feat(token-mint-authority): add testnet faucet mint-authority program

[0x-r4bbit]

A permissionless faucet that holds the mint authority for faucet token definitions and lets any account self-mint a fixed grant, so testers can fund themselves on testnet. The call chain is user -> token-mint-authority -> token: the program holds no key and delegates every mint to the token program under a PDA seed.

• FaucetMint (no amount) mints a fixed 10_000e18 to the caller, at most once per 24h per (recipient, token definition), via a chained Token::MintWithAuthority authorized by the mint-authority PDA seed.
• Rate limiting is a per-(recipient, definition) MintAllowance PDA (last-mint timestamp), claimed on first use and rewritten thereafter.
• Wall-clock time is read from the system CLOCK_01 account, as the stablecoin program does.

Setup: the faucet token must be created via the token program's NewFungibleDefinition with mint_authority set to compute_mint_authority_pda(<program id>); the program refuses to mint a token whose stored authority is not its PDA.

[Copilot]

🟡 Changes recommended

The faucet currently lacks a critical ownership-consistency check before delegating the chained mint and also over-requests write access for the mint-authority PDA, both of which widen the attack surface.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds a new token_mint_authority program to the LEZ workspace: a permissionless, rate-limited testnet faucet that delegates a fixed mint to the Token Program using a mint-authority PDA seed, with both unit and zkVM integration test coverage.

Changes:

• Introduces token_mint_authority_{core,program,methods,guest} crates implementing FaucetMint + PDA-based cooldown tracking.
• Adds unit + integration tests covering PDA derivation, chained mint behavior, and cooldown enforcement.
• Wires the new program into guest build scripts, workspace manifests/locks, IDL artifacts, and README docs.

File summaries

File	Description
scripts/build-guests.sh	Include token_mint_authority in guest binary packaging.
scripts/build-guests.Dockerfile	Include token_mint_authority in Docker guest build loop.
README.md	Document the new program and update test/build/IDL examples.
Cargo.toml	Add new crates to workspace members and shared deps.
Cargo.lock	Lockfile updates for new crates/deps.
programs/token_mint_authority/src/lib.rs	New host crate entry module.
programs/token_mint_authority/src/faucet_mint.rs	Implements faucet mint host logic + clock read + chained mint.
programs/token_mint_authority/src/test_support.rs	Test account builders and constants.
programs/token_mint_authority/src/tests.rs	Unit tests for cooldown, PDAs, chained call shape, and preconditions.
programs/token_mint_authority/core/src/lib.rs	New core types/constants + PDA derivations + verification helpers.
programs/token_mint_authority/core/Cargo.toml	New core crate manifest.
programs/token_mint_authority/Cargo.toml	New host crate manifest + example deps.
programs/token_mint_authority/examples/mint_authority.rs	Helper to compute/print mint-authority PDA for a built binary.
programs/token_mint_authority/methods/build.rs	Embed guest methods via risc0_build.
programs/token_mint_authority/methods/Cargo.toml	Methods crate manifest.
programs/token_mint_authority/methods/src/lib.rs	Host-side embedded ELF constants include.
programs/token_mint_authority/methods/guest/Cargo.toml	Guest crate manifest.
programs/token_mint_authority/methods/guest/Cargo.lock	Guest lockfile.
programs/token_mint_authority/methods/guest/src/bin/token_mint_authority.rs	Guest entry wiring + FaucetMint instruction handler.
programs/integration_tests/Cargo.toml	Add token-mint-authority core/methods to integration tests.
programs/integration_tests/tests/token_mint_authority.rs	New zkVM E2E tests for faucet behavior.
artifacts/token_mint_authority-idl.json	New IDL for the faucet instruction/accounts.

Review details

• Files reviewed: 20/22 changed files
• Comments generated: 4
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Addressed all comments. Dismissing.