feat(settlement): production wallet L1 BTC to cBTC (not institutional ledger)

Add wallet settlement source with custody-backed mint path, btc-intake persistence,
/btc/wallet/l1-settle and /btc/wallet/status APIs, and full production deploy script.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/deployment/deploy-btc-wallet-production.sh

@@ -0,0 +1,123 @@
+#!/usr/bin/env bash
+# Full production deploy: wallet L1 BTC → cBTC (settlement-middleware + btc-intake).
+#
+# Run on dev-bis-ali / secure.omdnl.org backend:
+#   bash scripts/deployment/deploy-btc-wallet-production.sh
+#
+set -euo pipefail
+
+REPO_DIR="${OMNL_BANK_ROOT:-$HOME/smom-dbis-138}"
+ENV_FILE="${OMNL_BANK_ENV:-$REPO_DIR/.env}"
+LOG_DIR="${OMNL_BANK_LOG_DIR:-$HOME/omnl-bank/logs}"
+
+log() { echo "[$(date -Iseconds)] $*"; }
+
+cd "$REPO_DIR"
+
+if [[ "${OMNL_SKIP_GIT_PULL:-0}" != "1" ]]; then
+  log "Pull latest main..."
+  git fetch origin && git checkout main && git pull --ff-only origin main
+fi
+
+export SETTLEMENT_MIDDLEWARE_CONFIG="${SETTLEMENT_MIDDLEWARE_CONFIG:-$REPO_DIR/config/settlement-middleware.production.v1.json}"
+export OMNL_BTC_LEDGER_CONFIG="${OMNL_BTC_LEDGER_CONFIG:-$REPO_DIR/config/btc-l1-ledger-1000.chain138.v1.json}"
+export OMNL_BTC_WALLET_CONFIG="${OMNL_BTC_WALLET_CONFIG:-$REPO_DIR/config/btc-wallet-l1.chain138.v1.json}"
+
+if [[ -f "$ENV_FILE" ]]; then
+  set -a
+  set +u
+  # shellcheck disable=SC1090
+  source "$ENV_FILE"
+  set -u
+  set +a
+fi
+
+if [[ -f "$REPO_DIR/scripts/deployment/sync-btc-ledger-contract-env.mjs" ]]; then
+  node "$REPO_DIR/scripts/deployment/sync-btc-ledger-contract-env.mjs" | while IFS= read -r line; do
+    key="${line%%=*}"
+    grep -q "^${key}=" "$ENV_FILE" 2>/dev/null || echo "$line" >>"$ENV_FILE"
+  done
+  set -a
+  set +u
+  # shellcheck disable=SC1090
+  source "$ENV_FILE"
+  set -u
+  set +a
+fi
+
+log "Building settlement-core, settlement-middleware, btc-intake..."
+for dir in packages/settlement-core services/settlement-middleware services/btc-intake; do
+  cd "$REPO_DIR/$dir"
+  NODE_ENV=development npm install --no-fund --no-audit
+  npm run build
+done
+
+mkdir -p "$LOG_DIR"
+
+start_settlement() {
+  cd "$REPO_DIR/services/settlement-middleware"
+  pkill -f "smom-dbis-138/services/settlement-middleware" 2>/dev/null || true
+  fuser -k 3011/tcp 2>/dev/null || true
+  sleep 1
+  nohup env \
+    SETTLEMENT_MIDDLEWARE_CONFIG="$SETTLEMENT_MIDDLEWARE_CONFIG" \
+    OMNL_BTC_LEDGER_CONFIG="$OMNL_BTC_LEDGER_CONFIG" \
+    OMNL_BTC_WALLET_CONFIG="$OMNL_BTC_WALLET_CONFIG" \
+    OMNL_SUPPORTED_CHAINS_CONFIG="${OMNL_SUPPORTED_CHAINS_CONFIG:-$REPO_DIR/config/omnl-supported-chains.v1.json}" \
+    OMNL_M2_TOKEN_REGISTRY="${OMNL_M2_TOKEN_REGISTRY:-$REPO_DIR/config/omnl-m2-token-registry.v1.json}" \
+    OMNL_API_KEY="${OMNL_API_KEY:-${OMNL_SUPER_ADMIN_SECURE_KEY:-}}" \
+    OMNL_FINERACT_BASE_URL="${OMNL_FINERACT_BASE_URL:-${FINERACT_BASE_URL:-}}" \
+    OMNL_FINERACT_TENANT="${OMNL_FINERACT_TENANT:-${FINERACT_TENANT:-omnl}}" \
+    OMNL_FINERACT_USER="${OMNL_FINERACT_USER:-}" \
+    OMNL_FINERACT_USERNAME="${OMNL_FINERACT_USERNAME:-}" \
+    OMNL_FINERACT_PASSWORD="${OMNL_FINERACT_PASSWORD:-}" \
+    SETTLEMENT_ALLOW_CHAIN_MINT_EXECUTE="${SETTLEMENT_ALLOW_CHAIN_MINT_EXECUTE:-1}" \
+    TOKEN_AGGREGATION_URL="${TOKEN_AGGREGATION_URL:-http://127.0.0.1:3000}" \
+    CHAIN138_ORACLE_URL="${CHAIN138_ORACLE_URL:-http://127.0.0.1:3500}" \
+    RPC_URL_138="${RPC_URL_138:-${CHAIN_138_RPC_URL:-}}" \
+    OMNL_MINT_OPERATOR_PRIVATE_KEY="${OMNL_MINT_OPERATOR_PRIVATE_KEY:-}" \
+    OMNL_REQUIRE_LIVE_BTC_PRICE="${OMNL_REQUIRE_LIVE_BTC_PRICE:-1}" \
+    CBTC_ADDRESS_138="${CBTC_ADDRESS_138:-}" \
+    BTC_L1_RECIPIENT_ADDRESS="${BTC_L1_RECIPIENT_ADDRESS:-}" \
+    DODO_PMM_INTEGRATION="${DODO_PMM_INTEGRATION:-}" \
+    npm run start >"$LOG_DIR/settlement-middleware.log" 2>&1 &
+  echo $! >"$LOG_DIR/settlement-middleware.pid"
+}
+
+start_btc_intake() {
+  cd "$REPO_DIR/services/btc-intake"
+  pkill -f "smom-dbis-138/services/btc-intake" 2>/dev/null || true
+  fuser -k 3013/tcp 2>/dev/null || true
+  sleep 1
+  nohup env \
+    BTC_INTAKE_PORT="${BTC_INTAKE_PORT:-3013}" \
+    BTC_INTAKE_DATA_DIR="${BTC_INTAKE_DATA_DIR:-$REPO_DIR/data/btc-intake}" \
+    SETTLEMENT_MIDDLEWARE_URL="${SETTLEMENT_MIDDLEWARE_URL:-http://127.0.0.1:3011}" \
+    OMNL_API_KEY="${OMNL_API_KEY:-${OMNL_SUPER_ADMIN_SECURE_KEY:-}}" \
+    BITCOIND_RPC_URL="${BITCOIND_RPC_URL:-}" \
+    BITCOIND_RPC_USER="${BITCOIND_RPC_USER:-}" \
+    BITCOIND_RPC_PASS="${BITCOIND_RPC_PASS:-}" \
+    BTC_NETWORK="${BTC_NETWORK:-mainnet}" \
+    BTC_CONFIRMATIONS_REQUIRED="${BTC_CONFIRMATIONS_REQUIRED:-6}" \
+    BTC_INTAKE_SYNC_INTERVAL_MS="${BTC_INTAKE_SYNC_INTERVAL_MS:-30000}" \
+    npm run start >"$LOG_DIR/btc-intake.log" 2>&1 &
+  echo $! >"$LOG_DIR/btc-intake.pid"
+}
+
+start_settlement
+sleep 4
+start_btc_intake
+sleep 3
+
+API_KEY="${OMNL_API_KEY:-${OMNL_SUPER_ADMIN_SECURE_KEY:-}}"
+log "Smoke: GET /btc/wallet/status"
+curl -sf -H "Authorization: Bearer ${API_KEY}" \
+  "http://127.0.0.1:3011/api/v1/settlement/btc/wallet/status" | head -c 500
+echo
+log "Smoke: GET btc-intake /health"
+curl -sf "http://127.0.0.1:3013/health" | head -c 200 || log "WARN: btc-intake degraded (bitcoind may be offline)"
+echo
+log "Wallet BTC production deploy complete"
+log "  Deposit: POST http://127.0.0.1:3013/deposit-instructions"
+log "  Settle:  POST https://secure.omdnl.org/settlement/btc/wallet/l1-settle"
+log "  Status:  GET  https://secure.omdnl.org/settlement/btc/wallet/status"

scripts/deployment/deploy-omnl-bank-production.sh

@@ -172,6 +172,7 @@ start_svc() {
     OMNL_MINT_OPERATOR_PRIVATE_KEY="${OMNL_MINT_OPERATOR_PRIVATE_KEY:-}" \
     OMNL_REQUIRE_LIVE_BTC_PRICE="${OMNL_REQUIRE_LIVE_BTC_PRICE:-1}" \
     OMNL_BTC_LEDGER_CONFIG="${OMNL_BTC_LEDGER_CONFIG:-$REPO_DIR/config/btc-l1-ledger-1000.chain138.v1.json}" \
+    OMNL_BTC_WALLET_CONFIG="${OMNL_BTC_WALLET_CONFIG:-$REPO_DIR/config/btc-wallet-l1.chain138.v1.json}" \
     CBTC_ADDRESS_138="${CBTC_ADDRESS_138:-}" \
     BTC_L1_RECIPIENT_ADDRESS="${BTC_L1_RECIPIENT_ADDRESS:-}" \
     BTC_EXISTING_MINT_HOLDER="${BTC_EXISTING_MINT_HOLDER:-}" \

scripts/deployment/push-portal-env-to-lxc.sh

@@ -26,7 +26,7 @@ set -u
 set +a
 
 FRAG="$(mktemp)"
-grep -E '^(OMNL_FINERACT_|OMNL_PUBLIC_MONEY_SUPPLY=|OMNL_REQUIRE_API_KEY=|OMNL_CUSTOMER_SECURITY_PRODUCTION=|OMNL_CUSTOMER_API_KEYS=|OFFICE24_OPENING_M1_USD=|OMNL_PORTAL_INTERNAL_SECRET=|JWT_SECRET=|DATABASE_URL=|RPC_URL_138=|CHAIN_138_RPC_URL=|SETTLEMENT_ALLOW_CHAIN_MINT_EXECUTE=|SETTLEMENT_ALLOW_HYBX_PRODUCTION=|OMNL_ALLOW_CHAIN_MINT_EXECUTE=|OMNL_MINT_OPERATOR_PRIVATE_KEY=|OMNL_BTC_LEDGER_CONFIG=|CBTC_ADDRESS_138=|BTC_L1_RECIPIENT_ADDRESS=|BTC_EXISTING_MINT_HOLDER=|DODO_PMM_INTEGRATION=|CHAIN_138_DODO_PMM_INTEGRATION=|RESERVE_SYSTEM=|ORACLE_PROXY_ADDRESS=|CHAIN138_POOL_CBTC_CUSDT=|CHAIN138_POOL_CBTC_CUSDC=|CHAIN138_POOL_CBTC_CXAUC=|CHAIN138_ORACLE_URL=|CHAIN138_ORACLE_PORT=|TOKEN_AGGREGATION_URL=|OMNL_REQUIRE_LIVE_BTC_PRICE=|KEEPER_PRIVATE_KEY=|PRICE_FEED_KEEPER_ADDRESS=|AGGREGATOR_ADDRESS=|SWIFT_LISTENER_URL=|HYBX_BASE_URL=|HYBX_API=|HYBX_ENVIRONMENT=|HYBX_API_KEY=|HYBX_CLIENT_ID=|HYBX_CLIENT_SECRET=|HYBX_WEBHOOK_SECRET=|HYBX_MIFOS_FINERACT_SIDECAR_URL=|HYBX_ALLOW_LAN_SIDECAR=|INFURA_PROJECT_ID=|INFURA_PROJECT_SECRET=)' "$ENV_FILE" >"$FRAG" || true
+grep -E '^(OMNL_FINERACT_|OMNL_PUBLIC_MONEY_SUPPLY=|OMNL_REQUIRE_API_KEY=|OMNL_CUSTOMER_SECURITY_PRODUCTION=|OMNL_CUSTOMER_API_KEYS=|OFFICE24_OPENING_M1_USD=|OMNL_PORTAL_INTERNAL_SECRET=|JWT_SECRET=|DATABASE_URL=|RPC_URL_138=|CHAIN_138_RPC_URL=|SETTLEMENT_ALLOW_CHAIN_MINT_EXECUTE=|SETTLEMENT_ALLOW_HYBX_PRODUCTION=|OMNL_ALLOW_CHAIN_MINT_EXECUTE=|OMNL_MINT_OPERATOR_PRIVATE_KEY=|OMNL_BTC_LEDGER_CONFIG=|OMNL_BTC_WALLET_CONFIG=|CBTC_ADDRESS_138=|BTC_L1_RECIPIENT_ADDRESS=|BTC_EXISTING_MINT_HOLDER=|DODO_PMM_INTEGRATION=|CHAIN_138_DODO_PMM_INTEGRATION=|RESERVE_SYSTEM=|ORACLE_PROXY_ADDRESS=|CHAIN138_POOL_CBTC_CUSDT=|CHAIN138_POOL_CBTC_CUSDC=|CHAIN138_POOL_CBTC_CXAUC=|BITCOIND_RPC_URL=|BITCOIND_RPC_USER=|BITCOIND_RPC_PASS=|BTC_NETWORK=|BTC_CONFIRMATIONS_REQUIRED=|BTC_INTAKE_PORT=|SETTLEMENT_MIDDLEWARE_URL=|CHAIN138_ORACLE_URL=|CHAIN138_ORACLE_PORT=|TOKEN_AGGREGATION_URL=|OMNL_REQUIRE_LIVE_BTC_PRICE=|KEEPER_PRIVATE_KEY=|PRICE_FEED_KEEPER_ADDRESS=|AGGREGATOR_ADDRESS=|SWIFT_LISTENER_URL=|HYBX_BASE_URL=|HYBX_API=|HYBX_ENVIRONMENT=|HYBX_API_KEY=|HYBX_CLIENT_ID=|HYBX_CLIENT_SECRET=|HYBX_WEBHOOK_SECRET=|HYBX_MIFOS_FINERACT_SIDECAR_URL=|HYBX_ALLOW_LAN_SIDECAR=|INFURA_PROJECT_ID=|INFURA_PROJECT_SECRET=)' "$ENV_FILE" >"$FRAG" || true
 
 ADMIN_ENV_KEY="$(node -e "
 const fs = require('fs');