feat: whitelist names before mainnet

contracts/external/revive/ISystem.sol

@@ -13,4 +13,10 @@ interface ISystem {
     /// Returning true iff the immediate caller's substrate origin is `Root`.
     /// Reverts on a `RuntimeOrigin::Signed(_)` or non-Root origin.
     function callerIsRoot() external view returns (bool);
+
+    /// Returning true iff the transaction-level substrate origin is `Root`.
+    /// @dev Reads the stack origin rather than the immediate caller, so it holds through a UUPS
+    ///      proxy's delegatecall frame where `callerIsRoot` returns false. Returns false, rather
+    ///      than reverting, on a non-Root origin.
+    function originIsRoot() external view returns (bool);
 }

contracts/utils/DotnsConstants.sol

@@ -44,6 +44,29 @@ library DotnsConstants {
     ///      or change protocol configuration.
     bytes32 internal constant WHITELIST_OPERATOR_ROLE = keccak256("DOTNS_WHITELIST_OPERATOR_ROLE");
 
+    /// @notice Default per-name live-claim cap the name whitelist starts with.
+    /// @dev Governance retunes it on the whitelist within `WHITELIST_MAX_CLAIMANTS_LIMIT`.
+    uint16 internal constant WHITELIST_DEFAULT_MAX_CLAIMANTS = 64;
+
+    /// @notice Default claim-reason byte cap the name whitelist starts with.
+    /// @dev Governance retunes it on the whitelist within `WHITELIST_MAX_REASON_LIMIT`.
+    uint256 internal constant WHITELIST_DEFAULT_MAX_REASON_BYTES = 256;
+
+    /// @notice Upper bound on the whitelist live-claim cap. Caps the claim clear-loop below the
+    ///         block gas limit.
+    uint16 internal constant WHITELIST_MAX_CLAIMANTS_LIMIT = 128;
+
+    /// @notice Upper bound on the whitelist reason byte cap.
+    uint256 internal constant WHITELIST_MAX_REASON_LIMIT = 256;
+
+    /// @notice Default cap on labels granted in one `grantNames` call.
+    /// @dev Governance retunes it on the whitelist within `WHITELIST_MAX_GRANT_BATCH_LIMIT`.
+    uint16 internal constant WHITELIST_DEFAULT_MAX_GRANT_BATCH = 100;
+
+    /// @notice Upper bound on the `grantNames` batch cap. Bounds one call below the block gas
+    /// limit.
+    uint16 internal constant WHITELIST_MAX_GRANT_BATCH_LIMIT = 256;
+
     /// @notice Well-known key for the ERC721 registrar backing name ownership.
     /// @dev Role: token-of-record for registered names. Mints, burns, and tracks the
     ///      `tokenId => label` mapping consumed by the forward registry on
@@ -140,4 +163,12 @@ library DotnsConstants {
     ///      the protocol registry.
     /// forge-lint: disable-next-line(unsafe-typecast)
     bytes32 internal constant POP_GATEWAY = bytes32("popGateway");
+
+    /// @notice Well-known key for the pre-launch name whitelist that binds a label to the
+    ///         one address permitted to register it.
+    /// @dev Role: authority for label-bound registration grants. Both the public and PoP
+    ///      controllers resolve it here and read it at mint time; the whitelist stores the
+    ///      grants, the controllers only read them.
+    /// forge-lint: disable-next-line(unsafe-typecast)
+    bytes32 internal constant NAME_WHITELIST = bytes32("nameWhitelist");
 }

contracts/utils/SystemUtils.sol

@@ -0,0 +1,21 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.34;
+
+import {ISystem} from "../external/revive/ISystem.sol";
+import {DotnsConstants} from "./DotnsConstants.sol";
+
+/// @title SystemUtils
+/// @notice Shared access to revive's System precompile for DotNS contracts.
+/// @dev Canonical wrapper around `ISystem` at `DotnsConstants.REVIVE_SYSTEM`, so the precompile
+///      address and interface are wired in one place rather than duplicated per consumer.
+/// @custom:security-contact admin@parity.io
+library SystemUtils {
+    /// @notice Returns whether the transaction-level origin is substrate Root.
+    /// @dev Reads the stack origin through `ISystem.originIsRoot`, which holds through a UUPS
+    ///      proxy's delegatecall frame where `callerIsRoot` returns false, and returns false
+    ///      rather than reverting on a non-Root origin.
+    /// @return root True when the transaction origin is Root.
+    function originIsRoot() internal view returns (bool root) {
+        return ISystem(DotnsConstants.REVIVE_SYSTEM).originIsRoot();
+    }
+}