@waterx/sdk 4.0.0 → 4.0.1

package/dist/src/oracle/pyth.js

@@ -15,40 +15,343 @@
  */
 import { fromHex, toHex } from "@mysten/bcs";
 import { bcs } from "@mysten/sui/bcs";
-import { FetchPolicyError, fetchWithPolicy } from "./update-fetch.js";
+import { fetchWithPolicy, joinEndpointPath, rethrowExhaustedFetch, trimTrailingSlashes, } from "./update-fetch.js";
 export class PythCache {
     pythStateInfo;
     wormholePackageId;
     priceTableInfo;
     priceFeedObjectIdCache = new Map();
 }
-// ============================================================================
-// Hermes REST
-// ============================================================================
+/**
+ * How long a "this endpoint lacks feed X" verdict stays memoized. The verdict
+ * is a claim about *someone else's* deployment — a feed can be added to the
+ * catalog, an entitlement can be granted, a Pro plan can be upgraded — so it
+ * must expire rather than bind the whole process lifetime. Long enough that a
+ * genuinely-absent feed costs one discovery per window instead of one per
+ * build; short enough that a recovered endpoint self-heals without a restart.
+ */
+export const MISSING_FEED_MEMO_TTL_MS = 15 * 60_000;
+/**
+ * Per-endpoint memo of feed ids this endpoint has rejected as unknown (a 404
+ * on `/v2/updates/price/latest`). The Pyth Pro compat endpoint carries a
+ * SUBSET of Core's feeds — mainnet `WTIUSD`/`BRENTUSD` (Commodities
+ * USOILSPOT/UKOILSPOT) are absent, for example. Pyth 404s the WHOLE batch if
+ * ANY id is unknown, and the body naming the bad ids is NOT reliably delivered
+ * to `fetch` (Cloudflare returns it to curl but `content-length: 0` to node's
+ * undici), so the ids are isolated by catalog read (or bisection) and
+ * remembered here — later batches skip them instead of 404ing every time.
+ *
+ * Entries carry an expiry ({@link MISSING_FEED_MEMO_TTL_MS}); an
+ * endpoint-level fault never lands here at all (see {@link
+ * HermesEndpointRejectedAllFeedsError}).
+ */
+const missingFeedIdsByEndpoint = new Map();
+/**
+ * Thrown when discovery concludes that an endpoint rejects EVERY requested
+ * feed id without a catalog vouching for that verdict. `instanceof`-able
+ * (mirrors `FetchPolicyError` / {@link OracleFeeSourceUnavailableError}).
+ *
+ * "All of them are missing" is the signature of an endpoint/credential fault —
+ * a wrong base path (the Pyth Pro `/hermes` prefix dropped), a changed route,
+ * a revoked or downgraded entitlement — not of N individually-absent feeds.
+ * Memoizing it would convert a loud, fixable misconfiguration into a silent
+ * permanent one: every id marked missing ⇒ `fetchPriceFeedsUpdateData` returns
+ * `[]` ⇒ `buildPythPriceUpdateCalls` throws "Hermes returned empty results",
+ * blaming Hermes for having no data, for the rest of the process's life. So
+ * this case writes NOTHING to the memo and throws instead; the next call
+ * re-probes and recovers on its own once the endpoint does.
+ *
+ * The message keeps the `Hermes price fetch failed: <status>` prefix on its
+ * first line — the documented contract downstream consumers string-match (see
+ * {@link fetchPriceFeedsUpdateData} and the e2e transient detector).
+ */
+export class HermesEndpointRejectedAllFeedsError extends Error {
+    endpoint;
+    requestedCount;
+    constructor(endpoint, requestedCount, catalogState) {
+        super(`Hermes price fetch failed: 404 — endpoint rejected ALL ${requestedCount} requested feed id(s) ` +
+            `and its feed catalog was ${catalogState}, so nothing vouches for those feeds being ` +
+            `individually absent. Treating this as an endpoint/credential fault (wrong base path — ` +
+            `e.g. a dropped Pyth Pro '/hermes' prefix — changed route, or revoked entitlement) rather ` +
+            `than caching every feed as missing. Endpoint: ${endpoint}`);
+        this.endpoint = endpoint;
+        this.requestedCount = requestedCount;
+        this.name = "HermesEndpointRejectedAllFeedsError";
+    }
+}
+/**
+ * Memo key for `(endpoint, credential)` — the same trailing-slash trim
+ * {@link joinEndpointPath} applies to the request URL (shared helper, so the
+ * two can't drift), plus the apiKey: "feed X is missing" is a property of the
+ * endpoint AND the credential (Pyth Pro entitlements are per-key), so two
+ * clients in one process with different keys must not cross-poison each
+ * other's memo. Without the trim, two consumers spelling the same endpoint
+ * differently (`…/hermes` vs `…/hermes/`) would fragment the memo and re-run
+ * the whole 404 discovery despite one of them having already paid for it.
+ */
+function memoKey(endpoint, apiKey) {
+    return `${trimTrailingSlashes(endpoint)}\u0000${apiKey ?? ""}`;
+}
+function recordMissingFeeds(endpoint, feedIds, apiKey) {
+    const key = memoKey(endpoint, apiKey);
+    let entries = missingFeedIdsByEndpoint.get(key);
+    if (!entries) {
+        entries = new Map();
+        missingFeedIdsByEndpoint.set(key, entries);
+    }
+    const expiresAt = Date.now() + MISSING_FEED_MEMO_TTL_MS;
+    // Key on the bare (0x-stripped, lowercased) form — the SAME normalization the
+    // catalog comparison and the in-flight latch use — so a feed can't fragment
+    // the memo across `0xAB`/`ab` spellings and slip back through as unfiltered.
+    for (const feedId of feedIds)
+        entries.set(bareFeedId(feedId), expiresAt);
+}
+/**
+ * The subset of `feedIds` this `endpoint` is known to serve — i.e. minus any
+ * discovered to be absent within the last {@link MISSING_FEED_MEMO_TTL_MS}
+ * (see {@link fetchPriceFeedsUpdateData}). Callers building a
+ * `{ updates, feedIds }` payload use this to keep `feedIds` aligned with the
+ * feeds the fetch actually returned data for, so `buildPythPriceUpdateCalls`
+ * (one moveCall per feed id) never references a feed the accumulator blob
+ * doesn't cover.
+ *
+ * Expired entries are pruned here rather than on a timer: the memo is only
+ * ever consulted through this function, so a lazy sweep is both sufficient and
+ * free of a dangling interval in a library.
+ */
+export function endpointSupportedFeedIds(endpoint, feedIds, apiKey) {
+    const key = memoKey(endpoint, apiKey);
+    const entries = missingFeedIdsByEndpoint.get(key);
+    if (!entries)
+        return feedIds;
+    const now = Date.now();
+    for (const [id, expiresAt] of entries) {
+        if (expiresAt <= now)
+            entries.delete(id);
+    }
+    if (entries.size === 0) {
+        missingFeedIdsByEndpoint.delete(key);
+        return feedIds;
+    }
+    return feedIds.filter((id) => !entries.has(bareFeedId(id)));
+}
+/**
+ * Discovery runs currently in flight, keyed by `(endpoint, credential,
+ * requested id set)`. A cold memo plus two concurrent tx-builds asking the
+ * same question ran two full independent discoveries — duplicate catalog reads
+ * (or duplicate bisection probe trees) on the money path, for one answer. The
+ * second caller now joins the first run's promise: each still gets its own
+ * survivor data, but they share the one discovery behind it.
+ */
+const inFlightDiscoveries = new Map();
+/** Test-only: forget everything learned about which feeds an endpoint lacks. */
+export function __resetMissingFeedCacheForTest() {
+    missingFeedIdsByEndpoint.clear();
+    inFlightDiscoveries.clear();
+}
+/**
+ * One `GET /v2/price_feeds` — the set of feed ids this endpoint serves for
+ * THIS credential (verified against the Pro compat endpoint: WTI absent from
+ * the catalog AND 404 on latest-price; BTC present AND 200 —
+ * entitlement-filtered per key), normalized to bare lowercase hex.
+ *
+ * Returns `null` when the catalog is unreadable (non-2xx, unparseable, network
+ * error) — the catalog is an optimization, {@link bisectMissingFeeds} remains
+ * the ground truth derived from the money-path fetch itself. Note that "read
+ * fine, served nothing" (`size === 0`) is NOT the same as unreadable: an empty
+ * catalog is an entitlement/route fault in its own right, and the caller
+ * treats it as one.
+ */
+async function readEndpointCatalog(endpoint, opts) {
+    try {
+        const res = await fetchWithPolicy(joinEndpointPath(endpoint, "v2/price_feeds").toString(), {}, { apiKey: opts?.apiKey, ...opts?.fetch });
+        if (!res.ok) {
+            void res.body?.cancel().catch(() => { });
+            return null;
+        }
+        const catalog = (await res.json());
+        if (!Array.isArray(catalog))
+            return null;
+        // Catalog ids come WITHOUT the 0x prefix; callers pass either form.
+        return new Set(catalog.map((f) => bareFeedId(f.id)));
+    }
+    catch {
+        return null;
+    }
+}
+/** Feed ids are compared prefix- and case-insensitively (`0xAB` ≡ `ab`). */
+function bareFeedId(feedId) {
+    return feedId.toLowerCase().replace(/^0x/, "");
+}
+async function rawFetch(endpoint, ids, opts) {
+    // joinEndpointPath preserves the endpoint's own base path — `new URL`
+    // with a leading-slash path would discard it (the Pyth Pro `/hermes`
+    // prefix → 404 on EVERY feed); see its doc in update-fetch.ts.
+    const url = joinEndpointPath(endpoint, "v2/updates/price/latest");
+    ids.forEach((id) => url.searchParams.append("ids[]", id));
+    return fetchWithPolicy(url.toString(), {}, { apiKey: opts?.apiKey, ...opts?.fetch });
+}
+/**
+ * Bisect `ids` down to the individual ones this endpoint 404s on — the
+ * response body isn't readable, so a single id that still 404s IS the unknown
+ * one. Data is discarded; this only *reports* (the caller decides whether the
+ * verdict is trustworthy enough to memoize). A non-404 (the subset is fine) or
+ * a network error stops that branch and contributes nothing.
+ *
+ * `known404: true` skips the root probe — the caller has already watched this
+ * exact batch 404, so re-fetching it would only re-learn a fact in hand (a
+ * wasted round trip on the money path during cold discovery). Recursive
+ * half-calls always probe: their status is genuinely unknown.
+ */
+async function bisectMissingFeeds(endpoint, ids, opts, known404 = false) {
+    if (ids.length === 0)
+        return new Set();
+    if (!known404) {
+        let res;
+        try {
+            res = await rawFetch(endpoint, ids, opts);
+        }
+        catch {
+            return new Set(); // transient/network failure — can't classify
+        }
+        void res.body?.cancel().catch(() => { });
+        if (res.status !== 404)
+            return new Set(); // this subset is serveable
+    }
+    if (ids.length === 1)
+        return new Set([ids[0]]);
+    const mid = Math.floor(ids.length / 2);
+    const [lo, hi] = await Promise.all([
+        bisectMissingFeeds(endpoint, ids.slice(0, mid), opts),
+        bisectMissingFeeds(endpoint, ids.slice(mid), opts),
+    ]);
+    return new Set([...lo, ...hi]);
+}
+/**
+ * Work out which of `ids` this endpoint lacks and memoize exactly those.
+ *
+ * Catalog first: one `GET /v2/price_feeds` answers for the whole batch, so a
+ * confirmed 404 costs one extra request instead of O(log n) bisection probes.
+ * The catalog is also the only *authoritative* source here — it says what the
+ * endpoint DOES serve, which is what separates "these two feeds are absent"
+ * from "this endpoint is serving nothing to me". Bisection can only observe
+ * 404s, and a wrong base path 404s identically to an unknown feed.
+ *
+ * Hence the guard: a verdict of "every requested id is missing" is only
+ * committed when a non-empty catalog vouches for it. Otherwise nothing is
+ * written and {@link HermesEndpointRejectedAllFeedsError} is thrown — see its
+ * docblock for why silently memoizing that case is worse than failing.
+ *
+ * Concurrent callers asking the identical question share ONE run (see {@link
+ * inFlightDiscoveries}); the latch is released on failure too, so a blip never
+ * pins later callers to a stale outcome.
+ *
+ * @throws HermesEndpointRejectedAllFeedsError on an endpoint-level rejection.
+ */
+function discoverMissingFeeds(endpoint, ids, opts, known404 = false) {
+    // Same endpoint + credential + requested set ⇒ same answer; anything else
+    // is a different question and runs on its own.
+    const key = `${memoKey(endpoint, opts?.apiKey)}${ids.map(bareFeedId).sort().join(",")}`;
+    const inFlight = inFlightDiscoveries.get(key);
+    if (inFlight)
+        return inFlight;
+    const run = runDiscovery(endpoint, ids, opts, known404).finally(() => {
+        inFlightDiscoveries.delete(key);
+    });
+    inFlightDiscoveries.set(key, run);
+    return run;
+}
+async function runDiscovery(endpoint, ids, opts, known404 = false) {
+    if (ids.length === 0)
+        return;
+    if (!known404) {
+        let res;
+        try {
+            res = await rawFetch(endpoint, ids, opts);
+        }
+        catch {
+            return; // transient/network failure — can't classify; leave the memo untouched
+        }
+        void res.body?.cancel().catch(() => { });
+        if (res.status !== 404)
+            return; // this batch is serveable — nothing to record
+    }
+    const catalog = await readEndpointCatalog(endpoint, opts);
+    if (catalog !== null && catalog.size === 0) {
+        // Read fine, serves nothing: an entitlement/route fault, not N absent feeds.
+        throw new HermesEndpointRejectedAllFeedsError(endpoint, ids.length, "empty");
+    }
+    const missing = catalog !== null
+        ? new Set(ids.filter((id) => !catalog.has(bareFeedId(id))))
+        : await bisectMissingFeeds(endpoint, ids, opts, true);
+    if (missing.size === 0)
+        return;
+    if (catalog === null && missing.size === ids.length) {
+        throw new HermesEndpointRejectedAllFeedsError(endpoint, ids.length, "unreadable");
+    }
+    recordMissingFeeds(endpoint, missing, opts?.apiKey);
+}
+/**
+ * Discovery-only entry for consumers that fetch Hermes THEMSELVES (e.g. a
+ * parsed latest-price reader) and just observed a whole-batch 404: resolves
+ * which ids the endpoint lacks, memoizes them (see {@link
+ * endpointSupportedFeedIds}), fetches NO survivor data. Without this, such a
+ * consumer's only way to populate the memo was calling {@link
+ * fetchPriceFeedsUpdateData} and discarding its accumulator blob — two full
+ * redundant transfers per cold discovery.
+ *
+ * @throws HermesEndpointRejectedAllFeedsError when the rejection looks
+ * endpoint-wide rather than per-feed — the caller's own 404 is then a
+ * misconfiguration to surface, not a set of feeds to quietly drop.
+ */
+export function probeMissingFeeds(endpoint, ids, opts) {
+    return discoverMissingFeeds(endpoint, ids, opts, true);
+}
 export async function fetchPriceFeedsUpdateData(endpoint, priceIds, opts) {
-    if (priceIds.length === 0)
+    // Skip feeds this endpoint has already told us it doesn't have.
+    const ids = endpointSupportedFeedIds(endpoint, priceIds, opts?.apiKey);
+    if (ids.length === 0)
         return [];
-    const url = new URL("/v2/updates/price/latest", endpoint);
-    priceIds.forEach((id) => url.searchParams.append("ids[]", id));
     let res;
     try {
-        res = await fetchWithPolicy(url.toString(), {}, { apiKey: opts?.apiKey, ...opts?.fetch });
+        res = await rawFetch(endpoint, ids, opts);
     }
     catch (err) {
-        // A retryable status (429/5xx) that never recovered surfaces as a
-        // FetchPolicyError with `status` set — reformat it into this function's
-        // own message shape so callers (and the e2e transient-failure detector,
-        // which keys off "Hermes price fetch failed") see the same text whether
-        // the failure was retried or not. A network-level exhaustion (no status)
-        // has no domain-specific reframing to add — propagate it as-is.
-        if (err instanceof FetchPolicyError && err.status !== undefined) {
-            const body = err.bodySnippet ? ` ${err.bodySnippet}` : "";
-            throw new Error(`Hermes price fetch failed: ${err.status}${body} (retries exhausted after ${err.attempts} attempts)`, { cause: err });
+        rethrowExhaustedFetch(err, (e) => `Hermes price fetch failed: ${e.status}${e.bodySnippet ? ` ${e.bodySnippet}` : ""}`);
+    }
+    if (!res.ok) {
+        // Drain the body ONCE, here. A `Response` body can only be read once, and
+        // the 404 branch below finishes with it before the throw is reached — so
+        // reading it inside the throw surfaced `TypeError: Body is unusable`
+        // instead of this function's documented message whenever a 404 fell
+        // through. Reading up front also releases the connection on every path.
+        const body = await res.text().catch(() => "");
+        // Pyth 404s the ENTIRE batch if ANY id is unknown to the endpoint (a Core
+        // feed absent from the Pyth Pro compat endpoint). This is on the money
+        // path of every order/position/WLP tx-build, so instead of failing the
+        // whole refresh: discover the unknown ids (catalog, else bisection — the
+        // body isn't reliably delivered), memoize them, and re-fetch the survivors
+        // as ONE clean batch (a single combined accumulator blob, which
+        // buildPythPriceUpdateCalls requires). A genuinely-absent ticker just
+        // isn't in the payload — its on-chain aggregate abstains/aborts, which is
+        // correct. Steady state: once discovered, survivors are filtered up front
+        // and this never runs. A rejection that looks endpoint-wide instead of
+        // per-feed throws out of here (HermesEndpointRejectedAllFeedsError).
+        if (res.status === 404) {
+            // known404: this exact batch just 404'd above — skip the root re-probe.
+            await discoverMissingFeeds(endpoint, ids, opts, true);
+            const survivors = endpointSupportedFeedIds(endpoint, ids, opts?.apiKey);
+            if (survivors.length === 0)
+                return [];
+            // survivors < ids ⇒ we removed the offender(s); re-fetch cleanly. Equal
+            // ⇒ nothing was recorded (a 404 that wasn't a missing-feed rejection) —
+            // surface it rather than loop.
+            if (survivors.length < ids.length) {
+                return fetchPriceFeedsUpdateData(endpoint, survivors, opts);
+            }
         }
-        throw err;
+        throw new Error(`Hermes price fetch failed: ${res.status}${body ? ` ${body}` : ""}`);
     }
-    if (!res.ok)
-        throw new Error(`Hermes price fetch failed: ${res.status} ${await res.text()}`);
     const json = (await res.json());
     const data = json.binary?.data;
     if (!Array.isArray(data) || data.length === 0) {
@@ -278,9 +581,18 @@ export async function buildPythPriceUpdateCalls(tx, host, updates, feedIds, opts
 }
 /** All-in-one: fetch from Hermes, append update calls. Returns PriceInfoObject IDs. */
 export async function updatePythPrices(tx, host, feedIds, opts) {
-    const updates = await fetchPriceFeedsUpdateData(host.pyth.hermes_endpoint, feedIds, {
+    // `host.pyth` is the Pyth Core infra (fixed per network) plus the caller's
+    // api_key/fetch — endpoint, credential and policy all come from it.
+    const endpoint = host.pyth.hermes_endpoint;
+    const updates = await fetchPriceFeedsUpdateData(endpoint, feedIds, {
         apiKey: host.pyth.api_key,
         fetch: host.pyth.fetch,
     });
-    return buildPythPriceUpdateCalls(tx, host, updates, feedIds, opts);
+    // Align feedIds with the feeds the endpoint actually served — the fetch drops
+    // (and memoizes) any it lacks, and `buildPythPriceUpdateCalls` emits one
+    // update call per feedId, so a dropped feed would reference a PriceInfoObject
+    // the accumulator blob doesn't cover (invalid PTB / on-chain abort). Mirrors
+    // `PythCoreRule.fetchUpdateData`.
+    const servedFeedIds = endpointSupportedFeedIds(endpoint, feedIds, host.pyth.api_key);
+    return buildPythPriceUpdateCalls(tx, host, updates, servedFeedIds, opts);
 }

package/dist/src/oracle/rule-registry.d.ts

@@ -3,13 +3,17 @@
  * `PriceUpdateRule` implementation. `refreshOraclePrices` (`aggregate.ts`) is
  * the only production caller; this is the one place `OracleSource` values are
  * wired to a rule instance. Selection is driven purely by the value passed in
- * (ultimately `OracleHost.oracleSource`, a client create option) — never by a
- * config JSON `enabled` flag and never by `process.env`.
+ * (ultimately `OracleHost.oracleSource`, the `oracleSource` client create
+ * option) — never by a config JSON `enabled` flag and never by `process.env`.
  *
- * Both sources are registered: `pyth_rule` (`PythCoreRule`, Hermes VAA) and
- * `pyth_lazer_rule` (`PythLazerRule`, Lazer signed updates). Resolving a
- * source with no registered rule throws a clear `OracleSourceNotImplemented`
- * error instead of silently falling back to Pyth Core.
+ * Each source is self-contained: it owns its own infra + config and does NOT
+ * back-stop any other source. Both are registered: `pyth_rule` (`PythCoreRule`,
+ * Hermes VAA) and `pyth_lazer_rule` (`PythLazerRule`, Lazer signed updates).
+ * Resolving a source with no registered rule throws a clear
+ * `OracleSourceNotImplemented` error. There is deliberately no cross-source
+ * fallback and no client-creation config guard: selecting a source whose feeds
+ * are absent is not an error at init — it surfaces at tx-build time for the
+ * specific tickers that source can't serve (see `refreshOraclePrices`).
  */
 import type { OracleSource, PriceUpdateRule } from "./price-update-rule.ts";
 /**

package/dist/src/oracle/rule-registry.js

@@ -3,13 +3,17 @@
  * `PriceUpdateRule` implementation. `refreshOraclePrices` (`aggregate.ts`) is
  * the only production caller; this is the one place `OracleSource` values are
  * wired to a rule instance. Selection is driven purely by the value passed in
- * (ultimately `OracleHost.oracleSource`, a client create option) — never by a
- * config JSON `enabled` flag and never by `process.env`.
+ * (ultimately `OracleHost.oracleSource`, the `oracleSource` client create
+ * option) — never by a config JSON `enabled` flag and never by `process.env`.
  *
- * Both sources are registered: `pyth_rule` (`PythCoreRule`, Hermes VAA) and
- * `pyth_lazer_rule` (`PythLazerRule`, Lazer signed updates). Resolving a
- * source with no registered rule throws a clear `OracleSourceNotImplemented`
- * error instead of silently falling back to Pyth Core.
+ * Each source is self-contained: it owns its own infra + config and does NOT
+ * back-stop any other source. Both are registered: `pyth_rule` (`PythCoreRule`,
+ * Hermes VAA) and `pyth_lazer_rule` (`PythLazerRule`, Lazer signed updates).
+ * Resolving a source with no registered rule throws a clear
+ * `OracleSourceNotImplemented` error. There is deliberately no cross-source
+ * fallback and no client-creation config guard: selecting a source whose feeds
+ * are absent is not an error at init — it surfaces at tx-build time for the
+ * specific tickers that source can't serve (see `refreshOraclePrices`).
  */
 import { PythCoreRule } from "./rules/pyth-core-rule.js";
 import { PythLazerRule } from "./rules/pyth-lazer-rule.js";

package/dist/src/oracle/rules/pyth-core-rule.js

@@ -7,7 +7,7 @@
  * changes vs `../pyth.ts` / `./pyth-rule.ts`.
  */
 import { assertRuleUpdateData, } from "../price-update-rule.js";
-import { buildPythPriceUpdateCalls, fetchPriceFeedsUpdateData } from "../pyth.js";
+import { buildPythPriceUpdateCalls, endpointSupportedFeedIds, fetchPriceFeedsUpdateData, } from "../pyth.js";
 /**
  * Shape check ONLY — the `kind` discriminant is checked separately by the
  * caller before this runs, since a same-shaped payload from a different rule
@@ -33,12 +33,27 @@ export const PythCoreRule = {
     async fetchUpdateData(host, tickers) {
         if (tickers.length === 0)
             return null;
+        // `host.pyth` is this source's own infra — the fixed per-network Core
+        // Pyth block plus the caller's api_key/fetch. Endpoint, credential and
+        // retry/timeout policy all come from it.
+        const endpoint = host.pyth.hermes_endpoint;
         const feedIds = tickers.map((ticker) => host.getPythFeed(ticker).feed_id);
-        const updates = await fetchPriceFeedsUpdateData(host.pyth.hermes_endpoint, feedIds, {
+        const updates = await fetchPriceFeedsUpdateData(endpoint, feedIds, {
             apiKey: host.pyth.api_key,
             fetch: host.pyth.fetch,
         });
-        return { kind: "pyth_rule", payload: { updates, feedIds } };
+        // `updates` covers only the feeds this endpoint actually served — the fetch
+        // drops (and memoizes) any it lacks, e.g. Core feeds absent from Pyth Pro
+        // (WTIUSD/BRENTUSD). Align `feedIds` with them: buildPythPriceUpdateCalls
+        // emits one moveCall per feedId and must not reference a feed the
+        // accumulator blob doesn't cover.
+        return {
+            kind: "pyth_rule",
+            payload: {
+                updates,
+                feedIds: endpointSupportedFeedIds(endpoint, feedIds, host.pyth.api_key),
+            },
+        };
     },
     /**
      * Subsets a (typically whole-universe) payload from {@link fetchUpdateData}

package/dist/src/oracle/rules/pyth-lazer-rule.d.ts

@@ -3,7 +3,7 @@
  * updates, plus `feedLazerRule`, the collector-feed leg `aggregateTicker`
  * appends per lazer-routed ticker. Fetches one `leEcdsa` payload for all
  * requested integer feed ids from the Lazer HTTP API (Bearer-authenticated
- * via `config.pyth.api_key`), verifies it ONCE on-chain via
+ * via the `pythApiKey` create option), verifies it ONCE on-chain via
  * `pyth_lazer::parse_and_verify_le_ecdsa_update`, and hands the resulting
  * `Update` PTB value back through a `RuleUpdateHandle` for the feed calls.
  */
@@ -19,11 +19,11 @@ export interface PythLazerUpdatePayload {
 }
 /**
  * Thrown by {@link PythLazerRule.fetchUpdateData} when `pyth_lazer_rule` is
- * deployed in config but no `pyth.api_key` is set — the Lazer HTTP API
- * requires a Bearer token and the SDK never reads `process.env` to find one.
- * `instanceof`-able (mirrors `OracleFeeSourceUnavailableError` in `pyth.ts`)
- * so a consumer can branch on the failure type directly instead of
- * string-matching `error.message`.
+ * deployed in config but no `pythApiKey` was supplied at client init — the
+ * Lazer HTTP API requires a Bearer token and the SDK never reads
+ * `process.env` to find one. `instanceof`-able (mirrors
+ * `OracleFeeSourceUnavailableError` in `pyth.ts`) so a consumer can branch on
+ * the failure type directly instead of string-matching `error.message`.
  */
 export declare class LazerApiKeyMissingError extends Error {
     constructor();

package/dist/src/oracle/rules/pyth-lazer-rule.js

@@ -3,14 +3,14 @@
  * updates, plus `feedLazerRule`, the collector-feed leg `aggregateTicker`
  * appends per lazer-routed ticker. Fetches one `leEcdsa` payload for all
  * requested integer feed ids from the Lazer HTTP API (Bearer-authenticated
- * via `config.pyth.api_key`), verifies it ONCE on-chain via
+ * via the `pythApiKey` create option), verifies it ONCE on-chain via
  * `pyth_lazer::parse_and_verify_le_ecdsa_update`, and hands the resulting
  * `Update` PTB value back through a `RuleUpdateHandle` for the feed calls.
  */
 import { fromHex } from "@mysten/bcs";
 import { LAZER_DEFAULTS } from "../config.js";
 import { assertRuleUpdateData, } from "../price-update-rule.js";
-import { FetchPolicyError, fetchWithPolicy } from "../update-fetch.js";
+import { fetchWithPolicy, joinEndpointPath, rethrowExhaustedFetch } from "../update-fetch.js";
 /**
  * Signed-update request pins, mirroring what the on-chain rule consumes:
  * - `properties` — `price` + `exponent` are REQUIRED by
@@ -18,10 +18,17 @@ import { FetchPolicyError, fetchWithPolicy } from "../update-fetch.js";
  *   `confidence` is optional on-chain but requested so the rule's
  *   fail-closed confidence gate actually engages (a payload without
  *   confidence passes the gate unchecked).
- * - `channel` — `real_time`: the deployed rule binds the v1 Lazer API, whose
- *   `channel::from_u8` aborts on the 1000ms fixed-rate channel; real_time /
- *   50ms / 200ms are the safe subscriptions, and for an on-demand pull
- *   real_time is the freshest.
+ * - `channel` — `fixed_rate@200ms`, NOT `real_time`: Lazer rejects a request
+ *   whose channel is faster than ANY requested feed's `min_channel`, and it
+ *   rejects the WHOLE batch (`400 Feeds do not support channel …`). Only the
+ *   majors (BTC/ETH/SOL/USDC/DOGE/XRP/BNB/HYPE + EUR/JPY FX) publish
+ *   `real_time`; the other 19 of the 29 configured feeds — including SUIUSD
+ *   and every xStock — are `min_channel: fixed_rate@200ms` (Lazer symbol
+ *   registry, verified 2026-07-22: the same 29-feed batch 400s at
+ *   `real_time`/`50ms` and serves 200 with the leEcdsa blob at `200ms`).
+ *   200ms is the fastest channel every configured feed supports, and the
+ *   deployed rule accepts it: the v1 on-chain `channel::from_u8` aborts only
+ *   on the 1000ms fixed-rate channel (real_time / 50ms / 200ms are safe).
  * - `formats: leEcdsa` + `jsonBinaryEncoding: hex` — the Sui verifier takes
  *   the `leEcdsa` framing; hex matches `fromHex` below.
  */
@@ -29,7 +36,7 @@ const LAZER_LATEST_PRICE_REQUEST = {
     properties: ["price", "exponent", "confidence"],
     formats: ["leEcdsa"],
     jsonBinaryEncoding: "hex",
-    channel: "real_time",
+    channel: "fixed_rate@200ms",
 };
 /**
  * Shape check ONLY — the `kind` discriminant is checked separately by the
@@ -44,16 +51,16 @@ function isPythLazerUpdatePayloadShape(payload) {
 }
 /**
  * Thrown by {@link PythLazerRule.fetchUpdateData} when `pyth_lazer_rule` is
- * deployed in config but no `pyth.api_key` is set — the Lazer HTTP API
- * requires a Bearer token and the SDK never reads `process.env` to find one.
- * `instanceof`-able (mirrors `OracleFeeSourceUnavailableError` in `pyth.ts`)
- * so a consumer can branch on the failure type directly instead of
- * string-matching `error.message`.
+ * deployed in config but no `pythApiKey` was supplied at client init — the
+ * Lazer HTTP API requires a Bearer token and the SDK never reads
+ * `process.env` to find one. `instanceof`-able (mirrors
+ * `OracleFeeSourceUnavailableError` in `pyth.ts`) so a consumer can branch on
+ * the failure type directly instead of string-matching `error.message`.
  */
 export class LazerApiKeyMissingError extends Error {
     constructor() {
         super("LazerApiKeyMissing: pyth_lazer_rule requires a Pyth Lazer access token — " +
-            "set `pyth.api_key` in the client config (the SDK never reads process.env)");
+            "pass `pythApiKey` when creating the client (the SDK never reads process.env)");
         this.name = "LazerApiKeyMissingError";
     }
 }
@@ -72,7 +79,11 @@ function requireLazerPackage(host) {
  * both oracle sources fail the same way under upstream degradation.
  */
 async function fetchLazerSignedUpdate(endpoint, apiKey, feedIds, fetchOpts) {
-    const url = new URL("/v1/latest_price", endpoint);
+    // joinEndpointPath preserves any base path on the endpoint — the same
+    // leading-slash `new URL` footgun that 404'd every feed on the Pyth Pro
+    // Hermes endpoint (see update-fetch.ts). Defensive here: the default
+    // Lazer endpoint has no base path, but a config override may.
+    const url = joinEndpointPath(endpoint, "v1/latest_price");
     let res;
     try {
         res = await fetchWithPolicy(url.toString(), {
@@ -82,15 +93,7 @@ async function fetchLazerSignedUpdate(endpoint, apiKey, feedIds, fetchOpts) {
         }, { apiKey, ...fetchOpts });
     }
     catch (err) {
-        // Mirrors fetchPriceFeedsUpdateData's reframing: a retryable status that
-        // never recovered carries `status` on the FetchPolicyError — reformat
-        // into this function's own message shape; a network-level exhaustion
-        // (no status) propagates as-is.
-        if (err instanceof FetchPolicyError && err.status !== undefined) {
-            const body = err.bodySnippet ? ` ${err.bodySnippet}` : "";
-            throw new Error(`Lazer price fetch failed: ${err.status}${body} (retries exhausted after ${err.attempts} attempts)`, { cause: err });
-        }
-        throw err;
+        rethrowExhaustedFetch(err, (e) => `Lazer price fetch failed: ${e.status}${e.bodySnippet ? ` ${e.bodySnippet}` : ""}`);
     }
     if (!res.ok)
         throw new Error(`Lazer price fetch failed: ${res.status} ${await res.text()}`);

package/dist/src/oracle/rules/pyth-rule.js

@@ -13,6 +13,11 @@ export function feedPythRule(tx, host, collector, priceInfoObjectId) {
         arguments: {
             collector,
             config: tx.object(host.config.packages.pyth_rule.config),
+            // The deployed pyth_rule package is compiled against the Core pyth
+            // dependency, so its `&PythState` parameter is the Core-package-qualified
+            // type and `host.pyth` (the fixed per-network Core infra) is always the
+            // right state to pass. The config's price_info_object entries are Core
+            // objects to match.
             pythState: tx.object(host.pyth.state_id),
             pythPriceInfo: tx.object(priceInfoObjectId),
         },