@waterx/sdk 4.1.0 → 4.3.0

package/dist/src/oracle/rules/waterx-rule.js

@@ -4,7 +4,7 @@
  * `aggregateTicker` appends per waterx-routed ticker. Pulls one enclave-signed
  * batch envelope covering every requested ticker from the quote-center
  * (`GET /v1/quotes/update?symbols=…`, endpoint from `host.waterx` — the
- * `waterxEndpoint`/`waterxFetch` create options — else `WATERX_DEFAULTS`), then —
+ * `waterxEndpoint`/`waterxFetch` create options — else its own `WATERX_INFRA`), then —
  * unlike Pyth Lazer, whose verify is a single shared PTB step — verifies AND
  * feeds in ONE `waterx_rule::collect_batch_latest` call per collector (the Move
  * API bundles the two). So `buildUpdateCalls` emits nothing and the signed
@@ -13,16 +13,50 @@
  * `collect_batch_latest` is the dual-rule path: it feeds the item matching
  * `collector.symbol()` WITHOUT aggregating, so a waterx-routed ticker composes
  * onto the same collector as Pyth/Supra (compose-then-aggregate). On-chain a
- * freshness miss / replayed timestamp ABSTAINS (the other weighted rules
- * cover); a config/integrity mismatch or bad signature aborts.
+ * FRESHNESS miss ABSTAINS (the other weighted rules cover); a config/
+ * integrity mismatch, bad signature, future timestamp — or a REPLAYED signed
+ * timestamp — ABORTS (`EReplayedSignature`, audit F-014: a signed tuple is
+ * single-use per symbol, enforced by a per-symbol high-water mark BEFORE any
+ * weight arbitration). Consequence for concurrent builds: two PTBs carrying
+ * the same envelope for the same symbol cannot both land — the second aborts
+ * even if the rule is unweighted for that ticker. Never share one fetched
+ * envelope across builds that may execute concurrently for the same symbol.
  */
 import { fromHex } from "@mysten/bcs";
 import { collectBatchLatest, newBatchItem, newBatchPayload, pushBatchItem, } from "../../generated/waterx_rule/waterx_rule.js";
-import { WATERX_DEFAULTS } from "../config.js";
 import { assertRuleUpdateData, } from "../price-update-rule.js";
 import { FetchPolicyError, fetchWithPolicy, joinEndpointPath, } from "../update-fetch.js";
-/** The single signing intent (`BATCH_PRICE_INTENT`) the quote-center emits. */
-const BATCH_PRICE_INTENT = 1;
+/** The single signing intent the quote-center emits — exported so read-plane
+ *  consumers can mirror the rule's own envelope intent check (a mispointed
+ *  endpoint must be rejected by reads exactly as tx-builds reject it). */
+export const BATCH_PRICE_INTENT = 1;
+/**
+ * WaterX quote-center external infra — owned by THIS source, by network.
+ * Mirrors `PYTH_CORE_INFRA` (oracle/pyth.ts) and `LAZER_INFRA`
+ * (rules/pyth-lazer-rule.ts): per-network constants for infrastructure the
+ * source's operator runs, co-located with the only rule that reads them — no
+ * other oracle source ever touches a quote-center endpoint. Public read (no
+ * auth), so there is no api_key. `endpoint` has no trailing slash — the rule
+ * appends the path.
+ *
+ * These are the DEFAULTS behind the caller's `client.waterx` access slice
+ * (`waterxEndpoint` / `waterxFetch` create options) — the browser-CORS proxy
+ * hook, since this is the one source fetched from the page.
+ */
+export const WATERX_INFRA = {
+    MAINNET: { endpoint: "https://quote-center.waterx.app" },
+    TESTNET: { endpoint: "https://quote-center-staging.waterx.app" },
+};
+/**
+ * The waterx source's quote-center base for `network` — the ONE accessor
+ * consumers (BE/FE read planes) use when, and only when, their own
+ * `ORACLE_SOURCE` resolves to `'waterx_rule'`. Mirrors
+ * `pythCoreHermesEndpoint`. Under any other source the read endpoint is that
+ * source's own configuration — never this one.
+ */
+export function waterxQuoteCenterEndpoint(network) {
+    return WATERX_INFRA[network].endpoint;
+}
 /**
  * Shape check ONLY — the `kind` discriminant is checked separately by the
  * caller before this runs (mirrors the other rules' guard split), so a
@@ -84,18 +118,21 @@ function requireWaterxPackage(host) {
     return entry;
 }
 /**
- * Resolve the quote-center infra for this host: the `waterxEndpoint` /
- * `waterxFetch` create options when the client carries them, else the network
- * default. The fetch policy falls back to the shared `pyth.fetch` policy so a
- * consumer that already tuned timeouts/retries once keeps them here.
+ * Resolve the quote-center infra for this host: each field independently from
+ * the caller's `client.waterx` access slice (`waterxEndpoint` / `waterxFetch`
+ * create options) when set, else this source's own `WATERX_INFRA` default /
+ * `fetchWithPolicy`'s built-ins. Deliberately NO fallback onto `pyth.fetch`
+ * or any other source's policy — sources stay fully independent.
  *
  * This is the seam a browser consumer needs: the envelope is fetched FROM THE
  * PAGE, so a front end whose origin the quote-center does not allow (CORS)
  * points `endpoint` at a same-origin proxy, or supplies its own `fetchImpl`.
  */
 function resolveWaterxInfra(host) {
-    const infra = host.waterx ?? WATERX_DEFAULTS[host.network];
-    return { endpoint: infra.endpoint, fetch: infra.fetch ?? host.pyth.fetch };
+    return {
+        endpoint: host.waterx?.endpoint ?? WATERX_INFRA[host.network].endpoint,
+        fetch: host.waterx?.fetch,
+    };
 }
 /**
  * Pull one enclave-signed batch envelope covering `symbols` from the
@@ -151,8 +188,10 @@ function decodeSig(hex) {
  * per item, the exact shape the enclave signed) and contribute the price for
  * `collector.symbol()` to the collector. One collect call re-verifies the batch
  * signature and picks this collector's symbol out of the batch; on-chain it
- * abstains (records `none`) instead of aborting when the symbol is stale,
- * absent from the batch, or its timestamp was already accepted (replay).
+ * abstains (records `none`) when the symbol is stale or absent from the batch,
+ * but ABORTS `EReplayedSignature` when the symbol's signed timestamp was
+ * already accepted (per-symbol high-water mark, audit F-014) — see the module
+ * header for the concurrent-build consequence.
  */
 export function feedWaterxRule(tx, host, collector, envelope) {
     const wr = requireWaterxPackage(host);

package/dist/src/perp/client.d.ts

@@ -13,35 +13,48 @@
 import { BaseLineClient } from "../base-client.ts";
 import type { OracleSource } from "../oracle/price-update-rule.ts";
 import type { FetchPolicy } from "../oracle/update-fetch.ts";
-import { type LoadConfigOptions, type PythFetchPolicy, type PythInfraConfig, type WaterXConfig, type WaterxInfraConfig, type WormholeInfraConfig } from "./config.ts";
+import { type LoadConfigOptions, type PythAccessConfig, type PythFetchPolicy, type WaterxAccessConfig, type WaterXConfig, type WormholeInfraConfig } from "./config.ts";
 import type { Network } from "./constants.ts";
 export interface CreateClientOptions extends LoadConfigOptions {
     grpcUrl?: string;
     /**
-     * Which oracle price-update source drives `refreshOraclePrices`. Each source
-     * is self-contained (own infra + config) with NO cross-source fallback:
+     * Which oracle price-update source drives `refreshOraclePrices`. REQUIRED —
+     * there is NO default source: every deployment names its source explicitly
+     * (wire it from your own env var, e.g. `ORACLE_SOURCE`). Each source is
+     * self-contained (own infra, own endpoints, own config) with NO cross-source
+     * fallback:
      *
-     * - `'pyth_rule'` (default) — Pyth Core `pyth_rule` updates (Hermes VAA +
-     *   per-feed update fees), Core state + keyless Core Hermes.
+     * - `'pyth_rule'` — Pyth Core `pyth_rule` updates (Hermes VAA + per-feed
+     *   update fees); Core state + Hermes endpoint live in the source's own
+     *   `PYTH_CORE_INFRA` table.
      * - `'pyth_lazer_rule'` — Pyth Lazer signed updates (ONE `leEcdsa` verify
      *   per PTB, no per-feed fees); needs `packages.pyth_lazer_rule` with feeds
-     *   and a `pythApiKey` (Lazer is auth-first).
+     *   and a `pythApiKey` (Lazer is auth-first); Lazer infra lives in the
+     *   source's own `LAZER_INFRA` table.
      * - `'waterx_rule'` — the first-party WaterX quote-center (Nautilus-TEE,
      *   ed25519-signed batches): ONE envelope covering the build's tickers,
      *   verified AND fed by a single `collect_batch_latest` per collector. No
      *   credential and no per-update fee; needs `packages.waterx_rule` with
-     *   feeds. Endpoint/transport via {@link CreateClientOptions.waterxEndpoint}
-     *   / {@link CreateClientOptions.waterxFetch} — the browser-CORS proxy hook,
+     *   feeds. Quote-center infra lives in the source's own `WATERX_INFRA`
+     *   table; endpoint/transport overridable via
+     *   {@link CreateClientOptions.waterxEndpoint} /
+     *   {@link CreateClientOptions.waterxFetch} — the browser-CORS proxy hook,
      *   since this is the one source fetched from the page.
      *
      * The name is source-neutral on purpose — a source need not be Pyth (as
      * `'waterx_rule'` shows). Selecting a source whose feed for a requested
      * ticker is absent is NOT an error at client creation: it fails at tx-build
-     * time for exactly those tickers (see `refreshOraclePrices`). The Pyth Core
-     * infra is fixed per network by `PYTH_DEFAULTS` and is not
-     * deployment-overridable.
+     * time for exactly those tickers (see `refreshOraclePrices`).
+     *
+     * Accepts a SINGLE source or a LIST. A list means every listed source's
+     * data is fetched and fed in one build — required whenever the on-chain
+     * weight tables have more than one rule weighted (e.g. a Core→Pro or
+     * Pro+Waterx coexistence window): the chain drops unweighted contributions
+     * (harmless) but aborts on a starved weighted rule, so the list must stay a
+     * SUPERSET of every ticker's weighted set. Order is meaningful to consumers
+     * (read-plane priority), not to the on-chain build.
      */
-    oracleSource?: OracleSource;
+    oracleSource: OracleSource | OracleSource[];
     /**
      * Pyth Lazer access token (`Authorization: Bearer …`). Required under
      * `oracleSource: 'pyth_lazer_rule'` (Lazer is auth-first) and unused by
@@ -57,7 +70,7 @@ export interface CreateClientOptions extends LoadConfigOptions {
     pythFetch?: PythFetchPolicy;
     /**
      * Quote-center base URL for `oracleSource: 'waterx_rule'` — overrides the
-     * per-network {@link WATERX_DEFAULTS} host.
+     * source's own per-network `WATERX_INFRA` default.
      *
      * This is the one source a BROWSER fetches itself (the signed envelope is
      * pulled from the page), so it is bound by the quote-center deployment's CORS
@@ -73,28 +86,28 @@ export interface CreateClientOptions extends LoadConfigOptions {
     waterxEndpoint?: string;
     /**
      * Retry/timeout policy — and `fetchImpl` — for the quote-center fetch (see
-     * `fetchWithPolicy`). Optional: falls back to `pythFetch`, then to the
-     * built-in defaults. Supply `fetchImpl` to route the request through your own
+     * `fetchWithPolicy`). Optional: falls back to the built-in defaults — never
+     * to `pythFetch` (sources stay independent). Supply `fetchImpl` to route the request through your own
      * transport (a proxying `fetch` wrapper, a non-global `fetch`, a test double).
      */
     waterxFetch?: FetchPolicy;
 }
 export declare class PerpClient extends BaseLineClient<WaterXConfig> {
-    /** Pyth Core infra (fixed per network) plus the caller-supplied credential/policy. */
-    pyth: PythInfraConfig;
+    /** Caller-supplied Pyth credential + fetch policy — NO infra; each source owns its own tables. */
+    pyth: PythAccessConfig;
     /**
-     * WaterX quote-center infra for `oracleSource: 'waterx_rule'` — the network
-     * default, overridden by the `waterxEndpoint` / `waterxFetch` create options
-     * (a same-origin proxy or a custom `fetchImpl` for browser consumers).
+     * Caller-supplied quote-center overrides for `oracleSource: 'waterx_rule'`
+     * (`waterxEndpoint` / `waterxFetch` create options) — access-only, mirroring
+     * `pyth` above; unset fields resolve against the rule's own `WATERX_INFRA`.
      */
-    waterx: WaterxInfraConfig;
+    waterx: WaterxAccessConfig;
     /** Wormhole infra for the credit bridge (network defaults unless overridden). */
     wormhole: WormholeInfraConfig;
-    /** Selected oracle price-update source (`oracleSource` create option; default `'pyth_rule'`). */
-    readonly oracleSource: OracleSource;
+    /** The fed set: `oracleSource` create option normalized to a non-empty, deduped list. */
+    readonly oracleSources: readonly OracleSource[];
     /** Canonical-schema lookups (delegated to below); no transport. */
     private readonly view;
-    constructor(network: Network, config: WaterXConfig, opts?: CreateClientOptions);
+    constructor(network: Network, config: WaterXConfig, opts: CreateClientOptions);
     /**
      * Async factory: fetches the deployment config for `network` and returns
      * a ready-to-use client. Pass `opts.cache=true` to memoize the JSON.
@@ -103,9 +116,9 @@ export declare class PerpClient extends BaseLineClient<WaterXConfig> {
      * not an error at init — it surfaces at tx-build time for the specific
      * tickers that source can't serve (see `refreshOraclePrices`).
      */
-    static create(network: Network, opts?: CreateClientOptions): Promise<PerpClient>;
-    static mainnet(opts?: CreateClientOptions): Promise<PerpClient>;
-    static testnet(opts?: CreateClientOptions): Promise<PerpClient>;
+    static create(network: Network, opts: CreateClientOptions): Promise<PerpClient>;
+    static mainnet(opts: CreateClientOptions): Promise<PerpClient>;
+    static testnet(opts: CreateClientOptions): Promise<PerpClient>;
     /** @see PerpConfigView.getMarket */
     getMarket(ticker: string): import("./config.ts").WaterxPerpMarketEntry;
     /** @see PerpConfigView.getAggregator */

package/dist/src/perp/client.js

@@ -12,43 +12,51 @@
  */
 import { BaseLineClient } from "../base-client.js";
 import { PerpConfigView } from "./config-view.js";
-import { loadConfig, PYTH_DEFAULTS, WATERX_DEFAULTS, WORMHOLE_DEFAULTS, } from "./config.js";
+import { loadConfig, WORMHOLE_DEFAULTS, } from "./config.js";
 export class PerpClient extends BaseLineClient {
-    /** Pyth Core infra (fixed per network) plus the caller-supplied credential/policy. */
+    /** Caller-supplied Pyth credential + fetch policy — NO infra; each source owns its own tables. */
     pyth;
     /**
-     * WaterX quote-center infra for `oracleSource: 'waterx_rule'` — the network
-     * default, overridden by the `waterxEndpoint` / `waterxFetch` create options
-     * (a same-origin proxy or a custom `fetchImpl` for browser consumers).
+     * Caller-supplied quote-center overrides for `oracleSource: 'waterx_rule'`
+     * (`waterxEndpoint` / `waterxFetch` create options) — access-only, mirroring
+     * `pyth` above; unset fields resolve against the rule's own `WATERX_INFRA`.
      */
     waterx;
     /** Wormhole infra for the credit bridge (network defaults unless overridden). */
     wormhole;
-    /** Selected oracle price-update source (`oracleSource` create option; default `'pyth_rule'`). */
-    oracleSource;
+    /** The fed set: `oracleSource` create option normalized to a non-empty, deduped list. */
+    oracleSources;
     /** Canonical-schema lookups (delegated to below); no transport. */
     view;
-    constructor(network, config, opts = {}) {
+    constructor(network, config, opts) {
         super(network, config, opts);
-        // Pyth Core infra is fixed per network — NOT deployment-overridable and
-        // NOT source-dependent (the pyth_lazer_rule source reads only api_key/fetch
-        // from here). The api_key + fetch policy are caller-supplied at init: a
-        // secret has no place in the canonical waterx-config JSON.
+        // Access-only slice: the api_key + fetch policy are caller-supplied at
+        // init (a secret has no place in the canonical waterx-config JSON). All
+        // endpoint/object-id infra is per-source, owned by the rule modules —
+        // nothing infra-shaped lives on the client.
         this.pyth = {
-            ...PYTH_DEFAULTS[network],
             ...(opts.pythApiKey !== undefined ? { api_key: opts.pythApiKey } : {}),
             ...(opts.pythFetch !== undefined ? { fetch: opts.pythFetch } : {}),
         };
         this.wormhole = config.wormhole ?? WORMHOLE_DEFAULTS[network];
-        // Quote-center infra: network default, each field independently overridable
-        // — a browser blocked by the quote-center's CORS allowlist swaps `endpoint`
-        // for a same-origin proxy without touching anything else.
+        // Quote-center access slice: overrides only — a browser blocked by the
+        // quote-center's CORS allowlist swaps `endpoint` for a same-origin proxy;
+        // unset fields resolve inside the rule against WATERX_INFRA[network].
         this.waterx = {
-            ...WATERX_DEFAULTS[network],
             ...(opts.waterxEndpoint !== undefined ? { endpoint: opts.waterxEndpoint } : {}),
             ...(opts.waterxFetch !== undefined ? { fetch: opts.waterxFetch } : {}),
         };
-        this.oracleSource = opts.oracleSource ?? "pyth_rule";
+        // Normalize single-or-list to a deduped, order-preserving list. An empty
+        // list — or a nullish/empty entry, the shape an untyped caller produces
+        // by omitting the REQUIRED option — is a caller bug, not "no oracle":
+        // fail construction loudly instead of booting green and surfacing as
+        // `OracleSourceNotImplemented: undefined` at the first tx-build.
+        const sources = Array.isArray(opts.oracleSource) ? opts.oracleSource : [opts.oracleSource];
+        this.oracleSources = [...new Set(sources)];
+        if (this.oracleSources.length === 0 ||
+            this.oracleSources.some((source) => typeof source !== "string" || source.length === 0)) {
+            throw new Error(`oracleSource is REQUIRED and must name at least one source (got ${JSON.stringify(sources)})`);
+        }
         this.view = new PerpConfigView(() => this.config, () => this.wormhole);
     }
     /**
@@ -59,14 +67,14 @@ export class PerpClient extends BaseLineClient {
      * not an error at init — it surfaces at tx-build time for the specific
      * tickers that source can't serve (see `refreshOraclePrices`).
      */
-    static async create(network, opts = {}) {
+    static async create(network, opts) {
         const config = await loadConfig(network, opts);
         return new PerpClient(network, config, opts);
     }
-    static mainnet(opts = {}) {
+    static mainnet(opts) {
         return PerpClient.create("MAINNET", opts);
     }
-    static testnet(opts = {}) {
+    static testnet(opts) {
         return PerpClient.create("TESTNET", opts);
     }
     // ========================================================

package/dist/src/perp/config.d.ts

@@ -3,17 +3,17 @@
  * `waterx-config` repo (default: GitHub raw).
  *
  * The schema mirrors the canonical JSON layout one-to-one (each package
- * groups its own object IDs + per-ticker maps). External chain infra
- * (Pyth state, Wormhole state/core, Hermes & Wormholescan endpoints) is
- * **not** in the JSON — it lives in `PYTH_DEFAULTS` / `WORMHOLE_DEFAULTS`
- * below, keyed by network.
+ * groups its own object IDs + per-ticker maps). External chain infra is
+ * **not** in the JSON — each oracle source owns its own per-network table
+ * (`PYTH_CORE_INFRA` in `oracle/pyth.ts`, `LAZER_INFRA` in
+ * `oracle/rules/pyth-lazer-rule.ts`); Wormhole bridge infra lives in
+ * `WORMHOLE_DEFAULTS` below.
  */
 import type { AccountPackages, BasePackageEntry, WormholeInfraConfig } from "../account/config.ts";
 import type { OraclePackages } from "../oracle/config.ts";
 import type { Network } from "./constants.ts";
 export type { AccountConfig, AccountPackages, BasePackageEntry, NativeCustodyAsset, NativeCustodyPackage, WaterxCreditPackage, WaterxReferralPackage, WithdrawalQueuePackage, WormholeBridgePackage, WormholeInfraConfig, WxaAccountPackage, } from "../account/config.ts";
-export type { ConstantFeedEntry, OracleConfig, OraclePackages, PythFetchPolicy, PythInfraConfig, PythLazerRulePackage, PythRulePackage, PythSponsorRulePackage, SupraFeedEntry, SupraRulePackage, WaterxConstantRulePackage, WaterxInfraConfig, WaterxOraclePackage, WaterxRulePackage, } from "../oracle/config.ts";
-export { PYTH_DEFAULTS, WATERX_DEFAULTS } from "../oracle/config.ts";
+export type { ConstantFeedEntry, OracleConfig, OraclePackages, PythAccessConfig, PythFetchPolicy, PythLazerRulePackage, PythRulePackage, PythSponsorRulePackage, SupraFeedEntry, SupraRulePackage, WaterxConstantRulePackage, WaterxAccessConfig, WaterxOraclePackage, WaterxRulePackage, } from "../oracle/config.ts";
 export interface WaterxPerpMarketEntry {
     market: string;
     config: string;

package/dist/src/perp/config.js

@@ -3,23 +3,25 @@
  * `waterx-config` repo (default: GitHub raw).
  *
  * The schema mirrors the canonical JSON layout one-to-one (each package
- * groups its own object IDs + per-ticker maps). External chain infra
- * (Pyth state, Wormhole state/core, Hermes & Wormholescan endpoints) is
- * **not** in the JSON — it lives in `PYTH_DEFAULTS` / `WORMHOLE_DEFAULTS`
- * below, keyed by network.
+ * groups its own object IDs + per-ticker maps). External chain infra is
+ * **not** in the JSON — each oracle source owns its own per-network table
+ * (`PYTH_CORE_INFRA` in `oracle/pyth.ts`, `LAZER_INFRA` in
+ * `oracle/rules/pyth-lazer-rule.ts`); Wormhole bridge infra lives in
+ * `WORMHOLE_DEFAULTS` below.
  */
 import { fetchWithPolicy, rethrowExhaustedFetch } from "../oracle/update-fetch.js";
-export { PYTH_DEFAULTS, WATERX_DEFAULTS } from "../oracle/config.js";
 // ============================================================================
-// Wormhole / Hermes — external chain infra, defaults by network
+// Wormhole — external chain infra, defaults by network
 // ============================================================================
 //
-// `PythInfraConfig` + `PYTH_DEFAULTS` live in `oracle/config.ts` (shared infra)
-// and are re-exported at the top of this file.
+// Oracle-source infra lives with each source (`PYTH_CORE_INFRA` in
+// `oracle/pyth.ts`, `LAZER_INFRA` in `oracle/rules/pyth-lazer-rule.ts`);
+// `client.pyth` is the caller-supplied access slice only (`PythAccessConfig`,
+// re-exported at the top of this file).
 // `WormholeInfraConfig` is defined in `account/config.ts` (funding base) and
 // re-exported at the top of this file. `state_id` is the same shared Sui
 // Wormhole `State` object Pyth uses (kept in sync with
-// `PYTH_DEFAULTS[*].wormhole_state_id`).
+// `PYTH_CORE_INFRA[*].wormhole_state_id`).
 export const WORMHOLE_DEFAULTS = {
     MAINNET: {
         state_id: "0xaeab97f96cf9877fee2883315d459552b2b921edc16d7ceac6eab944dd88919c",

package/dist/src/perp/index.d.ts

@@ -1,7 +1,7 @@
 export { PerpClient } from "./client.ts";
 export type { CreateClientOptions } from "./client.ts";
-export { PYTH_DEFAULTS, WORMHOLE_DEFAULTS, clearConfigCache, loadConfig } from "./config.ts";
-export type { BasePackageEntry, ConstantFeedEntry, WaterxReferralPackage, LoadConfigOptions, NativeCustodyAsset, NativeCustodyPackage, PythFetchPolicy, PythInfraConfig, PythLazerRulePackage, PythRulePackage, PythSponsorRulePackage, SupraFeedEntry, SupraRulePackage, TestnetFaucetPackage, WaterXConfig, WaterXPackages, WaterxCreditPackage, WaterxOraclePackage, WaterxPerpMarketEntry, WaterxPerpPackage, WaterxStakingPackage, WithdrawalQueuePackage, WlpPackage, WormholeBridgePackage, WormholeInfraConfig, WxaAccountPackage, } from "./config.ts";
+export { WORMHOLE_DEFAULTS, clearConfigCache, loadConfig } from "./config.ts";
+export type { BasePackageEntry, ConstantFeedEntry, WaterxReferralPackage, LoadConfigOptions, NativeCustodyAsset, NativeCustodyPackage, PythAccessConfig, PythFetchPolicy, PythLazerRulePackage, PythRulePackage, PythSponsorRulePackage, SupraFeedEntry, SupraRulePackage, TestnetFaucetPackage, WaterXConfig, WaterXPackages, WaterxCreditPackage, WaterxOraclePackage, WaterxPerpMarketEntry, WaterxPerpPackage, WaterxStakingPackage, WithdrawalQueuePackage, WlpPackage, WormholeBridgePackage, WormholeInfraConfig, WxaAccountPackage, } from "./config.ts";
 export { ACTION_ADD_PRE_ORDER, ACTION_CANCEL_ORDER, ACTION_CANCEL_PRE_ORDER, ACTION_CLOSE_POSITION, ACTION_DECREASE_POSITION, ACTION_DEPOSIT_COLLATERAL, ACTION_INCREASE_POSITION, ACTION_LIQUIDATE, ACTION_OPEN_POSITION, ACTION_PLACE_ORDER, ACTION_UPDATE_ORDER, ACTION_WITHDRAW_COLLATERAL, BPS_SCALE, DOUBLE_SCALE, DRY_RUN_SENDER, FLOAT_SCALE, ORDER_LIMIT_BUY, ORDER_LIMIT_SELL, ORDER_STOP_BUY, ORDER_STOP_SELL, ORDER_TAG_WILDCARD, PERM_ALL, PERM_ALL_TRADING, PERM_CANCEL_ORDER, PERM_CLOSE_POSITION, PERM_DECREASE_POSITION, PERM_DEPOSIT_COLLATERAL, PERM_INCREASE_POSITION, PERM_MINT_WLP, PERM_OPEN_POSITION, PERM_PLACE_ORDER, PERM_REDEEM_WLP, PERM_WITHDRAW_COLLATERAL, STAKING_PERM_DEPOSIT_STAKE, STAKING_PERM_REDEEM_STAKE, STAKING_PERM_CLAIM_REWARD, STAKING_PERM_ALL, MS_PER_MINUTE, MS_PER_HOUR, MS_PER_YEAR, SUI_DECIMALS, WLP_DECIMALS, COLLATERAL_DECIMALS, TOKEN_DECIMALS, } from "./constants.ts";
 export type { Network } from "./constants.ts";
 export { getMarketTickers, getCollateralAssets } from "../utils/config.ts";
@@ -13,7 +13,7 @@ export type { EstLiqPriceViewOpts } from "./liq-view.ts";
 export * from "./user/index.ts";
 export * from "./tx-builders.ts";
 export * from "./fetch.ts";
-export { FetchPolicyError, LazerApiKeyMissingError, OracleFeeSourceUnavailableError, OracleSourceNotImplementedError, PythCache, aggregateTicker, aggregateTickerWithConstant, aggregateTickerWithPyth, buildPythPriceUpdateCalls, fetchPriceFeedsUpdateData, refreshOraclePrices, updatePythPrices, } from "../oracle/index.ts";
+export { FetchPolicyError, LazerApiKeyMissingError, OracleFeeSourceUnavailableError, OracleSourceNotImplementedError, PythCache, aggregateTicker, aggregateTickerWithConstant, aggregateTickerWithPyth, buildPythPriceUpdateCalls, fetchPriceFeedsUpdateData, pythCoreHermesEndpoint, pythProHermesEndpoint, resolveHermesReadEndpoint, waterxQuoteCenterEndpoint, refreshOraclePrices, updatePythPrices, } from "../oracle/index.ts";
 export type { FetchPolicy, OracleFeeSource, OracleSource, UpdateDataProvider, } from "../oracle/index.ts";
 export { fetchDepositVaa, fetchVaa, listBridgeWithdrawalVaas, listVaasByEmitter, padEvmEmitter, toWormholescanEmitter, vaaBase64ToBytes, vaaBase64ToHex, vaaBytesToBase64, waitForVaa, } from "../account/funding/wormhole.ts";
 export type { VaaListItem, VaaResponse, WormholescanOptions } from "../account/funding/wormhole.ts";

package/dist/src/perp/index.js

@@ -1,6 +1,6 @@
 // ======== Core ========
 export { PerpClient } from "./client.js";
-export { PYTH_DEFAULTS, WORMHOLE_DEFAULTS, clearConfigCache, loadConfig } from "./config.js";
+export { WORMHOLE_DEFAULTS, clearConfigCache, loadConfig } from "./config.js";
 // ======== Constants & enums ========
 export { ACTION_ADD_PRE_ORDER, ACTION_CANCEL_ORDER, ACTION_CANCEL_PRE_ORDER, ACTION_CLOSE_POSITION, ACTION_DECREASE_POSITION, ACTION_DEPOSIT_COLLATERAL, ACTION_INCREASE_POSITION, ACTION_LIQUIDATE, ACTION_OPEN_POSITION, ACTION_PLACE_ORDER, ACTION_UPDATE_ORDER, ACTION_WITHDRAW_COLLATERAL, BPS_SCALE, DOUBLE_SCALE, DRY_RUN_SENDER, FLOAT_SCALE, ORDER_LIMIT_BUY, ORDER_LIMIT_SELL, ORDER_STOP_BUY, ORDER_STOP_SELL, ORDER_TAG_WILDCARD, PERM_ALL, PERM_ALL_TRADING, PERM_CANCEL_ORDER, PERM_CLOSE_POSITION, PERM_DECREASE_POSITION, PERM_DEPOSIT_COLLATERAL, PERM_INCREASE_POSITION, PERM_MINT_WLP, PERM_OPEN_POSITION, PERM_PLACE_ORDER, PERM_REDEEM_WLP, PERM_WITHDRAW_COLLATERAL, STAKING_PERM_DEPOSIT_STAKE, STAKING_PERM_REDEEM_STAKE, STAKING_PERM_CLAIM_REWARD, STAKING_PERM_ALL, MS_PER_MINUTE, MS_PER_HOUR, MS_PER_YEAR, SUI_DECIMALS, WLP_DECIMALS, COLLATERAL_DECIMALS, TOKEN_DECIMALS, } from "./constants.js";
 // ======== Utilities ========
@@ -15,7 +15,7 @@ export * from "./tx-builders.js";
 // ======== Read-only queries ========
 export * from "./fetch.js";
 // ======== Oracle utilities (Pyth source + rule aggregation) ========
-export { FetchPolicyError, LazerApiKeyMissingError, OracleFeeSourceUnavailableError, OracleSourceNotImplementedError, PythCache, aggregateTicker, aggregateTickerWithConstant, aggregateTickerWithPyth, buildPythPriceUpdateCalls, fetchPriceFeedsUpdateData, refreshOraclePrices, updatePythPrices, } from "../oracle/index.js";
+export { FetchPolicyError, LazerApiKeyMissingError, OracleFeeSourceUnavailableError, OracleSourceNotImplementedError, PythCache, aggregateTicker, aggregateTickerWithConstant, aggregateTickerWithPyth, buildPythPriceUpdateCalls, fetchPriceFeedsUpdateData, pythCoreHermesEndpoint, pythProHermesEndpoint, resolveHermesReadEndpoint, waterxQuoteCenterEndpoint, refreshOraclePrices, updatePythPrices, } from "../oracle/index.js";
 // ======== Wormhole / Wormholescan utilities (credit bridge) ========
 export { fetchDepositVaa, fetchVaa, listBridgeWithdrawalVaas, listVaasByEmitter, padEvmEmitter, toWormholescanEmitter, vaaBase64ToBytes, vaaBase64ToHex, vaaBytesToBase64, waitForVaa, } from "../account/funding/wormhole.js";
 // ======== Generated BCS types (sui-ts-codegen) ========

package/dist/src/unified-client.d.ts

@@ -3,7 +3,7 @@
  *
  * Exposes three namespaces over the two product-line sub-clients:
  *
- *   const client = await WaterXClient.create({ network: "TESTNET" });
+ *   const client = await WaterXClient.create({ network: "TESTNET", oracleSource: "pyth_rule" });
  *   client.account.createAccount(tx, { alias });   // -> shared waterx_account + funding
  *   client.perp.placeOrderRequest(tx, params);     // -> perp builder
  *   client.predict.placeOrder(tx, params);         // -> prediction builder
@@ -370,20 +370,25 @@ export interface ClientCreateOptions {
     /**
      * The perp line's oracle price-update source (perp-line only — the
      * prediction line has no oracle leg), forwarded to `PerpClient.create`.
+     * REQUIRED — there is NO default source: every deployment names its source
+     * explicitly (wire it from your own env var, e.g. `ORACLE_SOURCE`).
      * Source-neutral by design: a source need not be Pyth (see `'waterx_rule'`).
      *
-     * - `'pyth_rule'` (default) — Pyth Core updates on Core infra.
+     * - `'pyth_rule'` — Pyth Core updates; infra in the source's own
+     *   `PYTH_CORE_INFRA` table.
      * - `'pyth_lazer_rule'` — Pyth Lazer signed updates (pair with `pythApiKey`
-     *   and a config carrying `packages.pyth_lazer_rule`).
+     *   and a config carrying `packages.pyth_lazer_rule`); infra in the
+     *   source's own `LAZER_INFRA` table.
      * - `'waterx_rule'` — the first-party WaterX quote-center (Nautilus-TEE,
-     *   ed25519 signed batches; no credential, no per-update fee). Pair with
-     *   `waterxEndpoint` / `waterxFetch` when the browser needs a proxy.
+     *   ed25519 signed batches; no credential, no per-update fee); infra in the
+     *   source's own `WATERX_INFRA` table. Pair with `waterxEndpoint` /
+     *   `waterxFetch` when the browser needs a proxy.
      *
      * Each source is self-contained with no cross-source fallback; selecting a
      * source whose feed for a ticker is absent fails at tx-build (not at init).
      * See perp `CreateClientOptions.oracleSource` for the full note.
      */
-    oracleSource?: OracleSource;
+    oracleSource: OracleSource | OracleSource[];
     /**
      * Pyth Lazer access token, forwarded to the perp line. Required under
      * `oracleSource: 'pyth_lazer_rule'`, unused by `'pyth_rule'`. A SECRET —
@@ -395,7 +400,7 @@ export interface ClientCreateOptions {
     pythFetch?: PythFetchPolicy;
     /**
      * Quote-center base URL for `oracleSource: 'waterx_rule'`, forwarded to the
-     * perp line — overrides the per-network `WATERX_DEFAULTS` host.
+     * perp line — overrides the source's own per-network `WATERX_INFRA` default.
      *
      * `waterx_rule` is the one source a BROWSER fetches itself, so it is bound by
      * the quote-center deployment's CORS allowlist: a front end whose origin is
@@ -406,7 +411,7 @@ export interface ClientCreateOptions {
     waterxEndpoint?: string;
     /**
      * Retry/timeout policy — and `fetchImpl` — for the perp line's quote-center
-     * fetch. Falls back to `pythFetch`, then to the built-in defaults.
+     * fetch. Falls back to the built-in defaults — never to `pythFetch`.
      */
     waterxFetch?: FetchPolicy;
     /** Perp-line overrides (network, grpcUrl, waterxConfigUrl, cache, …). */
@@ -448,6 +453,6 @@ export declare class WaterXClient {
      * `waterx-config` JSON) and returns a ready client. Each line can target a
      * different network via `opts.perp.network` / `opts.predict.network`.
      */
-    static create(opts?: ClientCreateOptions): Promise<WaterXClient>;
+    static create(opts: ClientCreateOptions): Promise<WaterXClient>;
 }
 export {};

package/dist/src/unified-client.js

@@ -3,7 +3,7 @@
  *
  * Exposes three namespaces over the two product-line sub-clients:
  *
- *   const client = await WaterXClient.create({ network: "TESTNET" });
+ *   const client = await WaterXClient.create({ network: "TESTNET", oracleSource: "pyth_rule" });
  *   client.account.createAccount(tx, { alias });   // -> shared waterx_account + funding
  *   client.perp.placeOrderRequest(tx, params);     // -> perp builder
  *   client.predict.placeOrder(tx, params);         // -> prediction builder
@@ -150,7 +150,7 @@ export class WaterXClient {
      * `waterx-config` JSON) and returns a ready client. Each line can target a
      * different network via `opts.perp.network` / `opts.predict.network`.
      */
-    static async create(opts = {}) {
+    static async create(opts) {
         const baseNetwork = opts.network ?? "TESTNET";
         const { network: perpNetwork, ...perpRest } = opts.perp ?? {};
         const { network: predictNetwork, ...predictRest } = opts.predict ?? {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@waterx/sdk",
-  "version": "4.1.0",
+  "version": "4.3.0",
   "description": "WaterX SDK — perpetuals and prediction markets on Sui",
   "license": "MIT",
   "author": "WaterX",