@waterx/sdk 4.1.0 → 4.3.1

package/dist/cjs/src/oracle/rules/pyth-lazer-rule.js

@@ -9,12 +9,38 @@
  * `Update` PTB value back through a `RuleUpdateHandle` for the feed calls.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PythLazerRule = exports.LazerApiKeyMissingError = void 0;
+exports.PythLazerRule = exports.LazerApiKeyMissingError = exports.LAZER_INFRA = void 0;
 exports.feedLazerRule = feedLazerRule;
 const bcs_1 = require("@mysten/bcs");
-const config_ts_1 = require("../config.js");
+const record_ts_1 = require("../../utils/record.js");
 const price_update_rule_ts_1 = require("../price-update-rule.js");
 const update_fetch_ts_1 = require("../update-fetch.js");
+/**
+ * Pyth Lazer (Pyth Pro) external infra — owned by THIS source, by network.
+ * Per-network constants for infrastructure Pyth operates (not part of the
+ * `waterx-config` JSON), co-located with the only rule that reads them —
+ * no other oracle source ever touches a Lazer endpoint or verifier.
+ *
+ * - `endpoint` — Lazer HTTP API base; signed updates come from
+ *   `POST /v1/latest_price` (Bearer-authenticated). The service is
+ *   network-agnostic (one signed payload verifies on any chain that trusts the
+ *   Lazer signers), so both networks share the production host.
+ * - `verifier_package` — the Sui package carrying
+ *   `pyth_lazer::parse_and_verify_le_ecdsa_update`. Per-network: testnet is
+ *   still the original v1 publish; mainnet is the v2-upgraded package (which
+ *   still exposes the v1 entry `pyth_lazer_rule` binds). Values mirror the
+ *   contract repo's `pyth_lazer_rule/Move.toml` published-at pins.
+ */
+exports.LAZER_INFRA = {
+    MAINNET: {
+        endpoint: "https://pyth-lazer.dourolabs.app",
+        verifier_package: "0xefbfd064480777699fd9c557a5804d72ace7bc82661fdc8d1f1a44ea6d92ee10",
+    },
+    TESTNET: {
+        endpoint: "https://pyth-lazer.dourolabs.app",
+        verifier_package: "0xf5bd2141967507050a91b58de3d95e77c432cd90d1799ee46effc27430a68c21",
+    },
+};
 /**
  * Signed-update request pins, mirroring what the on-chain rule consumes:
  * - `properties` — `price` + `exponent` are REQUIRED by
@@ -142,7 +168,9 @@ exports.PythLazerRule = {
         // not fail per ticker as if only that feed were missing.
         const { feeds } = requireLazerPackage(host);
         const feedIds = tickers.map((ticker) => {
-            const feedId = feeds[ticker];
+            // ownEntry: a prototype-key ticker ("toString") must throw here as
+            // unlisted, not turn an inherited Function into a "feed id".
+            const feedId = (0, record_ts_1.ownEntry)(feeds, ticker);
             if (feedId === undefined) {
                 throw new Error(`No pyth_lazer_rule feed listed for ticker: ${ticker}`);
             }
@@ -152,7 +180,7 @@ exports.PythLazerRule = {
         if (!apiKey) {
             throw new LazerApiKeyMissingError();
         }
-        const update = await fetchLazerSignedUpdate(config_ts_1.LAZER_DEFAULTS[host.network].endpoint, apiKey, feedIds, host.pyth.fetch);
+        const update = await fetchLazerSignedUpdate(exports.LAZER_INFRA[host.network].endpoint, apiKey, feedIds, host.pyth.fetch);
         return { kind: "pyth_lazer_rule", payload: { update, feedIds } };
     },
     /**
@@ -170,7 +198,7 @@ exports.PythLazerRule = {
             return null;
         const packedFeedIds = new Set(payload.feedIds);
         for (const ticker of tickers) {
-            const feedId = host.config.packages.pyth_lazer_rule?.feeds?.[ticker];
+            const feedId = (0, record_ts_1.ownEntry)(host.config.packages.pyth_lazer_rule?.feeds, ticker);
             if (feedId === undefined || !packedFeedIds.has(feedId))
                 return null;
         }
@@ -189,7 +217,7 @@ exports.PythLazerRule = {
             return undefined;
         const lazer = requireLazerPackage(host);
         const [update] = tx.moveCall({
-            target: `${config_ts_1.LAZER_DEFAULTS[host.network].verifier_package}::pyth_lazer::parse_and_verify_le_ecdsa_update`,
+            target: `${exports.LAZER_INFRA[host.network].verifier_package}::pyth_lazer::parse_and_verify_le_ecdsa_update`,
             arguments: [tx.object(lazer.state), tx.object.clock(), tx.pure.vector("u8", payload.update)],
         });
         return { kind: "pyth_lazer_rule", update };

package/dist/cjs/src/oracle/rules/pyth-rule.js

@@ -10,6 +10,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.feedPythRule = feedPythRule;
 const pyth_rule_ts_1 = require("../../generated/waterx_pyth_rule/pyth_rule.js");
+const pyth_ts_1 = require("../pyth.js");
 function feedPythRule(tx, host, collector, priceInfoObjectId) {
     (0, pyth_rule_ts_1.feed)({
         package: host.config.packages.pyth_rule.published_at,
@@ -18,10 +19,10 @@ function feedPythRule(tx, host, collector, priceInfoObjectId) {
             config: tx.object(host.config.packages.pyth_rule.config),
             // The deployed pyth_rule package is compiled against the Core pyth
             // dependency, so its `&PythState` parameter is the Core-package-qualified
-            // type and `host.pyth` (the fixed per-network Core infra) is always the
-            // right state to pass. The config's price_info_object entries are Core
-            // objects to match.
-            pythState: tx.object(host.pyth.state_id),
+            // type and the Core source's own per-network state (`PYTH_CORE_INFRA`)
+            // is always the right state to pass. The config's price_info_object
+            // entries are Core objects to match.
+            pythState: tx.object(pyth_ts_1.PYTH_CORE_INFRA[host.network].state_id),
             pythPriceInfo: tx.object(priceInfoObjectId),
         },
     })(tx);

package/dist/cjs/src/oracle/rules/waterx-rule.d.ts

@@ -4,7 +4,7 @@
  * `aggregateTicker` appends per waterx-routed ticker. Pulls one enclave-signed
  * batch envelope covering every requested ticker from the quote-center
  * (`GET /v1/quotes/update?symbols=…`, endpoint from `host.waterx` — the
- * `waterxEndpoint`/`waterxFetch` create options — else `WATERX_DEFAULTS`), then —
+ * `waterxEndpoint`/`waterxFetch` create options — else its own `WATERX_INFRA`), then —
  * unlike Pyth Lazer, whose verify is a single shared PTB step — verifies AND
  * feeds in ONE `waterx_rule::collect_batch_latest` call per collector (the Move
  * API bundles the two). So `buildUpdateCalls` emits nothing and the signed
@@ -13,12 +13,47 @@
  * `collect_batch_latest` is the dual-rule path: it feeds the item matching
  * `collector.symbol()` WITHOUT aggregating, so a waterx-routed ticker composes
  * onto the same collector as Pyth/Supra (compose-then-aggregate). On-chain a
- * freshness miss / replayed timestamp ABSTAINS (the other weighted rules
- * cover); a config/integrity mismatch or bad signature aborts.
+ * FRESHNESS miss ABSTAINS (the other weighted rules cover); a config/
+ * integrity mismatch, bad signature, future timestamp — or a REPLAYED signed
+ * timestamp — ABORTS (`EReplayedSignature`, audit F-014: a signed tuple is
+ * single-use per symbol, enforced by a per-symbol high-water mark BEFORE any
+ * weight arbitration). Consequence for concurrent builds: two PTBs carrying
+ * the same envelope for the same symbol cannot both land — the second aborts
+ * even if the rule is unweighted for that ticker. Never share one fetched
+ * envelope across builds that may execute concurrently for the same symbol.
  */
 import type { Transaction, TransactionArgument } from "@mysten/sui/transactions";
+import type { Network } from "../../constants.ts";
 import type { OracleHost } from "../host.ts";
 import { type PriceUpdateRule, type RuleUpdateData } from "../price-update-rule.ts";
+/** The single signing intent the quote-center emits — exported so read-plane
+ *  consumers can mirror the rule's own envelope intent check (a mispointed
+ *  endpoint must be rejected by reads exactly as tx-builds reject it). */
+export declare const BATCH_PRICE_INTENT = 1;
+/**
+ * WaterX quote-center external infra — owned by THIS source, by network.
+ * Mirrors `PYTH_CORE_INFRA` (oracle/pyth.ts) and `LAZER_INFRA`
+ * (rules/pyth-lazer-rule.ts): per-network constants for infrastructure the
+ * source's operator runs, co-located with the only rule that reads them — no
+ * other oracle source ever touches a quote-center endpoint. Public read (no
+ * auth), so there is no api_key. `endpoint` has no trailing slash — the rule
+ * appends the path.
+ *
+ * These are the DEFAULTS behind the caller's `client.waterx` access slice
+ * (`waterxEndpoint` / `waterxFetch` create options) — the browser-CORS proxy
+ * hook, since this is the one source fetched from the page.
+ */
+export declare const WATERX_INFRA: Record<Network, {
+    endpoint: string;
+}>;
+/**
+ * The waterx source's quote-center base for `network` — the ONE accessor
+ * consumers (BE/FE read planes) use when, and only when, their own
+ * `ORACLE_SOURCE` resolves to `'waterx_rule'`. Mirrors
+ * `pythCoreHermesEndpoint`. Under any other source the read endpoint is that
+ * source's own configuration — never this one.
+ */
+export declare function waterxQuoteCenterEndpoint(network: Network): string;
 /**
  * One item inside a signed batch payload, mirroring the quote-center
  * `/v1/quotes/update` JSON 1:1 (snake_case). The u64 integer fields are the
@@ -82,8 +117,10 @@ export declare function waterxEnvelopeOf(data: RuleUpdateData): WaterxSignedEnve
  * per item, the exact shape the enclave signed) and contribute the price for
  * `collector.symbol()` to the collector. One collect call re-verifies the batch
  * signature and picks this collector's symbol out of the batch; on-chain it
- * abstains (records `none`) instead of aborting when the symbol is stale,
- * absent from the batch, or its timestamp was already accepted (replay).
+ * abstains (records `none`) when the symbol is stale or absent from the batch,
+ * but ABORTS `EReplayedSignature` when the symbol's signed timestamp was
+ * already accepted (per-symbol high-water mark, audit F-014) — see the module
+ * header for the concurrent-build consequence.
  */
 export declare function feedWaterxRule(tx: Transaction, host: OracleHost, collector: TransactionArgument, envelope: WaterxSignedEnvelope): void;
 export declare const WaterxRule: PriceUpdateRule;

package/dist/cjs/src/oracle/rules/waterx-rule.js

@@ -5,7 +5,7 @@
  * `aggregateTicker` appends per waterx-routed ticker. Pulls one enclave-signed
  * batch envelope covering every requested ticker from the quote-center
  * (`GET /v1/quotes/update?symbols=…`, endpoint from `host.waterx` — the
- * `waterxEndpoint`/`waterxFetch` create options — else `WATERX_DEFAULTS`), then —
+ * `waterxEndpoint`/`waterxFetch` create options — else its own `WATERX_INFRA`), then —
  * unlike Pyth Lazer, whose verify is a single shared PTB step — verifies AND
  * feeds in ONE `waterx_rule::collect_batch_latest` call per collector (the Move
  * API bundles the two). So `buildUpdateCalls` emits nothing and the signed
@@ -14,21 +14,57 @@
  * `collect_batch_latest` is the dual-rule path: it feeds the item matching
  * `collector.symbol()` WITHOUT aggregating, so a waterx-routed ticker composes
  * onto the same collector as Pyth/Supra (compose-then-aggregate). On-chain a
- * freshness miss / replayed timestamp ABSTAINS (the other weighted rules
- * cover); a config/integrity mismatch or bad signature aborts.
+ * FRESHNESS miss ABSTAINS (the other weighted rules cover); a config/
+ * integrity mismatch, bad signature, future timestamp — or a REPLAYED signed
+ * timestamp — ABORTS (`EReplayedSignature`, audit F-014: a signed tuple is
+ * single-use per symbol, enforced by a per-symbol high-water mark BEFORE any
+ * weight arbitration). Consequence for concurrent builds: two PTBs carrying
+ * the same envelope for the same symbol cannot both land — the second aborts
+ * even if the rule is unweighted for that ticker. Never share one fetched
+ * envelope across builds that may execute concurrently for the same symbol.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WaterxRule = void 0;
+exports.WaterxRule = exports.WATERX_INFRA = exports.BATCH_PRICE_INTENT = void 0;
+exports.waterxQuoteCenterEndpoint = waterxQuoteCenterEndpoint;
 exports.parseSignedEnvelope = parseSignedEnvelope;
 exports.waterxEnvelopeOf = waterxEnvelopeOf;
 exports.feedWaterxRule = feedWaterxRule;
 const bcs_1 = require("@mysten/bcs");
 const waterx_rule_ts_1 = require("../../generated/waterx_rule/waterx_rule.js");
-const config_ts_1 = require("../config.js");
+const record_ts_1 = require("../../utils/record.js");
 const price_update_rule_ts_1 = require("../price-update-rule.js");
 const update_fetch_ts_1 = require("../update-fetch.js");
-/** The single signing intent (`BATCH_PRICE_INTENT`) the quote-center emits. */
-const BATCH_PRICE_INTENT = 1;
+/** The single signing intent the quote-center emits — exported so read-plane
+ *  consumers can mirror the rule's own envelope intent check (a mispointed
+ *  endpoint must be rejected by reads exactly as tx-builds reject it). */
+exports.BATCH_PRICE_INTENT = 1;
+/**
+ * WaterX quote-center external infra — owned by THIS source, by network.
+ * Mirrors `PYTH_CORE_INFRA` (oracle/pyth.ts) and `LAZER_INFRA`
+ * (rules/pyth-lazer-rule.ts): per-network constants for infrastructure the
+ * source's operator runs, co-located with the only rule that reads them — no
+ * other oracle source ever touches a quote-center endpoint. Public read (no
+ * auth), so there is no api_key. `endpoint` has no trailing slash — the rule
+ * appends the path.
+ *
+ * These are the DEFAULTS behind the caller's `client.waterx` access slice
+ * (`waterxEndpoint` / `waterxFetch` create options) — the browser-CORS proxy
+ * hook, since this is the one source fetched from the page.
+ */
+exports.WATERX_INFRA = {
+    MAINNET: { endpoint: "https://quote-center.waterx.app" },
+    TESTNET: { endpoint: "https://quote-center-staging.waterx.app" },
+};
+/**
+ * The waterx source's quote-center base for `network` — the ONE accessor
+ * consumers (BE/FE read planes) use when, and only when, their own
+ * `ORACLE_SOURCE` resolves to `'waterx_rule'`. Mirrors
+ * `pythCoreHermesEndpoint`. Under any other source the read endpoint is that
+ * source's own configuration — never this one.
+ */
+function waterxQuoteCenterEndpoint(network) {
+    return exports.WATERX_INFRA[network].endpoint;
+}
 /**
  * Shape check ONLY — the `kind` discriminant is checked separately by the
  * caller before this runs (mirrors the other rules' guard split), so a
@@ -90,18 +126,21 @@ function requireWaterxPackage(host) {
     return entry;
 }
 /**
- * Resolve the quote-center infra for this host: the `waterxEndpoint` /
- * `waterxFetch` create options when the client carries them, else the network
- * default. The fetch policy falls back to the shared `pyth.fetch` policy so a
- * consumer that already tuned timeouts/retries once keeps them here.
+ * Resolve the quote-center infra for this host: each field independently from
+ * the caller's `client.waterx` access slice (`waterxEndpoint` / `waterxFetch`
+ * create options) when set, else this source's own `WATERX_INFRA` default /
+ * `fetchWithPolicy`'s built-ins. Deliberately NO fallback onto `pyth.fetch`
+ * or any other source's policy — sources stay fully independent.
  *
  * This is the seam a browser consumer needs: the envelope is fetched FROM THE
  * PAGE, so a front end whose origin the quote-center does not allow (CORS)
  * points `endpoint` at a same-origin proxy, or supplies its own `fetchImpl`.
  */
 function resolveWaterxInfra(host) {
-    const infra = host.waterx ?? config_ts_1.WATERX_DEFAULTS[host.network];
-    return { endpoint: infra.endpoint, fetch: infra.fetch ?? host.pyth.fetch };
+    return {
+        endpoint: host.waterx?.endpoint ?? exports.WATERX_INFRA[host.network].endpoint,
+        fetch: host.waterx?.fetch,
+    };
 }
 /**
  * Pull one enclave-signed batch envelope covering `symbols` from the
@@ -136,8 +175,8 @@ async function fetchWaterxSignedUpdate(endpoint, symbols, fetchOpts) {
     // Parse from raw text (not res.json()) so the u64 fields are decoded exact as
     // bigint — see parseSignedEnvelope. Malformed-shape check lives there.
     const envelope = parseSignedEnvelope(await res.text());
-    if (envelope.intent !== BATCH_PRICE_INTENT) {
-        throw new Error(`WaterX quote-center returned intent ${envelope.intent}, expected BATCH_PRICE_INTENT ${BATCH_PRICE_INTENT}`);
+    if (envelope.intent !== exports.BATCH_PRICE_INTENT) {
+        throw new Error(`WaterX quote-center returned intent ${envelope.intent}, expected BATCH_PRICE_INTENT ${exports.BATCH_PRICE_INTENT}`);
     }
     return envelope;
 }
@@ -157,8 +196,10 @@ function decodeSig(hex) {
  * per item, the exact shape the enclave signed) and contribute the price for
  * `collector.symbol()` to the collector. One collect call re-verifies the batch
  * signature and picks this collector's symbol out of the batch; on-chain it
- * abstains (records `none`) instead of aborting when the symbol is stale,
- * absent from the batch, or its timestamp was already accepted (replay).
+ * abstains (records `none`) when the symbol is stale or absent from the batch,
+ * but ABORTS `EReplayedSignature` when the symbol's signed timestamp was
+ * already accepted (per-symbol high-water mark, audit F-014) — see the module
+ * header for the concurrent-build consequence.
  */
 function feedWaterxRule(tx, host, collector, envelope) {
     const wr = requireWaterxPackage(host);
@@ -227,7 +268,9 @@ exports.WaterxRule = {
         // not fail per ticker as if only that feed were missing.
         const { feeds } = requireWaterxPackage(host);
         for (const ticker of tickers) {
-            if (feeds[ticker] === undefined) {
+            // ownEntry: a prototype-key ticker ("toString") must throw here as
+            // unlisted, not pass as an inherited Function and reach the network.
+            if ((0, record_ts_1.ownEntry)(feeds, ticker) === undefined) {
                 throw new Error(`No waterx_rule feed listed for ticker: ${ticker}`);
             }
         }

package/dist/cjs/src/oracle/source-list.d.ts

@@ -0,0 +1,36 @@
+/**
+ * `source-list.ts` — THE parser for a consumer's `ORACLE_SOURCE` env string
+ * (comma list of `OracleSource` values → the fed set). The FE and BE
+ * previously carried twin hand-written parsers whose semantics drifted once
+ * in review (a trailing comma booted one deployment green and 500'd the
+ * other); this canonical behavior is what both fold onto:
+ *
+ *  - split on `,`, trim entries, DROP empties (trailing/doubled commas are
+ *    the most common env typo, never a boot failure)
+ *  - validate every entry against {@link ORACLE_SOURCES}
+ *  - dedupe, order-preserving (list order is consumer read-plane policy —
+ *    the SDK's own fed-set build treats the list as a set)
+ *  - throw an operator-actionable error on empty/unset/invalid input —
+ *    there is NO default oracle source
+ *
+ * The SDK still never reads `process.env` — callers pass the raw string.
+ *
+ * STRICTER than the consumers' previous `in`-operator checks: a value named
+ * like an `Object.prototype` key (`toString`, `constructor`, …) passed those
+ * and died deep in the stack; `Set.has` rejects it here at parse.
+ *
+ * Zod adopters: this THROWS a plain Error. Inside a zod `.transform()` a
+ * throw escapes `schema.parse()` un-aggregated and masks sibling issues —
+ * wrap it: `try { return parseOracleSourceList(raw); } catch (e) {
+ * ctx.addIssue({ code: "custom", message: (e as Error).message }); return
+ * z.NEVER; }`.
+ */
+import { type OracleSource } from "./price-update-rule.ts";
+/**
+ * THE runtime membership check for {@link ORACLE_SOURCES} — the parser below
+ * and `PerpClient`'s ctor validation both use this one predicate, so the env
+ * parser and the create-option front door can never disagree. `Set.has`,
+ * never `in`/bracket reads (prototype-chain safe by construction).
+ */
+export declare function isOracleSource(value: string): value is OracleSource;
+export declare function parseOracleSourceList(raw: string | null | undefined): OracleSource[];

package/dist/cjs/src/oracle/source-list.js

@@ -0,0 +1,57 @@
+"use strict";
+/**
+ * `source-list.ts` — THE parser for a consumer's `ORACLE_SOURCE` env string
+ * (comma list of `OracleSource` values → the fed set). The FE and BE
+ * previously carried twin hand-written parsers whose semantics drifted once
+ * in review (a trailing comma booted one deployment green and 500'd the
+ * other); this canonical behavior is what both fold onto:
+ *
+ *  - split on `,`, trim entries, DROP empties (trailing/doubled commas are
+ *    the most common env typo, never a boot failure)
+ *  - validate every entry against {@link ORACLE_SOURCES}
+ *  - dedupe, order-preserving (list order is consumer read-plane policy —
+ *    the SDK's own fed-set build treats the list as a set)
+ *  - throw an operator-actionable error on empty/unset/invalid input —
+ *    there is NO default oracle source
+ *
+ * The SDK still never reads `process.env` — callers pass the raw string.
+ *
+ * STRICTER than the consumers' previous `in`-operator checks: a value named
+ * like an `Object.prototype` key (`toString`, `constructor`, …) passed those
+ * and died deep in the stack; `Set.has` rejects it here at parse.
+ *
+ * Zod adopters: this THROWS a plain Error. Inside a zod `.transform()` a
+ * throw escapes `schema.parse()` un-aggregated and masks sibling issues —
+ * wrap it: `try { return parseOracleSourceList(raw); } catch (e) {
+ * ctx.addIssue({ code: "custom", message: (e as Error).message }); return
+ * z.NEVER; }`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isOracleSource = isOracleSource;
+exports.parseOracleSourceList = parseOracleSourceList;
+const price_update_rule_ts_1 = require("./price-update-rule.js");
+// Widened-annotation Set (not an assertion) so the type predicate below
+// narrows by CONSTRUCTION rather than by cast.
+const ORACLE_SOURCE_SET = new Set(price_update_rule_ts_1.ORACLE_SOURCES);
+/**
+ * THE runtime membership check for {@link ORACLE_SOURCES} — the parser below
+ * and `PerpClient`'s ctor validation both use this one predicate, so the env
+ * parser and the create-option front door can never disagree. `Set.has`,
+ * never `in`/bracket reads (prototype-chain safe by construction).
+ */
+function isOracleSource(value) {
+    return ORACLE_SOURCE_SET.has(value);
+}
+function parseOracleSourceList(raw) {
+    const parts = (raw ?? "")
+        .split(",")
+        .map((part) => part.trim())
+        .filter((part) => part !== "");
+    const sources = parts.filter(isOracleSource);
+    if (parts.length === 0 || sources.length !== parts.length) {
+        const got = raw == null || raw.trim() === "" ? "unset" : `'${raw}'`;
+        throw new Error(`ORACLE_SOURCE must be a comma-separated list of ${price_update_rule_ts_1.ORACLE_SOURCES.join(" | ")} ` +
+            `(got ${got}) — there is NO default oracle source; set it in the deployment's env.`);
+    }
+    return [...new Set(sources)];
+}

package/dist/cjs/src/perp/client.d.ts

@@ -11,37 +11,50 @@
  * {@link PerpConfigView}. This class is just the wiring + factory between them.
  */
 import { BaseLineClient } from "../base-client.ts";
-import type { OracleSource } from "../oracle/price-update-rule.ts";
+import { type OracleSource } from "../oracle/price-update-rule.ts";
 import type { FetchPolicy } from "../oracle/update-fetch.ts";
-import { type LoadConfigOptions, type PythFetchPolicy, type PythInfraConfig, type WaterXConfig, type WaterxInfraConfig, type WormholeInfraConfig } from "./config.ts";
+import { type LoadConfigOptions, type PythAccessConfig, type PythFetchPolicy, type WaterxAccessConfig, type WaterXConfig, type WormholeInfraConfig } from "./config.ts";
 import type { Network } from "./constants.ts";
 export interface CreateClientOptions extends LoadConfigOptions {
     grpcUrl?: string;
     /**
-     * Which oracle price-update source drives `refreshOraclePrices`. Each source
-     * is self-contained (own infra + config) with NO cross-source fallback:
+     * Which oracle price-update source drives `refreshOraclePrices`. REQUIRED —
+     * there is NO default source: every deployment names its source explicitly
+     * (wire it from your own env var, e.g. `ORACLE_SOURCE`). Each source is
+     * self-contained (own infra, own endpoints, own config) with NO cross-source
+     * fallback:
      *
-     * - `'pyth_rule'` (default) — Pyth Core `pyth_rule` updates (Hermes VAA +
-     *   per-feed update fees), Core state + keyless Core Hermes.
+     * - `'pyth_rule'` — Pyth Core `pyth_rule` updates (Hermes VAA + per-feed
+     *   update fees); Core state + Hermes endpoint live in the source's own
+     *   `PYTH_CORE_INFRA` table.
      * - `'pyth_lazer_rule'` — Pyth Lazer signed updates (ONE `leEcdsa` verify
      *   per PTB, no per-feed fees); needs `packages.pyth_lazer_rule` with feeds
-     *   and a `pythApiKey` (Lazer is auth-first).
+     *   and a `pythApiKey` (Lazer is auth-first); Lazer infra lives in the
+     *   source's own `LAZER_INFRA` table.
      * - `'waterx_rule'` — the first-party WaterX quote-center (Nautilus-TEE,
      *   ed25519-signed batches): ONE envelope covering the build's tickers,
      *   verified AND fed by a single `collect_batch_latest` per collector. No
      *   credential and no per-update fee; needs `packages.waterx_rule` with
-     *   feeds. Endpoint/transport via {@link CreateClientOptions.waterxEndpoint}
-     *   / {@link CreateClientOptions.waterxFetch} — the browser-CORS proxy hook,
+     *   feeds. Quote-center infra lives in the source's own `WATERX_INFRA`
+     *   table; endpoint/transport overridable via
+     *   {@link CreateClientOptions.waterxEndpoint} /
+     *   {@link CreateClientOptions.waterxFetch} — the browser-CORS proxy hook,
      *   since this is the one source fetched from the page.
      *
      * The name is source-neutral on purpose — a source need not be Pyth (as
      * `'waterx_rule'` shows). Selecting a source whose feed for a requested
      * ticker is absent is NOT an error at client creation: it fails at tx-build
-     * time for exactly those tickers (see `refreshOraclePrices`). The Pyth Core
-     * infra is fixed per network by `PYTH_DEFAULTS` and is not
-     * deployment-overridable.
+     * time for exactly those tickers (see `refreshOraclePrices`).
+     *
+     * Accepts a SINGLE source or a LIST. A list means every listed source's
+     * data is fetched and fed in one build — required whenever the on-chain
+     * weight tables have more than one rule weighted (e.g. a Core→Pro or
+     * Pro+Waterx coexistence window): the chain drops unweighted contributions
+     * (harmless) but aborts on a starved weighted rule, so the list must stay a
+     * SUPERSET of every ticker's weighted set. Order is meaningful to consumers
+     * (read-plane priority), not to the on-chain build.
      */
-    oracleSource?: OracleSource;
+    oracleSource: OracleSource | OracleSource[];
     /**
      * Pyth Lazer access token (`Authorization: Bearer …`). Required under
      * `oracleSource: 'pyth_lazer_rule'` (Lazer is auth-first) and unused by
@@ -57,7 +70,7 @@ export interface CreateClientOptions extends LoadConfigOptions {
     pythFetch?: PythFetchPolicy;
     /**
      * Quote-center base URL for `oracleSource: 'waterx_rule'` — overrides the
-     * per-network {@link WATERX_DEFAULTS} host.
+     * source's own per-network `WATERX_INFRA` default.
      *
      * This is the one source a BROWSER fetches itself (the signed envelope is
      * pulled from the page), so it is bound by the quote-center deployment's CORS
@@ -73,28 +86,28 @@ export interface CreateClientOptions extends LoadConfigOptions {
     waterxEndpoint?: string;
     /**
      * Retry/timeout policy — and `fetchImpl` — for the quote-center fetch (see
-     * `fetchWithPolicy`). Optional: falls back to `pythFetch`, then to the
-     * built-in defaults. Supply `fetchImpl` to route the request through your own
+     * `fetchWithPolicy`). Optional: falls back to the built-in defaults — never
+     * to `pythFetch` (sources stay independent). Supply `fetchImpl` to route the request through your own
      * transport (a proxying `fetch` wrapper, a non-global `fetch`, a test double).
      */
     waterxFetch?: FetchPolicy;
 }
 export declare class PerpClient extends BaseLineClient<WaterXConfig> {
-    /** Pyth Core infra (fixed per network) plus the caller-supplied credential/policy. */
-    pyth: PythInfraConfig;
+    /** Caller-supplied Pyth credential + fetch policy — NO infra; each source owns its own tables. */
+    pyth: PythAccessConfig;
     /**
-     * WaterX quote-center infra for `oracleSource: 'waterx_rule'` — the network
-     * default, overridden by the `waterxEndpoint` / `waterxFetch` create options
-     * (a same-origin proxy or a custom `fetchImpl` for browser consumers).
+     * Caller-supplied quote-center overrides for `oracleSource: 'waterx_rule'`
+     * (`waterxEndpoint` / `waterxFetch` create options) — access-only, mirroring
+     * `pyth` above; unset fields resolve against the rule's own `WATERX_INFRA`.
      */
-    waterx: WaterxInfraConfig;
+    waterx: WaterxAccessConfig;
     /** Wormhole infra for the credit bridge (network defaults unless overridden). */
     wormhole: WormholeInfraConfig;
-    /** Selected oracle price-update source (`oracleSource` create option; default `'pyth_rule'`). */
-    readonly oracleSource: OracleSource;
+    /** The fed set: `oracleSource` create option normalized to a non-empty, deduped list. */
+    readonly oracleSources: readonly OracleSource[];
     /** Canonical-schema lookups (delegated to below); no transport. */
     private readonly view;
-    constructor(network: Network, config: WaterXConfig, opts?: CreateClientOptions);
+    constructor(network: Network, config: WaterXConfig, opts: CreateClientOptions);
     /**
      * Async factory: fetches the deployment config for `network` and returns
      * a ready-to-use client. Pass `opts.cache=true` to memoize the JSON.
@@ -103,9 +116,9 @@ export declare class PerpClient extends BaseLineClient<WaterXConfig> {
      * not an error at init — it surfaces at tx-build time for the specific
      * tickers that source can't serve (see `refreshOraclePrices`).
      */
-    static create(network: Network, opts?: CreateClientOptions): Promise<PerpClient>;
-    static mainnet(opts?: CreateClientOptions): Promise<PerpClient>;
-    static testnet(opts?: CreateClientOptions): Promise<PerpClient>;
+    static create(network: Network, opts: CreateClientOptions): Promise<PerpClient>;
+    static mainnet(opts: CreateClientOptions): Promise<PerpClient>;
+    static testnet(opts: CreateClientOptions): Promise<PerpClient>;
     /** @see PerpConfigView.getMarket */
     getMarket(ticker: string): import("./config.ts").WaterxPerpMarketEntry;
     /** @see PerpConfigView.getAggregator */

package/dist/cjs/src/perp/client.js

@@ -14,44 +14,56 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PerpClient = void 0;
 const base_client_ts_1 = require("../base-client.js");
+const price_update_rule_ts_1 = require("../oracle/price-update-rule.js");
+const source_list_ts_1 = require("../oracle/source-list.js");
 const config_view_ts_1 = require("./config-view.js");
 const config_ts_1 = require("./config.js");
 class PerpClient extends base_client_ts_1.BaseLineClient {
-    /** Pyth Core infra (fixed per network) plus the caller-supplied credential/policy. */
+    /** Caller-supplied Pyth credential + fetch policy — NO infra; each source owns its own tables. */
     pyth;
     /**
-     * WaterX quote-center infra for `oracleSource: 'waterx_rule'` — the network
-     * default, overridden by the `waterxEndpoint` / `waterxFetch` create options
-     * (a same-origin proxy or a custom `fetchImpl` for browser consumers).
+     * Caller-supplied quote-center overrides for `oracleSource: 'waterx_rule'`
+     * (`waterxEndpoint` / `waterxFetch` create options) — access-only, mirroring
+     * `pyth` above; unset fields resolve against the rule's own `WATERX_INFRA`.
      */
     waterx;
     /** Wormhole infra for the credit bridge (network defaults unless overridden). */
     wormhole;
-    /** Selected oracle price-update source (`oracleSource` create option; default `'pyth_rule'`). */
-    oracleSource;
+    /** The fed set: `oracleSource` create option normalized to a non-empty, deduped list. */
+    oracleSources;
     /** Canonical-schema lookups (delegated to below); no transport. */
     view;
-    constructor(network, config, opts = {}) {
+    constructor(network, config, opts) {
         super(network, config, opts);
-        // Pyth Core infra is fixed per network — NOT deployment-overridable and
-        // NOT source-dependent (the pyth_lazer_rule source reads only api_key/fetch
-        // from here). The api_key + fetch policy are caller-supplied at init: a
-        // secret has no place in the canonical waterx-config JSON.
+        // Access-only slice: the api_key + fetch policy are caller-supplied at
+        // init (a secret has no place in the canonical waterx-config JSON). All
+        // endpoint/object-id infra is per-source, owned by the rule modules —
+        // nothing infra-shaped lives on the client.
         this.pyth = {
-            ...config_ts_1.PYTH_DEFAULTS[network],
             ...(opts.pythApiKey !== undefined ? { api_key: opts.pythApiKey } : {}),
             ...(opts.pythFetch !== undefined ? { fetch: opts.pythFetch } : {}),
         };
         this.wormhole = config.wormhole ?? config_ts_1.WORMHOLE_DEFAULTS[network];
-        // Quote-center infra: network default, each field independently overridable
-        // — a browser blocked by the quote-center's CORS allowlist swaps `endpoint`
-        // for a same-origin proxy without touching anything else.
+        // Quote-center access slice: overrides only — a browser blocked by the
+        // quote-center's CORS allowlist swaps `endpoint` for a same-origin proxy;
+        // unset fields resolve inside the rule against WATERX_INFRA[network].
         this.waterx = {
-            ...config_ts_1.WATERX_DEFAULTS[network],
             ...(opts.waterxEndpoint !== undefined ? { endpoint: opts.waterxEndpoint } : {}),
             ...(opts.waterxFetch !== undefined ? { fetch: opts.waterxFetch } : {}),
         };
-        this.oracleSource = opts.oracleSource ?? "pyth_rule";
+        // Normalize single-or-list to a deduped, order-preserving list, gated by
+        // `isOracleSource` — the SAME predicate `parseOracleSourceList` uses. An
+        // empty list, a nullish entry (an untyped caller omitting the REQUIRED
+        // option), or an unregistered value (`'core'`, `'pyth'`, …) fails
+        // construction loudly instead of booting green and surfacing as
+        // `OracleSourceNotImplemented` at the first tx-build.
+        const sources = Array.isArray(opts.oracleSource) ? opts.oracleSource : [opts.oracleSource];
+        this.oracleSources = [...new Set(sources)];
+        if (this.oracleSources.length === 0 ||
+            this.oracleSources.some((source) => !(0, source_list_ts_1.isOracleSource)(source))) {
+            throw new Error(`oracleSource is REQUIRED and must name at least one of ${price_update_rule_ts_1.ORACLE_SOURCES.join(" | ")} ` +
+                `(got ${JSON.stringify(sources)})`);
+        }
         this.view = new config_view_ts_1.PerpConfigView(() => this.config, () => this.wormhole);
     }
     /**
@@ -62,14 +74,14 @@ class PerpClient extends base_client_ts_1.BaseLineClient {
      * not an error at init — it surfaces at tx-build time for the specific
      * tickers that source can't serve (see `refreshOraclePrices`).
      */
-    static async create(network, opts = {}) {
+    static async create(network, opts) {
         const config = await (0, config_ts_1.loadConfig)(network, opts);
         return new PerpClient(network, config, opts);
     }
-    static mainnet(opts = {}) {
+    static mainnet(opts) {
         return PerpClient.create("MAINNET", opts);
     }
-    static testnet(opts = {}) {
+    static testnet(opts) {
         return PerpClient.create("TESTNET", opts);
     }
     // ========================================================