feat: restore operator WIP — PMM JSON sync entrypoint, dotenv RPC trim + secrets, pool env alignment

- Resolve stash: merge load_deployment_env path with secure-secrets and CR/LF RPC strip - create-pmm-full-mesh-chain138.sh delegates to sync-chain138-pmm-pools-from-json.sh - env.additions.example: canonical PMM pool defaults (cUSDT/USDT per crosscheck) - Include Chain138 scripts, official mirror deploy scaffolding, and prior staged changes Made-with: Cursor
2026-03-27 19:02:30 -07:00
parent c6e7bad15e
commit 2a4753eb2d
200 changed files with 5987 additions and 913 deletions
--- a/scripts/bridge/fund-bsc-relay-bridge.sh
+++ b/scripts/bridge/fund-bsc-relay-bridge.sh
@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+cd "$PROJECT_ROOT"
+
+source "$PROJECT_ROOT/scripts/lib/deployment/dotenv.sh"
+load_deployment_env
+
+if [[ -f "$PROJECT_ROOT/services/relay/.env.bsc" ]]; then
+  set -a
+  # shellcheck disable=SC1091
+  source "$PROJECT_ROOT/services/relay/.env.bsc"
+  set +a
+fi
+
+DRY_RUN=0
+AMOUNT_WEI=""
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --dry-run)
+      DRY_RUN=1
+      shift
+      ;;
+    *)
+      if [[ -z "$AMOUNT_WEI" ]]; then
+        AMOUNT_WEI="$1"
+      fi
+      shift
+      ;;
+  esac
+done
+
+RPC_URL="${DEST_RPC_URL:-${BSC_RPC_URL:-${BSC_MAINNET_RPC:-}}}"
+BRIDGE_ADDRESS="${DEST_RELAY_BRIDGE:-}"
+WETH_ADDRESS="${DEST_WETH9_ADDRESS:-0x2170Ed0880ac9A755fd29B2688956BD959F933F8}"
+
+if [[ -z "${PRIVATE_KEY:-}" ]]; then
+  echo "Set PRIVATE_KEY in .env" >&2
+  exit 1
+fi
+if [[ -z "$RPC_URL" ]]; then
+  echo "Set BSC_RPC_URL (or BSC_MAINNET_RPC / DEST_RPC_URL) in .env" >&2
+  exit 1
+fi
+if [[ -z "$BRIDGE_ADDRESS" ]]; then
+  echo "Set DEST_RELAY_BRIDGE in services/relay/.env.bsc" >&2
+  exit 1
+fi
+
+DEPLOYER="$(cast wallet address --private-key "$PRIVATE_KEY")"
+
+if [[ -z "$AMOUNT_WEI" ]]; then
+  AMOUNT_WEI="$(cast call "$WETH_ADDRESS" "balanceOf(address)(uint256)" "$DEPLOYER" --rpc-url "$RPC_URL")"
+fi
+
+if [[ -z "$AMOUNT_WEI" || "$AMOUNT_WEI" == "0" ]]; then
+  if [[ "$DRY_RUN" == "1" ]]; then
+    AMOUNT_WEI="1000000000000000"
+    echo "No BSC WETH available; using placeholder amount for dry-run: $AMOUNT_WEI wei"
+  else
+    echo "No BSC WETH available to fund the BSC relay bridge." >&2
+    exit 1
+  fi
+fi
+
+CMD=(cast send "$WETH_ADDRESS" "transfer(address,uint256)" "$BRIDGE_ADDRESS" "$AMOUNT_WEI" --rpc-url "$RPC_URL" --private-key "$PRIVATE_KEY" --legacy)
+DRY_CMD=(cast send "$WETH_ADDRESS" "transfer(address,uint256)" "$BRIDGE_ADDRESS" "$AMOUNT_WEI" --rpc-url "$RPC_URL" --private-key "<PRIVATE_KEY>" --legacy)
+
+echo "BSC relay funding"
+echo "  Deployer: $DEPLOYER"
+echo "  WETH:     $WETH_ADDRESS"
+echo "  Bridge:   $BRIDGE_ADDRESS"
+echo "  Amount:   $AMOUNT_WEI wei"
+
+if [[ "$DRY_RUN" == "1" ]]; then
+  printf '  [DRY RUN] '
+  printf '%q ' "${DRY_CMD[@]}"
+  printf '\n'
+  exit 0
+fi
+
+"${CMD[@]}"
--- a/scripts/bridge/fund-mainnet-relay-bridge.sh
+++ b/scripts/bridge/fund-mainnet-relay-bridge.sh
@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+cd "$PROJECT_ROOT"
+
+source "$PROJECT_ROOT/scripts/lib/deployment/dotenv.sh"
+load_deployment_env
+
+DRY_RUN=0
+AMOUNT_WEI=""
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --dry-run)
+      DRY_RUN=1
+      shift
+      ;;
+    *)
+      if [[ -z "$AMOUNT_WEI" ]]; then
+        AMOUNT_WEI="$1"
+      fi
+      shift
+      ;;
+  esac
+done
+
+RPC_URL="${RPC_URL_MAINNET:-${ETHEREUM_MAINNET_RPC:-}}"
+BRIDGE_ADDRESS="${CCIP_RELAY_BRIDGE_MAINNET:-${RELAY_BRIDGE_MAINNET:-${CW_BRIDGE_MAINNET:-}}}"
+WETH_ADDRESS="${WETH9_MAINNET:-0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2}"
+
+if [[ -z "${PRIVATE_KEY:-}" ]]; then
+  echo "Set PRIVATE_KEY in .env" >&2
+  exit 1
+fi
+if [[ -z "$RPC_URL" ]]; then
+  echo "Set ETHEREUM_MAINNET_RPC (or RPC_URL_MAINNET) in .env" >&2
+  exit 1
+fi
+if [[ -z "$BRIDGE_ADDRESS" ]]; then
+  echo "Set CCIP_RELAY_BRIDGE_MAINNET (or RELAY_BRIDGE_MAINNET / CW_BRIDGE_MAINNET) in .env" >&2
+  exit 1
+fi
+
+DEPLOYER="$(cast wallet address --private-key "$PRIVATE_KEY")"
+
+if [[ -z "$AMOUNT_WEI" ]]; then
+  AMOUNT_WEI="$(cast call "$WETH_ADDRESS" "balanceOf(address)(uint256)" "$DEPLOYER" --rpc-url "$RPC_URL")"
+fi
+
+if [[ -z "$AMOUNT_WEI" || "$AMOUNT_WEI" == "0" ]]; then
+  if [[ "$DRY_RUN" == "1" ]]; then
+    AMOUNT_WEI="1000000000000000"
+    echo "No WETH available; using placeholder amount for dry-run: $AMOUNT_WEI wei"
+  else
+    echo "No WETH available to fund the Mainnet relay bridge." >&2
+    exit 1
+  fi
+fi
+
+CMD=(cast send "$WETH_ADDRESS" "transfer(address,uint256)" "$BRIDGE_ADDRESS" "$AMOUNT_WEI" --rpc-url "$RPC_URL" --private-key "$PRIVATE_KEY" --legacy)
+DRY_CMD=(cast send "$WETH_ADDRESS" "transfer(address,uint256)" "$BRIDGE_ADDRESS" "$AMOUNT_WEI" --rpc-url "$RPC_URL" --private-key "<PRIVATE_KEY>" --legacy)
+
+echo "Mainnet relay funding"
+echo "  Deployer: $DEPLOYER"
+echo "  WETH:     $WETH_ADDRESS"
+echo "  Bridge:   $BRIDGE_ADDRESS"
+echo "  Amount:   $AMOUNT_WEI wei"
+
+if [[ "$DRY_RUN" == "1" ]]; then
+  printf '  [DRY RUN] '
+  printf '%q ' "${DRY_CMD[@]}"
+  printf '\n'
+  exit 0
+fi
+
+"${CMD[@]}"
--- a/scripts/configuration/check-link-balance-at-address.sh
+++ b/scripts/configuration/check-link-balance-at-address.sh
@@ -20,12 +20,15 @@ log_success() { echo -e "${GREEN}[✓]${NC} $1"; }
 log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
 log_error() { echo -e "${RED}[ERROR]${NC} $1"; }

-# Load environment
-if [ -f "$PROJECT_ROOT/.env" ]; then
+if [[ -f "$PROJECT_ROOT/scripts/lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/scripts/lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "$PROJECT_ROOT"
+elif [ -f "$PROJECT_ROOT/.env" ]; then
    source "$PROJECT_ROOT/.env" 2>/dev/null || true
 fi

-if [ -z "$PRIVATE_KEY" ]; then
+if [ -z "${PRIVATE_KEY:-}" ]; then
    log_error "PRIVATE_KEY not set in .env"
    exit 1
 fi
--- a/scripts/configuration/check-link-balance.sh
+++ b/scripts/configuration/check-link-balance.sh
@@ -7,6 +7,7 @@ set -e

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+cd "$PROJECT_ROOT" 2>/dev/null || true

 # Colors
 RED='\033[0;31m'
@@ -21,12 +22,15 @@ log_success() { echo -e "${GREEN}[✓]${NC} $1"; }
 log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
 log_error() { echo -e "${RED}[ERROR]${NC} $1"; }

-# Load environment
-if [ -f "$PROJECT_ROOT/.env" ]; then
+if [[ -f "$PROJECT_ROOT/scripts/lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/scripts/lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "$PROJECT_ROOT"
+elif [ -f "$PROJECT_ROOT/.env" ]; then
    source "$PROJECT_ROOT/.env" 2>/dev/null || true
 fi

-if [ -z "$PRIVATE_KEY" ]; then
+if [ -z "${PRIVATE_KEY:-}" ]; then
    log_error "PRIVATE_KEY not set in .env"
    exit 1
 fi
--- a/scripts/configuration/execute-full-bidirectional-config.sh
+++ b/scripts/configuration/execute-full-bidirectional-config.sh
@@ -1,14 +1,24 @@
 #!/usr/bin/env bash
+# Full bidirectional bridge configuration (Ethereum mainnet ↔ Chain 138).
+# Legacy scripts under scripts/configuration/configure-chain138-* were removed; this delegates to deployment helpers.

-# Execute Full Bidirectional Bridge Configuration
-# This script attempts to configure both directions using available selector information
-
-set -e
+set -euo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+cd "$PROJECT_ROOT"
+
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "$PROJECT_ROOT"
+elif [[ -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+fi

-# Colors
 RED='\033[0;31m'
 GREEN='\033[0;32m'
 YELLOW='\033[1;33m'
@@ -16,54 +26,21 @@ BLUE='\033[0;34m'
 NC='\033[0m'

 log_info() { echo -e "${BLUE}[INFO]${NC} $1"; }
+log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
 log_success() { echo -e "${GREEN}[✓]${NC} $1"; }
 log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
-log_error() { echo -e "${RED}[ERROR]${NC} $1"; }

-log_info "=== Full Bidirectional Bridge Configuration ==="
-log_info ""
+log_info "=== Mainnet ↔ Chain 138 (WETH9/WETH10 bridges) ==="
+bash "$PROJECT_ROOT/scripts/deployment/execute-bridge-config.sh" || log_warn "execute-bridge-config.sh exited non-zero (review output)."

-# Load environment if available
-if [ -f "$PROJECT_ROOT/.env" ]; then
-    source "$PROJECT_ROOT/.env" 2>/dev/null || true
-fi
+log_info "=== Config-ready chains (Gnosis/Cronos/Celo/Wemix) ==="
+log_info "When bridge addresses are in .env, run: scripts/deployment/complete-config-ready-chains.sh"

-# Step 1: Configure ChainID 138 → Mainnet (always possible)
-log_info "Step 1: Configuring ChainID 138 → Mainnet..."
-./scripts/configuration/configure-chain138-to-mainnet.sh
-
-log_info ""
-log_info "---"
-
-# Step 2: Try to configure Mainnet → ChainID 138 (if selector available)
-log_info "Step 2: Attempting Mainnet → ChainID 138 configuration..."
-
-# Get selector from networks.json if not in env
-if [ -z "$CHAIN138_SELECTOR" ] && [ -f "$PROJECT_ROOT/networks.json" ]; then
-    CHAIN138_SELECTOR=$(python3 -c "import json; data=json.load(open('$PROJECT_ROOT/networks.json')); print(data['networks']['138']['chainSelector'])" 2>/dev/null || echo "")
-    if [ -n "$CHAIN138_SELECTOR" ]; then
-        log_info "Using ChainID 138 selector from networks.json: $CHAIN138_SELECTOR"
-        export CHAIN138_SELECTOR
-    fi
-fi
-
-if [ -n "$CHAIN138_SELECTOR" ]; then
-    ./scripts/configuration/configure-mainnet-to-chain138.sh
-    log_success "✓ Bidirectional configuration complete!"
+log_info "=== Optional verification ==="
+if [[ -x "$PROJECT_ROOT/scripts/verify-bridge-setup-checklist.sh" ]]; then
+  bash "$PROJECT_ROOT/scripts/verify-bridge-setup-checklist.sh" || log_warn "Checklist reported issues (non-fatal)."
 else
-    log_warn "⚠ ChainID 138 selector not available - only ChainID 138 → Mainnet configured"
-    log_info "To complete bidirectional setup:"
-    log_info "1. Determine ChainID 138 selector"
-    log_info "2. Set in .env: CHAIN138_SELECTOR=<selector>"
-    log_info "3. Run: ./scripts/configuration/configure-mainnet-to-chain138.sh"
+  log_warn "verify-bridge-setup-checklist.sh not found or not executable."
 fi

-log_info ""
-log_info "---"
-
-# Step 3: Verify configuration
-log_info "Step 3: Verifying configuration..."
-./scripts/configuration/verify-bridge-configuration.sh
-
-log_info ""
-log_success "=== Configuration Process Complete ==="
+log_success "=== Done ==="
--- a/scripts/configuration/find-chain-selector.sh
+++ b/scripts/configuration/find-chain-selector.sh
@@ -19,7 +19,10 @@ log_success() { echo -e "${GREEN}[✓]${NC} $1"; }
 log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }

 # Load environment variables
+# Default matches operator LAN Core RPC (see project AGENTS.md / rules).
 CHAIN138_RPC="${RPC_URL_138:-http://192.168.11.211:8545}"
+CHAIN138_RPC="${CHAIN138_RPC%$'\r'}"
+CHAIN138_RPC="${CHAIN138_RPC%$'\n'}"
 CCIP_ROUTER_138="${CCIP_ROUTER_138:-0x42DAb7b888Dd382bD5Adcf9E038dBF1fD03b4817}"

 log_info "=== Finding ChainID 138 CCIP Selector ==="
--- a/scripts/create-all-dodo-pools-from-token-api.sh
+++ b/scripts/create-all-dodo-pools-from-token-api.sh
@@ -5,6 +5,12 @@

 set -euo pipefail

+hex_to_addr() {
+  local value="${1#0x}"
+  [[ ${#value} -ge 40 ]] || return 1
+  printf '0x%s\n' "${value: -40}"
+}
+
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"

@@ -19,7 +25,11 @@ log_success() { echo -e "${GREEN}[✓]${NC} $1"; }
 log_warn() { echo -e "${YELLOW}[⚠]${NC} $1"; }
 log_error() { echo -e "${RED}[✗]${NC} $1"; }

-if [ -f "$PROJECT_ROOT/.env" ]; then
+if [[ -f "$SCRIPT_DIR/lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "$PROJECT_ROOT"
+elif [ -f "$PROJECT_ROOT/.env" ]; then
  set -a
  source "$PROJECT_ROOT/.env"
  set +a
@@ -131,7 +141,7 @@ while true; do
      continue
    fi

-    if ! pool_addr=$(cast call "$DODO_PMM_INTEGRATION" "pools(address,address)(address)" "$token_addr" "$QUOTE_TOKEN" --rpc-url "$RPC_URL" 2>/dev/null | cast --to-addr 2>/dev/null); then
+    if ! pool_addr=$(cast call "$DODO_PMM_INTEGRATION" "pools(address,address)(address)" "$token_addr" "$QUOTE_TOKEN" --rpc-url "$RPC_URL" 2>/dev/null | while read -r raw; do hex_to_addr "$raw" 2>/dev/null || true; done); then
      pool_addr=""
    fi
    if [ -n "$pool_addr" ] && [ "$pool_addr" != "0x0000000000000000000000000000000000000000" ]; then
@@ -153,7 +163,7 @@ while true; do
      --private-key "$PRIVATE_KEY" \
      --legacy \
      -q 2>/dev/null; then
-      pool_addr=$(cast call "$DODO_PMM_INTEGRATION" "pools(address,address)(address)" "$token_addr" "$QUOTE_TOKEN" --rpc-url "$RPC_URL" | cast --to-addr)
+      pool_addr=$(cast call "$DODO_PMM_INTEGRATION" "pools(address,address)(address)" "$token_addr" "$QUOTE_TOKEN" --rpc-url "$RPC_URL" | while read -r raw; do hex_to_addr "$raw"; done)
      log_success "Pool created: $pool_addr"

      if [ -n "$ENHANCED_SWAP_ROUTER" ] && [ "$ENHANCED_SWAP_ROUTER" != "0x0000000000000000000000000000000000000000" ]; then
--- a/scripts/create-pmm-full-mesh-chain138.sh
+++ b/scripts/create-pmm-full-mesh-chain138.sh
@@ -1,128 +1,10 @@
 #!/usr/bin/env bash
-# Create the full PMM pool mesh on Chain 138: all c* vs c* pairs plus c* vs official USDT/USDC.
-# Uses DODOPMMIntegration.createPool() and registers each pool with DODOPMMProvider.
-# Skip pairs that already have a pool. Requires POOL_MANAGER_ROLE on integration and provider.
-#
-# Usage:
-#   ./scripts/create-pmm-full-mesh-chain138.sh              # all c* mesh + optional official pairs
-#   MESH_ONLY_C_STAR=1 ./scripts/create-pmm-full-mesh-chain138.sh   # only c* vs c* (no official)
-#   DRY_RUN=1 ./scripts/create-pmm-full-mesh-chain138.sh   # print only, no txs
-#
-# Requires: PRIVATE_KEY, RPC_URL_138, DODO_PMM_INTEGRATION_ADDRESS, DODO_PMM_PROVIDER_ADDRESS in .env
+# Backward-compatible entrypoint for Chain 138 PMM desired-state sync.
+# Delegates to JSON-driven sync (config/chain138-pmm-pools.json).

 set -euo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-cd "$PROJECT_ROOT"
-[[ -f .env ]] && set -a && source .env && set +a

-RPC="${RPC_URL_138:-${RPC_URL:-http://192.168.11.211:8545}}"
-INT="${DODO_PMM_INTEGRATION_ADDRESS:-${DODO_PMM_INTEGRATION:-}}"
-PROV="${DODO_PMM_PROVIDER_ADDRESS:-}"
-LP_FEE="${LP_FEE_RATE:-3}"
-I="${INITIAL_PRICE:-1000000000000000000}"
-K="${K_FACTOR:-500000000000000000}"
-TWAP="${ENABLE_TWAP:-false}"
-DRY_RUN="${DRY_RUN:-0}"
-MESH_ONLY_C_STAR="${MESH_ONLY_C_STAR:-0}"
-
-# 12 c* tokens on Chain 138 (symbol:address)
-declare -a C_STAR_SYMS=(cUSDT cUSDC cEURC cEURT cGBPC cGBPT cAUDC cJPYC cCHFC cCADC cXAUC cXAUT)
-declare -a C_STAR_ADDRS=(
-  0x93E66202A11B1772E55407B32B44e5Cd8eda7f22
-  0xf22258f57794CC8E06237084b353Ab30fFfa640b
-  0x8085961F9cF02b4d800A3c6d386D31da4B34266a
-  0xdf4b71c61E5912712C1Bdd451416B9aC26949d72
-  0x003960f16D9d34F2e98d62723B6721Fb92074aD2
-  0x350f54e4D23795f86A9c03988c7135357CCaD97c
-  0xD51482e567c03899eecE3CAe8a058161FD56069D
-  0xEe269e1226a334182aace90056EE4ee5Cc8A6770
-  0x873990849DDa5117d7C644f0aF24370797C03885
-  0x54dBd40cF05e15906A2C21f600937e96787f5679
-  0x290E52a8819A4fbD0714E517225429aA2B70EC6b
-  0x94e408E26c6FD8F4ee00b54dF19082FDA07dC96E
-)
-
-[[ -n "${PRIVATE_KEY:-}" ]] || { echo "PRIVATE_KEY not set"; exit 1; }
-[[ -n "$INT" ]] || { echo "DODO_PMM_INTEGRATION_ADDRESS (or DODO_PMM_INTEGRATION) not set"; exit 1; }
-[[ -n "$PROV" ]] || { echo "DODO_PMM_PROVIDER_ADDRESS not set"; exit 1; }
-
-# Official USDT/USDC on 138 (from integration if available)
-OFFICIAL_USDT="${OFFICIAL_USDT_ADDRESS:-0x004b63A7B5b0E06f6bB6adb4a5F9f590BF3182D1}"
-OFFICIAL_USDC="${OFFICIAL_USDC_ADDRESS:-}"
-if [[ -z "$OFFICIAL_USDC" ]] && command -v cast &>/dev/null; then
-  OFFICIAL_USDC=$(cast call "$INT" "officialUSDC()(address)" --rpc-url "$RPC" 2>/dev/null | cast --to-addr 2>/dev/null || true)
-fi
-[[ -z "$OFFICIAL_USDC" ]] && OFFICIAL_USDC="0x0000000000000000000000000000000000000000"
-
-created=0
-skipped=0
-failed=0
-
-pool_exists() {
-  local base="$1" quote="$2"
-  local addr
-  addr=$(cast call "$INT" "pools(address,address)(address)" "$base" "$quote" --rpc-url "$RPC" 2>/dev/null | cast --to-addr 2>/dev/null || echo "0x0")
-  [[ -n "$addr" && "$addr" != "0x0000000000000000000000000000000000000000" ]]
-}
-
-create_pool() {
-  local base="$1" quote="$2" label="$3"
-  if pool_exists "$base" "$quote"; then
-    echo "  SKIP $label (pool exists)"
-    ((skipped++)) || true
-    return 0
-  fi
-  if [[ "$DRY_RUN" == "1" ]]; then
-    echo "  [DRY] would create $label"
-    ((created++)) || true
-    return 0
-  fi
-  if cast send "$INT" "createPool(address,address,uint256,uint256,uint256,bool)" \
-    "$base" "$quote" "$LP_FEE" "$I" "$K" "$TWAP" \
-    --rpc-url "$RPC" --private-key "$PRIVATE_KEY" --legacy --gas-limit 500000 -q 2>/dev/null; then
-    local pool_addr
-    pool_addr=$(cast call "$INT" "pools(address,address)(address)" "$base" "$quote" --rpc-url "$RPC" | cast --to-addr)
-    echo "  OK $label -> $pool_addr"
-    if [[ -n "$PROV" ]]; then
-      cast send "$PROV" "registerPool(address,address,address)" "$base" "$quote" "$pool_addr" \
-        --rpc-url "$RPC" --private-key "$PRIVATE_KEY" --legacy --gas-limit 200000 -q 2>/dev/null && echo "    registered with provider" || echo "    provider register failed"
-    fi
-    ((created++)) || true
-  else
-    echo "  FAIL $label"
-    ((failed++)) || true
-  fi
-}
-
-echo "=== PMM full mesh Chain 138 ==="
-echo "  Integration: $INT  Provider: $PROV  RPC: $RPC"
-echo "  Mesh: c* vs c* (+ c* vs official USDT/USDC if MESH_ONLY_C_STAR != 1)"
-echo ""
-
-# 1) All c* vs c* pairs (base < quote by address to avoid duplicates)
-n=${#C_STAR_ADDRS[@]}
-for ((i=0; i<n; i++)); do
-  for ((j=i+1; j<n; j++)); do
-    base="${C_STAR_ADDRS[$i]}"
-    quote="${C_STAR_ADDRS[$j]}"
-    label="${C_STAR_SYMS[$i]}/${C_STAR_SYMS[$j]}"
-    create_pool "$base" "$quote" "$label"
-  done
-done
-
-# 2) c* vs official USDT and c* vs official USDC (optional)
-if [[ "$MESH_ONLY_C_STAR" != "1" ]] && [[ "$OFFICIAL_USDT" != "0x0000000000000000000000000000000000000000" ]]; then
-  for ((i=0; i<n; i++)); do
-    create_pool "${C_STAR_ADDRS[$i]}" "$OFFICIAL_USDT" "${C_STAR_SYMS[$i]}/USDT"
-  done
-fi
-if [[ "$MESH_ONLY_C_STAR" != "1" ]] && [[ "$OFFICIAL_USDC" != "0x0000000000000000000000000000000000000000" ]]; then
-  for ((i=0; i<n; i++)); do
-    create_pool "${C_STAR_ADDRS[$i]}" "$OFFICIAL_USDC" "${C_STAR_SYMS[$i]}/USDC"
-  done
-fi
-
-echo ""
-echo "Done. Created: $created  Skipped: $skipped  Failed: $failed"
+exec "$PROJECT_ROOT/scripts/deployment/sync-chain138-pmm-pools-from-json.sh" "$@"
--- a/scripts/deployment/add-cloudflare-env.sh
+++ b/scripts/deployment/add-cloudflare-env.sh
@@ -8,6 +8,22 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../lib/init.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi
 ENV_FILE="${PROJECT_ROOT}/.env"

 log() {
--- a/scripts/deployment/azure-login.sh
+++ b/scripts/deployment/azure-login.sh
@@ -9,6 +9,22 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../lib/init.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 # Load environment variables
 if [ -f "${PROJECT_ROOT}/.env" ]; then
--- a/scripts/deployment/calculate-create2-parameters.sh
+++ b/scripts/deployment/calculate-create2-parameters.sh
@@ -8,9 +8,24 @@ set -e
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 # Load environment
-source .env 2>/dev/null || true

 TARGET_WETH9="0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2"
 TARGET_WETH10="0xf4BB2e28688e89fCcE3c0580D37d36A7672E8A9F"
--- a/scripts/deployment/canary-region.sh
+++ b/scripts/deployment/canary-region.sh
@@ -12,6 +12,22 @@ set -euo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi
 TERRAFORM_DIR="$PROJECT_ROOT/terraform"

 REGION="${1:-northeurope}"
--- a/scripts/deployment/check-balances-gas-and-deploy.sh
+++ b/scripts/deployment/check-balances-gas-and-deploy.sh
@@ -33,13 +33,6 @@ load_deployment_env
 parse_deploy_tag "$@"
 DO_DEPLOY="${DO_DEPLOY:-0}"

-# Load .env (load_deployment_env already did; keep for any vars set after)
-if [ -f .env ]; then
-  set -a
-  source .env
-  set +a
-fi
-
 # Infura: use Basic Auth URL when INFURA_PROJECT_SECRET is set (fixes "error sending request" from Infura)
 SCRIPT_LIB="$SCRIPT_DIR/../lib"
 [ -f "${SCRIPT_LIB}/infura.sh" ] && source "${SCRIPT_LIB}/infura.sh"
--- a/scripts/deployment/check-cronos-api.sh
+++ b/scripts/deployment/check-cronos-api.sh
@@ -6,7 +6,22 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 cd "$PROJECT_ROOT"
-source .env 2>/dev/null || true
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 RPC="${CRONOS_RPC_URL:-https://evm.cronos.org}"
 CONTRACTS=(
--- a/scripts/deployment/check-cronos-verification-status.sh
+++ b/scripts/deployment/check-cronos-verification-status.sh
@@ -7,6 +7,22 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 RPC="${CRONOS_RPC_URL:-https://evm.cronos.org}"
 CONTRACTS=(
--- a/scripts/deployment/check-dapp-env.sh
+++ b/scripts/deployment/check-dapp-env.sh
@@ -5,6 +5,22 @@
 set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi
 ENV_FILE="${1:-$REPO_ROOT/.env}"

 get_var() {
--- a/scripts/deployment/check-deployment-status.sh
+++ b/scripts/deployment/check-deployment-status.sh
@@ -11,6 +11,22 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../lib/init.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 log_info "=== Deployment Status Check ==="

--- a/scripts/deployment/check-env-required.sh
+++ b/scripts/deployment/check-env-required.sh
@@ -6,6 +6,22 @@ set -euo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi
 ENV_FILE="${PROJECT_ROOT}/.env"

 echo "=== .env check (keys only, no values) ==="
--- a/scripts/deployment/check-link-balance-config-ready-chains.sh
+++ b/scripts/deployment/check-link-balance-config-ready-chains.sh
@@ -10,7 +10,16 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 cd "$PROJECT_ROOT"

-[[ -f "$PROJECT_ROOT/.env" ]] && set -a && source "$PROJECT_ROOT/.env" && set +a
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "$PROJECT_ROOT"
+elif [[ -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+fi

 CHAIN="${1:-all}"
 REQUIRED_LINK="20"  # 10 per WETH9 bridge + 10 per WETH10 bridge
@@ -21,10 +30,10 @@ LINK_TOKEN_CRONOS="${LINK_TOKEN_CRONOS:-${CCIP_CRONOS_LINK_TOKEN:-0x8c80A01F461f
 LINK_TOKEN_CELO="${LINK_TOKEN_CELO:-${CCIP_CELO_LINK_TOKEN:-0xd07294e6E917e07dfDcee882dd1e2565085C2ae0}}"
 LINK_TOKEN_WEMIX="${LINK_TOKEN_WEMIX:-${CCIP_WEMIX_LINK_TOKEN:-0x80f1FcdC96B55e459BF52b998aBBE2c364935d69}}"

-GNOSIS_RPC="${GNOSIS_RPC:-https://rpc.gnosischain.com}"
-CRONOS_RPC="${CRONOS_RPC:-https://evm.cronos.org}"
-CELO_RPC="${CELO_RPC:-https://forno.celo.org}"
-WEMIX_RPC="${WEMIX_RPC:-https://api.wemix.com}"
+GNOSIS_RPC="${GNOSIS_RPC:-${GNOSIS_MAINNET_RPC:-https://rpc.gnosischain.com}}"
+CRONOS_RPC="${CRONOS_RPC:-${CRONOS_RPC_URL:-https://evm.cronos.org}}"
+CELO_RPC="${CELO_RPC:-${CELO_MAINNET_RPC:-https://forno.celo.org}}"
+WEMIX_RPC="${WEMIX_RPC:-${WEMIX_MAINNET_RPC:-https://api.wemix.com}}"

 if [[ -z "${PRIVATE_KEY:-}" ]]; then
  echo "Error: Set PRIVATE_KEY in .env" >&2
@@ -42,7 +51,7 @@ check_link() {
  local name="$1" rpc="$2" link_token="$3"
  [[ -z "$rpc" || -z "$link_token" ]] && return 1
  local raw
-  raw=$(cast call "$link_token" "balanceOf(address)(uint256)" "$DEPLOYER" --rpc-url "$rpc" 2>/dev/null || echo "0")
+  raw=$(cast call "${link_token,,}" "balanceOf(address)(uint256)" "${DEPLOYER,,}" --rpc-url "$rpc" 2>/dev/null || echo "0")
  local link_val
  link_val=$(echo "scale=4; $raw / 1000000000000000000" | bc 2>/dev/null || echo "0")
  if [[ -z "$link_val" || "$link_val" == "0" ]]; then
--- a/scripts/deployment/check-mainnet-balances.sh
+++ b/scripts/deployment/check-mainnet-balances.sh
@@ -7,6 +7,22 @@ set -e
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../lib/init.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi


 # Load environment variables
--- a/scripts/deployment/check-mainnet-deployment-status.sh
+++ b/scripts/deployment/check-mainnet-deployment-status.sh
@@ -7,6 +7,22 @@ set -e
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../lib/init.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 # Colors

--- a/scripts/deployment/check-rpc-status.sh
+++ b/scripts/deployment/check-rpc-status.sh
@@ -11,6 +11,22 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../lib/init.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 log_info "=== RPC Endpoint Status Check for Chain ID 138 ==="

--- a/scripts/deployment/check-syntax.sh
+++ b/scripts/deployment/check-syntax.sh
@@ -5,6 +5,22 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 cd "$REPO_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 FAIL=0

--- a/scripts/deployment/check-wallet-balances.sh
+++ b/scripts/deployment/check-wallet-balances.sh
@@ -8,6 +8,22 @@ set -e
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../lib/init.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 # Colors

--- a/scripts/deployment/complete-all-deployment.sh
+++ b/scripts/deployment/complete-all-deployment.sh
@@ -55,6 +55,22 @@ echo "PHASE 2: STORE NODE SECRETS"
 echo "======================================================================"

 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 bash scripts/key-management/store-nodes-in-keyvault.sh 2>&1 | tee /tmp/store-secrets.log

--- a/scripts/deployment/complete-config-ready-chains.sh
+++ b/scripts/deployment/complete-config-ready-chains.sh
@@ -11,9 +11,13 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 [[ -f "$SCRIPT_DIR/../lib/init.sh" ]] && source "$SCRIPT_DIR/../lib/init.sh" 2>/dev/null || true
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-
-if [[ -f "$PROJECT_ROOT/.env" ]]; then
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "$PROJECT_ROOT"
+elif [[ -f "$PROJECT_ROOT/.env" ]]; then
  set -a
+  # shellcheck disable=SC1090
  source "$PROJECT_ROOT/.env"
  set +a
 fi
@@ -26,11 +30,15 @@ CELO_SELECTOR="${CELO_SELECTOR:-1346049177634351622}"
 WEMIX_SELECTOR="${WEMIX_SELECTOR:-5142893604156789321}"
 CHAIN138_SELECTOR="${CHAIN138_SELECTOR:-}"

-CHAIN138_RPC="${CHAIN138_RPC:-${RPC_URL:-https://rpc-core.d-bis.org}}"
-GNOSIS_RPC="${GNOSIS_RPC:-https://rpc.gnosischain.com}"
-CRONOS_RPC="${CRONOS_RPC:-https://evm.cronos.org}"
-CELO_RPC="${CELO_RPC:-https://forno.celo.org}"
-WEMIX_RPC="${WEMIX_RPC:-https://api.wemix.com}"
+# Prefer LAN/core RPC for 138 when set (matches fund / deploy scripts).
+CHAIN138_RPC="${RPC_URL_138:-${CHAIN138_RPC:-${RPC_URL:-https://rpc-core.d-bis.org}}}"
+CHAIN138_RPC="${CHAIN138_RPC//$'\r'/}"
+CHAIN138_RPC="${CHAIN138_RPC//$'\n'/}"
+# Align with fund-ccip-bridges-with-link.sh / .env.example (MAINNET_RPC aliases).
+GNOSIS_RPC="${GNOSIS_RPC:-${GNOSIS_MAINNET_RPC:-https://rpc.gnosischain.com}}"
+CRONOS_RPC="${CRONOS_RPC:-${CRONOS_RPC_URL:-https://evm.cronos.org}}"
+CELO_RPC="${CELO_RPC:-${CELO_MAINNET_RPC:-https://forno.celo.org}}"
+WEMIX_RPC="${WEMIX_RPC:-${WEMIX_MAINNET_RPC:-https://api.wemix.com}}"

 PRIVATE_KEY="${PRIVATE_KEY:-}"
 if [[ -n "$PRIVATE_KEY" && ! "$PRIVATE_KEY" =~ ^0x ]]; then
@@ -38,18 +46,22 @@ if [[ -n "$PRIVATE_KEY" && ! "$PRIVATE_KEY" =~ ^0x ]]; then
 fi

 # Chain 138 bridge addresses (required)
-WETH9_138=$(grep "CCIPWETH9_BRIDGE_CHAIN138=" "$PROJECT_ROOT/.env" 2>/dev/null | cut -d'=' -f2 | tr -d ' "' || echo "${CCIPWETH9_BRIDGE_CHAIN138:-}")
-WETH10_138=$(grep "CCIPWETH10_BRIDGE_CHAIN138=" "$PROJECT_ROOT/.env" 2>/dev/null | cut -d'=' -f2 | tr -d ' "' || echo "${CCIPWETH10_BRIDGE_CHAIN138:-}")
+WETH9_138=$(grep "CCIPWETH9_BRIDGE_CHAIN138=" "$PROJECT_ROOT/.env" 2>/dev/null | cut -d'=' -f2 | tr -d ' "\r\n' || echo "${CCIPWETH9_BRIDGE_CHAIN138:-}")
+WETH10_138=$(grep "CCIPWETH10_BRIDGE_CHAIN138=" "$PROJECT_ROOT/.env" 2>/dev/null | cut -d'=' -f2 | tr -d ' "\r\n' || echo "${CCIPWETH10_BRIDGE_CHAIN138:-}")

 # Config-ready chain bridge addresses (optional; if set, we configure them)
-WETH9_GNOSIS=$(grep "CCIPWETH9_BRIDGE_GNOSIS=" "$PROJECT_ROOT/.env" 2>/dev/null | cut -d'=' -f2 | tr -d ' "' || echo "${CCIPWETH9_BRIDGE_GNOSIS:-}")
-WETH10_GNOSIS=$(grep "CCIPWETH10_BRIDGE_GNOSIS=" "$PROJECT_ROOT/.env" 2>/dev/null | cut -d'=' -f2 | tr -d ' "' || echo "${CCIPWETH10_BRIDGE_GNOSIS:-}")
-WETH9_CRONOS=$(grep "CCIPWETH9_BRIDGE_CRONOS=" "$PROJECT_ROOT/.env" 2>/dev/null | cut -d'=' -f2 | tr -d ' "' || echo "${CCIPWETH9_BRIDGE_CRONOS:-}")
-WETH10_CRONOS=$(grep "CCIPWETH10_BRIDGE_CRONOS=" "$PROJECT_ROOT/.env" 2>/dev/null | cut -d'=' -f2 | tr -d ' "' || echo "${CCIPWETH10_BRIDGE_CRONOS:-}")
-WETH9_CELO=$(grep "CCIPWETH9_BRIDGE_CELO=" "$PROJECT_ROOT/.env" 2>/dev/null | cut -d'=' -f2 | tr -d ' "' || echo "${CCIPWETH9_BRIDGE_CELO:-}")
-WETH10_CELO=$(grep "CCIPWETH10_BRIDGE_CELO=" "$PROJECT_ROOT/.env" 2>/dev/null | cut -d'=' -f2 | tr -d ' "' || echo "${CCIPWETH10_BRIDGE_CELO:-}")
-WETH9_WEMIX=$(grep "CCIPWETH9_BRIDGE_WEMIX=" "$PROJECT_ROOT/.env" 2>/dev/null | cut -d'=' -f2 | tr -d ' "' || echo "${CCIPWETH9_BRIDGE_WEMIX:-}")
-WETH10_WEMIX=$(grep "CCIPWETH10_BRIDGE_WEMIX=" "$PROJECT_ROOT/.env" 2>/dev/null | cut -d'=' -f2 | tr -d ' "' || echo "${CCIPWETH10_BRIDGE_WEMIX:-}")
+WETH9_GNOSIS=$(grep "CCIPWETH9_BRIDGE_GNOSIS=" "$PROJECT_ROOT/.env" 2>/dev/null | cut -d'=' -f2 | tr -d ' "\r\n' || echo "${CCIPWETH9_BRIDGE_GNOSIS:-}")
+WETH10_GNOSIS=$(grep "CCIPWETH10_BRIDGE_GNOSIS=" "$PROJECT_ROOT/.env" 2>/dev/null | cut -d'=' -f2 | tr -d ' "\r\n' || echo "${CCIPWETH10_BRIDGE_GNOSIS:-}")
+WETH9_CRONOS=$(grep "CCIPWETH9_BRIDGE_CRONOS=" "$PROJECT_ROOT/.env" 2>/dev/null | cut -d'=' -f2 | tr -d ' "\r\n' || echo "${CCIPWETH9_BRIDGE_CRONOS:-}")
+WETH10_CRONOS=$(grep "CCIPWETH10_BRIDGE_CRONOS=" "$PROJECT_ROOT/.env" 2>/dev/null | cut -d'=' -f2 | tr -d ' "\r\n' || echo "${CCIPWETH10_BRIDGE_CRONOS:-}")
+WETH9_CELO=$(grep "CCIPWETH9_BRIDGE_CELO=" "$PROJECT_ROOT/.env" 2>/dev/null | cut -d'=' -f2 | tr -d ' "\r\n' || echo "${CCIPWETH9_BRIDGE_CELO:-}")
+WETH10_CELO=$(grep "CCIPWETH10_BRIDGE_CELO=" "$PROJECT_ROOT/.env" 2>/dev/null | cut -d'=' -f2 | tr -d ' "\r\n' || echo "${CCIPWETH10_BRIDGE_CELO:-}")
+WETH9_WEMIX=$(grep "CCIPWETH9_BRIDGE_WEMIX=" "$PROJECT_ROOT/.env" 2>/dev/null | cut -d'=' -f2 | tr -d ' "\r\n' || echo "${CCIPWETH9_BRIDGE_WEMIX:-}")
+WETH10_WEMIX=$(grep "CCIPWETH10_BRIDGE_WEMIX=" "$PROJECT_ROOT/.env" 2>/dev/null | cut -d'=' -f2 | tr -d ' "\r\n' || echo "${CCIPWETH10_BRIDGE_WEMIX:-}")
+
+# Besu eth_call via `cast call` can return -32602; lowercase 20-byte addresses avoids some failures on sends.
+WETH9_138="${WETH9_138,,}"
+WETH10_138="${WETH10_138,,}"

 DRY_RUN="${DRY_RUN:-0}"

@@ -69,10 +81,14 @@ run_or_echo() {
  if [[ "$DRY_RUN" = "1" ]]; then
    echo "  [DRY RUN] $*"
  else
-    if eval "$*" >/dev/null 2>&1; then
+    # With set -e, _out=$(eval ...) would exit the whole script on failure; use if to absorb it.
+    local _out
+    if _out=$(eval "$*" 2>&1); then
      log_success "  OK"
+      [[ -n "$_out" ]] && echo "    $_out"
    else
-      log_warn "  Failed (non-fatal) - run manually to see error"
+      log_warn "  Failed (non-fatal)"
+      echo "    $_out" >&2
    fi
  fi
 }
@@ -90,10 +106,10 @@ configure_chain_138_destination() {

  echo "  Configuring Chain 138 → $label..."
  if [[ -n "$addr9" ]]; then
-    run_or_echo "cast send $WETH9_138 \"addDestination(uint64,address)\" $selector $addr9 --rpc-url $CHAIN138_RPC --private-key \$PRIVATE_KEY --legacy --gas-limit 200000"
+    run_or_echo "cast send $WETH9_138 \"addDestination(uint64,address)\" $selector ${addr9,,} --rpc-url $CHAIN138_RPC --private-key \$PRIVATE_KEY --legacy --gas-limit 250000 --gas-price 2000000000"
  fi
  if [[ -n "$addr10" ]]; then
-    run_or_echo "cast send $WETH10_138 \"addDestination(uint64,address)\" $selector $addr10 --rpc-url $CHAIN138_RPC --private-key \$PRIVATE_KEY --legacy --gas-limit 200000"
+    run_or_echo "cast send $WETH10_138 \"addDestination(uint64,address)\" $selector ${addr10,,} --rpc-url $CHAIN138_RPC --private-key \$PRIVATE_KEY --legacy --gas-limit 250000 --gas-price 2000000000"
  fi
 }

@@ -110,10 +126,10 @@ configure_remote_chain_destination() {

  echo "  Configuring $label → Chain 138..."
  if [[ -n "$addr9" ]]; then
-    run_or_echo "cast send $addr9 \"addDestination(uint64,address)\" $CHAIN138_SELECTOR $WETH9_138 --rpc-url $rpc --private-key \$PRIVATE_KEY --legacy"
+    run_or_echo "cast send ${addr9,,} \"addDestination(uint64,address)\" $CHAIN138_SELECTOR $WETH9_138 --rpc-url $rpc --private-key \$PRIVATE_KEY --legacy --gas-limit 400000"
  fi
  if [[ -n "$addr10" ]]; then
-    run_or_echo "cast send $addr10 \"addDestination(uint64,address)\" $CHAIN138_SELECTOR $WETH10_138 --rpc-url $rpc --private-key \$PRIVATE_KEY --legacy"
+    run_or_echo "cast send ${addr10,,} \"addDestination(uint64,address)\" $CHAIN138_SELECTOR $WETH10_138 --rpc-url $rpc --private-key \$PRIVATE_KEY --legacy --gas-limit 400000"
  fi
 }

--- a/scripts/deployment/complete-phase2.sh
+++ b/scripts/deployment/complete-phase2.sh
@@ -8,6 +8,22 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../lib/init.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 log() {
    log_success "[✓] $1"
--- a/scripts/deployment/configure-avalanche-arbitrum-cronos-bridges.sh
+++ b/scripts/deployment/configure-avalanche-arbitrum-cronos-bridges.sh
@@ -9,10 +9,20 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 cd "$PROJECT_ROOT"
-
-if [[ -f .env ]]; then
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
  set -a
-  source .env
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
  set +a
 fi

@@ -25,6 +35,8 @@ CRONOS_SELECTOR="${CRONOS_SELECTOR:-1456215246176062136}"
 CHAIN138_SELECTOR="${CHAIN138_SELECTOR:-138}"

 CHAIN138_RPC="${RPC_URL_138:-${CHAIN138_RPC:-http://192.168.11.211:8545}}"
+CHAIN138_RPC="${CHAIN138_RPC%$'\r'}"
+CHAIN138_RPC="${CHAIN138_RPC%$'\n'}"
 # Prefer explicit RPC; else Infura (INFURA_PROJECT_ID + optional INFURA_PROJECT_SECRET); else public
 _avalanche_infura=$(build_infura_rpc "avalanche-mainnet" 2>/dev/null || true)
 _arbitrum_infura=$(build_infura_rpc "arbitrum-mainnet" 2>/dev/null || true)
@@ -41,6 +53,11 @@ WETH10_ARBITRUM="${CCIPWETH10_BRIDGE_ARBITRUM:-}"
 WETH9_CRONOS="${CCIPWETH9_BRIDGE_CRONOS:-}"
 WETH10_CRONOS="${CCIPWETH10_BRIDGE_CRONOS:-}"

+[[ -n "$WETH9_138" ]] && WETH9_138="${WETH9_138,,}"
+[[ -n "$WETH10_138" ]] && WETH10_138="${WETH10_138,,}"
+_gas138="--legacy --gas-limit 250000 --gas-price 2000000000"
+_gas_remote="--legacy --gas-limit 400000"
+
 PRIVATE_KEY="${PRIVATE_KEY:-}"
 [[ -n "$PRIVATE_KEY" && ! "$PRIVATE_KEY" =~ ^0x ]] && PRIVATE_KEY="0x$PRIVATE_KEY"

@@ -54,10 +71,13 @@ run_or_echo() {
  if [[ "$DRY_RUN" = "1" ]]; then
    echo "  [DRY RUN] $*"
  else
-    if eval "$*"; then
+    local _out
+    if _out=$(eval "$*" 2>&1); then
      echo -e "  ${GREEN}OK${NC}"
+      [[ -n "$_out" ]] && echo "    $_out"
    else
-      echo -e "  ${RED}Failed${NC}"
+      echo -e "  ${RED}Failed${NC}" >&2
+      echo "    $_out" >&2
      return 1
    fi
  fi
@@ -86,20 +106,20 @@ echo ""
 # Step A: Chain 138 → Avalanche
 if [[ -n "$WETH9_AVALANCHE" || -n "$WETH10_AVALANCHE" ]]; then
  echo "  Chain 138 → Avalanche:"
-  [[ -n "$WETH9_AVALANCHE" ]]  && run_or_echo "cast send $WETH9_138  'addDestination(uint64,address)' $AVALANCHE_SELECTOR $WETH9_AVALANCHE  --rpc-url $CHAIN138_RPC --private-key \$PRIVATE_KEY --legacy" || true
-  [[ -n "$WETH10_AVALANCHE" ]] && run_or_echo "cast send $WETH10_138 'addDestination(uint64,address)' $AVALANCHE_SELECTOR $WETH10_AVALANCHE --rpc-url $CHAIN138_RPC --private-key \$PRIVATE_KEY --legacy" || true
+  [[ -n "$WETH9_AVALANCHE" ]]  && run_or_echo "cast send $WETH9_138 \"addDestination(uint64,address)\" $AVALANCHE_SELECTOR ${WETH9_AVALANCHE,,} --rpc-url $CHAIN138_RPC --private-key \$PRIVATE_KEY $_gas138" || true
+  [[ -n "$WETH10_AVALANCHE" && -n "$WETH10_138" ]] && run_or_echo "cast send $WETH10_138 \"addDestination(uint64,address)\" $AVALANCHE_SELECTOR ${WETH10_AVALANCHE,,} --rpc-url $CHAIN138_RPC --private-key \$PRIVATE_KEY $_gas138" || true
 fi
 # Step A: Chain 138 → Arbitrum
 if [[ -n "$WETH9_ARBITRUM" || -n "$WETH10_ARBITRUM" ]]; then
  echo "  Chain 138 → Arbitrum:"
-  [[ -n "$WETH9_ARBITRUM" ]]  && run_or_echo "cast send $WETH9_138  'addDestination(uint64,address)' $ARBITRUM_SELECTOR $WETH9_ARBITRUM  --rpc-url $CHAIN138_RPC --private-key \$PRIVATE_KEY --legacy" || true
-  [[ -n "$WETH10_ARBITRUM" ]] && run_or_echo "cast send $WETH10_138 'addDestination(uint64,address)' $ARBITRUM_SELECTOR $WETH10_ARBITRUM --rpc-url $CHAIN138_RPC --private-key \$PRIVATE_KEY --legacy" || true
+  [[ -n "$WETH9_ARBITRUM" ]]  && run_or_echo "cast send $WETH9_138 \"addDestination(uint64,address)\" $ARBITRUM_SELECTOR ${WETH9_ARBITRUM,,} --rpc-url $CHAIN138_RPC --private-key \$PRIVATE_KEY $_gas138" || true
+  [[ -n "$WETH10_ARBITRUM" && -n "$WETH10_138" ]] && run_or_echo "cast send $WETH10_138 \"addDestination(uint64,address)\" $ARBITRUM_SELECTOR ${WETH10_ARBITRUM,,} --rpc-url $CHAIN138_RPC --private-key \$PRIVATE_KEY $_gas138" || true
 fi
 # Step A: Chain 138 → Cronos
 if [[ -n "$WETH9_CRONOS" || -n "$WETH10_CRONOS" ]]; then
  echo "  Chain 138 → Cronos:"
-  [[ -n "$WETH9_CRONOS" ]]  && run_or_echo "cast send $WETH9_138  'addDestination(uint64,address)' $CRONOS_SELECTOR $WETH9_CRONOS  --rpc-url $CHAIN138_RPC --private-key \$PRIVATE_KEY --legacy" || true
-  [[ -n "$WETH10_CRONOS" ]] && run_or_echo "cast send $WETH10_138 'addDestination(uint64,address)' $CRONOS_SELECTOR $WETH10_CRONOS --rpc-url $CHAIN138_RPC --private-key \$PRIVATE_KEY --legacy" || true
+  [[ -n "$WETH9_CRONOS" ]]  && run_or_echo "cast send $WETH9_138 \"addDestination(uint64,address)\" $CRONOS_SELECTOR ${WETH9_CRONOS,,} --rpc-url $CHAIN138_RPC --private-key \$PRIVATE_KEY $_gas138" || true
+  [[ -n "$WETH10_CRONOS" && -n "$WETH10_138" ]] && run_or_echo "cast send $WETH10_138 \"addDestination(uint64,address)\" $CRONOS_SELECTOR ${WETH10_CRONOS,,} --rpc-url $CHAIN138_RPC --private-key \$PRIVATE_KEY $_gas138" || true
 fi

 echo ""
@@ -109,20 +129,20 @@ echo ""
 # Step B: Avalanche → Chain 138
 if [[ -n "$WETH9_AVALANCHE" || -n "$WETH10_AVALANCHE" ]]; then
  echo "  Avalanche → Chain 138:"
-  [[ -n "$WETH9_AVALANCHE" ]]  && run_or_echo "cast send $WETH9_AVALANCHE  'addDestination(uint64,address)' $CHAIN138_SELECTOR $WETH9_138  --rpc-url $AVALANCHE_RPC --private-key \$PRIVATE_KEY --legacy" || true
-  [[ -n "$WETH10_AVALANCHE" ]] && run_or_echo "cast send $WETH10_AVALANCHE 'addDestination(uint64,address)' $CHAIN138_SELECTOR $WETH10_138 --rpc-url $AVALANCHE_RPC --private-key \$PRIVATE_KEY --legacy" || true
+  [[ -n "$WETH9_AVALANCHE" ]]  && run_or_echo "cast send ${WETH9_AVALANCHE,,} \"addDestination(uint64,address)\" $CHAIN138_SELECTOR $WETH9_138 --rpc-url $AVALANCHE_RPC --private-key \$PRIVATE_KEY $_gas_remote" || true
+  [[ -n "$WETH10_AVALANCHE" && -n "$WETH10_138" ]] && run_or_echo "cast send ${WETH10_AVALANCHE,,} \"addDestination(uint64,address)\" $CHAIN138_SELECTOR $WETH10_138 --rpc-url $AVALANCHE_RPC --private-key \$PRIVATE_KEY $_gas_remote" || true
 fi
 # Step B: Arbitrum → Chain 138
 if [[ -n "$WETH9_ARBITRUM" || -n "$WETH10_ARBITRUM" ]]; then
  echo "  Arbitrum → Chain 138:"
-  [[ -n "$WETH9_ARBITRUM" ]]  && run_or_echo "cast send $WETH9_ARBITRUM  'addDestination(uint64,address)' $CHAIN138_SELECTOR $WETH9_138  --rpc-url $ARBITRUM_RPC --private-key \$PRIVATE_KEY --legacy" || true
-  [[ -n "$WETH10_ARBITRUM" ]] && run_or_echo "cast send $WETH10_ARBITRUM 'addDestination(uint64,address)' $CHAIN138_SELECTOR $WETH10_138 --rpc-url $ARBITRUM_RPC --private-key \$PRIVATE_KEY --legacy" || true
+  [[ -n "$WETH9_ARBITRUM" ]]  && run_or_echo "cast send ${WETH9_ARBITRUM,,} \"addDestination(uint64,address)\" $CHAIN138_SELECTOR $WETH9_138 --rpc-url $ARBITRUM_RPC --private-key \$PRIVATE_KEY $_gas_remote" || true
+  [[ -n "$WETH10_ARBITRUM" && -n "$WETH10_138" ]] && run_or_echo "cast send ${WETH10_ARBITRUM,,} \"addDestination(uint64,address)\" $CHAIN138_SELECTOR $WETH10_138 --rpc-url $ARBITRUM_RPC --private-key \$PRIVATE_KEY $_gas_remote" || true
 fi
 # Step B: Cronos → Chain 138
 if [[ -n "$WETH9_CRONOS" || -n "$WETH10_CRONOS" ]]; then
  echo "  Cronos → Chain 138:"
-  [[ -n "$WETH9_CRONOS" ]]  && run_or_echo "cast send $WETH9_CRONOS  'addDestination(uint64,address)' $CHAIN138_SELECTOR $WETH9_138  --rpc-url $CRONOS_RPC --private-key \$PRIVATE_KEY --legacy" || true
-  [[ -n "$WETH10_CRONOS" ]] && run_or_echo "cast send $WETH10_CRONOS 'addDestination(uint64,address)' $CHAIN138_SELECTOR $WETH10_138 --rpc-url $CRONOS_RPC --private-key \$PRIVATE_KEY --legacy" || true
+  [[ -n "$WETH9_CRONOS" ]]  && run_or_echo "cast send ${WETH9_CRONOS,,} \"addDestination(uint64,address)\" $CHAIN138_SELECTOR $WETH9_138 --rpc-url $CRONOS_RPC --private-key \$PRIVATE_KEY $_gas_remote" || true
+  [[ -n "$WETH10_CRONOS" && -n "$WETH10_138" ]] && run_or_echo "cast send ${WETH10_CRONOS,,} \"addDestination(uint64,address)\" $CHAIN138_SELECTOR $WETH10_138 --rpc-url $CRONOS_RPC --private-key \$PRIVATE_KEY $_gas_remote" || true
 fi

 echo ""
--- a/scripts/deployment/configure-bridge-destinations.sh
+++ b/scripts/deployment/configure-bridge-destinations.sh
@@ -1,107 +1,123 @@
-#!/bin/bash
+#!/usr/bin/env bash
+# Configure Chain 138 ↔ Ethereum mainnet CCIP WETH bridge destinations.
+# Uses CCIPWETH9Bridge / CCIPWETH10Bridge addDestination(uint64,address) (receiver = peer bridge on the other chain).
+# For Gnosis/Cronos/Celo/Wemix, use complete-config-ready-chains.sh instead.
+#
+# Env: PRIVATE_KEY; bridge addresses (see below); RPC_URL_138; ETHEREUM_MAINNET_RPC or RPC_URL_MAINNET.
+#
+# shellcheck disable=SC1090

-# Configure Bridge Destinations Script
-# Configures ChainID 138 ↔ Mainnet bidirectional bridge destinations
+set -euo pipefail

-set -e
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "$PROJECT_ROOT"
+fi

-# Colors for output
 RED='\033[0;31m'
 GREEN='\033[0;32m'
 YELLOW='\033[1;33m'
-NC='\033[0m' # No Color
+NC='\033[0m'

-# Configuration
 PRIVATE_KEY="${PRIVATE_KEY:-}"
-RPC_URL_138="${RPC_URL_138:-http://192.168.11.175:8545}"
-RPC_URL_MAINNET="${RPC_URL_MAINNET:-https://eth.llamarpc.com}"
-
-# Chain Selectors
-MAINNET_CHAIN_SELECTOR="5009297550715157269"
-CHAIN138_CHAIN_SELECTOR="${CHAIN138_CHAIN_SELECTOR:-}" # To be determined
-
-# Contract Addresses (set these after deployment)
-WETH9_BRIDGE_138="${WETH9_BRIDGE_138:-}"
-WETH10_BRIDGE_138="${WETH10_BRIDGE_138:-}"
-WETH9_MAINNET="${WETH9_MAINNET:-0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2}"
-WETH10_MAINNET="${WETH10_MAINNET:-0xf4BB2e28688e89fCcE3c0580D37d36A7672E8A9f}"
-
-echo -e "${GREEN}=== Bridge Destination Configuration ===${NC}\n"
-
-# Check prerequisites
-if [ -z "$PRIVATE_KEY" ]; then
-    echo -e "${RED}ERROR: PRIVATE_KEY environment variable not set${NC}"
-    exit 1
+if [[ -n "$PRIVATE_KEY" && ! "$PRIVATE_KEY" =~ ^0x ]]; then
+  PRIVATE_KEY="0x$PRIVATE_KEY"
 fi

-if [ -z "$WETH9_BRIDGE_138" ] || [ -z "$WETH10_BRIDGE_138" ]; then
-    echo -e "${YELLOW}WARNING: Bridge addresses not set. Please set WETH9_BRIDGE_138 and WETH10_BRIDGE_138${NC}"
-    exit 1
+RPC_URL_138="${RPC_URL_138:-http://192.168.11.211:8545}"
+RPC_URL_138="${RPC_URL_138%$'\r'}"
+RPC_URL_138="${RPC_URL_138%$'\n'}"
+RPC_URL_MAINNET="${RPC_URL_MAINNET:-${ETHEREUM_MAINNET_RPC:-https://eth.llamarpc.com}}"
+RPC_URL_MAINNET="${RPC_URL_MAINNET%$'\r'}"
+RPC_URL_MAINNET="${RPC_URL_MAINNET%$'\n'}"
+
+MAINNET_CHAIN_SELECTOR="${MAINNET_CHAIN_SELECTOR:-5009297550715157269}"
+CHAIN138_CHAIN_SELECTOR="${CHAIN138_CHAIN_SELECTOR:-${CHAIN138_SELECTOR:-}}"
+
+# 138-side bridges (aliases match .env CCIP* names)
+WETH9_BRIDGE_138="${WETH9_BRIDGE_138:-${CCIPWETH9_BRIDGE_CHAIN138:-}}"
+WETH10_BRIDGE_138="${WETH10_BRIDGE_138:-${CCIPWETH10_BRIDGE_CHAIN138:-}}"
+# Mainnet peer *bridge* contracts (not WETH token addresses)
+WETH9_MAINNET="${WETH9_MAINNET:-${MAINNET_CCIP_WETH9_BRIDGE:-}}"
+WETH10_MAINNET="${WETH10_MAINNET:-${MAINNET_CCIP_WETH10_BRIDGE:-}}"
+
+echo -e "${GREEN}=== Bridge destination configuration (138 ↔ Mainnet) ===${NC}\n"
+
+if [[ -z "$PRIVATE_KEY" ]]; then
+  echo -e "${RED}ERROR: PRIVATE_KEY not set (env or .env)${NC}" >&2
+  exit 1
+fi
+
+if [[ -z "$WETH9_BRIDGE_138" || -z "$WETH10_BRIDGE_138" ]]; then
+  echo -e "${RED}ERROR: Set WETH9_BRIDGE_138 / WETH10_BRIDGE_138 or CCIPWETH9_BRIDGE_CHAIN138 / CCIPWETH10_BRIDGE_CHAIN138${NC}" >&2
+  exit 1
+fi
+
+if [[ -z "$WETH9_MAINNET" || -z "$WETH10_MAINNET" ]]; then
+  echo -e "${RED}ERROR: Set mainnet peer bridge addresses: WETH9_MAINNET / WETH10_MAINNET${NC}" >&2
+  echo -e "  (or MAINNET_CCIP_WETH9_BRIDGE / MAINNET_CCIP_WETH10_BRIDGE). These must be the CCIP bridge contracts on Ethereum, not WETH token addresses.${NC}" >&2
+  exit 1
 fi

-# Function to add destination
 add_destination() {
-    local bridge_address=$1
-    local chain_selector=$2
-    local destination_token=$3
-    local rpc_url=$4
-    local network_name=$5
+  local bridge_address=$1
+  local chain_selector=$2
+  local receiver_bridge=$3
+  local rpc_url=$4
+  local network_name=$5

-    echo -e "${GREEN}Adding destination to $network_name bridge...${NC}"
-    
-    cast send "$bridge_address" \
-        "addDestination(uint64,address,address)" \
-        "$chain_selector" \
-        "$destination_token" \
-        "0x0000000000000000000000000000000000000000" \
-        --rpc-url "$rpc_url" \
-        --private-key "$PRIVATE_KEY" \
-        --legacy
+  echo -e "${GREEN}Adding destination on $network_name bridge...${NC}"
+  cast send "${bridge_address,,}" \
+    "addDestination(uint64,address)" \
+    "$chain_selector" \
+    "${receiver_bridge,,}" \
+    --rpc-url "$rpc_url" \
+    --private-key "$PRIVATE_KEY" \
+    --legacy \
+    --gas-limit 250000 \
+    --gas-price 2000000000

-    echo -e "${GREEN}✓ Destination added${NC}\n"
+  echo -e "${GREEN}✓ Destination added${NC}\n"
 }

-# Function to verify destinations
 verify_destinations() {
-    local bridge_address=$1
-    local rpc_url=$2
-    local network_name=$3
+  local bridge_address=$1
+  local rpc_url=$2
+  local network_name=$3

-    echo -e "${GREEN}Verifying destinations on $network_name...${NC}"
-    
-    local chains=$(cast call "$bridge_address" \
-        "getDestinationChains()(uint64[])" \
-        --rpc-url "$rpc_url")
-    
+  echo -e "${GREEN}Verifying destinations on $network_name...${NC}"
+  local chains
+  if chains=$(cast call "${bridge_address,,}" \
+    "getDestinationChains()(uint64[])" \
+    --rpc-url "$rpc_url" 2>/dev/null); then
    echo -e "${GREEN}Destination chains: $chains${NC}\n"
+  else
+    echo -e "${YELLOW}Could not read getDestinationChains (cast/RPC). Try cast rpc eth_call or another RPC.${NC}\n"
+  fi
 }

-# Configure ChainID 138 → Mainnet
-echo -e "${YELLOW}=== Configuring ChainID 138 → Mainnet ===${NC}\n"
+echo -e "${YELLOW}=== Chain 138 → Mainnet ===${NC}\n"

-echo -e "${GREEN}1. Configuring WETH9 Bridge (ChainID 138 → Mainnet)${NC}"
-add_destination "$WETH9_BRIDGE_138" "$MAINNET_CHAIN_SELECTOR" "$WETH9_MAINNET" "$RPC_URL_138" "ChainID 138"
+echo -e "${GREEN}1. WETH9 bridge on 138 → Mainnet peer${NC}"
+add_destination "$WETH9_BRIDGE_138" "$MAINNET_CHAIN_SELECTOR" "$WETH9_MAINNET" "$RPC_URL_138" "Chain 138 WETH9"

-echo -e "${GREEN}2. Configuring WETH10 Bridge (ChainID 138 → Mainnet)${NC}"
-add_destination "$WETH10_BRIDGE_138" "$MAINNET_CHAIN_SELECTOR" "$WETH10_MAINNET" "$RPC_URL_138" "ChainID 138"
+echo -e "${GREEN}2. WETH10 bridge on 138 → Mainnet peer${NC}"
+add_destination "$WETH10_BRIDGE_138" "$MAINNET_CHAIN_SELECTOR" "$WETH10_MAINNET" "$RPC_URL_138" "Chain 138 WETH10"

-# Verify ChainID 138 bridges
-echo -e "${YELLOW}=== Verifying ChainID 138 Bridges ===${NC}\n"
+echo -e "${YELLOW}=== Verify 138 bridges ===${NC}\n"
 verify_destinations "$WETH9_BRIDGE_138" "$RPC_URL_138" "WETH9 Bridge"
 verify_destinations "$WETH10_BRIDGE_138" "$RPC_URL_138" "WETH10 Bridge"

-# Note: Mainnet → ChainID 138 requires ChainID 138 selector
-if [ -z "$CHAIN138_CHAIN_SELECTOR" ]; then
-    echo -e "${YELLOW}NOTE: ChainID 138 chain selector not set.${NC}"
-    echo -e "${YELLOW}To configure Mainnet → ChainID 138, first determine the ChainID 138 selector.${NC}"
-    echo -e "${YELLOW}You can find it using: cast call <CCIP_ROUTER> 'getChainSelector()(uint64)' --rpc-url $RPC_URL_138${NC}\n"
+if [[ -z "$CHAIN138_CHAIN_SELECTOR" ]]; then
+  echo -e "${YELLOW}NOTE: CHAIN138_CHAIN_SELECTOR / CHAIN138_SELECTOR not set.${NC}"
+  echo -e "${YELLOW}To add Chain 138 as a destination on Mainnet bridges, set the selector then run addDestination on mainnet (see complete-config-ready-chains.sh pattern).${NC}"
+  echo -e "${YELLOW}Router getChainSelector() may revert on custom routers; see docs/deployment/CHAIN138_SELECTOR_NOTES.md${NC}\n"
 else
-    echo -e "${YELLOW}=== Configuring Mainnet → ChainID 138 ===${NC}\n"
-    echo -e "${YELLOW}NOTE: This requires deploying bridges on Mainnet first.${NC}\n"
+  echo -e "${YELLOW}=== Mainnet → Chain 138 ===${NC}"
+  echo -e "${YELLOW}CHAIN138_CHAIN_SELECTOR=$CHAIN138_CHAIN_SELECTOR — run addDestination on each Mainnet bridge with this selector and the 138 peer bridge address (not automated here).${NC}\n"
 fi

-echo -e "${GREEN}=== Configuration Complete ===${NC}\n"
-echo -e "Next Steps:"
-echo -e "  1. Test bidirectional transfers"
-echo -e "  2. Monitor bridge activity"
-echo -e "  3. Verify LINK token balances for CCIP fees"
+echo -e "${GREEN}=== Done ===${NC}\n"
+echo -e "Next: fund bridges with LINK; test transfers; monitor fees."
--- a/scripts/deployment/configure-weth10-bridge.sh
+++ b/scripts/deployment/configure-weth10-bridge.sh
@@ -1,38 +1,56 @@
 #!/usr/bin/env bash
-# Configure CCIPWETH10Bridge destinations
+# Print cast commands to configure CCIPWETH10Bridge (Mainnet ↔ Chain 138).
+# For hands-off execution use execute-bridge-config.sh (WETH9 + WETH10).
+
+set -euo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-source "$SCRIPT_DIR/../lib/init.sh"
+[[ -f "$SCRIPT_DIR/../lib/init.sh" ]] && source "$SCRIPT_DIR/../lib/init.sh" 2>/dev/null || true
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"

-# Load environment
-if [ -f "$PROJECT_ROOT/.env" ]; then
-    source "$PROJECT_ROOT/.env"
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
 fi

 MAINNET_RPC="${ETHEREUM_MAINNET_RPC:-https://eth.llamarpc.com}"
-CHAIN138_RPC="${RPC_URL:-https://rpc.d-bis.org}"
-PRIVATE_KEY="${PRIVATE_KEY}"
-if [[ ! "$PRIVATE_KEY" =~ ^0x ]]; then
-    PRIVATE_KEY="0x$PRIVATE_KEY"
+MAINNET_RPC="${MAINNET_RPC%$'\r'}"
+MAINNET_RPC="${MAINNET_RPC%$'\n'}"
+CHAIN138_RPC="${RPC_URL_138:-${CHAIN138_RPC:-http://192.168.11.211:8545}}"
+CHAIN138_RPC="${CHAIN138_RPC%$'\r'}"
+CHAIN138_RPC="${CHAIN138_RPC%$'\n'}"
+
+PRIVATE_KEY="${PRIVATE_KEY:-}"
+[[ -n "$PRIVATE_KEY" && ! "$PRIVATE_KEY" =~ ^0x ]] && PRIVATE_KEY="0x$PRIVATE_KEY"
+
+WETH10_BRIDGE_MAINNET=$(grep "CCIPWETH10_BRIDGE_MAINNET=" "$PROJECT_ROOT/.env" 2>/dev/null | cut -d'=' -f2 | tr -d ' "\r\n' || echo "${CCIPWETH10_BRIDGE_MAINNET:-}")
+WETH10_BRIDGE_CHAIN138=$(grep "CCIPWETH10_BRIDGE_CHAIN138=" "$PROJECT_ROOT/.env" 2>/dev/null | cut -d'=' -f2 | tr -d ' "\r\n' || echo "${CCIPWETH10_BRIDGE_CHAIN138:-}")
+
+CHAIN138_SELECTOR="${CHAIN138_SELECTOR:-138}"
+ETH_SELECTOR="${ETH_MAINNET_SELECTOR:-5009297550715157269}"
+
+WETH10_BRIDGE_MAINNET="${WETH10_BRIDGE_MAINNET,,}"
+WETH10_BRIDGE_CHAIN138="${WETH10_BRIDGE_CHAIN138,,}"
+
+if [[ -z "$WETH10_BRIDGE_MAINNET" || -z "$WETH10_BRIDGE_CHAIN138" ]]; then
+  echo "Error: Set CCIPWETH10_BRIDGE_MAINNET and CCIPWETH10_BRIDGE_CHAIN138 in .env" >&2
+  exit 1
 fi

-WETH10_BRIDGE_MAINNET=$(grep "CCIPWETH10_BRIDGE_MAINNET=" "$PROJECT_ROOT/.env" 2>/dev/null | cut -d'=' -f2 | tr -d ' "' || echo "")
-WETH10_BRIDGE_CHAIN138=$(grep "CCIPWETH10_BRIDGE_CHAIN138=" "$PROJECT_ROOT/.env" 2>/dev/null | cut -d'=' -f2 | tr -d ' "' || echo "")
-
-CHAIN138_SELECTOR="${CHAIN138_SELECTOR:-0x000000000000008a}"
-ETH_SELECTOR="${ETH_MAINNET_SELECTOR:-0x500147}"
-
-if [ -z "$WETH10_BRIDGE_MAINNET" ] || [ -z "$WETH10_BRIDGE_CHAIN138" ]; then
-    echo "Error: Bridge addresses not found in .env"
-    exit 1
-fi
-
-echo "Configuring CCIPWETH10Bridge..."
-echo "  Mainnet Bridge: $WETH10_BRIDGE_MAINNET"
-echo "  Chain-138 Bridge: $WETH10_BRIDGE_CHAIN138"
-echo "To configure, run:"
-echo "  # On Mainnet:"
-echo "  cast send $WETH10_BRIDGE_MAINNET \"addDestination(uint64,address)\" $CHAIN138_SELECTOR $WETH10_BRIDGE_CHAIN138 --rpc-url $MAINNET_RPC --private-key $PRIVATE_KEY"
-echo "  # On Chain-138:"
-echo "  cast send $WETH10_BRIDGE_CHAIN138 \"addDestination(uint64,address)\" $ETH_SELECTOR $WETH10_BRIDGE_MAINNET --rpc-url $CHAIN138_RPC --private-key $PRIVATE_KEY"
+echo "=== CCIPWETH10Bridge — run these cast commands (decimal selectors) ==="
+echo ""
+echo "# On Ethereum mainnet (add Chain 138 as destination):"
+echo "cast send ${WETH10_BRIDGE_MAINNET} \"addDestination(uint64,address)\" ${CHAIN138_SELECTOR} ${WETH10_BRIDGE_CHAIN138} \\"
+echo "  --rpc-url ${MAINNET_RPC} --private-key \"\$PRIVATE_KEY\" --legacy --gas-limit 400000"
+echo ""
+echo "# On Chain 138 (add Mainnet as destination):"
+echo "cast send ${WETH10_BRIDGE_CHAIN138} \"addDestination(uint64,address)\" ${ETH_SELECTOR} ${WETH10_BRIDGE_MAINNET} \\"
+echo "  --rpc-url ${CHAIN138_RPC} --private-key \"\$PRIVATE_KEY\" --legacy --gas-limit 250000 --gas-price 2000000000"
+echo ""
+echo "Or run: ./scripts/deployment/execute-bridge-config.sh"
--- a/scripts/deployment/configure-weth9-bridge.sh
+++ b/scripts/deployment/configure-weth9-bridge.sh
@@ -1,38 +1,56 @@
 #!/usr/bin/env bash
-# Configure CCIPWETH9Bridge destinations
+# Print cast commands to configure CCIPWETH9Bridge (Mainnet ↔ Chain 138).
+# For hands-off execution use execute-bridge-config.sh (WETH9 + WETH10).
+
+set -euo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-source "$SCRIPT_DIR/../lib/init.sh"
+[[ -f "$SCRIPT_DIR/../lib/init.sh" ]] && source "$SCRIPT_DIR/../lib/init.sh" 2>/dev/null || true
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"

-# Load environment
-if [ -f "$PROJECT_ROOT/.env" ]; then
-    source "$PROJECT_ROOT/.env"
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
 fi

 MAINNET_RPC="${ETHEREUM_MAINNET_RPC:-https://eth.llamarpc.com}"
-CHAIN138_RPC="${RPC_URL:-https://rpc.d-bis.org}"
-PRIVATE_KEY="${PRIVATE_KEY}"
-if [[ ! "$PRIVATE_KEY" =~ ^0x ]]; then
-    PRIVATE_KEY="0x$PRIVATE_KEY"
+MAINNET_RPC="${MAINNET_RPC%$'\r'}"
+MAINNET_RPC="${MAINNET_RPC%$'\n'}"
+CHAIN138_RPC="${RPC_URL_138:-${CHAIN138_RPC:-http://192.168.11.211:8545}}"
+CHAIN138_RPC="${CHAIN138_RPC%$'\r'}"
+CHAIN138_RPC="${CHAIN138_RPC%$'\n'}"
+
+PRIVATE_KEY="${PRIVATE_KEY:-}"
+[[ -n "$PRIVATE_KEY" && ! "$PRIVATE_KEY" =~ ^0x ]] && PRIVATE_KEY="0x$PRIVATE_KEY"
+
+WETH9_BRIDGE_MAINNET=$(grep "CCIPWETH9_BRIDGE_MAINNET=" "$PROJECT_ROOT/.env" 2>/dev/null | cut -d'=' -f2 | tr -d ' "\r\n' || echo "${CCIPWETH9_BRIDGE_MAINNET:-}")
+WETH9_BRIDGE_CHAIN138=$(grep "CCIPWETH9_BRIDGE_CHAIN138=" "$PROJECT_ROOT/.env" 2>/dev/null | cut -d'=' -f2 | tr -d ' "\r\n' || echo "${CCIPWETH9_BRIDGE_CHAIN138:-}")
+
+CHAIN138_SELECTOR="${CHAIN138_SELECTOR:-138}"
+ETH_SELECTOR="${ETH_MAINNET_SELECTOR:-5009297550715157269}"
+
+WETH9_BRIDGE_MAINNET="${WETH9_BRIDGE_MAINNET,,}"
+WETH9_BRIDGE_CHAIN138="${WETH9_BRIDGE_CHAIN138,,}"
+
+if [[ -z "$WETH9_BRIDGE_MAINNET" || -z "$WETH9_BRIDGE_CHAIN138" ]]; then
+  echo "Error: Set CCIPWETH9_BRIDGE_MAINNET and CCIPWETH9_BRIDGE_CHAIN138 in .env" >&2
+  exit 1
 fi

-WETH9_BRIDGE_MAINNET=$(grep "CCIPWETH9_BRIDGE_MAINNET=" "$PROJECT_ROOT/.env" 2>/dev/null | cut -d'=' -f2 | tr -d ' "' || echo "")
-WETH9_BRIDGE_CHAIN138=$(grep "CCIPWETH9_BRIDGE_CHAIN138=" "$PROJECT_ROOT/.env" 2>/dev/null | cut -d'=' -f2 | tr -d ' "' || echo "")
-
-CHAIN138_SELECTOR="${CHAIN138_SELECTOR:-0x000000000000008a}"
-ETH_SELECTOR="${ETH_MAINNET_SELECTOR:-0x500147}"
-
-if [ -z "$WETH9_BRIDGE_MAINNET" ] || [ -z "$WETH9_BRIDGE_CHAIN138" ]; then
-    echo "Error: Bridge addresses not found in .env"
-    exit 1
-fi
-
-echo "Configuring CCIPWETH9Bridge..."
-echo "  Mainnet Bridge: $WETH9_BRIDGE_MAINNET"
-echo "  Chain-138 Bridge: $WETH9_BRIDGE_CHAIN138"
-echo "To configure, run:"
-echo "  # On Mainnet:"
-echo "  cast send $WETH9_BRIDGE_MAINNET \"addDestination(uint64,address)\" $CHAIN138_SELECTOR $WETH9_BRIDGE_CHAIN138 --rpc-url $MAINNET_RPC --private-key $PRIVATE_KEY"
-echo "  # On Chain-138:"
-echo "  cast send $WETH9_BRIDGE_CHAIN138 \"addDestination(uint64,address)\" $ETH_SELECTOR $WETH9_BRIDGE_MAINNET --rpc-url $CHAIN138_RPC --private-key $PRIVATE_KEY"
+echo "=== CCIPWETH9Bridge — run these cast commands (decimal selectors) ==="
+echo ""
+echo "# On Ethereum mainnet (add Chain 138 as destination):"
+echo "cast send ${WETH9_BRIDGE_MAINNET} \"addDestination(uint64,address)\" ${CHAIN138_SELECTOR} ${WETH9_BRIDGE_CHAIN138} \\"
+echo "  --rpc-url ${MAINNET_RPC} --private-key \"\$PRIVATE_KEY\" --legacy --gas-limit 400000"
+echo ""
+echo "# On Chain 138 (add Mainnet as destination):"
+echo "cast send ${WETH9_BRIDGE_CHAIN138} \"addDestination(uint64,address)\" ${ETH_SELECTOR} ${WETH9_BRIDGE_MAINNET} \\"
+echo "  --rpc-url ${CHAIN138_RPC} --private-key \"\$PRIVATE_KEY\" --legacy --gas-limit 250000 --gas-price 2000000000"
+echo ""
+echo "Or run: ./scripts/deployment/execute-bridge-config.sh"
--- a/scripts/deployment/create-terraform-backend.sh
+++ b/scripts/deployment/create-terraform-backend.sh
@@ -8,6 +8,22 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../lib/init.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi


 log_info "=== Creating Terraform Backend Storage Account ==="
--- a/scripts/deployment/create-uniswap-v3-pool-cusdt-cusdc.sh
+++ b/scripts/deployment/create-uniswap-v3-pool-cusdt-cusdc.sh
@@ -10,8 +10,23 @@
 set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi
 DOTENV="$REPO_ROOT/.env"
-if [[ -f "$DOTENV" ]]; then set -a; source "$DOTENV"; set +a; fi

 UNISWAP_V3_FACTORY="${UNISWAP_V3_FACTORY:-0x1F98431c8aD98523631AE4a59f267346ea31F984}"
 FEE="${FEE:-500}"
--- a/scripts/deployment/deploy-36-region-infrastructure.sh
+++ b/scripts/deployment/deploy-36-region-infrastructure.sh
@@ -7,6 +7,22 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../lib/init.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi
 TF_DIR="$PROJECT_ROOT/terraform/well-architected/cloud-sovereignty"

 cd "$TF_DIR"
--- a/scripts/deployment/deploy-all-contracts.sh
+++ b/scripts/deployment/deploy-all-contracts.sh
@@ -5,8 +5,23 @@ set -e
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

-source .env 2>/dev/null || true

 RPC_URL="${RPC_URL_138:-http://localhost:8545}"
 GAS_PRICE="${GAS_PRICE:-1000000000}"
--- a/scripts/deployment/deploy-all-from-proxy.sh
+++ b/scripts/deployment/deploy-all-from-proxy.sh
@@ -7,6 +7,22 @@ set -e
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
 echo "Phase 2 Complete Deployment from Proxy Host"
--- a/scripts/deployment/deploy-all-mainnet.sh
+++ b/scripts/deployment/deploy-all-mainnet.sh
@@ -8,6 +8,22 @@ set -e
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../lib/init.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi


 # Load environment variables
--- a/scripts/deployment/deploy-all-mainnets-with-mapper-oracle-pmm.sh
+++ b/scripts/deployment/deploy-all-mainnets-with-mapper-oracle-pmm.sh
@@ -8,11 +8,24 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 # Load .env without strict unset (avoid init.sh pipefail on .env)
-set +u
-[ -f .env ] && source .env
-set -u
 [ -f "$SCRIPT_DIR/../lib/infura.sh" ] && source "$SCRIPT_DIR/../lib/infura.sh"

 PHASE="${1:-all}"
--- a/scripts/deployment/deploy-all-ordered.sh
+++ b/scripts/deployment/deploy-all-ordered.sh
@@ -11,6 +11,22 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../lib/init.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 log_info "=== Deploy All Contracts in Proper Order ==="

--- a/scripts/deployment/deploy-all-phases.sh
+++ b/scripts/deployment/deploy-all-phases.sh
@@ -15,6 +15,22 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 if [ -f .env ]; then
  set -a
--- a/scripts/deployment/deploy-all-ready-chains.sh
+++ b/scripts/deployment/deploy-all-ready-chains.sh
@@ -8,6 +8,22 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"

 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 # Source environment
 if [ -f .env ]; then
--- a/scripts/deployment/deploy-all.sh
+++ b/scripts/deployment/deploy-all.sh
@@ -9,6 +9,22 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../lib/init.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi
 DEPLOYMENT_LOG="${PROJECT_ROOT}/deployment.log"
 CONTRACT_ADDRESSES_FILE="${PROJECT_ROOT}/contracts-deployed.json"

--- a/scripts/deployment/deploy-bridges-chain138.sh
+++ b/scripts/deployment/deploy-bridges-chain138.sh
@@ -4,6 +4,22 @@
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../lib/init.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi


 log_info "=== Deploying Bridges on Chain-138 ==="
--- a/scripts/deployment/deploy-bridges-config-ready-chains.sh
+++ b/scripts/deployment/deploy-bridges-config-ready-chains.sh
@@ -14,8 +14,27 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

-[[ -f "$PROJECT_ROOT/.env" ]] && set -a && source "$PROJECT_ROOT/.env" && set +a
+GNOSIS_RPC="${GNOSIS_RPC:-${GNOSIS_MAINNET_RPC:-}}"
+CRONOS_RPC="${CRONOS_RPC:-${CRONOS_RPC_URL:-}}"
+CELO_RPC="${CELO_RPC:-${CELO_MAINNET_RPC:-}}"
+WEMIX_RPC="${WEMIX_RPC:-${WEMIX_MAINNET_RPC:-}}"

 DRY_RUN="${DRY_RUN:-0}"
 SIMULATE="${SIMULATE:-0}"
--- a/scripts/deployment/deploy-bridges-mainnet.sh
+++ b/scripts/deployment/deploy-bridges-mainnet.sh
@@ -7,6 +7,22 @@ set -e
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../lib/init.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi


 # Load environment variables
--- a/scripts/deployment/deploy-cacti.sh
+++ b/scripts/deployment/deploy-cacti.sh
@@ -8,6 +8,22 @@ set -e
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../lib/init.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 # Configuration
 NAMESPACE="${NAMESPACE:-cacti}"
--- a/scripts/deployment/deploy-ccip-logger-all-chains.sh
+++ b/scripts/deployment/deploy-ccip-logger-all-chains.sh
@@ -9,10 +9,20 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 cd "$PROJECT_ROOT"
-
-if [[ -f .env ]]; then
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
  set -a
-  source .env
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
  set +a
 fi

--- a/scripts/deployment/deploy-ccip-router.sh
+++ b/scripts/deployment/deploy-ccip-router.sh
@@ -39,6 +39,22 @@ echo "Data Fee Per Byte: $DATA_FEE_PER_BYTE"

 # Deploy using Foundry
 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 forge script script/DeployCCIPRouter.s.sol \
    --rpc-url "$RPC_URL" \
--- a/scripts/deployment/deploy-ccip-weth10-bridge.sh
+++ b/scripts/deployment/deploy-ccip-weth10-bridge.sh
@@ -45,6 +45,22 @@ echo "WETH10 Address: $WETH10_ADDRESS"
 echo "Fee Token (LINK): $CCIP_FEE_TOKEN"

 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 # Export environment variables for Foundry
 export PRIVATE_KEY
--- a/scripts/deployment/deploy-ccip-weth9-bridge.sh
+++ b/scripts/deployment/deploy-ccip-weth9-bridge.sh
@@ -45,6 +45,22 @@ echo "WETH9 Address: $WETH9_ADDRESS"
 echo "Fee Token (LINK): $CCIP_FEE_TOKEN"

 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 # Export environment variables for Foundry
 export PRIVATE_KEY
--- a/scripts/deployment/deploy-contracts-once-ready.sh
+++ b/scripts/deployment/deploy-contracts-once-ready.sh
@@ -7,8 +7,23 @@ set -e
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

-source .env 2>/dev/null || true

 RPC_URL="${RPC_URL:-http://localhost:8545}"
 PRIVATE_KEY="${PRIVATE_KEY:-}"
--- a/scripts/deployment/deploy-contracts-ordered.sh
+++ b/scripts/deployment/deploy-contracts-ordered.sh
@@ -11,6 +11,22 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../lib/init.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 # Load environment variables
 if [ ! -f .env ]; then
--- a/scripts/deployment/deploy-contracts-parallel.sh
+++ b/scripts/deployment/deploy-contracts-parallel.sh
@@ -8,6 +8,22 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../lib/init.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 # Load environment variables
 if [ ! -f .env ]; then
--- a/scripts/deployment/deploy-contracts-unified.sh
+++ b/scripts/deployment/deploy-contracts-unified.sh
@@ -8,6 +8,22 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../lib/init.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 # Default values
 MODE="${MODE:-ordered}"  # ordered or parallel
--- a/scripts/deployment/deploy-cusdt-cusdc-all-chains.sh
+++ b/scripts/deployment/deploy-cusdt-cusdc-all-chains.sh
@@ -8,7 +8,22 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 DOTENV="$REPO_ROOT/.env"
 cd "$REPO_ROOT"
-if [[ -f "$DOTENV" ]]; then set -a; source "$DOTENV"; set +a; fi
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "$REPO_ROOT"
+elif [[ -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi
+
+GNOSIS_MAINNET_RPC="${GNOSIS_MAINNET_RPC:-${GNOSIS_RPC:-}}"
+CRONOS_RPC_URL="${CRONOS_RPC_URL:-${CRONOS_RPC:-}}"
+CELO_MAINNET_RPC="${CELO_MAINNET_RPC:-${CELO_RPC:-}}"
+WEMIX_MAINNET_RPC="${WEMIX_MAINNET_RPC:-${WEMIX_RPC:-}}"

 # Chain name : chain_id : RPC env var name
 CHAINS=(
--- a/scripts/deployment/deploy-firefly.sh
+++ b/scripts/deployment/deploy-firefly.sh
@@ -8,6 +8,22 @@ set -e
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../lib/init.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 # Configuration
 NAMESPACE="${NAMESPACE:-firefly}"
--- a/scripts/deployment/deploy-full-parity-all-chains.sh
+++ b/scripts/deployment/deploy-full-parity-all-chains.sh
@@ -11,10 +11,23 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

-set +u
-[ -f .env ] && source .env
-set -u
 [ -f "$SCRIPT_DIR/../lib/infura.sh" ] && source "$SCRIPT_DIR/../lib/infura.sh"

 PHASE="${1:-all}"
--- a/scripts/deployment/deploy-keyvaults-only.sh
+++ b/scripts/deployment/deploy-keyvaults-only.sh
@@ -5,6 +5,22 @@ set -e
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../lib/init.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi
 TERRAFORM_DIR="$PROJECT_ROOT/terraform/well-architected/cloud-sovereignty"

 echo "╔════════════════════════════════════════════════════════════════╗"
--- a/scripts/deployment/deploy-mainnet-tether-mirror.sh
+++ b/scripts/deployment/deploy-mainnet-tether-mirror.sh
@@ -8,6 +8,22 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../" && pwd)"

 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 # Source environment variables
 if [ -f .env ]; then
--- a/scripts/deployment/deploy-multicall.sh
+++ b/scripts/deployment/deploy-multicall.sh
@@ -20,6 +20,22 @@ echo "Deploying Multicall to ChainID 138..."
 echo "RPC URL: $RPC_URL"

 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 forge script script/DeployMulticall.s.sol \
    --rpc-url "$RPC_URL" \
--- a/scripts/deployment/deploy-multisig.sh
+++ b/scripts/deployment/deploy-multisig.sh
@@ -8,6 +8,22 @@ set -e
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../lib/init.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 RPC_URL="${RPC_URL:-http://localhost:8545}"
 PRIVATE_KEY="${PRIVATE_KEY:-}"
--- a/scripts/deployment/deploy-off-chain-services.sh
+++ b/scripts/deployment/deploy-off-chain-services.sh
@@ -96,6 +96,22 @@ deploy_service() {
    fi
    
    cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi
 }

 # Main deployment
--- a/scripts/deployment/deploy-official-dvm-chain138.sh
+++ b/scripts/deployment/deploy-official-dvm-chain138.sh
@@ -7,6 +7,22 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 DODO_DIR="$PROJECT_ROOT/lib/dodo-contractV2"
 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 if [[ ! -f .env ]]; then
  echo "ERROR: .env not found" >&2
--- a/scripts/deployment/deploy-optional-future-all.sh
+++ b/scripts/deployment/deploy-optional-future-all.sh
@@ -12,6 +12,22 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 if [ -f .env ]; then
  set -a
--- a/scripts/deployment/deploy-phase1.sh
+++ b/scripts/deployment/deploy-phase1.sh
@@ -8,6 +8,22 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../lib/init.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 log() {
    log_success "[✓] $1"
--- a/scripts/deployment/deploy-phase2-and-contracts-parallel.sh
+++ b/scripts/deployment/deploy-phase2-and-contracts-parallel.sh
@@ -8,6 +8,22 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../lib/init.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 # Load environment variables
 if [ ! -f .env ]; then
--- a/scripts/deployment/deploy-phase2-from-proxy.sh
+++ b/scripts/deployment/deploy-phase2-from-proxy.sh
@@ -9,6 +9,22 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"

 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
 echo "Phase 2 Deployment from Proxy Host"
--- a/scripts/deployment/deploy-phase2.sh
+++ b/scripts/deployment/deploy-phase2.sh
@@ -8,6 +8,22 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../lib/init.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi
 TERRAFORM_DIR="$PROJECT_ROOT/terraform"

 log() {
--- a/scripts/deployment/deploy-sufficient-balance-chains.sh
+++ b/scripts/deployment/deploy-sufficient-balance-chains.sh
@@ -10,6 +10,22 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 # Load .env
 if [ -f .env ]; then
--- a/scripts/deployment/deploy-tokenization-service.sh
+++ b/scripts/deployment/deploy-tokenization-service.sh
@@ -8,6 +8,22 @@ set -e
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../lib/init.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 # Configuration
 NAMESPACE="${NAMESPACE:-besu-network}"
--- a/scripts/deployment/deploy-tokens-and-weth-all-chains-skip-canonical.sh
+++ b/scripts/deployment/deploy-tokens-and-weth-all-chains-skip-canonical.sh
@@ -34,8 +34,23 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

-[ -f .env ] && set -a && source .env && set +a

 DRY_RUN=false
 CHAINS_FILTER=""
--- a/scripts/deployment/deploy-vault-system-and-ac-vdc-sdc.sh
+++ b/scripts/deployment/deploy-vault-system-and-ac-vdc-sdc.sh
@@ -6,8 +6,23 @@ set -e
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

-source .env 2>/dev/null || true

 RPC_URL="${RPC_URL_138:-http://192.168.11.211:8545}"
 GAS_PRICE="${GAS_PRICE:-1000000000}"
--- a/scripts/deployment/deploy-weth-create.sh
+++ b/scripts/deployment/deploy-weth-create.sh
@@ -8,9 +8,24 @@ set -e
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 # Load environment
-source .env 2>/dev/null || true

 RPC_URL="${RPC_URL:-http://localhost:8545}"
 PRIVATE_KEY="${PRIVATE_KEY:-}"
--- a/scripts/deployment/deploy-weth-create2.sh
+++ b/scripts/deployment/deploy-weth-create2.sh
@@ -7,9 +7,24 @@ set -e
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 # Load environment
-source .env 2>/dev/null || true

 RPC_URL="${RPC_URL:-http://localhost:8545}"
 PRIVATE_KEY="${PRIVATE_KEY:-}"
--- a/scripts/deployment/deploy-weth-unified.sh
+++ b/scripts/deployment/deploy-weth-unified.sh
@@ -81,6 +81,22 @@ if [ -z "$PRIVATE_KEY" ]; then
 fi

 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
 echo "🚀 Unified WETH Deployment"
--- a/scripts/deployment/deploy-weth-with-ccip.sh
+++ b/scripts/deployment/deploy-weth-with-ccip.sh
@@ -69,6 +69,22 @@ fi
 echo "========================================="

 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 # Export environment variables for Foundry
 export PRIVATE_KEY
--- a/scripts/deployment/deploy-weth.sh
+++ b/scripts/deployment/deploy-weth.sh
@@ -20,6 +20,22 @@ echo "Deploying WETH to ChainID 138..."
 echo "RPC URL: $RPC_URL"

 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 forge script script/DeployWETH.s.sol \
    --rpc-url "$RPC_URL" \
--- a/scripts/deployment/deploy-weth10.sh
+++ b/scripts/deployment/deploy-weth10.sh
@@ -20,6 +20,22 @@ echo "Deploying WETH10 to ChainID 138..."
 echo "RPC URL: $RPC_URL"

 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 forge script script/DeployWETH10.s.sol \
    --rpc-url "$RPC_URL" \
--- a/scripts/deployment/deployment-readiness-report.sh
+++ b/scripts/deployment/deployment-readiness-report.sh
@@ -4,6 +4,22 @@
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../lib/init.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi


 log_info "=== Ethereum Mainnet Deployment Readiness Report ==="
--- a/scripts/deployment/dry-run-enhanced-swap-router-chain138.sh
+++ b/scripts/deployment/dry-run-enhanced-swap-router-chain138.sh
@@ -0,0 +1,247 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SMOM_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+ENV_FILE="$SMOM_ROOT/.env"
+RUN_FORGE_DRY_RUN=0
+RUN_TIMEOUT_SECONDS="${RUN_TIMEOUT_SECONDS:-90}"
+VERBOSITY="${VERBOSITY:--vv}"
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --run)
+      RUN_FORGE_DRY_RUN=1
+      shift
+      ;;
+    --timeout-seconds)
+      RUN_TIMEOUT_SECONDS="${2:?missing value for --timeout-seconds}"
+      shift 2
+      ;;
+    --verbosity)
+      VERBOSITY="${2:?missing value for --verbosity}"
+      shift 2
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      echo "Usage: $0 [--run] [--timeout-seconds <seconds>] [--verbosity <-v|-vv|-vvv|...>]" >&2
+      exit 1
+      ;;
+  esac
+done
+
+CHAIN138_WETH_DEFAULT="0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2"
+CHAIN138_USDT_DEFAULT="0x004b63A7B5b0E06f6bB6adb4a5F9f590BF3182D1"
+CHAIN138_USDC_DEFAULT="0x71D6687F38b93CCad569Fa6352c876eea967201b"
+DAI_PLACEHOLDER_DEFAULT="0x6B175474E89094C44Da98b954EedeAC495271d0F"
+
+if [[ -f "$ENV_FILE" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$ENV_FILE"
+  set +a
+fi
+
+RPC_URL_138="${RPC_URL_138:-http://192.168.11.211:8545}"
+WETH="${WETH:-$CHAIN138_WETH_DEFAULT}"
+OFFICIAL_USDT_ADDRESS="${OFFICIAL_USDT_ADDRESS:-$CHAIN138_USDT_DEFAULT}"
+OFFICIAL_USDC_ADDRESS="${OFFICIAL_USDC_ADDRESS:-$CHAIN138_USDC_DEFAULT}"
+DAI="${DAI:-$DAI_PLACEHOLDER_DEFAULT}"
+
+missing=()
+[[ -n "${PRIVATE_KEY:-}" ]] || missing+=("PRIVATE_KEY")
+[[ -n "${RPC_URL_138:-}" ]] || missing+=("RPC_URL_138")
+
+show_var() {
+  local name="$1" value="$2" note="${3:-}"
+  printf '  %-28s %s' "$name" "$value"
+  [[ -n "$note" ]] && printf '  (%s)' "$note"
+  printf '\n'
+}
+
+probe_bool() {
+  local label="$1" token_in="$2" token_out="$3" provider="$4"
+  local calldata payload response result
+  calldata="$(cast calldata "supportsTokenPair(address,address)" "$token_in" "$token_out" 2>/dev/null || true)"
+  [[ -n "$calldata" ]] || {
+    echo "  UNKNOWN: $label (failed to encode calldata)"
+    return 2
+  }
+  payload=$(printf '{"jsonrpc":"2.0","method":"eth_call","params":[{"to":"%s","data":"%s"},"latest"],"id":1}' "$provider" "$calldata")
+  response="$(curl -s -X POST "$RPC_URL_138" -H 'Content-Type: application/json' --data "$payload" 2>/dev/null || true)"
+  result="$(printf '%s' "$response" | sed -n 's/.*"result":"\([^"]*\)".*/\1/p')"
+  case "$result" in
+    "true"|"0x0000000000000000000000000000000000000000000000000000000000000001")
+      echo "  OK: $label"
+      return 0
+      ;;
+    "false"|"0x0000000000000000000000000000000000000000000000000000000000000000")
+      echo "  MISSING: $label"
+      return 1
+      ;;
+    *)
+      echo "  UNKNOWN: $label (provider call failed)"
+      return 2
+      ;;
+  esac
+}
+
+run_forge_dry_run() {
+  local forge_cmd=(
+    forge script script/bridge/trustless/DeployEnhancedSwapRouter.s.sol:DeployEnhancedSwapRouter
+    --skip test
+    --non-interactive
+    --rpc-url "$RPC_URL_138"
+    --private-key "$PRIVATE_KEY"
+    "$VERBOSITY"
+  )
+  local exit_code=0
+
+  echo "Running targeted build warm-up"
+  forge build contracts/bridge/trustless/EnhancedSwapRouter.sol script/bridge/trustless/DeployEnhancedSwapRouter.s.sol
+  echo ""
+  echo "Running sourced non-broadcast forge script"
+  echo "Timeout: ${RUN_TIMEOUT_SECONDS}s"
+  echo "Verbosity: $VERBOSITY"
+  echo ""
+
+  set +e
+  if command -v timeout >/dev/null 2>&1; then
+    timeout "${RUN_TIMEOUT_SECONDS}s" "${forge_cmd[@]}"
+    exit_code=$?
+  else
+    "${forge_cmd[@]}"
+    exit_code=$?
+  fi
+  set -e
+
+  if (( exit_code == 124 )); then
+    echo ""
+    echo "Forge dry-run timed out after ${RUN_TIMEOUT_SECONDS}s."
+    echo "Likely causes:"
+    echo "  - large project compilation still dominates the preflight"
+    echo "  - RPC simulation is slow on the current Chain 138 endpoint"
+    echo "  - the script needs more visibility to pinpoint the slow phase"
+    echo "Next diagnostic step:"
+    echo "  bash scripts/deployment/dry-run-enhanced-swap-router-chain138.sh --run --timeout-seconds 180 --verbosity -vvv"
+    return 124
+  fi
+
+  if (( exit_code != 0 )); then
+    echo ""
+    echo "Forge dry-run failed with exit code ${exit_code}."
+    return "$exit_code"
+  fi
+}
+
+echo "=== EnhancedSwapRouter Chain 138 Dry Run ==="
+echo "Project root: $SMOM_ROOT"
+echo "Env file: $ENV_FILE"
+echo ""
+
+if (( ${#missing[@]} > 0 )); then
+  echo "Missing required env:"
+  for item in "${missing[@]}"; do
+    echo "  - $item"
+  done
+  echo ""
+  echo "Set them in $ENV_FILE or export them in your shell, then rerun."
+  exit 1
+fi
+
+echo "Required env"
+show_var "RPC_URL_138" "$RPC_URL_138" "Core RPC only"
+show_var "PRIVATE_KEY" "<set>" "value loaded; not printed"
+echo ""
+
+echo "Chain 138 token env used by the deploy script"
+show_var "WETH" "$WETH" "defaults to Chain 138 canonical WETH"
+show_var "OFFICIAL_USDT_ADDRESS" "$OFFICIAL_USDT_ADDRESS" "defaults to Chain 138 mirror USDT"
+show_var "OFFICIAL_USDC_ADDRESS" "$OFFICIAL_USDC_ADDRESS" "defaults to Chain 138 mirror USDC"
+show_var "DAI" "$DAI" "placeholder unless a real Chain 138 DAI exists"
+echo ""
+
+echo "Optional provider env"
+show_var "DODOEX_ROUTER" "${DODOEX_ROUTER:-<unset>}" "unset => Dodoex provider disabled after deploy"
+show_var "DODO_PMM_PROVIDER_ADDRESS" "${DODO_PMM_PROVIDER_ADDRESS:-${DODO_PMM_PROVIDER:-<unset>}}" "set => Chain 138 uses deployed PMM provider backend"
+show_var "UNISWAP_V3_ROUTER" "${UNISWAP_V3_ROUTER:-<unset>}" "unset => Uniswap provider disabled after deploy"
+show_var "CURVE_3POOL" "${CURVE_3POOL:-<unset>}" "unset => Curve provider disabled after deploy"
+show_var "BALANCER_VAULT" "${BALANCER_VAULT:-<unset>}" "unset => Balancer provider disabled after deploy"
+show_var "ONEINCH_ROUTER" "${ONEINCH_ROUTER:-<unset>}" "unset => 1inch provider disabled after deploy"
+echo ""
+
+echo "Live execution readiness"
+if [[ -n "${DODO_PMM_PROVIDER_ADDRESS:-${DODO_PMM_PROVIDER:-}}" ]]; then
+  echo "  OK: DODO PMM provider is set, so Chain 138 can use the deployed PMM integration/provider backend."
+elif [[ -z "${DODOEX_ROUTER:-}" ]]; then
+  echo "  BLOCKER: neither DODOEX_ROUTER nor DODO_PMM_PROVIDER_ADDRESS is set."
+  echo "  BLOCKER: live Chain 138 DODO pool mappings would be registered, but no DODO execution path would remain enabled."
+else
+  echo "  OK: DODOEX_ROUTER is set, so external Dodoex token-to-token execution can stay enabled."
+fi
+if [[ -z "${UNISWAP_V3_ROUTER:-}" && -z "${BALANCER_VAULT:-}" && -z "${CURVE_3POOL:-}" && -z "${ONEINCH_ROUTER:-}" ]]; then
+  echo "  NOTE: no secondary providers are configured yet; that is acceptable for DODO-only bring-up."
+fi
+echo "  GAP: swapToStablecoin() still needs real WETH -> stable routes before it is operational on Chain 138."
+echo ""
+
+if [[ -n "${DODO_PMM_PROVIDER_ADDRESS:-${DODO_PMM_PROVIDER:-}}" ]] && command -v cast >/dev/null 2>&1; then
+  DODO_PROVIDER_TO_PROBE="${DODO_PMM_PROVIDER_ADDRESS:-${DODO_PMM_PROVIDER}}"
+  live_pair_missing=0
+  echo "Live PMM provider route probe"
+  probe_bool "WETH -> OFFICIAL_USDT_ADDRESS" "$WETH" "$OFFICIAL_USDT_ADDRESS" "$DODO_PROVIDER_TO_PROBE" || true
+  probe_bool "WETH -> OFFICIAL_USDC_ADDRESS" "$WETH" "$OFFICIAL_USDC_ADDRESS" "$DODO_PROVIDER_TO_PROBE" || true
+  probe_bool "WETH -> DAI" "$WETH" "$DAI" "$DODO_PROVIDER_TO_PROBE" || true
+  echo "Registered live-pair probe"
+  probe_bool "cUSDT -> cUSDC" "0x93E66202A11B1772E55407B32B44e5Cd8eda7f22" "0xf22258f57794CC8E06237084b353Ab30fFfa640b" "$DODO_PROVIDER_TO_PROBE" || true
+  if ! probe_bool "cUSDT -> OFFICIAL_USDT_ADDRESS" "0x93E66202A11B1772E55407B32B44e5Cd8eda7f22" "$OFFICIAL_USDT_ADDRESS" "$DODO_PROVIDER_TO_PROBE"; then
+    live_pair_missing=1
+  fi
+  if (( live_pair_missing == 1 )); then
+    echo "  BLOCKER: the deployed DODOPMMProvider is missing at least one documented live pair registration."
+    echo "  FIX: rerun RegisterDODOPools.s.sol with the corrected 2026-03-26 public pool map."
+  fi
+  echo "  NOTE: current bridge-and-swap via swapToStablecoin() needs at least one WETH -> stable route above."
+  echo ""
+fi
+
+echo "Live DODO pairs preloaded by the deploy script"
+echo "  - cUSDT <-> cUSDC"
+echo "  - cUSDT <-> USDT"
+echo "  - cUSDC <-> USDC"
+echo "  - cUSDT <-> cXAUC"
+echo "  - cUSDC <-> cXAUC"
+echo "  - cEURT <-> cXAUC"
+echo ""
+
+echo "Exact dry-run command"
+echo "cd \"$SMOM_ROOT\" && source .env && forge script script/bridge/trustless/DeployEnhancedSwapRouter.s.sol:DeployEnhancedSwapRouter --rpc-url \"$RPC_URL_138\" --private-key \"\$PRIVATE_KEY\""
+echo ""
+echo "Example minimal exports before dry-run"
+cat <<EOF
+export RPC_URL_138="$RPC_URL_138"
+export PRIVATE_KEY='<your-private-key>'
+export WETH="$WETH"
+export OFFICIAL_USDT_ADDRESS="$OFFICIAL_USDT_ADDRESS"
+export OFFICIAL_USDC_ADDRESS="$OFFICIAL_USDC_ADDRESS"
+# Optional if a real executable Dodo router exists on Chain 138:
+# export DODOEX_ROUTER=0x...
+# Preferred on current Chain 138 if DODOPMMProvider is deployed:
+# export DODO_PMM_PROVIDER_ADDRESS=0x...
+# Optional if/when live on Chain 138:
+# export UNISWAP_V3_ROUTER=0x...
+# export BALANCER_VAULT=0x...
+# export CURVE_3POOL=0x...
+# export ONEINCH_ROUTER=0x...
+EOF
+echo ""
+echo "Optional executable preflight"
+echo "  bash scripts/deployment/dry-run-enhanced-swap-router-chain138.sh --run"
+echo "  bash scripts/deployment/dry-run-enhanced-swap-router-chain138.sh --run --timeout-seconds 180 --verbosity -vvv"
+echo ""
+echo "Note: this is a safe dry-run helper only. The deploy script still warns that swapToStablecoin() needs real WETH->stable routes to be useful on Chain 138."
+
+if (( RUN_FORGE_DRY_RUN == 1 )); then
+  echo ""
+  run_forge_dry_run
+fi
--- a/scripts/deployment/dry-run-mainnet-deployment.sh
+++ b/scripts/deployment/dry-run-mainnet-deployment.sh
@@ -108,6 +108,22 @@ validate_address "$WETH10_ADDRESS" "WETH10"
 # Step 4: Compile contracts
 log_info "Step 4: Compiling contracts..."
 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 echo "Compiling CCIPWETH9Bridge..."
 if forge build --contracts contracts/ccip/CCIPWETH9Bridge.sol 2>&1 | grep -q "Compiler run successful\|No files changed"; then
--- a/scripts/deployment/ensure-prerequisites.sh
+++ b/scripts/deployment/ensure-prerequisites.sh
@@ -9,6 +9,22 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # PROJECT_ROOT = smom-dbis-138
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 RED='\033[0;31m'
 GREEN='\033[0;32m'
--- a/scripts/deployment/execute-all-phases.sh
+++ b/scripts/deployment/execute-all-phases.sh
@@ -5,6 +5,22 @@ set -e
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../lib/init.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 echo "╔════════════════════════════════════════════════════════════════╗"
 echo "║     EXECUTING ALL DEPLOYMENT PHASES                               ║"
--- a/scripts/deployment/execute-bridge-config.sh
+++ b/scripts/deployment/execute-bridge-config.sh
@@ -1,66 +1,83 @@
 #!/usr/bin/env bash
-# Execute bridge destination configuration
+# Execute WETH9/WETH10 bridge addDestination both directions: Ethereum mainnet ↔ Chain 138.
+# Requires .env with bridge addresses and PRIVATE_KEY.
+
+set -euo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../lib/init.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+cd "$PROJECT_ROOT"

-
-log_info "=== Executing Bridge Configuration ==="
-
-# Load environment
-if [ -f "$PROJECT_ROOT/.env" ]; then
-    source "$PROJECT_ROOT/.env"
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
 fi

+log_info "=== Executing bridge configuration (Mainnet ↔ Chain 138) ==="
+
 MAINNET_RPC="${ETHEREUM_MAINNET_RPC:-https://eth.llamarpc.com}"
-CHAIN138_RPC="${RPC_URL:-https://rpc.d-bis.org}"
-PRIVATE_KEY="${PRIVATE_KEY}"
-if [[ ! "$PRIVATE_KEY" =~ ^0x ]]; then
-    PRIVATE_KEY="0x$PRIVATE_KEY"
+MAINNET_RPC="${MAINNET_RPC%$'\r'}"
+MAINNET_RPC="${MAINNET_RPC%$'\n'}"
+CHAIN138_RPC="${RPC_URL_138:-${CHAIN138_RPC:-http://192.168.11.211:8545}}"
+CHAIN138_RPC="${CHAIN138_RPC%$'\r'}"
+CHAIN138_RPC="${CHAIN138_RPC%$'\n'}"
+
+PRIVATE_KEY="${PRIVATE_KEY:-}"
+[[ -n "$PRIVATE_KEY" && ! "$PRIVATE_KEY" =~ ^0x ]] && PRIVATE_KEY="0x$PRIVATE_KEY"
+
+WETH9_MAINNET=$(grep "CCIPWETH9_BRIDGE_MAINNET=" "$PROJECT_ROOT/.env" 2>/dev/null | cut -d'=' -f2 | tr -d ' "\r\n' || echo "${CCIPWETH9_BRIDGE_MAINNET:-}")
+WETH10_MAINNET=$(grep "CCIPWETH10_BRIDGE_MAINNET=" "$PROJECT_ROOT/.env" 2>/dev/null | cut -d'=' -f2 | tr -d ' "\r\n' || echo "${CCIPWETH10_BRIDGE_MAINNET:-}")
+WETH9_CHAIN138=$(grep "CCIPWETH9_BRIDGE_CHAIN138=" "$PROJECT_ROOT/.env" 2>/dev/null | cut -d'=' -f2 | tr -d ' "\r\n' || echo "${CCIPWETH9_BRIDGE_CHAIN138:-}")
+WETH10_CHAIN138=$(grep "CCIPWETH10_BRIDGE_CHAIN138=" "$PROJECT_ROOT/.env" 2>/dev/null | cut -d'=' -f2 | tr -d ' "\r\n' || echo "${CCIPWETH10_BRIDGE_CHAIN138:-}")
+
+CHAIN138_SELECTOR="${CHAIN138_SELECTOR:-138}"
+ETH_SELECTOR="${ETH_MAINNET_SELECTOR:-5009297550715157269}"
+
+WETH9_MAINNET="${WETH9_MAINNET,,}"
+WETH10_MAINNET="${WETH10_MAINNET,,}"
+WETH9_CHAIN138="${WETH9_CHAIN138,,}"
+WETH10_CHAIN138="${WETH10_CHAIN138,,}"
+
+if [[ -z "$WETH9_MAINNET" || -z "$WETH9_CHAIN138" || -z "$WETH10_MAINNET" || -z "$WETH10_CHAIN138" ]]; then
+  log_error "Bridge addresses not found in .env (CCIPWETH9/10_BRIDGE_MAINNET and CCIPWETH9/10_BRIDGE_CHAIN138)"
+  exit 1
 fi

-WETH9_MAINNET=$(grep "CCIPWETH9_BRIDGE_MAINNET=" "$PROJECT_ROOT/.env" 2>/dev/null | cut -d'=' -f2 | tr -d ' "' || echo "")
-WETH10_MAINNET=$(grep "CCIPWETH10_BRIDGE_MAINNET=" "$PROJECT_ROOT/.env" 2>/dev/null | cut -d'=' -f2 | tr -d ' "' || echo "")
-WETH9_CHAIN138=$(grep "CCIPWETH9_BRIDGE_CHAIN138=" "$PROJECT_ROOT/.env" 2>/dev/null | cut -d'=' -f2 | tr -d ' "' || echo "")
-WETH10_CHAIN138=$(grep "CCIPWETH10_BRIDGE_CHAIN138=" "$PROJECT_ROOT/.env" 2>/dev/null | cut -d'=' -f2 | tr -d ' "' || echo "")
+_gas138=(--legacy --gas-limit 250000 --gas-price 2000000000)
+_gas_main=(--legacy --gas-limit 400000)

-CHAIN138_SELECTOR="${CHAIN138_SELECTOR:-0x000000000000008a}"
-ETH_SELECTOR="${ETH_MAINNET_SELECTOR:-0x500147}"
-
-if [ -z "$WETH9_MAINNET" ] || [ -z "$WETH9_CHAIN138" ] || [ -z "$WETH10_MAINNET" ] || [ -z "$WETH10_CHAIN138" ]; then
-    log_error "Error: Bridge addresses not found in .env"
-    exit 1
-fi
+_try() {
+  local _o
+  if _o=$("$@" 2>&1); then
+    log_success "OK"
+    [[ -n "$_o" ]] && echo "$_o"
+  else
+    log_warn "Command failed (non-fatal for batch)"
+    echo "$_o" >&2
+  fi
+}

 echo "Configuring WETH9 Bridge..."
-echo "  Adding Chain-138 destination to Mainnet bridge..."
-if cast send "$WETH9_MAINNET" "addDestination(uint64,address)" "$CHAIN138_SELECTOR" "$WETH9_CHAIN138" --rpc-url "$MAINNET_RPC" --private-key "$PRIVATE_KEY" --legacy 2>&1 | grep -q "Success\|success"; then
-    log_success "✅ WETH9 Mainnet → Chain-138 configured"
-else
-    log_warn "⚠️  Configuration may have failed - check transaction"
-fi
-
-echo "  Adding Mainnet destination to Chain-138 bridge..."
-if cast send "$WETH9_CHAIN138" "addDestination(uint64,address)" "$ETH_SELECTOR" "$WETH9_MAINNET" --rpc-url "$CHAIN138_RPC" --private-key "$PRIVATE_KEY" --legacy 2>&1 | grep -q "Success\|success"; then
-    log_success "✅ WETH9 Chain-138 → Mainnet configured"
-else
-    log_warn "⚠️  Configuration may have failed - check transaction"
-fi
+echo "  Mainnet → Chain 138..."
+_try cast send "$WETH9_MAINNET" "addDestination(uint64,address)" "$CHAIN138_SELECTOR" "$WETH9_CHAIN138" \
+  --rpc-url "$MAINNET_RPC" --private-key "$PRIVATE_KEY" "${_gas_main[@]}"
+echo "  Chain 138 → Mainnet..."
+_try cast send "$WETH9_CHAIN138" "addDestination(uint64,address)" "$ETH_SELECTOR" "$WETH9_MAINNET" \
+  --rpc-url "$CHAIN138_RPC" --private-key "$PRIVATE_KEY" "${_gas138[@]}"

 echo "Configuring WETH10 Bridge..."
-echo "  Adding Chain-138 destination to Mainnet bridge..."
-if cast send "$WETH10_MAINNET" "addDestination(uint64,address)" "$CHAIN138_SELECTOR" "$WETH10_CHAIN138" --rpc-url "$MAINNET_RPC" --private-key "$PRIVATE_KEY" --legacy 2>&1 | grep -q "Success\|success"; then
-    log_success "✅ WETH10 Mainnet → Chain-138 configured"
-else
-    log_warn "⚠️  Configuration may have failed - check transaction"
-fi
+echo "  Mainnet → Chain 138..."
+_try cast send "$WETH10_MAINNET" "addDestination(uint64,address)" "$CHAIN138_SELECTOR" "$WETH10_CHAIN138" \
+  --rpc-url "$MAINNET_RPC" --private-key "$PRIVATE_KEY" "${_gas_main[@]}"
+echo "  Chain 138 → Mainnet..."
+_try cast send "$WETH10_CHAIN138" "addDestination(uint64,address)" "$ETH_SELECTOR" "$WETH10_MAINNET" \
+  --rpc-url "$CHAIN138_RPC" --private-key "$PRIVATE_KEY" "${_gas138[@]}"

-echo "  Adding Mainnet destination to Chain-138 bridge..."
-if cast send "$WETH10_CHAIN138" "addDestination(uint64,address)" "$ETH_SELECTOR" "$WETH10_MAINNET" --rpc-url "$CHAIN138_RPC" --private-key "$PRIVATE_KEY" --legacy 2>&1 | grep -q "Success\|success"; then
-    log_success "✅ WETH10 Chain-138 → Mainnet configured"
-else
-    log_warn "⚠️  Configuration may have failed - check transaction"
-fi
-
-log_success "✅ Bridge configuration complete!"
+log_success "Bridge configuration attempts finished (review output above)."
--- a/scripts/deployment/execute-cross-chain-test.sh
+++ b/scripts/deployment/execute-cross-chain-test.sh
@@ -4,6 +4,22 @@
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../lib/init.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi


 log_info "=== Cross-Chain Transfer Test ==="
--- a/scripts/deployment/export-cronos-verification-sources.sh
+++ b/scripts/deployment/export-cronos-verification-sources.sh
@@ -7,6 +7,22 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 OUT_DIR="$PROJECT_ROOT/.cronos-verify"
 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 mkdir -p "$OUT_DIR"

--- a/scripts/deployment/find-all-deployed-contracts.sh
+++ b/scripts/deployment/find-all-deployed-contracts.sh
@@ -7,8 +7,23 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

-source .env 2>/dev/null || true

 echo "=========================================="
 echo "Finding All Deployed Mainnet Contracts"
--- a/scripts/deployment/fix-configuration-issues.sh
+++ b/scripts/deployment/fix-configuration-issues.sh
@@ -11,6 +11,22 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../lib/init.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 log_info "=== Fixing Configuration Issues ==="

--- a/scripts/deployment/fund-ccip-bridges-with-link.sh
+++ b/scripts/deployment/fund-ccip-bridges-with-link.sh
@@ -20,10 +20,13 @@ run_or_echo() {
  if [[ "${DRY_RUN:-0}" = "1" ]]; then
    echo "  [DRY RUN] $*"
  else
-    if eval "$*"; then
+    local _out
+    if _out=$(eval "$*" 2>&1); then
      echo "  OK"
+      [[ -n "$_out" ]] && echo "    $_out"
    else
-      echo "  Failed (non-fatal)"
+      echo "  Failed (non-fatal)" >&2
+      echo "    $_out" >&2
    fi
  fi
 }
@@ -38,13 +41,15 @@ fi
 echo "Funding CCIP bridges with LINK (amount per bridge: $LINK_AMOUNT_WEI wei)"
 echo ""

-# Chain 138
+# Chain 138 (Besu: gas estimation often fails; use explicit legacy gas like manual cast)
 if [[ -n "${RPC_URL_138:-}" && -n "${LINK_TOKEN_CHAIN138:-${LINK_TOKEN:-}}" ]]; then
  link="${LINK_TOKEN_CHAIN138:-$LINK_TOKEN}"
+  link="${link,,}"
  rpc=$(ensure_rpc "$RPC_URL_138")
  echo "Chain 138 (RPC: ${rpc%%\?*}...)"
-  [[ -n "${CCIPWETH9_BRIDGE_CHAIN138:-}" ]]  && run_or_echo "cast send $link \"transfer(address,uint256)\" $CCIPWETH9_BRIDGE_CHAIN138 $LINK_AMOUNT_WEI --rpc-url \"$rpc\" --private-key \"\$PRIVATE_KEY\" --legacy"
-  [[ -n "${CCIPWETH10_BRIDGE_CHAIN138:-}" ]] && run_or_echo "cast send $link \"transfer(address,uint256)\" $CCIPWETH10_BRIDGE_CHAIN138 $LINK_AMOUNT_WEI --rpc-url \"$rpc\" --private-key \"\$PRIVATE_KEY\" --legacy"
+  _gas138="--legacy --gas-limit 250000 --gas-price 2000000000"
+  [[ -n "${CCIPWETH9_BRIDGE_CHAIN138:-}" ]]  && run_or_echo "cast send $link \"transfer(address,uint256)\" ${CCIPWETH9_BRIDGE_CHAIN138,,} $LINK_AMOUNT_WEI --rpc-url \"$rpc\" --private-key \"\$PRIVATE_KEY\" $_gas138"
+  [[ -n "${CCIPWETH10_BRIDGE_CHAIN138:-}" ]] && run_or_echo "cast send $link \"transfer(address,uint256)\" ${CCIPWETH10_BRIDGE_CHAIN138,,} $LINK_AMOUNT_WEI --rpc-url \"$rpc\" --private-key \"\$PRIVATE_KEY\" $_gas138"
  echo ""
 fi

@@ -58,8 +63,8 @@ if [[ -n "${ETHEREUM_MAINNET_RPC:-}" && -n "${MAINNET_LINK_TOKEN:-${CCIP_ETH_LIN
  echo ""
 fi

-# BSC, Polygon, Base, Optimism, Arbitrum, Avalanche, Cronos, Gnosis, Celo
-for label in BSC POLYGON BASE OPTIMISM ARBITRUM AVALANCHE CRONOS GNOSIS CELO; do
+# BSC, Polygon, Base, Optimism, Arbitrum, Avalanche, Cronos, Gnosis, Celo, Wemix (matches check-link-balance-config-ready-chains.sh)
+for label in BSC POLYGON BASE OPTIMISM ARBITRUM AVALANCHE CRONOS GNOSIS CELO WEMIX; do
  case "$label" in
    BSC)      rpc_var="BSC_RPC_URL";              link_var="CCIP_BSC_LINK_TOKEN"; ;;
    POLYGON)  rpc_var="POLYGON_MAINNET_RPC";      link_var="CCIP_POLYGON_LINK_TOKEN"; ;;
@@ -70,6 +75,7 @@ for label in BSC POLYGON BASE OPTIMISM ARBITRUM AVALANCHE CRONOS GNOSIS CELO; do
    CRONOS)   rpc_var="CRONOS_RPC_URL";           link_var="CCIP_CRONOS_LINK_TOKEN"; rpc_fb="CRONOS_RPC"; link_fb="LINK_TOKEN_CRONOS"; ;;
    GNOSIS)   rpc_var="GNOSIS_MAINNET_RPC";       link_var="CCIP_GNOSIS_LINK_TOKEN"; rpc_fb="GNOSIS_RPC"; link_fb="LINK_TOKEN_GNOSIS"; ;;
    CELO)     rpc_var="CELO_MAINNET_RPC";         link_var="CCIP_CELO_LINK_TOKEN";   rpc_fb="CELO_RPC"; link_fb="LINK_TOKEN_CELO"; ;;
+    WEMIX)    rpc_var="WEMIX_RPC";                link_var="CCIP_WEMIX_LINK_TOKEN";  rpc_fb="WEMIX_MAINNET_RPC"; link_fb="LINK_TOKEN_WEMIX"; ;;
  esac
  rpc="${!rpc_var:-${!rpc_fb:-}}"
  link="${!link_var:-${!link_fb:-}}"
@@ -83,8 +89,8 @@ for label in BSC POLYGON BASE OPTIMISM ARBITRUM AVALANCHE CRONOS GNOSIS CELO; do
  [[ -z "$addr9" && -z "$addr10" ]] && continue

  echo "$label"
-  [[ -n "$addr9" ]]  && run_or_echo "cast send $link \"transfer(address,uint256)\" $addr9  $LINK_AMOUNT_WEI --rpc-url \"$rpc\" --private-key \"\$PRIVATE_KEY\" --legacy"
-  [[ -n "$addr10" ]] && run_or_echo "cast send $link \"transfer(address,uint256)\" $addr10 $LINK_AMOUNT_WEI --rpc-url \"$rpc\" --private-key \"\$PRIVATE_KEY\" --legacy"
+  [[ -n "$addr9" ]]  && run_or_echo "cast send ${link,,} \"transfer(address,uint256)\" ${addr9,,}  $LINK_AMOUNT_WEI --rpc-url \"$rpc\" --private-key \"\$PRIVATE_KEY\" --legacy"
+  [[ -n "$addr10" ]] && run_or_echo "cast send ${link,,} \"transfer(address,uint256)\" ${addr10,,} $LINK_AMOUNT_WEI --rpc-url \"$rpc\" --private-key \"\$PRIVATE_KEY\" --legacy"
  echo ""
 done

--- a/scripts/deployment/generate-all-adapters.sh
+++ b/scripts/deployment/generate-all-adapters.sh
@@ -6,6 +6,22 @@ set -euo pipefail

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi
 CONTRACTS_DIR="$PROJECT_ROOT/contracts/bridge/adapters"
 SCRIPTS_DIR="$PROJECT_ROOT/script/deploy/chains"
 CONFIG_DIR="$PROJECT_ROOT/config/chains"
--- a/scripts/deployment/generate-genesis-with-validators.sh
+++ b/scripts/deployment/generate-genesis-with-validators.sh
@@ -9,6 +9,22 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../lib/init.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 CONFIG_DIR="$PROJECT_ROOT/config"
 KEYS_DIR="$PROJECT_ROOT/keys"
--- a/scripts/deployment/generate-phase2-tfvars.sh
+++ b/scripts/deployment/generate-phase2-tfvars.sh
@@ -6,6 +6,22 @@ set -e

 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi
 OUTPUT_FILE="${1:-${PROJECT_ROOT}/terraform/phases/phase2/terraform.tfvars}"

 # Load .env if it exists
--- a/scripts/deployment/generate-static-nodes.sh
+++ b/scripts/deployment/generate-static-nodes.sh
@@ -8,6 +8,22 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../lib/init.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 cd "$PROJECT_ROOT"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 CONFIG_DIR="$PROJECT_ROOT/config"

--- a/scripts/deployment/get-app-gateway-ip.sh
+++ b/scripts/deployment/get-app-gateway-ip.sh
@@ -9,6 +9,22 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../lib/init.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 # Load environment variables
 if [ -f "${PROJECT_ROOT}/.env" ]; then
--- a/scripts/deployment/get-wallet-address.sh
+++ b/scripts/deployment/get-wallet-address.sh
@@ -7,6 +7,22 @@ set -e
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../lib/init.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi

 # Colors

--- a/scripts/deployment/import-all-resources.sh
+++ b/scripts/deployment/import-all-resources.sh
@@ -22,6 +22,22 @@ run() {
 }

 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi
 TERRAFORM_DIR="$PROJECT_ROOT/terraform/well-architected/cloud-sovereignty"

 cd "$TERRAFORM_DIR"
--- a/scripts/deployment/import-existing-clusters.sh
+++ b/scripts/deployment/import-existing-clusters.sh
@@ -7,6 +7,22 @@ set -e
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../lib/init.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi
 TERRAFORM_DIR="$PROJECT_ROOT/terraform/well-architected/cloud-sovereignty"

 cd "$TERRAFORM_DIR"
--- a/scripts/deployment/init-terraform.sh
+++ b/scripts/deployment/init-terraform.sh
@@ -8,6 +8,22 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/../lib/init.sh"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+# Load .env via dotenv (RPC CR/LF trim). Fallback: raw source.
+if [[ -f "$SCRIPT_DIR/../lib/deployment/dotenv.sh" ]]; then
+  # shellcheck disable=SC1090
+  source "$SCRIPT_DIR/../lib/deployment/dotenv.sh"
+  load_deployment_env --repo-root "${PROJECT_ROOT:-$REPO_ROOT}"
+elif [[ -n "${PROJECT_ROOT:-}" && -f "$PROJECT_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$PROJECT_ROOT/.env"
+  set +a
+elif [[ -n "${REPO_ROOT:-}" && -f "$REPO_ROOT/.env" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$REPO_ROOT/.env"
+  set +a
+fi
 TERRAFORM_DIR="$PROJECT_ROOT/terraform"

 log() {
--- a/scripts/deployment/inventory-chain138-pmm-desired-state.sh
+++ b/scripts/deployment/inventory-chain138-pmm-desired-state.sh
@@ -0,0 +1,183 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SMOM_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+ENV_FILE="$SMOM_ROOT/.env"
+CONFIG_JSON="${POOL_CONFIG_JSON:-$SMOM_ROOT/config/chain138-pmm-pools.json}"
+ORIG_RPC_URL_138="${RPC_URL_138-}"
+ORIG_RPC_URL="${RPC_URL-}"
+ORIG_DODO_PMM_INTEGRATION_ADDRESS="${DODO_PMM_INTEGRATION_ADDRESS-}"
+ORIG_DODO_PMM_INTEGRATION="${DODO_PMM_INTEGRATION-}"
+ORIG_DODO_PMM_PROVIDER_ADDRESS="${DODO_PMM_PROVIDER_ADDRESS-}"
+ORIG_DODO_PMM_PROVIDER="${DODO_PMM_PROVIDER-}"
+
+if [[ -f "$ENV_FILE" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$ENV_FILE"
+  set +a
+fi
+
+[[ -n "$ORIG_RPC_URL_138" ]] && RPC_URL_138="$ORIG_RPC_URL_138"
+[[ -n "$ORIG_RPC_URL" ]] && RPC_URL="$ORIG_RPC_URL"
+[[ -n "$ORIG_DODO_PMM_INTEGRATION_ADDRESS" ]] && DODO_PMM_INTEGRATION_ADDRESS="$ORIG_DODO_PMM_INTEGRATION_ADDRESS"
+[[ -n "$ORIG_DODO_PMM_INTEGRATION" ]] && DODO_PMM_INTEGRATION="$ORIG_DODO_PMM_INTEGRATION"
+[[ -n "$ORIG_DODO_PMM_PROVIDER_ADDRESS" ]] && DODO_PMM_PROVIDER_ADDRESS="$ORIG_DODO_PMM_PROVIDER_ADDRESS"
+[[ -n "$ORIG_DODO_PMM_PROVIDER" ]] && DODO_PMM_PROVIDER="$ORIG_DODO_PMM_PROVIDER"
+
+RPC_URL_138="${RPC_URL_138:-${RPC_URL:-http://192.168.11.211:8545}}"
+DODO_PMM_INTEGRATION_ADDRESS="${DODO_PMM_INTEGRATION_ADDRESS:-${DODO_PMM_INTEGRATION:-}}"
+DODO_PMM_PROVIDER_ADDRESS="${DODO_PMM_PROVIDER_ADDRESS:-${DODO_PMM_PROVIDER:-}}"
+
+[[ -f "$CONFIG_JSON" ]] || { echo "POOL_CONFIG_JSON not found: $CONFIG_JSON" >&2; exit 1; }
+command -v jq >/dev/null 2>&1 || { echo "jq is required" >&2; exit 1; }
+command -v cast >/dev/null 2>&1 || { echo "cast is required" >&2; exit 1; }
+[[ -n "$DODO_PMM_INTEGRATION_ADDRESS" ]] || { echo "DODO_PMM_INTEGRATION_ADDRESS not set" >&2; exit 1; }
+[[ -n "$DODO_PMM_PROVIDER_ADDRESS" ]] || { echo "DODO_PMM_PROVIDER_ADDRESS not set" >&2; exit 1; }
+
+declare -A TOKENS=()
+while IFS=$'\t' read -r sym addr; do
+  TOKENS["$sym"]="$addr"
+done < <(jq -r '.tokens | to_entries[] | [.key, .value] | @tsv' "$CONFIG_JSON")
+
+mapfile -t C_STARS < <(jq -r '.groups.cStarSymbols[]' "$CONFIG_JSON")
+mapfile -t OFFICIALS < <(jq -r '.groups.officialStableSymbols[]' "$CONFIG_JSON")
+WETH_SYMBOL="$(jq -r '.groups.wethSymbol' "$CONFIG_JSON")"
+
+rpc_call() {
+  local to="$1" data="$2"
+  local payload
+  payload=$(printf '{"jsonrpc":"2.0","method":"eth_call","params":[{"to":"%s","data":"%s"},"latest"],"id":1}' "$to" "$data")
+  curl -s -X POST "$RPC_URL_138" -H 'Content-Type: application/json' --data "$payload"
+}
+
+json_result() {
+  sed -n 's/.*"result":"\([^"]*\)".*/\1/p'
+}
+
+hex_to_addr() {
+  local value="${1#0x}"
+  if [[ ${#value} -lt 40 ]]; then
+    echo "0x0000000000000000000000000000000000000000"
+    return 0
+  fi
+  printf '0x%s\n' "${value: -40}"
+}
+
+pool_for() {
+  local calldata result
+  calldata="$(cast calldata "pools(address,address)" "$1" "$2" 2>/dev/null || true)"
+  [[ -n "$calldata" ]] || { echo "0x0000000000000000000000000000000000000000"; return 0; }
+  result="$(rpc_call "$DODO_PMM_INTEGRATION_ADDRESS" "$calldata" | json_result)"
+  [[ -n "$result" ]] || { echo "0x0000000000000000000000000000000000000000"; return 0; }
+  hex_to_addr "$result"
+}
+
+provider_pool_for() {
+  local calldata result
+  calldata="$(cast calldata "pools(address,address)" "$1" "$2" 2>/dev/null || true)"
+  [[ -n "$calldata" ]] || { echo "0x0000000000000000000000000000000000000000"; return 0; }
+  result="$(rpc_call "$DODO_PMM_PROVIDER_ADDRESS" "$calldata" | json_result)"
+  [[ -n "$result" ]] || { echo "0x0000000000000000000000000000000000000000"; return 0; }
+  hex_to_addr "$result"
+}
+
+declare -A SEEN=()
+DESIRED_PAIRS=()
+
+add_pair() {
+  local base_sym="$1" quote_sym="$2"
+  local base="${TOKENS[$base_sym]:-}"
+  local quote="${TOKENS[$quote_sym]:-}"
+  local key="${base_sym}|${quote_sym}"
+
+  [[ -n "$base" && -n "$quote" ]] || return 0
+  [[ -z "${SEEN[$key]:-}" ]] || return 0
+  SEEN["$key"]=1
+  DESIRED_PAIRS+=("${base_sym}|${base}|${quote_sym}|${quote}")
+}
+
+if [[ "$(jq -r '.groups.deploy.cStarVsCStar' "$CONFIG_JSON")" == "true" ]]; then
+  for ((i=0; i<${#C_STARS[@]}; i++)); do
+    for ((j=i+1; j<${#C_STARS[@]}; j++)); do
+      add_pair "${C_STARS[$i]}" "${C_STARS[$j]}"
+    done
+  done
+fi
+if [[ "$(jq -r '.groups.deploy.cStarVsOfficial' "$CONFIG_JSON")" == "true" ]]; then
+  for cstar in "${C_STARS[@]}"; do
+    for official in "${OFFICIALS[@]}"; do
+      add_pair "$cstar" "$official"
+    done
+  done
+fi
+if [[ "$(jq -r '.groups.deploy.cStarVsWeth' "$CONFIG_JSON")" == "true" ]]; then
+  for cstar in "${C_STARS[@]}"; do
+    add_pair "$cstar" "$WETH_SYMBOL"
+  done
+fi
+if [[ "$(jq -r '.groups.deploy.officialVsWeth' "$CONFIG_JSON")" == "true" ]]; then
+  for official in "${OFFICIALS[@]}"; do
+    add_pair "$official" "$WETH_SYMBOL"
+  done
+fi
+while IFS=$'\t' read -r base_sym quote_sym; do
+  add_pair "$base_sym" "$quote_sym"
+done < <(jq -r '.explicitPairs[]? | [.baseSymbol, .quoteSymbol] | @tsv' "$CONFIG_JSON")
+
+echo "=== Chain 138 PMM Desired-State Inventory ==="
+echo "Config:       $CONFIG_JSON"
+echo "Integration:  $DODO_PMM_INTEGRATION_ADDRESS"
+echo "Provider:     $DODO_PMM_PROVIDER_ADDRESS"
+echo "RPC:          $RPC_URL_138"
+echo "Desired pairs:${#DESIRED_PAIRS[@]}"
+echo ""
+
+existing=0
+missing=0
+aligned=0
+needs_registration=0
+stale_provider_only=0
+provider_mismatch=0
+
+for pair in "${DESIRED_PAIRS[@]}"; do
+  IFS='|' read -r base_sym base quote_sym quote <<< "$pair"
+  label="${base_sym}/${quote_sym}"
+  pool="$(pool_for "$base" "$quote")"
+  provider_pool_ab="$(provider_pool_for "$base" "$quote")"
+  provider_pool_ba="$(provider_pool_for "$quote" "$base")"
+
+  if [[ "$pool" != "0x0000000000000000000000000000000000000000" ]]; then
+    ((existing++)) || true
+    status="EXISTS"
+  else
+    ((missing++)) || true
+    status="MISSING"
+  fi
+
+  if [[ "$pool" != "0x0000000000000000000000000000000000000000" && "$provider_pool_ab" == "$pool" && "$provider_pool_ba" == "$pool" ]]; then
+    ((aligned++)) || true
+    route_status="ALIGNED"
+  elif [[ "$pool" != "0x0000000000000000000000000000000000000000" && "$provider_pool_ab" == "0x0000000000000000000000000000000000000000" && "$provider_pool_ba" == "0x0000000000000000000000000000000000000000" ]]; then
+    ((needs_registration++)) || true
+    route_status="NEEDS_REGISTRATION"
+  elif [[ "$pool" == "0x0000000000000000000000000000000000000000" && ( "$provider_pool_ab" != "0x0000000000000000000000000000000000000000" || "$provider_pool_ba" != "0x0000000000000000000000000000000000000000" ) ]]; then
+    ((stale_provider_only++)) || true
+    route_status="STALE_PROVIDER_ONLY"
+  else
+    ((provider_mismatch++)) || true
+    route_status="PROVIDER_MISMATCH"
+  fi
+
+  echo "$status  $route_status  $label  integrationPool=$pool providerAB=$provider_pool_ab providerBA=$provider_pool_ba"
+done
+
+echo ""
+echo "Summary:"
+echo "  Existing pools:       $existing"
+echo "  Missing pools:        $missing"
+echo "  Aligned routes:       $aligned"
+echo "  Needs registration:   $needs_registration"
+echo "  Stale provider only:  $stale_provider_only"
+echo "  Provider mismatch:    $provider_mismatch"
--- a/scripts/deployment/inventory-register-dodo-pools-chain138.sh
+++ b/scripts/deployment/inventory-register-dodo-pools-chain138.sh
@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SMOM_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+ENV_FILE="$SMOM_ROOT/.env"
+
+if [[ -f "$ENV_FILE" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$ENV_FILE"
+  set +a
+fi
+
+RPC_URL_138="${RPC_URL_138:-http://192.168.11.211:8545}"
+DODO_PMM_INTEGRATION_ADDRESS="${DODO_PMM_INTEGRATION_ADDRESS:-${DODO_PMM_INTEGRATION:-}}"
+DODO_PMM_PROVIDER_ADDRESS="${DODO_PMM_PROVIDER_ADDRESS:-${DODO_PMM_PROVIDER:-}}"
+
+[[ -n "$DODO_PMM_INTEGRATION_ADDRESS" ]] || { echo "DODO_PMM_INTEGRATION_ADDRESS not set"; exit 1; }
+[[ -n "$DODO_PMM_PROVIDER_ADDRESS" ]] || { echo "DODO_PMM_PROVIDER_ADDRESS not set"; exit 1; }
+
+declare -A SYMBOLS=(
+  ["0x93e66202a11b1772e55407b32b44e5cd8eda7f22"]="cUSDT"
+  ["0xf22258f57794cc8e06237084b353ab30fffa640b"]="cUSDC"
+  ["0x8085961f9cf02b4d800a3c6d386d31da4b34266a"]="cEURC"
+  ["0xdf4b71c61e5912712c1bdd451416b9ac26949d72"]="cEURT"
+  ["0x003960f16d9d34f2e98d62723b6721fb92074ad2"]="cGBPC"
+  ["0x350f54e4d23795f86a9c03988c7135357ccad97c"]="cGBPT"
+  ["0xd51482e567c03899eece3cae8a058161fd56069d"]="cAUDC"
+  ["0xee269e1226a334182aace90056ee4ee5cc8a6770"]="cJPYC"
+  ["0x873990849dda5117d7c644f0af24370797c03885"]="cCHFC"
+  ["0x54dbd40cf05e15906a2c21f600937e96787f5679"]="cCADC"
+  ["0x290e52a8819a4fbd0714e517225429aa2b70ec6b"]="cXAUC"
+  ["0x94e408e26c6fd8f4ee00b54df19082fda07dc96e"]="cXAUT"
+  ["0x004b63a7b5b0e06f6bb6adb4a5f9f590bf3182d1"]="USDT"
+  ["0x71d6687f38b93ccad569fa6352c876eea967201b"]="USDC"
+  ["0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2"]="WETH"
+)
+
+rpc_call() {
+  local to="$1" data="$2"
+  local payload
+  payload=$(printf '{"jsonrpc":"2.0","method":"eth_call","params":[{"to":"%s","data":"%s"},"latest"],"id":1}' "$to" "$data")
+  curl -s -X POST "$RPC_URL_138" -H 'Content-Type: application/json' --data "$payload"
+}
+
+json_result() {
+  sed -n 's/.*"result":"\([^"]*\)".*/\1/p'
+}
+
+word_at() {
+  local hex="$1" index="$2"
+  local start=$(( index * 64 ))
+  printf '%s' "${hex:$start:64}"
+}
+
+addr_from_word() {
+  local word="$1"
+  printf '0x%s' "${word:24:40}"
+}
+
+symbol_for() {
+  local lower
+  lower="$(printf '%s' "$1" | tr '[:upper:]' '[:lower:]')"
+  if [[ -n "${SYMBOLS[$lower]:-}" ]]; then
+    printf '%s' "${SYMBOLS[$lower]}"
+  else
+    printf '%s' "$1"
+  fi
+}
+
+decode_address_array() {
+  local result="${1#0x}"
+  local count_hex count i
+  count_hex="$(word_at "$result" 1)"
+  count=$((16#$count_hex))
+  for ((i=0; i<count; i++)); do
+    addr_from_word "$(word_at "$result" $((i + 2)))"
+    printf '\n'
+  done
+}
+
+get_all_pools_data="$(rpc_call "$DODO_PMM_INTEGRATION_ADDRESS" "$(cast calldata "getAllPools()")" | json_result)"
+[[ -n "$get_all_pools_data" ]] || { echo "Failed to read getAllPools() from integration"; exit 1; }
+
+mapfile -t pools < <(decode_address_array "$get_all_pools_data")
+
+echo "=== DODO Registration Inventory (read-only) ==="
+echo "Integration: $DODO_PMM_INTEGRATION_ADDRESS"
+echo "Provider:    $DODO_PMM_PROVIDER_ADDRESS"
+echo "RPC:         $RPC_URL_138"
+echo "Pools found: ${#pools[@]}"
+echo ""
+
+for pool in "${pools[@]}"; do
+  pool_config_data="$(rpc_call "$DODO_PMM_INTEGRATION_ADDRESS" "$(cast calldata "getPoolConfig(address)" "$pool")" | json_result)"
+  [[ -n "$pool_config_data" ]] || {
+    echo "Pool: $pool"
+    echo "  SKIP: pool is removed or getPoolConfig(pool) is unreadable"
+    echo ""
+    continue
+  }
+  config_hex="${pool_config_data#0x}"
+  base="$(addr_from_word "$(word_at "$config_hex" 1)")"
+  quote="$(addr_from_word "$(word_at "$config_hex" 2)")"
+
+  echo "Pool:  $pool"
+  echo "Base:  $(symbol_for "$base") ($base)"
+  echo "Quote: $(symbol_for "$quote") ($quote)"
+  echo "Would register:"
+  echo "  registerPool($base, $quote, $pool)"
+  echo "  registerPool($quote, $base, $pool)"
+  echo ""
+done
+
+echo "Dry-run command:"
+echo "  cd \"$SMOM_ROOT\" && source .env && bash scripts/deployment/inventory-register-dodo-pools-chain138.sh"
+echo ""
+echo "Broadcast command:"
+echo "  cd \"$SMOM_ROOT\" && source .env && forge script script/liquidity/RegisterDODOPools.s.sol:RegisterDODOPools --rpc-url \"\$RPC_URL_138\" --private-key \"\$PRIVATE_KEY\" --broadcast --slow --with-gas-price 1000000000"
--- a/Show More
+++ b/Show More