@waterx/sdk 4.0.0 → 4.1.0

package/dist/src/oracle/aggregate.d.ts

@@ -25,6 +25,7 @@ import type { Transaction, TransactionArgument } from "@mysten/sui/transactions"
 import type { OracleHost } from "./host.ts";
 import type { OracleSource, PriceUpdateRule, UpdateDataProvider } from "./price-update-rule.ts";
 import { type OracleFeeSource, type PythCache } from "./pyth.ts";
+import { type WaterxSignedEnvelope } from "./rules/waterx-rule.ts";
 /**
  * Aggregate one ticker's price into the shared `Oracle`: build a collector, feed
  * every rule the ticker is configured for, then `aggregate`.
@@ -54,6 +55,7 @@ export declare function aggregateTicker(tx: Transaction, host: OracleHost, args:
     ticker: string;
     priceInfoObjectId?: string;
     lazerUpdate?: TransactionArgument;
+    waterxEnvelope?: WaterxSignedEnvelope;
 }): void;
 /**
  * Thin wrapper over {@link aggregateTicker} for a Pyth-fed ticker. Kept for
@@ -83,28 +85,26 @@ export declare function aggregateTickerWithConstant(tx: Transaction, host: Oracl
  * enabled, Constant when it's a constant ticker).
  *
  * Before that, the on-chain price *update* leg is routed by `host.oracleSource`
- * (see `rule-registry.ts`): the selected rule serves every ticker in its
- * `supportedTickers(host)`; tickers it doesn't cover fall back to `pyth_rule`
- * (`PythCoreRule`) when THEY support it — so when `oracleSource` IS `'pyth_rule'`
- * there is exactly one group, identical to the pre-routing behavior. A ticker
- * supported by neither is simply skipped from this leg (no fetch/build call for
- * it) — the same way today's non-pyth tickers (e.g. constant-only) always were;
- * it still gets aggregated below via whichever rule {@link aggregateTicker} finds.
+ * (see `rule-registry.ts`): the ONE selected source serves every ticker in its
+ * `supportedTickers(host)`. There is **no cross-source fallback** — a requested
+ * ticker the selected source does not serve, and that is not a constant-only
+ * ticker (which needs no price-update leg), fails the build immediately with a
+ * clear error naming the ticker and source. That is the deliberate "fail the
+ * tx-build, don't silently reroute" contract: a wrong-but-present feed id is
+ * NOT validated here (it surfaces on-chain at dry-run); a MISSING feed for the
+ * selected source is caught here. When the selected source's feed exists but is
+ * wrong, this function does nothing special — the on-chain aggregate aborts at
+ * dry-run, which is correct.
  *
- * Each group's fetch + build runs against its own rule, which guarantees
- * per-rule PTB atomicity (no mixed-generation payload within one rule's calls).
- * When `oracleSource` isn't `'pyth_rule'`, one PTB may legitimately carry BOTH a
- * non-Pyth-Core block (selected group) and a Pyth Core block (fallback group) —
- * each verifies against its own contract objects, so that's fine. A fee-source
- * pre-check runs first, across every group's `requiresFeeSource` — BEFORE any
- * off-chain fetch or PTB mutation — so a fee-charging group with no
- * `opts.feeSource` throws `OracleFeeSourceUnavailable` with zero wasted
- * network calls and zero stray moveCalls, even in a mixed shape (e.g. a
- * fee-free Lazer group ordered ahead of a Pyth Core fallback group). Only once
- * that check passes do all groups' off-chain fetches run concurrently
- * (`Promise.all`) and complete before any PTB mutation; on-chain reads inside
- * `buildUpdateCalls` can still fail mid-append for other reasons — callers
- * discard the tx on any throw.
+ * The selected source's fetch + build runs against its own infra, guaranteeing
+ * per-rule PTB atomicity. A fee-source pre-check runs first (the source's
+ * `requiresFeeSource`) BEFORE any off-chain fetch or PTB mutation — so a
+ * fee-charging source with no `opts.feeSource` throws
+ * `OracleFeeSourceUnavailable` with zero wasted network calls and zero stray
+ * moveCalls. Only once that check passes does the off-chain fetch run and
+ * complete before any PTB mutation; on-chain reads inside `buildUpdateCalls`
+ * can still fail mid-append for other reasons — callers discard the tx on any
+ * throw.
  *
  * **Collector-feed leg is rule-aware:** a lazer-served group's
  * `buildUpdateCalls` returns the verified `Update` PTB value

package/dist/src/oracle/aggregate.js

@@ -28,6 +28,7 @@ import { feedConstantRule } from "./rules/constant-rule.js";
 import { feedLazerRule } from "./rules/pyth-lazer-rule.js";
 import { feedPythRule } from "./rules/pyth-rule.js";
 import { maybeFeedSupra } from "./rules/supra-rule.js";
+import { feedWaterxRule, waterxEnvelopeOf, } from "./rules/waterx-rule.js";
 /**
  * Resolve one group's off-chain update payload for {@link refreshOraclePrices}:
  * try `provider.get(source, tickers)` first (when a provider is configured),
@@ -110,6 +111,14 @@ export function aggregateTicker(tx, host, args) {
         feedLazerRule(tx, host, collector, args.lazerUpdate);
         fed = true;
     }
+    if (args.waterxEnvelope !== undefined) {
+        // waterx_rule::collect_batch_latest verifies the batch signature and feeds
+        // this collector's symbol from the batch. If the ticker's aggregator does
+        // not (yet) weight `WaterxRule`, the contribution is silently dropped
+        // on-chain — feeding ahead of the weight migration is harmless.
+        feedWaterxRule(tx, host, collector, args.waterxEnvelope);
+        fed = true;
+    }
     if (fed) {
         // Supra rides on the same collector when enabled (abstains on-chain otherwise).
         maybeFeedSupra(tx, host, collector);
@@ -159,28 +168,26 @@ export function aggregateTickerWithConstant(tx, host, args) {
  * enabled, Constant when it's a constant ticker).
  *
  * Before that, the on-chain price *update* leg is routed by `host.oracleSource`
- * (see `rule-registry.ts`): the selected rule serves every ticker in its
- * `supportedTickers(host)`; tickers it doesn't cover fall back to `pyth_rule`
- * (`PythCoreRule`) when THEY support it — so when `oracleSource` IS `'pyth_rule'`
- * there is exactly one group, identical to the pre-routing behavior. A ticker
- * supported by neither is simply skipped from this leg (no fetch/build call for
- * it) — the same way today's non-pyth tickers (e.g. constant-only) always were;
- * it still gets aggregated below via whichever rule {@link aggregateTicker} finds.
+ * (see `rule-registry.ts`): the ONE selected source serves every ticker in its
+ * `supportedTickers(host)`. There is **no cross-source fallback** — a requested
+ * ticker the selected source does not serve, and that is not a constant-only
+ * ticker (which needs no price-update leg), fails the build immediately with a
+ * clear error naming the ticker and source. That is the deliberate "fail the
+ * tx-build, don't silently reroute" contract: a wrong-but-present feed id is
+ * NOT validated here (it surfaces on-chain at dry-run); a MISSING feed for the
+ * selected source is caught here. When the selected source's feed exists but is
+ * wrong, this function does nothing special — the on-chain aggregate aborts at
+ * dry-run, which is correct.
  *
- * Each group's fetch + build runs against its own rule, which guarantees
- * per-rule PTB atomicity (no mixed-generation payload within one rule's calls).
- * When `oracleSource` isn't `'pyth_rule'`, one PTB may legitimately carry BOTH a
- * non-Pyth-Core block (selected group) and a Pyth Core block (fallback group) —
- * each verifies against its own contract objects, so that's fine. A fee-source
- * pre-check runs first, across every group's `requiresFeeSource` — BEFORE any
- * off-chain fetch or PTB mutation — so a fee-charging group with no
- * `opts.feeSource` throws `OracleFeeSourceUnavailable` with zero wasted
- * network calls and zero stray moveCalls, even in a mixed shape (e.g. a
- * fee-free Lazer group ordered ahead of a Pyth Core fallback group). Only once
- * that check passes do all groups' off-chain fetches run concurrently
- * (`Promise.all`) and complete before any PTB mutation; on-chain reads inside
- * `buildUpdateCalls` can still fail mid-append for other reasons — callers
- * discard the tx on any throw.
+ * The selected source's fetch + build runs against its own infra, guaranteeing
+ * per-rule PTB atomicity. A fee-source pre-check runs first (the source's
+ * `requiresFeeSource`) BEFORE any off-chain fetch or PTB mutation — so a
+ * fee-charging source with no `opts.feeSource` throws
+ * `OracleFeeSourceUnavailable` with zero wasted network calls and zero stray
+ * moveCalls. Only once that check passes does the off-chain fetch run and
+ * complete before any PTB mutation; on-chain reads inside `buildUpdateCalls`
+ * can still fail mid-append for other reasons — callers discard the tx on any
+ * throw.
  *
  * **Collector-feed leg is rule-aware:** a lazer-served group's
  * `buildUpdateCalls` returns the verified `Update` PTB value
@@ -207,69 +214,74 @@ export async function refreshOraclePrices(tx, host, tickers, opts = {}) {
     const pythTickers = tickers.filter((t) => host.config.packages.pyth_rule?.feeds?.[t] !== undefined);
     const priceInfoByTicker = new Map();
     pythTickers.forEach((t) => priceInfoByTicker.set(t, host.getPythFeed(t).price_info_object));
-    // Group tickers for the on-chain update leg: selected rule first, then the
-    // pyth_rule fallback for whatever the selected rule doesn't cover. `source`
-    // is tracked alongside each group (rather than read back off `rule.kind`,
-    // which is typed as the broader PriceUpdateRuleKind) so the provider lookup
-    // below has an OracleSource to key on without a cast.
+    // ONE source, no fallback. The selected source serves the tickers in its
+    // `supportedTickers(host)`; `source` is tracked alongside the group (rather
+    // than read back off `rule.kind`, typed as the broader PriceUpdateRuleKind)
+    // so the provider lookup below has an OracleSource to key on without a cast.
     const selectedRule = resolveOracleRule(host.oracleSource, opts.ruleOverrides);
     const selectedSupported = new Set(selectedRule.supportedTickers(host));
-    const selectedGroup = tickers.filter((t) => selectedSupported.has(t));
-    const groups = [];
-    if (selectedGroup.length > 0) {
-        groups.push({ source: host.oracleSource, rule: selectedRule, tickers: selectedGroup });
+    // Fail the tx-build (NOT client init, NOT a silent reroute) when the selected
+    // source has no feed for a requested ticker that actually needs a price
+    // update. Only a CONSTANT-ONLY ticker is exempt — priced entirely by
+    // `constant_rule`, it needs no update leg from any source. A DUAL-FEED ticker
+    // (constant AND pyth) still needs its Pyth leg refreshed, so `isConstantTicker`
+    // alone must NOT exempt it: under a source that can't serve it, with no
+    // fallback, feeding an unrefreshed Pyth leg would price it stale (or abort on a
+    // missing weighted source). `priceInfoByTicker.has(t)` ⇔ the ticker has a
+    // `pyth_rule.feeds` entry, so `constant && !hasPyth` is exactly constant-only.
+    // This catches a MISSING feed; a present-but-WRONG feed id is deliberately not
+    // validated here (it aborts on-chain at dry-run).
+    const isConstantOnly = (t) => host.isConstantTicker(t) && !priceInfoByTicker.has(t);
+    const unservable = tickers.filter((t) => !selectedSupported.has(t) && !isConstantOnly(t));
+    if (unservable.length > 0) {
+        throw new Error(`oracleSource '${host.oracleSource}' has no feed configured for ticker(s): ` +
+            `${unservable.join(", ")}. Sources are self-contained with no fallback — add ` +
+            `${host.oracleSource} feeds for them, or select a source that serves them.`);
     }
-    if (host.oracleSource !== "pyth_rule") {
-        const fallbackRule = resolveOracleRule("pyth_rule", opts.ruleOverrides);
-        const fallbackSupported = new Set(fallbackRule.supportedTickers(host));
-        const fallbackGroup = tickers.filter((t) => !selectedSupported.has(t) && fallbackSupported.has(t));
-        if (fallbackGroup.length > 0) {
-            groups.push({ source: "pyth_rule", rule: fallbackRule, tickers: fallbackGroup });
-        }
-    }
-    // Fee-source pre-check, hoisted ABOVE both the off-chain fetch below AND
-    // the per-group build loop further down. The condition only consults
-    // `group.rule.requiresFeeSource` — known the moment `groups` is built,
-    // before any fetch or PTB mutation — so this throws with ZERO wasted
-    // network calls and zero PTB commands. A per-call guard inside
-    // `buildPythPriceUpdateCalls` alone would not be early enough: in a mixed
-    // shape (e.g. a lazer-selected `oracleSource` with a `pyth_rule` fallback
-    // group for tickers Lazer doesn't cover), the build loop runs each
-    // group's `buildUpdateCalls` in sequence — a fee-free group ordered ahead
-    // of a fee-charging one would already have appended its verify/feed
-    // moveCalls to the shared `tx` by the time the fee-charging group's own
-    // guard fired, breaking the "throw before any PTB mutation" guarantee.
-    // Checking every group's `requiresFeeSource` up front — before ANY group
-    // fetches or builds — closes that gap, and (unlike a referential check
-    // against a specific rule instance) keeps protecting a future
-    // fee-charging rule or a test double standing in for one.
-    if (!opts.feeSource && groups.some((group) => group.rule.requiresFeeSource)) {
+    const selectedGroup = tickers.filter((t) => selectedSupported.has(t));
+    // Fee-source pre-check, hoisted ABOVE the off-chain fetch and PTB build below.
+    // It consults only `rule.requiresFeeSource` — known before any fetch or PTB
+    // mutation — so a fee-charging source with no `feeSource` throws with ZERO
+    // wasted network calls and zero PTB commands, rather than waiting for
+    // `buildPythPriceUpdateCalls`'s own per-call guard to fire after the off-chain
+    // fetch already ran.
+    if (selectedGroup.length > 0 && !opts.feeSource && selectedRule.requiresFeeSource) {
         throw new OracleFeeSourceUnavailableError();
     }
-    // Fetch every group's off-chain payload concurrently (independent network
-    // calls — no reason to serialize) and let ALL of them settle before the
-    // first PTB mutation below, so a later group's fetch failure can never
-    // leave an earlier group's moveCalls stranded in a caller-owned tx.
-    const groupsWithData = await Promise.all(groups.map(async (group) => ({
-        rule: group.rule,
-        tickers: group.tickers,
-        data: await resolveGroupUpdateData(host, group, opts.updateDataProvider),
-    })));
-    // Verified-`Update` handle per lazer-served ticker (one shared PTB value per
-    // group) — consumed by the collector-feed leg below.
+    // Resolve + build the selected source's update leg. The off-chain fetch
+    // settles before the first PTB mutation, so a fetch failure never strands
+    // moveCalls in a caller-owned tx. Map each lazer-served ticker to the one
+    // verified `Update` PTB value for the collector-feed leg below.
     const lazerUpdateByTicker = new Map();
-    for (const group of groupsWithData) {
-        const handle = (await group.rule.buildUpdateCalls(tx, host, group.data, {
+    // Signed batch envelope per waterx-served ticker. Unlike Lazer's shared PTB
+    // handle, waterx's verify+feed is bundled into `collect_batch_latest` in the
+    // per-ticker feed leg, so its `buildUpdateCalls` emits nothing and the
+    // envelope is carried straight from the group's fetched data.
+    const waterxEnvelopeByTicker = new Map();
+    if (selectedGroup.length > 0) {
+        const group = { source: host.oracleSource, rule: selectedRule, tickers: selectedGroup };
+        const data = await resolveGroupUpdateData(host, group, opts.updateDataProvider);
+        const handle = (await selectedRule.buildUpdateCalls(tx, host, data, {
             cache: opts.cache,
             feeSource: opts.feeSource,
         })) ?? undefined;
         // Route by the handle's kind discriminant — the one site the tag exists to
-        // protect: a future non-lazer handle (e.g. a WaterxRule value) must never
-        // be silently fed into pyth_lazer_rule::feed.
+        // protect: a future non-lazer handle must never be silently fed into
+        // pyth_lazer_rule::feed.
         if (handle?.kind === "pyth_lazer_rule") {
-            for (const ticker of group.tickers)
+            for (const ticker of selectedGroup)
                 lazerUpdateByTicker.set(ticker, handle.update);
         }
+        // waterx_rule emits no shared handle (verify+feed is bundled into the
+        // per-ticker `collect_batch_latest`), so the envelope is carried straight
+        // from this group's fetched data to the feed leg below.
+        if (selectedRule.kind === "waterx_rule") {
+            const envelope = waterxEnvelopeOf(data);
+            if (envelope) {
+                for (const ticker of selectedGroup)
+                    waterxEnvelopeByTicker.set(ticker, envelope);
+            }
+        }
     }
     // Aggregate each ticker, feeding whichever rules it is configured for.
     for (const ticker of tickers) {
@@ -277,6 +289,7 @@ export async function refreshOraclePrices(tx, host, tickers, opts = {}) {
             ticker,
             priceInfoObjectId: priceInfoByTicker.get(ticker),
             lazerUpdate: lazerUpdateByTicker.get(ticker),
+            waterxEnvelope: waterxEnvelopeByTicker.get(ticker),
         });
     }
 }

package/dist/src/oracle/config.d.ts

@@ -12,6 +12,7 @@
 import type { BasePackageEntry } from "../account/config.ts";
 import type { BaseLineConfig } from "../base-client.ts";
 import type { Network } from "../constants.ts";
+import type { FetchPolicy } from "./update-fetch.ts";
 export interface PythRulePackage extends BasePackageEntry {
     config: string;
     feeds: Record<string, {
@@ -82,6 +83,39 @@ export interface SupraRulePackage extends BasePackageEntry {
      */
     enabled?: boolean;
 }
+/**
+ * Per-ticker `waterx_rule` feed entry. Keyed in `feeds` by the oracle **ticker**
+ * (e.g. `"SUIUSD"`, the same key `pyth_rule.feeds` uses), so
+ * `Object.keys(feeds)` is the SDK's supported-ticker set. The fields are
+ * informational off-chain — the SDK keys routing/support off the entry's
+ * presence and pushes the enclave-signed price verbatim, never re-deriving it.
+ */
+export interface WaterxRuleFeedEntry {
+    /** Exchange ticker the quote-center aggregates from (e.g. `"SUIUSDT"`). */
+    ticker?: string;
+}
+/**
+ * `waterx_rule` deployment entry — the first-party Nautilus-TEE oracle rule.
+ * Read by `WaterxRule` (`rules/waterx-rule.ts`): `feeds` for ticker support,
+ * `config`/`enclave_config`/`enclave` for the `collect_batch_latest` call,
+ * `published_at` for the package address. The off-chain signed price is pulled
+ * from the quote-center (endpoint from {@link WATERX_DEFAULTS}), not this JSON.
+ *
+ * `enabled` mirrors the JSON field verbatim but MUST NOT be read for routing —
+ * which rule prices a ticker is decided solely by the client's `oracleSource`
+ * create option (see `OracleHost.oracleSource`), mirroring `pyth_lazer_rule`.
+ */
+export interface WaterxRulePackage extends BasePackageEntry {
+    /** Shared `waterx_rule::Config` (per-symbol on-chain feed_config). */
+    config: string;
+    /** Shared `EnclaveConfig<WATERX_RULE>` the on-chain signature verify runs against. */
+    enclave_config: string;
+    /** Shared `Enclave<WATERX_RULE>` holding the registered TEE signing pubkey. */
+    enclave: string;
+    enabled?: boolean;
+    /** Oracle ticker → feed entry; presence marks the ticker as waterx-served. */
+    feeds: Record<string, WaterxRuleFeedEntry>;
+}
 export interface WaterxOraclePackage extends BasePackageEntry {
     listing_cap: string;
     oracle: string;
@@ -99,8 +133,33 @@ export interface OraclePackages {
     pyth_lazer_rule?: PythLazerRulePackage;
     constant_rule?: WaterxConstantRulePackage;
     supra_rule?: SupraRulePackage;
+    /** See {@link WaterxRulePackage} — read by `WaterxRule` when `oracleSource` selects it. */
+    waterx_rule?: WaterxRulePackage;
     waterx_oracle: WaterxOraclePackage;
 }
+/**
+ * Resolved Pyth Core infra as it lives on `client.pyth` — NOT a config-JSON
+ * shape. `state_id` / `wormhole_state_id` / `hermes_endpoint` come verbatim
+ * from the fixed per-network constant ({@link PYTH_DEFAULTS}); `api_key` /
+ * `fetch` are layered on from the caller's `pythApiKey` / `pythFetch` create
+ * options. None of it is sourced from the canonical `waterx-config` JSON — the
+ * SDK never reads a `pyth` block there (a Bearer secret has no place in a
+ * public CDN document). The infra is the same for every `oracleSource`; the
+ * `pyth_lazer_rule` source reads only the `api_key` / `fetch` from here and
+ * gets its on-chain infra from {@link LAZER_DEFAULTS} + config instead.
+ */
+/**
+ * The caller-tunable subset of `fetchWithPolicy`'s policy exposed on the
+ * `pythFetch` create option and `client.pyth.fetch` — the retry/timeout budget
+ * for the off-chain Hermes (`fetchPriceFeedsUpdateData`) and Lazer
+ * (`PythLazerRule`) update fetches. Deliberately narrower than the internal
+ * `FetchPolicy` (no `retryDelayMs` / `apiKey` / `fetchImpl`). Both fetches fall
+ * back to `fetchWithPolicy`'s defaults (15s timeout, 2 retries) when unset.
+ */
+export type PythFetchPolicy = {
+    timeoutMs?: number;
+    retries?: number;
+};
 export interface PythInfraConfig {
     state_id: string;
     wormhole_state_id: string;
@@ -109,8 +168,8 @@ export interface PythInfraConfig {
      * Pyth Pro / Lazer access token (`Authorization: Bearer …`) for
      * `PythLazerRule`'s signed-update fetch — Lazer is auth-first, so there is
      * no keyless default. Optional: Pyth-Core-only deployments never need it.
-     * Consumers pass it through client config (`config.pyth`); the SDK never
-     * reads `process.env`. Absent when a lazer-routed fetch runs →
+     * Supplied via the `pythApiKey` create option (the SDK never reads
+     * `process.env` or the config JSON). Absent when a lazer-routed fetch runs →
      * `LazerApiKeyMissing` is thrown at fetch time. As of the Pyth Pro
      * migration (post-2026-08-18, per
      * https://docs.pyth.network/price-feeds/core/upgrade) this is ALSO required
@@ -119,57 +178,16 @@ export interface PythInfraConfig {
      */
     api_key?: string;
     /**
-     * Retry/timeout policy override for the Hermes (`fetchPriceFeedsUpdateData`)
-     * and Lazer (`PythLazerRule`) off-chain update fetches — see
-     * `fetchWithPolicy` (`./update-fetch.ts`) for the full policy (backoff,
-     * which statuses retry, Bearer attachment). Optional: both fetches default
-     * to `fetchWithPolicy`'s built-in defaults (15s timeout, 2 retries) when
-     * unset.
+     * Retry/timeout policy for the Hermes (`fetchPriceFeedsUpdateData`) and
+     * Lazer (`PythLazerRule`) off-chain update fetches — see `fetchWithPolicy`
+     * (`./update-fetch.ts`) for the full policy (backoff, which statuses retry,
+     * Bearer attachment). Supplied via the `pythFetch` create option. Optional:
+     * both fetches default to `fetchWithPolicy`'s built-in defaults (15s
+     * timeout, 2 retries) when unset.
      */
-    fetch?: {
-        timeoutMs?: number;
-        retries?: number;
-    };
+    fetch?: PythFetchPolicy;
 }
 export declare const PYTH_DEFAULTS: Record<Network, PythInfraConfig>;
-/**
- * Which Pyth Core contract generation feeds `host.pyth` when the config JSON
- * carries no explicit `pyth` override:
- *
- * - `'core'` (default) — the original contracts + keyless Hermes
- *   ({@link PYTH_DEFAULTS}).
- * - `'pro'` — the Pro-compatible upgraded contracts + the Hermes-compatible
- *   endpoint ({@link PYTH_PRO_DEFAULTS}); pair with `pyth.api_key` after the
- *   2026-08-18 cutover.
- *
- * Resolved once at client creation from the `pythGeneration` create option.
- * Orthogonal to `oracleSource` — this flips the Pyth-Core *infra* (state ids
- * + endpoint), not which `PriceUpdateRule` routes tickers.
- */
-export type PythGeneration = "core" | "pro";
-/**
- * Pyth **Pro-generation** Core-compatible infra — the post-2026-08-18
- * contracts (cutover date per
- * https://docs.pyth.network/price-feeds/core/upgrade) from Pyth's Core-Upgrade
- * docs
- * (https://docs.pyth.network/price-feeds/core/upgrade/contracts, Sui section;
- * package revs `sui-pro-compatible-contract-mainnet` /
- * `sui-pro-compatible-contract-testnet`). Selected via the client's
- * `pythGeneration: 'pro'` create option; `config.pyth` still overrides
- * wholesale (see `PerpClient`). All four state ids were verified on-chain
- * (shared `state::State` objects under the docs' upgraded package ids).
- *
- * Kept as a second flat map beside {@link PYTH_DEFAULTS} rather than a nested
- * `PYTH_INFRA[network][generation]` — `PYTH_DEFAULTS` is a published export
- * with external consumers, so the smallest honest surface is an additive
- * sibling (same deferral note as {@link LAZER_DEFAULTS}).
- *
- * The Hermes-compatible endpoint (`pyth.dourolabs.app/hermes`) serves the
- * same REST surface as `hermes.pyth.network` but requires `pyth.api_key`
- * (`Authorization: Bearer …`) after the cutover — see
- * {@link PythInfraConfig.api_key}.
- */
-export declare const PYTH_PRO_DEFAULTS: Record<Network, PythInfraConfig>;
 /**
  * Pyth Lazer (Pyth Pro) external infra the `PythLazerRule` needs, by network.
  * Mirrors {@link PYTH_DEFAULTS}: per-network constants for infrastructure Pyth
@@ -190,6 +208,45 @@ export declare const LAZER_DEFAULTS: Record<Network, {
     endpoint: string;
     verifier_package: string;
 }>;
+/**
+ * Resolved WaterX quote-center infra for `WaterxRule` — the network default
+ * from {@link WATERX_DEFAULTS}, with both fields overridable at client init
+ * (`waterxEndpoint` / `waterxFetch`).
+ *
+ * The override exists because this is the one oracle source a BROWSER fetches
+ * itself: the rule pulls the signed envelope from the page, so it is subject to
+ * the quote-center deployment's CORS allowlist. A front end whose origin is not
+ * on that list — or one that must route egress through its own backend — points
+ * `endpoint` at a same-origin proxy (or supplies `fetch.fetchImpl`) instead of
+ * being locked to the hardcoded host.
+ */
+export interface WaterxInfraConfig {
+    /**
+     * Quote-center base URL. A base PATH is preserved — the rule appends via
+     * `joinEndpointPath`, so `https://app.example/api/quote-center` resolves to
+     * `…/api/quote-center/v1/quotes/update` and a proxy route is not rewritten
+     * away. A trailing slash is trimmed.
+     */
+    endpoint: string;
+    /**
+     * Retry/timeout policy (and `fetchImpl`) for the quote-center fetch — see
+     * `fetchWithPolicy` (`./update-fetch.ts`). Supplied via the `waterxFetch`
+     * create option. When unset the rule falls back to the shared `pyth.fetch`
+     * policy, then to `fetchWithPolicy`'s defaults (15s timeout, 2 retries).
+     */
+    fetch?: FetchPolicy;
+}
+/**
+ * WaterX quote-center base URL by network — the first-party TEE-signed price
+ * hub `WaterxRule` pulls from (`GET /v1/quotes/update?symbols=…`). Mirrors
+ * {@link LAZER_DEFAULTS}: infra WaterX operates, not part of the `waterx-config`
+ * JSON. Public read (no auth), so there is no api_key. `endpoint` has no
+ * trailing slash — the rule appends the path.
+ *
+ * These are DEFAULTS, not a hard pin: a consumer overrides them per client via
+ * `waterxEndpoint` / `waterxFetch` (resolved onto `client.waterx`).
+ */
+export declare const WATERX_DEFAULTS: Record<Network, WaterxInfraConfig>;
 /**
  * The narrow config shape the oracle/refresh code needs. `WaterXConfig`
  * (the perp line's full config) is assignable to this, so `PerpClient` satisfies
@@ -197,6 +254,4 @@ export declare const LAZER_DEFAULTS: Record<Network, {
  */
 export interface OracleConfig extends BaseLineConfig {
     packages: OraclePackages;
-    /** Pyth infra override (defaults from {@link PYTH_DEFAULTS}). */
-    pyth?: PythInfraConfig;
 }

package/dist/src/oracle/config.js

@@ -21,40 +21,6 @@ export const PYTH_DEFAULTS = {
         hermes_endpoint: "https://hermes-beta.pyth.network",
     },
 };
-/**
- * Pyth **Pro-generation** Core-compatible infra — the post-2026-08-18
- * contracts (cutover date per
- * https://docs.pyth.network/price-feeds/core/upgrade) from Pyth's Core-Upgrade
- * docs
- * (https://docs.pyth.network/price-feeds/core/upgrade/contracts, Sui section;
- * package revs `sui-pro-compatible-contract-mainnet` /
- * `sui-pro-compatible-contract-testnet`). Selected via the client's
- * `pythGeneration: 'pro'` create option; `config.pyth` still overrides
- * wholesale (see `PerpClient`). All four state ids were verified on-chain
- * (shared `state::State` objects under the docs' upgraded package ids).
- *
- * Kept as a second flat map beside {@link PYTH_DEFAULTS} rather than a nested
- * `PYTH_INFRA[network][generation]` — `PYTH_DEFAULTS` is a published export
- * with external consumers, so the smallest honest surface is an additive
- * sibling (same deferral note as {@link LAZER_DEFAULTS}).
- *
- * The Hermes-compatible endpoint (`pyth.dourolabs.app/hermes`) serves the
- * same REST surface as `hermes.pyth.network` but requires `pyth.api_key`
- * (`Authorization: Bearer …`) after the cutover — see
- * {@link PythInfraConfig.api_key}.
- */
-export const PYTH_PRO_DEFAULTS = {
-    MAINNET: {
-        state_id: "0x03719fae774ddab3cfcaa53bbc046f0cbe21410019b6280811bf3f9f4b05839d",
-        wormhole_state_id: "0xdbca52b9fb4f712e25f61f974586d93ac541bcf8389564f0323bb07215168b5c",
-        hermes_endpoint: "https://pyth.dourolabs.app/hermes",
-    },
-    TESTNET: {
-        state_id: "0x3c48fe392912de6c18087a2b3f5fdbfbfdb4598e180947feff1f12f8e9ea073e",
-        wormhole_state_id: "0x750da8e6d16b6a363a39fe2eaa8295ac224a1e6fce4e47b58845e2e8746164f0",
-        hermes_endpoint: "https://pyth.dourolabs.app/hermes",
-    },
-};
 // ============================================================================
 // Pyth Lazer — external infra, defaults by network
 // ============================================================================
@@ -84,3 +50,17 @@ export const LAZER_DEFAULTS = {
         verifier_package: "0xf5bd2141967507050a91b58de3d95e77c432cd90d1799ee46effc27430a68c21",
     },
 };
+/**
+ * WaterX quote-center base URL by network — the first-party TEE-signed price
+ * hub `WaterxRule` pulls from (`GET /v1/quotes/update?symbols=…`). Mirrors
+ * {@link LAZER_DEFAULTS}: infra WaterX operates, not part of the `waterx-config`
+ * JSON. Public read (no auth), so there is no api_key. `endpoint` has no
+ * trailing slash — the rule appends the path.
+ *
+ * These are DEFAULTS, not a hard pin: a consumer overrides them per client via
+ * `waterxEndpoint` / `waterxFetch` (resolved onto `client.waterx`).
+ */
+export const WATERX_DEFAULTS = {
+    MAINNET: { endpoint: "https://quote-center.waterx.app" },
+    TESTNET: { endpoint: "https://quote-center-staging.waterx.app" },
+};

package/dist/src/oracle/host.d.ts

@@ -9,15 +9,26 @@
  */
 import type { SuiGrpcClient } from "@mysten/sui/grpc";
 import type { Network } from "../constants.ts";
-import type { OracleConfig, PythInfraConfig } from "./config.ts";
+import type { OracleConfig, PythInfraConfig, WaterxInfraConfig } from "./config.ts";
 import type { OracleSource } from "./price-update-rule.ts";
 export interface OracleHost {
     /** Sui network this client targets — selects per-network external-infra defaults (e.g. `LAZER_DEFAULTS`). */
     readonly network: Network;
     /** Oracle slice of the canonical `waterx-config` JSON (rule packages + per-ticker feeds). */
     readonly config: OracleConfig;
-    /** External Pyth/Wormhole/Hermes infra (network default, overridable via config). */
+    /** External Pyth/Wormhole/Hermes infra — fixed per `(network, generation)`; api_key/fetch layered from create options. */
     readonly pyth: PythInfraConfig;
+    /**
+     * WaterX quote-center infra for `WaterxRule` — endpoint + fetch policy,
+     * resolved from the `waterxEndpoint` / `waterxFetch` create options.
+     *
+     * OPTIONAL so an existing host stays a valid `OracleHost`: when absent the
+     * rule falls back to `WATERX_DEFAULTS[network]`. This is the hook a browser
+     * consumer uses to route the quote-center fetch through a same-origin proxy
+     * (`endpoint`) or its own transport (`fetch.fetchImpl`) — that request is
+     * made from the page, so it is bound by the quote-center's CORS allowlist.
+     */
+    readonly waterx?: WaterxInfraConfig;
     /** gRPC client for the on-chain reads the Pyth update path needs. */
     readonly grpcClient: SuiGrpcClient;
     /**

package/dist/src/oracle/index.d.ts

@@ -16,15 +16,17 @@
  * rules that consume it are separate concerns.
  */
 export type { OracleHost } from "./host.ts";
-export { FetchPolicyError } from "./update-fetch.ts";
+export { FetchPolicyError, fetchWithPolicy, joinEndpointPath } from "./update-fetch.ts";
 export type { FetchPolicy } from "./update-fetch.ts";
-export { PythCache, fetchPriceFeedsUpdateData, buildPythPriceUpdateCalls, updatePythPrices, OracleFeeSourceUnavailableError, } from "./pyth.ts";
+export { PythCache, fetchPriceFeedsUpdateData, endpointSupportedFeedIds, probeMissingFeeds, buildPythPriceUpdateCalls, updatePythPrices, HermesEndpointRejectedAllFeedsError, MISSING_FEED_MEMO_TTL_MS, OracleFeeSourceUnavailableError, } from "./pyth.ts";
 export type { OracleFeeSource } from "./pyth.ts";
 export type { PriceUpdateRule, PriceUpdateRuleKind, RuleUpdateData, RuleUpdateHandle, BuildUpdateOpts, OracleSource, UpdateDataProvider, } from "./price-update-rule.ts";
 export { PythCoreRule } from "./rules/pyth-core-rule.ts";
 export type { PythCoreUpdatePayload } from "./rules/pyth-core-rule.ts";
 export { PythLazerRule, LazerApiKeyMissingError } from "./rules/pyth-lazer-rule.ts";
 export type { PythLazerUpdatePayload } from "./rules/pyth-lazer-rule.ts";
+export { WaterxRule, parseSignedEnvelope } from "./rules/waterx-rule.ts";
+export type { WaterxUpdatePayload, WaterxSignedEnvelope, WaterxBatchItem, } from "./rules/waterx-rule.ts";
 export { OracleSourceNotImplementedError } from "./rule-registry.ts";
 export { aggregateTicker, aggregateTickerWithPyth, aggregateTickerWithConstant, refreshOraclePrices, } from "./aggregate.ts";
 export { openPythSponsorFund, reimbursePythSponsor } from "./rules/sponsor.ts";