@waterx/sdk 4.0.1 → 4.3.0

package/dist/src/oracle/aggregate.d.ts

@@ -19,12 +19,14 @@
  *
  * `refreshOraclePrices` additionally routes the on-chain price *update* leg
  * (the fetch + verify/push step, before any of the above feeding) through the
- * `PriceUpdateRule` selected by `host.oracleSource` — see `rule-registry.ts`.
+ * `PriceUpdateRule` of EVERY source in the `host.oracleSources` fed set — see
+ * `rule-registry.ts`.
  */
 import type { Transaction, TransactionArgument } from "@mysten/sui/transactions";
 import type { OracleHost } from "./host.ts";
 import type { OracleSource, PriceUpdateRule, UpdateDataProvider } from "./price-update-rule.ts";
 import { type OracleFeeSource, type PythCache } from "./pyth.ts";
+import { type WaterxSignedEnvelope } from "./rules/waterx-rule.ts";
 /**
  * Aggregate one ticker's price into the shared `Oracle`: build a collector, feed
  * every rule the ticker is configured for, then `aggregate`.
@@ -54,6 +56,7 @@ export declare function aggregateTicker(tx: Transaction, host: OracleHost, args:
     ticker: string;
     priceInfoObjectId?: string;
     lazerUpdate?: TransactionArgument;
+    waterxEnvelope?: WaterxSignedEnvelope;
 }): void;
 /**
  * Thin wrapper over {@link aggregateTicker} for a Pyth-fed ticker. Kept for
@@ -82,27 +85,26 @@ export declare function aggregateTickerWithConstant(tx: Transaction, host: Oracl
  * entry, Lazer if the lazer update leg served it — see below — Supra when
  * enabled, Constant when it's a constant ticker).
  *
- * Before that, the on-chain price *update* leg is routed by `host.oracleSource`
- * (see `rule-registry.ts`): the ONE selected source serves every ticker in its
- * `supportedTickers(host)`. There is **no cross-source fallback** — a requested
- * ticker the selected source does not serve, and that is not a constant-only
- * ticker (which needs no price-update leg), fails the build immediately with a
- * clear error naming the ticker and source. That is the deliberate "fail the
- * tx-build, don't silently reroute" contract: a wrong-but-present feed id is
- * NOT validated here (it surfaces on-chain at dry-run); a MISSING feed for the
- * selected source is caught here. When the selected source's feed exists but is
- * wrong, this function does nothing special — the on-chain aggregate aborts at
- * dry-run, which is correct.
+ * Before that, the on-chain price *update* leg is routed by the
+ * `host.oracleSources` fed set (see `rule-registry.ts`): EVERY listed source
+ * updates the tickers its own `supportedTickers(host)` serves, all in this one
+ * PTB. There is **no cross-source fallback** — a requested ticker NO listed
+ * source serves, and that is not a constant-only ticker (which needs no
+ * price-update leg), fails the build immediately with a clear error naming
+ * the ticker and the list. That is the deliberate "fail the tx-build, don't
+ * silently reroute" contract: a wrong-but-present feed id is NOT validated
+ * here (it surfaces on-chain at dry-run); a ticker MISSING from every listed
+ * source's feeds is caught here.
  *
- * The selected source's fetch + build runs against its own infra, guaranteeing
- * per-rule PTB atomicity. A fee-source pre-check runs first (the source's
- * `requiresFeeSource`) BEFORE any off-chain fetch or PTB mutation — so a
- * fee-charging source with no `opts.feeSource` throws
+ * Each source's fetch + build runs against its own infra, guaranteeing
+ * per-rule PTB atomicity. A fee-source pre-check runs first (any listed
+ * source's `requiresFeeSource`) BEFORE any off-chain fetch or PTB mutation —
+ * so a fee-charging source with no `opts.feeSource` throws
  * `OracleFeeSourceUnavailable` with zero wasted network calls and zero stray
- * moveCalls. Only once that check passes does the off-chain fetch run and
- * complete before any PTB mutation; on-chain reads inside `buildUpdateCalls`
- * can still fail mid-append for other reasons — callers discard the tx on any
- * throw.
+ * moveCalls. Only once that check passes do the off-chain fetches run — in
+ * parallel across sources — and ALL settle before the first PTB mutation;
+ * on-chain reads inside `buildUpdateCalls` can still fail mid-append for
+ * other reasons — callers discard the tx on any throw.
  *
  * **Collector-feed leg is rule-aware:** a lazer-served group's
  * `buildUpdateCalls` returns the verified `Update` PTB value
@@ -137,7 +139,7 @@ export declare function refreshOraclePrices(tx: Transaction, host: OracleHost, t
     /**
      * @internal Test-only: layer fake `PriceUpdateRule`s on top of the
      * production registry (see `rule-registry.ts`'s `resolveOracleRule`).
-     * Production callers never set this — routing is by `host.oracleSource`
+     * Production callers never set this — routing is by `host.oracleSources`
      * alone.
      */
     ruleOverrides?: Partial<Record<OracleSource, PriceUpdateRule>>;

package/dist/src/oracle/aggregate.js

@@ -19,7 +19,8 @@
  *
  * `refreshOraclePrices` additionally routes the on-chain price *update* leg
  * (the fetch + verify/push step, before any of the above feeding) through the
- * `PriceUpdateRule` selected by `host.oracleSource` — see `rule-registry.ts`.
+ * `PriceUpdateRule` of EVERY source in the `host.oracleSources` fed set — see
+ * `rule-registry.ts`.
  */
 import { aggregate as aggregateCall, newCollector } from "../generated/waterx_oracle/oracle.js";
 import { OracleFeeSourceUnavailableError } from "./pyth.js";
@@ -28,6 +29,7 @@ import { feedConstantRule } from "./rules/constant-rule.js";
 import { feedLazerRule } from "./rules/pyth-lazer-rule.js";
 import { feedPythRule } from "./rules/pyth-rule.js";
 import { maybeFeedSupra } from "./rules/supra-rule.js";
+import { feedWaterxRule, waterxEnvelopeOf, } from "./rules/waterx-rule.js";
 /**
  * Resolve one group's off-chain update payload for {@link refreshOraclePrices}:
  * try `provider.get(source, tickers)` first (when a provider is configured),
@@ -110,6 +112,20 @@ export function aggregateTicker(tx, host, args) {
         feedLazerRule(tx, host, collector, args.lazerUpdate);
         fed = true;
     }
+    if (args.waterxEnvelope !== undefined) {
+        // waterx_rule::collect_batch_latest verifies the batch signature and feeds
+        // this collector's symbol from the batch. If the ticker's aggregator does
+        // not (yet) weight `WaterxRule`, the contribution is silently dropped
+        // on-chain — feeding ahead of the weight migration is safe for THIS tx.
+        // CAVEAT (unlike lazer): the feed call records a per-symbol signed-
+        // timestamp high-water mark REGARDLESS of weights, and a replayed
+        // timestamp ABORTS (`EReplayedSignature`, audit F-014) — so two PTBs
+        // carrying the same envelope for the same symbol cannot both land; the
+        // second aborts even where waterx is unweighted. See WaterxRule's module
+        // header.
+        feedWaterxRule(tx, host, collector, args.waterxEnvelope);
+        fed = true;
+    }
     if (fed) {
         // Supra rides on the same collector when enabled (abstains on-chain otherwise).
         maybeFeedSupra(tx, host, collector);
@@ -158,27 +174,26 @@ export function aggregateTickerWithConstant(tx, host, args) {
  * entry, Lazer if the lazer update leg served it — see below — Supra when
  * enabled, Constant when it's a constant ticker).
  *
- * Before that, the on-chain price *update* leg is routed by `host.oracleSource`
- * (see `rule-registry.ts`): the ONE selected source serves every ticker in its
- * `supportedTickers(host)`. There is **no cross-source fallback** — a requested
- * ticker the selected source does not serve, and that is not a constant-only
- * ticker (which needs no price-update leg), fails the build immediately with a
- * clear error naming the ticker and source. That is the deliberate "fail the
- * tx-build, don't silently reroute" contract: a wrong-but-present feed id is
- * NOT validated here (it surfaces on-chain at dry-run); a MISSING feed for the
- * selected source is caught here. When the selected source's feed exists but is
- * wrong, this function does nothing special — the on-chain aggregate aborts at
- * dry-run, which is correct.
+ * Before that, the on-chain price *update* leg is routed by the
+ * `host.oracleSources` fed set (see `rule-registry.ts`): EVERY listed source
+ * updates the tickers its own `supportedTickers(host)` serves, all in this one
+ * PTB. There is **no cross-source fallback** — a requested ticker NO listed
+ * source serves, and that is not a constant-only ticker (which needs no
+ * price-update leg), fails the build immediately with a clear error naming
+ * the ticker and the list. That is the deliberate "fail the tx-build, don't
+ * silently reroute" contract: a wrong-but-present feed id is NOT validated
+ * here (it surfaces on-chain at dry-run); a ticker MISSING from every listed
+ * source's feeds is caught here.
  *
- * The selected source's fetch + build runs against its own infra, guaranteeing
- * per-rule PTB atomicity. A fee-source pre-check runs first (the source's
- * `requiresFeeSource`) BEFORE any off-chain fetch or PTB mutation — so a
- * fee-charging source with no `opts.feeSource` throws
+ * Each source's fetch + build runs against its own infra, guaranteeing
+ * per-rule PTB atomicity. A fee-source pre-check runs first (any listed
+ * source's `requiresFeeSource`) BEFORE any off-chain fetch or PTB mutation —
+ * so a fee-charging source with no `opts.feeSource` throws
  * `OracleFeeSourceUnavailable` with zero wasted network calls and zero stray
- * moveCalls. Only once that check passes does the off-chain fetch run and
- * complete before any PTB mutation; on-chain reads inside `buildUpdateCalls`
- * can still fail mid-append for other reasons — callers discard the tx on any
- * throw.
+ * moveCalls. Only once that check passes do the off-chain fetches run — in
+ * parallel across sources — and ALL settle before the first PTB mutation;
+ * on-chain reads inside `buildUpdateCalls` can still fail mid-append for
+ * other reasons — callers discard the tx on any throw.
  *
  * **Collector-feed leg is rule-aware:** a lazer-served group's
  * `buildUpdateCalls` returns the verified `Update` PTB value
@@ -199,64 +214,122 @@ export function aggregateTickerWithConstant(tx, host, args) {
 export async function refreshOraclePrices(tx, host, tickers, opts = {}) {
     if (tickers.length === 0)
         return;
+    // Dedupe the caller's list (order-preserving): a repeated ticker would
+    // otherwise aggregate TWICE in this one PTB — wasted gas for every rule,
+    // and a hard ABORT under waterx: the second `collect_batch_latest` carries
+    // the same envelope, and the on-chain per-symbol replay guard rejects an
+    // already-accepted signed timestamp (`EReplayedSignature`, F-014) even
+    // inside a single transaction.
+    tickers = [...new Set(tickers)];
     // price_info_object lookup for every ticker with a pyth_rule.feeds entry —
     // needed by aggregateTicker's (unchanged) Pyth feed step below regardless of
     // which rule performed the on-chain update for that ticker.
     const pythTickers = tickers.filter((t) => host.config.packages.pyth_rule?.feeds?.[t] !== undefined);
     const priceInfoByTicker = new Map();
     pythTickers.forEach((t) => priceInfoByTicker.set(t, host.getPythFeed(t).price_info_object));
-    // ONE source, no fallback. The selected source serves the tickers in its
-    // `supportedTickers(host)`; `source` is tracked alongside the group (rather
-    // than read back off `rule.kind`, typed as the broader PriceUpdateRuleKind)
-    // so the provider lookup below has an OracleSource to key on without a cast.
-    const selectedRule = resolveOracleRule(host.oracleSource, opts.ruleOverrides);
-    const selectedSupported = new Set(selectedRule.supportedTickers(host));
-    // Fail the tx-build (NOT client init, NOT a silent reroute) when the selected
-    // source has no feed for a requested ticker that actually needs a price
+    // The fed set is a LIST (`host.oracleSources`, normalized + deduped at
+    // client creation): ONE build carries every listed source's data, and the
+    // chain's per-ticker weight tables decide which contributions count —
+    // feeding an unweighted rule's PRICE is dropped on-chain, while starving a
+    // weighted one aborts. That asymmetry is what makes weight migrations
+    // safe: flip weights per ticker at any time while the fed set stays a
+    // superset of every ticker's weighted set. (One caveat: waterx's feed call
+    // burns a per-symbol signed-timestamp high-water mark regardless of
+    // weights — see aggregateTicker's waterx branch.) Still NO fallback
+    // BETWEEN sources: each group serves only the tickers its own feeds list.
+    // Zero-ticker groups are dropped here so everything downstream (fee check,
+    // fetch fan-out, update-leg build) can assume every group has work.
+    const groups = host.oracleSources
+        .map((source) => {
+        const rule = resolveOracleRule(source, opts.ruleOverrides);
+        const supported = new Set(rule.supportedTickers(host));
+        return { source, rule, tickers: tickers.filter((t) => supported.has(t)) };
+    })
+        .filter((group) => group.tickers.length > 0);
+    // Fail the tx-build (NOT client init, NOT a silent reroute) when NO listed
+    // source has a feed for a requested ticker that actually needs a price
     // update. Only a CONSTANT-ONLY ticker is exempt — priced entirely by
     // `constant_rule`, it needs no update leg from any source. A DUAL-FEED ticker
     // (constant AND pyth) still needs its Pyth leg refreshed, so `isConstantTicker`
-    // alone must NOT exempt it: under a source that can't serve it, with no
-    // fallback, feeding an unrefreshed Pyth leg would price it stale (or abort on a
-    // missing weighted source). `priceInfoByTicker.has(t)` ⇔ the ticker has a
-    // `pyth_rule.feeds` entry, so `constant && !hasPyth` is exactly constant-only.
-    // This catches a MISSING feed; a present-but-WRONG feed id is deliberately not
-    // validated here (it aborts on-chain at dry-run).
+    // alone must NOT exempt it: with no source able to serve it, feeding an
+    // unrefreshed Pyth leg would price it stale (or abort on a missing weighted
+    // source). `priceInfoByTicker.has(t)` ⇔ the ticker has a `pyth_rule.feeds`
+    // entry, so `constant && !hasPyth` is exactly constant-only. This catches a
+    // MISSING feed; a present-but-WRONG feed id is deliberately not validated
+    // here (it aborts on-chain at dry-run).
+    const covered = new Set(groups.flatMap((group) => group.tickers));
     const isConstantOnly = (t) => host.isConstantTicker(t) && !priceInfoByTicker.has(t);
-    const unservable = tickers.filter((t) => !selectedSupported.has(t) && !isConstantOnly(t));
+    const unservable = tickers.filter((t) => !covered.has(t) && !isConstantOnly(t));
     if (unservable.length > 0) {
-        throw new Error(`oracleSource '${host.oracleSource}' has no feed configured for ticker(s): ` +
+        const sources = host.oracleSources.join(", ");
+        throw new Error(`oracleSource [${sources}] has no feed configured for ticker(s): ` +
             `${unservable.join(", ")}. Sources are self-contained with no fallback — add ` +
-            `${host.oracleSource} feeds for them, or select a source that serves them.`);
+            `feeds for them under a listed source, or list a source that serves them.`);
     }
-    const selectedGroup = tickers.filter((t) => selectedSupported.has(t));
-    // Fee-source pre-check, hoisted ABOVE the off-chain fetch and PTB build below.
-    // It consults only `rule.requiresFeeSource` — known before any fetch or PTB
-    // mutation — so a fee-charging source with no `feeSource` throws with ZERO
-    // wasted network calls and zero PTB commands, rather than waiting for
-    // `buildPythPriceUpdateCalls`'s own per-call guard to fire after the off-chain
-    // fetch already ran.
-    if (selectedGroup.length > 0 && !opts.feeSource && selectedRule.requiresFeeSource) {
+    // Fee-source pre-check, hoisted ABOVE the off-chain fetches and PTB build
+    // below. It consults only `rule.requiresFeeSource` — known before any fetch
+    // or PTB mutation — so a fee-charging source (Pyth Core) in the fed set with
+    // no `feeSource` throws with ZERO wasted network calls and zero PTB
+    // commands, rather than waiting for `buildPythPriceUpdateCalls`'s own
+    // per-call guard to fire after the off-chain fetches already ran.
+    if (!opts.feeSource && groups.some((group) => group.rule.requiresFeeSource)) {
         throw new OracleFeeSourceUnavailableError();
     }
-    // Resolve + build the selected source's update leg. The off-chain fetch
-    // settles before the first PTB mutation, so a fetch failure never strands
-    // moveCalls in a caller-owned tx. Map each lazer-served ticker to the one
-    // verified `Update` PTB value for the collector-feed leg below.
+    // Phase 1 — resolve every group's update data IN PARALLEL: the per-source
+    // fetches (Hermes VAA / Lazer POST / quote-center GET) are independent
+    // network calls on the tx-build money path, so a multi-source fed set must
+    // not pay one RTT per source sequentially. ALL fetches settle before the
+    // first PTB mutation below, so a fetch failure never strands moveCalls in a
+    // caller-owned tx — and a failure in ANY group fails the whole build (a
+    // listed source is load-bearing; silently building without it would starve
+    // its weighted tickers on-chain).
+    const dataByGroup = await Promise.all(groups.map((group) => resolveGroupUpdateData(host, group, opts.updateDataProvider)));
+    // Phase 2 — build each group's update leg sequentially, in list order, so
+    // PTB command order stays deterministic. The carry step below is an
+    // exhaustive switch over the group's rule kind: a future source whose feed
+    // leg needs per-ticker data from its update leg must decide its carry here
+    // — falling through silently would starve its weighted tickers on-chain.
     const lazerUpdateByTicker = new Map();
-    if (selectedGroup.length > 0) {
-        const group = { source: host.oracleSource, rule: selectedRule, tickers: selectedGroup };
-        const data = await resolveGroupUpdateData(host, group, opts.updateDataProvider);
-        const handle = (await selectedRule.buildUpdateCalls(tx, host, data, {
+    // Signed batch envelope per waterx-served ticker. Unlike Lazer's shared PTB
+    // handle, waterx's verify+feed is bundled into `collect_batch_latest` in the
+    // per-ticker feed leg, so its `buildUpdateCalls` emits nothing and the
+    // envelope is carried straight from the group's fetched data.
+    const waterxEnvelopeByTicker = new Map();
+    for (const [i, group] of groups.entries()) {
+        const data = dataByGroup[i] ?? null;
+        const handle = (await group.rule.buildUpdateCalls(tx, host, data, {
             cache: opts.cache,
             feeSource: opts.feeSource,
         })) ?? undefined;
-        // Route by the handle's kind discriminant — the one site the tag exists to
-        // protect: a future non-lazer handle (e.g. a WaterxRule value) must never
-        // be silently fed into pyth_lazer_rule::feed.
-        if (handle?.kind === "pyth_lazer_rule") {
-            for (const ticker of selectedGroup)
-                lazerUpdateByTicker.set(ticker, handle.update);
+        switch (group.rule.kind) {
+            case "pyth_rule":
+                // Core's update leg wrote the PriceInfoObjects in place — the feed
+                // leg reads them by id (`priceInfoByTicker`), nothing to carry.
+                break;
+            case "pyth_lazer_rule":
+                // Route by the handle's kind discriminant — the tag exists so a
+                // non-lazer handle can never be silently fed into
+                // pyth_lazer_rule::feed.
+                if (handle?.kind === "pyth_lazer_rule") {
+                    for (const ticker of group.tickers)
+                        lazerUpdateByTicker.set(ticker, handle.update);
+                }
+                break;
+            case "waterx_rule": {
+                // waterx_rule emits no shared handle (verify+feed is bundled into the
+                // per-ticker `collect_batch_latest`), so the envelope is carried
+                // straight from this group's fetched data to the feed leg below.
+                const envelope = waterxEnvelopeOf(data);
+                if (envelope) {
+                    for (const ticker of group.tickers)
+                        waterxEnvelopeByTicker.set(ticker, envelope);
+                }
+                break;
+            }
+            default: {
+                const exhausted = group.rule.kind;
+                throw new Error(`refreshOraclePrices: unhandled rule kind '${String(exhausted)}'`);
+            }
         }
     }
     // Aggregate each ticker, feeding whichever rules it is configured for.
@@ -265,6 +338,7 @@ export async function refreshOraclePrices(tx, host, tickers, opts = {}) {
             ticker,
             priceInfoObjectId: priceInfoByTicker.get(ticker),
             lazerUpdate: lazerUpdateByTicker.get(ticker),
+            waterxEnvelope: waterxEnvelopeByTicker.get(ticker),
         });
     }
 }

package/dist/src/oracle/config.d.ts

@@ -11,7 +11,7 @@
  */
 import type { BasePackageEntry } from "../account/config.ts";
 import type { BaseLineConfig } from "../base-client.ts";
-import type { Network } from "../constants.ts";
+import type { FetchPolicy } from "./update-fetch.ts";
 export interface PythRulePackage extends BasePackageEntry {
     config: string;
     feeds: Record<string, {
@@ -30,7 +30,7 @@ export interface PythSponsorRulePackage extends BasePackageEntry {
  *
  * `enabled` mirrors the JSON field verbatim but MUST NOT be read for routing —
  * which rule prices a ticker is decided solely by the client's `oracleSource`
- * create option (see `OracleHost.oracleSource`), never by this flag or any
+ * create option (see `OracleHost.oracleSources`), never by this flag or any
  * other config value.
  */
 export interface PythLazerRulePackage extends BasePackageEntry {
@@ -82,6 +82,40 @@ export interface SupraRulePackage extends BasePackageEntry {
      */
     enabled?: boolean;
 }
+/**
+ * Per-ticker `waterx_rule` feed entry. Keyed in `feeds` by the oracle **ticker**
+ * (e.g. `"SUIUSD"`, the same key `pyth_rule.feeds` uses), so
+ * `Object.keys(feeds)` is the SDK's supported-ticker set. The fields are
+ * informational off-chain — the SDK keys routing/support off the entry's
+ * presence and pushes the enclave-signed price verbatim, never re-deriving it.
+ */
+export interface WaterxRuleFeedEntry {
+    /** Exchange ticker the quote-center aggregates from (e.g. `"SUIUSDT"`). */
+    ticker?: string;
+}
+/**
+ * `waterx_rule` deployment entry — the first-party Nautilus-TEE oracle rule.
+ * Read by `WaterxRule` (`rules/waterx-rule.ts`): `feeds` for ticker support,
+ * `config`/`enclave_config`/`enclave` for the `collect_batch_latest` call,
+ * `published_at` for the package address. The off-chain signed price is pulled
+ * from the quote-center (endpoint from the rule-owned `WATERX_INFRA` table in
+ * `rules/waterx-rule.ts`), not this JSON.
+ *
+ * `enabled` mirrors the JSON field verbatim but MUST NOT be read for routing —
+ * which rule prices a ticker is decided solely by the client's `oracleSource`
+ * create option (see `OracleHost.oracleSources`), mirroring `pyth_lazer_rule`.
+ */
+export interface WaterxRulePackage extends BasePackageEntry {
+    /** Shared `waterx_rule::Config` (per-symbol on-chain feed_config). */
+    config: string;
+    /** Shared `EnclaveConfig<WATERX_RULE>` the on-chain signature verify runs against. */
+    enclave_config: string;
+    /** Shared `Enclave<WATERX_RULE>` holding the registered TEE signing pubkey. */
+    enclave: string;
+    enabled?: boolean;
+    /** Oracle ticker → feed entry; presence marks the ticker as waterx-served. */
+    feeds: Record<string, WaterxRuleFeedEntry>;
+}
 export interface WaterxOraclePackage extends BasePackageEntry {
     listing_cap: string;
     oracle: string;
@@ -99,19 +133,10 @@ export interface OraclePackages {
     pyth_lazer_rule?: PythLazerRulePackage;
     constant_rule?: WaterxConstantRulePackage;
     supra_rule?: SupraRulePackage;
+    /** See {@link WaterxRulePackage} — read by `WaterxRule` when `oracleSource` selects it. */
+    waterx_rule?: WaterxRulePackage;
     waterx_oracle: WaterxOraclePackage;
 }
-/**
- * Resolved Pyth Core infra as it lives on `client.pyth` — NOT a config-JSON
- * shape. `state_id` / `wormhole_state_id` / `hermes_endpoint` come verbatim
- * from the fixed per-network constant ({@link PYTH_DEFAULTS}); `api_key` /
- * `fetch` are layered on from the caller's `pythApiKey` / `pythFetch` create
- * options. None of it is sourced from the canonical `waterx-config` JSON — the
- * SDK never reads a `pyth` block there (a Bearer secret has no place in a
- * public CDN document). The infra is the same for every `oracleSource`; the
- * `pyth_lazer_rule` source reads only the `api_key` / `fetch` from here and
- * gets its on-chain infra from {@link LAZER_DEFAULTS} + config instead.
- */
 /**
  * The caller-tunable subset of `fetchWithPolicy`'s policy exposed on the
  * `pythFetch` create option and `client.pyth.fetch` — the retry/timeout budget
@@ -124,18 +149,24 @@ export type PythFetchPolicy = {
     timeoutMs?: number;
     retries?: number;
 };
-export interface PythInfraConfig {
-    state_id: string;
-    wormhole_state_id: string;
-    hermes_endpoint: string;
+/**
+ * `client.pyth` — ONLY the caller-supplied Pyth credential + fetch policy,
+ * shared by the Pyth-family rules (`pyth_rule`, `pyth_lazer_rule`). It carries
+ * NO endpoints and NO on-chain object ids: every oracle source owns its own
+ * infra, co-located with its rule (`PYTH_CORE_INFRA` in `oracle/pyth.ts`;
+ * the Lazer constants inside `rules/pyth-lazer-rule.ts`). A non-Pyth source
+ * never reads this slice.
+ * Nothing here is sourced from the canonical `waterx-config` JSON — a Bearer
+ * secret has no place in a public CDN document.
+ */
+export interface PythAccessConfig {
     /**
-     * Pyth Pro / Lazer access token (`Authorization: Bearer …`) for
+     * Pyth access token (`Authorization: Bearer …`). Required by
      * `PythLazerRule`'s signed-update fetch — Lazer is auth-first, so there is
-     * no keyless default. Optional: Pyth-Core-only deployments never need it.
-     * Supplied via the `pythApiKey` create option (the SDK never reads
-     * `process.env` or the config JSON). Absent when a lazer-routed fetch runs →
-     * `LazerApiKeyMissing` is thrown at fetch time. As of the Pyth Pro
-     * migration (post-2026-08-18, per
+     * no keyless default; absent when a lazer-routed fetch runs →
+     * `LazerApiKeyMissing` is thrown at fetch time. Supplied via the
+     * `pythApiKey` create option (the SDK never reads `process.env` or the
+     * config JSON). As of the Pyth Pro migration (post-2026-08-18, per
      * https://docs.pyth.network/price-feeds/core/upgrade) this is ALSO required
      * for `pyth_rule`'s Hermes fetch (`fetchPriceFeedsUpdateData`) — see
      * `fetch` below.
@@ -151,27 +182,37 @@ export interface PythInfraConfig {
      */
     fetch?: PythFetchPolicy;
 }
-export declare const PYTH_DEFAULTS: Record<Network, PythInfraConfig>;
 /**
- * Pyth Lazer (Pyth Pro) external infra the `PythLazerRule` needs, by network.
- * Mirrors {@link PYTH_DEFAULTS}: per-network constants for infrastructure Pyth
- * operates (not part of the `waterx-config` JSON). A fuller `PYTH_INFRA`
- * restructure is deferred — this stays a minimal map until then.
+ * `client.waterx` — ONLY the caller-supplied quote-center overrides for
+ * `WaterxRule`, mirroring {@link PythAccessConfig}: no resolved infra lives on
+ * the client. When a field is unset the rule resolves it against its OWN
+ * per-network table (`WATERX_INFRA` in `rules/waterx-rule.ts`) — no other
+ * source's endpoint or policy is ever consulted.
  *
- * - `endpoint` — Lazer HTTP API base; signed updates come from
- *   `POST /v1/latest_price` (Bearer-authenticated). The service is
- *   network-agnostic (one signed payload verifies on any chain that trusts the
- *   Lazer signers), so both networks share the production host.
- * - `verifier_package` — the Sui package carrying
- *   `pyth_lazer::parse_and_verify_le_ecdsa_update`. Per-network: testnet is
- *   still the original v1 publish; mainnet is the v2-upgraded package (which
- *   still exposes the v1 entry `pyth_lazer_rule` binds). Values mirror the
- *   contract repo's `pyth_lazer_rule/Move.toml` published-at pins.
+ * The endpoint override exists because this is the one oracle source a BROWSER
+ * fetches itself: the rule pulls the signed envelope from the page, so it is
+ * subject to the quote-center deployment's CORS allowlist. A front end whose
+ * origin is not on that list — or one that must route egress through its own
+ * backend — points `endpoint` at a same-origin proxy (or supplies
+ * `fetch.fetchImpl`) instead of being locked to the default host.
  */
-export declare const LAZER_DEFAULTS: Record<Network, {
-    endpoint: string;
-    verifier_package: string;
-}>;
+export interface WaterxAccessConfig {
+    /**
+     * Quote-center base URL override (`waterxEndpoint` create option). A base
+     * PATH is preserved — the rule appends via `joinEndpointPath`, so
+     * `https://app.example/api/quote-center` resolves to
+     * `…/api/quote-center/v1/quotes/update` and a proxy route is not rewritten
+     * away. A trailing slash is trimmed.
+     */
+    endpoint?: string;
+    /**
+     * Retry/timeout policy (and `fetchImpl`) for the quote-center fetch — see
+     * `fetchWithPolicy` (`./update-fetch.ts`). Supplied via the `waterxFetch`
+     * create option. Falls back to `fetchWithPolicy`'s built-in defaults (15s
+     * timeout, 2 retries) when unset — never to another source's policy.
+     */
+    fetch?: FetchPolicy;
+}
 /**
  * The narrow config shape the oracle/refresh code needs. `WaterXConfig`
  * (the perp line's full config) is assignable to this, so `PerpClient` satisfies

package/dist/src/oracle/config.js

@@ -9,44 +9,4 @@
  * depends on this shared schema instead of the perp line's full config —
  * mirrors the earlier account-config hoist.
  */
-export const PYTH_DEFAULTS = {
-    MAINNET: {
-        state_id: "0x1f9310238ee9298fb703c3419030b35b22bb1cc37113e3bb5007c99aec79e5b8",
-        wormhole_state_id: "0xaeab97f96cf9877fee2883315d459552b2b921edc16d7ceac6eab944dd88919c",
-        hermes_endpoint: "https://hermes.pyth.network",
-    },
-    TESTNET: {
-        state_id: "0x243759059f4c3111179da5878c12f68d612c21a8d54d85edc86164bb18be1c7c",
-        wormhole_state_id: "0x31358d198147da50db32eda2562951d53973a0c0ad5ed738e9b17d88b213d790",
-        hermes_endpoint: "https://hermes-beta.pyth.network",
-    },
-};
-// ============================================================================
-// Pyth Lazer — external infra, defaults by network
-// ============================================================================
-/**
- * Pyth Lazer (Pyth Pro) external infra the `PythLazerRule` needs, by network.
- * Mirrors {@link PYTH_DEFAULTS}: per-network constants for infrastructure Pyth
- * operates (not part of the `waterx-config` JSON). A fuller `PYTH_INFRA`
- * restructure is deferred — this stays a minimal map until then.
- *
- * - `endpoint` — Lazer HTTP API base; signed updates come from
- *   `POST /v1/latest_price` (Bearer-authenticated). The service is
- *   network-agnostic (one signed payload verifies on any chain that trusts the
- *   Lazer signers), so both networks share the production host.
- * - `verifier_package` — the Sui package carrying
- *   `pyth_lazer::parse_and_verify_le_ecdsa_update`. Per-network: testnet is
- *   still the original v1 publish; mainnet is the v2-upgraded package (which
- *   still exposes the v1 entry `pyth_lazer_rule` binds). Values mirror the
- *   contract repo's `pyth_lazer_rule/Move.toml` published-at pins.
- */
-export const LAZER_DEFAULTS = {
-    MAINNET: {
-        endpoint: "https://pyth-lazer.dourolabs.app",
-        verifier_package: "0xefbfd064480777699fd9c557a5804d72ace7bc82661fdc8d1f1a44ea6d92ee10",
-    },
-    TESTNET: {
-        endpoint: "https://pyth-lazer.dourolabs.app",
-        verifier_package: "0xf5bd2141967507050a91b58de3d95e77c432cd90d1799ee46effc27430a68c21",
-    },
-};
+export {};

package/dist/src/oracle/host.d.ts

@@ -9,26 +9,41 @@
  */
 import type { SuiGrpcClient } from "@mysten/sui/grpc";
 import type { Network } from "../constants.ts";
-import type { OracleConfig, PythInfraConfig } from "./config.ts";
+import type { OracleConfig, PythAccessConfig, WaterxAccessConfig } from "./config.ts";
 import type { OracleSource } from "./price-update-rule.ts";
 export interface OracleHost {
-    /** Sui network this client targets — selects per-network external-infra defaults (e.g. `LAZER_DEFAULTS`). */
+    /** Sui network this client targets — each rule keys its OWN infra table by it (`PYTH_CORE_INFRA`, `LAZER_INFRA`). */
     readonly network: Network;
     /** Oracle slice of the canonical `waterx-config` JSON (rule packages + per-ticker feeds). */
     readonly config: OracleConfig;
-    /** External Pyth/Wormhole/Hermes infra — fixed per `(network, generation)`; api_key/fetch layered from create options. */
-    readonly pyth: PythInfraConfig;
+    /** Caller-supplied Pyth credential + fetch policy (create options) — NO endpoints, NO object ids. */
+    readonly pyth: PythAccessConfig;
+    /**
+     * Caller-supplied WaterX quote-center overrides for `WaterxRule`
+     * (`waterxEndpoint` / `waterxFetch` create options) — access-only, mirroring
+     * `pyth` above. OPTIONAL so an existing host stays a valid `OracleHost`;
+     * unset fields resolve against the rule's own `WATERX_INFRA[network]` table.
+     * This is the hook a browser consumer uses to route the quote-center fetch
+     * through a same-origin proxy (`endpoint`) or its own transport
+     * (`fetch.fetchImpl`) — that request is made from the page, so it is bound
+     * by the quote-center's CORS allowlist.
+     */
+    readonly waterx?: WaterxAccessConfig;
     /** gRPC client for the on-chain reads the Pyth update path needs. */
     readonly grpcClient: SuiGrpcClient;
     /**
-     * Client-selected oracle rule source for `refreshOraclePrices`'s on-chain
-     * update leg — resolved at client creation from the `oracleSource` create
-     * option (default `'pyth_rule'`). Routing is driven by this value ALONE:
-     * never by a config JSON `enabled` flag (e.g. a future `pyth_lazer_rule.enabled`)
-     * and never by `process.env` — the SDK never reads it; consumers (BE/FE) wire
-     * this option from their own env var.
+     * The FED SET for `refreshOraclePrices`'s update legs — the REQUIRED
+     * `oracleSource` create option normalized to a non-empty, deduped list.
+     * Every listed source's data is fetched and fed in one build; the chain's
+     * per-ticker weight tables decide which contributions count (feeding an
+     * unweighted rule is dropped on-chain; starving a weighted one aborts), so
+     * during weight migrations the list stays a SUPERSET of every ticker's
+     * weighted set. Routing is driven by this value ALONE: never by a config
+     * JSON `enabled` flag and never by `process.env` — the SDK never reads it;
+     * consumers (BE/FE) wire this option from their own env var
+     * (`ORACLE_SOURCE`, comma-separated).
      */
-    readonly oracleSource: OracleSource;
+    readonly oracleSources: readonly OracleSource[];
     /** True when `ticker` is priced by `constant_rule`. */
     isConstantTicker(ticker: string): boolean;
     /** The `supra_rule` config when deployed, enabled, and fully wired; else `undefined`. */