feat(chain138): Monad CCIP, token aggregation OMNL gates, HYBX client, and PMM deploy updates.

Relay router, reserve system, oracle publisher, token-aggregation compliance middleware, and Monad deployment scripts.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/deployment/complete-config-monad-chain138.sh

@@ -32,7 +32,8 @@ fi
 DRY_RUN="${DRY_RUN:-0}"
 CHAIN138_RPC="${RPC_URL_138:-${CHAIN138_RPC:-http://192.168.11.211:8545}}"
 MONAD_RPC="${MONAD_MAINNET_RPC:-https://rpc.monad.xyz}"
-if [[ "$MONAD_RPC" =~ infura\.io/v3/?$ ]]; then
+# Infura project keys often lack Monad access — prefer public RPC unless forced.
+if [[ "$MONAD_RPC" =~ infura\.io/v3 ]] && [[ "${MONAD_MAINNET_RPC_FORCE_INFURA:-0}" != "1" ]]; then
   MONAD_RPC="${MONAD_MAINNET_RPC_PUBLIC:-https://rpc.monad.xyz}"
 fi
 CHAIN138_SELECTOR="${CHAIN138_SELECTOR:-}"

scripts/deployment/deploy-chain138-weth-relay-bridge.sh

@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+# Deploy CCIPRelayBridge (WETH) on Chain 138 and authorize on CCIP_RELAY_ROUTER_CHAIN138.
+#
+# Chain 138 Besu rejects Cancun bytecode (PUSH0 / 0x5f). Build + deploy with Paris EVM.
+#
+# Usage: ./scripts/deployment/deploy-chain138-weth-relay-bridge.sh --execute
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+cd "$PROJECT_ROOT"
+
+# shellcheck disable=SC1090
+source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+load_deployment_env --repo-root "$PROJECT_ROOT"
+
+EXECUTE=0
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --execute) EXECUTE=1; shift ;;
+    --dry-run) echo "[DRY RUN] forge create CCIPRelayBridge (Paris, gas ~3.5M)"; exit 0 ;;
+    *) echo "Unknown arg: $1" >&2; exit 1 ;;
+  esac
+done
+
+[[ "$EXECUTE" == "1" ]] || { echo "Pass --execute"; exit 0; }
+require_private_key_env || exit 1
+command -v jq >/dev/null 2>&1 || { echo "jq required"; exit 1; }
+
+RPC="${RPC_URL_138:-http://192.168.11.211:8545}"
+WETH="${WETH9:-0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2}"
+ROUTER="${CCIP_RELAY_ROUTER_CHAIN138:-0xe75d26bc558a28442f30750c6d97bffb46f39abc}"
+GAS_LIMIT_DEPLOY="${GAS_LIMIT_DEPLOY:-3500000}"
+EVM_VERSION_CHAIN138="${EVM_VERSION_CHAIN138:-paris}"
+
+bash "$PROJECT_ROOT/scripts/forge/scope.sh" build relay --evm-version "$EVM_VERSION_CHAIN138" --force
+
+LOG="/tmp/chain138-weth-relay-bridge.log"
+out=$(bash "$PROJECT_ROOT/scripts/forge/scope.sh" create relay contracts/relay/CCIPRelayBridge.sol:CCIPRelayBridge \
+  --rpc-url "$RPC" --private-key "$PRIVATE_KEY" --legacy \
+  --evm-version "$EVM_VERSION_CHAIN138" \
+  --gas-limit "$GAS_LIMIT_DEPLOY" \
+  --broadcast \
+  --constructor-args "$WETH" "$ROUTER" 2>&1) || {
+  printf '%s\n' "$out" | tee "$LOG"
+  exit 1
+}
+printf '%s\n' "$out" | tee "$LOG"
+
+BRIDGE=$(printf '%s\n' "$out" | sed -n 's/.*Deployed to: \(0x[0-9a-fA-F]\{40\}\).*/\1/p' | head -1)
+if [[ -z "$BRIDGE" ]]; then
+  BRIDGE=$(printf '%s\n' "$out" | sed -n 's/.*"contract":"\(0x[0-9a-fA-F]\{40\}\)".*/\1/p' | head -1)
+fi
+if [[ -z "$BRIDGE" ]]; then
+  echo "ERROR: bridge deploy failed — see $LOG" >&2
+  exit 1
+fi
+
+txh=$(printf '%s\n' "$out" | sed -n 's/.*Transaction hash: \(0x[0-9a-fA-F]\{64\}\).*/\1/p' | head -1)
+if [[ -n "$txh" ]]; then
+  st=$(cast receipt "$txh" --json --rpc-url "$RPC" 2>/dev/null | jq -r '.status // "0x0"')
+  if [[ "$st" != "0x1" ]]; then
+    echo "ERROR: deploy tx $txh failed on-chain (status=$st)" >&2
+    exit 1
+  fi
+fi
+
+code=$(cast code "$BRIDGE" --rpc-url "$RPC" 2>/dev/null || echo "0x")
+if [[ -z "$code" || "$code" == "0x" ]]; then
+  echo "ERROR: no bytecode at $BRIDGE" >&2
+  exit 1
+fi
+
+echo "CCIP_RELAY_BRIDGE_CHAIN138_WETH=$BRIDGE"
+
+OK=$(cast call "$ROUTER" "authorizedBridges(address)(bool)" "$BRIDGE" --rpc-url "$RPC" 2>/dev/null || echo "false")
+if [[ "$OK" != "true" ]]; then
+  echo "=== Authorize bridge on relay router ==="
+  cast send "$ROUTER" "authorizeBridge(address)" "$BRIDGE" \
+    --rpc-url "$RPC" --private-key "$PRIVATE_KEY" --legacy --gas-price 5000000000
+fi
+
+echo "Done."

scripts/deployment/deploy-monad-ccip-relay.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+# Deploy CCIPRelayRouter + CCIPRelayBridge on Monad (143) for 138→Monad delivery.
+#
+# Usage:
+#   DRY_RUN=1 ./scripts/deployment/deploy-monad-ccip-relay.sh
+#   ./scripts/deployment/deploy-monad-ccip-relay.sh --execute
+#
+# Records: CCIP_RELAY_ROUTER_MONAD, CCIP_RELAY_BRIDGE_MONAD in .env
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+cd "$PROJECT_ROOT"
+
+# shellcheck disable=SC1090
+source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+load_deployment_env --repo-root "$PROJECT_ROOT"
+
+EXECUTE=0
+DRY_RUN="${DRY_RUN:-0}"
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --execute) EXECUTE=1; shift ;;
+    --dry-run) DRY_RUN=1; shift ;;
+    *) echo "Unknown arg: $1" >&2; exit 1 ;;
+  esac
+done
+
+RPC="${MONAD_MAINNET_RPC:-https://rpc.monad.xyz}"
+if [[ "$RPC" =~ infura\.io/v3 ]] && [[ "${MONAD_MAINNET_RPC_FORCE_INFURA:-0}" != "1" ]]; then
+  RPC="${MONAD_MAINNET_RPC_PUBLIC:-https://rpc.monad.xyz}"
+fi
+
+WMON="${WETH9_MONAD:-${WMON_MAINNET:-0x754704bc059f8c67012fed69bc8a327a5aafb603}}"
+RELAYER="${RELAYER_ADDRESS:-${DEPLOYER_ADDRESS:-0x4A666F96fC8764181194447A7dFdb7d471b301C8}}"
+
+export WETH9_MAINNET="$WMON"
+export RELAYER_ADDRESS="$RELAYER"
+
+echo "=== Deploy CCIP relay on Monad (143) ==="
+echo "RPC: ${RPC%%\?*}"
+echo "WMON (relay bridge token): $WMON"
+echo "Relayer: $RELAYER"
+
+if [[ "$DRY_RUN" == "1" || "$EXECUTE" != "1" ]]; then
+  echo "[DRY RUN] forge script script/DeployCCIPRelay.s.sol:DeployCCIPRelay --rpc-url $RPC --chain-id 143 --broadcast --legacy"
+  [[ "$EXECUTE" != "1" && "$DRY_RUN" != "1" ]] && echo "Pass --execute to broadcast."
+  exit 0
+fi
+
+require_private_key_env || exit 1
+"$SCRIPT_DIR/preflight-monad-deploy.sh"
+
+LOG="/tmp/monad-ccip-relay-deploy.log"
+forge script script/DeployCCIPRelay.s.sol:DeployCCIPRelay \
+  --rpc-url "$RPC" \
+  --chain-id 143 \
+  --private-key "$PRIVATE_KEY" \
+  --broadcast --legacy -vvv 2>&1 | tee "$LOG"
+
+ROUTER=$(grep -oE "CCIPRelayRouter deployed at: 0x[a-fA-F0-9]{40}" "$LOG" | grep -oE "0x[a-fA-F0-9]{40}" | tail -1)
+BRIDGE=$(grep -oE "CCIPRelayBridge deployed at: 0x[a-fA-F0-9]{40}" "$LOG" | grep -oE "0x[a-fA-F0-9]{40}" | tail -1)
+
+if [[ -z "$ROUTER" || -z "$BRIDGE" ]]; then
+  echo "ERROR: could not parse relay addresses from $LOG" >&2
+  exit 1
+fi
+
+echo ""
+echo "CCIP_RELAY_ROUTER_MONAD=$ROUTER"
+echo "CCIP_RELAY_BRIDGE_MONAD=$BRIDGE"
+echo ""
+echo "Add to smom-dbis-138/.env and re-run complete-config / wire-monad scripts."

scripts/deployment/deploy-monad-ccip-stack.sh

@@ -43,7 +43,7 @@ while [[ $# -gt 0 ]]; do
 done
 
 RPC="${MONAD_MAINNET_RPC:-https://rpc.monad.xyz}"
-if [[ "$RPC" =~ infura\.io/v3/?$ ]]; then
+if [[ "$RPC" =~ infura\.io/v3 ]] && [[ "${MONAD_MAINNET_RPC_FORCE_INFURA:-0}" != "1" ]]; then
   RPC="${MONAD_MAINNET_RPC_PUBLIC:-https://rpc.monad.xyz}"
 fi
 CHAIN_ID=143

scripts/deployment/deploy-monad-outbound-138-lane.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# Deploy event-only CCIPRouter + outbound WMON bridge on Monad for Monad→138 relay lane.
+#
+# Usage: ./scripts/deployment/deploy-monad-outbound-138-lane.sh --execute
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+cd "$PROJECT_ROOT"
+
+# shellcheck disable=SC1090
+source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+load_deployment_env --repo-root "$PROJECT_ROOT"
+
+EXECUTE=0
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --execute) EXECUTE=1; shift ;;
+    --dry-run) echo "[DRY RUN] forge DeployMonad138OutboundLane"; exit 0 ;;
+    *) echo "Unknown arg: $1" >&2; exit 1 ;;
+  esac
+done
+
+[[ "$EXECUTE" == "1" ]] || { echo "Pass --execute"; exit 0; }
+require_private_key_env || exit 1
+"$SCRIPT_DIR/preflight-monad-deploy.sh"
+
+RPC="${MONAD_MAINNET_RPC_PUBLIC:-https://rpc.monad.xyz}"
+export WETH9_MONAD="${WETH9_MONAD:-0x754704bc059f8c67012fed69bc8a327a5aafb603}"
+export CCIP_FEE_TOKEN="0x0000000000000000000000000000000000000000"
+export CHAIN138_SELECTOR="${CHAIN138_SELECTOR:-}"
+
+LOG="/tmp/monad-outbound-138-lane.log"
+forge script script/DeployMonad138OutboundLane.s.sol:DeployMonad138OutboundLane \
+  --rpc-url "$RPC" --chain-id 143 --private-key "$PRIVATE_KEY" \
+  --broadcast --legacy -vvv 2>&1 | tee "$LOG"
+
+ROUTER=$(grep -oE "Monad event-only CCIPRouter: 0x[a-fA-F0-9]{40}" "$LOG" | grep -oE "0x[a-fA-F0-9]{40}" | tail -1)
+BRIDGE=$(grep -oE "Monad outbound CCIPWETH9Bridge: 0x[a-fA-F0-9]{40}" "$LOG" | grep -oE "0x[a-fA-F0-9]{40}" | tail -1)
+echo "CCIP_ROUTER_MONAD_SEND=$ROUTER"
+echo "CCIPWETH9_BRIDGE_MONAD_SEND=$BRIDGE"

scripts/deployment/preflight-monad-deploy.sh

@@ -22,8 +22,8 @@ fi
 
 DEPLOYER="${DEPLOYER_ADDRESS:-0x4A666F96fC8764181194447A7dFdb7d471b301C8}"
 RPC="${MONAD_MAINNET_RPC:-https://rpc.monad.xyz}"
-# Infura template without expanded INFURA_PROJECT_ID is unusable — fall back to public RPC
-if [[ "$RPC" =~ infura\.io/v3/?$ ]]; then
+# Infura project keys often lack Monad access — prefer public RPC unless forced.
+if [[ "$RPC" =~ infura\.io/v3 ]] && [[ "${MONAD_MAINNET_RPC_FORCE_INFURA:-0}" != "1" ]]; then
   RPC="${MONAD_MAINNET_RPC_PUBLIC:-https://rpc.monad.xyz}"
 fi
 ROUTER="${CCIP_MONAD_ROUTER:-0x33566fE5976AAa420F3d5C64996641Fc3858CaDB}"

scripts/deployment/proof-ccip-chain138-monad.sh

@@ -64,13 +64,14 @@ if [[ "$DRY_RUN" == "1" ]]; then
 fi
 
 cast send "$WETH" "approve(address,uint256)" "$BRIDGE" "$AMOUNT_WEI" \
-  --rpc-url "$RPC" --private-key "$PRIVATE_KEY" $GAS --async
+  --rpc-url "$RPC" --private-key "$PRIVATE_KEY" $GAS
 cast send "$LINK" "approve(address,uint256)" "$BRIDGE" "$((FEE_WEI + 1))" \
-  --rpc-url "$RPC" --private-key "$PRIVATE_KEY" $GAS --async
-sleep 5
+  --rpc-url "$RPC" --private-key "$PRIVATE_KEY" $GAS
 
 OUT=$(cast send "$BRIDGE" "sendCrossChain(uint64,address,uint256)" "$SEL" "$RECIPIENT" "$AMOUNT_WEI" \
-  --rpc-url "$RPC" --private-key "$PRIVATE_KEY" $GAS --async)
+  --rpc-url "$RPC" --private-key "$PRIVATE_KEY" $GAS --json)
+echo "$OUT"
+HASH=$(echo "$OUT" | jq -r '.transactionHash // empty')
 echo "$OUT"
 HASH=$(echo "$OUT" | awk '/transactionHash/{print $2}')
 REPORT="/home/intlc/projects/proxmox/reports/status/proof-ccip-chain138-monad-latest.json"
@@ -85,7 +86,7 @@ cat > "$REPORT" <<EOF
   "bridge": "$BRIDGE",
   "recipient": "$RECIPIENT",
   "txHash": "${HASH:-}",
-  "note": "138 custom CCIP router is event-only; Monad delivery requires relay profile when available"
+  "note": "138 event-only router; Monad delivery via ccip-relay-monad on r630-01"
 }
 EOF
 echo "Report: $REPORT"

scripts/deployment/proof-ccip-monad-chain138.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Canary CCIP proof: Monad (143) -> Chain 138 via CCIPWETH9Bridge (native MON fees).
+# Canary CCIP proof: Monad (143) -> Chain 138 via CCIPWETH9Bridge send lane (native MON fees).
+# Prefers CCIPWETH9_BRIDGE_MONAD_SEND (custom event-only router); falls back to hub bridge.
 #
 # Usage:
 #   DRY_RUN=1 ./scripts/deployment/proof-ccip-monad-chain138.sh
@@ -25,14 +26,14 @@ fi
 
 DRY_RUN="${DRY_RUN:-0}"
 AMOUNT_ETH="${AMOUNT_ETH:-0.001}"
-MONAD_RPC="${MONAD_MAINNET_RPC_PUBLIC:-https://rpc.monad.xyz}"
-if [[ "${MONAD_MAINNET_RPC:-}" =~ infura\.io/v3/?$ ]]; then
+MONAD_RPC="${MONAD_MAINNET_RPC:-https://rpc.monad.xyz}"
+if [[ "$MONAD_RPC" =~ infura\.io/v3 ]] && [[ "${MONAD_MAINNET_RPC_FORCE_INFURA:-0}" != "1" ]]; then
   MONAD_RPC="${MONAD_MAINNET_RPC_PUBLIC:-https://rpc.monad.xyz}"
-elif [[ -n "${MONAD_MAINNET_RPC:-}" ]]; then
+elif [[ -n "${MONAD_MAINNET_RPC:-}" ]] && [[ "${MONAD_MAINNET_RPC_FORCE_INFURA:-0}" == "1" ]]; then
   MONAD_RPC="$MONAD_MAINNET_RPC"
 fi
 
-BRIDGE="${CCIPWETH9_BRIDGE_MONAD:-}"
+BRIDGE="${CCIPWETH9_BRIDGE_MONAD_SEND:-${CCIPWETH9_BRIDGE_MONAD:-}}"
 WMON="${WMON_MAINNET:-0x754704Bc059F8C67012fEd69BC8A327a5aafb603}"
 SEL="${CHAIN138_SELECTOR:-}"
 
@@ -59,9 +60,15 @@ echo "Recipient (138): $RECIPIENT"
 echo "Selector: $SEL"
 
 FEE_WEI=$(cast call "$BRIDGE" "calculateFee(uint64,uint256)" "$SEL" "$AMOUNT_WEI" --rpc-url "$MONAD_RPC" | cast --to-dec)
-echo "CCIP fee (native MON): $FEE_WEI wei"
+FEE_TOKEN=$(cast call "$BRIDGE" "feeToken()(address)" --rpc-url "$MONAD_RPC")
+ZERO="0x0000000000000000000000000000000000000000"
+if [[ "${FEE_TOKEN,,}" == "${ZERO,,}" ]]; then
+  echo "CCIP fee (native MON): $FEE_WEI wei"
+else
+  echo "CCIP fee (LINK): $FEE_WEI wei"
+fi
 
-BAL=$(cast call "$WMON" "balanceOf(address)(uint256)" "$SENDER" --rpc-url "$MONAD_RPC" | cast --to-dec)
+BAL=$(cast call "$WMON" "balanceOf(address)(uint256)" "$SENDER" --rpc-url "$MONAD_RPC" | awk '{print $1}' | cast --to-dec 2>/dev/null || echo 0)
 echo "Deployer WMON balance: $BAL wei"
 
 if [[ "$BAL" -lt "$AMOUNT_WEI" ]]; then
@@ -86,10 +93,17 @@ fi
 cast send "$WMON" "approve(address,uint256)" "$BRIDGE" "$AMOUNT_WEI" \
   --rpc-url "$MONAD_RPC" --private-key "$PRIVATE_KEY" --legacy
 
-OUT=$(cast send "$BRIDGE" "sendCrossChain(uint64,address,uint256)" "$SEL" "$RECIPIENT" "$AMOUNT_WEI" \
-  --value "$FEE_WEI" --rpc-url "$MONAD_RPC" --private-key "$PRIVATE_KEY" --legacy)
+if [[ "${FEE_TOKEN,,}" != "${ZERO,,}" ]] && [[ "$FEE_WEI" -gt 0 ]]; then
+  cast send "$FEE_TOKEN" "approve(address,uint256)" "$BRIDGE" "$((FEE_WEI + 1))" \
+    --rpc-url "$MONAD_RPC" --private-key "$PRIVATE_KEY" --legacy
+  OUT=$(cast send "$BRIDGE" "sendCrossChain(uint64,address,uint256)" "$SEL" "$RECIPIENT" "$AMOUNT_WEI" \
+    --rpc-url "$MONAD_RPC" --private-key "$PRIVATE_KEY" --legacy --json)
+else
+  OUT=$(cast send "$BRIDGE" "sendCrossChain(uint64,address,uint256)" "$SEL" "$RECIPIENT" "$AMOUNT_WEI" \
+    --value "$FEE_WEI" --rpc-url "$MONAD_RPC" --private-key "$PRIVATE_KEY" --legacy --json)
+fi
 echo "$OUT"
-HASH=$(echo "$OUT" | awk '/transactionHash/{print $2}')
+HASH=$(echo "$OUT" | jq -r '.transactionHash // empty')
 echo ""
 echo "Submitted: $HASH"
 echo "Monad explorer: https://monadscan.com/tx/${HASH}"

scripts/deployment/redeploy-monad-relay-bridge-wmon.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+# Redeploy Monad CCIPRelayBridge with canonical WMON (fixes wrong USDC address at 0x754704…).
+#
+# Usage: ./scripts/deployment/redeploy-monad-relay-bridge-wmon.sh --execute
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+cd "$PROJECT_ROOT"
+
+# shellcheck disable=SC1090
+source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+load_deployment_env --repo-root "$PROJECT_ROOT"
+
+EXECUTE=0
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --execute) EXECUTE=1; shift ;;
+    --dry-run) echo "[DRY RUN] redeploy Monad relay bridge with WMON=$WMON_CANONICAL"; exit 0 ;;
+    *) echo "Unknown arg: $1" >&2; exit 1 ;;
+  esac
+done
+
+[[ "$EXECUTE" == "1" ]] || { echo "Pass --execute"; exit 0; }
+require_private_key_env || exit 1
+command -v jq >/dev/null 2>&1 || { echo "jq required"; exit 1; }
+
+RPC="${MONAD_MAINNET_RPC_PUBLIC:-https://rpc.monad.xyz}"
+WMON_CANONICAL="${WMON_MAINNET:-0x3bd359C1119dA7Da1D913D1C4D2B7c461115433A}"
+ROUTER="${CCIP_RELAY_ROUTER_MONAD:-0x89dd12025bfCD38A168455A44B400e913ED33BE2}"
+
+sym=$(cast call "$WMON_CANONICAL" "symbol()(string)" --rpc-url "$RPC" 2>/dev/null | tr -d '"' || echo "?")
+[[ "$sym" == "WMON" ]] || { echo "ERROR: $WMON_CANONICAL symbol=$sym (expected WMON)" >&2; exit 1; }
+
+echo "=== Redeploy Monad CCIPRelayBridge (WMON=$WMON_CANONICAL) ==="
+
+LOG="/tmp/monad-relay-bridge-wmon.log"
+out=$(bash "$PROJECT_ROOT/scripts/forge/scope.sh" create relay contracts/relay/CCIPRelayBridge.sol:CCIPRelayBridge \
+  --rpc-url "$RPC" --private-key "$PRIVATE_KEY" --legacy \
+  --gas-limit 3500000 --broadcast \
+  --constructor-args "$WMON_CANONICAL" "$ROUTER" 2>&1) || {
+  printf '%s\n' "$out" | tee "$LOG"
+  exit 1
+}
+printf '%s\n' "$out" | tee "$LOG"
+
+BRIDGE=$(printf '%s\n' "$out" | sed -n 's/.*Deployed to: \(0x[0-9a-fA-F]\{40\}\).*/\1/p' | head -1)
+[[ -n "$BRIDGE" ]] || { echo "ERROR: parse bridge address failed" >&2; exit 1; }
+
+OK=$(cast call "$ROUTER" "authorizedBridges(address)(bool)" "$BRIDGE" --rpc-url "$RPC" 2>/dev/null || echo "false")
+if [[ "$OK" != "true" ]]; then
+  cast send "$ROUTER" "authorizeBridge(address)" "$BRIDGE" \
+    --rpc-url "$RPC" --private-key "$PRIVATE_KEY" --legacy --gas-limit 200000
+fi
+
+echo ""
+echo "CCIP_RELAY_BRIDGE_MONAD=$BRIDGE"
+echo "Update smom-dbis-138/.env and re-run wire-monad-chain138-relay.sh --execute"

scripts/deployment/redeploy-monad-send-bridge-wmon.sh

@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+# Redeploy Monad outbound CCIPWETH9Bridge with canonical WMON on existing send router.
+#
+# Usage: ./scripts/deployment/redeploy-monad-send-bridge-wmon.sh --execute
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+cd "$PROJECT_ROOT"
+
+# shellcheck disable=SC1090
+source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+load_deployment_env --repo-root "$PROJECT_ROOT"
+
+EXECUTE=0
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --execute) EXECUTE=1; shift ;;
+    --dry-run) echo "[DRY RUN] redeploy Monad send bridge"; exit 0 ;;
+    *) echo "Unknown arg: $1" >&2; exit 1 ;;
+  esac
+done
+
+[[ "$EXECUTE" == "1" ]] || { echo "Pass --execute"; exit 0; }
+require_private_key_env || exit 1
+
+RPC="${MONAD_MAINNET_RPC_PUBLIC:-https://rpc.monad.xyz}"
+WMON="${WMON_MAINNET:-0x3bd359C1119dA7Da1D913D1C4D2B7c461115433A}"
+ROUTER="${CCIP_ROUTER_MONAD_SEND:-0x937824f2516fa58f25aeAb92E7BFf7D74F463B4c}"
+FEE="${CCIP_FEE_TOKEN:-0x0000000000000000000000000000000000000000}"
+CH138_SEL="${CHAIN138_SELECTOR:-16015286601757825753}"
+CH138_BRIDGE="${CCIP_RELAY_BRIDGE_CHAIN138_WETH:-}"
+
+sym=$(cast call "$WMON" "symbol()(string)" --rpc-url "$RPC" 2>/dev/null | tr -d '"' || echo "?")
+[[ "$sym" == "WMON" ]] || { echo "ERROR: $WMON symbol=$sym (expected WMON)" >&2; exit 1; }
+
+echo "=== Redeploy Monad outbound CCIPWETH9Bridge ==="
+echo "Router: $ROUTER  WMON: $WMON"
+
+LOG="/tmp/monad-send-bridge-wmon.log"
+out=$(bash "$PROJECT_ROOT/scripts/forge/scope.sh" create ccip contracts/ccip/CCIPWETH9Bridge.sol:CCIPWETH9Bridge \
+  --rpc-url "$RPC" --private-key "$PRIVATE_KEY" --legacy \
+  --gas-limit 5000000 --broadcast \
+  --constructor-args "$ROUTER" "$WMON" "$FEE" 2>&1) || {
+  printf '%s\n' "$out" | tee "$LOG"
+  exit 1
+}
+printf '%s\n' "$out" | tee "$LOG"
+
+BRIDGE=$(printf '%s\n' "$out" | sed -n 's/.*Deployed to: \(0x[0-9a-fA-F]\{40\}\).*/\1/p' | head -1)
+[[ -n "$BRIDGE" ]] || { echo "ERROR: parse bridge address failed" >&2; exit 1; }
+
+if [[ -n "$CH138_BRIDGE" ]]; then
+  enabled=$(cast call "$BRIDGE" "destinations(uint64)(uint64,address,bool)" "$CH138_SEL" --rpc-url "$RPC" 2>/dev/null | awk 'NR==3{print $1}')
+  if [[ "$enabled" != "true" ]]; then
+    cast send "$BRIDGE" "addDestination(uint64,address)" "$CH138_SEL" "$CH138_BRIDGE" \
+      --rpc-url "$RPC" --private-key "$PRIVATE_KEY" --legacy --gas-limit 300000
+  else
+    cast send "$BRIDGE" "updateDestination(uint64,address)" "$CH138_SEL" "$CH138_BRIDGE" \
+      --rpc-url "$RPC" --private-key "$PRIVATE_KEY" --legacy --gas-limit 300000
+  fi
+fi
+
+echo ""
+echo "CCIPWETH9_BRIDGE_MONAD_SEND=$BRIDGE"

scripts/deployment/seed-chain138-canonical-pmm-pools.sh

@@ -130,12 +130,12 @@ for row in "${PAIRS[@]}"; do
   base_balance="$(balance_for "$base_token" "$DEPLOYER")"
   quote_balance="$(balance_for "$quote_token" "$DEPLOYER")"
   if (( base_balance < base_amount )); then
-    echo "FAIL seed $label -> insufficient $base_sym balance ($base_balance < $base_amount)"
-    exit 1
+    echo "SKIP seed $label -> insufficient $base_sym balance ($base_balance < $base_amount)"
+    continue
   fi
   if (( quote_balance < quote_amount )); then
-    echo "FAIL seed $label -> insufficient $quote_sym balance ($quote_balance < $quote_amount)"
-    exit 1
+    echo "SKIP seed $label -> insufficient $quote_sym balance ($quote_balance < $quote_amount)"
+    continue
   fi
 
   approve_if_needed "$base_token"

scripts/deployment/wire-monad-chain138-relay.sh

@@ -0,0 +1,118 @@
+#!/usr/bin/env bash
+# Wire Monad↔138 relay lanes after CCIP relay contracts are deployed.
+#
+# 138→Monad: updateDestination on 138 bridges → CCIP_RELAY_BRIDGE_MONAD
+# Monad→138: addDestination on CCIPWETH9_BRIDGE_MONAD_SEND → CCIP_RELAY_BRIDGE_CHAIN138
+# Authorize 138 WETH relay bridge on CCIP_RELAY_ROUTER_CHAIN138
+#
+# Usage:
+#   DRY_RUN=1 ./scripts/deployment/wire-monad-chain138-relay.sh
+#   ./scripts/deployment/wire-monad-chain138-relay.sh --execute
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+cd "$PROJECT_ROOT"
+
+# shellcheck disable=SC1090
+source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+load_deployment_env --repo-root "$PROJECT_ROOT"
+
+EXECUTE=0
+DRY_RUN="${DRY_RUN:-0}"
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --execute) EXECUTE=1; shift ;;
+    --dry-run) DRY_RUN=1; shift ;;
+    *) echo "Unknown arg: $1" >&2; exit 1 ;;
+  esac
+done
+
+RPC138="${RPC_URL_138:-http://192.168.11.211:8545}"
+MONAD_RPC="${MONAD_MAINNET_RPC_PUBLIC:-https://rpc.monad.xyz}"
+if [[ "${MONAD_MAINNET_RPC:-}" =~ infura\.io/v3 ]] && [[ "${MONAD_MAINNET_RPC_FORCE_INFURA:-0}" != "1" ]]; then
+  MONAD_RPC="${MONAD_MAINNET_RPC_PUBLIC:-https://rpc.monad.xyz}"
+fi
+
+MONAD_SEL="${MONAD_SELECTOR:-8481857512324358265}"
+CH138_SEL="${CHAIN138_SELECTOR:-}"
+W9_138="${CCIPWETH9_BRIDGE_CHAIN138:-}"
+W10_138="${CCIPWETH10_BRIDGE_CHAIN138:-}"
+MONAD_RELAY_BRIDGE="${CCIP_RELAY_BRIDGE_MONAD:-}"
+MONAD_SEND_BRIDGE="${CCIPWETH9_BRIDGE_MONAD_SEND:-}"
+CH138_RELAY_ROUTER="${CCIP_RELAY_ROUTER_CHAIN138:-}"
+CH138_RELAY_BRIDGE="${CCIP_RELAY_BRIDGE_CHAIN138_WETH:-}"
+GAS_138="--legacy --gas-limit 250000 --gas-price 15000000000 --timeout 600"
+
+missing=0
+for v in CH138_SEL W9_138 W10_138 MONAD_RELAY_BRIDGE CH138_RELAY_ROUTER CH138_RELAY_BRIDGE MONAD_SEND_BRIDGE; do
+  if [[ -z "${!v}" ]]; then
+    echo "Missing: $v" >&2
+    missing=1
+  fi
+done
+[[ "$missing" == 1 ]] && exit 1
+
+require_private_key_env || exit 1
+
+update_dest() {
+  local rpc="$1" bridge="$2" sel="$3" receiver="$4" label="$5" gas="$6"
+  local current enabled
+  current=$(cast call "$bridge" "destinations(uint64)(uint64,address,bool)" "$sel" --rpc-url "$rpc" 2>/dev/null | awk 'NR==2{print $1}')
+  enabled=$(cast call "$bridge" "destinations(uint64)(uint64,address,bool)" "$sel" --rpc-url "$rpc" 2>/dev/null | awk 'NR==3{print $1}')
+  if [[ "${enabled,,}" == "true" && "${current,,}" == "${receiver,,}" ]]; then
+    echo "Skip (aligned): $label"
+    return 0
+  fi
+  if [[ "$DRY_RUN" == "1" ]]; then
+    echo "[DRY RUN] $label: updateDestination($sel,$receiver) on $bridge"
+    return 0
+  fi
+  echo "=== $label ==="
+  # shellcheck disable=SC2086
+  cast send "$bridge" "updateDestination(uint64,address)" "$sel" "$receiver" \
+    --rpc-url "$rpc" --private-key "$PRIVATE_KEY" $gas
+}
+
+add_dest() {
+  local rpc="$1" bridge="$2" sel="$3" receiver="$4" label="$5" gas="$6"
+  local enabled
+  enabled=$(cast call "$bridge" "destinations(uint64)(uint64,address,bool)" "$sel" --rpc-url "$rpc" 2>/dev/null | awk 'NR==3{print $1}')
+  if [[ "$enabled" == "true" ]]; then
+    update_dest "$rpc" "$bridge" "$sel" "$receiver" "$label (update)" "$gas"
+    return 0
+  fi
+  if [[ "$DRY_RUN" == "1" ]]; then
+    echo "[DRY RUN] $label: addDestination($sel,$receiver) on $bridge"
+    return 0
+  fi
+  echo "=== $label ==="
+  # shellcheck disable=SC2086
+  cast send "$bridge" "addDestination(uint64,address)" "$sel" "$receiver" \
+    --rpc-url "$rpc" --private-key "$PRIVATE_KEY" $gas
+}
+
+authorize_bridge() {
+  local rpc="$1" router="$2" bridge="$3"
+  local ok
+  ok=$(cast call "$router" "authorizedBridges(address)(bool)" "$bridge" --rpc-url "$rpc" 2>/dev/null || echo "false")
+  if [[ "$ok" == "true" ]]; then
+    echo "Skip: $bridge already authorized on $router"
+    return 0
+  fi
+  if [[ "$DRY_RUN" == "1" ]]; then
+    echo "[DRY RUN] authorizeBridge($bridge) on $router"
+    return 0
+  fi
+  echo "=== Authorize 138 WETH relay bridge on router ==="
+  cast send "$router" "authorizeBridge(address)" "$bridge" \
+    --rpc-url "$rpc" --private-key "$PRIVATE_KEY" $GAS_138
+}
+
+echo "=== Wire Monad↔138 relay destinations ==="
+update_dest "$RPC138" "$W9_138" "$MONAD_SEL" "$MONAD_RELAY_BRIDGE" "138 WETH9 → Monad relay bridge" "$GAS_138"
+update_dest "$RPC138" "$W10_138" "$MONAD_SEL" "$MONAD_RELAY_BRIDGE" "138 WETH10 → Monad relay bridge" "$GAS_138"
+add_dest "$MONAD_RPC" "$MONAD_SEND_BRIDGE" "$CH138_SEL" "$CH138_RELAY_BRIDGE" "Monad send → 138 WETH relay bridge" "--legacy --timeout 600"
+authorize_bridge "$RPC138" "$CH138_RELAY_ROUTER" "$CH138_RELAY_BRIDGE"
+echo "Done."

scripts/forge/scope.sh

@@ -250,7 +250,7 @@ prepare_scope_env() {
   elif [[ "$scope" == "m00-diamond" ]]; then
     export FOUNDRY_SRC="contracts/m00-diamond,contracts/rwa"
     export FOUNDRY_PROFILE="${FOUNDRY_PROFILE:-m00-diamond}"
-  elif [[ "$scope" == "oracle" ]]; then
+  elif [[ "$scope" == "oracle" || "$scope" == "reserve" ]]; then
     export FOUNDRY_SRC="$src_dir"
     export FOUNDRY_PROFILE="${FOUNDRY_PROFILE:-chain138}"
   else
@@ -338,7 +338,7 @@ main() {
           if [[ "$scope" != "full" && -z "${FOUNDRY_TEST:-}" ]]; then
             die "scope '$scope' has no matching test/<scope> directory"
           fi
-          exec forge test "$@"
+          exec forge test --skip script "$@"
           ;;
         script)
           [[ $# -gt 0 ]] || die "script command requires a script target, e.g. script/treasury/DeployTreasuryExecutor138.s.sol:DeployTreasuryExecutor138"