merge(main): reconcile remote main into x402 verification branch

2026-07-12 15:14:59 -07:00
parent df46ede3d8 61de708a4c
commit 7b43908585
225 changed files with 12259 additions and 1606 deletions
--- a/scripts/deployment/activate-omnl-production.sh
+++ b/scripts/deployment/activate-omnl-production.sh
@@ -81,7 +81,8 @@ log "  Central Bank:   https://secure.d-bis.org/central-bank"
 log "  Online banking: https://online.omdnl.org/central-bank"
 log "  Office 24:      https://office24.omdnl.org/office-24"
 log "  DBIS Trade:     https://exchange.d-bis.org/trade"
-log "  Digital Swap:   https://digital.omdnl.org/swap"
+log "  Digital Swap:   https://exchange.omdnl.org/trade (OMNL) | Z: https://zblockchainsystem.com/swap"
+log "  Z Ecosystem:    https://zblockchainsystem.com/z (separate product)"
 log "=== Health ==="
 curl -sf http://127.0.0.1:3011/api/v1/settlement/health | head -c 120 || true
 echo
--- a/scripts/deployment/activate-swift-production.sh
+++ b/scripts/deployment/activate-swift-production.sh
@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+# Activate full SWIFT stack for Central Bank + Office 24 + Z Online Bank (production).
+set -euo pipefail
+
+REPO_DIR="${OMNL_BANK_ROOT:-$HOME/smom-dbis-138}"
+ENV_FILE="${OMNL_BANK_ENV:-$REPO_DIR/.env}"
+LISTENER_URL="${SWIFT_LISTENER_URL:-http://127.0.0.1:8788}"
+SETTLEMENT_BASE="${SETTLEMENT_HEALTH_URL:-https://secure.omdnl.org/settlement}"
+
+log() { echo "[$(date -Iseconds)] swift-activate $*"; }
+fail() { log "FAIL: $*"; exit 1; }
+
+[[ -f "$ENV_FILE" ]] || fail "Missing $ENV_FILE — load zardasht handoff first (chmod 600)"
+
+set -a
+# shellcheck disable=SC1090
+source "$ENV_FILE"
+set +a
+
+: "${OMNL_FINERACT_BASE_URL:?Set OMNL_FINERACT_BASE_URL}"
+: "${OMNL_FINERACT_PASSWORD:?Set OMNL_FINERACT_PASSWORD}"
+: "${OMNL_SUPER_ADMIN_OFFICE24_KEY:?Set OMNL_SUPER_ADMIN_OFFICE24_KEY}"
+
+export SETTLEMENT_MIDDLEWARE_CONFIG="${SETTLEMENT_MIDDLEWARE_CONFIG:-$REPO_DIR/config/settlement-middleware.production.v1.json}"
+export SWIFT_LISTENER_URL="${SWIFT_LISTENER_URL:-$LISTENER_URL}"
+export SETTLEMENT_ALLOW_HYBX_PRODUCTION="${SETTLEMENT_ALLOW_HYBX_PRODUCTION:-1}"
+export OMNL_PUBLIC_MONEY_SUPPLY="${OMNL_PUBLIC_MONEY_SUPPLY:-1}"
+
+log "1/5 Start SWIFT listener..."
+bash "$REPO_DIR/scripts/deployment/start-swift-listener-production.sh"
+
+log "2/5 Settlement health + Office 24..."
+health="$(curl -sS "${SETTLEMENT_BASE}/health")"
+echo "$health" | grep -q '"officeId":24' || fail "Office 24 not bound on settlement health"
+echo "$health" | grep -q '"status":"ok"' || fail "Settlement health not ok"
+
+log "3/5 Public money supply (Fineract live)..."
+ms="$(curl -sS "${SETTLEMENT_BASE}/public/money-supply")"
+echo "$ms" | grep -q 'fineractLive' || log "WARN: fineractLive not in money-supply response"
+
+log "4/5 SWIFT auth probe (empty external-transfer — expect validation error)..."
+code="$(curl -sS -o /tmp/swift-probe.json -w '%{http_code}' \
+  -X POST "${SETTLEMENT_BASE}/external-transfer" \
+  -H "Authorization: Bearer ${OMNL_SUPER_ADMIN_OFFICE24_KEY}" \
+  -H "Content-Type: application/json" \
+  -d '{}')"
+[[ "$code" == "400" || "$code" == "500" ]] || fail "external-transfer auth probe HTTP $code (expected 400/500)"
+grep -qi idempotencyKey /tmp/swift-probe.json || fail "Auth probe missing validation message"
+
+log "5/5 Inbound SWIFT stub (MT103 → listener)..."
+MT103='{1:F01OMNLUS33XXXX}{2:I103BANKUS33XXXXN}{4:
+:20:SWIFT-ACTIVATE-TEST
+:32A:260703USD1,00
+:59:/IQ98ZARD00000000000000000001
+Test Beneficiary
+:70:OMNL SWIFT activate probe chain138 cWUSDC
+-}'
+curl -sS -o /dev/null -w "listener=%{http_code}\n" \
+  -X POST "${SWIFT_LISTENER_URL}/inbound" \
+  -H "Content-Type: text/plain" \
+  ${SWIFT_LISTENER_WEBHOOK_TOKEN:+-H "Authorization: Bearer ${SWIFT_LISTENER_WEBHOOK_TOKEN}"} \
+  --data-binary "$MT103"
+
+log "SWIFT production stack active"
+log "  Listener:  ${SWIFT_LISTENER_URL}/health"
+log "  Settlement: ${SETTLEMENT_BASE}/health"
+log "  Portal:     /central-bank#z-settlement-protocols (MT102/MT103/SBLC/BG)"
+log "  Catalog:    config/swift-mt-catalog.v1.json"
+log ""
+log "MT types: MT103 MT102 MT202 MT910 MT940 MT942 MT950 + ISO20022 pacs/camt"
+log "Redeploy banking LXCs: bash scripts/deployment/deploy-omnl-bank-production.sh"
--- a/scripts/deployment/bootstrap-z-chain-anvil.ps1
+++ b/scripts/deployment/bootstrap-z-chain-anvil.ps1
@@ -0,0 +1,11 @@
+# Local Z Chain without Docker — Anvil (chainId 900002)
+$ErrorActionPreference = "Stop"
+$RpcPort = if ($env:Z_CHAIN_RPC_PORT) { $env:Z_CHAIN_RPC_PORT } else { "8546" }
+
+if (-not (Get-Command anvil -ErrorAction SilentlyContinue)) {
+  Write-Error "Install Foundry (anvil): https://book.getfoundry.sh/getting-started/installation"
+}
+
+Write-Host "Starting Anvil as Z Chain on http://127.0.0.1:$RpcPort (chainId 900002)"
+Write-Host "Use Anvil account #0 private key as PRIVATE_KEY for deploy."
+anvil --chain-id 900002 --port $RpcPort --host 127.0.0.1
--- a/scripts/deployment/bootstrap-z-chain-anvil.sh
+++ b/scripts/deployment/bootstrap-z-chain-anvil.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# Local Z Chain without Docker — Anvil (chainId 900002) for contract deploy / wallet dev.
+set -euo pipefail
+
+RPC_PORT="${Z_CHAIN_RPC_PORT:-8546}"
+CHAIN_ID=900002
+
+if ! command -v anvil &>/dev/null; then
+  echo "ERROR: install Foundry (anvil) — https://book.getfoundry.sh/getting-started/installation"
+  exit 1
+fi
+
+echo "Starting Anvil as Z Chain on http://127.0.0.1:$RPC_PORT (chainId $CHAIN_ID)"
+echo "Account #0 private key is printed by Anvil — use as PRIVATE_KEY for deploy."
+echo ""
+exec anvil --chain-id "$CHAIN_ID" --port "$RPC_PORT" --host 127.0.0.1
--- a/scripts/deployment/bootstrap-z-chain-local.ps1
+++ b/scripts/deployment/bootstrap-z-chain-local.ps1
@@ -0,0 +1,66 @@
+# Bootstrap local Z Chain (chainId 900002) with Hyperledger Besu via Docker.
+$ErrorActionPreference = "Stop"
+
+$Root = (Resolve-Path (Join-Path $PSScriptRoot "..\..")).Path
+$NetworkDir = if ($env:Z_CHAIN_NETWORK_DIR) { $env:Z_CHAIN_NETWORK_DIR } else { Join-Path $Root "logs\z-chain-network" }
+$GenesisConfig = Join-Path $Root "config\z-chain-network-config.json"
+$RpcPort = if ($env:Z_CHAIN_RPC_PORT) { $env:Z_CHAIN_RPC_PORT } else { "8546" }
+$ContainerName = if ($env:Z_CHAIN_BESU_CONTAINER) { $env:Z_CHAIN_BESU_CONTAINER } else { "z-chain-besu" }
+
+try {
+  docker info 2>&1 | Out-Null
+  if ($LASTEXITCODE -ne 0) { throw "Docker daemon not running" }
+} catch {
+  Write-Error "Docker is installed but not running. Start Docker Desktop or run: scripts\deployment\complete-z-chain.ps1 (Hardhat fallback)"
+}
+
+if (-not (Test-Path $GenesisConfig)) {
+  Write-Error "Missing $GenesisConfig"
+}
+
+New-Item -ItemType Directory -Force -Path $NetworkDir | Out-Null
+
+$GenesisOut = Join-Path $NetworkDir "genesis.json"
+if (-not (Test-Path $GenesisOut)) {
+  Write-Host "Generating IBFT2 network files in $NetworkDir ..."
+  docker run --rm `
+    -v "${Root}\config:/config:ro" `
+    -v "${NetworkDir}:/network" `
+    hyperledger/besu:latest `
+    operator generate-blockchain-config `
+      --config-file=/config/z-chain-network-config.json `
+      --to=/network
+}
+
+$existing = docker ps -a --format "{{.Names}}" 2>$null | Where-Object { $_ -eq $ContainerName }
+if ($existing) {
+  Write-Host "Removing existing container $ContainerName ..."
+  docker rm -f $ContainerName | Out-Null
+}
+
+$NodeKey = Join-Path $NetworkDir "keys\node1\key"
+if (-not (Test-Path $NodeKey) -or -not (Test-Path $GenesisOut)) {
+  Write-Error "Generated network files missing under $NetworkDir"
+}
+
+Write-Host "Starting Z Chain Besu on http://127.0.0.1:$RpcPort (chainId 900002) ..."
+docker run -d `
+  --name $ContainerName `
+  -p "${RpcPort}:8545" `
+  -v "${NetworkDir}:/network:ro" `
+  hyperledger/besu:latest `
+  --data-path=/tmp/besu `
+  --genesis-file=/network/genesis.json `
+  --node-private-key-file=/network/keys/node1/key `
+  --rpc-http-enabled `
+  --rpc-http-api=ETH,NET,WEB3,IBFT,ADMIN,DEBUG `
+  --rpc-http-host=0.0.0.0 `
+  --rpc-http-port=8545 `
+  --rpc-http-cors-origins="*" `
+  --host-allowlist="*" `
+  --min-gas-price=0 | Out-Null
+
+Write-Host ""
+Write-Host "Z Chain local RPC: http://127.0.0.1:$RpcPort"
+Write-Host 'Set env: CHAIN_900002_RPC_URL=http://127.0.0.1:' + $RpcPort
+Write-Host 'Set env: VITE_RPC_URL_900002=http://127.0.0.1:' + $RpcPort
--- a/scripts/deployment/bootstrap-z-chain-local.sh
+++ b/scripts/deployment/bootstrap-z-chain-local.sh
@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+# Bootstrap local Z Chain (chainId 900002) with Hyperledger Besu via Docker.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+NETWORK_DIR="${Z_CHAIN_NETWORK_DIR:-$ROOT/logs/z-chain-network}"
+GENESIS_CONFIG="$ROOT/config/z-chain-network-config.json"
+RPC_PORT="${Z_CHAIN_RPC_PORT:-8546}"
+CONTAINER_NAME="${Z_CHAIN_BESU_CONTAINER:-z-chain-besu}"
+
+cd "$ROOT"
+
+if ! command -v docker &>/dev/null; then
+  echo "ERROR: docker is required. Install Docker and retry."
+  exit 1
+fi
+
+if [[ ! -f "$GENESIS_CONFIG" ]]; then
+  echo "ERROR: missing $GENESIS_CONFIG"
+  exit 1
+fi
+
+mkdir -p "$NETWORK_DIR"
+
+if [[ ! -f "$NETWORK_DIR/genesis.json" ]]; then
+  echo "Generating IBFT2 network files in $NETWORK_DIR ..."
+  docker run --rm \
+    -v "$ROOT/config:/config:ro" \
+    -v "$NETWORK_DIR:/network" \
+    hyperledger/besu:latest \
+    operator generate-blockchain-config \
+      --config-file=/config/z-chain-network-config.json \
+      --to=/network
+fi
+
+if docker ps -a --format '{{.Names}}' | grep -qx "$CONTAINER_NAME"; then
+  echo "Removing existing container $CONTAINER_NAME ..."
+  docker rm -f "$CONTAINER_NAME" >/dev/null
+fi
+
+NODE_KEY="$NETWORK_DIR/keys/node1/key"
+GENESIS="$NETWORK_DIR/genesis.json"
+
+if [[ ! -f "$NODE_KEY" || ! -f "$GENESIS" ]]; then
+  echo "ERROR: generated network files missing under $NETWORK_DIR"
+  exit 1
+fi
+
+echo "Starting Z Chain Besu on http://127.0.0.1:$RPC_PORT (chainId 900002) ..."
+docker run -d \
+  --name "$CONTAINER_NAME" \
+  -p "${RPC_PORT}:8545" \
+  -v "$NETWORK_DIR:/network:ro" \
+  hyperledger/besu:latest \
+  --data-path=/tmp/besu \
+  --genesis-file=/network/genesis.json \
+  --node-private-key-file=/network/keys/node1/key \
+  --rpc-http-enabled \
+  --rpc-http-api=ETH,NET,WEB3,IBFT,ADMIN,DEBUG \
+  --rpc-http-host=0.0.0.0 \
+  --rpc-http-port=8545 \
+  --rpc-http-cors-origins="*" \
+  --host-allowlist="*" \
+  --min-gas-price=0
+
+echo ""
+echo "Z Chain local RPC: http://127.0.0.1:$RPC_PORT"
+echo "Export: CHAIN_900002_RPC_URL=http://127.0.0.1:$RPC_PORT"
+echo "Export: VITE_RPC_URL_900002=http://127.0.0.1:$RPC_PORT"
+echo "Verify: cast chain-id --rpc-url http://127.0.0.1:$RPC_PORT"
--- a/scripts/deployment/bootstrap-z-chain-production.sh
+++ b/scripts/deployment/bootstrap-z-chain-production.sh
@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+# Production Z Chain Besu bootstrap (chainId 900002) on a banking LXC or VM.
+# Generates IBFT2 keys once, then runs Besu with persistent data under /opt/besu-z-chain.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+NETWORK_DIR="${Z_CHAIN_NETWORK_DIR:-/opt/besu-z-chain/network}"
+DATA_PATH="${Z_CHAIN_DATA_PATH:-/opt/besu-z-chain/data}"
+GENESIS_CONFIG="$ROOT/config/z-chain-network-config.json"
+RPC_PORT="${Z_CHAIN_RPC_PORT:-8546}"
+CONTAINER_NAME="${Z_CHAIN_BESU_CONTAINER:-z-chain-besu-prod}"
+
+if [[ $EUID -ne 0 ]]; then
+  echo "Run as root on the target host (or use sudo)."
+  exit 1
+fi
+
+if ! command -v docker &>/dev/null; then
+  echo "ERROR: docker required on production host"
+  exit 1
+fi
+
+mkdir -p "$NETWORK_DIR" "$DATA_PATH"
+
+if [[ ! -f "$NETWORK_DIR/genesis.json" ]]; then
+  echo "Generating IBFT2 network files in $NETWORK_DIR ..."
+  docker run --rm \
+    -v "$ROOT/config:/config:ro" \
+    -v "$NETWORK_DIR:/network" \
+    hyperledger/besu:latest \
+    operator generate-blockchain-config \
+      --config-file=/config/z-chain-network-config.json \
+      --to=/network
+fi
+
+docker rm -f "$CONTAINER_NAME" 2>/dev/null || true
+
+echo "Starting production Z Chain Besu on 0.0.0.0:$RPC_PORT ..."
+docker run -d \
+  --name "$CONTAINER_NAME" \
+  --restart unless-stopped \
+  -p "127.0.0.1:${RPC_PORT}:8545" \
+  -v "$NETWORK_DIR:/network:ro" \
+  -v "$DATA_PATH:/data" \
+  hyperledger/besu:latest \
+  --data-path=/data \
+  --genesis-file=/network/genesis.json \
+  --node-private-key-file=/network/keys/node1/key \
+  --rpc-http-enabled \
+  --rpc-http-api=ETH,NET,WEB3,IBFT,ADMIN \
+  --rpc-http-host=127.0.0.1 \
+  --rpc-http-port=8545 \
+  --host-allowlist="*" \
+  --min-gas-price=0
+
+echo ""
+echo "Production Z Chain RPC (localhost): http://127.0.0.1:$RPC_PORT"
+echo "Expose via nginx/Cloudflare as https://rpc.zblockchainsystem.com"
+echo "Z portal: https://zblockchainsystem.com"
--- a/scripts/deployment/build-z-ecosystem-stack.sh
+++ b/scripts/deployment/build-z-ecosystem-stack.sh
@@ -0,0 +1,104 @@
+#!/usr/bin/env bash
+# Build and start Z Ecosystem stack only (no OMNL portal deploy).
+set -euo pipefail
+
+REPO_DIR="${Z_ECOSYSTEM_ROOT:-$HOME/smom-dbis-138}"
+LOG_DIR="${Z_ECOSYSTEM_LOG_DIR:-$HOME/z-ecosystem/logs}"
+ENV_FILE="${Z_ECOSYSTEM_ENV:-$REPO_DIR/config/z-ecosystem.local.env}"
+FRONTEND_PORT="${Z_ECOSYSTEM_FRONTEND_PORT:-3002}"
+API_PORT="${Z_TOKEN_AGGREGATION_PORT:-${PORT:-3000}}"
+
+log() { echo "[$(date -Iseconds)] $*"; }
+
+mkdir -p "$LOG_DIR"
+cd "$REPO_DIR"
+
+if [[ -f "$REPO_DIR/.env" ]]; then
+  set -a; set +u; source "$REPO_DIR/.env"; set -u; set +a
+fi
+if [[ -f "$ENV_FILE" ]]; then
+  set -a; set +u; source "$ENV_FILE"; set -u; set +a
+fi
+
+export VITE_ECOSYSTEM=z
+export VITE_ENABLE_Z_WALLET=true
+export OMNL_SUPPORTED_CHAINS_CONFIG="${Z_SUPPORTED_CHAINS_CONFIG:-$REPO_DIR/config/z-supported-chains.v1.json}"
+export SETTLEMENT_MIDDLEWARE_CONFIG="${SETTLEMENT_MIDDLEWARE_CONFIG:-$REPO_DIR/config/settlement-middleware.production.v1.json}"
+export CHAIN_900002_RPC_URL="${CHAIN_900002_RPC_URL:-https://rpc.zblockchainsystem.com}"
+export VITE_RPC_URL_900002="${VITE_RPC_URL_900002:-$CHAIN_900002_RPC_URL}"
+export VITE_Z_CHAIN_EXPLORER_URL="${VITE_Z_CHAIN_EXPLORER_URL:-https://explorer.zblockchainsystem.com}"
+export VITE_Z_ECOSYSTEM_URL="${VITE_Z_ECOSYSTEM_URL:-https://zblockchainsystem.com}"
+export VITE_TOKEN_AGGREGATION_URL="${VITE_TOKEN_AGGREGATION_URL:-/api/v1}"
+export VITE_SETTLEMENT_MIDDLEWARE_URL="${VITE_SETTLEMENT_MIDDLEWARE_URL:-/settlement}"
+export VITE_DBIS_EXCHANGE_URL="${VITE_DBIS_EXCHANGE_URL:-/exchange}"
+
+build_pkg() {
+  local dir="$1"
+  log "Building $dir..."
+  cd "$REPO_DIR/$dir"
+  NODE_ENV=development npm install --no-fund --no-audit
+  npm run build
+}
+
+for dir in packages/integration-foundation packages/settlement-core \
+  services/token-aggregation services/settlement-middleware services/dbis-exchange; do
+  build_pkg "$dir"
+done
+
+log "Building Z frontend (VITE_ECOSYSTEM=z)..."
+cd "$REPO_DIR/frontend-dapp"
+unset VITE_OMNL_API_KEY
+if command -v pnpm >/dev/null 2>&1; then
+  pnpm install --frozen-lockfile 2>/dev/null || pnpm install
+  VITE_ECOSYSTEM=z pnpm run build:z
+else
+  npm install
+  VITE_ECOSYSTEM=z npm run build:z
+fi
+
+start_svc() {
+  local name="$1"
+  local dir="$2"
+  local port="$3"
+  local cmd="$4"
+  log "Starting $name on :$port"
+  cd "$REPO_DIR/$dir"
+  pkill -f "smom-dbis-138/$dir" 2>/dev/null || true
+  fuser -k "${port}/tcp" 2>/dev/null || true
+  sleep 1
+  nohup env \
+    SETTLEMENT_MIDDLEWARE_CONFIG="$SETTLEMENT_MIDDLEWARE_CONFIG" \
+    OMNL_SUPPORTED_CHAINS_CONFIG="$OMNL_SUPPORTED_CHAINS_CONFIG" \
+    Z_SUPPORTED_CHAINS_CONFIG="$OMNL_SUPPORTED_CHAINS_CONFIG" \
+    PORT="$port" \
+    TOKEN_AGGREGATION_URL="${TOKEN_AGGREGATION_URL:-http://127.0.0.1:$port}" \
+    CHAIN_900002_RPC_URL="$CHAIN_900002_RPC_URL" \
+    AZURE_OPENAI_ENDPOINT="${AZURE_OPENAI_ENDPOINT:-}" \
+    AZURE_OPENAI_API_KEY="${AZURE_OPENAI_API_KEY:-}" \
+    AZURE_OPENAI_DEPLOYMENT="${AZURE_OPENAI_DEPLOYMENT:-}" \
+    AZURE_OPENAI_API_VERSION="${AZURE_OPENAI_API_VERSION:-2024-02-15-preview}" \
+    bash -c "$cmd" >"$LOG_DIR/$name.log" 2>&1 &
+  echo $! >"$LOG_DIR/$name.pid"
+}
+
+start_svc token-aggregation services/token-aggregation "$API_PORT" "npm run start"
+sleep 2
+start_svc settlement-middleware services/settlement-middleware 3011 "npm run start"
+sleep 2
+start_svc dbis-exchange services/dbis-exchange 3012 "npm run start"
+sleep 2
+
+pkill -f "serve -s.*$FRONTEND_PORT" 2>/dev/null || true
+cd "$REPO_DIR/frontend-dapp"
+nohup npx --yes serve -s dist -l "$FRONTEND_PORT" >"$LOG_DIR/frontend.log" 2>&1 &
+echo $! >"$LOG_DIR/frontend.pid"
+
+sleep 5
+log "Z health checks..."
+curl -sf "http://127.0.0.1:$API_PORT/api/v1/z-bot/health" | head -c 200 || true
+echo
+curl -sf "http://127.0.0.1:3011/api/v1/settlement/health" | head -c 200 || true
+echo
+curl -sf -o /dev/null -w "z-hub=%{http_code}\n" "http://127.0.0.1:$FRONTEND_PORT/z"
+curl -sf -o /dev/null -w "z-wallet=%{http_code}\n" "http://127.0.0.1:$FRONTEND_PORT/z-wallet"
+log "Z stack ready on :$FRONTEND_PORT"
--- a/scripts/deployment/complete-z-chain.ps1
+++ b/scripts/deployment/complete-z-chain.ps1
@@ -0,0 +1,90 @@
+# Complete Z Chain local setup: RPC node + contract deploy + config sync.
+# Uses Docker Besu when available; otherwise Hardhat node chainId 900002.
+$ErrorActionPreference = "Stop"
+
+$Root = (Resolve-Path (Join-Path $PSScriptRoot "..\..")).Path
+$RpcPort = if ($env:Z_CHAIN_RPC_PORT) { $env:Z_CHAIN_RPC_PORT } else { "8546" }
+$RpcUrl = "http://127.0.0.1:$RpcPort"
+$NodeLog = Join-Path $Root "logs\z-chain-node.log"
+$ErrLog = Join-Path $Root "logs\z-chain-node.err.log"
+$PidFile = Join-Path $Root "logs\z-chain-node.pid"
+
+Set-Location $Root
+New-Item -ItemType Directory -Force -Path (Join-Path $Root "logs") | Out-Null
+
+function Test-RpcReady {
+  try {
+    $body = '{"jsonrpc":"2.0","id":1,"method":"eth_chainId","params":[]}'
+    $r = Invoke-RestMethod -Uri $RpcUrl -Method Post -Body $body -ContentType "application/json" -TimeoutSec 2
+    return ($r.result -eq "0xdbba2")
+  } catch {
+    return $false
+  }
+}
+
+function Stop-ZChainNode {
+  if (Test-Path $PidFile) {
+    $oldPid = Get-Content $PidFile -ErrorAction SilentlyContinue
+    if ($oldPid) {
+      Stop-Process -Id $oldPid -Force -ErrorAction SilentlyContinue
+    }
+    Remove-Item $PidFile -Force -ErrorAction SilentlyContinue
+  }
+  try {
+    docker rm -f z-chain-besu 2>$null | Out-Null
+  } catch {}
+  $conn = Get-NetTCPConnection -LocalPort $RpcPort -ErrorAction SilentlyContinue | Select-Object -First 1
+  if ($conn -and $conn.OwningProcess) {
+    Stop-Process -Id $conn.OwningProcess -Force -ErrorAction SilentlyContinue
+    Start-Sleep -Seconds 2
+  }
+}
+
+$dockerOk = $false
+try {
+  docker info 2>&1 | Out-Null
+  if ($LASTEXITCODE -eq 0) { $dockerOk = $true }
+} catch {}
+
+Stop-ZChainNode
+
+if ($dockerOk) {
+  Write-Host "Starting Z Chain via Docker Besu ..."
+  & "$PSScriptRoot\bootstrap-z-chain-local.ps1"
+} else {
+  $env:Z_CHAIN_LOCAL = "1"
+  $hardhat = Join-Path $Root "node_modules\.bin\hardhat.cmd"
+  $nodeCmd = "set Z_CHAIN_LOCAL=1&& `"$hardhat`" node --port $RpcPort --hostname 127.0.0.1"
+  $nodeProc = Start-Process -FilePath "cmd.exe" -ArgumentList @("/c", $nodeCmd) -WorkingDirectory $Root -PassThru -WindowStyle Hidden -RedirectStandardOutput $NodeLog -RedirectStandardError $ErrLog
+  $nodeProc.Id | Set-Content $PidFile
+  Start-Sleep -Seconds 8
+}
+
+$deadline = (Get-Date).AddSeconds(90)
+while (-not (Test-RpcReady)) {
+  if ((Get-Date) -gt $deadline) {
+    Write-Error "Z Chain RPC not ready at $RpcUrl after 90s. See $NodeLog and $ErrLog"
+  }
+  Start-Sleep -Seconds 2
+}
+Write-Host "Z Chain RPC ready at $RpcUrl"
+
+$env:CHAIN_900002_RPC_URL = $RpcUrl
+$env:Z_CHAIN_LOCAL = "1"
+if (-not $env:PRIVATE_KEY) {
+  $env:PRIVATE_KEY = "0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80"
+}
+
+Write-Host "Compiling Z Chain contracts ..."
+npx hardhat compile --config hardhat.zchain.config.js 2>&1 | Out-Null
+if ($LASTEXITCODE -ne 0) { throw "zchain compile failed" }
+
+Write-Host "Deploying Z Chain contracts ..."
+npx hardhat run scripts/deployment/deploy-z-chain-contracts.js --network zchain --config hardhat.zchain.config.js
+if ($LASTEXITCODE -ne 0) { throw "contract deploy failed" }
+
+Write-Host ""
+Write-Host "Z Chain setup complete."
+Write-Host "  RPC: $RpcUrl"
+Write-Host "  Set VITE_ENABLE_Z_WALLET=true and VITE_RPC_URL_900002=$RpcUrl"
+Write-Host "  Updated config/z-chain-deployed.v1.json"
--- a/scripts/deployment/deploy-omnl-bank-production.sh
+++ b/scripts/deployment/deploy-omnl-bank-production.sh
@@ -93,13 +93,18 @@ build_pkg() {
  local dir="$1"
  log "Building $dir..."
  cd "$REPO_DIR/$dir"
-  npm install --no-fund --no-audit
+  NODE_ENV=development npm install --no-fund --no-audit
  npm run build
 }

 for dir in packages/integration-foundation packages/settlement-core \
-  services/token-aggregation services/settlement-middleware services/dbis-exchange; do
-  build_pkg "$dir"
+  services/token-aggregation services/settlement-middleware services/dbis-exchange \
+  services/swift-listener; do
+  if [[ "$dir" == "services/swift-listener" ]]; then
+    build_pkg "$dir" || log "WARN: swift-listener build skipped — SWIFT inbound may use existing dist"
+  else
+    build_pkg "$dir"
+  fi
 done

 log "Building frontend..."
@@ -107,14 +112,17 @@ cd "$REPO_DIR/frontend-dapp"
 export VITE_TOKEN_AGGREGATION_URL="${VITE_TOKEN_AGGREGATION_URL:-/api/v1}"
 export VITE_SETTLEMENT_MIDDLEWARE_URL="${VITE_SETTLEMENT_MIDDLEWARE_URL:-/settlement}"
 export VITE_DBIS_EXCHANGE_URL="${VITE_DBIS_EXCHANGE_URL:-/exchange}"
+export VITE_ECOSYSTEM="${VITE_ECOSYSTEM:-omnl}"
+export VITE_ENABLE_Z_WALLET="${VITE_ENABLE_Z_WALLET:-false}"
+unset VITE_RPC_URL_900002 VITE_Z_CHAIN_EXPLORER_URL VITE_Z_ECOSYSTEM_URL
 # Never embed operator API keys in production frontend — nginx injects server-side.
 unset VITE_OMNL_API_KEY
 if command -v pnpm >/dev/null 2>&1; then
  pnpm install --frozen-lockfile 2>/dev/null || pnpm install
-  pnpm run build
+  VITE_ECOSYSTEM=omnl pnpm run build:omnl
 else
  npm install
-  npm run build
+  VITE_ECOSYSTEM=omnl npm run build:omnl
 fi

 start_svc() {
@@ -153,9 +161,14 @@ start_svc() {
    OMNL_ALLOW_CHAIN_MINT_EXECUTE="${OMNL_ALLOW_CHAIN_MINT_EXECUTE:-1}" \
    TOKEN_AGGREGATION_URL="${TOKEN_AGGREGATION_URL:-http://127.0.0.1:3000}" \
    HYBX_MIFOS_FINERACT_SIDECAR_URL="${HYBX_MIFOS_FINERACT_SIDECAR_URL:-}" \
-    SWIFT_LISTENER_URL="${SWIFT_LISTENER_URL:-}" \
+    SWIFT_LISTENER_URL="${SWIFT_LISTENER_URL:-http://127.0.0.1:8788}" \
    RPC_URL_138="${RPC_URL_138:-${CHAIN_138_RPC_URL:-}}" \
    CHAIN_138_RPC_URL="${CHAIN_138_RPC_URL:-${RPC_URL_138:-}}" \
+    CHAIN_900002_RPC_URL="${CHAIN_900002_RPC_URL:-}" \
+    AZURE_OPENAI_ENDPOINT="${AZURE_OPENAI_ENDPOINT:-}" \
+    AZURE_OPENAI_API_KEY="${AZURE_OPENAI_API_KEY:-}" \
+    AZURE_OPENAI_DEPLOYMENT="${AZURE_OPENAI_DEPLOYMENT:-}" \
+    AZURE_OPENAI_API_VERSION="${AZURE_OPENAI_API_VERSION:-2024-02-15-preview}" \
    OMNL_MINT_OPERATOR_PRIVATE_KEY="${OMNL_MINT_OPERATOR_PRIVATE_KEY:-}" \
    bash -c "$cmd" >"$LOG_DIR/$name.log" 2>&1 &
  echo $! >"$LOG_DIR/$name.pid"
@@ -168,6 +181,11 @@ sleep 2
 start_svc dbis-exchange services/dbis-exchange 3012 "npm run start"
 sleep 2

+if [[ "${OMNL_SWIFT_LISTENER_START:-1}" == "1" ]]; then
+  log "Starting SWIFT listener..."
+  bash "$REPO_DIR/scripts/deployment/start-swift-listener-production.sh" || log "WARN: SWIFT listener start failed"
+fi
+
 FRONTEND_PORT="${OMNL_BANK_FRONTEND_PORT:-3002}"
 pkill -f "serve -s.*$FRONTEND_PORT" 2>/dev/null || true
 cd "$REPO_DIR/frontend-dapp"
@@ -183,6 +201,8 @@ echo
 curl -sf "http://127.0.0.1:3012/api/v1/exchange/health" | head -c 200 || true
 echo
 curl -sf -o /dev/null -w "frontend=%{http_code}\n" "http://127.0.0.1:$FRONTEND_PORT/central-bank"
+curl -sf -o /dev/null -w "hub=%{http_code}\n" "http://127.0.0.1:$FRONTEND_PORT/hub"
+curl -sf "http://127.0.0.1:8788/health" 2>/dev/null | head -c 80 || log "WARN: SWIFT listener :8788 not reachable"

 if [[ -n "${DATABASE_URL:-}" ]] && [[ "${SEED_SUPER_ADMIN_USERS:-1}" == "1" ]]; then
  log "Seeding super-admin control-panel users..."
@@ -196,6 +216,7 @@ if [[ -n "${DATABASE_URL:-}" ]] && [[ "${SEED_SUPER_ADMIN_USERS:-1}" == "1" ]];
 fi

 log "OMNL Bank deploy complete"
+bash "$REPO_DIR/scripts/deployment/sync-guosmm-notices.sh" || log "WARN: GUOSMM sync check failed"
 log "  Central Bank: http://127.0.0.1:$FRONTEND_PORT/central-bank"
 log "  Office 24:    http://127.0.0.1:$FRONTEND_PORT/office-24"
 log "  DBIS Trade:   http://127.0.0.1:$FRONTEND_PORT/trade"
--- a/scripts/deployment/deploy-omnl-banking-portal-pct.sh
+++ b/scripts/deployment/deploy-omnl-banking-portal-pct.sh
@@ -48,7 +48,9 @@ tar -czf "$STAGE" \
  -C "$REPO_DIR" \
  config \
  frontend-dapp/dist \
+  packages/integration-foundation/package.json \
  packages/integration-foundation/dist \
+  packages/settlement-core/package.json \
  packages/settlement-core/dist \
  services/token-aggregation/dist \
  services/token-aggregation/package.json \
--- a/scripts/deployment/deploy-omnl-domains.sh
+++ b/scripts/deployment/deploy-omnl-domains.sh
@@ -42,5 +42,7 @@ check_host secure.d-bis.org /central-bank
 check_host office24.omdnl.org /office-24
 check_host digital.omdnl.org /swap

+log "Z Ecosystem domain (separate) — run scripts/deployment/deploy-z-domains.sh"
+
 log "OMNL domain deploy complete"
 log "DNS: point all domains A record to 76.53.10.34 (or Cloudflare proxy to origin)"
--- a/scripts/deployment/deploy-z-chain-contracts.js
+++ b/scripts/deployment/deploy-z-chain-contracts.js
@@ -0,0 +1,74 @@
+const { ethers } = require('hardhat');
+const fs = require('fs');
+const path = require('path');
+require('dotenv').config();
+
+const ROOT = path.resolve(__dirname, '../..');
+
+function syncAddresses(cUsdc, registry) {
+  const today = new Date().toISOString().slice(0, 10);
+
+  const deployedPath = path.join(ROOT, 'config/z-chain-deployed.v1.json');
+  const deployed = JSON.parse(fs.readFileSync(deployedPath, 'utf8'));
+  deployed.updated = today;
+  deployed.status = 'active';
+  deployed.contracts.cUSDC = cUsdc;
+  deployed.contracts.accountWalletRegistry = registry;
+  fs.writeFileSync(deployedPath, `${JSON.stringify(deployed, null, 2)}\n`);
+
+  const integrationPath = path.join(ROOT, 'config/z-chain-integration.v1.json');
+  const integration = JSON.parse(fs.readFileSync(integrationPath, 'utf8'));
+  integration.contracts.cUSDC = cUsdc;
+  integration.contracts.accountWalletRegistry = registry;
+  fs.writeFileSync(integrationPath, `${JSON.stringify(integration, null, 2)}\n`);
+
+  const hybxPath = path.join(ROOT, 'config/hybx-omnl-cross-chain-lines.json');
+  const hybx = JSON.parse(fs.readFileSync(hybxPath, 'utf8'));
+  for (const line of hybx.lines || []) {
+    if (line.chains?.['900002']) {
+      line.chains['900002'].tokenM1 = cUsdc;
+    }
+  }
+  fs.writeFileSync(hybxPath, `${JSON.stringify(hybx, null, 2)}\n`);
+
+  const broadcastDir = path.join(ROOT, 'broadcast/DeployZChainEmoney.s.sol/900002');
+  fs.mkdirSync(broadcastDir, { recursive: true });
+  const broadcast = {
+    transactions: [
+      { contractName: 'ZChainUSDC', contractAddress: cUsdc },
+      { contractName: 'AccountWalletRegistryZ', contractAddress: registry },
+    ],
+  };
+  fs.writeFileSync(path.join(broadcastDir, 'run-latest.json'), `${JSON.stringify(broadcast, null, 2)}\n`);
+
+  console.log('\nConfig updated:');
+  console.log('  cUSDC:', cUsdc);
+  console.log('  AccountWalletRegistry:', registry);
+}
+
+async function main() {
+  const [deployer] = await ethers.getSigners();
+  const network = await ethers.provider.getNetwork();
+  console.log('Deployer:', deployer.address);
+  console.log('Chain ID:', network.chainId.toString());
+  console.log('Balance:', ethers.formatEther(await ethers.provider.getBalance(deployer.address)));
+
+  const ZChainUSDC = await ethers.getContractFactory('ZChainUSDC');
+  const cUsdc = await ZChainUSDC.deploy(deployer.address);
+  await cUsdc.waitForDeployment();
+  const cUsdcAddress = await cUsdc.getAddress();
+  console.log('ZChainUSDC deployed:', cUsdcAddress);
+
+  const AccountWalletRegistry = await ethers.getContractFactory('AccountWalletRegistryZ');
+  const registry = await AccountWalletRegistry.deploy(deployer.address);
+  await registry.waitForDeployment();
+  const registryAddress = await registry.getAddress();
+  console.log('AccountWalletRegistry deployed:', registryAddress);
+
+  syncAddresses(cUsdcAddress, registryAddress);
+}
+
+main().catch((err) => {
+  console.error(err);
+  process.exit(1);
+});
--- a/scripts/deployment/deploy-z-chain-contracts.sh
+++ b/scripts/deployment/deploy-z-chain-contracts.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Deploy Z Chain contracts (cUSDC + AccountWalletRegistry) on chainId 900002.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+cd "$ROOT"
+
+RPC="${CHAIN_900002_RPC_URL:-http://127.0.0.1:8546}"
+
+if [[ -z "${PRIVATE_KEY:-}" ]]; then
+  echo "ERROR: set PRIVATE_KEY (Besu dev key #1 works for local bootstrap)"
+  exit 1
+fi
+
+echo "Deploying to Z Chain at $RPC ..."
+forge script script/z-chain/DeployZChainEmoney.s.sol:DeployZChainEmoney \
+  --rpc-url "$RPC" \
+  --chain-id 900002 \
+  --broadcast \
+  --profile zchain
+
+echo "Done. Copy deployed addresses into config/z-chain-deployed.v1.json"
+echo "Or run: node scripts/deployment/sync-z-chain-deployed-addresses.mjs"
--- a/scripts/deployment/deploy-z-domains.sh
+++ b/scripts/deployment/deploy-z-domains.sh
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Install nginx vhost for Z Ecosystem (zblockchainsystem.com)
+set -euo pipefail
+
+REPO_DIR="${Z_ECOSYSTEM_ROOT:-${OMNL_BANK_ROOT:-$HOME/smom-dbis-138}}"
+VHOST_SRC="$REPO_DIR/deploy/nginx/z-ecosystem-domains.conf"
+VHOST_DST="/etc/nginx/sites-available/z-ecosystem-domains"
+VHOST_LINK="/etc/nginx/sites-enabled/z-ecosystem-domains"
+
+log() { echo "[$(date -Iseconds)] $*"; }
+
+if [ ! -f "$VHOST_SRC" ]; then
+  echo "Missing $VHOST_SRC" >&2
+  exit 1
+fi
+
+log "Installing Z Ecosystem nginx vhost..."
+sudo cp "$VHOST_SRC" "$VHOST_DST"
+SNIPPET_SRC="$REPO_DIR/deploy/nginx/z-ecosystem-common-locations.conf"
+SNIPPET_DST="/etc/nginx/snippets/z-ecosystem-common-locations.conf"
+sudo cp "$SNIPPET_SRC" "$SNIPPET_DST"
+sudo ln -sf "$VHOST_DST" "$VHOST_LINK"
+
+log "Testing nginx..."
+sudo nginx -t
+
+log "Reloading nginx..."
+sudo systemctl reload nginx
+
+check_host() {
+  local host="$1"
+  local expect="$2"
+  local code
+  code=$(curl -s -o /dev/null -w '%{http_code}' -H "Host: $host" "http://127.0.0.1/")
+  log "  $host -> HTTP $code (expect redirect toward $expect)"
+}
+
+check_host zblockchainsystem.com /z
+check_host www.zblockchainsystem.com /z
+
+log "Z domain deploy complete — https://zblockchainsystem.com/z"
--- a/scripts/deployment/deploy-z-ecosystem-production.sh
+++ b/scripts/deployment/deploy-z-ecosystem-production.sh
@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+# Production deploy: Z Ecosystem on zblockchainsystem.com (separate from OMNL portals).
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+ENV_FILE="${Z_ECOSYSTEM_ENV:-$ROOT/config/z-ecosystem.production.env}"
+PROD_CFG="$ROOT/config/z-chain-production.v1.json"
+DOMAIN_CFG="$ROOT/config/z-ecosystem-production-domains.v1.json"
+
+log() { echo "[$(date -Iseconds)] $*"; }
+
+if [[ -f "$ROOT/.env" ]]; then
+  set -a
+  set +u
+  # shellcheck disable=SC1090
+  source "$ROOT/.env"
+  set -u
+  set +a
+fi
+if [[ -f "$ENV_FILE" ]]; then
+  set -a
+  set +u
+  # shellcheck disable=SC1090
+  source "$ENV_FILE"
+  set -u
+  set +a
+fi
+
+export CHAIN_900002_RPC_URL="${CHAIN_900002_RPC_URL:-https://rpc.zblockchainsystem.com}"
+export VITE_RPC_URL_900002="${VITE_RPC_URL_900002:-$CHAIN_900002_RPC_URL}"
+export VITE_Z_CHAIN_EXPLORER_URL="${VITE_Z_CHAIN_EXPLORER_URL:-https://explorer.zblockchainsystem.com}"
+export VITE_Z_ECOSYSTEM_URL="${VITE_Z_ECOSYSTEM_URL:-https://zblockchainsystem.com}"
+export VITE_ENABLE_Z_WALLET="${VITE_ENABLE_Z_WALLET:-true}"
+export VITE_TOKEN_AGGREGATION_URL="${VITE_TOKEN_AGGREGATION_URL:-/api/v1}"
+export VITE_SETTLEMENT_MIDDLEWARE_URL="${VITE_SETTLEMENT_MIDDLEWARE_URL:-/settlement}"
+export VITE_DBIS_EXCHANGE_URL="${VITE_DBIS_EXCHANGE_URL:-/exchange}"
+
+log "Z Ecosystem production deploy (zblockchainsystem.com)"
+log "  chain:   $PROD_CFG"
+log "  domain:  $DOMAIN_CFG"
+log "  portal:  $VITE_Z_ECOSYSTEM_URL"
+log "  rpc:     $CHAIN_900002_RPC_URL"
+
+if [[ "${Z_CHAIN_BOOTSTRAP_PROD:-0}" == "1" ]]; then
+  log "Bootstrapping Besu Z Chain..."
+  sudo bash "$ROOT/scripts/deployment/bootstrap-z-chain-production.sh"
+fi
+
+if [[ "${Z_CHAIN_DEPLOY_CONTRACTS:-0}" == "1" ]]; then
+  log "Deploying Z Chain contracts..."
+  node "$ROOT/scripts/deployment/deploy-z-chain-contracts.js" --network zchain
+  node "$ROOT/scripts/deployment/sync-z-chain-deployed-addresses.mjs"
+fi
+
+log "Build Z-only backend + frontend..."
+bash "$ROOT/scripts/deployment/build-z-ecosystem-stack.sh"
+
+log "Install Z domain nginx vhost..."
+bash "$ROOT/scripts/deployment/deploy-z-domains.sh"
+
+if [[ "${Z_ECOSYSTEM_PUSH_PCT:-0}" == "1" ]]; then
+  log "Pushing portal bundle to Proxmox LXC..."
+  bash "$ROOT/scripts/deployment/deploy-omnl-banking-portal-pct.sh"
+fi
+
+log "Done. Verify:"
+log "  curl -sf http://127.0.0.1:\${Z_TOKEN_AGGREGATION_PORT:-3100}/api/v1/z-bot/health"
+log "  curl -sf http://127.0.0.1:3011/api/v1/settlement/health"
+log "  curl -sI https://zblockchainsystem.com/z"
+log "  bash scripts/deployment/print-z-dns-records.sh"
--- a/scripts/deployment/deploy-z-ecosystem.ps1
+++ b/scripts/deployment/deploy-z-ecosystem.ps1
@@ -0,0 +1,135 @@
+# Deploy Z Ecosystem portal locally (chain + settlement + API + portal)
+$ErrorActionPreference = "Stop"
+$Root = (Resolve-Path (Join-Path $PSScriptRoot "..\..")).Path
+$LogDir = Join-Path $Root "logs"
+New-Item -ItemType Directory -Force -Path $LogDir | Out-Null
+
+function Import-DotEnvFile([string]$Path) {
+  if (-not (Test-Path $Path)) { return }
+  Get-Content $Path | ForEach-Object {
+    $line = $_.Trim()
+    if ($line -eq "" -or $line.StartsWith("#")) { return }
+    if ($line -match '^\s*([^=]+)=(.*)$') {
+      $name = $matches[1].Trim()
+      $value = $matches[2].Trim().Trim('"').Trim("'")
+      Set-Item -Path "env:$name" -Value $value
+    }
+  }
+}
+
+function Test-ZChainRpc {
+  try {
+    $body = '{"jsonrpc":"2.0","id":1,"method":"eth_chainId","params":[]}'
+    $r = Invoke-RestMethod -Uri "http://127.0.0.1:8546" -Method Post -Body $body -ContentType "application/json" -TimeoutSec 2
+    return ($r.result -eq "0xdbba2")
+  } catch { return $false }
+}
+
+function Stop-Port($port) {
+  $conn = Get-NetTCPConnection -LocalPort $port -ErrorAction SilentlyContinue | Select-Object -First 1
+  if ($conn -and $conn.OwningProcess) {
+    Stop-Process -Id $conn.OwningProcess -Force -ErrorAction SilentlyContinue
+    Start-Sleep -Seconds 1
+  }
+}
+
+function Start-BackgroundService([string]$Name, [string]$WorkDir, [string]$Command, [string]$LogFile) {
+  Write-Host "Starting $Name ..."
+  Start-Process -FilePath "cmd.exe" -ArgumentList @("/c", "$Command > `"$LogFile`" 2>&1") `
+    -WorkingDirectory $WorkDir -WindowStyle Hidden
+}
+
+Set-Location $Root
+
+Import-DotEnvFile (Join-Path $Root ".env")
+Import-DotEnvFile (Join-Path $Root "config\z-ecosystem.local.env")
+
+$env:CHAIN_900002_RPC_URL = if ($env:CHAIN_900002_RPC_URL) { $env:CHAIN_900002_RPC_URL } else { "http://127.0.0.1:8546" }
+$env:SETTLEMENT_MIDDLEWARE_URL = if ($env:SETTLEMENT_MIDDLEWARE_URL) { $env:SETTLEMENT_MIDDLEWARE_URL } else { "http://127.0.0.1:3011" }
+$env:SETTLEMENT_URL = $env:SETTLEMENT_MIDDLEWARE_URL
+$env:TOKEN_AGGREGATION_URL = "http://127.0.0.1:3000"
+$env:VITE_ECOSYSTEM = "z"
+$env:OMNL_SUPPORTED_CHAINS_CONFIG = Join-Path $Root "config\z-supported-chains.v1.json"
+
+if (-not $env:SETTLEMENT_MIDDLEWARE_CONFIG) {
+  $env:SETTLEMENT_MIDDLEWARE_CONFIG = Join-Path $Root "config\settlement-middleware.production.v1.json"
+}
+if (-not $env:OMNL_SUPPORTED_CHAINS_CONFIG) {
+  $env:OMNL_SUPPORTED_CHAINS_CONFIG = Join-Path $Root "config\omnl-supported-chains.v1.json"
+}
+
+if (-not (Test-ZChainRpc)) {
+  Write-Host "Z Chain RPC not running - starting complete-z-chain ..."
+  & "$PSScriptRoot\complete-z-chain.ps1"
+}
+
+Write-Host "Building packages (settlement-core) ..."
+foreach ($pkg in @("packages\integration-foundation", "packages\settlement-core")) {
+  $pkgDir = Join-Path $Root $pkg
+  if (Test-Path $pkgDir) {
+    Set-Location $pkgDir
+    if (-not (Test-Path node_modules)) { npm install --legacy-peer-deps 2>&1 | Out-Null }
+    npm run build
+    if ($LASTEXITCODE -ne 0) { throw "$pkg build failed" }
+  }
+}
+
+Write-Host "Building settlement-middleware ..."
+Set-Location "$Root\services\settlement-middleware"
+if (-not (Test-Path node_modules)) { npm install --legacy-peer-deps 2>&1 | Out-Null }
+npm run build
+if ($LASTEXITCODE -ne 0) { throw "settlement-middleware build failed" }
+
+Write-Host "Building token-aggregation ..."
+Set-Location "$Root\services\token-aggregation"
+if (-not (Test-Path node_modules)) { npm install --legacy-peer-deps 2>&1 | Out-Null }
+npm run build
+if ($LASTEXITCODE -ne 0) { throw "token-aggregation build failed" }
+
+Write-Host "Building frontend-dapp (Z Ecosystem only) ..."
+Set-Location "$Root\frontend-dapp"
+if (-not (Test-Path node_modules)) { npm install --legacy-peer-deps 2>&1 | Out-Null }
+npm run build:z
+if ($LASTEXITCODE -ne 0) { throw "frontend build failed" }
+
+Stop-Port 3011
+Stop-Port 3000
+Stop-Port 3002
+
+$settlementLog = Join-Path $LogDir "settlement-middleware.log"
+$tokenLog = Join-Path $LogDir "token-aggregation.log"
+$portalLog = Join-Path $LogDir "portal-serve.log"
+
+Start-BackgroundService "settlement-middleware on :3011" "$Root\services\settlement-middleware" "npm start" $settlementLog
+Start-Sleep -Seconds 3
+
+Start-BackgroundService "token-aggregation on :3000" "$Root\services\token-aggregation" "npm start" $tokenLog
+Start-Sleep -Seconds 4
+
+$env:SETTLEMENT_URL = "http://127.0.0.1:3011"
+Start-BackgroundService "portal on :3002" "$Root\frontend-dapp" "npm run serve:portal" $portalLog
+Start-Sleep -Seconds 5
+
+$llmStatus = "rule-based"
+try {
+  $health = Invoke-RestMethod -Uri "http://localhost:3000/api/v1/z-bot/health" -TimeoutSec 5
+  $llmStatus = $health.llm.provider
+} catch { }
+
+$settlementStatus = "unknown"
+try {
+  $settlementStatus = (Invoke-RestMethod -Uri "http://localhost:3011/api/v1/settlement/health" -TimeoutSec 5).status
+} catch { $settlementStatus = "unreachable" }
+
+Write-Host ""
+Write-Host "Z Ecosystem deployed locally:"
+Write-Host "  Hub:         http://localhost:3002/z"
+Write-Host "  Wallet:      http://localhost:3002/z-wallet"
+Write-Host "  Z Bot API:   http://localhost:3000/api/v1/z-bot/health ($llmStatus)"
+Write-Host "  Settlement:  http://localhost:3011/api/v1/settlement/health ($settlementStatus)"
+Write-Host "  Z Chain RPC: $($env:CHAIN_900002_RPC_URL)"
+Write-Host "  Logs:        $LogDir"
+if ($llmStatus -eq "rule-based") {
+  Write-Host ""
+  Write-Host "Azure OpenAI: copy config/z-ecosystem.local.env.example to config/z-ecosystem.local.env and set AZURE_OPENAI_* then redeploy."
+}
--- a/scripts/deployment/enable-z-hosts-local.ps1
+++ b/scripts/deployment/enable-z-hosts-local.ps1
@@ -0,0 +1,12 @@
+# Run as Administrator to map zblockchainsystem.com to this PC (local Z portal on :3002)
+$marker = '# Z Ecosystem only'
+$hostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
+$line = '127.0.0.1 zblockchainsystem.com www.zblockchainsystem.com rpc.zblockchainsystem.com explorer.zblockchainsystem.com'
+$content = Get-Content $hostsPath -Raw
+if ($content -match [regex]::Escape($marker)) {
+  Write-Host 'Z hosts entries already present.'
+  exit 0
+}
+Add-Content -Path $hostsPath -Value "`n$marker`n$line"
+Write-Host 'Added zblockchainsystem.com -> 127.0.0.1'
+Write-Host 'Open: http://zblockchainsystem.com:3002/z'
--- a/scripts/deployment/go-live-z-ecosystem.ps1
+++ b/scripts/deployment/go-live-z-ecosystem.ps1
@@ -0,0 +1,138 @@
+# Go live — Z Ecosystem (production build + tunnel + deploy bundle)
+$ErrorActionPreference = "Stop"
+$Root = (Resolve-Path (Join-Path $PSScriptRoot "..\..")).Path
+$LogDir = Join-Path $Root "logs"
+$BundleDir = Join-Path $Root "dist\go-live"
+$BundleTar = Join-Path $BundleDir "z-ecosystem-portal.tar.gz"
+New-Item -ItemType Directory -Force -Path $LogDir, $BundleDir | Out-Null
+
+function Import-DotEnvFile([string]$Path) {
+  if (-not (Test-Path $Path)) { return }
+  Get-Content $Path | ForEach-Object {
+    $line = $_.Trim()
+    if ($line -eq "" -or $line.StartsWith("#")) { return }
+    if ($line -match '^\s*([^=]+)=(.*)$') {
+      Set-Item -Path "env:$($matches[1].Trim())" -Value $matches[2].Trim().Trim('"').Trim("'")
+    }
+  }
+}
+
+function Stop-Port($port) {
+  $conn = Get-NetTCPConnection -LocalPort $port -State Listen -ErrorAction SilentlyContinue | Select-Object -First 1
+  if ($conn -and $conn.OwningProcess) {
+    Stop-Process -Id $conn.OwningProcess -Force -ErrorAction SilentlyContinue
+    Start-Sleep -Seconds 1
+  }
+}
+
+Set-Location $Root
+Import-DotEnvFile (Join-Path $Root ".env")
+Import-DotEnvFile (Join-Path $Root "config\z-ecosystem.local.env")
+
+# Production frontend env (same-origin on zblockchainsystem.com)
+$env:VITE_ECOSYSTEM = "z"
+$env:VITE_TOKEN_AGGREGATION_URL = "/api/v1"
+$env:VITE_SETTLEMENT_MIDDLEWARE_URL = "/settlement"
+$env:VITE_DBIS_EXCHANGE_URL = "/exchange"
+$env:VITE_ENABLE_Z_WALLET = "true"
+$env:VITE_RPC_URL_900002 = if ($env:VITE_RPC_URL_900002) { $env:VITE_RPC_URL_900002 } else { "https://rpc.zblockchainsystem.com" }
+$env:VITE_Z_CHAIN_EXPLORER_URL = if ($env:VITE_Z_CHAIN_EXPLORER_URL) { $env:VITE_Z_CHAIN_EXPLORER_URL } else { "https://explorer.zblockchainsystem.com" }
+$env:VITE_Z_ECOSYSTEM_URL = if ($env:VITE_Z_ECOSYSTEM_URL) { $env:VITE_Z_ECOSYSTEM_URL } else { "https://zblockchainsystem.com" }
+Remove-Item Env:VITE_OMNL_API_KEY -ErrorAction SilentlyContinue
+
+Write-Host "=== 1/4 Local stack (Z Chain + APIs + portal) ==="
+& "$PSScriptRoot\deploy-z-ecosystem.ps1"
+
+Write-Host ""
+Write-Host "=== 2/4 Production frontend build (Z-only) ==="
+Set-Location "$Root\frontend-dapp"
+npm run build:z
+if ($LASTEXITCODE -ne 0) { throw "production frontend build failed" }
+
+Write-Host ""
+Write-Host "=== 3/4 Stage deploy bundle ==="
+$stageRoot = Join-Path $BundleDir "stage"
+if (Test-Path $stageRoot) { Remove-Item -Recurse -Force $stageRoot }
+New-Item -ItemType Directory -Force -Path $stageRoot | Out-Null
+
+$copyPaths = @(
+  "config",
+  "frontend-dapp\dist",
+  "packages\integration-foundation\package.json",
+  "packages\integration-foundation\dist",
+  "packages\settlement-core\package.json",
+  "packages\settlement-core\dist",
+  "services\token-aggregation\dist",
+  "services\token-aggregation\package.json",
+  "services\token-aggregation\package-lock.json",
+  "services\settlement-middleware\dist",
+  "services\settlement-middleware\package.json",
+  "services\settlement-middleware\package-lock.json",
+  "scripts\deployment\start-omnl-banking-portal.sh",
+  "scripts\deployment\deploy-z-ecosystem-production.sh",
+  "deploy\nginx\omnl-lxc-portal.conf",
+  "deploy\nginx\omnl-portal-auth-current.conf.inc"
+)
+
+foreach ($rel in $copyPaths) {
+  $src = Join-Path $Root $rel
+  if (-not (Test-Path $src)) {
+    Write-Host "  skip missing: $rel"
+    continue
+  }
+  $dst = Join-Path $stageRoot $rel
+  New-Item -ItemType Directory -Force -Path (Split-Path $dst -Parent) | Out-Null
+  Copy-Item -Path $src -Destination $dst -Recurse -Force
+}
+
+if (Get-Command tar -ErrorAction SilentlyContinue) {
+  if (Test-Path $BundleTar) { Remove-Item -Force $BundleTar }
+  tar -czf $BundleTar -C $stageRoot .
+  Write-Host "  bundle: $BundleTar"
+} else {
+  Write-Host "  tar not found - bundle folder: $stageRoot"
+}
+
+Write-Host ""
+Write-Host "=== 4/4 Public tunnel (cloudflared) ==="
+Stop-Port 4040
+$tunnelLog = Join-Path $LogDir "cloudflared-z-ecosystem.log"
+$cf = "C:\Program Files (x86)\cloudflared\cloudflared.exe"
+if (-not (Test-Path $cf)) { $cf = "cloudflared" }
+
+$tunnelErr = Join-Path $LogDir "cloudflared-z-ecosystem.err.log"
+Start-Process -FilePath "cmd.exe" -ArgumentList @("/c", "`"$cf`" tunnel --url http://localhost:3002 --metrics localhost:4040 > `"$tunnelLog`" 2> `"$tunnelErr`"") `
+  -WindowStyle Hidden
+
+$tunnelUrl = $null
+for ($i = 0; $i -lt 30; $i++) {
+  Start-Sleep -Seconds 1
+  if (Test-Path $tunnelLog) {
+    $log = Get-Content $tunnelLog -Raw -ErrorAction SilentlyContinue
+    if ($log -match '(https://[a-z0-9-]+\.trycloudflare\.com)') {
+      $tunnelUrl = $matches[1]
+      break
+    }
+  }
+}
+
+Write-Host ""
+Write-Host "Z Ecosystem GO LIVE"
+Write-Host "==================="
+if ($tunnelUrl) {
+  Write-Host "  Public tunnel:  $tunnelUrl/z"
+  Write-Host "  Z Wallet:       $tunnelUrl/z-wallet"
+  Write-Host "  Z Bot health:   $tunnelUrl/api/v1/z-bot/health"
+} else {
+  Write-Host "  Tunnel starting - see $tunnelLog"
+  Write-Host "  Local:          http://localhost:3002/z"
+}
+Write-Host ""
+Write-Host "Production portal zblockchainsystem.com - run on dev-bis-ali:"
+Write-Host '  cd ~/smom-dbis-138; git pull; bash scripts/deployment/deploy-z-ecosystem-production.sh'
+Write-Host '  # or push bundle to LXC:'
+Write-Host '  Z_ECOSYSTEM_PUSH_PCT=1 bash scripts/deployment/deploy-z-ecosystem-production.sh'
+Write-Host ""
+Write-Host "DNS still required for Z Chain RPC:"
+Write-Host '  rpc.zblockchainsystem.com -> Besu host port 8546'
+Write-Host '  explorer.zblockchainsystem.com -> explorer optional'
--- a/scripts/deployment/print-omnl-dns-records.sh
+++ b/scripts/deployment/print-omnl-dns-records.sh
@@ -16,7 +16,7 @@ Zone: omdnl.org
  A     secure    $ORIGIN_IP      yes     Central Bank (/central-bank)
  A     online    $ORIGIN_IP      yes     Online banking (/central-bank)
  A     forex     $ORIGIN_IP      yes     Forex terminal (/trade)
-  A     digital   $ORIGIN_IP      yes     Digital swap (/swap)
+  A     digital   $ORIGIN_IP      yes     Legacy swap (/swap) — prefer zblockchainsystem.com

 Zone: omdnl.org (Office 24)
  Type  Name      Content         Proxy   Dashboard
@@ -40,6 +40,9 @@ Live URLs once DNS is active:
  https://online.omdnl.org/central-bank
  https://forex.omdnl.org/trade
  https://digital.omdnl.org/swap
+  https://zblockchainsystem.com/z
+  https://zblockchainsystem.com/z-wallet
+  https://zblockchainsystem.com/swap
  https://office24.omdnl.org/office-24
  https://exchange.d-bis.org/trade
  https://secure.d-bis.org/central-bank
--- a/scripts/deployment/print-z-dns-records.sh
+++ b/scripts/deployment/print-z-dns-records.sh
@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+# DNS records for Z Ecosystem (zblockchainsystem.com) — separate from OMNL
+
+ORIGIN_IP="${Z_ECOSYSTEM_ORIGIN_IP:-${OMNL_ORIGIN_IP:-76.53.10.34}}"
+
+cat <<EOF
+# Z Ecosystem DNS — zblockchainsystem.com (separate from OMNL)
+
+Zone: zblockchainsystem.com
+  Type  Name      Content         Proxy   Product
+  A     @         $ORIGIN_IP      yes     Z Hub (/z)
+  A     www       $ORIGIN_IP      yes     Z Hub (/z)
+  A     rpc       $ORIGIN_IP      yes     Z Chain RPC (:8546 on origin)
+  A     explorer  $ORIGIN_IP      yes     Z Chain explorer (optional)
+
+Live URLs after DNS:
+  https://zblockchainsystem.com/z
+  https://zblockchainsystem.com/z-wallet
+  https://zblockchainsystem.com/swap
+  https://zblockchainsystem.com/central-bank
+  https://zblockchainsystem.com/api/v1/z-bot/health
+  https://rpc.zblockchainsystem.com
+  https://explorer.zblockchainsystem.com
+EOF
--- a/scripts/deployment/start-omnl-banking-portal.sh
+++ b/scripts/deployment/start-omnl-banking-portal.sh
@@ -44,6 +44,7 @@ start_service() {
  local name="$1"
  local dir="$2"
  local cmd="$3"
+  local port="${4:-}"
  local active_root=""
  local alias_root

@@ -57,6 +58,20 @@ start_service() {
  [[ -n "$active_root" ]] || active_root="$ROOT"
  cd "${active_root}/${dir}"

+  if [[ -n "$port" ]]; then
+    if command -v fuser >/dev/null 2>&1; then
+      fuser -k "${port}/tcp" 2>/dev/null || true
+    else
+      pid="$(ss -H -tlnp "sport = :${port}" 2>/dev/null | sed -n 's/.*pid=\([0-9]*\).*/\1/p' | head -1)"
+      [[ -n "$pid" ]] && kill "$pid" 2>/dev/null || true
+    fi
+    sleep 1
+  fi
+
+  if [[ ! -d node_modules ]] || [[ ! -f node_modules/.package-lock.json ]]; then
+    NODE_ENV=development npm install --no-fund --no-audit
+  fi
+
  local -a env_args=(
    "SETTLEMENT_MIDDLEWARE_CONFIG=$SETTLEMENT_MIDDLEWARE_CONFIG"
    "DBIS_EXCHANGE_CONFIG=$DBIS_EXCHANGE_CONFIG"
@@ -95,11 +110,11 @@ start_service() {
  echo $! >"${LOG_DIR}/${name}.pid"
 }

-start_service token-aggregation services/token-aggregation "npm run start"
+start_service token-aggregation services/token-aggregation "npm run start" 3000
 sleep 2
-start_service settlement-middleware services/settlement-middleware "npm run start"
+start_service settlement-middleware services/settlement-middleware "npm run start" 3011
 sleep 2
-start_service dbis-exchange services/dbis-exchange "npm run start"
+start_service dbis-exchange services/dbis-exchange "npm run start" 3012
 sleep 2

 pkill -f "serve -s.*${FRONTEND_PORT}" 2>/dev/null || true
@@ -118,13 +133,7 @@ if command -v nginx >/dev/null 2>&1 && [[ -f "$NGINX_TEMPLATE" ]]; then
  echo "OMNL banking portal started under ${ROOT} (nginx :${FRONTEND_PORT})"
 else
  cd "${ROOT}/frontend-dapp"
-  if [[ -x "./node_modules/vite/bin/vite.js" || -f "./node_modules/vite/bin/vite.js" ]]; then
-    nohup node ./node_modules/vite/bin/vite.js preview --host 0.0.0.0 --port "$FRONTEND_PORT" \
-      >"${LOG_DIR}/frontend.log" 2>&1 &
-    echo "OMNL banking portal started under ${ROOT} (vite preview :${FRONTEND_PORT})"
-  else
-    nohup npx --yes serve -s dist -l "$FRONTEND_PORT" >"${LOG_DIR}/frontend.log" 2>&1 &
-    echo "OMNL banking portal started under ${ROOT} (serve :${FRONTEND_PORT})"
-  fi
+  nohup npx --yes serve -s dist -l "$FRONTEND_PORT" >"${LOG_DIR}/frontend.log" 2>&1 &
+  echo "OMNL banking portal started under ${ROOT} (serve :${FRONTEND_PORT})"
  echo $! >"${LOG_DIR}/frontend.pid"
 fi
--- a/scripts/deployment/start-swift-listener-production.sh
+++ b/scripts/deployment/start-swift-listener-production.sh
@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+# Start OMNL SWIFT listener (FIN webhook :8788 + file inbox + optional FIN TCP).
+# Run on dev VM or banking LXC host after .env is loaded (chmod 600).
+set -euo pipefail
+
+REPO_DIR="${OMNL_BANK_ROOT:-$HOME/smom-dbis-138}"
+ENV_FILE="${OMNL_BANK_ENV:-$REPO_DIR/.env}"
+LOG_DIR="${OMNL_BANK_LOG_DIR:-$HOME/omnl-bank/logs}"
+PORT="${SWIFT_LISTENER_PORT:-8788}"
+
+log() { echo "[$(date -Iseconds)] swift-listener $*"; }
+
+mkdir -p "$LOG_DIR"
+
+if [[ -f "$ENV_FILE" ]]; then
+  set -a
+  # shellcheck disable=SC1090
+  source "$ENV_FILE"
+  set +a
+fi
+
+export SWIFT_LISTENER_WEBHOOK="${SWIFT_LISTENER_WEBHOOK:-1}"
+export SWIFT_LISTENER_FILE_INBOX="${SWIFT_LISTENER_FILE_INBOX:-1}"
+export SWIFT_LISTENER_OMNL_FORWARD="${SWIFT_LISTENER_OMNL_FORWARD:-1}"
+export SWIFT_LISTENER_INTAKE_GATEWAY="${SWIFT_LISTENER_INTAKE_GATEWAY:-1}"
+export SWIFT_LISTENER_GATEWAY_EXECUTE="${SWIFT_LISTENER_GATEWAY_EXECUTE:-0}"
+export TOKEN_AGGREGATION_URL="${TOKEN_AGGREGATION_URL:-http://127.0.0.1:3000}"
+export OMNL_API_KEY="${OMNL_API_KEY:-${OMNL_SUPER_ADMIN_OFFICE24_KEY:-}}"
+export RPC_URL_138="${RPC_URL_138:-${CHAIN_138_RPC_URL:-http://192.168.11.211:8545}}"
+
+cd "$REPO_DIR/services/swift-listener"
+if [[ ! -d node_modules ]]; then
+  log "npm install..."
+  npm install --no-fund --no-audit
+fi
+if [[ ! -f dist/cli.js ]]; then
+  log "build..."
+  npm run build
+fi
+
+pkill -f "swift-listener/dist/cli.js" 2>/dev/null || true
+fuser -k "${PORT}/tcp" 2>/dev/null || true
+sleep 1
+
+log "Starting on :${PORT} (POST /inbound, GET /health)"
+nohup env \
+  OMNL_BANK_ROOT="$REPO_DIR" \
+  SWIFT_LISTENER_WEBHOOK="$SWIFT_LISTENER_WEBHOOK" \
+  SWIFT_LISTENER_FILE_INBOX="$SWIFT_LISTENER_FILE_INBOX" \
+  SWIFT_LISTENER_OMNL_FORWARD="$SWIFT_LISTENER_OMNL_FORWARD" \
+  SWIFT_LISTENER_INTAKE_GATEWAY="$SWIFT_LISTENER_INTAKE_GATEWAY" \
+  SWIFT_LISTENER_GATEWAY_EXECUTE="$SWIFT_LISTENER_GATEWAY_EXECUTE" \
+  SWIFT_LISTENER_WEBHOOK_TOKEN="${SWIFT_LISTENER_WEBHOOK_TOKEN:-}" \
+  HYBX_WEBHOOK_SECRET="${HYBX_WEBHOOK_SECRET:-}" \
+  TOKEN_AGGREGATION_URL="$TOKEN_AGGREGATION_URL" \
+  OMNL_API_KEY="$OMNL_API_KEY" \
+  RPC_URL_138="$RPC_URL_138" \
+  PRIVATE_KEY="${PRIVATE_KEY:-}" \
+  node dist/cli.js --project-root "$REPO_DIR" \
+  >"$LOG_DIR/swift-listener.log" 2>&1 &
+echo $! >"$LOG_DIR/swift-listener.pid"
+
+sleep 2
+if curl -sf "http://127.0.0.1:${PORT}/health" | head -c 120; then
+  echo
+  log "OK — set SWIFT_LISTENER_URL=http://127.0.0.1:${PORT} in .env for settlement-middleware"
+else
+  log "WARN: health check failed — see $LOG_DIR/swift-listener.log"
+  exit 1
+fi
--- a/scripts/deployment/sync-guosmm-notices.sh
+++ b/scripts/deployment/sync-guosmm-notices.sh
@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Verify GUOSMM gazette notices are live and propagate config to banking stack.
+set -euo pipefail
+
+REPO_DIR="${OMNL_BANK_ROOT:-$HOME/smom-dbis-138}"
+REGISTRY="${REPO_DIR}/config/guosmm-notices.v1.json"
+log() { echo "[$(date -Iseconds)] guosmm-sync $*"; }
+
+[[ -f "$REGISTRY" ]] || { log "Missing $REGISTRY"; exit 1; }
+
+log "Verifying gazette URLs..."
+while IFS= read -r url; do
+  [[ -n "$url" ]] || continue
+  code="$(curl -sS -o /dev/null -w '%{http_code}' "$url")"
+  log "  $url -> HTTP $code"
+  [[ "$code" == "200" ]] || exit 1
+done < <(node -e "
+const r=require('${REGISTRY//\\/\\\\}');
+for (const n of r.notices) console.log(n.url);
+")
+
+log "API catalog probe (local token-aggregation)..."
+curl -sf "http://127.0.0.1:3000/api/v1/omnl/gazette/notices" | head -c 200 || log "WARN: local API not up — redeploy first"
+echo
+
+if [[ "${GUOSMM_SYNC_LXCS:-0}" == "1" ]]; then
+  PROXMOX_ROOT="${PROXMOX_ROOT:-/srv/projects/proxmox}"
+  if [[ -f "${PROXMOX_ROOT}/scripts/deployment/sync-zardasht-omnl-banking-portal-lxcs.sh" ]]; then
+    log "LXC sync..."
+    bash "${PROXMOX_ROOT}/scripts/deployment/sync-zardasht-omnl-banking-portal-lxcs.sh" --apply
+  fi
+fi
+
+log "GUOSMM notices deployed to config + API registry"
+log "  Portal: /central-bank and /hub (gazette section)"
+log "  API: GET /api/v1/omnl/gazette/notices"
--- a/scripts/deployment/sync-z-chain-deployed-addresses.mjs
+++ b/scripts/deployment/sync-z-chain-deployed-addresses.mjs
@@ -0,0 +1,69 @@
+#!/usr/bin/env node
+/**
+ * Sync forge broadcast output into z-chain-deployed.v1.json and hybx cross-chain lines.
+ * Usage: node scripts/deployment/sync-z-chain-deployed-addresses.mjs [broadcast-run.json]
+ */
+import { readFileSync, writeFileSync, existsSync } from 'fs';
+import { resolve, dirname } from 'path';
+import { fileURLToPath } from 'url';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const root = resolve(__dirname, '../..');
+
+const broadcastPath =
+  process.argv[2] ||
+  resolve(root, 'broadcast/DeployZChainEmoney.s.sol/900002/run-latest.json');
+
+if (!existsSync(broadcastPath)) {
+  console.error(`Broadcast file not found: ${broadcastPath}`);
+  console.error('Deploy first: bash scripts/deployment/deploy-z-chain-contracts.sh');
+  process.exit(1);
+}
+
+const broadcast = JSON.parse(readFileSync(broadcastPath, 'utf8'));
+const txs = broadcast.transactions || [];
+let cUsdc = null;
+let registry = null;
+
+for (const tx of txs) {
+  const name = tx.contractName;
+  const addr = tx.contractAddress;
+  if (!addr) continue;
+  if (name === 'ZChainUSDC') cUsdc = addr;
+  if (name === 'AccountWalletRegistry' || name === 'AccountWalletRegistryZ') registry = addr;
+}
+
+if (!cUsdc || !registry) {
+  console.error('Could not find ZChainUSDC and AccountWalletRegistry in broadcast');
+  process.exit(1);
+}
+
+const deployedPath = resolve(root, 'config/z-chain-deployed.v1.json');
+const deployed = JSON.parse(readFileSync(deployedPath, 'utf8'));
+deployed.updated = new Date().toISOString().slice(0, 10);
+deployed.status = 'active';
+deployed.contracts.cUSDC = cUsdc;
+deployed.contracts.accountWalletRegistry = registry;
+writeFileSync(deployedPath, `${JSON.stringify(deployed, null, 2)}\n`);
+
+const integrationPath = resolve(root, 'config/z-chain-integration.v1.json');
+const integration = JSON.parse(readFileSync(integrationPath, 'utf8'));
+integration.contracts.cUSDC = cUsdc;
+integration.contracts.accountWalletRegistry = registry;
+writeFileSync(integrationPath, `${JSON.stringify(integration, null, 2)}\n`);
+
+const hybxPath = resolve(root, 'config/hybx-omnl-cross-chain-lines.json');
+const hybx = JSON.parse(readFileSync(hybxPath, 'utf8'));
+for (const line of hybx.lines || []) {
+  if (line.chains?.['900002']) {
+    line.chains['900002'].tokenM1 = cUsdc;
+  }
+}
+writeFileSync(hybxPath, `${JSON.stringify(hybx, null, 2)}\n`);
+
+console.log('Updated:');
+console.log('  cUSDC:', cUsdc);
+console.log('  AccountWalletRegistry:', registry);
+console.log('  config/z-chain-deployed.v1.json');
+console.log('  config/z-chain-integration.v1.json');
+console.log('  config/hybx-omnl-cross-chain-lines.json (chains.900002.tokenM1)');