@waterx/sdk 4.1.0 → 4.3.0

package/dist/src/oracle/aggregate.js

@@ -19,7 +19,8 @@
  *
  * `refreshOraclePrices` additionally routes the on-chain price *update* leg
  * (the fetch + verify/push step, before any of the above feeding) through the
- * `PriceUpdateRule` selected by `host.oracleSource` — see `rule-registry.ts`.
+ * `PriceUpdateRule` of EVERY source in the `host.oracleSources` fed set — see
+ * `rule-registry.ts`.
  */
 import { aggregate as aggregateCall, newCollector } from "../generated/waterx_oracle/oracle.js";
 import { OracleFeeSourceUnavailableError } from "./pyth.js";
@@ -115,7 +116,13 @@ export function aggregateTicker(tx, host, args) {
         // waterx_rule::collect_batch_latest verifies the batch signature and feeds
         // this collector's symbol from the batch. If the ticker's aggregator does
         // not (yet) weight `WaterxRule`, the contribution is silently dropped
-        // on-chain — feeding ahead of the weight migration is harmless.
+        // on-chain — feeding ahead of the weight migration is safe for THIS tx.
+        // CAVEAT (unlike lazer): the feed call records a per-symbol signed-
+        // timestamp high-water mark REGARDLESS of weights, and a replayed
+        // timestamp ABORTS (`EReplayedSignature`, audit F-014) — so two PTBs
+        // carrying the same envelope for the same symbol cannot both land; the
+        // second aborts even where waterx is unweighted. See WaterxRule's module
+        // header.
         feedWaterxRule(tx, host, collector, args.waterxEnvelope);
         fed = true;
     }
@@ -167,27 +174,26 @@ export function aggregateTickerWithConstant(tx, host, args) {
  * entry, Lazer if the lazer update leg served it — see below — Supra when
  * enabled, Constant when it's a constant ticker).
  *
- * Before that, the on-chain price *update* leg is routed by `host.oracleSource`
- * (see `rule-registry.ts`): the ONE selected source serves every ticker in its
- * `supportedTickers(host)`. There is **no cross-source fallback** — a requested
- * ticker the selected source does not serve, and that is not a constant-only
- * ticker (which needs no price-update leg), fails the build immediately with a
- * clear error naming the ticker and source. That is the deliberate "fail the
- * tx-build, don't silently reroute" contract: a wrong-but-present feed id is
- * NOT validated here (it surfaces on-chain at dry-run); a MISSING feed for the
- * selected source is caught here. When the selected source's feed exists but is
- * wrong, this function does nothing special — the on-chain aggregate aborts at
- * dry-run, which is correct.
+ * Before that, the on-chain price *update* leg is routed by the
+ * `host.oracleSources` fed set (see `rule-registry.ts`): EVERY listed source
+ * updates the tickers its own `supportedTickers(host)` serves, all in this one
+ * PTB. There is **no cross-source fallback** — a requested ticker NO listed
+ * source serves, and that is not a constant-only ticker (which needs no
+ * price-update leg), fails the build immediately with a clear error naming
+ * the ticker and the list. That is the deliberate "fail the tx-build, don't
+ * silently reroute" contract: a wrong-but-present feed id is NOT validated
+ * here (it surfaces on-chain at dry-run); a ticker MISSING from every listed
+ * source's feeds is caught here.
  *
- * The selected source's fetch + build runs against its own infra, guaranteeing
- * per-rule PTB atomicity. A fee-source pre-check runs first (the source's
- * `requiresFeeSource`) BEFORE any off-chain fetch or PTB mutation — so a
- * fee-charging source with no `opts.feeSource` throws
+ * Each source's fetch + build runs against its own infra, guaranteeing
+ * per-rule PTB atomicity. A fee-source pre-check runs first (any listed
+ * source's `requiresFeeSource`) BEFORE any off-chain fetch or PTB mutation —
+ * so a fee-charging source with no `opts.feeSource` throws
  * `OracleFeeSourceUnavailable` with zero wasted network calls and zero stray
- * moveCalls. Only once that check passes does the off-chain fetch run and
- * complete before any PTB mutation; on-chain reads inside `buildUpdateCalls`
- * can still fail mid-append for other reasons — callers discard the tx on any
- * throw.
+ * moveCalls. Only once that check passes do the off-chain fetches run — in
+ * parallel across sources — and ALL settle before the first PTB mutation;
+ * on-chain reads inside `buildUpdateCalls` can still fail mid-append for
+ * other reasons — callers discard the tx on any throw.
  *
  * **Collector-feed leg is rule-aware:** a lazer-served group's
  * `buildUpdateCalls` returns the verified `Update` PTB value
@@ -208,78 +214,121 @@ export function aggregateTickerWithConstant(tx, host, args) {
 export async function refreshOraclePrices(tx, host, tickers, opts = {}) {
     if (tickers.length === 0)
         return;
+    // Dedupe the caller's list (order-preserving): a repeated ticker would
+    // otherwise aggregate TWICE in this one PTB — wasted gas for every rule,
+    // and a hard ABORT under waterx: the second `collect_batch_latest` carries
+    // the same envelope, and the on-chain per-symbol replay guard rejects an
+    // already-accepted signed timestamp (`EReplayedSignature`, F-014) even
+    // inside a single transaction.
+    tickers = [...new Set(tickers)];
     // price_info_object lookup for every ticker with a pyth_rule.feeds entry —
     // needed by aggregateTicker's (unchanged) Pyth feed step below regardless of
     // which rule performed the on-chain update for that ticker.
     const pythTickers = tickers.filter((t) => host.config.packages.pyth_rule?.feeds?.[t] !== undefined);
     const priceInfoByTicker = new Map();
     pythTickers.forEach((t) => priceInfoByTicker.set(t, host.getPythFeed(t).price_info_object));
-    // ONE source, no fallback. The selected source serves the tickers in its
-    // `supportedTickers(host)`; `source` is tracked alongside the group (rather
-    // than read back off `rule.kind`, typed as the broader PriceUpdateRuleKind)
-    // so the provider lookup below has an OracleSource to key on without a cast.
-    const selectedRule = resolveOracleRule(host.oracleSource, opts.ruleOverrides);
-    const selectedSupported = new Set(selectedRule.supportedTickers(host));
-    // Fail the tx-build (NOT client init, NOT a silent reroute) when the selected
-    // source has no feed for a requested ticker that actually needs a price
+    // The fed set is a LIST (`host.oracleSources`, normalized + deduped at
+    // client creation): ONE build carries every listed source's data, and the
+    // chain's per-ticker weight tables decide which contributions count —
+    // feeding an unweighted rule's PRICE is dropped on-chain, while starving a
+    // weighted one aborts. That asymmetry is what makes weight migrations
+    // safe: flip weights per ticker at any time while the fed set stays a
+    // superset of every ticker's weighted set. (One caveat: waterx's feed call
+    // burns a per-symbol signed-timestamp high-water mark regardless of
+    // weights — see aggregateTicker's waterx branch.) Still NO fallback
+    // BETWEEN sources: each group serves only the tickers its own feeds list.
+    // Zero-ticker groups are dropped here so everything downstream (fee check,
+    // fetch fan-out, update-leg build) can assume every group has work.
+    const groups = host.oracleSources
+        .map((source) => {
+        const rule = resolveOracleRule(source, opts.ruleOverrides);
+        const supported = new Set(rule.supportedTickers(host));
+        return { source, rule, tickers: tickers.filter((t) => supported.has(t)) };
+    })
+        .filter((group) => group.tickers.length > 0);
+    // Fail the tx-build (NOT client init, NOT a silent reroute) when NO listed
+    // source has a feed for a requested ticker that actually needs a price
     // update. Only a CONSTANT-ONLY ticker is exempt — priced entirely by
     // `constant_rule`, it needs no update leg from any source. A DUAL-FEED ticker
     // (constant AND pyth) still needs its Pyth leg refreshed, so `isConstantTicker`
-    // alone must NOT exempt it: under a source that can't serve it, with no
-    // fallback, feeding an unrefreshed Pyth leg would price it stale (or abort on a
-    // missing weighted source). `priceInfoByTicker.has(t)` ⇔ the ticker has a
-    // `pyth_rule.feeds` entry, so `constant && !hasPyth` is exactly constant-only.
-    // This catches a MISSING feed; a present-but-WRONG feed id is deliberately not
-    // validated here (it aborts on-chain at dry-run).
+    // alone must NOT exempt it: with no source able to serve it, feeding an
+    // unrefreshed Pyth leg would price it stale (or abort on a missing weighted
+    // source). `priceInfoByTicker.has(t)` ⇔ the ticker has a `pyth_rule.feeds`
+    // entry, so `constant && !hasPyth` is exactly constant-only. This catches a
+    // MISSING feed; a present-but-WRONG feed id is deliberately not validated
+    // here (it aborts on-chain at dry-run).
+    const covered = new Set(groups.flatMap((group) => group.tickers));
     const isConstantOnly = (t) => host.isConstantTicker(t) && !priceInfoByTicker.has(t);
-    const unservable = tickers.filter((t) => !selectedSupported.has(t) && !isConstantOnly(t));
+    const unservable = tickers.filter((t) => !covered.has(t) && !isConstantOnly(t));
     if (unservable.length > 0) {
-        throw new Error(`oracleSource '${host.oracleSource}' has no feed configured for ticker(s): ` +
+        const sources = host.oracleSources.join(", ");
+        throw new Error(`oracleSource [${sources}] has no feed configured for ticker(s): ` +
             `${unservable.join(", ")}. Sources are self-contained with no fallback — add ` +
-            `${host.oracleSource} feeds for them, or select a source that serves them.`);
+            `feeds for them under a listed source, or list a source that serves them.`);
     }
-    const selectedGroup = tickers.filter((t) => selectedSupported.has(t));
-    // Fee-source pre-check, hoisted ABOVE the off-chain fetch and PTB build below.
-    // It consults only `rule.requiresFeeSource` — known before any fetch or PTB
-    // mutation — so a fee-charging source with no `feeSource` throws with ZERO
-    // wasted network calls and zero PTB commands, rather than waiting for
-    // `buildPythPriceUpdateCalls`'s own per-call guard to fire after the off-chain
-    // fetch already ran.
-    if (selectedGroup.length > 0 && !opts.feeSource && selectedRule.requiresFeeSource) {
+    // Fee-source pre-check, hoisted ABOVE the off-chain fetches and PTB build
+    // below. It consults only `rule.requiresFeeSource` — known before any fetch
+    // or PTB mutation — so a fee-charging source (Pyth Core) in the fed set with
+    // no `feeSource` throws with ZERO wasted network calls and zero PTB
+    // commands, rather than waiting for `buildPythPriceUpdateCalls`'s own
+    // per-call guard to fire after the off-chain fetches already ran.
+    if (!opts.feeSource && groups.some((group) => group.rule.requiresFeeSource)) {
         throw new OracleFeeSourceUnavailableError();
     }
-    // Resolve + build the selected source's update leg. The off-chain fetch
-    // settles before the first PTB mutation, so a fetch failure never strands
-    // moveCalls in a caller-owned tx. Map each lazer-served ticker to the one
-    // verified `Update` PTB value for the collector-feed leg below.
+    // Phase 1 — resolve every group's update data IN PARALLEL: the per-source
+    // fetches (Hermes VAA / Lazer POST / quote-center GET) are independent
+    // network calls on the tx-build money path, so a multi-source fed set must
+    // not pay one RTT per source sequentially. ALL fetches settle before the
+    // first PTB mutation below, so a fetch failure never strands moveCalls in a
+    // caller-owned tx — and a failure in ANY group fails the whole build (a
+    // listed source is load-bearing; silently building without it would starve
+    // its weighted tickers on-chain).
+    const dataByGroup = await Promise.all(groups.map((group) => resolveGroupUpdateData(host, group, opts.updateDataProvider)));
+    // Phase 2 — build each group's update leg sequentially, in list order, so
+    // PTB command order stays deterministic. The carry step below is an
+    // exhaustive switch over the group's rule kind: a future source whose feed
+    // leg needs per-ticker data from its update leg must decide its carry here
+    // — falling through silently would starve its weighted tickers on-chain.
     const lazerUpdateByTicker = new Map();
     // Signed batch envelope per waterx-served ticker. Unlike Lazer's shared PTB
     // handle, waterx's verify+feed is bundled into `collect_batch_latest` in the
     // per-ticker feed leg, so its `buildUpdateCalls` emits nothing and the
     // envelope is carried straight from the group's fetched data.
     const waterxEnvelopeByTicker = new Map();
-    if (selectedGroup.length > 0) {
-        const group = { source: host.oracleSource, rule: selectedRule, tickers: selectedGroup };
-        const data = await resolveGroupUpdateData(host, group, opts.updateDataProvider);
-        const handle = (await selectedRule.buildUpdateCalls(tx, host, data, {
+    for (const [i, group] of groups.entries()) {
+        const data = dataByGroup[i] ?? null;
+        const handle = (await group.rule.buildUpdateCalls(tx, host, data, {
             cache: opts.cache,
             feeSource: opts.feeSource,
         })) ?? undefined;
-        // Route by the handle's kind discriminant — the one site the tag exists to
-        // protect: a future non-lazer handle must never be silently fed into
-        // pyth_lazer_rule::feed.
-        if (handle?.kind === "pyth_lazer_rule") {
-            for (const ticker of selectedGroup)
-                lazerUpdateByTicker.set(ticker, handle.update);
-        }
-        // waterx_rule emits no shared handle (verify+feed is bundled into the
-        // per-ticker `collect_batch_latest`), so the envelope is carried straight
-        // from this group's fetched data to the feed leg below.
-        if (selectedRule.kind === "waterx_rule") {
-            const envelope = waterxEnvelopeOf(data);
-            if (envelope) {
-                for (const ticker of selectedGroup)
-                    waterxEnvelopeByTicker.set(ticker, envelope);
+        switch (group.rule.kind) {
+            case "pyth_rule":
+                // Core's update leg wrote the PriceInfoObjects in place — the feed
+                // leg reads them by id (`priceInfoByTicker`), nothing to carry.
+                break;
+            case "pyth_lazer_rule":
+                // Route by the handle's kind discriminant — the tag exists so a
+                // non-lazer handle can never be silently fed into
+                // pyth_lazer_rule::feed.
+                if (handle?.kind === "pyth_lazer_rule") {
+                    for (const ticker of group.tickers)
+                        lazerUpdateByTicker.set(ticker, handle.update);
+                }
+                break;
+            case "waterx_rule": {
+                // waterx_rule emits no shared handle (verify+feed is bundled into the
+                // per-ticker `collect_batch_latest`), so the envelope is carried
+                // straight from this group's fetched data to the feed leg below.
+                const envelope = waterxEnvelopeOf(data);
+                if (envelope) {
+                    for (const ticker of group.tickers)
+                        waterxEnvelopeByTicker.set(ticker, envelope);
+                }
+                break;
+            }
+            default: {
+                const exhausted = group.rule.kind;
+                throw new Error(`refreshOraclePrices: unhandled rule kind '${String(exhausted)}'`);
             }
         }
     }

package/dist/src/oracle/config.d.ts

@@ -11,7 +11,6 @@
  */
 import type { BasePackageEntry } from "../account/config.ts";
 import type { BaseLineConfig } from "../base-client.ts";
-import type { Network } from "../constants.ts";
 import type { FetchPolicy } from "./update-fetch.ts";
 export interface PythRulePackage extends BasePackageEntry {
     config: string;
@@ -31,7 +30,7 @@ export interface PythSponsorRulePackage extends BasePackageEntry {
  *
  * `enabled` mirrors the JSON field verbatim but MUST NOT be read for routing —
  * which rule prices a ticker is decided solely by the client's `oracleSource`
- * create option (see `OracleHost.oracleSource`), never by this flag or any
+ * create option (see `OracleHost.oracleSources`), never by this flag or any
  * other config value.
  */
 export interface PythLazerRulePackage extends BasePackageEntry {
@@ -99,11 +98,12 @@ export interface WaterxRuleFeedEntry {
  * Read by `WaterxRule` (`rules/waterx-rule.ts`): `feeds` for ticker support,
  * `config`/`enclave_config`/`enclave` for the `collect_batch_latest` call,
  * `published_at` for the package address. The off-chain signed price is pulled
- * from the quote-center (endpoint from {@link WATERX_DEFAULTS}), not this JSON.
+ * from the quote-center (endpoint from the rule-owned `WATERX_INFRA` table in
+ * `rules/waterx-rule.ts`), not this JSON.
  *
  * `enabled` mirrors the JSON field verbatim but MUST NOT be read for routing —
  * which rule prices a ticker is decided solely by the client's `oracleSource`
- * create option (see `OracleHost.oracleSource`), mirroring `pyth_lazer_rule`.
+ * create option (see `OracleHost.oracleSources`), mirroring `pyth_lazer_rule`.
  */
 export interface WaterxRulePackage extends BasePackageEntry {
     /** Shared `waterx_rule::Config` (per-symbol on-chain feed_config). */
@@ -137,17 +137,6 @@ export interface OraclePackages {
     waterx_rule?: WaterxRulePackage;
     waterx_oracle: WaterxOraclePackage;
 }
-/**
- * Resolved Pyth Core infra as it lives on `client.pyth` — NOT a config-JSON
- * shape. `state_id` / `wormhole_state_id` / `hermes_endpoint` come verbatim
- * from the fixed per-network constant ({@link PYTH_DEFAULTS}); `api_key` /
- * `fetch` are layered on from the caller's `pythApiKey` / `pythFetch` create
- * options. None of it is sourced from the canonical `waterx-config` JSON — the
- * SDK never reads a `pyth` block there (a Bearer secret has no place in a
- * public CDN document). The infra is the same for every `oracleSource`; the
- * `pyth_lazer_rule` source reads only the `api_key` / `fetch` from here and
- * gets its on-chain infra from {@link LAZER_DEFAULTS} + config instead.
- */
 /**
  * The caller-tunable subset of `fetchWithPolicy`'s policy exposed on the
  * `pythFetch` create option and `client.pyth.fetch` — the retry/timeout budget
@@ -160,18 +149,24 @@ export type PythFetchPolicy = {
     timeoutMs?: number;
     retries?: number;
 };
-export interface PythInfraConfig {
-    state_id: string;
-    wormhole_state_id: string;
-    hermes_endpoint: string;
+/**
+ * `client.pyth` — ONLY the caller-supplied Pyth credential + fetch policy,
+ * shared by the Pyth-family rules (`pyth_rule`, `pyth_lazer_rule`). It carries
+ * NO endpoints and NO on-chain object ids: every oracle source owns its own
+ * infra, co-located with its rule (`PYTH_CORE_INFRA` in `oracle/pyth.ts`;
+ * the Lazer constants inside `rules/pyth-lazer-rule.ts`). A non-Pyth source
+ * never reads this slice.
+ * Nothing here is sourced from the canonical `waterx-config` JSON — a Bearer
+ * secret has no place in a public CDN document.
+ */
+export interface PythAccessConfig {
     /**
-     * Pyth Pro / Lazer access token (`Authorization: Bearer …`) for
+     * Pyth access token (`Authorization: Bearer …`). Required by
      * `PythLazerRule`'s signed-update fetch — Lazer is auth-first, so there is
-     * no keyless default. Optional: Pyth-Core-only deployments never need it.
-     * Supplied via the `pythApiKey` create option (the SDK never reads
-     * `process.env` or the config JSON). Absent when a lazer-routed fetch runs →
-     * `LazerApiKeyMissing` is thrown at fetch time. As of the Pyth Pro
-     * migration (post-2026-08-18, per
+     * no keyless default; absent when a lazer-routed fetch runs →
+     * `LazerApiKeyMissing` is thrown at fetch time. Supplied via the
+     * `pythApiKey` create option (the SDK never reads `process.env` or the
+     * config JSON). As of the Pyth Pro migration (post-2026-08-18, per
      * https://docs.pyth.network/price-feeds/core/upgrade) this is ALSO required
      * for `pyth_rule`'s Hermes fetch (`fetchPriceFeedsUpdateData`) — see
      * `fetch` below.
@@ -187,66 +182,37 @@ export interface PythInfraConfig {
      */
     fetch?: PythFetchPolicy;
 }
-export declare const PYTH_DEFAULTS: Record<Network, PythInfraConfig>;
-/**
- * Pyth Lazer (Pyth Pro) external infra the `PythLazerRule` needs, by network.
- * Mirrors {@link PYTH_DEFAULTS}: per-network constants for infrastructure Pyth
- * operates (not part of the `waterx-config` JSON). A fuller `PYTH_INFRA`
- * restructure is deferred — this stays a minimal map until then.
- *
- * - `endpoint` — Lazer HTTP API base; signed updates come from
- *   `POST /v1/latest_price` (Bearer-authenticated). The service is
- *   network-agnostic (one signed payload verifies on any chain that trusts the
- *   Lazer signers), so both networks share the production host.
- * - `verifier_package` — the Sui package carrying
- *   `pyth_lazer::parse_and_verify_le_ecdsa_update`. Per-network: testnet is
- *   still the original v1 publish; mainnet is the v2-upgraded package (which
- *   still exposes the v1 entry `pyth_lazer_rule` binds). Values mirror the
- *   contract repo's `pyth_lazer_rule/Move.toml` published-at pins.
- */
-export declare const LAZER_DEFAULTS: Record<Network, {
-    endpoint: string;
-    verifier_package: string;
-}>;
 /**
- * Resolved WaterX quote-center infra for `WaterxRule` — the network default
- * from {@link WATERX_DEFAULTS}, with both fields overridable at client init
- * (`waterxEndpoint` / `waterxFetch`).
+ * `client.waterx` — ONLY the caller-supplied quote-center overrides for
+ * `WaterxRule`, mirroring {@link PythAccessConfig}: no resolved infra lives on
+ * the client. When a field is unset the rule resolves it against its OWN
+ * per-network table (`WATERX_INFRA` in `rules/waterx-rule.ts`) — no other
+ * source's endpoint or policy is ever consulted.
  *
- * The override exists because this is the one oracle source a BROWSER fetches
- * itself: the rule pulls the signed envelope from the page, so it is subject to
- * the quote-center deployment's CORS allowlist. A front end whose origin is not
- * on that list — or one that must route egress through its own backend — points
- * `endpoint` at a same-origin proxy (or supplies `fetch.fetchImpl`) instead of
- * being locked to the hardcoded host.
+ * The endpoint override exists because this is the one oracle source a BROWSER
+ * fetches itself: the rule pulls the signed envelope from the page, so it is
+ * subject to the quote-center deployment's CORS allowlist. A front end whose
+ * origin is not on that list — or one that must route egress through its own
+ * backend — points `endpoint` at a same-origin proxy (or supplies
+ * `fetch.fetchImpl`) instead of being locked to the default host.
  */
-export interface WaterxInfraConfig {
+export interface WaterxAccessConfig {
     /**
-     * Quote-center base URL. A base PATH is preserved — the rule appends via
-     * `joinEndpointPath`, so `https://app.example/api/quote-center` resolves to
+     * Quote-center base URL override (`waterxEndpoint` create option). A base
+     * PATH is preserved — the rule appends via `joinEndpointPath`, so
+     * `https://app.example/api/quote-center` resolves to
      * `…/api/quote-center/v1/quotes/update` and a proxy route is not rewritten
      * away. A trailing slash is trimmed.
      */
-    endpoint: string;
+    endpoint?: string;
     /**
      * Retry/timeout policy (and `fetchImpl`) for the quote-center fetch — see
      * `fetchWithPolicy` (`./update-fetch.ts`). Supplied via the `waterxFetch`
-     * create option. When unset the rule falls back to the shared `pyth.fetch`
-     * policy, then to `fetchWithPolicy`'s defaults (15s timeout, 2 retries).
+     * create option. Falls back to `fetchWithPolicy`'s built-in defaults (15s
+     * timeout, 2 retries) when unset — never to another source's policy.
      */
     fetch?: FetchPolicy;
 }
-/**
- * WaterX quote-center base URL by network — the first-party TEE-signed price
- * hub `WaterxRule` pulls from (`GET /v1/quotes/update?symbols=…`). Mirrors
- * {@link LAZER_DEFAULTS}: infra WaterX operates, not part of the `waterx-config`
- * JSON. Public read (no auth), so there is no api_key. `endpoint` has no
- * trailing slash — the rule appends the path.
- *
- * These are DEFAULTS, not a hard pin: a consumer overrides them per client via
- * `waterxEndpoint` / `waterxFetch` (resolved onto `client.waterx`).
- */
-export declare const WATERX_DEFAULTS: Record<Network, WaterxInfraConfig>;
 /**
  * The narrow config shape the oracle/refresh code needs. `WaterXConfig`
  * (the perp line's full config) is assignable to this, so `PerpClient` satisfies

package/dist/src/oracle/config.js

@@ -9,58 +9,4 @@
  * depends on this shared schema instead of the perp line's full config —
  * mirrors the earlier account-config hoist.
  */
-export const PYTH_DEFAULTS = {
-    MAINNET: {
-        state_id: "0x1f9310238ee9298fb703c3419030b35b22bb1cc37113e3bb5007c99aec79e5b8",
-        wormhole_state_id: "0xaeab97f96cf9877fee2883315d459552b2b921edc16d7ceac6eab944dd88919c",
-        hermes_endpoint: "https://hermes.pyth.network",
-    },
-    TESTNET: {
-        state_id: "0x243759059f4c3111179da5878c12f68d612c21a8d54d85edc86164bb18be1c7c",
-        wormhole_state_id: "0x31358d198147da50db32eda2562951d53973a0c0ad5ed738e9b17d88b213d790",
-        hermes_endpoint: "https://hermes-beta.pyth.network",
-    },
-};
-// ============================================================================
-// Pyth Lazer — external infra, defaults by network
-// ============================================================================
-/**
- * Pyth Lazer (Pyth Pro) external infra the `PythLazerRule` needs, by network.
- * Mirrors {@link PYTH_DEFAULTS}: per-network constants for infrastructure Pyth
- * operates (not part of the `waterx-config` JSON). A fuller `PYTH_INFRA`
- * restructure is deferred — this stays a minimal map until then.
- *
- * - `endpoint` — Lazer HTTP API base; signed updates come from
- *   `POST /v1/latest_price` (Bearer-authenticated). The service is
- *   network-agnostic (one signed payload verifies on any chain that trusts the
- *   Lazer signers), so both networks share the production host.
- * - `verifier_package` — the Sui package carrying
- *   `pyth_lazer::parse_and_verify_le_ecdsa_update`. Per-network: testnet is
- *   still the original v1 publish; mainnet is the v2-upgraded package (which
- *   still exposes the v1 entry `pyth_lazer_rule` binds). Values mirror the
- *   contract repo's `pyth_lazer_rule/Move.toml` published-at pins.
- */
-export const LAZER_DEFAULTS = {
-    MAINNET: {
-        endpoint: "https://pyth-lazer.dourolabs.app",
-        verifier_package: "0xefbfd064480777699fd9c557a5804d72ace7bc82661fdc8d1f1a44ea6d92ee10",
-    },
-    TESTNET: {
-        endpoint: "https://pyth-lazer.dourolabs.app",
-        verifier_package: "0xf5bd2141967507050a91b58de3d95e77c432cd90d1799ee46effc27430a68c21",
-    },
-};
-/**
- * WaterX quote-center base URL by network — the first-party TEE-signed price
- * hub `WaterxRule` pulls from (`GET /v1/quotes/update?symbols=…`). Mirrors
- * {@link LAZER_DEFAULTS}: infra WaterX operates, not part of the `waterx-config`
- * JSON. Public read (no auth), so there is no api_key. `endpoint` has no
- * trailing slash — the rule appends the path.
- *
- * These are DEFAULTS, not a hard pin: a consumer overrides them per client via
- * `waterxEndpoint` / `waterxFetch` (resolved onto `client.waterx`).
- */
-export const WATERX_DEFAULTS = {
-    MAINNET: { endpoint: "https://quote-center.waterx.app" },
-    TESTNET: { endpoint: "https://quote-center-staging.waterx.app" },
-};
+export {};

package/dist/src/oracle/host.d.ts

@@ -9,37 +9,41 @@
  */
 import type { SuiGrpcClient } from "@mysten/sui/grpc";
 import type { Network } from "../constants.ts";
-import type { OracleConfig, PythInfraConfig, WaterxInfraConfig } from "./config.ts";
+import type { OracleConfig, PythAccessConfig, WaterxAccessConfig } from "./config.ts";
 import type { OracleSource } from "./price-update-rule.ts";
 export interface OracleHost {
-    /** Sui network this client targets — selects per-network external-infra defaults (e.g. `LAZER_DEFAULTS`). */
+    /** Sui network this client targets — each rule keys its OWN infra table by it (`PYTH_CORE_INFRA`, `LAZER_INFRA`). */
     readonly network: Network;
     /** Oracle slice of the canonical `waterx-config` JSON (rule packages + per-ticker feeds). */
     readonly config: OracleConfig;
-    /** External Pyth/Wormhole/Hermes infra — fixed per `(network, generation)`; api_key/fetch layered from create options. */
-    readonly pyth: PythInfraConfig;
+    /** Caller-supplied Pyth credential + fetch policy (create options) — NO endpoints, NO object ids. */
+    readonly pyth: PythAccessConfig;
     /**
-     * WaterX quote-center infra for `WaterxRule` — endpoint + fetch policy,
-     * resolved from the `waterxEndpoint` / `waterxFetch` create options.
-     *
-     * OPTIONAL so an existing host stays a valid `OracleHost`: when absent the
-     * rule falls back to `WATERX_DEFAULTS[network]`. This is the hook a browser
-     * consumer uses to route the quote-center fetch through a same-origin proxy
-     * (`endpoint`) or its own transport (`fetch.fetchImpl`) — that request is
-     * made from the page, so it is bound by the quote-center's CORS allowlist.
+     * Caller-supplied WaterX quote-center overrides for `WaterxRule`
+     * (`waterxEndpoint` / `waterxFetch` create options) — access-only, mirroring
+     * `pyth` above. OPTIONAL so an existing host stays a valid `OracleHost`;
+     * unset fields resolve against the rule's own `WATERX_INFRA[network]` table.
+     * This is the hook a browser consumer uses to route the quote-center fetch
+     * through a same-origin proxy (`endpoint`) or its own transport
+     * (`fetch.fetchImpl`) — that request is made from the page, so it is bound
+     * by the quote-center's CORS allowlist.
      */
-    readonly waterx?: WaterxInfraConfig;
+    readonly waterx?: WaterxAccessConfig;
     /** gRPC client for the on-chain reads the Pyth update path needs. */
     readonly grpcClient: SuiGrpcClient;
     /**
-     * Client-selected oracle rule source for `refreshOraclePrices`'s on-chain
-     * update leg — resolved at client creation from the `oracleSource` create
-     * option (default `'pyth_rule'`). Routing is driven by this value ALONE:
-     * never by a config JSON `enabled` flag (e.g. a future `pyth_lazer_rule.enabled`)
-     * and never by `process.env` — the SDK never reads it; consumers (BE/FE) wire
-     * this option from their own env var.
+     * The FED SET for `refreshOraclePrices`'s update legs — the REQUIRED
+     * `oracleSource` create option normalized to a non-empty, deduped list.
+     * Every listed source's data is fetched and fed in one build; the chain's
+     * per-ticker weight tables decide which contributions count (feeding an
+     * unweighted rule is dropped on-chain; starving a weighted one aborts), so
+     * during weight migrations the list stays a SUPERSET of every ticker's
+     * weighted set. Routing is driven by this value ALONE: never by a config
+     * JSON `enabled` flag and never by `process.env` — the SDK never reads it;
+     * consumers (BE/FE) wire this option from their own env var
+     * (`ORACLE_SOURCE`, comma-separated).
      */
-    readonly oracleSource: OracleSource;
+    readonly oracleSources: readonly OracleSource[];
     /** True when `ticker` is priced by `constant_rule`. */
     isConstantTicker(ticker: string): boolean;
     /** The `supra_rule` config when deployed, enabled, and fully wired; else `undefined`. */

package/dist/src/oracle/index.d.ts

@@ -18,15 +18,17 @@
 export type { OracleHost } from "./host.ts";
 export { FetchPolicyError, fetchWithPolicy, joinEndpointPath } from "./update-fetch.ts";
 export type { FetchPolicy } from "./update-fetch.ts";
-export { PythCache, fetchPriceFeedsUpdateData, endpointSupportedFeedIds, probeMissingFeeds, buildPythPriceUpdateCalls, updatePythPrices, HermesEndpointRejectedAllFeedsError, MISSING_FEED_MEMO_TTL_MS, OracleFeeSourceUnavailableError, } from "./pyth.ts";
+export { PythCache, fetchPriceFeedsUpdateData, endpointSupportedFeedIds, probeMissingFeeds, buildPythPriceUpdateCalls, pythCoreHermesEndpoint, pythProHermesEndpoint, PYTH_PRO_HERMES_ENDPOINT, updatePythPrices, HermesEndpointRejectedAllFeedsError, MISSING_FEED_MEMO_TTL_MS, OracleFeeSourceUnavailableError, } from "./pyth.ts";
 export type { OracleFeeSource } from "./pyth.ts";
 export type { PriceUpdateRule, PriceUpdateRuleKind, RuleUpdateData, RuleUpdateHandle, BuildUpdateOpts, OracleSource, UpdateDataProvider, } from "./price-update-rule.ts";
+export { resolveOracleReadPlan, resolveHermesReadEndpoint } from "./read-plane.ts";
+export type { OracleReadPlan } from "./read-plane.ts";
 export { PythCoreRule } from "./rules/pyth-core-rule.ts";
 export type { PythCoreUpdatePayload } from "./rules/pyth-core-rule.ts";
 export { PythLazerRule, LazerApiKeyMissingError } from "./rules/pyth-lazer-rule.ts";
 export type { PythLazerUpdatePayload } from "./rules/pyth-lazer-rule.ts";
-export { WaterxRule, parseSignedEnvelope } from "./rules/waterx-rule.ts";
+export { WaterxRule, parseSignedEnvelope, BATCH_PRICE_INTENT, WATERX_INFRA, waterxQuoteCenterEndpoint, } from "./rules/waterx-rule.ts";
 export type { WaterxUpdatePayload, WaterxSignedEnvelope, WaterxBatchItem, } from "./rules/waterx-rule.ts";
-export { OracleSourceNotImplementedError } from "./rule-registry.ts";
+export { OracleSourceNotImplementedError, resolveOracleRule } from "./rule-registry.ts";
 export { aggregateTicker, aggregateTickerWithPyth, aggregateTickerWithConstant, refreshOraclePrices, } from "./aggregate.ts";
 export { openPythSponsorFund, reimbursePythSponsor } from "./rules/sponsor.ts";

package/dist/src/oracle/index.js

@@ -33,24 +33,39 @@ export { FetchPolicyError, fetchWithPolicy, joinEndpointPath } from "./update-fe
 // branch on the fee-source failure directly, and a consumer of
 // `fetchPriceFeedsUpdateData` / `probeMissingFeeds` can tell a misconfigured
 // or unentitled endpoint apart from feeds that endpoint genuinely lacks.
-export { PythCache, fetchPriceFeedsUpdateData, endpointSupportedFeedIds, probeMissingFeeds, buildPythPriceUpdateCalls, updatePythPrices, HermesEndpointRejectedAllFeedsError, MISSING_FEED_MEMO_TTL_MS, OracleFeeSourceUnavailableError, } from "./pyth.js";
+export { PythCache, fetchPriceFeedsUpdateData, endpointSupportedFeedIds, probeMissingFeeds, buildPythPriceUpdateCalls, 
+// The pyth read-plane endpoint accessors — Core (keyless, per network) and
+// Pro (the documented fixed base; auth via the caller's Bearer key). There
+// is no client-level endpoint field: consumers pick via
+// `resolveHermesReadEndpoint` (pyth_rule listed → Core, else override ??
+// Pro) — never a hand-rolled branch, never a cross-source fallback.
+pythCoreHermesEndpoint, pythProHermesEndpoint, PYTH_PRO_HERMES_ENDPOINT, updatePythPrices, HermesEndpointRejectedAllFeedsError, MISSING_FEED_MEMO_TTL_MS, OracleFeeSourceUnavailableError, } from "./pyth.js";
+// Per-source READ-plane resolution — which tickers a source can price
+// off-chain and with which ids (`resolveOracleReadPlan`), and which
+// Hermes-compatible base the hermes plans execute against
+// (`resolveHermesReadEndpoint`: pyth_rule listed → Core, else override ??
+// the documented Pyth Pro base). The one place the "lazer reads through
+// `pyth_rule.feeds` hex ids" invariant lives; consumers resolve through
+// this instead of hardcoding namespace sharing or endpoint branching.
+export { resolveOracleReadPlan, resolveHermesReadEndpoint } from "./read-plane.js";
 // Pyth Core rule (PriceUpdateRule wrapper over the Pyth source above)
 export { PythCoreRule } from "./rules/pyth-core-rule.js";
 // Pyth Lazer rule (signed-update generation; `feedLazerRule` stays internal to `aggregate.ts`)
 // `LazerApiKeyMissingError` is re-exported (not just the type) for the same
 // `instanceof` reason as `OracleFeeSourceUnavailableError` above.
 export { PythLazerRule, LazerApiKeyMissingError } from "./rules/pyth-lazer-rule.js";
+// `WATERX_INFRA` / `waterxQuoteCenterEndpoint` are the source's own infra table +
+// read-plane accessor (mirrors `pythCoreHermesEndpoint`).
 // WaterX quote-center rule (first-party ed25519 signed batches; `feedWaterxRule`
 // stays internal to `aggregate.ts`).
-export { WaterxRule, parseSignedEnvelope } from "./rules/waterx-rule.js";
-// `resolveOracleRule` (rule-registry.ts) is NOT re-exported here — it has one
-// production consumer (`refreshOraclePrices` below) and no external caller;
-// per repo convention ("no unused exports") it stays module-internal. Tests
-// import it directly from `./rule-registry.ts`. `OracleSourceNotImplementedError`
-// IS re-exported (the same `instanceof` reason as `OracleFeeSourceUnavailableError`
-// above) — a consumer of `refreshOraclePrices` can catch it without importing
-// `resolveOracleRule` itself.
-export { OracleSourceNotImplementedError } from "./rule-registry.js";
+export { WaterxRule, parseSignedEnvelope, BATCH_PRICE_INTENT, WATERX_INFRA, waterxQuoteCenterEndpoint, } from "./rules/waterx-rule.js";
+// `resolveOracleRule` is the ONE source→rule registry — exported so external
+// consumers (e.g. a BE prefetch cache that keys per source and needs each
+// source's `supportedTickers`/`fetchUpdateData`) resolve through it instead of
+// hand-mirroring the map and drifting. `OracleSourceNotImplementedError` is
+// its `instanceof`-able failure (same reason as `OracleFeeSourceUnavailableError`
+// above).
+export { OracleSourceNotImplementedError, resolveOracleRule } from "./rule-registry.js";
 // Aggregation orchestrator
 export { aggregateTicker, aggregateTickerWithPyth, aggregateTickerWithConstant, refreshOraclePrices, } from "./aggregate.js";
 // Sponsor rule (fund open / reimburse + witness attach)