@waterx/sdk 4.1.0 → 4.3.1

package/dist/src/generated/waterx_rule/waterx_rule.js

@@ -41,9 +41,6 @@ export const BatchPriceItem = new MoveStruct({ name: `${$moduleName}::BatchPrice
 export const BatchPricePayload = new MoveStruct({ name: `${$moduleName}::BatchPricePayload`, fields: {
         items: bcs.vector(BatchPriceItem)
     } });
-export const MerkleRoot = new MoveStruct({ name: `${$moduleName}::MerkleRoot`, fields: {
-        root: bcs.vector(bcs.u8())
-    } });
 export const FeedConfig = new MoveStruct({ name: `${$moduleName}::FeedConfig`, fields: {
         ticker: bcs.string(),
         sources: bcs.vector(bcs.u64()),
@@ -129,17 +126,15 @@ export function feedBatchLatest(options) {
  * and so aborts on any stale item, this path runs alongside Pyth/Supra. To let
  * those cover a lagging TEE — the blast-radius bound in the GCP ADR — a
  * _freshness_ miss ABSTAINS (records `none`, which `aggregator::remove_outliers`
- * drops before the `weight_threshold` fail-closed check), and so does a _replayed_
- * signed timestamp (the chain already accepted that snapshot — the on-chain price
- * is at least as fresh, and two concurrent keeper PTBs sharing one envelope must
- * not kill each other). A _config/integrity_ mismatch (source / ticker / method /
- * confidence / deviation) still ABORTS: an enclave whose signed payload disagrees
- * with the on-chain feed config is a red flag, not a liveness blip. Bad signature,
- * malformed batch, and a future timestamp always abort.
+ * drops before the `weight_threshold` fail-closed check). A _config/integrity_
+ * mismatch (source / ticker / method / confidence / deviation) still ABORTS: an
+ * enclave whose signed payload disagrees with the on-chain feed config is a red
+ * flag, not a liveness blip. Bad signature, malformed batch, a future timestamp,
+ * and replay always abort.
  *
  * Every gate is identical to `feed_batch_item_latest`; only the abort-vs-abstain
- * disposition of the freshness + replay gates differs, and the sink is the
- * caller's collector rather than a fresh single-rule one.
+ * disposition of the two freshness gates differs, and the sink is the caller's
+ * collector rather than a fresh single-rule one.
  */
 export function collectBatchLatest(options) {
     const packageAddress = options.package ?? '@waterx/rule';
@@ -161,63 +156,6 @@ export function collectBatchLatest(options) {
         arguments: normalizeMoveArguments(options.arguments, argumentsTypes, parameterNames),
     });
 }
-/**
- * Streaming per-symbol sibling of `feed_batch_latest`. Verifies ONE enclave
- * signature over a Merkle `root`, checks `item` is a leaf of that root via
- * `proof`, then runs the identical per-item gates + `oracle::aggregate`. Use for a
- * WaterxRule-only aggregator; for a Pyth-coexisting aggregator use
- * `collect_single_with_proof`.
- */
-export function feedSingleWithProof(options) {
-    const packageAddress = options.package ?? '@waterx/rule';
-    const argumentsTypes = [
-        null,
-        null,
-        '0x2::clock::Clock',
-        null,
-        null,
-        'u64',
-        null,
-        'vector<vector<u8>>',
-        'vector<u8>'
-    ];
-    const parameterNames = ["oracleObj", "config", "enclaveConfig", "enclave", "timestampMs", "item", "proof", "sig"];
-    return (tx) => tx.moveCall({
-        package: packageAddress,
-        module: 'waterx_rule',
-        function: 'feed_single_with_proof',
-        arguments: normalizeMoveArguments(options.arguments, argumentsTypes, parameterNames),
-    });
-}
-/**
- * Collect-only sibling of `feed_single_with_proof` for the dual-rule latest path
- * (WaterX alongside Pyth on one aggregator), mirroring `collect_batch_latest`:
- * verifies root + proof, feeds the leaf into the caller's `PriceCollector` WITHOUT
- * calling `oracle::aggregate`. Abort vs abstain matches `collect_batch_latest`
- * exactly — a config/integrity mismatch aborts, a freshness miss abstains so Pyth
- * can cover a lagging TEE.
- */
-export function collectSingleWithProof(options) {
-    const packageAddress = options.package ?? '@waterx/rule';
-    const argumentsTypes = [
-        null,
-        null,
-        '0x2::clock::Clock',
-        null,
-        null,
-        'u64',
-        null,
-        'vector<vector<u8>>',
-        'vector<u8>'
-    ];
-    const parameterNames = ["collector", "config", "enclaveConfig", "enclave", "timestampMs", "item", "proof", "sig"];
-    return (tx) => tx.moveCall({
-        package: packageAddress,
-        module: 'waterx_rule',
-        function: 'collect_single_with_proof',
-        arguments: normalizeMoveArguments(options.arguments, argumentsTypes, parameterNames),
-    });
-}
 /**
  * Verifies a historical quote without touching `waterx_oracle`.
  *
@@ -409,32 +347,6 @@ export function batchPriceIntent(options = {}) {
         function: 'batch_price_intent',
     });
 }
-export function merkleRootIntent(options = {}) {
-    const packageAddress = options.package ?? '@waterx/rule';
-    return (tx) => tx.moveCall({
-        package: packageAddress,
-        module: 'waterx_rule',
-        function: 'merkle_root_intent',
-    });
-}
-/**
- * The keccak256 leaf hash for `item` — `keccak256(0x00 || BCS(item))`. Exposed so
- * the off-chain builder / SDK can be pinned against the on-chain encoding in a
- * cross-implementation golden test.
- */
-export function leafHashOf(options) {
-    const packageAddress = options.package ?? '@waterx/rule';
-    const argumentsTypes = [
-        null
-    ];
-    const parameterNames = ["item"];
-    return (tx) => tx.moveCall({
-        package: packageAddress,
-        module: 'waterx_rule',
-        function: 'leaf_hash_of',
-        arguments: normalizeMoveArguments(options.arguments, argumentsTypes, parameterNames),
-    });
-}
 export function maxBatchSize(options = {}) {
     const packageAddress = options.package ?? '@waterx/rule';
     return (tx) => tx.moveCall({
@@ -821,54 +733,6 @@ export function sourceGataUsdtPerpWs(options = {}) {
         function: 'source_gata_usdt_perp_ws',
     });
 }
-export function sourceBybitSpotWs(options = {}) {
-    const packageAddress = options.package ?? '@waterx/rule';
-    return (tx) => tx.moveCall({
-        package: packageAddress,
-        module: 'waterx_rule',
-        function: 'source_bybit_spot_ws',
-    });
-}
-export function sourceXstockEquityRest(options = {}) {
-    const packageAddress = options.package ?? '@waterx/rule';
-    return (tx) => tx.moveCall({
-        package: packageAddress,
-        module: 'waterx_rule',
-        function: 'source_xstock_equity_rest',
-    });
-}
-export function sourceOkxSpotWs(options = {}) {
-    const packageAddress = options.package ?? '@waterx/rule';
-    return (tx) => tx.moveCall({
-        package: packageAddress,
-        module: 'waterx_rule',
-        function: 'source_okx_spot_ws',
-    });
-}
-export function sourceHyperliquidPerpWs(options = {}) {
-    const packageAddress = options.package ?? '@waterx/rule';
-    return (tx) => tx.moveCall({
-        package: packageAddress,
-        module: 'waterx_rule',
-        function: 'source_hyperliquid_perp_ws',
-    });
-}
-export function sourceGateioSpotWs(options = {}) {
-    const packageAddress = options.package ?? '@waterx/rule';
-    return (tx) => tx.moveCall({
-        package: packageAddress,
-        module: 'waterx_rule',
-        function: 'source_gateio_spot_ws',
-    });
-}
-export function sourceKrakenSpotWs(options = {}) {
-    const packageAddress = options.package ?? '@waterx/rule';
-    return (tx) => tx.moveCall({
-        package: packageAddress,
-        module: 'waterx_rule',
-        function: 'source_kraken_spot_ws',
-    });
-}
 export function methodDirect(options = {}) {
     const packageAddress = options.package ?? '@waterx/rule';
     return (tx) => tx.moveCall({

package/dist/src/oracle/aggregate.d.ts

@@ -19,7 +19,8 @@
  *
  * `refreshOraclePrices` additionally routes the on-chain price *update* leg
  * (the fetch + verify/push step, before any of the above feeding) through the
- * `PriceUpdateRule` selected by `host.oracleSource` — see `rule-registry.ts`.
+ * `PriceUpdateRule` of EVERY source in the `host.oracleSources` fed set — see
+ * `rule-registry.ts`.
  */
 import type { Transaction, TransactionArgument } from "@mysten/sui/transactions";
 import type { OracleHost } from "./host.ts";
@@ -84,27 +85,26 @@ export declare function aggregateTickerWithConstant(tx: Transaction, host: Oracl
  * entry, Lazer if the lazer update leg served it — see below — Supra when
  * enabled, Constant when it's a constant ticker).
  *
- * Before that, the on-chain price *update* leg is routed by `host.oracleSource`
- * (see `rule-registry.ts`): the ONE selected source serves every ticker in its
- * `supportedTickers(host)`. There is **no cross-source fallback** — a requested
- * ticker the selected source does not serve, and that is not a constant-only
- * ticker (which needs no price-update leg), fails the build immediately with a
- * clear error naming the ticker and source. That is the deliberate "fail the
- * tx-build, don't silently reroute" contract: a wrong-but-present feed id is
- * NOT validated here (it surfaces on-chain at dry-run); a MISSING feed for the
- * selected source is caught here. When the selected source's feed exists but is
- * wrong, this function does nothing special — the on-chain aggregate aborts at
- * dry-run, which is correct.
+ * Before that, the on-chain price *update* leg is routed by the
+ * `host.oracleSources` fed set (see `rule-registry.ts`): EVERY listed source
+ * updates the tickers its own `supportedTickers(host)` serves, all in this one
+ * PTB. There is **no cross-source fallback** — a requested ticker NO listed
+ * source serves, and that is not a constant-only ticker (which needs no
+ * price-update leg), fails the build immediately with a clear error naming
+ * the ticker and the list. That is the deliberate "fail the tx-build, don't
+ * silently reroute" contract: a wrong-but-present feed id is NOT validated
+ * here (it surfaces on-chain at dry-run); a ticker MISSING from every listed
+ * source's feeds is caught here.
  *
- * The selected source's fetch + build runs against its own infra, guaranteeing
- * per-rule PTB atomicity. A fee-source pre-check runs first (the source's
- * `requiresFeeSource`) BEFORE any off-chain fetch or PTB mutation — so a
- * fee-charging source with no `opts.feeSource` throws
+ * Each source's fetch + build runs against its own infra, guaranteeing
+ * per-rule PTB atomicity. A fee-source pre-check runs first (any listed
+ * source's `requiresFeeSource`) BEFORE any off-chain fetch or PTB mutation —
+ * so a fee-charging source with no `opts.feeSource` throws
  * `OracleFeeSourceUnavailable` with zero wasted network calls and zero stray
- * moveCalls. Only once that check passes does the off-chain fetch run and
- * complete before any PTB mutation; on-chain reads inside `buildUpdateCalls`
- * can still fail mid-append for other reasons — callers discard the tx on any
- * throw.
+ * moveCalls. Only once that check passes do the off-chain fetches run — in
+ * parallel across sources — and ALL settle before the first PTB mutation;
+ * on-chain reads inside `buildUpdateCalls` can still fail mid-append for
+ * other reasons — callers discard the tx on any throw.
  *
  * **Collector-feed leg is rule-aware:** a lazer-served group's
  * `buildUpdateCalls` returns the verified `Update` PTB value
@@ -139,7 +139,7 @@ export declare function refreshOraclePrices(tx: Transaction, host: OracleHost, t
     /**
      * @internal Test-only: layer fake `PriceUpdateRule`s on top of the
      * production registry (see `rule-registry.ts`'s `resolveOracleRule`).
-     * Production callers never set this — routing is by `host.oracleSource`
+     * Production callers never set this — routing is by `host.oracleSources`
      * alone.
      */
     ruleOverrides?: Partial<Record<OracleSource, PriceUpdateRule>>;

package/dist/src/oracle/aggregate.js

@@ -19,9 +19,11 @@
  *
  * `refreshOraclePrices` additionally routes the on-chain price *update* leg
  * (the fetch + verify/push step, before any of the above feeding) through the
- * `PriceUpdateRule` selected by `host.oracleSource` — see `rule-registry.ts`.
+ * `PriceUpdateRule` of EVERY source in the `host.oracleSources` fed set — see
+ * `rule-registry.ts`.
  */
 import { aggregate as aggregateCall, newCollector } from "../generated/waterx_oracle/oracle.js";
+import { ownEntry } from "../utils/record.js";
 import { OracleFeeSourceUnavailableError } from "./pyth.js";
 import { resolveOracleRule } from "./rule-registry.js";
 import { feedConstantRule } from "./rules/constant-rule.js";
@@ -115,7 +117,13 @@ export function aggregateTicker(tx, host, args) {
         // waterx_rule::collect_batch_latest verifies the batch signature and feeds
         // this collector's symbol from the batch. If the ticker's aggregator does
         // not (yet) weight `WaterxRule`, the contribution is silently dropped
-        // on-chain — feeding ahead of the weight migration is harmless.
+        // on-chain — feeding ahead of the weight migration is safe for THIS tx.
+        // CAVEAT (unlike lazer): the feed call records a per-symbol signed-
+        // timestamp high-water mark REGARDLESS of weights, and a replayed
+        // timestamp ABORTS (`EReplayedSignature`, audit F-014) — so two PTBs
+        // carrying the same envelope for the same symbol cannot both land; the
+        // second aborts even where waterx is unweighted. See WaterxRule's module
+        // header.
         feedWaterxRule(tx, host, collector, args.waterxEnvelope);
         fed = true;
     }
@@ -156,7 +164,7 @@ export function aggregateTickerWithPyth(tx, host, args) {
  * {@link refreshOraclePrices}), which feeds both.
  */
 export function aggregateTickerWithConstant(tx, host, args) {
-    if (host.config.packages.pyth_rule?.feeds?.[args.ticker] !== undefined) {
+    if (ownEntry(host.config.packages.pyth_rule?.feeds, args.ticker) !== undefined) {
         throw new Error(`'${args.ticker}' is in pyth_rule.feeds (dual-feed) — feed both via aggregateTicker({ priceInfoObjectId }) / refreshOraclePrices, not aggregateTickerWithConstant`);
     }
     aggregateTicker(tx, host, { ticker: args.ticker });
@@ -167,27 +175,26 @@ export function aggregateTickerWithConstant(tx, host, args) {
  * entry, Lazer if the lazer update leg served it — see below — Supra when
  * enabled, Constant when it's a constant ticker).
  *
- * Before that, the on-chain price *update* leg is routed by `host.oracleSource`
- * (see `rule-registry.ts`): the ONE selected source serves every ticker in its
- * `supportedTickers(host)`. There is **no cross-source fallback** — a requested
- * ticker the selected source does not serve, and that is not a constant-only
- * ticker (which needs no price-update leg), fails the build immediately with a
- * clear error naming the ticker and source. That is the deliberate "fail the
- * tx-build, don't silently reroute" contract: a wrong-but-present feed id is
- * NOT validated here (it surfaces on-chain at dry-run); a MISSING feed for the
- * selected source is caught here. When the selected source's feed exists but is
- * wrong, this function does nothing special — the on-chain aggregate aborts at
- * dry-run, which is correct.
+ * Before that, the on-chain price *update* leg is routed by the
+ * `host.oracleSources` fed set (see `rule-registry.ts`): EVERY listed source
+ * updates the tickers its own `supportedTickers(host)` serves, all in this one
+ * PTB. There is **no cross-source fallback** — a requested ticker NO listed
+ * source serves, and that is not a constant-only ticker (which needs no
+ * price-update leg), fails the build immediately with a clear error naming
+ * the ticker and the list. That is the deliberate "fail the tx-build, don't
+ * silently reroute" contract: a wrong-but-present feed id is NOT validated
+ * here (it surfaces on-chain at dry-run); a ticker MISSING from every listed
+ * source's feeds is caught here.
  *
- * The selected source's fetch + build runs against its own infra, guaranteeing
- * per-rule PTB atomicity. A fee-source pre-check runs first (the source's
- * `requiresFeeSource`) BEFORE any off-chain fetch or PTB mutation — so a
- * fee-charging source with no `opts.feeSource` throws
+ * Each source's fetch + build runs against its own infra, guaranteeing
+ * per-rule PTB atomicity. A fee-source pre-check runs first (any listed
+ * source's `requiresFeeSource`) BEFORE any off-chain fetch or PTB mutation —
+ * so a fee-charging source with no `opts.feeSource` throws
  * `OracleFeeSourceUnavailable` with zero wasted network calls and zero stray
- * moveCalls. Only once that check passes does the off-chain fetch run and
- * complete before any PTB mutation; on-chain reads inside `buildUpdateCalls`
- * can still fail mid-append for other reasons — callers discard the tx on any
- * throw.
+ * moveCalls. Only once that check passes do the off-chain fetches run — in
+ * parallel across sources — and ALL settle before the first PTB mutation;
+ * on-chain reads inside `buildUpdateCalls` can still fail mid-append for
+ * other reasons — callers discard the tx on any throw.
  *
  * **Collector-feed leg is rule-aware:** a lazer-served group's
  * `buildUpdateCalls` returns the verified `Update` PTB value
@@ -208,78 +215,121 @@ export function aggregateTickerWithConstant(tx, host, args) {
 export async function refreshOraclePrices(tx, host, tickers, opts = {}) {
     if (tickers.length === 0)
         return;
+    // Dedupe the caller's list (order-preserving): a repeated ticker would
+    // otherwise aggregate TWICE in this one PTB — wasted gas for every rule,
+    // and a hard ABORT under waterx: the second `collect_batch_latest` carries
+    // the same envelope, and the on-chain per-symbol replay guard rejects an
+    // already-accepted signed timestamp (`EReplayedSignature`, F-014) even
+    // inside a single transaction.
+    tickers = [...new Set(tickers)];
     // price_info_object lookup for every ticker with a pyth_rule.feeds entry —
     // needed by aggregateTicker's (unchanged) Pyth feed step below regardless of
     // which rule performed the on-chain update for that ticker.
-    const pythTickers = tickers.filter((t) => host.config.packages.pyth_rule?.feeds?.[t] !== undefined);
+    const pythTickers = tickers.filter((t) => ownEntry(host.config.packages.pyth_rule?.feeds, t) !== undefined);
     const priceInfoByTicker = new Map();
     pythTickers.forEach((t) => priceInfoByTicker.set(t, host.getPythFeed(t).price_info_object));
-    // ONE source, no fallback. The selected source serves the tickers in its
-    // `supportedTickers(host)`; `source` is tracked alongside the group (rather
-    // than read back off `rule.kind`, typed as the broader PriceUpdateRuleKind)
-    // so the provider lookup below has an OracleSource to key on without a cast.
-    const selectedRule = resolveOracleRule(host.oracleSource, opts.ruleOverrides);
-    const selectedSupported = new Set(selectedRule.supportedTickers(host));
-    // Fail the tx-build (NOT client init, NOT a silent reroute) when the selected
-    // source has no feed for a requested ticker that actually needs a price
+    // The fed set is a LIST (`host.oracleSources`, normalized + deduped at
+    // client creation): ONE build carries every listed source's data, and the
+    // chain's per-ticker weight tables decide which contributions count —
+    // feeding an unweighted rule's PRICE is dropped on-chain, while starving a
+    // weighted one aborts. That asymmetry is what makes weight migrations
+    // safe: flip weights per ticker at any time while the fed set stays a
+    // superset of every ticker's weighted set. (One caveat: waterx's feed call
+    // burns a per-symbol signed-timestamp high-water mark regardless of
+    // weights — see aggregateTicker's waterx branch.) Still NO fallback
+    // BETWEEN sources: each group serves only the tickers its own feeds list.
+    // Zero-ticker groups are dropped here so everything downstream (fee check,
+    // fetch fan-out, update-leg build) can assume every group has work.
+    const groups = host.oracleSources
+        .map((source) => {
+        const rule = resolveOracleRule(source, opts.ruleOverrides);
+        const supported = new Set(rule.supportedTickers(host));
+        return { source, rule, tickers: tickers.filter((t) => supported.has(t)) };
+    })
+        .filter((group) => group.tickers.length > 0);
+    // Fail the tx-build (NOT client init, NOT a silent reroute) when NO listed
+    // source has a feed for a requested ticker that actually needs a price
     // update. Only a CONSTANT-ONLY ticker is exempt — priced entirely by
     // `constant_rule`, it needs no update leg from any source. A DUAL-FEED ticker
     // (constant AND pyth) still needs its Pyth leg refreshed, so `isConstantTicker`
-    // alone must NOT exempt it: under a source that can't serve it, with no
-    // fallback, feeding an unrefreshed Pyth leg would price it stale (or abort on a
-    // missing weighted source). `priceInfoByTicker.has(t)` ⇔ the ticker has a
-    // `pyth_rule.feeds` entry, so `constant && !hasPyth` is exactly constant-only.
-    // This catches a MISSING feed; a present-but-WRONG feed id is deliberately not
-    // validated here (it aborts on-chain at dry-run).
+    // alone must NOT exempt it: with no source able to serve it, feeding an
+    // unrefreshed Pyth leg would price it stale (or abort on a missing weighted
+    // source). `priceInfoByTicker.has(t)` ⇔ the ticker has a `pyth_rule.feeds`
+    // entry, so `constant && !hasPyth` is exactly constant-only. This catches a
+    // MISSING feed; a present-but-WRONG feed id is deliberately not validated
+    // here (it aborts on-chain at dry-run).
+    const covered = new Set(groups.flatMap((group) => group.tickers));
     const isConstantOnly = (t) => host.isConstantTicker(t) && !priceInfoByTicker.has(t);
-    const unservable = tickers.filter((t) => !selectedSupported.has(t) && !isConstantOnly(t));
+    const unservable = tickers.filter((t) => !covered.has(t) && !isConstantOnly(t));
     if (unservable.length > 0) {
-        throw new Error(`oracleSource '${host.oracleSource}' has no feed configured for ticker(s): ` +
+        const sources = host.oracleSources.join(", ");
+        throw new Error(`oracleSource [${sources}] has no feed configured for ticker(s): ` +
             `${unservable.join(", ")}. Sources are self-contained with no fallback — add ` +
-            `${host.oracleSource} feeds for them, or select a source that serves them.`);
+            `feeds for them under a listed source, or list a source that serves them.`);
     }
-    const selectedGroup = tickers.filter((t) => selectedSupported.has(t));
-    // Fee-source pre-check, hoisted ABOVE the off-chain fetch and PTB build below.
-    // It consults only `rule.requiresFeeSource` — known before any fetch or PTB
-    // mutation — so a fee-charging source with no `feeSource` throws with ZERO
-    // wasted network calls and zero PTB commands, rather than waiting for
-    // `buildPythPriceUpdateCalls`'s own per-call guard to fire after the off-chain
-    // fetch already ran.
-    if (selectedGroup.length > 0 && !opts.feeSource && selectedRule.requiresFeeSource) {
+    // Fee-source pre-check, hoisted ABOVE the off-chain fetches and PTB build
+    // below. It consults only `rule.requiresFeeSource` — known before any fetch
+    // or PTB mutation — so a fee-charging source (Pyth Core) in the fed set with
+    // no `feeSource` throws with ZERO wasted network calls and zero PTB
+    // commands, rather than waiting for `buildPythPriceUpdateCalls`'s own
+    // per-call guard to fire after the off-chain fetches already ran.
+    if (!opts.feeSource && groups.some((group) => group.rule.requiresFeeSource)) {
         throw new OracleFeeSourceUnavailableError();
     }
-    // Resolve + build the selected source's update leg. The off-chain fetch
-    // settles before the first PTB mutation, so a fetch failure never strands
-    // moveCalls in a caller-owned tx. Map each lazer-served ticker to the one
-    // verified `Update` PTB value for the collector-feed leg below.
+    // Phase 1 — resolve every group's update data IN PARALLEL: the per-source
+    // fetches (Hermes VAA / Lazer POST / quote-center GET) are independent
+    // network calls on the tx-build money path, so a multi-source fed set must
+    // not pay one RTT per source sequentially. ALL fetches settle before the
+    // first PTB mutation below, so a fetch failure never strands moveCalls in a
+    // caller-owned tx — and a failure in ANY group fails the whole build (a
+    // listed source is load-bearing; silently building without it would starve
+    // its weighted tickers on-chain).
+    const dataByGroup = await Promise.all(groups.map((group) => resolveGroupUpdateData(host, group, opts.updateDataProvider)));
+    // Phase 2 — build each group's update leg sequentially, in list order, so
+    // PTB command order stays deterministic. The carry step below is an
+    // exhaustive switch over the group's rule kind: a future source whose feed
+    // leg needs per-ticker data from its update leg must decide its carry here
+    // — falling through silently would starve its weighted tickers on-chain.
     const lazerUpdateByTicker = new Map();
     // Signed batch envelope per waterx-served ticker. Unlike Lazer's shared PTB
     // handle, waterx's verify+feed is bundled into `collect_batch_latest` in the
     // per-ticker feed leg, so its `buildUpdateCalls` emits nothing and the
     // envelope is carried straight from the group's fetched data.
     const waterxEnvelopeByTicker = new Map();
-    if (selectedGroup.length > 0) {
-        const group = { source: host.oracleSource, rule: selectedRule, tickers: selectedGroup };
-        const data = await resolveGroupUpdateData(host, group, opts.updateDataProvider);
-        const handle = (await selectedRule.buildUpdateCalls(tx, host, data, {
+    for (const [i, group] of groups.entries()) {
+        const data = dataByGroup[i] ?? null;
+        const handle = (await group.rule.buildUpdateCalls(tx, host, data, {
             cache: opts.cache,
             feeSource: opts.feeSource,
         })) ?? undefined;
-        // Route by the handle's kind discriminant — the one site the tag exists to
-        // protect: a future non-lazer handle must never be silently fed into
-        // pyth_lazer_rule::feed.
-        if (handle?.kind === "pyth_lazer_rule") {
-            for (const ticker of selectedGroup)
-                lazerUpdateByTicker.set(ticker, handle.update);
-        }
-        // waterx_rule emits no shared handle (verify+feed is bundled into the
-        // per-ticker `collect_batch_latest`), so the envelope is carried straight
-        // from this group's fetched data to the feed leg below.
-        if (selectedRule.kind === "waterx_rule") {
-            const envelope = waterxEnvelopeOf(data);
-            if (envelope) {
-                for (const ticker of selectedGroup)
-                    waterxEnvelopeByTicker.set(ticker, envelope);
+        switch (group.rule.kind) {
+            case "pyth_rule":
+                // Core's update leg wrote the PriceInfoObjects in place — the feed
+                // leg reads them by id (`priceInfoByTicker`), nothing to carry.
+                break;
+            case "pyth_lazer_rule":
+                // Route by the handle's kind discriminant — the tag exists so a
+                // non-lazer handle can never be silently fed into
+                // pyth_lazer_rule::feed.
+                if (handle?.kind === "pyth_lazer_rule") {
+                    for (const ticker of group.tickers)
+                        lazerUpdateByTicker.set(ticker, handle.update);
+                }
+                break;
+            case "waterx_rule": {
+                // waterx_rule emits no shared handle (verify+feed is bundled into the
+                // per-ticker `collect_batch_latest`), so the envelope is carried
+                // straight from this group's fetched data to the feed leg below.
+                const envelope = waterxEnvelopeOf(data);
+                if (envelope) {
+                    for (const ticker of group.tickers)
+                        waterxEnvelopeByTicker.set(ticker, envelope);
+                }
+                break;
+            }
+            default: {
+                const exhausted = group.rule.kind;
+                throw new Error(`refreshOraclePrices: unhandled rule kind '${String(exhausted)}'`);
             }
         }
     }