @return CUSTODY block stream matching the provisioned allocations.
     function provisionPayable(
         CommandContext calldata c
     ) external payable onlyCommand returns (bytes memory) {
-        (Cur memory request, uint groups, ) = Cursors.init(c.request, 1);
-        Writer memory writer = Writers.allocCustodies(groups);
+        (Cur memory input, uint outputs) = openInput(c.input, descriptor);
+        Writer memory output = Writers.allocCustodies(outputs);
         Budget memory budget = openValue();
 
-        while (request.i < request.len) {
-            HostAmount memory allocation = request.unpackAllocationValue();
+        while (input.i < input.len) {
+            HostAmount memory allocation = input.unpackAllocationValue();
             provision(c.account, allocation, budget);
-            writer.appendCustody(allocation);
+            output.appendCustody(allocation);
         }
 
         closeValue(c.account, budget);
-        request.complete();
-        return writer.finish();
+        return output.finish();
     }
 }
 

package/commands/Recover.sol

@@ -3,39 +3,45 @@ pragma solidity ^0.8.33;
 
 import {CommandBase, CommandContext, Keys} from "./Base.sol";
 import {Payable} from "../core/Payable.sol";
-import {RecoverHook} from "../core/Portal.sol";
-import {Cursors, Cur, Schemas} from "../Cursors.sol";
+import {Cursors, Cur} from "../Cursors.sol";
 import {Budget} from "../utils/Value.sol";
 
 using Cursors for Cur;
 
+abstract contract RecoverHook {
+    /// @notice Override to recover a witness through `handler`.
+    /// @param handler Port that should attempt recovery.
+    /// @param key Recovery lookup key.
+    /// @param witness Witness payload used to prove and replay recovery.
+    /// @param value Native EVM value assigned to the recovery attempt.
+    function recover(uint handler, bytes32 key, bytes calldata witness, uint128 value) internal virtual;
+}
+
 /// @title RecoverPayable
 /// @notice Command that forwards recover request blocks to a virtual hook.
 /// Recovery is witness-driven: the command account pays and receives leftover
 /// value settlement, but the recovered subject is defined by each witness.
 /// Produces no output state.
 abstract contract RecoverPayable is CommandBase, Payable, RecoverHook {
-    uint internal immutable recoverPayableId = commandId(this.recoverPayable.selector);
+    bytes32 private immutable descriptor;
 
     constructor() {
-        emit Command(host, recoverPayableId, "1:0:0", Schemas.Recover, Keys.Empty, Keys.Empty, true);
-        emit Labeled(recoverPayableId, bytes32(0), "recoverPayable");
+        (, descriptor) = command("recoverPayable", Keys.Empty, Keys.Recover, Keys.Empty, 0, true, false);
     }
 
     /// @notice Recover each recover block in the command request.
-    /// @param c Command context; `c.request` must contain Recover blocks.
+    /// @param c Command context; `c.input` must contain Recover blocks.
     /// @return Empty output state.
     function recoverPayable(CommandContext calldata c) external payable onlyCommand returns (bytes memory) {
-        (Cur memory request, , ) = Cursors.init(c.request, 1);
+        (Cur memory input, ) = openInput(c.input, descriptor);
         Budget memory budget = openValue();
 
-        while (request.i < request.len) {
-            (uint handler, uint resources, bytes32 key, bytes calldata witness) = request.unpackRecover();
+        while (input.i < input.len) {
+            (uint handler, uint resources, bytes32 key, bytes calldata witness) = input.unpackRecover();
             recover(handler, key, witness, useValue(budget, resources));
         }
 
         closeValue(c.account, budget);
-        request.complete();
         return "";
     }
 }