Add mainnet checkpoint stack: ISO attestation, participant Etherscan surface, and services.

Ship AddressActivityRegistry V1/V2, ISO20022IntakeGateway, Chain138ParticipantSurface,
checkpoint hub contracts, checkpoint-core package, aggregator/indexer/sdk services,
relay profile guards, M00 diamond bridge facet, and OMNL compliance contracts.

Co-authored-by: Cursor <cursoragent@cursor.com>

script/mainnet-checkpoint/CheckpointConfigLib.s.sol

@@ -0,0 +1,35 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.20;
+
+import {Script} from "forge-std/Script.sol";
+import {CheckpointHubConfig} from "../../contracts/mainnet-checkpoint/libraries/CheckpointHubConfig.sol";
+import {BatchEmitterConfig} from "../../contracts/mainnet-checkpoint/libraries/BatchEmitterConfig.sol";
+
+/// @notice Shared env → config parsing for deploy/configure scripts.
+abstract contract CheckpointConfigScript is Script {
+    function hubConfigFromEnv() internal view returns (CheckpointHubConfig.HubConfig memory cfg) {
+        cfg = CheckpointHubConfig.mainnetDefaults();
+        cfg.batchSize = uint16(vm.envOr("CHECKPOINT_BATCH_SIZE", uint256(cfg.batchSize)));
+        cfg.maxBatchWaitSeconds = uint32(vm.envOr("CHECKPOINT_MAX_WAIT_SECONDS", uint256(cfg.maxBatchWaitSeconds)));
+        cfg.minPaymentValueWei = vm.envOr("CHECKPOINT_MIN_PAYMENT_VALUE_WEI", uint256(0));
+        cfg.requireValidatorSigs = vm.envOr("CHECKPOINT_REQUIRE_VALIDATOR_SIGS", cfg.requireValidatorSigs);
+        cfg.allowCalldataOnlySubmit = vm.envOr("CHECKPOINT_ALLOW_CALLDATA_ONLY", cfg.allowCalldataOnlySubmit);
+        cfg.allowCCIPIngress = vm.envOr("CHECKPOINT_ALLOW_CCIP_INGRESS", cfg.allowCCIPIngress);
+        cfg.enforcePreviousBatchId = vm.envOr("CHECKPOINT_ENFORCE_PREVIOUS_BATCH_ID", cfg.enforcePreviousBatchId);
+        cfg.ccipRouter = vm.envOr("CCIP_ROUTER_MAINNET", address(0));
+        cfg.sourceChainSelector = uint64(vm.envOr("CCIP_CHAIN_SELECTOR_138", uint256(0)));
+        cfg.batchEmitterOnSource = vm.envOr("CHAIN138_BATCH_EMITTER", address(0));
+        cfg.legacyMirrorV1 = vm.envOr("TRANSACTION_MIRROR_MAINNET", address(0));
+        cfg.legacyTetherV1 = vm.envOr("MAINNET_TETHER_ADDRESS", address(0));
+        cfg.submitterAttestationSigner = vm.envOr("CHECKPOINT_ATTESTATION_SIGNER", address(0));
+        CheckpointHubConfig.validate(cfg);
+    }
+
+    function emitterConfigFromEnv() internal view returns (BatchEmitterConfig.EmitterConfig memory cfg) {
+        cfg.ccipRouter = vm.envAddress("CCIP_ROUTER_CHAIN138");
+        cfg.linkToken = vm.envAddress("LINK_TOKEN_CHAIN138");
+        cfg.mainnetChainSelector = uint64(vm.envUint("CCIP_CHAIN_SELECTOR_MAINNET"));
+        cfg.mainnetCheckpoint = vm.envAddress("CHAIN138_MAINNET_CHECKPOINT_PROXY");
+        BatchEmitterConfig.validate(cfg);
+    }
+}

script/mainnet-checkpoint/ConfigureCheckpointExtensions.s.sol

@@ -0,0 +1,81 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.20;
+
+import {Script, console} from "forge-std/Script.sol";
+import {SubmitRateLimitExtension} from "../../contracts/mainnet-checkpoint/extensions/SubmitRateLimitExtension.sol";
+import {TimelockSubmitExtension} from "../../contracts/mainnet-checkpoint/extensions/TimelockSubmitExtension.sol";
+import {ValidatorSigVerifierExtension} from "../../contracts/mainnet-checkpoint/extensions/ValidatorSigVerifierExtension.sol";
+import {TokenTransferFilterExtension} from "../../contracts/mainnet-checkpoint/extensions/TokenTransferFilterExtension.sol";
+import {ZkStateRootVerifierExtension} from "../../contracts/mainnet-checkpoint/extensions/ZkStateRootVerifierExtension.sol";
+import {BlockHeaderOracleExtension} from "../../contracts/mainnet-checkpoint/extensions/BlockHeaderOracleExtension.sol";
+import {MinPaymentValueExtension} from "../../contracts/mainnet-checkpoint/extensions/MinPaymentValueExtension.sol";
+
+/// @notice Per-extension granular tuning from env (post-deploy).
+contract ConfigureCheckpointExtensions is Script {
+    function run() external {
+        uint256 pk = vm.envUint("PRIVATE_KEY");
+        vm.startBroadcast(pk);
+
+        address rateLimit = vm.envOr("EXT_RATE_LIMIT", address(0));
+        if (rateLimit != address(0)) {
+            uint256 maxPerHour = vm.envOr("CHECKPOINT_RATE_LIMIT_MAX_PER_HOUR", uint256(120));
+            SubmitRateLimitExtension(rateLimit).setMaxBatchesPerHour(maxPerHour);
+            console.log("RateLimit max/hour", maxPerHour);
+        }
+
+        address timelock = vm.envOr("EXT_TIMELOCK", address(0));
+        if (timelock != address(0)) {
+            uint256 delay = vm.envOr("CHECKPOINT_TIMELOCK_DELAY_SECONDS", uint256(48 hours));
+            TimelockSubmitExtension(timelock).setDelay(delay);
+            console.log("Timelock delay", delay);
+        }
+
+        address validator = vm.envOr("EXT_VALIDATOR_SIG", address(0));
+        if (validator != address(0)) {
+            address hub = vm.envAddress("CHAIN138_MAINNET_CHECKPOINT_PROXY");
+            ValidatorSigVerifierExtension(validator).setVerifyingContract(hub);
+            uint256 threshold = vm.envOr("CHECKPOINT_VALIDATOR_THRESHOLD", uint256(1));
+            address[] memory addrs = new address[](1);
+            addrs[0] = vm.envOr("CHECKPOINT_VALIDATOR_ADDRESS", vm.addr(pk));
+            ValidatorSigVerifierExtension(validator).setValidators(addrs, threshold);
+        }
+
+        address tokenFilter = vm.envOr("EXT_TOKEN_FILTER", address(0));
+        if (tokenFilter != address(0)) {
+            TokenTransferFilterExtension filter = TokenTransferFilterExtension(tokenFilter);
+            bool allowNative = vm.envOr("CHECKPOINT_TOKEN_FILTER_ALLOW_NATIVE", true);
+            uint256 minNative = vm.envOr("CHECKPOINT_TOKEN_FILTER_MIN_NATIVE_WEI", uint256(0));
+            filter.setAllowNative(allowNative, minNative);
+            _allowToken(filter, vm.envOr("CUSDT_CHAIN138", address(0)));
+            _allowToken(filter, vm.envOr("CUSDC_CHAIN138", address(0)));
+        }
+
+        address zk = vm.envOr("EXT_ZK_STATE_ROOT", address(0));
+        if (zk != address(0)) {
+            bool requireZk = vm.envOr("CHECKPOINT_REQUIRE_ZK_PROOF", false);
+            ZkStateRootVerifierExtension(zk).setRequireZkProof(requireZk);
+        }
+
+        address blockOracle = vm.envOr("EXT_BLOCK_ORACLE", address(0));
+        if (blockOracle != address(0)) {
+            BlockHeaderOracleExtension oracle = BlockHeaderOracleExtension(blockOracle);
+            oracle.setRequireOracleRecord(vm.envOr("CHECKPOINT_BLOCK_ORACLE_REQUIRED", true));
+            address updater = vm.envOr("CHECKPOINT_ORACLE_UPDATER", vm.addr(pk));
+            oracle.grantRole(keccak256("ORACLE_UPDATER_ROLE"), updater);
+        }
+
+        address minPay = vm.envOr("EXT_MIN_PAYMENT", address(0));
+        address hubProxy = vm.envOr("CHAIN138_MAINNET_CHECKPOINT_PROXY", address(0));
+        if (minPay != address(0) && hubProxy != address(0)) {
+            MinPaymentValueExtension(minPay).setHub(hubProxy);
+        }
+
+        vm.stopBroadcast();
+    }
+
+    function _allowToken(TokenTransferFilterExtension filter, address token) internal {
+        if (token == address(0)) return;
+        filter.setAllowedToken(token, true);
+        console.log("Allowed token", token);
+    }
+}

script/mainnet-checkpoint/ConfigureCheckpointHub.s.sol

@@ -0,0 +1,26 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.20;
+
+import {Script, console} from "forge-std/Script.sol";
+import {Chain138MainnetCheckpoint} from "../../contracts/mainnet-checkpoint/Chain138MainnetCheckpoint.sol";
+import {CheckpointHubConfig} from "../../contracts/mainnet-checkpoint/libraries/CheckpointHubConfig.sol";
+import {CheckpointConfigScript} from "./CheckpointConfigLib.s.sol";
+
+/// @notice Apply granular hub config from env (post-deploy). Run predeploy gate first.
+contract ConfigureCheckpointHub is CheckpointConfigScript {
+    function run() external {
+        uint256 pk = vm.envUint("PRIVATE_KEY");
+        address proxy = vm.envAddress("CHAIN138_MAINNET_CHECKPOINT_PROXY");
+        Chain138MainnetCheckpoint hub = Chain138MainnetCheckpoint(proxy);
+        CheckpointHubConfig.HubConfig memory cfg = hubConfigFromEnv();
+
+        vm.startBroadcast(pk);
+        hub.applyConfig(cfg);
+        vm.stopBroadcast();
+
+        CheckpointHubConfig.HubConfig memory onChain = hub.getFullConfig();
+        console.log("batchSize", onChain.batchSize);
+        console.log("maxBatchWaitSeconds", onChain.maxBatchWaitSeconds);
+        console.log("allowCCIPIngress", onChain.allowCCIPIngress);
+    }
+}

script/mainnet-checkpoint/DeployAddressActivityRegistry.s.sol

@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.20;
+
+import {Script, console} from "forge-std/Script.sol";
+import {AddressActivityRegistry} from "../../contracts/mainnet-checkpoint/AddressActivityRegistry.sol";
+
+contract DeployAddressActivityRegistry is Script {
+    function run() external {
+        address admin = vm.envOr("CHECKPOINT_ADMIN", msg.sender);
+        vm.startBroadcast();
+        AddressActivityRegistry registry = new AddressActivityRegistry(admin);
+        console.log("AddressActivityRegistry:", address(registry));
+        vm.stopBroadcast();
+    }
+}

script/mainnet-checkpoint/DeployAddressActivityRegistryV2.s.sol

@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.20;
+
+import {Script, console} from "forge-std/Script.sol";
+import {AddressActivityRegistryV2} from "../../contracts/mainnet-checkpoint/AddressActivityRegistryV2.sol";
+
+contract DeployAddressActivityRegistryV2 is Script {
+    function run() external {
+        address admin = vm.envOr("CHECKPOINT_ADMIN", msg.sender);
+        vm.startBroadcast();
+        AddressActivityRegistryV2 registry = new AddressActivityRegistryV2(admin);
+        console.log("AddressActivityRegistryV2:", address(registry));
+        vm.stopBroadcast();
+    }
+}

script/mainnet-checkpoint/DeployAllCheckpointExtensions.s.sol

@@ -0,0 +1,49 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.20;
+
+import {Script, console} from "forge-std/Script.sol";
+import {MirrorDetailExtension} from "../../contracts/mainnet-checkpoint/extensions/MirrorDetailExtension.sol";
+import {ValidatorSigVerifierExtension} from "../../contracts/mainnet-checkpoint/extensions/ValidatorSigVerifierExtension.sol";
+import {AttestationURIExtension} from "../../contracts/mainnet-checkpoint/extensions/AttestationURIExtension.sol";
+import {SubmitRateLimitExtension} from "../../contracts/mainnet-checkpoint/extensions/SubmitRateLimitExtension.sol";
+import {TokenTransferFilterExtension} from "../../contracts/mainnet-checkpoint/extensions/TokenTransferFilterExtension.sol";
+import {CwTransportLinkExtension} from "../../contracts/mainnet-checkpoint/extensions/CwTransportLinkExtension.sol";
+import {TimelockSubmitExtension} from "../../contracts/mainnet-checkpoint/extensions/TimelockSubmitExtension.sol";
+import {MetricsExtension} from "../../contracts/mainnet-checkpoint/extensions/MetricsExtension.sol";
+import {ZkStateRootVerifierExtension} from "../../contracts/mainnet-checkpoint/extensions/ZkStateRootVerifierExtension.sol";
+import {PaymasterHintExtension} from "../../contracts/mainnet-checkpoint/extensions/PaymasterHintExtension.sol";
+import {L2OracleAdapterExtension} from "../../contracts/mainnet-checkpoint/extensions/L2OracleAdapterExtension.sol";
+import {BlockHeaderOracleExtension} from "../../contracts/mainnet-checkpoint/extensions/BlockHeaderOracleExtension.sol";
+import {MinPaymentValueExtension} from "../../contracts/mainnet-checkpoint/extensions/MinPaymentValueExtension.sol";
+import {LegacyCheckpointAdapter} from "../../contracts/mainnet-checkpoint/LegacyCheckpointAdapter.sol";
+
+/// @notice Deploy all optional extension modules + legacy read adapter (non-proxy).
+contract DeployAllCheckpointExtensions is Script {
+    function run() external {
+        uint256 pk = vm.envUint("PRIVATE_KEY");
+        address admin = vm.envOr("CHECKPOINT_ADMIN", vm.addr(pk));
+        address checkpoint = vm.envAddress("CHAIN138_MAINNET_CHECKPOINT_PROXY");
+        address mirror = vm.envOr("TRANSACTION_MIRROR_MAINNET", address(0));
+        address tether = vm.envOr("MAINNET_TETHER_ADDRESS", address(0));
+
+        vm.startBroadcast(pk);
+        console.log("MirrorDetail:", address(new MirrorDetailExtension()));
+        console.log("ValidatorSig:", address(new ValidatorSigVerifierExtension()));
+        console.log("AttestationURI:", address(new AttestationURIExtension()));
+        console.log("RateLimit:", address(new SubmitRateLimitExtension()));
+        console.log("TokenFilter:", address(new TokenTransferFilterExtension()));
+        console.log("CwLink:", address(new CwTransportLinkExtension()));
+        console.log("Timelock:", address(new TimelockSubmitExtension()));
+        console.log("Metrics:", address(new MetricsExtension()));
+        console.log("ZkStateRoot:", address(new ZkStateRootVerifierExtension()));
+        console.log("PaymasterHint:", address(new PaymasterHintExtension()));
+        console.log("L2Oracle:", address(new L2OracleAdapterExtension()));
+        console.log("BlockOracle:", address(new BlockHeaderOracleExtension(admin)));
+        console.log("MinPayment:", address(new MinPaymentValueExtension()));
+        console.log("AddressActivityRegistry: deploy separately via scripts/deployment/deploy-address-activity-registry.sh");
+        if (mirror != address(0) && tether != address(0)) {
+            console.log("LegacyAdapter:", address(new LegacyCheckpointAdapter(checkpoint, mirror, tether)));
+        }
+        vm.stopBroadcast();
+    }
+}

script/mainnet-checkpoint/DeployChain138BatchEmitter.s.sol

@@ -0,0 +1,28 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.20;
+
+import {Script, console} from "forge-std/Script.sol";
+import {ERC1967Proxy} from "@openzeppelin/contracts/proxy/ERC1967/ERC1967Proxy.sol";
+import {Chain138BatchEmitter} from "../../contracts/mainnet-checkpoint/chain138/Chain138BatchEmitter.sol";
+
+contract DeployChain138BatchEmitter is Script {
+    function run() external {
+        uint256 pk = vm.envUint("PRIVATE_KEY");
+        address admin = vm.envOr("CHECKPOINT_ADMIN", vm.addr(pk));
+        address ccipRouter = vm.envAddress("CCIP_ROUTER_CHAIN138");
+        address linkToken = vm.envAddress("LINK_TOKEN_CHAIN138");
+        uint64 mainnetSelector = uint64(vm.envUint("CCIP_CHAIN_SELECTOR_MAINNET"));
+        address mainnetCheckpoint = vm.envAddress("CHAIN138_MAINNET_CHECKPOINT_PROXY");
+
+        vm.startBroadcast(pk);
+        Chain138BatchEmitter impl = new Chain138BatchEmitter();
+        bytes memory initData = abi.encodeCall(
+            Chain138BatchEmitter.initialize,
+            (admin, ccipRouter, linkToken, mainnetSelector, mainnetCheckpoint)
+        );
+        ERC1967Proxy proxy = new ERC1967Proxy(address(impl), initData);
+        console.log("Chain138BatchEmitter impl:", address(impl));
+        console.log("Chain138BatchEmitter proxy:", address(proxy));
+        vm.stopBroadcast();
+    }
+}

script/mainnet-checkpoint/DeployChain138MainnetCheckpoint.s.sol

@@ -0,0 +1,28 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.20;
+
+import {Script, console} from "forge-std/Script.sol";
+import {ERC1967Proxy} from "@openzeppelin/contracts/proxy/ERC1967/ERC1967Proxy.sol";
+import {Chain138MainnetCheckpoint} from "../../contracts/mainnet-checkpoint/Chain138MainnetCheckpoint.sol";
+
+contract DeployChain138MainnetCheckpoint is Script {
+    function run() external {
+        uint256 pk = vm.envUint("PRIVATE_KEY");
+        address admin = vm.envOr("CHECKPOINT_ADMIN", vm.addr(pk));
+        address ccipRouter = vm.envAddress("CCIP_ROUTER_MAINNET");
+        uint64 sourceSelector = uint64(vm.envUint("CCIP_CHAIN_SELECTOR_138"));
+        address batchEmitter = vm.envOr("CHAIN138_BATCH_EMITTER", address(0));
+
+        vm.startBroadcast(pk);
+        Chain138MainnetCheckpoint impl = new Chain138MainnetCheckpoint();
+        bytes memory initData = abi.encodeCall(
+            Chain138MainnetCheckpoint.initialize,
+            (admin, ccipRouter, sourceSelector, batchEmitter)
+        );
+        ERC1967Proxy proxy = new ERC1967Proxy(address(impl), initData);
+        console.log("Chain138MainnetCheckpoint impl:", address(impl));
+        console.log("Chain138MainnetCheckpoint proxy:", address(proxy));
+        console.log("Admin:", admin);
+        vm.stopBroadcast();
+    }
+}

script/mainnet-checkpoint/DeployChain138ParticipantSurface.s.sol

@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.20;
+
+import {Script, console} from "forge-std/Script.sol";
+import {Chain138ParticipantSurface} from "../../contracts/mainnet-checkpoint/Chain138ParticipantSurface.sol";
+
+contract DeployChain138ParticipantSurface is Script {
+    function run() external {
+        address admin = vm.envOr("CHECKPOINT_ADMIN", msg.sender);
+        vm.startBroadcast();
+        Chain138ParticipantSurface surface = new Chain138ParticipantSurface(admin);
+        console.log("Chain138ParticipantSurface:", address(surface));
+        vm.stopBroadcast();
+    }
+}

script/mainnet-checkpoint/DeployISO20022IntakeGateway.s.sol

@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.20;
+
+import {Script, console} from "forge-std/Script.sol";
+import {ISO20022IntakeGateway} from "../../contracts/mainnet-checkpoint/ISO20022IntakeGateway.sol";
+
+contract DeployISO20022IntakeGateway is Script {
+    function run() external {
+        address admin = vm.envOr("CHECKPOINT_ADMIN", msg.sender);
+        vm.startBroadcast();
+        ISO20022IntakeGateway gateway = new ISO20022IntakeGateway(admin);
+        console.log("ISO20022IntakeGateway:", address(gateway));
+        vm.stopBroadcast();
+    }
+}

script/mainnet-checkpoint/ReenableCheckpointExtensions.s.sol

@@ -0,0 +1,21 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.20;
+
+import {Script, console} from "forge-std/Script.sol";
+import {Chain138MainnetCheckpoint} from "../../contracts/mainnet-checkpoint/Chain138MainnetCheckpoint.sol";
+import {ExtensionIds} from "../../contracts/mainnet-checkpoint/libraries/ExtensionIds.sol";
+
+/// @notice Re-enable extensions after hub v3 + token filter replace (env: EXT_VALIDATOR_SIG optional sanity).
+contract ReenableCheckpointExtensions is Script {
+    function run() external {
+        uint256 pk = vm.envUint("PRIVATE_KEY");
+        Chain138MainnetCheckpoint hub = Chain138MainnetCheckpoint(vm.envAddress("CHAIN138_MAINNET_CHECKPOINT_PROXY"));
+
+        vm.startBroadcast(pk);
+        hub.setExtensionActive(ExtensionIds.VALIDATOR_SIG, true);
+        console.log("VALIDATOR_SIG active");
+        hub.setExtensionActive(ExtensionIds.TOKEN_FILTER, true);
+        console.log("TOKEN_FILTER active");
+        vm.stopBroadcast();
+    }
+}

script/mainnet-checkpoint/RegisterCheckpointExtensions.s.sol

@@ -0,0 +1,42 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.20;
+
+import {Script, console} from "forge-std/Script.sol";
+import {Chain138MainnetCheckpoint} from "../../contracts/mainnet-checkpoint/Chain138MainnetCheckpoint.sol";
+import {ExtensionIds} from "../../contracts/mainnet-checkpoint/libraries/ExtensionIds.sol";
+import {ICheckpointExtension} from "../../contracts/mainnet-checkpoint/interfaces/ICheckpointExtension.sol";
+
+/// @notice Register deployed extensions on the checkpoint hub (env: EXT_* addresses).
+contract RegisterCheckpointExtensions is Script {
+    function run() external {
+        uint256 pk = vm.envUint("PRIVATE_KEY");
+        address proxy = vm.envAddress("CHAIN138_MAINNET_CHECKPOINT_PROXY");
+        Chain138MainnetCheckpoint hub = Chain138MainnetCheckpoint(proxy);
+
+        vm.startBroadcast(pk);
+        _register(hub, ExtensionIds.METRICS, vm.envAddress("EXT_METRICS"));
+        _register(hub, ExtensionIds.CONTENT_URI, vm.envAddress("EXT_ATTESTATION_URI"));
+        _register(hub, ExtensionIds.RATE_LIMIT, vm.envAddress("EXT_RATE_LIMIT"));
+        _register(hub, ExtensionIds.VALIDATOR_SIG, vm.envAddress("EXT_VALIDATOR_SIG"));
+        _register(hub, ExtensionIds.TOKEN_FILTER, vm.envAddress("EXT_TOKEN_FILTER"));
+        _register(hub, ExtensionIds.CW_LINK, vm.envAddress("EXT_CW_LINK"));
+        _register(hub, ExtensionIds.GOV_TIMELOCK, vm.envAddress("EXT_TIMELOCK"));
+        _register(hub, ExtensionIds.MIRROR_DETAIL, vm.envAddress("EXT_MIRROR_DETAIL"));
+        _register(hub, ExtensionIds.ZK_STATE_ROOT, vm.envAddress("EXT_ZK_STATE_ROOT"));
+        _register(hub, ExtensionIds.PAYMASTER_HINT, vm.envAddress("EXT_PAYMASTER_HINT"));
+        _register(hub, ExtensionIds.L2_ORACLE, vm.envAddress("EXT_L2_ORACLE"));
+        _register(hub, ExtensionIds.BLOCK_ORACLE, vm.envAddress("EXT_BLOCK_ORACLE"));
+        _register(hub, ExtensionIds.MIN_PAYMENT, vm.envAddress("EXT_MIN_PAYMENT"));
+        vm.stopBroadcast();
+    }
+
+    function _register(Chain138MainnetCheckpoint hub, bytes32 id, address module) internal {
+        if (module == address(0)) return;
+        uint32 hooks = ICheckpointExtension(module).HOOK_BEFORE_SUBMIT()
+            | ICheckpointExtension(module).HOOK_AFTER_SUBMIT()
+            | ICheckpointExtension(module).HOOK_ON_CCIP()
+            | ICheckpointExtension(module).HOOK_VERIFY_LEAF();
+        hub.registerExtension(id, module, hooks);
+        console.log("Registered", vm.toString(id), module);
+    }
+}

script/mainnet-checkpoint/ReplaceMirrorDetailExtension.s.sol

@@ -0,0 +1,27 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.20;
+
+import {Script, console} from "forge-std/Script.sol";
+import {Chain138MainnetCheckpoint} from "../../contracts/mainnet-checkpoint/Chain138MainnetCheckpoint.sol";
+import {MirrorDetailExtension} from "../../contracts/mainnet-checkpoint/extensions/MirrorDetailExtension.sol";
+import {ExtensionIds} from "../../contracts/mainnet-checkpoint/libraries/ExtensionIds.sol";
+
+contract ReplaceMirrorDetailExtension is Script {
+    function run() external {
+        address proxy = vm.envAddress("CHAIN138_MAINNET_CHECKPOINT_PROXY");
+        address oldMirror = vm.envAddress("EXT_MIRROR_DETAIL");
+        uint256 pk = vm.envUint("PRIVATE_KEY");
+
+        vm.startBroadcast(pk);
+        MirrorDetailExtension mirror = new MirrorDetailExtension();
+        console.log("New MirrorDetail:", address(mirror));
+
+        Chain138MainnetCheckpoint hub = Chain138MainnetCheckpoint(proxy);
+        hub.setExtensionActive(ExtensionIds.MIRROR_DETAIL, true);
+        hub.revokeExtension(ExtensionIds.MIRROR_DETAIL);
+        hub.registerExtension(ExtensionIds.MIRROR_DETAIL, address(mirror), mirror.HOOK_AFTER_SUBMIT());
+        hub.setExtensionActive(ExtensionIds.MIRROR_DETAIL, true);
+        console.log("Replaced mirror (old was):", oldMirror);
+        vm.stopBroadcast();
+    }
+}

script/mainnet-checkpoint/ReplaceTokenTransferFilterExtension.s.sol

@@ -0,0 +1,40 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.20;
+
+import {Script, console} from "forge-std/Script.sol";
+import {Chain138MainnetCheckpoint} from "../../contracts/mainnet-checkpoint/Chain138MainnetCheckpoint.sol";
+import {ExtensionIds} from "../../contracts/mainnet-checkpoint/libraries/ExtensionIds.sol";
+import {TokenTransferFilterExtension} from "../../contracts/mainnet-checkpoint/extensions/TokenTransferFilterExtension.sol";
+import {ICheckpointExtension} from "../../contracts/mainnet-checkpoint/interfaces/ICheckpointExtension.sol";
+
+/// @notice Deploy fixed TokenTransferFilterExtension and swap on hub (revoke + register).
+contract ReplaceTokenTransferFilterExtension is Script {
+    function run() external {
+        uint256 pk = vm.envUint("PRIVATE_KEY");
+        address hubAddr = vm.envAddress("CHAIN138_MAINNET_CHECKPOINT_PROXY");
+        Chain138MainnetCheckpoint hub = Chain138MainnetCheckpoint(hubAddr);
+
+        vm.startBroadcast(pk);
+        TokenTransferFilterExtension filter = new TokenTransferFilterExtension();
+        console.log("New TokenTransferFilter:", address(filter));
+
+        bool allowNative = vm.envOr("CHECKPOINT_TOKEN_FILTER_ALLOW_NATIVE", true);
+        uint256 minNative = vm.envOr("CHECKPOINT_TOKEN_FILTER_MIN_NATIVE_WEI", uint256(0));
+        filter.setAllowNative(allowNative, minNative);
+
+        bytes32 id = ExtensionIds.TOKEN_FILTER;
+        (, , bool wasActive) = hub.getExtension(id);
+        if (!wasActive) {
+            hub.setExtensionActive(id, true);
+        }
+        hub.revokeExtension(id);
+        uint32 hooks = ICheckpointExtension(address(filter)).HOOK_BEFORE_SUBMIT()
+            | ICheckpointExtension(address(filter)).HOOK_AFTER_SUBMIT()
+            | ICheckpointExtension(address(filter)).HOOK_ON_CCIP()
+            | ICheckpointExtension(address(filter)).HOOK_VERIFY_LEAF();
+        hub.registerExtension(id, address(filter), hooks);
+        hub.setExtensionActive(id, true);
+        console.log("TOKEN_FILTER registered and active");
+        vm.stopBroadcast();
+    }
+}

script/mainnet-checkpoint/SimulateSubmitFromCalldata.s.sol

@@ -0,0 +1,22 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.20;
+
+import {Script, console} from "forge-std/Script.sol";
+import {Chain138MainnetCheckpoint} from "../../contracts/mainnet-checkpoint/Chain138MainnetCheckpoint.sol";
+
+/// @notice Replay aggregator calldata on a mainnet fork to surface revert reason.
+contract SimulateSubmitFromCalldata is Script {
+    function run() external {
+        address hub = vm.envAddress("CHAIN138_MAINNET_CHECKPOINT_PROXY");
+        bytes memory data = vm.envBytes("CHECKPOINT_SUBMIT_CALLDATA");
+        vm.prank(vm.envAddress("CHECKPOINT_SUBMIT_FROM"));
+        (bool ok, bytes memory ret) = hub.call(data);
+        if (!ok) {
+            if (ret.length > 0) {
+                console.logBytes(ret);
+            }
+            revert("submit simulation failed");
+        }
+        console.log("ok, latest", Chain138MainnetCheckpoint(hub).getLatestBatchId());
+    }
+}

script/mainnet-checkpoint/UpgradeChain138MainnetCheckpointV3.s.sol

@@ -0,0 +1,21 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.20;
+
+import {Script, console} from "forge-std/Script.sol";
+import {Chain138MainnetCheckpoint} from "../../contracts/mainnet-checkpoint/Chain138MainnetCheckpoint.sol";
+
+/// @notice UUPS upgrade: extension hook wiring (validator sigs vs leaf payload). IMPLEMENTATION_VERSION 3.
+contract UpgradeChain138MainnetCheckpointV3 is Script {
+    function run() external {
+        address proxy = vm.envAddress("CHAIN138_MAINNET_CHECKPOINT_PROXY");
+        uint256 pk = vm.envUint("PRIVATE_KEY");
+
+        vm.startBroadcast(pk);
+        Chain138MainnetCheckpoint newImpl = new Chain138MainnetCheckpoint();
+        console.log("New impl:", address(newImpl));
+        Chain138MainnetCheckpoint(proxy).upgradeToAndCall(address(newImpl), "");
+        console.log("Upgraded proxy:", proxy);
+        require(Chain138MainnetCheckpoint(proxy).IMPLEMENTATION_VERSION() == 3, "version");
+        vm.stopBroadcast();
+    }
+}

script/mainnet-checkpoint/UpgradeChain138MainnetCheckpointV4.s.sol

@@ -0,0 +1,20 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.20;
+
+import {Script, console} from "forge-std/Script.sol";
+import {Chain138MainnetCheckpoint} from "../../contracts/mainnet-checkpoint/Chain138MainnetCheckpoint.sol";
+
+/// @notice UUPS upgrade: PaymentLeafV2 submit + V2 extension payloads. IMPLEMENTATION_VERSION 4.
+contract UpgradeChain138MainnetCheckpointV4 is Script {
+    function run() external {
+        address proxy = vm.envAddress("CHAIN138_MAINNET_CHECKPOINT_PROXY");
+        uint256 pk = vm.envUint("PRIVATE_KEY");
+
+        vm.startBroadcast(pk);
+        Chain138MainnetCheckpoint newImpl = new Chain138MainnetCheckpoint();
+        console.log("New impl v4:", address(newImpl));
+        Chain138MainnetCheckpoint(proxy).upgradeToAndCall(address(newImpl), "");
+        require(Chain138MainnetCheckpoint(proxy).IMPLEMENTATION_VERSION() == 4, "version");
+        vm.stopBroadcast();
+    }
+}