@waterx/sdk 4.1.0 → 4.3.1

package/README.md

@@ -11,19 +11,21 @@ The perp and prediction lines expose builder functions with **colliding names**
 ```ts
 import { WaterXClient } from "@waterx/sdk";
 
-// waterxConfigUrl is REQUIRED — the SDK has no built-in default and never reads env.
+// waterxConfigUrl and oracleSource are REQUIRED — the SDK has no built-in
+// defaults and never reads env. oracleSource: see "Oracle sources" below.
 const client = await WaterXClient.create({
   network: "TESTNET",
   waterxConfigUrl:
     "https://raw.githubusercontent.com/WaterXProtocol/waterx-config/main/testnet.json",
+  oracleSource: "pyth_rule",
 });
 client.account.createAccount(tx, { alias }); // shared waterx_account + funding (credit/custody)
 client.perp.buildPlaceOrderTx(params); // perpetuals
 client.predict.placeOrder(tx, params); // prediction markets
 // client.perp / client.predict ARE the line clients — sign/execute on them directly:
 //   await client.perp.signAndExecuteTransaction({ transaction: tx, signer })
-// each line can target a different network + URL:
-//   WaterXClient.create({ perp: { network: "MAINNET", waterxConfigUrl: mainnetUrl }, predict: { network: "TESTNET", waterxConfigUrl: testnetUrl } })
+// each line can target a different network + URL (oracleSource stays top-level):
+//   WaterXClient.create({ oracleSource: "pyth_rule", perp: { network: "MAINNET", waterxConfigUrl: mainnetUrl }, predict: { network: "TESTNET", waterxConfigUrl: testnetUrl } })
 ```
 
 > `WaterXClient` is the umbrella entry point. `Client` is kept as a **deprecated alias** for one major cycle.
@@ -56,6 +58,7 @@ import { Transaction } from "@mysten/sui/transactions";
 const client = await WaterXClient.create({
   network: "TESTNET",
   waterxConfigUrl: "https://raw.githubusercontent.com/WaterXProtocol/waterx-config/main/testnet.json",
+  oracleSource: "pyth_rule", // REQUIRED — single source or a list (the fed set); see "Oracle sources"
 });
 const signer = /* your Ed25519Keypair or wallet Signer */;
 
@@ -94,46 +97,53 @@ import { PredictClient } from "@waterx/sdk/prediction";
 
 const waterxConfigUrl =
   "https://raw.githubusercontent.com/WaterXProtocol/waterx-config/main/testnet.json";
-const perp = await PerpClient.create("TESTNET", { waterxConfigUrl }); // or PerpClient.testnet({ waterxConfigUrl })
-const predict = await PredictClient.create("TESTNET", { waterxConfigUrl }); // or PredictClient.testnet({ waterxConfigUrl })
+const perp = await PerpClient.create("TESTNET", { waterxConfigUrl, oracleSource: "pyth_rule" }); // or PerpClient.testnet({ ... })
+const predict = await PredictClient.create("TESTNET", { waterxConfigUrl }); // predict line needs no oracle source
 ```
 
 Read-only queries use gRPC `simulateTransaction` (no signer) — the `getX` view helpers, e.g. `await perp.simulate(tx)` or `getMarketData(perp, …)`.
 
 ## Oracle sources
 
-ONE client create option, `oracleSource`, selects the price-update source. Each source is **self-contained** — it owns its own infra + config and does **not** back-stop any other source. The name is source-neutral on purpose: a future source need not be Pyth. The SDK **never reads `process.env`** — each consumer wires it from its own env var, so every environment runs the **same SDK version** and differs only by env:
+ONE **required** client create option, `oracleSource`, names the price-update source(s) — a single value or a **list (the fed set)**. Each source is **self-contained** — it owns its own infra + config and does **not** back-stop any other source. There is **no default source**: a client that has not named its sources fails at creation. The name is source-neutral on purpose: a future source need not be Pyth. The SDK **never reads `process.env`** — each consumer wires it from its own env var, so every environment runs the **same SDK version** and differs only by env:
 
-| Option         | Values                                                            | What it selects                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| -------------- | ----------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `oracleSource` | `'pyth_rule'` (default) \| `'pyth_lazer_rule'` \| `'waterx_rule'` | The price-update source. `'pyth_rule'` = Pyth Core updates (Hermes VAA + per-feed update fees, keyless `hermes.pyth.network`). `'pyth_lazer_rule'` = Pyth Lazer signed updates (ONE `leEcdsa` verify per PTB, no per-feed fees); needs `packages.pyth_lazer_rule` feeds + a `pythApiKey`. `'waterx_rule'` = the first-party WaterX quote-center (Nautilus-TEE, ed25519-signed CEX prices): one signed batch envelope per build, no API key and no per-update fee; needs `packages.waterx_rule` feeds. |
+| Option         | Values                                                                             | What it selects                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| -------------- | ---------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `oracleSource` | `OracleSource \| OracleSource[]` of `'pyth_rule'` \| `'pyth_lazer_rule'` \| `'waterx_rule'` — REQUIRED, no default | The price-update source(s). `'pyth_rule'` = Pyth Core updates (Hermes VAA + per-feed update fees, keyless `hermes.pyth.network`). `'pyth_lazer_rule'` = Pyth Lazer signed updates (ONE `leEcdsa` verify per PTB, no per-feed fees); needs `packages.pyth_lazer_rule` feeds + a `pythApiKey`. `'waterx_rule'` = the first-party WaterX quote-center (Nautilus-TEE, ed25519-signed CEX prices): one signed batch envelope per build, no API key and no per-update fee; needs `packages.waterx_rule` feeds. |
 
-**No cross-source fallback, no init guard.** Selecting a source whose feed for a requested ticker is absent is **not** an error at client creation — it fails at **tx-build** for exactly those tickers (constant-only tickers, which need no price update, are exempt). A present-but-wrong feed id is not validated by the SDK; it aborts on-chain at dry-run.
+**Multi-source fed sets.** With a list, ONE build fetches and feeds EVERY listed source's data in the same PTB; the chain's per-ticker aggregator **weight tables** decide which contributions count — feeding an unweighted rule's price is dropped on-chain, while starving a weighted rule aborts. That asymmetry is what makes weight migrations (Core→Pro, Pyth↔waterx coexistence) safe: keep the list a **superset** of every ticker's weighted rule set and flip weights per ticker at any time — an env edit, never an SDK release. (One caveat: waterx's feed call burns a per-symbol signed-timestamp high-water mark regardless of weights — see the replay note below.)
 
-The Pyth Core infra (`client.pyth`: state ids + Hermes endpoint) is **fixed per network** by `PYTH_DEFAULTS` and is **not** deployment-overridable — the canonical `waterx-config` JSON carries no `pyth` block. The `pyth_lazer_rule` source reads only the credential/policy (`api_key`/`fetch`) from `client.pyth`; its on-chain infra comes from `LAZER_DEFAULTS` + config. The credential and fetch policy are passed at client init (`pythApiKey` / `pythFetch`), never through the JSON. `waterx_rule` touches no Pyth infra at all: its quote-center endpoint **defaults** to `WATERX_DEFAULTS[network]` (testnet `quote-center-staging.waterx.app` / mainnet `quote-center.waterx.app`) and is overridable with `waterxEndpoint`; its fetch policy/transport resolves **`waterxFetch` → `pythFetch` → built-in defaults** (15s timeout, 2 retries), so the dedicated override wins and the shared Pyth policy is only the fallback. Both are client-init options — see the browser/CORS note below.
+**No cross-source fallback, no feeds guard at init.** Construction rejects an empty/nullish `oracleSource` **and any value outside `ORACLE_SOURCES`** (a legacy `'core'` / `'pyth'` string fails at `create`), but a listed source whose feed for a requested ticker is absent is **not** an error at client creation — the build fails at **tx-build** only when **no** listed source serves the ticker (constant-only tickers, which need no price update, are exempt). A present-but-wrong feed id is not validated by the SDK; it aborts on-chain at dry-run.
+
+Every source's external infra is a **rule-owned per-network table**, never deployment-overridable and never in the config JSON: `PYTH_CORE_INFRA` (`src/oracle/pyth.ts` — Pyth state ids + the keyless Core Hermes endpoint, read-plane accessor `pythCoreHermesEndpoint(network)`), `LAZER_INFRA` (`src/oracle/rules/pyth-lazer-rule.ts`), `WATERX_INFRA` (`src/oracle/rules/waterx-rule.ts` — testnet `quote-center-staging.waterx.app` / mainnet `quote-center.waterx.app`, accessor `waterxQuoteCenterEndpoint(network)`). For **price READS** under a fed set without `pyth_rule`, the documented Pyth Pro base (`pythProHermesEndpoint()` — identical for every subscriber, auth via the Bearer key) applies: resolve the read endpoint with `resolveHermesReadEndpoint(network, sources, override?)` instead of branching by hand, and pair it with `resolveOracleReadPlan` for the per-source served-sets/ids. `client.pyth` is the access-only `PythAccessConfig` — just the caller-supplied `pythApiKey` / `pythFetch` create options (a secret has no place in a public CDN JSON); `client.waterx` is likewise `WaterxAccessConfig` (`waterxEndpoint` / `waterxFetch` overrides only; fetch policy resolves **`waterxFetch` → built-in defaults** — deliberately no `pythFetch` fallback, sources never share config). See the browser/CORS note below.
 
 ```ts
-// Per-environment wiring — the consumer owns the env var, not the SDK:
+// Per-environment wiring — the consumer owns the env var, not the SDK.
+// parseOracleSourceList is THE canonical parser (trim, drop empty entries,
+// validate every value, dedupe, throw operator-actionably) — never a bare
+// split-and-cast, which would hand the strict constructor untrimmed junk.
+import { parseOracleSourceList } from "@waterx/sdk/oracle";
+
 const perp = await PerpClient.create(network, {
   waterxConfigUrl,
-  oracleSource: process.env.ORACLE_SOURCE as OracleSource | undefined, // e.g. staging: 'pyth_lazer_rule' | 'waterx_rule'
-  pythApiKey: process.env.PYTH_API_KEY, // Lazer is auth-first; unused by 'pyth_rule' / 'waterx_rule'
+  oracleSource: parseOracleSourceList(process.env.ORACLE_SOURCE), // REQUIRED; comma list = the fed set
+  pythApiKey: process.env.PYTH_API_KEY, // required iff 'pyth_lazer_rule' is listed (Lazer is auth-first)
 });
 ```
 
-This is the staging-Lazer / prod-Core rollout pattern: staging sets `ORACLE_SOURCE=pyth_lazer_rule` (+ `PYTH_API_KEY`) — or `ORACLE_SOURCE=waterx_rule`, which needs no credential — while production leaves it unset — flipping an environment is an env-var change, never an SDK release.
+This is the coexistence rollout pattern: staging lists every source under migration (`ORACLE_SOURCE=pyth_rule,pyth_lazer_rule,waterx_rule` + `PYTH_API_KEY`) while production stays single-value (`ORACLE_SOURCE=pyth_rule`) until its weight tables move — flipping an environment is an env-var change, never an SDK release.
 
 ### Adding an oracle source (runbook)
 
 Every source plugs in the same way — routing is driven **only** by the client's `oracleSource` option (never a config `enabled` flag, never `process.env`):
 
 1. **Implement `PriceUpdateRule`** in `src/oracle/rules/<name>-rule.ts` — all port fields (`src/oracle/price-update-rule.ts`): `kind`, `requiresFeeSource` (`true` iff the on-chain verify draws a per-update fee — gates the fail-fast fee-source check), `supportedTickers`, `fetchUpdateData`, `narrowUpdateData` (subset a cached whole-universe payload to one build's tickers — a divisible payload returns a per-feed subset, an indivisible one returns itself whole iff fully covered; uncovered ticker → `null` miss), `buildUpdateCalls`.
-2. **Register it** in `src/oracle/rule-registry.ts` (`DEFAULT_RULES`) under a new `OracleSource` value (added to the union in `price-update-rule.ts`).
+2. **Register it** in `src/oracle/rule-registry.ts` (`DEFAULT_RULES`) under a new `OracleSource` value — added to `ORACLE_SOURCES` in `price-update-rule.ts` (the union derives from that list; a registry test pins every listed value to a registered rule).
 3. **Publish the on-chain rule package** — its config entry (package ids, per-ticker `feeds`) arrives via the normal `waterx-config` deploy pipeline; type it in `OraclePackages` (`src/oracle/config.ts`).
-4. **Add SDK infra constants** if the source needs external infra that is not part of the config JSON (API endpoints, verifier packages, state objects) — a per-network map in `src/oracle/config.ts`, mirroring `LAZER_DEFAULTS` / `WATERX_DEFAULTS`.
+4. **Add SDK infra constants** if the source needs external infra that is not part of the config JSON (API endpoints, verifier packages, state objects) — a **rule-owned** per-network table inside the rule's own file, mirroring `LAZER_INFRA` / `WATERX_INFRA` (never on the shared client, never in `oracle/config.ts`). Wire its read-plane served-set/ids into `resolveOracleReadPlan` (`src/oracle/read-plane.ts`).
 5. **Consumers flip `oracleSource`** per environment — no consumer code change, no SDK re-release.
 
-The in-house `waterx_rule` (ed25519 enclave-signed CEX prices, `src/oracle/rules/waterx-rule.ts`) took exactly this path: it pulls one enclave-signed batch envelope covering the requested tickers from the quote-center (`GET /v1/quotes/update?symbols=…`, public read — no auth), then verifies **and** feeds in a single `waterx_rule::collect_batch_latest` call per collector, so it emits no shared verify step. On-chain a freshness miss / replayed timestamp abstains (the other weighted rules cover); a config mismatch or bad signature aborts.
+The in-house `waterx_rule` (ed25519 enclave-signed CEX prices, `src/oracle/rules/waterx-rule.ts`) took exactly this path: it pulls one enclave-signed batch envelope covering the requested tickers from the quote-center (`GET /v1/quotes/update?symbols=…`, public read — no auth), then verifies **and** feeds in a single `waterx_rule::collect_batch_latest` call per collector, so it emits no shared verify step. On-chain a **freshness** miss abstains (the other weighted rules cover); a config mismatch or bad signature aborts — and so does a **replayed** signed timestamp (`EReplayedSignature`, audit F-014: a signed tuple is single-use per symbol, weight-independent). Consequence: two PTBs carrying the same envelope for the same symbol cannot both land — never share one fetched envelope across concurrent builds for the same symbol.
 
 > **Browser consumers:** this source fetches the quote-center directly from the page, so the quote-center deployment must return `Access-Control-Allow-Origin` for the app's origin. For an origin that is not on that allowlist, point the SDK at your own proxy instead of the default host — the endpoint and the transport are both overridable at client init:
 >
@@ -148,7 +158,7 @@ The in-house `waterx_rule` (ed25519 enclave-signed CEX prices, `src/oracle/rules
 > });
 > ```
 >
-> Unset, `waterxEndpoint` falls back to `WATERX_DEFAULTS[network]` and `waterxFetch` to `pythFetch`, then to the built-in policy (15s timeout, 2 retries). Both are inert under the Pyth sources. They are also top-level options on the umbrella `WaterXClient.create({ oracleSource, waterxEndpoint, waterxFetch, … })`, which forwards them to the perp line. Node/keeper consumers are unaffected by CORS either way.
+> Unset, `waterxEndpoint` falls back to the rule-owned `WATERX_INFRA[network]` and `waterxFetch` to the built-in policy (15s timeout, 2 retries) — there is deliberately no `pythFetch` fallback. Both are inert under the Pyth sources. They are also top-level options on the umbrella `WaterXClient.create({ oracleSource, waterxEndpoint, waterxFetch, … })`, which forwards them to the perp line. Node/keeper consumers are unaffected by CORS either way.
 
 ## Recipes & full surface
 

package/dist/cjs/src/account/config.d.ts

@@ -73,8 +73,9 @@ export interface WithdrawalQueuePackage {
 /**
  * Wormhole infra for the cross-chain credit bridge. `state_id` is the same
  * shared Sui Wormhole `State` object Pyth uses (kept in sync with
- * `PYTH_DEFAULTS[*].wormhole_state_id`). Override per-deployment via
- * `WaterXConfig.wormhole` if a deployment ever points elsewhere.
+ * `PYTH_CORE_INFRA[*].wormhole_state_id` in `oracle/pyth.ts`). Override
+ * per-deployment via `WaterXConfig.wormhole` if a deployment ever points
+ * elsewhere.
  */
 export interface WormholeInfraConfig {
     /** Shared Sui Wormhole `State` object. */

package/dist/cjs/src/generated/waterx_rule/waterx_rule.d.ts

@@ -70,11 +70,6 @@ export declare const BatchPricePayload: MoveStruct<{
         length: number;
     }, string>;
 }, "@waterx/rule::waterx_rule::BatchPricePayload">;
-export declare const MerkleRoot: MoveStruct<{
-    root: import("@mysten/sui/bcs").BcsType<number[], Iterable<number> & {
-        length: number;
-    }, string>;
-}, "@waterx/rule::waterx_rule::MerkleRoot">;
 export declare const FeedConfig: MoveStruct<{
     ticker: import("@mysten/sui/bcs").BcsType<string, string, "string">;
     sources: import("@mysten/sui/bcs").BcsType<string[], Iterable<string | number | bigint> & {
@@ -219,82 +214,17 @@ export interface CollectBatchLatestOptions {
  * and so aborts on any stale item, this path runs alongside Pyth/Supra. To let
  * those cover a lagging TEE — the blast-radius bound in the GCP ADR — a
  * _freshness_ miss ABSTAINS (records `none`, which `aggregator::remove_outliers`
- * drops before the `weight_threshold` fail-closed check), and so does a _replayed_
- * signed timestamp (the chain already accepted that snapshot — the on-chain price
- * is at least as fresh, and two concurrent keeper PTBs sharing one envelope must
- * not kill each other). A _config/integrity_ mismatch (source / ticker / method /
- * confidence / deviation) still ABORTS: an enclave whose signed payload disagrees
- * with the on-chain feed config is a red flag, not a liveness blip. Bad signature,
- * malformed batch, and a future timestamp always abort.
+ * drops before the `weight_threshold` fail-closed check). A _config/integrity_
+ * mismatch (source / ticker / method / confidence / deviation) still ABORTS: an
+ * enclave whose signed payload disagrees with the on-chain feed config is a red
+ * flag, not a liveness blip. Bad signature, malformed batch, a future timestamp,
+ * and replay always abort.
  *
  * Every gate is identical to `feed_batch_item_latest`; only the abort-vs-abstain
- * disposition of the freshness + replay gates differs, and the sink is the
- * caller's collector rather than a fresh single-rule one.
+ * disposition of the two freshness gates differs, and the sink is the caller's
+ * collector rather than a fresh single-rule one.
  */
 export declare function collectBatchLatest(options: CollectBatchLatestOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
-export interface FeedSingleWithProofArguments {
-    oracleObj: RawTransactionArgument<string>;
-    config: RawTransactionArgument<string>;
-    enclaveConfig: RawTransactionArgument<string>;
-    enclave: RawTransactionArgument<string>;
-    timestampMs: RawTransactionArgument<number | bigint>;
-    item: TransactionArgument;
-    proof: RawTransactionArgument<Array<Array<number>>>;
-    sig: RawTransactionArgument<Array<number>>;
-}
-export interface FeedSingleWithProofOptions {
-    package?: string;
-    arguments: FeedSingleWithProofArguments | [
-        oracleObj: RawTransactionArgument<string>,
-        config: RawTransactionArgument<string>,
-        enclaveConfig: RawTransactionArgument<string>,
-        enclave: RawTransactionArgument<string>,
-        timestampMs: RawTransactionArgument<number | bigint>,
-        item: TransactionArgument,
-        proof: RawTransactionArgument<Array<Array<number>>>,
-        sig: RawTransactionArgument<Array<number>>
-    ];
-}
-/**
- * Streaming per-symbol sibling of `feed_batch_latest`. Verifies ONE enclave
- * signature over a Merkle `root`, checks `item` is a leaf of that root via
- * `proof`, then runs the identical per-item gates + `oracle::aggregate`. Use for a
- * WaterxRule-only aggregator; for a Pyth-coexisting aggregator use
- * `collect_single_with_proof`.
- */
-export declare function feedSingleWithProof(options: FeedSingleWithProofOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
-export interface CollectSingleWithProofArguments {
-    collector: TransactionArgument;
-    config: RawTransactionArgument<string>;
-    enclaveConfig: RawTransactionArgument<string>;
-    enclave: RawTransactionArgument<string>;
-    timestampMs: RawTransactionArgument<number | bigint>;
-    item: TransactionArgument;
-    proof: RawTransactionArgument<Array<Array<number>>>;
-    sig: RawTransactionArgument<Array<number>>;
-}
-export interface CollectSingleWithProofOptions {
-    package?: string;
-    arguments: CollectSingleWithProofArguments | [
-        collector: TransactionArgument,
-        config: RawTransactionArgument<string>,
-        enclaveConfig: RawTransactionArgument<string>,
-        enclave: RawTransactionArgument<string>,
-        timestampMs: RawTransactionArgument<number | bigint>,
-        item: TransactionArgument,
-        proof: RawTransactionArgument<Array<Array<number>>>,
-        sig: RawTransactionArgument<Array<number>>
-    ];
-}
-/**
- * Collect-only sibling of `feed_single_with_proof` for the dual-rule latest path
- * (WaterX alongside Pyth on one aggregator), mirroring `collect_batch_latest`:
- * verifies root + proof, feeds the leaf into the caller's `PriceCollector` WITHOUT
- * calling `oracle::aggregate`. Abort vs abstain matches `collect_batch_latest`
- * exactly — a config/integrity mismatch aborts, a freshness miss abstains so Pyth
- * can cover a lagging TEE.
- */
-export declare function collectSingleWithProof(options: CollectSingleWithProofOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
 export interface QuoteForTimestampArguments {
     config: RawTransactionArgument<string>;
     enclaveConfig: RawTransactionArgument<string>;
@@ -491,27 +421,6 @@ export interface BatchPriceIntentOptions {
     ];
 }
 export declare function batchPriceIntent(options?: BatchPriceIntentOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
-export interface MerkleRootIntentOptions {
-    package?: string;
-    arguments?: [
-    ];
-}
-export declare function merkleRootIntent(options?: MerkleRootIntentOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
-export interface LeafHashOfArguments {
-    item: TransactionArgument;
-}
-export interface LeafHashOfOptions {
-    package?: string;
-    arguments: LeafHashOfArguments | [
-        item: TransactionArgument
-    ];
-}
-/**
- * The keccak256 leaf hash for `item` — `keccak256(0x00 || BCS(item))`. Exposed so
- * the off-chain builder / SDK can be pinned against the on-chain encoding in a
- * cross-implementation golden test.
- */
-export declare function leafHashOf(options: LeafHashOfOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
 export interface MaxBatchSizeOptions {
     package?: string;
     arguments?: [
@@ -808,42 +717,6 @@ export interface SourceGataUsdtPerpWsOptions {
     ];
 }
 export declare function sourceGataUsdtPerpWs(options?: SourceGataUsdtPerpWsOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
-export interface SourceBybitSpotWsOptions {
-    package?: string;
-    arguments?: [
-    ];
-}
-export declare function sourceBybitSpotWs(options?: SourceBybitSpotWsOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
-export interface SourceXstockEquityRestOptions {
-    package?: string;
-    arguments?: [
-    ];
-}
-export declare function sourceXstockEquityRest(options?: SourceXstockEquityRestOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
-export interface SourceOkxSpotWsOptions {
-    package?: string;
-    arguments?: [
-    ];
-}
-export declare function sourceOkxSpotWs(options?: SourceOkxSpotWsOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
-export interface SourceHyperliquidPerpWsOptions {
-    package?: string;
-    arguments?: [
-    ];
-}
-export declare function sourceHyperliquidPerpWs(options?: SourceHyperliquidPerpWsOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
-export interface SourceGateioSpotWsOptions {
-    package?: string;
-    arguments?: [
-    ];
-}
-export declare function sourceGateioSpotWs(options?: SourceGateioSpotWsOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
-export interface SourceKrakenSpotWsOptions {
-    package?: string;
-    arguments?: [
-    ];
-}
-export declare function sourceKrakenSpotWs(options?: SourceKrakenSpotWsOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
 export interface MethodDirectOptions {
     package?: string;
     arguments?: [

package/dist/cjs/src/generated/waterx_rule/waterx_rule.js

@@ -36,11 +36,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.BatchLatestUpdated = exports.HistoricalPriceVerified = exports.SignedTsHwmKey = exports.Config = exports.VerifiedPrice = exports.FeedConfig = exports.MerkleRoot = exports.BatchPricePayload = exports.BatchPriceItem = exports.PricePayload = exports.WaterxRule = exports.WATERX_RULE = void 0;
+exports.BatchLatestUpdated = exports.HistoricalPriceVerified = exports.SignedTsHwmKey = exports.Config = exports.VerifiedPrice = exports.FeedConfig = exports.BatchPricePayload = exports.BatchPriceItem = exports.PricePayload = exports.WaterxRule = exports.WATERX_RULE = void 0;
 exports.feedBatchLatest = feedBatchLatest;
 exports.collectBatchLatest = collectBatchLatest;
-exports.feedSingleWithProof = feedSingleWithProof;
-exports.collectSingleWithProof = collectSingleWithProof;
 exports.quoteForTimestamp = quoteForTimestamp;
 exports.destroyVerifiedPrice = destroyVerifiedPrice;
 exports.collectVerifiedPrice = collectVerifiedPrice;
@@ -52,8 +50,6 @@ exports.newBatchItem = newBatchItem;
 exports.pushBatchItem = pushBatchItem;
 exports.feedConfig = feedConfig;
 exports.batchPriceIntent = batchPriceIntent;
-exports.merkleRootIntent = merkleRootIntent;
-exports.leafHashOf = leafHashOf;
 exports.maxBatchSize = maxBatchSize;
 exports.batchItems = batchItems;
 exports.batchItemSymbol = batchItemSymbol;
@@ -86,12 +82,6 @@ exports.sourceBinanceUsdmPerpWs = sourceBinanceUsdmPerpWs;
 exports.sourceBybitLinearPerpWs = sourceBybitLinearPerpWs;
 exports.sourceGateioUsdtPerpWs = sourceGateioUsdtPerpWs;
 exports.sourceGataUsdtPerpWs = sourceGataUsdtPerpWs;
-exports.sourceBybitSpotWs = sourceBybitSpotWs;
-exports.sourceXstockEquityRest = sourceXstockEquityRest;
-exports.sourceOkxSpotWs = sourceOkxSpotWs;
-exports.sourceHyperliquidPerpWs = sourceHyperliquidPerpWs;
-exports.sourceGateioSpotWs = sourceGateioSpotWs;
-exports.sourceKrakenSpotWs = sourceKrakenSpotWs;
 exports.methodDirect = methodDirect;
 exports.methodMedian = methodMedian;
 exports.methodConfidence = methodConfidence;
@@ -142,9 +132,6 @@ exports.BatchPriceItem = new index_ts_1.MoveStruct({ name: `${$moduleName}::Batc
 exports.BatchPricePayload = new index_ts_1.MoveStruct({ name: `${$moduleName}::BatchPricePayload`, fields: {
         items: bcs_1.bcs.vector(exports.BatchPriceItem)
     } });
-exports.MerkleRoot = new index_ts_1.MoveStruct({ name: `${$moduleName}::MerkleRoot`, fields: {
-        root: bcs_1.bcs.vector(bcs_1.bcs.u8())
-    } });
 exports.FeedConfig = new index_ts_1.MoveStruct({ name: `${$moduleName}::FeedConfig`, fields: {
         ticker: bcs_1.bcs.string(),
         sources: bcs_1.bcs.vector(bcs_1.bcs.u64()),
@@ -230,17 +217,15 @@ function feedBatchLatest(options) {
  * and so aborts on any stale item, this path runs alongside Pyth/Supra. To let
  * those cover a lagging TEE — the blast-radius bound in the GCP ADR — a
  * _freshness_ miss ABSTAINS (records `none`, which `aggregator::remove_outliers`
- * drops before the `weight_threshold` fail-closed check), and so does a _replayed_
- * signed timestamp (the chain already accepted that snapshot — the on-chain price
- * is at least as fresh, and two concurrent keeper PTBs sharing one envelope must
- * not kill each other). A _config/integrity_ mismatch (source / ticker / method /
- * confidence / deviation) still ABORTS: an enclave whose signed payload disagrees
- * with the on-chain feed config is a red flag, not a liveness blip. Bad signature,
- * malformed batch, and a future timestamp always abort.
+ * drops before the `weight_threshold` fail-closed check). A _config/integrity_
+ * mismatch (source / ticker / method / confidence / deviation) still ABORTS: an
+ * enclave whose signed payload disagrees with the on-chain feed config is a red
+ * flag, not a liveness blip. Bad signature, malformed batch, a future timestamp,
+ * and replay always abort.
  *
  * Every gate is identical to `feed_batch_item_latest`; only the abort-vs-abstain
- * disposition of the freshness + replay gates differs, and the sink is the
- * caller's collector rather than a fresh single-rule one.
+ * disposition of the two freshness gates differs, and the sink is the caller's
+ * collector rather than a fresh single-rule one.
  */
 function collectBatchLatest(options) {
     const packageAddress = options.package ?? '@waterx/rule';
@@ -262,63 +247,6 @@ function collectBatchLatest(options) {
         arguments: (0, index_ts_1.normalizeMoveArguments)(options.arguments, argumentsTypes, parameterNames),
     });
 }
-/**
- * Streaming per-symbol sibling of `feed_batch_latest`. Verifies ONE enclave
- * signature over a Merkle `root`, checks `item` is a leaf of that root via
- * `proof`, then runs the identical per-item gates + `oracle::aggregate`. Use for a
- * WaterxRule-only aggregator; for a Pyth-coexisting aggregator use
- * `collect_single_with_proof`.
- */
-function feedSingleWithProof(options) {
-    const packageAddress = options.package ?? '@waterx/rule';
-    const argumentsTypes = [
-        null,
-        null,
-        '0x2::clock::Clock',
-        null,
-        null,
-        'u64',
-        null,
-        'vector<vector<u8>>',
-        'vector<u8>'
-    ];
-    const parameterNames = ["oracleObj", "config", "enclaveConfig", "enclave", "timestampMs", "item", "proof", "sig"];
-    return (tx) => tx.moveCall({
-        package: packageAddress,
-        module: 'waterx_rule',
-        function: 'feed_single_with_proof',
-        arguments: (0, index_ts_1.normalizeMoveArguments)(options.arguments, argumentsTypes, parameterNames),
-    });
-}
-/**
- * Collect-only sibling of `feed_single_with_proof` for the dual-rule latest path
- * (WaterX alongside Pyth on one aggregator), mirroring `collect_batch_latest`:
- * verifies root + proof, feeds the leaf into the caller's `PriceCollector` WITHOUT
- * calling `oracle::aggregate`. Abort vs abstain matches `collect_batch_latest`
- * exactly — a config/integrity mismatch aborts, a freshness miss abstains so Pyth
- * can cover a lagging TEE.
- */
-function collectSingleWithProof(options) {
-    const packageAddress = options.package ?? '@waterx/rule';
-    const argumentsTypes = [
-        null,
-        null,
-        '0x2::clock::Clock',
-        null,
-        null,
-        'u64',
-        null,
-        'vector<vector<u8>>',
-        'vector<u8>'
-    ];
-    const parameterNames = ["collector", "config", "enclaveConfig", "enclave", "timestampMs", "item", "proof", "sig"];
-    return (tx) => tx.moveCall({
-        package: packageAddress,
-        module: 'waterx_rule',
-        function: 'collect_single_with_proof',
-        arguments: (0, index_ts_1.normalizeMoveArguments)(options.arguments, argumentsTypes, parameterNames),
-    });
-}
 /**
  * Verifies a historical quote without touching `waterx_oracle`.
  *
@@ -510,32 +438,6 @@ function batchPriceIntent(options = {}) {
         function: 'batch_price_intent',
     });
 }
-function merkleRootIntent(options = {}) {
-    const packageAddress = options.package ?? '@waterx/rule';
-    return (tx) => tx.moveCall({
-        package: packageAddress,
-        module: 'waterx_rule',
-        function: 'merkle_root_intent',
-    });
-}
-/**
- * The keccak256 leaf hash for `item` — `keccak256(0x00 || BCS(item))`. Exposed so
- * the off-chain builder / SDK can be pinned against the on-chain encoding in a
- * cross-implementation golden test.
- */
-function leafHashOf(options) {
-    const packageAddress = options.package ?? '@waterx/rule';
-    const argumentsTypes = [
-        null
-    ];
-    const parameterNames = ["item"];
-    return (tx) => tx.moveCall({
-        package: packageAddress,
-        module: 'waterx_rule',
-        function: 'leaf_hash_of',
-        arguments: (0, index_ts_1.normalizeMoveArguments)(options.arguments, argumentsTypes, parameterNames),
-    });
-}
 function maxBatchSize(options = {}) {
     const packageAddress = options.package ?? '@waterx/rule';
     return (tx) => tx.moveCall({
@@ -922,54 +824,6 @@ function sourceGataUsdtPerpWs(options = {}) {
         function: 'source_gata_usdt_perp_ws',
     });
 }
-function sourceBybitSpotWs(options = {}) {
-    const packageAddress = options.package ?? '@waterx/rule';
-    return (tx) => tx.moveCall({
-        package: packageAddress,
-        module: 'waterx_rule',
-        function: 'source_bybit_spot_ws',
-    });
-}
-function sourceXstockEquityRest(options = {}) {
-    const packageAddress = options.package ?? '@waterx/rule';
-    return (tx) => tx.moveCall({
-        package: packageAddress,
-        module: 'waterx_rule',
-        function: 'source_xstock_equity_rest',
-    });
-}
-function sourceOkxSpotWs(options = {}) {
-    const packageAddress = options.package ?? '@waterx/rule';
-    return (tx) => tx.moveCall({
-        package: packageAddress,
-        module: 'waterx_rule',
-        function: 'source_okx_spot_ws',
-    });
-}
-function sourceHyperliquidPerpWs(options = {}) {
-    const packageAddress = options.package ?? '@waterx/rule';
-    return (tx) => tx.moveCall({
-        package: packageAddress,
-        module: 'waterx_rule',
-        function: 'source_hyperliquid_perp_ws',
-    });
-}
-function sourceGateioSpotWs(options = {}) {
-    const packageAddress = options.package ?? '@waterx/rule';
-    return (tx) => tx.moveCall({
-        package: packageAddress,
-        module: 'waterx_rule',
-        function: 'source_gateio_spot_ws',
-    });
-}
-function sourceKrakenSpotWs(options = {}) {
-    const packageAddress = options.package ?? '@waterx/rule';
-    return (tx) => tx.moveCall({
-        package: packageAddress,
-        module: 'waterx_rule',
-        function: 'source_kraken_spot_ws',
-    });
-}
 function methodDirect(options = {}) {
     const packageAddress = options.package ?? '@waterx/rule';
     return (tx) => tx.moveCall({

package/dist/cjs/src/oracle/aggregate.d.ts

@@ -19,7 +19,8 @@
  *
  * `refreshOraclePrices` additionally routes the on-chain price *update* leg
  * (the fetch + verify/push step, before any of the above feeding) through the
- * `PriceUpdateRule` selected by `host.oracleSource` — see `rule-registry.ts`.
+ * `PriceUpdateRule` of EVERY source in the `host.oracleSources` fed set — see
+ * `rule-registry.ts`.
  */
 import type { Transaction, TransactionArgument } from "@mysten/sui/transactions";
 import type { OracleHost } from "./host.ts";
@@ -84,27 +85,26 @@ export declare function aggregateTickerWithConstant(tx: Transaction, host: Oracl
  * entry, Lazer if the lazer update leg served it — see below — Supra when
  * enabled, Constant when it's a constant ticker).
  *
- * Before that, the on-chain price *update* leg is routed by `host.oracleSource`
- * (see `rule-registry.ts`): the ONE selected source serves every ticker in its
- * `supportedTickers(host)`. There is **no cross-source fallback** — a requested
- * ticker the selected source does not serve, and that is not a constant-only
- * ticker (which needs no price-update leg), fails the build immediately with a
- * clear error naming the ticker and source. That is the deliberate "fail the
- * tx-build, don't silently reroute" contract: a wrong-but-present feed id is
- * NOT validated here (it surfaces on-chain at dry-run); a MISSING feed for the
- * selected source is caught here. When the selected source's feed exists but is
- * wrong, this function does nothing special — the on-chain aggregate aborts at
- * dry-run, which is correct.
+ * Before that, the on-chain price *update* leg is routed by the
+ * `host.oracleSources` fed set (see `rule-registry.ts`): EVERY listed source
+ * updates the tickers its own `supportedTickers(host)` serves, all in this one
+ * PTB. There is **no cross-source fallback** — a requested ticker NO listed
+ * source serves, and that is not a constant-only ticker (which needs no
+ * price-update leg), fails the build immediately with a clear error naming
+ * the ticker and the list. That is the deliberate "fail the tx-build, don't
+ * silently reroute" contract: a wrong-but-present feed id is NOT validated
+ * here (it surfaces on-chain at dry-run); a ticker MISSING from every listed
+ * source's feeds is caught here.
  *
- * The selected source's fetch + build runs against its own infra, guaranteeing
- * per-rule PTB atomicity. A fee-source pre-check runs first (the source's
- * `requiresFeeSource`) BEFORE any off-chain fetch or PTB mutation — so a
- * fee-charging source with no `opts.feeSource` throws
+ * Each source's fetch + build runs against its own infra, guaranteeing
+ * per-rule PTB atomicity. A fee-source pre-check runs first (any listed
+ * source's `requiresFeeSource`) BEFORE any off-chain fetch or PTB mutation —
+ * so a fee-charging source with no `opts.feeSource` throws
  * `OracleFeeSourceUnavailable` with zero wasted network calls and zero stray
- * moveCalls. Only once that check passes does the off-chain fetch run and
- * complete before any PTB mutation; on-chain reads inside `buildUpdateCalls`
- * can still fail mid-append for other reasons — callers discard the tx on any
- * throw.
+ * moveCalls. Only once that check passes do the off-chain fetches run — in
+ * parallel across sources — and ALL settle before the first PTB mutation;
+ * on-chain reads inside `buildUpdateCalls` can still fail mid-append for
+ * other reasons — callers discard the tx on any throw.
  *
  * **Collector-feed leg is rule-aware:** a lazer-served group's
  * `buildUpdateCalls` returns the verified `Update` PTB value
@@ -139,7 +139,7 @@ export declare function refreshOraclePrices(tx: Transaction, host: OracleHost, t
     /**
      * @internal Test-only: layer fake `PriceUpdateRule`s on top of the
      * production registry (see `rule-registry.ts`'s `resolveOracleRule`).
-     * Production callers never set this — routing is by `host.oracleSource`
+     * Production callers never set this — routing is by `host.oracleSources`
      * alone.
      */
     ruleOverrides?: Partial<Record<OracleSource, PriceUpdateRule>>;