@etherisc/gif-next 0.0.2-f034782-101 → 0.0.2-f080b71-868

package/contracts/instance/IInstance.sol

@@ -8,6 +8,7 @@ import {StateId} from "../types/StateId.sol";
 import {RiskId} from "../types/RiskId.sol";
 import {VersionPart} from "../types/Version.sol";
 import {Key32} from "../types/Key32.sol";
+import {RoleId} from "../types/RoleId.sol";
 
 import {IRegisterable} from "../shared/IRegisterable.sol";
 
@@ -16,83 +17,44 @@ import {ITransferInterceptor} from "../registry/ITransferInterceptor.sol";
 import {InstanceAccessManager} from "./InstanceAccessManager.sol";
 import {BundleManager} from "./BundleManager.sol";
 import {InstanceReader} from "./InstanceReader.sol";
+import {InstanceStore} from "./InstanceStore.sol";
+
+import {IKeyValueStore} from "./base/IKeyValueStore.sol";
+
+import {IAccess} from "./module/IAccess.sol";
 
-import {IBundle} from "./module/IBundle.sol";
 import {IBundleService} from "./service/IBundleService.sol";
-import {IComponents} from "./module/IComponents.sol";
 import {IDistributionService} from "./service/IDistributionService.sol";
-import {InstanceAccessManager} from "./InstanceAccessManager.sol";
-import {IKeyValueStore} from "./base/IKeyValueStore.sol";
-import {IPolicy} from "./module/IPolicy.sol";
-import {IDistribution} from "./module/IDistribution.sol";
 import {IPolicyService} from "./service/IPolicyService.sol";
 import {IPoolService} from "./service/IPoolService.sol";
 import {IProductService} from "./service/IProductService.sol";
 import {IPolicyService} from "./service/IPolicyService.sol";
 import {IBundleService} from "./service/IBundleService.sol";
-import {IRisk} from "./module/IRisk.sol";
-import {ISetup} from "./module/ISetup.sol";
 
 
 
 interface IInstance is 
     IRegisterable, 
     ITransferInterceptor, 
-    IAccessManaged, 
-    IKeyValueStore 
+    IAccessManaged
 {
+    function createRole(string memory roleName, string memory adminName) external returns (RoleId roleId, RoleId admin);
+    function grantRole(RoleId roleId, address account) external;
+    function revokeRole(RoleId roleId, address account) external;
+
+    function createTarget(address target, string memory name) external;
+    function setTargetFunctionRole(string memory targetName, bytes4[] calldata selectors, RoleId roleId) external;
+    function setTargetLocked(address target, bool locked) external;
+
     function getDistributionService() external view returns (IDistributionService);
     function getProductService() external view returns (IProductService);
     function getPoolService() external view returns (IPoolService);
     function getPolicyService() external view returns (IPolicyService);
     function getBundleService() external view returns (IBundleService);
 
-    function createDistributionSetup(NftId distributionNftId, ISetup.DistributionSetupInfo memory setup) external;
-    function updateDistributionSetup(NftId distributionNftId, ISetup.DistributionSetupInfo memory setup, StateId newState) external;
-    function updateDistributionSetupState(NftId distributionNftId, StateId newState) external;
-
-    function createPoolSetup(NftId poolNftId, IComponents.ComponentInfo memory info) external;
-    function updatePoolSetup(NftId poolNftId, IComponents.ComponentInfo memory info, StateId newState) external;
-    function updatePoolSetupState(NftId poolNftId, StateId newState) external;
-
-    function createBundle(NftId bundleNftId, IBundle.BundleInfo memory bundle) external;
-    function updateBundle(NftId bundleNftId, IBundle.BundleInfo memory bundle, StateId newState) external;
-    function updateBundleState(NftId bundleNftId, StateId newState) external;
-
-    function createProductSetup(NftId productNftId, ISetup.ProductSetupInfo memory setup) external;
-    function updateProductSetup(NftId productNftId, ISetup.ProductSetupInfo memory setup, StateId newState) external;
-    function updateProductSetupState(NftId productNftId, StateId newState) external;
-
-    function createDistributorType(Key32 distributorKey, IDistribution.DistributorTypeInfo memory info) external;
-    function updateDistributorType(Key32 distributorKey, IDistribution.DistributorTypeInfo memory info, StateId newState) external;
-    function updateDistributorTypeState(Key32 distributorKey, StateId newState) external;
-
-    function createDistributor(NftId nftId, IDistribution.DistributorInfo memory info) external;
-    function updateDistributor(NftId nftId, IDistribution.DistributorInfo memory info, StateId newState) external;
-    function updateDistributorState(NftId nftId, StateId newState) external;
-
-    function createReferral(Key32 referralKey, IDistribution.ReferralInfo memory referralInfo) external;
-    function updateReferral(Key32 referralKey, IDistribution.ReferralInfo memory referralInfo, StateId newState) external;
-    function updateReferralState(Key32 referralKey, StateId newState) external;
-
-    function createRisk(RiskId riskId, IRisk.RiskInfo memory risk) external;
-    function updateRisk(RiskId riskId, IRisk.RiskInfo memory risk, StateId newState) external;
-    function updateRiskState(RiskId riskId, StateId newState) external;
-
-    function createApplication(NftId applicationNftId, IPolicy.PolicyInfo memory policy) external;
-    function updateApplication(NftId applicationNftId, IPolicy.PolicyInfo memory policy, StateId newState) external;
-    function updateApplicationState(NftId applicationNftId, StateId newState) external;
-
-    function updatePolicy(NftId policyNftId, IPolicy.PolicyInfo memory policy, StateId newState) external;
-    function updatePolicyState(NftId policyNftId, StateId newState) external;
-
-    // TODO add claims/payouts function to instance
-    // function updateClaims(NftId policyNftId, IPolicy.PolicyInfo memory policy, StateId newState) external;
-
     function getMajorVersion() external pure returns (VersionPart majorVersion);
     function getInstanceReader() external view returns (InstanceReader);
     function getBundleManager() external view returns (BundleManager);
-
-    function setInstanceAccessManager(InstanceAccessManager accessManager) external;
     function getInstanceAccessManager() external view returns (InstanceAccessManager);
+    function getInstanceStore() external view returns (InstanceStore);
 }

package/contracts/instance/IInstanceService.sol

@@ -15,6 +15,7 @@ import {InstanceAccessManager} from "./InstanceAccessManager.sol";
 import {Instance} from "./Instance.sol";
 import {InstanceReader} from "./InstanceReader.sol";
 import {BundleManager} from "./BundleManager.sol";
+import {InstanceStore} from "./InstanceStore.sol";
 
 interface IInstanceService is IService {
 
@@ -33,11 +34,13 @@ interface IInstanceService is IService {
     error ErrorInstanceServiceInstanceAccessManagerZero();
     error ErrorInstanceServiceInstanceReaderZero();
     error ErrorInstanceServiceBundleManagerZero();
+    error ErrorInstanceServiceInstanceStoreZero();
 
     error ErrorInstanceServiceInstanceAuthorityMismatch();
     error ErrorInstanceServiceBundleManagerAuthorityMismatch();
     error ErrorInstanceServiceInstanceReaderInstanceMismatch2();
     error ErrorInstanceServiceBundleMangerInstanceMismatch();
+    error ErrorInstanceServiceInstanceStoreAuthorityMismatch();
 
     error ErrorInstanceServiceRequestUnauhorized(address caller);
     error ErrorInstanceServiceNotInstanceOwner(address caller, NftId instanceNftId);
@@ -46,7 +49,15 @@ interface IInstanceService is IService {
     error ErrorInstanceServiceInstanceComponentMismatch(NftId instanceNftId, NftId componentNftId);
     error ErrorInstanceServiceInvalidComponentType(address componentAddress, ObjectType expectedType, ObjectType componentType);
     
-    event LogInstanceCloned(address clonedOzAccessManager, address clonedInstanceAccessManager, address clonedInstance, address clonedBundleManager, address clonedInstanceReader, NftId clonedInstanceNftId);
+    event LogInstanceCloned(
+        address clonedOzAccessManager,
+        address clonedInstanceAccessManager,
+        address clonedInstance,
+        address clonedInstanceStore,
+        address clonedBundleManager, 
+        address clonedInstanceReader, 
+        NftId clonedInstanceNftId
+    );
 
     function createInstanceClone()
         external 
@@ -56,7 +67,8 @@ interface IInstanceService is IService {
             Instance clonedInstance,
             NftId instanceNftId,
             InstanceReader clonedInstanceReader,
-            BundleManager clonedBundleManager
+            BundleManager clonedBundleManager,
+            InstanceStore clonedInstanceStore
         );
 
     function createGifTarget(

package/contracts/instance/Instance.sol

@@ -3,19 +3,14 @@ pragma solidity ^0.8.20;
 
 import {AccessManagedUpgradeable} from "@openzeppelin/contracts-upgradeable/access/manager/AccessManagedUpgradeable.sol";
 
-import {Key32, KeyId, Key32Lib} from "../types/Key32.sol";
 import {NftId} from "../types/NftId.sol";
-import {ClaimId} from "../types/ClaimId.sol";
-import {NumberId} from "../types/NumberId.sol";
 import {ObjectType, BUNDLE, DISTRIBUTION, INSTANCE, POLICY, POOL, ROLE, PRODUCT, TARGET, COMPONENT, DISTRIBUTOR, DISTRIBUTOR_TYPE} from "../types/ObjectType.sol";
-import {RiskId, RiskIdLib} from "../types/RiskId.sol";
-import {RoleId, RoleIdLib, INSTANCE_ROLE, INSTANCE_OWNER_ROLE} from "../types/RoleId.sol";
-import {StateId, ACTIVE} from "../types/StateId.sol";
-import {TimestampLib} from "../types/Timestamp.sol";
+import {RoleId, RoleIdLib, eqRoleId, ADMIN_ROLE, INSTANCE_ROLE, INSTANCE_OWNER_ROLE} from "../types/RoleId.sol";
 import {VersionPart, VersionPartLib} from "../types/Version.sol";
 
 import {ERC165} from "../shared/ERC165.sol";
 import {Registerable} from "../shared/Registerable.sol";
+import {TokenHandler} from "../shared/TokenHandler.sol";
 
 import {IRegistry} from "../registry/IRegistry.sol";
 
@@ -23,6 +18,7 @@ import {IInstance} from "./IInstance.sol";
 import {InstanceReader} from "./InstanceReader.sol";
 import {InstanceAccessManager} from "./InstanceAccessManager.sol";
 import {BundleManager} from "./BundleManager.sol";
+import {InstanceStore} from "./InstanceStore.sol";
 
 import {KeyValueStore} from "./base/KeyValueStore.sol";
 
@@ -39,29 +35,32 @@ import {IPoolService} from "./service/IPoolService.sol";
 import {IProductService} from "./service/IProductService.sol";
 import {IPolicyService} from "./service/IPolicyService.sol";
 import {IBundleService} from "./service/IBundleService.sol";
-import {TokenHandler} from "../shared/TokenHandler.sol";
-import {VersionPart, VersionPartLib} from "../types/Version.sol";
 
 contract Instance is
     IInstance,
     AccessManagedUpgradeable,
-    Registerable,
-    KeyValueStore
+    Registerable
 {
+    error InstanceErrorReaderInstanceMismatch(address expectedInstance, address foundInstance);
 
-    uint256 public constant GIF_MAJOR_VERSION = 3;
+    error InstanceErrorBundleManagerAlreadySet();
+    error InstanceErrorBundleManagerAuthorityMismatch();
+    error InstanceErrorBundleManagerInstanceMismatch(address expectedInstance, address foundInstance);
+
+    error InstanceErrorAccessManagerAlreadySet();
+    error InstanceErrorAccessManagerAuthorityMismatch();
 
-    uint64 public constant ADMIN_ROLE = type(uint64).min;
-    uint64 public constant PUBLIC_ROLE = type(uint64).max;
-    uint64 public constant CUSTOM_ROLE_ID_MIN = 10000;
+    error InstanceErrorInstanceStoreAlreadySet();
+    error InstanceErrorInstanceStoreAuthorityMismatch();
 
-    uint32 public constant EXECUTION_DELAY = 0;
+    uint256 public constant GIF_MAJOR_VERSION = 3;
 
     bool private _initialized;
 
     InstanceAccessManager internal _accessManager;
     InstanceReader internal _instanceReader;
     BundleManager internal _bundleManager;
+    InstanceStore internal _instanceStore;
 
     modifier onlyChainNft() {
         if(msg.sender != getRegistry().getChainNftAddress()) {
@@ -71,168 +70,66 @@ contract Instance is
     }
 
     function initialize(address authority, address registryAddress, address initialOwner) 
-        public 
+        external 
         initializer()
     {
         __AccessManaged_init(authority);
         
         IRegistry registry = IRegistry(registryAddress);
         initializeRegisterable(registryAddress, registry.getNftId(), INSTANCE(), true, initialOwner, "");
-        initializeLifecycle();
 
         registerInterface(type(IInstance).interfaceId);    
     }
 
-    //--- ProductSetup ------------------------------------------------------//
-    function createProductSetup(NftId productNftId, ISetup.ProductSetupInfo memory setup) external restricted() {
-        create(_toNftKey32(productNftId, PRODUCT()), abi.encode(setup));
-    }
-
-    function updateProductSetup(NftId productNftId, ISetup.ProductSetupInfo memory setup, StateId newState) external restricted() {
-        update(_toNftKey32(productNftId, PRODUCT()), abi.encode(setup), newState);
-    }
-
-    function updateProductSetupState(NftId productNftId, StateId newState) external restricted() {
-        updateState(_toNftKey32(productNftId, PRODUCT()), newState);
-    }
-
-    //--- DistributionSetup ------------------------------------------------------//
-    function createDistributionSetup(NftId distributionNftId, ISetup.DistributionSetupInfo memory setup) external restricted() {
-        create(_toNftKey32(distributionNftId, DISTRIBUTION()), abi.encode(setup));
-    }
-
-    function updateDistributionSetup(NftId distributionNftId, ISetup.DistributionSetupInfo memory setup, StateId newState) external restricted() {
-        update(_toNftKey32(distributionNftId, DISTRIBUTION()), abi.encode(setup), newState);
-    }
-
-    function updateDistributionSetupState(NftId distributionNftId, StateId newState) external restricted() {
-        updateState(_toNftKey32(distributionNftId, DISTRIBUTION()), newState);
-    }
-
-    //--- PoolSetup ------------------------------------------------------//
-    function createPoolSetup(NftId poolNftId, IComponents.ComponentInfo memory info) external restricted() {
-        create(_toNftKey32(poolNftId, POOL()), abi.encode(info));
-    }
-
-    function updatePoolSetup(NftId poolNftId, IComponents.ComponentInfo memory info, StateId newState) external restricted() {
-        update(_toNftKey32(poolNftId, POOL()), abi.encode(info), newState);
-    }
-
-    function updatePoolSetupState(NftId poolNftId, StateId newState) external restricted() {
-        updateState(_toNftKey32(poolNftId, POOL()), newState);
-    }
-
-    //--- DistributorType -------------------------------------------------------//
-    function createDistributorType(Key32 distributorKey, IDistribution.DistributorTypeInfo memory info) external restricted() {
-        create(distributorKey, abi.encode(info));
-    }
-
-    function updateDistributorType(Key32 distributorKey, IDistribution.DistributorTypeInfo memory info, StateId newState) external restricted() {
-        update(distributorKey, abi.encode(info), newState);
-    }
-
-    function updateDistributorTypeState(Key32 distributorKey, StateId newState) external restricted() {
-        updateState(distributorKey, newState);
-    }
-
-    //--- Distributor -------------------------------------------------------//
-    function createDistributor(NftId nftId, IDistribution.DistributorInfo memory info) external restricted() {
-        create(toDistributorKey32(nftId), abi.encode(info));
-    }
-
-    function updateDistributor(NftId nftId, IDistribution.DistributorInfo memory info, StateId newState) external restricted() {
-        update(toDistributorKey32(nftId), abi.encode(info), newState);
-    }
-
-    function updateDistributorState(NftId nftId, StateId newState) external restricted() {
-        updateState(toDistributorKey32(nftId), newState);
-    }
-
-    //--- Referral ----------------------------------------------------------//
-    function createReferral(Key32 referralKey, IDistribution.ReferralInfo memory referralInfo) external restricted() {
-        create(referralKey, abi.encode(referralInfo));
-    }
-
-    function updateReferral(Key32 referralKey, IDistribution.ReferralInfo memory referralInfo, StateId newState) external restricted() {
-        update(referralKey, abi.encode(referralInfo), newState);
-    }
-
-    function updateReferralState(Key32 referralKey, StateId newState) external restricted() {
-        updateState(referralKey, newState);
-    }
-
-    //--- Bundle ------------------------------------------------------------//
-    function createBundle(NftId bundleNftId, IBundle.BundleInfo memory bundle) external restricted() {
-        create(toBundleKey32(bundleNftId), abi.encode(bundle));
-    }
-
-    function updateBundle(NftId bundleNftId, IBundle.BundleInfo memory bundle, StateId newState) external restricted() {
-        update(toBundleKey32(bundleNftId), abi.encode(bundle), newState);
-    }
+    //--- Roles ------------------------------------------------------------//
 
-    function updateBundleState(NftId bundleNftId, StateId newState) external restricted() {
-        updateState(toBundleKey32(bundleNftId), newState);
-    }
-
-    //--- Risk --------------------------------------------------------------//
-    function createRisk(RiskId riskId, IRisk.RiskInfo memory risk) external restricted() {
-        create(riskId.toKey32(), abi.encode(risk));
-    }
-
-    function updateRisk(RiskId riskId, IRisk.RiskInfo memory risk, StateId newState) external restricted() {
-        update(riskId.toKey32(), abi.encode(risk), newState);
-    }
-
-    function updateRiskState(RiskId riskId, StateId newState) external restricted() {
-        updateState(riskId.toKey32(), newState);
-    }
-
-    //--- Application (Policy) ----------------------------------------------//
-    function createApplication(NftId applicationNftId, IPolicy.PolicyInfo memory policy) external restricted() {
-        create(toPolicyKey32(applicationNftId), abi.encode(policy));
-    }
-
-    function updateApplication(NftId applicationNftId, IPolicy.PolicyInfo memory policy, StateId newState) external restricted() {
-        update(toPolicyKey32(applicationNftId), abi.encode(policy), newState);
-    }
-
-    function updateApplicationState(NftId applicationNftId, StateId newState) external restricted() {
-        updateState(toPolicyKey32(applicationNftId), newState);
-    }
-
-    //--- Policy ------------------------------------------------------------//
-    function updatePolicy(NftId policyNftId, IPolicy.PolicyInfo memory policy, StateId newState) external restricted() {
-        update(toPolicyKey32(policyNftId), abi.encode(policy), newState);
-    }
-
-    function updatePolicyState(NftId policyNftId, StateId newState) external restricted() {
-        updateState(toPolicyKey32(policyNftId), newState);
+    function createRole(string memory roleName, string memory adminName)
+        external
+        restricted // INSTANCE_OWNER_ROLE
+        returns (RoleId roleId, RoleId admin)
+    {
+        (roleId, admin) = _accessManager.createRole(roleName, adminName);
     }
 
-    //--- Claim -------------------------------------------------------------//
-    function createClaim(NftId policyNftId, ClaimId claimId, IPolicy.ClaimInfo memory claim) external restricted() {
-        create(toPolicyKey32(policyNftId), abi.encode(claim));
+    function grantRole(RoleId roleId, address account) 
+        external 
+        restricted // INSTANCE_OWNER_ROLE
+    {
+        _accessManager.grantRole(roleId, account);
     }
 
-    function updateClaim(NftId policyNftId, ClaimId claimId, IPolicy.ClaimInfo memory claim, StateId newState) external restricted() {
-        update(toPolicyKey32(policyNftId), abi.encode(claim), newState);
+    function revokeRole(RoleId roleId, address account) 
+        external 
+        restricted // INSTANCE_OWNER_ROLE
+    {
+        _accessManager.revokeRole(roleId, account);
     }
 
-    function updateClaimState(NftId policyNftId, ClaimId claimId, StateId newState) external restricted() {
-        updateState(toPolicyKey32(policyNftId), newState);
-    }
+    //--- Targets ------------------------------------------------------------//
 
-    //--- Payout ------------------------------------------------------------//
-    function createPayout(NftId policyNftId, NumberId payoutId, IPolicy.PayoutInfo memory payout) external restricted() {
-        create(toPolicyKey32(policyNftId), abi.encode(payout));
+    function createTarget(address target, string memory name) 
+        external 
+        restricted // INSTANCE_OWNER_ROLE
+    {
+        _accessManager.createTarget(target, name);
     }
 
-    function updatePayout(NftId policyNftId, NumberId payoutId, IPolicy.PayoutInfo memory payout, StateId newState) external restricted() {
-        update(toPolicyKey32(policyNftId), abi.encode(payout), newState);
+    function setTargetFunctionRole(
+        string memory targetName,
+        bytes4[] calldata selectors,
+        RoleId roleId
+    ) 
+        external 
+        restricted // INSTANCE_OWNER_ROLE
+    {
+        _accessManager.setTargetFunctionRole(targetName, selectors, roleId);
     }
 
-    function updatePayoutState(NftId policyNftId, StateId newState) external restricted() {
-        updateState(toPolicyKey32(policyNftId), newState);
+    function setTargetLocked(address target, bool locked)
+        external 
+        restricted // INSTANCE_OWNER_ROLE
+    {
+        _accessManager.setTargetLockedByInstance(target, locked);
     }
 
     //--- ITransferInterceptor ------------------------------------------------------------//
@@ -246,31 +143,6 @@ contract Instance is
         assert(_accessManager.grantRole(INSTANCE_OWNER_ROLE(), to) == true);
     }
 
-    //--- internal view/pure functions --------------------------------------//
-    function _toNftKey32(NftId nftId, ObjectType objectType) internal pure returns (Key32) {
-        return nftId.toKey32(objectType);
-    }
-
-    function toBundleKey32(NftId bundleNftId) public pure returns (Key32) {
-        return bundleNftId.toKey32(BUNDLE());
-    }
-
-    function toPolicyKey32(NftId policyNftId) public pure returns (Key32) {
-        return policyNftId.toKey32(POLICY());
-    }
-
-    function toDistributionKey32(NftId distNftId) public pure returns (Key32) {
-        return distNftId.toKey32(DISTRIBUTION());
-    }
-
-    function toDistributorTypeKey32(NftId distNftId) public pure returns (Key32) {
-        return distNftId.toKey32(DISTRIBUTOR_TYPE());
-    }
-
-    function toDistributorKey32(NftId distNftId) public pure returns (Key32) {
-        return distNftId.toKey32(DISTRIBUTOR());
-    }
-    
     function getDistributionService() external view returns (IDistributionService) {
         return IDistributionService(getRegistry().getServiceAddress(DISTRIBUTION(), VersionPart.wrap(3)));
     }
@@ -292,7 +164,9 @@ contract Instance is
     }
 
     function setInstanceReader(InstanceReader instanceReader) external restricted() {
-        require(instanceReader.getInstance() == Instance(this), "InstanceReader instance mismatch");
+        if(instanceReader.getInstance() != Instance(this)) {
+            revert InstanceErrorReaderInstanceMismatch(address(this), address(instanceReader.getInstance()));
+        }
         _instanceReader = instanceReader;
     }
 
@@ -305,9 +179,15 @@ contract Instance is
     }
     
     function setBundleManager(BundleManager bundleManager) external restricted() {
-        require(address(_bundleManager) == address(0), "BundleManager is set");
-        require(bundleManager.getInstance() == Instance(this), "BundleManager instance mismatch");
-        require(bundleManager.authority() == authority(), "BundleManager authority mismatch");
+        if(address(_bundleManager) != address(0)) {
+            revert InstanceErrorBundleManagerAlreadySet();
+        }
+        if(bundleManager.getInstance() != Instance(this)) {
+            revert InstanceErrorBundleManagerInstanceMismatch(address(this), address(bundleManager.getInstance()));
+        }
+        if(bundleManager.authority() != authority()) {
+            revert InstanceErrorBundleManagerAuthorityMismatch();
+        }
         _bundleManager = bundleManager;
     }
 
@@ -316,12 +196,32 @@ contract Instance is
     }
 
     function setInstanceAccessManager(InstanceAccessManager accessManager) external restricted {
-        require(address(_accessManager) == address(0), "InstanceAccessManager is set");
-        require(accessManager.authority() == authority(), "InstanceAccessManager authority mismatch");  
+        if(address(_accessManager) != address(0)) {
+            revert InstanceErrorAccessManagerAlreadySet();
+        }
+        if(accessManager.authority() != authority()) {
+            revert InstanceErrorAccessManagerAuthorityMismatch();
+        }
         _accessManager = accessManager;      
     }
 
     function getInstanceAccessManager() external view returns (InstanceAccessManager) {
         return _accessManager;
     }
-}
+
+    function setInstanceStore(InstanceStore instanceStore) external restricted {
+        if(address(_instanceStore) != address(0)) {
+            revert InstanceErrorInstanceStoreAlreadySet();
+        }
+        if(instanceStore.authority() != authority()) {
+            revert InstanceErrorInstanceStoreAuthorityMismatch();
+        }
+        _instanceStore = instanceStore;
+    }
+
+    function getInstanceStore() external view returns (InstanceStore) {
+        return _instanceStore;
+    }
+
+    //--- internal view/pure functions --------------------------------------//
+}

package/contracts/instance/InstanceAccessManager.sol

@@ -73,7 +73,7 @@ contract InstanceAccessManager is
         _createRole(ADMIN_ROLE(), ADMIN_ROLE_NAME, IAccess.Type.Core);
         _createRole(PUBLIC_ROLE(), PUBLIC_ROLE_NAME, IAccess.Type.Core);
         _createRole(INSTANCE_ROLE(), INSTANCE_ROLE_NAME, IAccess.Type.Core);
-        _createRole(INSTANCE_OWNER_ROLE(), INSTANCE_OWNER_ROLE_NAME, IAccess.Type.Gif);
+        _createRole(INSTANCE_OWNER_ROLE(), INSTANCE_OWNER_ROLE_NAME, IAccess.Type.Gif);// TODO should be of core type
 
         // assume `this` is already a member of ADMIN_ROLE
         EnumerableSet.add(_roleMembers[ADMIN_ROLE()], address(this));
@@ -142,6 +142,7 @@ contract InstanceAccessManager is
         _roleInfo[roleId].admin = admin;      
     }
 
+    // TODO core role can be granted only to 1 member
     function grantRole(RoleId roleId, address member) 
         public
         restrictedToRoleAdmin(roleId) 
@@ -226,7 +227,7 @@ contract InstanceAccessManager is
         return _roleIds[idx];
     }
 
-    // TODO now: for non existent name returns ADMIN_ROLE id
+    // TODO returns ADMIN_ROLE id for non existent name
     function getRoleIdForName(string memory name) external view returns (RoleId roleId) {
         return _roleIdForName[ShortStrings.toShortString(name)];
     }
@@ -250,7 +251,7 @@ contract InstanceAccessManager is
         _createTarget(target, name, IAccess.Type.Core);
     }
     // INSTANCE_SERVICE_ROLE
-    // assume gif target is registered and belongs to the same instance as instance access manager
+    // TODO check for instance mismatch?
     function createGifTarget(address target, string memory name) external restricted() 
     {
         if(!_registry.isRegistered(target)) {
@@ -268,27 +269,23 @@ contract InstanceAccessManager is
     {
         _createTarget(target, name, IAccess.Type.Custom);
     }
-    // INSTANCE_SERVICE_ROLE
-    // IMPORTANT: instance access manager MUST be of Core type -> otherwise will be locked forever
-    function setTargetLocked(string memory targetName, bool locked) 
+
+    // TODO instance owner locks component instead of revoking it access to the instance...
+    function setTargetLockedByService(address target, bool locked)
         external 
-        restricted() 
+        restricted // INSTANCE_SERVICE_ROLE
     {
-        ShortString nameShort = ShortStrings.toShortString(targetName);
-        address target = _targetAddressForName[nameShort];
-        
-        if (target == address(0)) {
-            revert IAccess.ErrorIAccessTargetDoesNotExist(nameShort);
-        }
+        _setTargetLocked(target, locked);
+    }
 
-        if(_targetInfo[target].ttype == IAccess.Type.Core) {
-            revert IAccess.ErrorIAccessTargetTypeInvalid(nameShort, _targetInfo[target].ttype);
-        }
-        // TODO isLocked is redundant but makes getTargetInfo() faster
-        _targetInfo[target].isLocked = locked;
-        _accessManager.setTargetClosed(target, locked);
+    function setTargetLockedByInstance(address target, bool locked)
+        external
+        restricted // INSTANCE_ROLE
+    {
+        _setTargetLocked(target, locked);
     }
 
+
     // allowed combinations of roles and targets:
     //1) set core role for core target 
     //2) set gif role for gif target  
@@ -314,7 +311,7 @@ contract InstanceAccessManager is
 
         // not custom target
         if(_targetInfo[target].ttype == IAccess.Type.Custom) {
-            revert IAccess.ErrorIAccessTargetTypeInvalid(nameShort, IAccess.Type.Custom);
+            revert IAccess.ErrorIAccessTargetTypeInvalid(target, IAccess.Type.Custom);
         }
 
         // not custom role
@@ -345,7 +342,7 @@ contract InstanceAccessManager is
 
         // not core target
         if(_targetInfo[target].ttype == IAccess.Type.Core) {
-            revert IAccess.ErrorIAccessTargetTypeInvalid(nameShort, IAccess.Type.Core);
+            revert IAccess.ErrorIAccessTargetTypeInvalid(target, IAccess.Type.Core);
         }
 
         // not core role
@@ -356,8 +353,13 @@ contract InstanceAccessManager is
         _setTargetFunctionRole(target, nameShort, selectors, roleId);
     }
 
+    function getTargetAddress(string memory targetName) public view returns(address targetAddress) {
+        ShortString nameShort = ShortStrings.toShortString(targetName);
+        return _targetAddressForName[nameShort];
+    }
+
     function isTargetLocked(address target) public view returns (bool locked) {
-        return _accessManager.isTargetClosed(target);
+        return _targetInfo[target].isLocked;
     }
 
     function targetExists(address target) public view returns (bool exists) {
@@ -492,6 +494,22 @@ contract InstanceAccessManager is
         }
     }
 
+    // IMPORTANT: instance access manager MUST be of Core type -> otherwise can be locked forever
+    function _setTargetLocked(address target, bool locked) internal
+    {
+        IAccess.Type targetType = _targetInfo[target].ttype;
+        if(target == address(0) || targetType == IAccess.Type.NotInitialized) {
+            revert IAccess.ErrorIAccessTargetDoesNotExist(target);
+        }
+
+        if(targetType == IAccess.Type.Core) {
+            revert IAccess.ErrorIAccessTargetTypeInvalid(target, targetType);
+        }
+
+        _targetInfo[target].isLocked = locked;
+        _accessManager.setTargetClosed(target, locked);
+    }
+
     function _setTargetFunctionRole(
         address target,
         ShortString name,
@@ -501,7 +519,7 @@ contract InstanceAccessManager is
         internal
     {
         if (target == address(0)) {
-            revert IAccess.ErrorIAccessTargetDoesNotExist(name);
+            revert IAccess.ErrorIAccessTargetDoesNotExist(target);
         }
 
         if (!roleExists(roleId)) {