writing type-safe command envelopes instead of command gate