@rev-net/core-v6 0.0.65 → 0.0.67

package/src/REVOwner.sol

@@ -4,7 +4,10 @@ pragma solidity 0.8.28;
 import {IJB721TiersHook} from "@bananapus/721-hook-v6/src/interfaces/IJB721TiersHook.sol";
 import {IJBBuybackHookRegistry} from "@bananapus/buyback-hook-v6/src/interfaces/IJBBuybackHookRegistry.sol";
 import {IJBCashOutHook} from "@bananapus/core-v6/src/interfaces/IJBCashOutHook.sol";
+import {IJBController} from "@bananapus/core-v6/src/interfaces/IJBController.sol";
 import {IJBDirectory} from "@bananapus/core-v6/src/interfaces/IJBDirectory.sol";
+import {IJBPermissions} from "@bananapus/core-v6/src/interfaces/IJBPermissions.sol";
+import {IJBProjects} from "@bananapus/core-v6/src/interfaces/IJBProjects.sol";
 import {IJBRulesetDataHook} from "@bananapus/core-v6/src/interfaces/IJBRulesetDataHook.sol";
 import {IJBTerminal} from "@bananapus/core-v6/src/interfaces/IJBTerminal.sol";
 import {JBCashOuts} from "@bananapus/core-v6/src/libraries/JBCashOuts.sol";
@@ -16,16 +19,24 @@ import {JBBeforeCashOutRecordedContext} from "@bananapus/core-v6/src/structs/JBB
 import {JBBeforePayRecordedContext} from "@bananapus/core-v6/src/structs/JBBeforePayRecordedContext.sol";
 import {JBCashOutHookSpecification} from "@bananapus/core-v6/src/structs/JBCashOutHookSpecification.sol";
 import {JBPayHookSpecification} from "@bananapus/core-v6/src/structs/JBPayHookSpecification.sol";
+import {JBPermissionsData} from "@bananapus/core-v6/src/structs/JBPermissionsData.sol";
 import {JBRuleset} from "@bananapus/core-v6/src/structs/JBRuleset.sol";
+import {JBPermissionIds} from "@bananapus/permission-ids-v6/src/JBPermissionIds.sol";
 import {IJBPeerChainAdjustedAccounts} from "@bananapus/suckers-v6/src/interfaces/IJBPeerChainAdjustedAccounts.sol";
 import {IJBSuckerRegistry} from "@bananapus/suckers-v6/src/interfaces/IJBSuckerRegistry.sol";
 import {IERC165} from "@openzeppelin/contracts/utils/introspection/IERC165.sol";
 import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
+import {IERC721} from "@openzeppelin/contracts/token/ERC721/IERC721.sol";
+import {IERC721Receiver} from "@openzeppelin/contracts/token/ERC721/IERC721Receiver.sol";
 import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
 import {mulDiv} from "@prb/math/src/Common.sol";
 
 import {IREVDeployer} from "./interfaces/IREVDeployer.sol";
 import {IREVLoans} from "./interfaces/IREVLoans.sol";
+import {IREVOwner} from "./interfaces/IREVOwner.sol";
+import {REVOwnerAutoIssuance} from "./structs/REVOwnerAutoIssuance.sol";
+import {REVOwnerExtraGrant} from "./structs/REVOwnerExtraGrant.sol";
+import {REVOwnerRevnetInit} from "./structs/REVOwnerRevnetInit.sol";
 
 /// @notice The runtime hook for all revnets — set as every revnet's `dataHook` in ruleset metadata. At pay time, it
 /// coordinates the 721 hook (NFT tier minting) with the buyback hook (secondary market swap routing) and scales weight
@@ -34,7 +45,7 @@ import {IREVLoans} from "./interfaces/IREVLoans.sol";
 /// proceeds to the fee revnet via `afterCashOutRecordedWith`.
 /// @dev Separated from `REVDeployer` to stay within the EIP-170 contract size limit. Also implements
 /// `IJBPeerChainAdjustedAccounts` to expose loan state to peer-chain supply/surplus snapshots.
-contract REVOwner is IJBRulesetDataHook, IJBCashOutHook, IJBPeerChainAdjustedAccounts {
+contract REVOwner is IREVOwner, IJBRulesetDataHook, IJBCashOutHook, IJBPeerChainAdjustedAccounts, IERC721Receiver {
     // A library that adds default safety checks to ERC20 functionality.
     using SafeERC20 for IERC20;
 
@@ -46,26 +57,30 @@ contract REVOwner is IJBRulesetDataHook, IJBCashOutHook, IJBPeerChainAdjustedAcc
     error REVOwner_CashOutDelayNotFinished(uint256 cashOutDelay, uint256 blockTimestamp);
     error REVOwner_InvalidLoanSourceToken(uint256 revnetId, address token);
     error REVOwner_NativeFeeValueMismatch(uint256 expected, uint256 actual);
+    error REVOwner_NothingToAutoIssue(uint256 revnetId, uint256 stageId, address beneficiary);
+    error REVOwner_NothingToBurn(uint256 revnetId, address holder);
+    error REVOwner_StageNotStarted(uint256 stageId);
     error REVOwner_Unauthorized(address caller, address expectedCaller);
+    error REVOwner_UnauthorizedOperator(uint256 revnetId, address caller);
 
     //*********************************************************************//
     // --------------- public immutable stored properties ---------------- //
     //*********************************************************************//
 
     /// @notice The buyback hook used as a data hook to route payments through buyback pools.
-    IJBBuybackHookRegistry public immutable BUYBACK_HOOK;
+    IJBBuybackHookRegistry public immutable override BUYBACK_HOOK;
 
     /// @notice The directory of terminals and controllers for Juicebox projects.
-    IJBDirectory public immutable DIRECTORY;
+    IJBDirectory public immutable override DIRECTORY;
 
     /// @notice The Juicebox project ID of the revnet that receives cash out fees.
-    uint256 public immutable FEE_REVNET_ID;
+    uint256 public immutable override FEE_REVNET_ID;
 
     /// @notice The loan contract used by all revnets.
-    IREVLoans public immutable LOANS;
+    IREVLoans public immutable override LOANS;
 
     /// @notice Deploys and tracks suckers for revnets.
-    IJBSuckerRegistry public immutable SUCKER_REGISTRY;
+    IJBSuckerRegistry public immutable override SUCKER_REGISTRY;
 
     //*********************************************************************//
     // --------------------- public stored properties -------------------- //
@@ -74,15 +89,43 @@ contract REVOwner is IJBRulesetDataHook, IJBCashOutHook, IJBPeerChainAdjustedAcc
     /// @notice The timestamp of when cashouts will become available to a specific revnet's participants.
     /// @dev Only applies to existing revnets deploying onto a new network.
     /// @custom:param revnetId The ID of the revnet to check the cash out delay for.
-    mapping(uint256 revnetId => uint256 cashOutDelay) public cashOutDelayOf;
+    mapping(uint256 revnetId => uint256 cashOutDelay) public override cashOutDelayOf;
 
     /// @notice Each revnet's tiered ERC-721 hook.
     /// @custom:param revnetId The ID of the revnet to look up.
-    mapping(uint256 revnetId => IJB721TiersHook tiered721Hook) public tiered721HookOf;
+    mapping(uint256 revnetId => IJB721TiersHook tiered721Hook) public override tiered721HookOf;
+
+    /// @notice The amount of project tokens to auto-issue at a given stage to a given beneficiary.
+    /// @custom:param revnetId The ID of the revnet to look up.
+    /// @custom:param stageId The ID of the ruleset stage to look up.
+    /// @custom:param beneficiary The address that will receive the auto-issued tokens.
+    mapping(uint256 revnetId => mapping(uint256 stageId => mapping(address beneficiary => uint256 count)))
+        public
+        override amountToAutoIssue;
 
     /// @notice The deployer that manages revnet state.
     /// @dev Set once via `setDeployer()` using the precomputed canonical REVDeployer address.
-    IREVDeployer public deployer;
+    IREVDeployer public override deployer;
+
+    /// @notice The controller used by all revnets to manage their projects.
+    /// @dev Cached from the deployer at `setDeployer()` time.
+    IJBController public override CONTROLLER;
+
+    /// @notice The permissions registry used to grant operator authority over revnets.
+    /// @dev Cached from the deployer at `setDeployer()` time.
+    IJBPermissions public override PERMISSIONS;
+
+    /// @notice The Juicebox project NFT contract.
+    /// @dev Cached from the deployer at `setDeployer()` time. Required for `onERC721Received` authentication.
+    IJBProjects public override PROJECTS;
+
+    //*********************************************************************//
+    // -------------------- internal stored properties ------------------- //
+    //*********************************************************************//
+
+    /// @notice Additional operator permissions configured per revnet on top of the protocol-default set.
+    /// @custom:param revnetId The ID of the revnet to look up.
+    mapping(uint256 revnetId => uint256[] permissionIds) internal _extraOperatorPermissions;
 
     //*********************************************************************//
     // -------------------- private stored properties -------------------- //
@@ -509,15 +552,80 @@ contract REVOwner is IJBRulesetDataHook, IJBCashOutHook, IJBPeerChainAdjustedAcc
         }
     }
 
-    /// @notice Store the cash out delay for a revnet.
-    /// @dev Only callable by the deployer.
-    /// @param revnetId The ID of the revnet.
-    /// @param cashOutDelay The timestamp after which cash outs are allowed.
-    function setCashOutDelayOf(uint256 revnetId, uint256 cashOutDelay) external {
+    /// @notice Bind every piece of revnet-scoped state managed by this contract in a single deployer call. Stores
+    /// the cash-out delay, the tiered ERC-721 hook, auto-issuance allocations, extra operator permissions, the
+    /// initial operator, and any integration-specific permission grants.
+    /// @dev Only callable by the canonical deployer during a revnet's initial configuration. Extra operator
+    /// permissions are appended before the operator is bootstrapped so the operator receives the merged set in a
+    /// single permissions write.
+    /// @param revnetId The ID of the revnet being initialized.
+    /// @param init The full initialization payload.
+    function initializeRevnet(uint256 revnetId, REVOwnerRevnetInit calldata init) external override {
+        // Only the canonical deployer may bind a revnet's runtime state. Any other caller would let an outsider
+        // overwrite cash-out delays, hook addresses, or operator permissions for an existing revnet.
         if (msg.sender != address(deployer)) {
             revert REVOwner_Unauthorized({caller: msg.sender, expectedCaller: address(deployer)});
         }
-        cashOutDelayOf[revnetId] = cashOutDelay;
+
+        // Store the cash-out delay if the deployer computed one (existing revnet landing on a new chain). A zero
+        // delay means cash outs are unlocked immediately, so skip the storage write to save gas in the common case.
+        if (init.cashOutDelay != 0) {
+            cashOutDelayOf[revnetId] = init.cashOutDelay;
+        }
+
+        // Bind the tiered ERC-721 hook the deployer just created for this revnet so `beforePayRecordedWith` can
+        // route NFT-tier mints through it. The deployer always deploys a hook (empty or pre-tiered), so the zero
+        // guard is defensive.
+        if (address(init.tiered721Hook) != address(0)) {
+            tiered721HookOf[revnetId] = init.tiered721Hook;
+        }
+
+        // Record every auto-issuance allocation that lands on this chain. The deployer pre-filtered by `chainId`
+        // and resolved each stage ID to its canonical ruleset ID, so each entry is ready to be claimed later via
+        // `autoIssueFor`. `+=` (instead of `=`) lets the deployer split the same beneficiary across multiple stage
+        // entries without one overwriting another.
+        for (uint256 i; i < init.autoIssuances.length;) {
+            REVOwnerAutoIssuance calldata autoIssuance = init.autoIssuances[i];
+            amountToAutoIssue[revnetId][autoIssuance.stageId][autoIssuance.beneficiary] += autoIssuance.count;
+            unchecked {
+                ++i;
+            }
+        }
+
+        // Append any deployer-supplied extra permissions (e.g. 721 hook admin permissions) to this revnet's
+        // operator set BEFORE bootstrapping the operator below — `_setOperatorOf` reads the merged set, so the
+        // operator must see these extras on its first permissions write.
+        for (uint256 i; i < init.extraOperatorPermissionIds.length;) {
+            _extraOperatorPermissions[revnetId].push(init.extraOperatorPermissionIds[i]);
+            unchecked {
+                ++i;
+            }
+        }
+
+        // Grant the operator the merged default + extra permission set in a single permissions write. Passing
+        // `address(0)` here is the explicit way to launch a revnet with no operator — no permissions get written
+        // because `_setPermissionsFor` is called with the zero address as the holder.
+        _setOperatorOf({revnetId: revnetId, operator: init.operator});
+
+        // Apply per-revnet permission grants for integrations that aren't the operator (e.g. the Croptop
+        // publisher needs `ADJUST_721_TIERS` to post NFTs on the revnet's behalf). Each grant is scoped to a
+        // specific (revnet, operator, permissionId) triple on this contract's account so it does not leak into
+        // the operator's general authority.
+        for (uint256 i; i < init.extraGrants.length;) {
+            REVOwnerExtraGrant calldata grant = init.extraGrants[i];
+            uint8[] memory permissionIds = new uint8[](1);
+            permissionIds[0] = grant.permissionId;
+            _setPermissionsFor({
+                account: address(this), operator: grant.operator, revnetId: revnetId, permissionIds: permissionIds
+            });
+            unchecked {
+                ++i;
+            }
+        }
+
+        // Emit a single marker event for off-chain indexers — the deployer side already emits granular events
+        // (`DeployRevnet`, `StoreAutoIssuanceAmount`, `SetCashOutDelay`) with the underlying data.
+        emit InitializeRevnet({revnetId: revnetId, caller: msg.sender});
     }
 
     /// @notice Bind the canonical deployer address exactly once.
@@ -525,30 +633,145 @@ contract REVOwner is IJBRulesetDataHook, IJBCashOutHook, IJBPeerChainAdjustedAcc
     /// Only that deploy-time binder may call this, which avoids an ambient public initializer where any first caller
     /// could seize the deployer role before the deterministic REVDeployer is actually deployed.
     /// @param newDeployer The canonical REVDeployer instance that will manage revnet runtime state.
-    function setDeployer(IREVDeployer newDeployer) external {
+    function setDeployer(IREVDeployer newDeployer) external override {
         // Only the account that deployed this REVOwner may complete the one-time deployer binding.
         if (msg.sender != _DEPLOYER) revert REVOwner_Unauthorized({caller: msg.sender, expectedCaller: _DEPLOYER});
         // Prevent the deployer binding from being overwritten after initialization.
         if (address(deployer) != address(0)) revert REVOwner_AlreadyInitialized({deployer: address(deployer)});
         // Store the canonical REVDeployer that is authorized to manage runtime hook state.
         deployer = newDeployer;
+        // Cache references read from the deployer so on-chain ownership operations don't need to re-traverse the
+        // deployer for each call. These are immutable on the deployer side so a single snapshot is sufficient.
+        CONTROLLER = newDeployer.CONTROLLER();
+        PERMISSIONS = newDeployer.PERMISSIONS();
+        PROJECTS = newDeployer.PROJECTS();
+
+        // Grant the wildcard operator permissions used by every revnet, scoped on this contract's account.
+        // The loan contract is the singleton shared by all revnets and uses the surplus allowance of each
+        // revnet's terminal. The buyback hook registry configures pools on every revnet.
+        uint8[] memory loanPermissionIds = new uint8[](1);
+        loanPermissionIds[0] = JBPermissionIds.USE_ALLOWANCE;
+        _setPermissionsFor({
+            account: address(this), operator: address(LOANS), revnetId: 0, permissionIds: loanPermissionIds
+        });
+
+        uint8[] memory buybackPermissionIds = new uint8[](1);
+        buybackPermissionIds[0] = JBPermissionIds.SET_BUYBACK_POOL;
+        _setPermissionsFor({
+            account: address(this), operator: address(BUYBACK_HOOK), revnetId: 0, permissionIds: buybackPermissionIds
+        });
+
+        // The deployer drives sucker setup for every revnet (initial deploy + post-deploy via
+        // `REVDeployer.deploySuckersFor`). Grant it `DEPLOY_SUCKERS` and `MAP_SUCKER_TOKEN` against this contract's
+        // account so the sucker registry sees an authorized caller acting for the project owner (this contract).
+        uint8[] memory deployerPermissionIds = new uint8[](2);
+        deployerPermissionIds[0] = JBPermissionIds.DEPLOY_SUCKERS;
+        deployerPermissionIds[1] = JBPermissionIds.MAP_SUCKER_TOKEN;
+        _setPermissionsFor({
+            account: address(this), operator: address(newDeployer), revnetId: 0, permissionIds: deployerPermissionIds
+        });
     }
 
-    /// @notice Store the tiered ERC-721 hook for a revnet.
-    /// @dev Only callable by the deployer.
-    /// @param revnetId The ID of the revnet.
-    /// @param hook The tiered ERC-721 hook.
-    function setTiered721HookOf(uint256 revnetId, IJB721TiersHook hook) external {
-        if (msg.sender != address(deployer)) {
-            revert REVOwner_Unauthorized({caller: msg.sender, expectedCaller: address(deployer)});
+    /// @notice Auto-mint a revnet's tokens from a stage for a beneficiary.
+    /// @dev Permissionless: anyone can trigger the mint once the stage has started. The recorded amount is consumed
+    /// (reset to zero) after the mint executes.
+    /// @param revnetId The ID of the revnet to auto-mint tokens for.
+    /// @param stageId The ID of the ruleset stage to auto-mint tokens from.
+    /// @param beneficiary The address to send auto-minted tokens to.
+    function autoIssueFor(uint256 revnetId, uint256 stageId, address beneficiary) external override {
+        // Get the ruleset for the stage to check if it has started.
+        (JBRuleset memory ruleset,) = CONTROLLER.getRulesetOf({projectId: revnetId, rulesetId: stageId});
+
+        // Make sure the stage has started.
+        // forge-lint: disable-next-line(block-timestamp)
+        if (ruleset.start > block.timestamp) {
+            revert REVOwner_StageNotStarted({stageId: stageId});
+        }
+
+        uint256 count = amountToAutoIssue[revnetId][stageId][beneficiary];
+        if (count == 0) {
+            revert REVOwner_NothingToAutoIssue({revnetId: revnetId, stageId: stageId, beneficiary: beneficiary});
         }
-        tiered721HookOf[revnetId] = hook;
+
+        // Reset before the external call to prevent re-entry from re-claiming.
+        amountToAutoIssue[revnetId][stageId][beneficiary] = 0;
+
+        emit AutoIssue({
+            revnetId: revnetId, stageId: stageId, beneficiary: beneficiary, count: count, caller: msg.sender
+        });
+
+        CONTROLLER.mintTokensOf({
+            projectId: revnetId, tokenCount: count, beneficiary: beneficiary, memo: "", useReservedPercent: false
+        });
+    }
+
+    /// @notice Burn any of a revnet's project tokens that have accumulated on this contract.
+    /// @dev Tokens accrue here from reserved-token distributions when splits don't sum to 100% (the JBController
+    /// mints the leftover to the project owner — which is this contract).
+    /// @param revnetId The ID of the revnet to burn tokens for.
+    function burnHeldTokensOf(uint256 revnetId) external override {
+        // Ask the controller's token registry for this contract's combined credit + ERC-20 balance for the revnet.
+        // This is the residue from reserved-token distributions where the splits don't sum to 100% — the
+        // controller mints the leftover to the project owner, which is this contract.
+        uint256 balance = CONTROLLER.TOKENS().totalBalanceOf({holder: address(this), projectId: revnetId});
+
+        // If there's nothing held, fail early — burning zero would silently no-op and waste the caller's gas.
+        if (balance == 0) revert REVOwner_NothingToBurn({revnetId: revnetId, holder: address(this)});
+
+        // Burn the full held balance through the controller. The controller drains credits first, then any
+        // ERC-20 supply on this contract, so a single call always clears the residue regardless of how it accrued.
+        CONTROLLER.burnTokensOf({holder: address(this), projectId: revnetId, tokenCount: balance, memo: ""});
+
+        // Record the burn for off-chain accounting. `caller` is the address that paid gas, not necessarily a
+        // privileged operator — this entrypoint is intentionally permissionless.
+        emit BurnHeldTokens({revnetId: revnetId, count: balance, caller: msg.sender});
+    }
+
+    /// @notice Change a revnet's operator.
+    /// @dev Only a revnet's current operator can rotate the operator. Passing `address(0)` relinquishes operator
+    /// powers permanently — the permissions move to the zero address which cannot execute transactions.
+    /// @param revnetId The ID of the revnet to change the operator for.
+    /// @param newOperator The new operator's address. Use `address(0)` to relinquish operator powers.
+    function setOperatorOf(uint256 revnetId, address newOperator) external override {
+        _checkIfIsOperatorOf({revnetId: revnetId, operator: msg.sender});
+
+        emit ReplaceOperator({revnetId: revnetId, newOperator: newOperator, caller: msg.sender});
+
+        // Remove operator permissions from the old operator.
+        _setPermissionsFor({
+            account: address(this), operator: msg.sender, revnetId: revnetId, permissionIds: new uint8[](0)
+        });
+
+        // Grant the default operator permissions to the new operator (no-op if `newOperator == address(0)`).
+        _setOperatorOf({revnetId: revnetId, operator: newOperator});
+    }
+
+    /// @notice Required to receive the JBProjects NFT for each revnet that this contract owns.
+    /// @dev Only accepts NFTs from the canonical `JBProjects` contract.
+    function onERC721Received(address, address, uint256, bytes calldata) external view returns (bytes4) {
+        if (msg.sender != address(PROJECTS)) revert();
+        return IERC721Receiver.onERC721Received.selector;
     }
 
     //*********************************************************************//
     // -------------------------- public views --------------------------- //
     //*********************************************************************//
 
+    /// @notice Check whether an address is a revnet's operator.
+    /// @param revnetId The ID of the revnet to check.
+    /// @param addr The address to check.
+    /// @return flag A flag indicating whether the address holds the revnet's operator permissions.
+    function isOperatorOf(uint256 revnetId, address addr) public view override returns (bool) {
+        return PERMISSIONS.hasPermissions({
+            operator: addr,
+            account: address(this),
+            projectId: revnetId,
+            permissionIds: _operatorPermissionIndexesOf(revnetId),
+            includeRoot: false,
+            includeWildcardProjectId: false
+        });
+    }
+
     /// @notice Indicates if this contract adheres to the specified interface.
     /// @dev See `IERC165.supportsInterface`.
     /// @return A flag indicating if the provided interface ID is supported.
@@ -570,6 +793,44 @@ contract REVOwner is IJBRulesetDataHook, IJBCashOutHook, IJBPeerChainAdjustedAcc
         return SUCKER_REGISTRY.isSuckerOf({projectId: revnetId, addr: addr});
     }
 
+    /// @notice The default + custom operator permissions that should be held by a revnet's operator.
+    /// @param revnetId The ID of the revnet to look up.
+    /// @return allOperatorPermissions The merged permission ID list.
+    function _operatorPermissionIndexesOf(uint256 revnetId)
+        internal
+        view
+        returns (uint256[] memory allOperatorPermissions)
+    {
+        uint256[] memory customOperatorPermissionIndexes = _extraOperatorPermissions[revnetId];
+
+        allOperatorPermissions = new uint256[](9 + customOperatorPermissionIndexes.length);
+        allOperatorPermissions[0] = JBPermissionIds.SET_SPLIT_GROUPS;
+        allOperatorPermissions[1] = JBPermissionIds.SET_BUYBACK_POOL;
+        allOperatorPermissions[2] = JBPermissionIds.SET_BUYBACK_TWAP;
+        allOperatorPermissions[3] = JBPermissionIds.SET_PROJECT_URI;
+        allOperatorPermissions[4] = JBPermissionIds.SUCKER_SAFETY;
+        allOperatorPermissions[5] = JBPermissionIds.SET_BUYBACK_HOOK;
+        allOperatorPermissions[6] = JBPermissionIds.SET_ROUTER_TERMINAL;
+        allOperatorPermissions[7] = JBPermissionIds.SET_TOKEN_METADATA;
+        allOperatorPermissions[8] = JBPermissionIds.SIGN_FOR_ERC20;
+
+        for (uint256 i; i < customOperatorPermissionIndexes.length;) {
+            allOperatorPermissions[9 + i] = customOperatorPermissionIndexes[i];
+            unchecked {
+                ++i;
+            }
+        }
+    }
+
+    /// @notice Reverts if `operator` is not the revnet's current operator.
+    /// @param revnetId The ID of the revnet to check.
+    /// @param operator The address to check.
+    function _checkIfIsOperatorOf(uint256 revnetId, address operator) internal view {
+        if (!isOperatorOf({revnetId: revnetId, addr: operator})) {
+            revert REVOwner_UnauthorizedOperator({revnetId: revnetId, caller: operator});
+        }
+    }
+
     /// @notice Total outstanding local loan debt and collateral for a revnet.
     /// @dev This is included in cash-out and peer-snapshot math because borrowed funds are still owed to the revnet
     /// and collateral can re-enter supply when the loan is repaid.
@@ -661,4 +922,44 @@ contract REVOwner is IJBRulesetDataHook, IJBCashOutHook, IJBPeerChainAdjustedAcc
         IERC20(token).safeIncreaseAllowance({spender: to, value: amount});
         return 0;
     }
+
+    /// @notice Grant the revnet's default operator permission set to `operator`.
+    /// @param revnetId The ID of the revnet to scope the permissions for.
+    /// @param operator The address to grant operator permissions to.
+    function _setOperatorOf(uint256 revnetId, address operator) internal {
+        uint256[] memory permissionIndexes = _operatorPermissionIndexesOf(revnetId);
+        uint8[] memory permissionIds = new uint8[](permissionIndexes.length);
+
+        for (uint256 i; i < permissionIndexes.length;) {
+            // forge-lint: disable-next-line(unsafe-typecast)
+            permissionIds[i] = uint8(permissionIndexes[i]);
+            unchecked {
+                ++i;
+            }
+        }
+
+        _setPermissionsFor({
+            account: address(this), operator: operator, revnetId: revnetId, permissionIds: permissionIds
+        });
+    }
+
+    /// @notice Set the permissions on the JB permissions registry, scoped to this revnet.
+    /// @param account The account whose permission slot is being updated. Always `address(this)`.
+    /// @param operator The address whose permissions are being set.
+    /// @param revnetId The ID of the revnet to scope the permissions for.
+    /// @param permissionIds The permission IDs to grant (empty array revokes).
+    function _setPermissionsFor(
+        address account,
+        address operator,
+        uint256 revnetId,
+        uint8[] memory permissionIds
+    )
+        internal
+    {
+        JBPermissionsData memory permissionData =
+        // forge-lint: disable-next-line(unsafe-typecast)
+        JBPermissionsData({operator: operator, projectId: uint64(revnetId), permissionIds: permissionIds});
+
+        PERMISSIONS.setPermissionsFor({account: account, permissionsData: permissionData});
+    }
 }

package/src/interfaces/IREVDeployer.sol

@@ -22,22 +22,6 @@ import {IREVLoans} from "./IREVLoans.sol";
 
 /// @notice Deploys and manages revnets -- Juicebox projects with pre-configured tokenomics.
 interface IREVDeployer {
-    /// @notice Emitted when tokens are auto-issued for a beneficiary during a stage.
-    /// @param revnetId The ID of the revnet.
-    /// @param stageId The ID of the stage.
-    /// @param beneficiary The address receiving the auto-issued tokens.
-    /// @param count The number of tokens auto-issued.
-    /// @param caller The address that triggered the auto-issuance.
-    event AutoIssue(
-        uint256 indexed revnetId, uint256 indexed stageId, address indexed beneficiary, uint256 count, address caller
-    );
-
-    /// @notice Emitted when held tokens are burned from the deployer contract.
-    /// @param revnetId The ID of the revnet whose tokens were burned.
-    /// @param count The number of tokens burned.
-    /// @param caller The address that triggered the burn.
-    event BurnHeldTokens(uint256 indexed revnetId, uint256 count, address caller);
-
     /// @notice Emitted when a new revnet is deployed.
     /// @param revnetId The ID of the deployed revnet.
     /// @param configuration The revnet's configuration.
@@ -68,12 +52,6 @@ interface IREVDeployer {
         address caller
     );
 
-    /// @notice Emitted when the operator of a revnet is replaced.
-    /// @param revnetId The ID of the revnet.
-    /// @param newOperator The address of the new operator.
-    /// @param caller The address that replaced the operator.
-    event ReplaceOperator(uint256 indexed revnetId, address indexed newOperator, address caller);
-
     /// @notice Emitted when the cash out delay is set for a revnet.
     /// @param revnetId The ID of the revnet.
     /// @param cashOutDelay The cash out delay in seconds.
@@ -90,13 +68,6 @@ interface IREVDeployer {
         uint256 indexed revnetId, uint256 indexed stageId, address indexed beneficiary, uint256 count, address caller
     );
 
-    /// @notice The number of revnet tokens that can be auto-minted for a beneficiary during a stage.
-    /// @param revnetId The ID of the revnet.
-    /// @param stageId The ID of the stage.
-    /// @param beneficiary The beneficiary of the auto-mint.
-    /// @return The number of tokens available to auto-issue.
-    function amountToAutoIssue(uint256 revnetId, uint256 stageId, address beneficiary) external view returns (uint256);
-
     /// @notice The buyback hook used as a data hook to route payments through buyback pools.
     /// @return The buyback hook contract.
     function BUYBACK_HOOK() external view returns (IJBBuybackHookRegistry);
@@ -134,12 +105,6 @@ interface IREVDeployer {
     /// @return The hook deployer contract.
     function HOOK_DEPLOYER() external view returns (IJB721TiersHookDeployer);
 
-    /// @notice Check whether an address is a revnet's operator.
-    /// @param revnetId The ID of the revnet to check.
-    /// @param addr The address to check.
-    /// @return A flag indicating whether the address is the revnet's operator.
-    function isOperatorOf(uint256 revnetId, address addr) external view returns (bool);
-
     /// @notice The loan contract used by all revnets.
     /// @return The loans contract address.
     function LOANS() external view returns (IREVLoans);
@@ -172,16 +137,6 @@ interface IREVDeployer {
     /// @return The sucker registry contract.
     function SUCKER_REGISTRY() external view returns (IJBSuckerRegistry);
 
-    /// @notice Auto-mint a revnet's tokens from a stage for a beneficiary.
-    /// @param revnetId The ID of the revnet to auto-mint tokens for.
-    /// @param stageId The ID of the stage to auto-mint tokens from.
-    /// @param beneficiary The address to send auto-minted tokens to.
-    function autoIssueFor(uint256 revnetId, uint256 stageId, address beneficiary) external;
-
-    /// @notice Burn any of a revnet's tokens held by this contract.
-    /// @param revnetId The ID of the revnet to burn tokens for.
-    function burnHeldTokensOf(uint256 revnetId) external;
-
     /// @notice Deploy a revnet with a tiered ERC-721 hook and optional croptop posting support.
     /// @dev Every revnet gets a 721 hook — pass an empty config if no tiers are needed initially.
     /// @param revnetId The ID of the Juicebox project to initialize. Send 0 to deploy a new revnet.
@@ -230,9 +185,4 @@ interface IREVDeployer {
     )
         external
         returns (address[] memory suckers);
-
-    /// @notice Change a revnet's operator. Only the current operator can call this.
-    /// @param revnetId The ID of the revnet.
-    /// @param newOperator The new operator's address.
-    function setOperatorOf(uint256 revnetId, address newOperator) external;
 }