@bananapus/permission-ids-v6 0.0.24 → 0.0.26

package/README.md

@@ -28,8 +28,9 @@ If the question is "who can do this action?" you still need `JBPermissions` in `
 | `24-27` | 721 hook permissions |
 | `28-30` | buyback hook and registry permissions |
 | `31` | router terminal registry permission |
-| `32-35` | sucker and omnichain deployment permissions |
-| `36-40` | revnet-core permissions |
+| `32-36` | sucker and omnichain deployment/lifecycle permissions |
+| `37-39` | revnet-core loan permissions |
+| `40` | currently unassigned; reserved for the next ecosystem permission |
 
 The exact constants live in `src/JBPermissionIds.sol`.
 

package/RISKS.md

@@ -22,13 +22,14 @@ This file covers the coordination risks in `JBPermissionIds`. The contract surfa
 - **`ROOT` is broad authority.** `ROOT` (ID `1`) grants all permissions, including permissions added in the future.
 - **Wildcard grants increase blast radius.** Any permission granted with `projectId = 0` applies to all projects owned by that account.
 - **Hook and router lock powers are bundled.** `SET_BUYBACK_HOOK` (`30`) and `SET_ROUTER_TERMINAL` (`31`) both cover setting and locking.
-- **Third-party extensions do not have an on-chain namespace.** IDs `41-255` are only socially coordinated, so external packages can collide without coordination.
+- **Third-party extensions do not have an on-chain namespace.** IDs `41-255` are only socially coordinated, so external packages can collide without coordination. ID `40` is not currently assigned in `JBPermissionIds.sol`.
 
 ## 2. High-Impact IDs
 
 - **Fund-moving IDs.** `CASH_OUT_TOKENS` (`4`), `SEND_PAYOUTS` (`5`), `MIGRATE_TERMINAL` (`6`), `SET_TERMINALS` (`15`), `USE_ALLOWANCE` (`18`), and `SET_SPLIT_GROUPS` (`19`) can redirect or release value.
 - **Hook-routing IDs.** `SET_BUYBACK_POOL` (`28`), `SET_BUYBACK_HOOK` (`30`), and `SET_ROUTER_TERMINAL` (`31`) materially control execution routes and can lock those routes permanently.
-- **Revnet loan IDs.** `OPEN_LOAN` (`36`), `REALLOCATE_LOAN` (`37`), and `REPAY_LOAN` (`38`) are operationally powerful because they move collateral and debt state.
+- **Sucker lifecycle IDs.** `SUCKER_SAFETY` (`35`) and `SET_SUCKER_DEPRECATION` (`36`) control emergency recovery and bridge shutdown state.
+- **Revnet loan IDs.** `OPEN_LOAN` (`37`), `REALLOCATE_LOAN` (`38`), and `REPAY_LOAN` (`39`) are operationally powerful because they move collateral and debt state.
 
 ## 3. Integration Risks
 
@@ -41,7 +42,7 @@ This file covers the coordination risks in `JBPermissionIds`. The contract surfa
 - Assigned IDs are append-only and never repurposed.
 - `0` stays unused as a permission ID.
 - Every documented ID in this repo matches the numeric checks in downstream contracts.
-- New IDs added after `40` do not collide with existing ecosystem assignments.
+- ID `40` remains unused until a named constant is appended, and all new IDs are added without colliding with existing ecosystem assignments.
 
 ## 5. Accepted Behaviors
 

package/USER_JOURNEYS.md

@@ -14,7 +14,7 @@ This repo is the shared permission vocabulary for the V6 ecosystem. It does not
 
 - `JBPermissionIds`: library of canonical permission constants used across V6 repos
 - grouped constants for core, 721, router, buyback, sucker, revnet, and related actions
-- reserved ranges documented in `README.md`, including `ROOT = 1`, ecosystem-managed IDs through `40`, and socially coordinated extension space above that
+- reserved ranges documented in `README.md`, including `ROOT = 1`, currently assigned ecosystem IDs through `39`, unassigned ID `40`, and socially coordinated extension space above that
 
 ## Journey 1: Map A Product Action To The Right Permission
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bananapus/permission-ids-v6",
-  "version": "0.0.24",
+  "version": "0.0.26",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/JBPermissionIds.sol

@@ -160,15 +160,24 @@ library JBPermissionIds {
 
     /// @notice Deploy cross-chain sucker bridges for a project, enabling token bridging between chains
     /// (`JBSuckerRegistry.deploySuckersFor`).
+    /// @dev When the configuration's `peer` is `address(0)` or `address(this)` (default symmetric-address peering),
+    /// `DEPLOY_SUCKERS` is sufficient. Registering a non-symmetric explicit peer also requires `SET_SUCKER_PEER`.
     uint8 internal constant DEPLOY_SUCKERS = 33;
 
+    /// @notice Register a non-symmetric explicit peer address when deploying a cross-chain sucker
+    /// (`JBSuckerRegistry.deploySuckersFor` with `configuration.peer` != 0 and != `address(this)`).
+    /// @dev The explicit-peer field bypasses the same-address peering invariant, so any operator that can set it
+    /// can authorize mint-from-arbitrary-roots. This permission is intentionally narrower than `DEPLOY_SUCKERS` so
+    /// that ops automation with `DEPLOY_SUCKERS` cannot register attacker-controlled peers.
+    uint8 internal constant SET_SUCKER_PEER = 34;
+
     /// @notice Enable the emergency hatch on a cross-chain sucker, allowing stuck tokens to be recovered
     /// (`JBSucker.enableEmergencyHatchFor`).
-    uint8 internal constant SUCKER_SAFETY = 34;
+    uint8 internal constant SUCKER_SAFETY = 35;
 
     /// @notice Set the deprecation status of a cross-chain sucker, progressing it through its shutdown lifecycle
     /// (`JBSucker.setDeprecation`).
-    uint8 internal constant SET_SUCKER_DEPRECATION = 35;
+    uint8 internal constant SET_SUCKER_DEPRECATION = 36;
 
     /* ── revnet-core-v6
     ─────────────────────────────────────────────────
@@ -176,13 +185,13 @@ library JBPermissionIds {
 
     /// @notice Open a loan against project tokens as collateral on behalf of a token holder
     /// (`REVLoans.borrowFrom`).
-    uint8 internal constant OPEN_LOAN = 36;
+    uint8 internal constant OPEN_LOAN = 37;
 
     /// @notice Move loan collateral between projects on behalf of a loan owner
     /// (`REVLoans.reallocateCollateralFromLoan`).
-    uint8 internal constant REALLOCATE_LOAN = 37;
+    uint8 internal constant REALLOCATE_LOAN = 38;
 
     /// @notice Repay a loan on behalf of the loan owner, returning collateral tokens
     /// (`REVLoans.repayLoan`).
-    uint8 internal constant REPAY_LOAN = 38;
+    uint8 internal constant REPAY_LOAN = 39;
 }

package/test/formal/JBPermissionIdsHalmos.t.sol

@@ -0,0 +1,68 @@
+// SPDX-License-Identifier: MIT
+pragma solidity 0.8.28;
+
+import {JBPermissionIds} from "../../src/JBPermissionIds.sol";
+
+/// @notice Small Halmos entrypoints for the ecosystem permission namespace.
+/// @dev This package is constants-only, so the useful machine-check is exact namespace drift: values must remain
+/// contiguous from ROOT through REPAY_LOAN unless a future migration intentionally updates this proof.
+contract JBPermissionIdsHalmos {
+    /// @notice Proves the permission IDs are exactly the expected contiguous sequence.
+    function check_permissionIdsAreContiguousAndStable() public pure {
+        uint8[39] memory ids = [
+            JBPermissionIds.ROOT,
+            JBPermissionIds.QUEUE_RULESETS,
+            JBPermissionIds.LAUNCH_RULESETS,
+            JBPermissionIds.CASH_OUT_TOKENS,
+            JBPermissionIds.SEND_PAYOUTS,
+            JBPermissionIds.MIGRATE_TERMINAL,
+            JBPermissionIds.SET_PROJECT_URI,
+            JBPermissionIds.DEPLOY_ERC20,
+            JBPermissionIds.SET_TOKEN,
+            JBPermissionIds.MINT_TOKENS,
+            JBPermissionIds.BURN_TOKENS,
+            JBPermissionIds.CLAIM_TOKENS,
+            JBPermissionIds.TRANSFER_CREDITS,
+            JBPermissionIds.SET_CONTROLLER,
+            JBPermissionIds.SET_TERMINALS,
+            JBPermissionIds.ADD_TERMINALS,
+            JBPermissionIds.SET_PRIMARY_TERMINAL,
+            JBPermissionIds.USE_ALLOWANCE,
+            JBPermissionIds.SET_SPLIT_GROUPS,
+            JBPermissionIds.ADD_PRICE_FEED,
+            JBPermissionIds.ADD_ACCOUNTING_CONTEXTS,
+            JBPermissionIds.SET_TOKEN_METADATA,
+            JBPermissionIds.SIGN_FOR_ERC20,
+            JBPermissionIds.ADJUST_721_TIERS,
+            JBPermissionIds.SET_721_METADATA,
+            JBPermissionIds.MINT_721,
+            JBPermissionIds.SET_721_DISCOUNT_PERCENT,
+            JBPermissionIds.SET_BUYBACK_TWAP,
+            JBPermissionIds.SET_BUYBACK_POOL,
+            JBPermissionIds.SET_BUYBACK_HOOK,
+            JBPermissionIds.SET_ROUTER_TERMINAL,
+            JBPermissionIds.MAP_SUCKER_TOKEN,
+            JBPermissionIds.DEPLOY_SUCKERS,
+            JBPermissionIds.SET_SUCKER_PEER,
+            JBPermissionIds.SUCKER_SAFETY,
+            JBPermissionIds.SET_SUCKER_DEPRECATION,
+            JBPermissionIds.OPEN_LOAN,
+            JBPermissionIds.REALLOCATE_LOAN,
+            JBPermissionIds.REPAY_LOAN
+        ];
+
+        for (uint256 i; i < ids.length;) {
+            assert(ids[i] == i + 1);
+
+            unchecked {
+                ++i;
+            }
+        }
+    }
+
+    /// @notice Proves the first and final IDs stay pinned to the documented namespace bounds.
+    function check_permissionNamespaceBounds() public pure {
+        assert(JBPermissionIds.ROOT == 1);
+        assert(JBPermissionIds.REPAY_LOAN == 39);
+    }
+}