feat(agglayer): correct script allowlists

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## v0.16.0-alpha.4 (2026-07-16)
+
+### Features
+
+- Added the canonical `ExpirationTransactionScript` to the transaction-script allowlists for AggLayer bridge and faucet accounts, allowing the network transaction builder to bound their transaction expiration.
+
 ## v0.16.0-alpha.3 (2026-07-15)
 
 ### Fixes

Cargo.toml

@@ -20,7 +20,7 @@ homepage     = "https://miden.xyz"
 license      = "MIT"
 repository   = "https://github.com/0xMiden/protocol"
 rust-version = "1.96.1"
-version      = "0.16.0-alpha.3"
+version      = "0.16.0-alpha.4"
 
 [profile.release]
 codegen-units = 1
@@ -36,13 +36,13 @@ lto           = true
 
 [workspace.dependencies]
 # Workspace crates
-miden-agglayer     = { default-features = false, path = "crates/miden-agglayer", version = "0.16.0-alpha.3" }
-miden-block-prover = { default-features = false, path = "crates/miden-block-prover", version = "0.16.0-alpha.3" }
-miden-protocol     = { default-features = false, path = "crates/miden-protocol", version = "0.16.0-alpha.3" }
-miden-standards    = { default-features = false, path = "crates/miden-standards", version = "0.16.0-alpha.3" }
-miden-testing      = { default-features = false, path = "crates/miden-testing", version = "0.16.0-alpha.3" }
-miden-tx           = { default-features = false, path = "crates/miden-tx", version = "0.16.0-alpha.3" }
-miden-tx-batch     = { default-features = false, path = "crates/miden-tx-batch", version = "0.16.0-alpha.3" }
+miden-agglayer     = { default-features = false, path = "crates/miden-agglayer", version = "0.16.0-alpha.4" }
+miden-block-prover = { default-features = false, path = "crates/miden-block-prover", version = "0.16.0-alpha.4" }
+miden-protocol     = { default-features = false, path = "crates/miden-protocol", version = "0.16.0-alpha.4" }
+miden-standards    = { default-features = false, path = "crates/miden-standards", version = "0.16.0-alpha.4" }
+miden-testing      = { default-features = false, path = "crates/miden-testing", version = "0.16.0-alpha.4" }
+miden-tx           = { default-features = false, path = "crates/miden-tx", version = "0.16.0-alpha.4" }
+miden-tx-batch     = { default-features = false, path = "crates/miden-tx-batch", version = "0.16.0-alpha.4" }
 
 # Miden dependencies
 miden-assembly         = { default-features = false, version = "0.25" }

crates/miden-agglayer/src/lib.rs

@@ -3,12 +3,12 @@
 extern crate alloc;
 
 use miden_core::{Felt, Word};
-use miden_protocol::account::{Account, AccountBuilder, AccountComponent, AccountId, AccountType};
+use miden_protocol::account::{Account, AccountBuilder, AccountComponent, AccountId};
 use miden_protocol::assembly::Library;
 use miden_protocol::asset::TokenSymbol;
 use miden_protocol::utils::serde::Deserializable;
 use miden_standards::account::access::{Authority, Ownable2Step};
-use miden_standards::account::auth::AuthNetworkAccount;
+use miden_standards::account::auth::NetworkAccount;
 use miden_standards::account::policies::{
     BurnAllowAll,
     BurnPolicy,
@@ -131,22 +131,15 @@ fn create_agglayer_faucet_component(
 ///
 /// The bridge starts with an empty faucet registry. Faucets are registered at runtime
 /// via CONFIG_AGG_BRIDGE notes that call `bridge_config::register_faucet`.
-///
-/// The builder is pre-wired with the [`AuthNetworkAccount`] auth component, initialized with
-/// [`AggLayerBridge::allowed_notes()`] so the bridge only accepts its sanctioned input notes.
 fn create_bridge_account_builder(
     seed: Word,
     bridge_admin_id: AccountId,
     ger_injector_id: AccountId,
     ger_remover_id: AccountId,
 ) -> AccountBuilder {
-    Account::builder(seed.into())
-        .account_type(AccountType::Public)
+    NetworkAccount::builder(seed.into(), AggLayerBridge::allowed_notes())
+        .expect("bridge note allowlist is non-empty")
         .with_component(AggLayerBridge::new(bridge_admin_id, ger_injector_id, ger_remover_id))
-        .with_auth_component(
-            AuthNetworkAccount::with_allowed_notes(AggLayerBridge::allowed_notes())
-                .expect("bridge note allowlist is non-empty"),
-        )
 }
 
 /// Creates a new bridge account with the standard configuration.
@@ -189,8 +182,10 @@ pub fn create_existing_bridge_account(
 ///   mint policy component (`MintOwnerOnly`) and burn policy component (`BurnOwnerOnly`) are
 ///   produced by the manager; `BurnAllowAll` is installed separately as the additional allowed burn
 ///   policy procedure.
-/// - The [`AuthNetworkAccount`] auth component, initialized with
-///   [`AggLayerFaucet::allowed_notes()`] so the faucet only accepts MINT and BURN notes.
+/// - The network-account auth component, installed via [`NetworkAccount::builder`] with
+///   [`AggLayerFaucet::allowed_notes()`] so the faucet only accepts MINT and BURN notes. The
+///   tx-script allowlist contains only the canonical
+///   [`ExpirationTransactionScript`](miden_standards::tx_script::ExpirationTransactionScript).
 fn create_agglayer_faucet_builder(
     seed: Word,
     token_symbol: &str,
@@ -212,17 +207,13 @@ fn create_agglayer_faucet_builder(
         .active_receive_policy(TransferPolicy::allow_all())
         .build();
 
-    Account::builder(seed.into())
-        .account_type(AccountType::Public)
+    NetworkAccount::builder(seed.into(), AggLayerFaucet::allowed_notes())
+        .expect("faucet note allowlist is non-empty")
         .with_component(agglayer_component)
         .with_component(Ownable2Step::new(bridge_account_id))
         .with_component(Authority::OwnerControlled)
         .with_components(token_policy_manager)
         .with_component(BurnAllowAll)
-        .with_auth_component(
-            AuthNetworkAccount::with_allowed_notes(AggLayerFaucet::allowed_notes())
-                .expect("faucet note allowlist is non-empty"),
-        )
 }
 
 /// Creates a new agglayer faucet account with the specified configuration.
@@ -298,3 +289,36 @@ pub fn create_existing_agglayer_faucet_with_callbacks(
     .build_existing()
     .expect("agglayer faucet account should be valid")
 }
+
+// TESTS
+// ================================================================================================
+
+#[cfg(test)]
+mod tests {
+    use miden_protocol::testing::account_id::ACCOUNT_ID_REGULAR_PUBLIC_ACCOUNT_IMMUTABLE_CODE;
+    use miden_standards::tx_script::ExpirationTransactionScript;
+
+    use super::*;
+
+    /// Both agglayer network accounts allowlist the canonical [`ExpirationTransactionScript`],
+    /// which the network transaction builder attaches to every network transaction.
+    #[test]
+    fn agglayer_accounts_allowlist_expiration_tx_script() {
+        let id = AccountId::try_from(ACCOUNT_ID_REGULAR_PUBLIC_ACCOUNT_IMMUTABLE_CODE).unwrap();
+
+        let bridge = create_existing_bridge_account(Word::default(), id, id, id);
+        let faucet = create_existing_agglayer_faucet(
+            Word::default(),
+            "AGG",
+            6,
+            Felt::from(1000u32),
+            Felt::ZERO,
+            id,
+        );
+
+        for account in [bridge, faucet] {
+            let network_account = NetworkAccount::try_from(account).unwrap();
+            assert!(network_account.allows_tx_script(&ExpirationTransactionScript::script_root()));
+        }
+    }
+}

crates/miden-standards/src/account/auth/mod.rs

@@ -23,6 +23,7 @@ mod network_account;
 pub use network_account::{
     AuthNetworkAccount,
     NetworkAccount,
+    NetworkAccountError,
     NetworkAccountNoteAllowlist,
     NetworkAccountNoteAllowlistError,
     NetworkAccountTxScriptAllowlist,

crates/miden-standards/src/account/auth/network_account/mod.rs

@@ -3,7 +3,7 @@ pub use auth_network_account::AuthNetworkAccount;
 
 #[allow(clippy::module_inception)]
 mod network_account;
-pub use network_account::NetworkAccount;
+pub use network_account::{NetworkAccount, NetworkAccountError};
 
 mod note_allowlist;
 pub use note_allowlist::{NetworkAccountNoteAllowlist, NetworkAccountNoteAllowlistError};