@waterx/sdk 4.3.0 → 4.3.1

package/README.md

@@ -113,15 +113,20 @@ ONE **required** client create option, `oracleSource`, names the price-update so
 
 **Multi-source fed sets.** With a list, ONE build fetches and feeds EVERY listed source's data in the same PTB; the chain's per-ticker aggregator **weight tables** decide which contributions count — feeding an unweighted rule's price is dropped on-chain, while starving a weighted rule aborts. That asymmetry is what makes weight migrations (Core→Pro, Pyth↔waterx coexistence) safe: keep the list a **superset** of every ticker's weighted rule set and flip weights per ticker at any time — an env edit, never an SDK release. (One caveat: waterx's feed call burns a per-symbol signed-timestamp high-water mark regardless of weights — see the replay note below.)
 
-**No cross-source fallback, no feeds guard at init.** Construction rejects an empty/nullish `oracleSource`, but a listed source whose feed for a requested ticker is absent is **not** an error at client creation — the build fails at **tx-build** only when **no** listed source serves the ticker (constant-only tickers, which need no price update, are exempt). A present-but-wrong feed id is not validated by the SDK; it aborts on-chain at dry-run.
+**No cross-source fallback, no feeds guard at init.** Construction rejects an empty/nullish `oracleSource` **and any value outside `ORACLE_SOURCES`** (a legacy `'core'` / `'pyth'` string fails at `create`), but a listed source whose feed for a requested ticker is absent is **not** an error at client creation — the build fails at **tx-build** only when **no** listed source serves the ticker (constant-only tickers, which need no price update, are exempt). A present-but-wrong feed id is not validated by the SDK; it aborts on-chain at dry-run.
 
 Every source's external infra is a **rule-owned per-network table**, never deployment-overridable and never in the config JSON: `PYTH_CORE_INFRA` (`src/oracle/pyth.ts` — Pyth state ids + the keyless Core Hermes endpoint, read-plane accessor `pythCoreHermesEndpoint(network)`), `LAZER_INFRA` (`src/oracle/rules/pyth-lazer-rule.ts`), `WATERX_INFRA` (`src/oracle/rules/waterx-rule.ts` — testnet `quote-center-staging.waterx.app` / mainnet `quote-center.waterx.app`, accessor `waterxQuoteCenterEndpoint(network)`). For **price READS** under a fed set without `pyth_rule`, the documented Pyth Pro base (`pythProHermesEndpoint()` — identical for every subscriber, auth via the Bearer key) applies: resolve the read endpoint with `resolveHermesReadEndpoint(network, sources, override?)` instead of branching by hand, and pair it with `resolveOracleReadPlan` for the per-source served-sets/ids. `client.pyth` is the access-only `PythAccessConfig` — just the caller-supplied `pythApiKey` / `pythFetch` create options (a secret has no place in a public CDN JSON); `client.waterx` is likewise `WaterxAccessConfig` (`waterxEndpoint` / `waterxFetch` overrides only; fetch policy resolves **`waterxFetch` → built-in defaults** — deliberately no `pythFetch` fallback, sources never share config). See the browser/CORS note below.
 
 ```ts
-// Per-environment wiring — the consumer owns the env var, not the SDK:
+// Per-environment wiring — the consumer owns the env var, not the SDK.
+// parseOracleSourceList is THE canonical parser (trim, drop empty entries,
+// validate every value, dedupe, throw operator-actionably) — never a bare
+// split-and-cast, which would hand the strict constructor untrimmed junk.
+import { parseOracleSourceList } from "@waterx/sdk/oracle";
+
 const perp = await PerpClient.create(network, {
   waterxConfigUrl,
-  oracleSource: process.env.ORACLE_SOURCE!.split(",") as OracleSource[], // REQUIRED; comma list = the fed set
+  oracleSource: parseOracleSourceList(process.env.ORACLE_SOURCE), // REQUIRED; comma list = the fed set
   pythApiKey: process.env.PYTH_API_KEY, // required iff 'pyth_lazer_rule' is listed (Lazer is auth-first)
 });
 ```
@@ -133,7 +138,7 @@ This is the coexistence rollout pattern: staging lists every source under migrat
 Every source plugs in the same way — routing is driven **only** by the client's `oracleSource` option (never a config `enabled` flag, never `process.env`):
 
 1. **Implement `PriceUpdateRule`** in `src/oracle/rules/<name>-rule.ts` — all port fields (`src/oracle/price-update-rule.ts`): `kind`, `requiresFeeSource` (`true` iff the on-chain verify draws a per-update fee — gates the fail-fast fee-source check), `supportedTickers`, `fetchUpdateData`, `narrowUpdateData` (subset a cached whole-universe payload to one build's tickers — a divisible payload returns a per-feed subset, an indivisible one returns itself whole iff fully covered; uncovered ticker → `null` miss), `buildUpdateCalls`.
-2. **Register it** in `src/oracle/rule-registry.ts` (`DEFAULT_RULES`) under a new `OracleSource` value (added to the union in `price-update-rule.ts`).
+2. **Register it** in `src/oracle/rule-registry.ts` (`DEFAULT_RULES`) under a new `OracleSource` value — added to `ORACLE_SOURCES` in `price-update-rule.ts` (the union derives from that list; a registry test pins every listed value to a registered rule).
 3. **Publish the on-chain rule package** — its config entry (package ids, per-ticker `feeds`) arrives via the normal `waterx-config` deploy pipeline; type it in `OraclePackages` (`src/oracle/config.ts`).
 4. **Add SDK infra constants** if the source needs external infra that is not part of the config JSON (API endpoints, verifier packages, state objects) — a **rule-owned** per-network table inside the rule's own file, mirroring `LAZER_INFRA` / `WATERX_INFRA` (never on the shared client, never in `oracle/config.ts`). Wire its read-plane served-set/ids into `resolveOracleReadPlan` (`src/oracle/read-plane.ts`).
 5. **Consumers flip `oracleSource`** per environment — no consumer code change, no SDK re-release.

package/dist/cjs/src/oracle/aggregate.js

@@ -29,6 +29,7 @@ exports.aggregateTickerWithPyth = aggregateTickerWithPyth;
 exports.aggregateTickerWithConstant = aggregateTickerWithConstant;
 exports.refreshOraclePrices = refreshOraclePrices;
 const oracle_ts_1 = require("../generated/waterx_oracle/oracle.js");
+const record_ts_1 = require("../utils/record.js");
 const pyth_ts_1 = require("./pyth.js");
 const rule_registry_ts_1 = require("./rule-registry.js");
 const constant_rule_ts_1 = require("./rules/constant-rule.js");
@@ -169,7 +170,7 @@ function aggregateTickerWithPyth(tx, host, args) {
  * {@link refreshOraclePrices}), which feeds both.
  */
 function aggregateTickerWithConstant(tx, host, args) {
-    if (host.config.packages.pyth_rule?.feeds?.[args.ticker] !== undefined) {
+    if ((0, record_ts_1.ownEntry)(host.config.packages.pyth_rule?.feeds, args.ticker) !== undefined) {
         throw new Error(`'${args.ticker}' is in pyth_rule.feeds (dual-feed) — feed both via aggregateTicker({ priceInfoObjectId }) / refreshOraclePrices, not aggregateTickerWithConstant`);
     }
     aggregateTicker(tx, host, { ticker: args.ticker });
@@ -230,7 +231,7 @@ async function refreshOraclePrices(tx, host, tickers, opts = {}) {
     // price_info_object lookup for every ticker with a pyth_rule.feeds entry —
     // needed by aggregateTicker's (unchanged) Pyth feed step below regardless of
     // which rule performed the on-chain update for that ticker.
-    const pythTickers = tickers.filter((t) => host.config.packages.pyth_rule?.feeds?.[t] !== undefined);
+    const pythTickers = tickers.filter((t) => (0, record_ts_1.ownEntry)(host.config.packages.pyth_rule?.feeds, t) !== undefined);
     const priceInfoByTicker = new Map();
     pythTickers.forEach((t) => priceInfoByTicker.set(t, host.getPythFeed(t).price_info_object));
     // The fed set is a LIST (`host.oracleSources`, normalized + deduped at

package/dist/cjs/src/oracle/index.d.ts

@@ -21,13 +21,15 @@ export type { FetchPolicy } from "./update-fetch.ts";
 export { PythCache, fetchPriceFeedsUpdateData, endpointSupportedFeedIds, probeMissingFeeds, buildPythPriceUpdateCalls, pythCoreHermesEndpoint, pythProHermesEndpoint, PYTH_PRO_HERMES_ENDPOINT, updatePythPrices, HermesEndpointRejectedAllFeedsError, MISSING_FEED_MEMO_TTL_MS, OracleFeeSourceUnavailableError, } from "./pyth.ts";
 export type { OracleFeeSource } from "./pyth.ts";
 export type { PriceUpdateRule, PriceUpdateRuleKind, RuleUpdateData, RuleUpdateHandle, BuildUpdateOpts, OracleSource, UpdateDataProvider, } from "./price-update-rule.ts";
+export { ORACLE_SOURCES } from "./price-update-rule.ts";
+export { isOracleSource, parseOracleSourceList } from "./source-list.ts";
 export { resolveOracleReadPlan, resolveHermesReadEndpoint } from "./read-plane.ts";
 export type { OracleReadPlan } from "./read-plane.ts";
 export { PythCoreRule } from "./rules/pyth-core-rule.ts";
 export type { PythCoreUpdatePayload } from "./rules/pyth-core-rule.ts";
 export { PythLazerRule, LazerApiKeyMissingError } from "./rules/pyth-lazer-rule.ts";
 export type { PythLazerUpdatePayload } from "./rules/pyth-lazer-rule.ts";
-export { WaterxRule, parseSignedEnvelope, BATCH_PRICE_INTENT, WATERX_INFRA, waterxQuoteCenterEndpoint, } from "./rules/waterx-rule.ts";
+export { WaterxRule, parseSignedEnvelope, BATCH_PRICE_INTENT, WATERX_INFRA, waterxQuoteCenterEndpoint, waterxEnvelopeOf, } from "./rules/waterx-rule.ts";
 export type { WaterxUpdatePayload, WaterxSignedEnvelope, WaterxBatchItem, } from "./rules/waterx-rule.ts";
 export { OracleSourceNotImplementedError, resolveOracleRule } from "./rule-registry.ts";
 export { aggregateTicker, aggregateTickerWithPyth, aggregateTickerWithConstant, refreshOraclePrices, } from "./aggregate.ts";

package/dist/cjs/src/oracle/index.js

@@ -17,7 +17,7 @@
  * rules that consume it are separate concerns.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.reimbursePythSponsor = exports.openPythSponsorFund = exports.refreshOraclePrices = exports.aggregateTickerWithConstant = exports.aggregateTickerWithPyth = exports.aggregateTicker = exports.resolveOracleRule = exports.OracleSourceNotImplementedError = exports.waterxQuoteCenterEndpoint = exports.WATERX_INFRA = exports.BATCH_PRICE_INTENT = exports.parseSignedEnvelope = exports.WaterxRule = exports.LazerApiKeyMissingError = exports.PythLazerRule = exports.PythCoreRule = exports.resolveHermesReadEndpoint = exports.resolveOracleReadPlan = exports.OracleFeeSourceUnavailableError = exports.MISSING_FEED_MEMO_TTL_MS = exports.HermesEndpointRejectedAllFeedsError = exports.updatePythPrices = exports.PYTH_PRO_HERMES_ENDPOINT = exports.pythProHermesEndpoint = exports.pythCoreHermesEndpoint = exports.buildPythPriceUpdateCalls = exports.probeMissingFeeds = exports.endpointSupportedFeedIds = exports.fetchPriceFeedsUpdateData = exports.PythCache = exports.joinEndpointPath = exports.fetchWithPolicy = exports.FetchPolicyError = void 0;
+exports.reimbursePythSponsor = exports.openPythSponsorFund = exports.refreshOraclePrices = exports.aggregateTickerWithConstant = exports.aggregateTickerWithPyth = exports.aggregateTicker = exports.resolveOracleRule = exports.OracleSourceNotImplementedError = exports.waterxEnvelopeOf = exports.waterxQuoteCenterEndpoint = exports.WATERX_INFRA = exports.BATCH_PRICE_INTENT = exports.parseSignedEnvelope = exports.WaterxRule = exports.LazerApiKeyMissingError = exports.PythLazerRule = exports.PythCoreRule = exports.resolveHermesReadEndpoint = exports.resolveOracleReadPlan = exports.parseOracleSourceList = exports.isOracleSource = exports.ORACLE_SOURCES = exports.OracleFeeSourceUnavailableError = exports.MISSING_FEED_MEMO_TTL_MS = exports.HermesEndpointRejectedAllFeedsError = exports.updatePythPrices = exports.PYTH_PRO_HERMES_ENDPOINT = exports.pythProHermesEndpoint = exports.pythCoreHermesEndpoint = exports.buildPythPriceUpdateCalls = exports.probeMissingFeeds = exports.endpointSupportedFeedIds = exports.fetchPriceFeedsUpdateData = exports.PythCache = exports.joinEndpointPath = exports.fetchWithPolicy = exports.FetchPolicyError = void 0;
 // Shared fetch resilience wrapper — `FetchPolicyError` is re-exported (not
 // just the type) so a consumer (e.g. a BE prefetch cache) can `instanceof`
 // it off the failure `fetchPriceFeedsUpdateData` / `PythLazerRule` /
@@ -57,6 +57,13 @@ Object.defineProperty(exports, "updatePythPrices", { enumerable: true, get: func
 Object.defineProperty(exports, "HermesEndpointRejectedAllFeedsError", { enumerable: true, get: function () { return pyth_ts_1.HermesEndpointRejectedAllFeedsError; } });
 Object.defineProperty(exports, "MISSING_FEED_MEMO_TTL_MS", { enumerable: true, get: function () { return pyth_ts_1.MISSING_FEED_MEMO_TTL_MS; } });
 Object.defineProperty(exports, "OracleFeeSourceUnavailableError", { enumerable: true, get: function () { return pyth_ts_1.OracleFeeSourceUnavailableError; } });
+// Canonical OracleSource value list + THE env-string parser consumers fold
+// onto — semantics and rationale in `source-list.ts`'s header.
+var price_update_rule_ts_1 = require("./price-update-rule.js");
+Object.defineProperty(exports, "ORACLE_SOURCES", { enumerable: true, get: function () { return price_update_rule_ts_1.ORACLE_SOURCES; } });
+var source_list_ts_1 = require("./source-list.js");
+Object.defineProperty(exports, "isOracleSource", { enumerable: true, get: function () { return source_list_ts_1.isOracleSource; } });
+Object.defineProperty(exports, "parseOracleSourceList", { enumerable: true, get: function () { return source_list_ts_1.parseOracleSourceList; } });
 // Per-source READ-plane resolution — which tickers a source can price
 // off-chain and with which ids (`resolveOracleReadPlan`), and which
 // Hermes-compatible base the hermes plans execute against
@@ -86,6 +93,9 @@ Object.defineProperty(exports, "parseSignedEnvelope", { enumerable: true, get: f
 Object.defineProperty(exports, "BATCH_PRICE_INTENT", { enumerable: true, get: function () { return waterx_rule_ts_1.BATCH_PRICE_INTENT; } });
 Object.defineProperty(exports, "WATERX_INFRA", { enumerable: true, get: function () { return waterx_rule_ts_1.WATERX_INFRA; } });
 Object.defineProperty(exports, "waterxQuoteCenterEndpoint", { enumerable: true, get: function () { return waterx_rule_ts_1.waterxQuoteCenterEndpoint; } });
+// Rule-owned payload accessor (kind-check + unwrap in one place) — never
+// hand-cast the payload shape.
+Object.defineProperty(exports, "waterxEnvelopeOf", { enumerable: true, get: function () { return waterx_rule_ts_1.waterxEnvelopeOf; } });
 // `resolveOracleRule` is the ONE source→rule registry — exported so external
 // consumers (e.g. a BE prefetch cache that keys per source and needs each
 // source's `supportedTickers`/`fetchUpdateData`) resolve through it instead of

package/dist/cjs/src/oracle/price-update-rule.d.ts

@@ -20,14 +20,28 @@ import type { OracleHost } from "./host.ts";
 import type { OracleFeeSource, PythCache } from "./pyth.ts";
 export type PriceUpdateRuleKind = "pyth_rule" | "pyth_lazer_rule" | "supra_rule" | "constant_rule" | "waterx_rule";
 /**
- * The subset of `PriceUpdateRuleKind`s listable in a client's `oracleSource`
- * create option (see `OracleHost.oracleSources`) — i.e. rules that can serve as
- * the on-chain price *update* leg `refreshOraclePrices` runs before aggregating.
- * `supra_rule` and `constant_rule` are auxiliary rules fed alongside whichever
- * source is selected (see `aggregateTicker`), not sources themselves. The SDK
- * never reads `process.env` — consumers resolve their own env var to this type.
+ * The canonical list of selectable oracle sources — the SINGLE authority the
+ * {@link OracleSource} union derives from (the value-list→union derive
+ * idiom of `unified-client.ts`'s `NON_CLIENT_FIRST`, plus `Object.freeze`
+ * so the immutability is RUNTIME truth: `as const` alone would let a JS
+ * consumer push into the array and desync the membership Set built from it
+ * in `source-list.ts`). Runtime membership checks and the `ORACLE_SOURCE`
+ * env parser live there, on `isOracleSource` / `parseOracleSourceList`.
+ * Only sources belong here: `supra_rule` and `constant_rule` are auxiliary
+ * rules fed alongside whichever sources are selected (see
+ * `aggregateTicker`), not sources themselves — the `satisfies` keeps
+ * entries inside `PriceUpdateRuleKind` but adding an auxiliary rule to this
+ * list is an (incorrect) editorial decision this comment exists to prevent.
  */
-export type OracleSource = "pyth_rule" | "pyth_lazer_rule" | "waterx_rule";
+export declare const ORACLE_SOURCES: readonly ["pyth_rule", "pyth_lazer_rule", "waterx_rule"];
+/**
+ * The kinds listable in a client's `oracleSource` create option (see
+ * `OracleHost.oracleSources`) — i.e. rules that can serve as the on-chain
+ * price *update* leg `refreshOraclePrices` runs before aggregating. Derived
+ * from {@link ORACLE_SOURCES}. The SDK never reads `process.env` — consumers
+ * resolve their own env var to this type.
+ */
+export type OracleSource = (typeof ORACLE_SOURCES)[number];
 /**
  * Off-chain payload fetched by a rule, tagged by `kind` so a caller holding
  * several rules' results can tell them apart. `payload` is `unknown` here —

package/dist/cjs/src/oracle/price-update-rule.js

@@ -17,7 +17,27 @@
  * through this port; `aggregate.ts` stays the sole orchestrator.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.ORACLE_SOURCES = void 0;
 exports.assertRuleUpdateData = assertRuleUpdateData;
+/**
+ * The canonical list of selectable oracle sources — the SINGLE authority the
+ * {@link OracleSource} union derives from (the value-list→union derive
+ * idiom of `unified-client.ts`'s `NON_CLIENT_FIRST`, plus `Object.freeze`
+ * so the immutability is RUNTIME truth: `as const` alone would let a JS
+ * consumer push into the array and desync the membership Set built from it
+ * in `source-list.ts`). Runtime membership checks and the `ORACLE_SOURCE`
+ * env parser live there, on `isOracleSource` / `parseOracleSourceList`.
+ * Only sources belong here: `supra_rule` and `constant_rule` are auxiliary
+ * rules fed alongside whichever sources are selected (see
+ * `aggregateTicker`), not sources themselves — the `satisfies` keeps
+ * entries inside `PriceUpdateRuleKind` but adding an auxiliary rule to this
+ * list is an (incorrect) editorial decision this comment exists to prevent.
+ */
+exports.ORACLE_SOURCES = Object.freeze([
+    "pyth_rule",
+    "pyth_lazer_rule",
+    "waterx_rule",
+]);
 /**
  * Shared null → kind → shape guard ladder for a `PriceUpdateRule.buildUpdateCalls`
  * payload — every rule's `buildUpdateCalls` needs the exact same three checks,

package/dist/cjs/src/oracle/read-plane.js

@@ -14,6 +14,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveHermesReadEndpoint = resolveHermesReadEndpoint;
 exports.resolveOracleReadPlan = resolveOracleReadPlan;
+const record_ts_1 = require("../utils/record.js");
 const pyth_ts_1 = require("./pyth.js");
 /**
  * Resolve `source`'s read plan for `tickers`. Pure config lookup — no
@@ -47,26 +48,32 @@ function resolveOracleReadPlan(host, source, tickers) {
     switch (source) {
         case "pyth_rule":
         case "pyth_lazer_rule": {
+            // All ticker lookups go through `ownEntry` (own-keys-only): a ticker
+            // named like an Object.prototype key ("toString", "constructor", …)
+            // must read as not-listed, not as an inherited Function.
             const hexFeeds = host.config.packages.pyth_rule?.feeds;
             const feedIdByTicker = new Map();
             for (const ticker of tickers) {
-                const feedId = hexFeeds?.[ticker]?.feed_id;
+                const feedId = (0, record_ts_1.ownEntry)(hexFeeds, ticker)?.feed_id;
                 if (feedId !== undefined)
                     feedIdByTicker.set(ticker, feedId);
             }
             // For pyth_rule the write and read namespaces coincide, so `unreadable`
             // is always empty; for lazer it is exactly the hex-entry gap.
             const writeFeeds = source === "pyth_lazer_rule" ? host.config.packages.pyth_lazer_rule?.feeds : hexFeeds;
-            const unreadable = tickers.filter((ticker) => writeFeeds?.[ticker] !== undefined && !feedIdByTicker.has(ticker));
+            const unreadable = tickers.filter((ticker) => (0, record_ts_1.ownEntry)(writeFeeds, ticker) !== undefined && !feedIdByTicker.has(ticker));
             return { plane: "hermes", feedIdByTicker, unreadable };
         }
         case "waterx_rule": {
             // Absent feeds block ⇒ serves nothing (see the OracleReadPlan doc) —
-            // never claim tickers the config doesn't name.
+            // never claim tickers the config doesn't name. `ownEntry` (own-keys-
+            // only, never the `in` operator or a bare bracket read) so a
+            // prototype-key ticker can't count as feeds-listed and poison the
+            // quote-center batch (which 404s whole batches on unknown symbols).
             const feeds = host.config.packages.waterx_rule?.feeds;
             return {
                 plane: "quote_center",
-                tickers: feeds ? tickers.filter((ticker) => ticker in feeds) : [],
+                tickers: tickers.filter((ticker) => (0, record_ts_1.ownEntry)(feeds, ticker) !== undefined),
                 unreadable: [],
             };
         }

package/dist/cjs/src/oracle/rules/pyth-core-rule.js

@@ -9,6 +9,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PythCoreRule = void 0;
+const record_ts_1 = require("../../utils/record.js");
 const price_update_rule_ts_1 = require("../price-update-rule.js");
 const pyth_ts_1 = require("../pyth.js");
 /**
@@ -79,7 +80,7 @@ exports.PythCoreRule = {
         for (const ticker of tickers) {
             // Same lookup as `host.getPythFeed(ticker)` minus its throw — an
             // unlisted ticker is a miss here, not an error.
-            const feedId = host.config.packages.pyth_rule?.feeds?.[ticker]?.feed_id;
+            const feedId = (0, record_ts_1.ownEntry)(host.config.packages.pyth_rule?.feeds, ticker)?.feed_id;
             if (feedId === undefined || !packedFeedIds.has(feedId))
                 return null;
             feedIds.push(feedId);

package/dist/cjs/src/oracle/rules/pyth-lazer-rule.js

@@ -12,6 +12,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.PythLazerRule = exports.LazerApiKeyMissingError = exports.LAZER_INFRA = void 0;
 exports.feedLazerRule = feedLazerRule;
 const bcs_1 = require("@mysten/bcs");
+const record_ts_1 = require("../../utils/record.js");
 const price_update_rule_ts_1 = require("../price-update-rule.js");
 const update_fetch_ts_1 = require("../update-fetch.js");
 /**
@@ -167,7 +168,9 @@ exports.PythLazerRule = {
         // not fail per ticker as if only that feed were missing.
         const { feeds } = requireLazerPackage(host);
         const feedIds = tickers.map((ticker) => {
-            const feedId = feeds[ticker];
+            // ownEntry: a prototype-key ticker ("toString") must throw here as
+            // unlisted, not turn an inherited Function into a "feed id".
+            const feedId = (0, record_ts_1.ownEntry)(feeds, ticker);
             if (feedId === undefined) {
                 throw new Error(`No pyth_lazer_rule feed listed for ticker: ${ticker}`);
             }
@@ -195,7 +198,7 @@ exports.PythLazerRule = {
             return null;
         const packedFeedIds = new Set(payload.feedIds);
         for (const ticker of tickers) {
-            const feedId = host.config.packages.pyth_lazer_rule?.feeds?.[ticker];
+            const feedId = (0, record_ts_1.ownEntry)(host.config.packages.pyth_lazer_rule?.feeds, ticker);
             if (feedId === undefined || !packedFeedIds.has(feedId))
                 return null;
         }

package/dist/cjs/src/oracle/rules/waterx-rule.js

@@ -31,6 +31,7 @@ exports.waterxEnvelopeOf = waterxEnvelopeOf;
 exports.feedWaterxRule = feedWaterxRule;
 const bcs_1 = require("@mysten/bcs");
 const waterx_rule_ts_1 = require("../../generated/waterx_rule/waterx_rule.js");
+const record_ts_1 = require("../../utils/record.js");
 const price_update_rule_ts_1 = require("../price-update-rule.js");
 const update_fetch_ts_1 = require("../update-fetch.js");
 /** The single signing intent the quote-center emits — exported so read-plane
@@ -267,7 +268,9 @@ exports.WaterxRule = {
         // not fail per ticker as if only that feed were missing.
         const { feeds } = requireWaterxPackage(host);
         for (const ticker of tickers) {
-            if (feeds[ticker] === undefined) {
+            // ownEntry: a prototype-key ticker ("toString") must throw here as
+            // unlisted, not pass as an inherited Function and reach the network.
+            if ((0, record_ts_1.ownEntry)(feeds, ticker) === undefined) {
                 throw new Error(`No waterx_rule feed listed for ticker: ${ticker}`);
             }
         }

package/dist/cjs/src/oracle/source-list.d.ts

@@ -0,0 +1,36 @@
+/**
+ * `source-list.ts` — THE parser for a consumer's `ORACLE_SOURCE` env string
+ * (comma list of `OracleSource` values → the fed set). The FE and BE
+ * previously carried twin hand-written parsers whose semantics drifted once
+ * in review (a trailing comma booted one deployment green and 500'd the
+ * other); this canonical behavior is what both fold onto:
+ *
+ *  - split on `,`, trim entries, DROP empties (trailing/doubled commas are
+ *    the most common env typo, never a boot failure)
+ *  - validate every entry against {@link ORACLE_SOURCES}
+ *  - dedupe, order-preserving (list order is consumer read-plane policy —
+ *    the SDK's own fed-set build treats the list as a set)
+ *  - throw an operator-actionable error on empty/unset/invalid input —
+ *    there is NO default oracle source
+ *
+ * The SDK still never reads `process.env` — callers pass the raw string.
+ *
+ * STRICTER than the consumers' previous `in`-operator checks: a value named
+ * like an `Object.prototype` key (`toString`, `constructor`, …) passed those
+ * and died deep in the stack; `Set.has` rejects it here at parse.
+ *
+ * Zod adopters: this THROWS a plain Error. Inside a zod `.transform()` a
+ * throw escapes `schema.parse()` un-aggregated and masks sibling issues —
+ * wrap it: `try { return parseOracleSourceList(raw); } catch (e) {
+ * ctx.addIssue({ code: "custom", message: (e as Error).message }); return
+ * z.NEVER; }`.
+ */
+import { type OracleSource } from "./price-update-rule.ts";
+/**
+ * THE runtime membership check for {@link ORACLE_SOURCES} — the parser below
+ * and `PerpClient`'s ctor validation both use this one predicate, so the env
+ * parser and the create-option front door can never disagree. `Set.has`,
+ * never `in`/bracket reads (prototype-chain safe by construction).
+ */
+export declare function isOracleSource(value: string): value is OracleSource;
+export declare function parseOracleSourceList(raw: string | null | undefined): OracleSource[];

package/dist/cjs/src/oracle/source-list.js

@@ -0,0 +1,57 @@
+"use strict";
+/**
+ * `source-list.ts` — THE parser for a consumer's `ORACLE_SOURCE` env string
+ * (comma list of `OracleSource` values → the fed set). The FE and BE
+ * previously carried twin hand-written parsers whose semantics drifted once
+ * in review (a trailing comma booted one deployment green and 500'd the
+ * other); this canonical behavior is what both fold onto:
+ *
+ *  - split on `,`, trim entries, DROP empties (trailing/doubled commas are
+ *    the most common env typo, never a boot failure)
+ *  - validate every entry against {@link ORACLE_SOURCES}
+ *  - dedupe, order-preserving (list order is consumer read-plane policy —
+ *    the SDK's own fed-set build treats the list as a set)
+ *  - throw an operator-actionable error on empty/unset/invalid input —
+ *    there is NO default oracle source
+ *
+ * The SDK still never reads `process.env` — callers pass the raw string.
+ *
+ * STRICTER than the consumers' previous `in`-operator checks: a value named
+ * like an `Object.prototype` key (`toString`, `constructor`, …) passed those
+ * and died deep in the stack; `Set.has` rejects it here at parse.
+ *
+ * Zod adopters: this THROWS a plain Error. Inside a zod `.transform()` a
+ * throw escapes `schema.parse()` un-aggregated and masks sibling issues —
+ * wrap it: `try { return parseOracleSourceList(raw); } catch (e) {
+ * ctx.addIssue({ code: "custom", message: (e as Error).message }); return
+ * z.NEVER; }`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isOracleSource = isOracleSource;
+exports.parseOracleSourceList = parseOracleSourceList;
+const price_update_rule_ts_1 = require("./price-update-rule.js");
+// Widened-annotation Set (not an assertion) so the type predicate below
+// narrows by CONSTRUCTION rather than by cast.
+const ORACLE_SOURCE_SET = new Set(price_update_rule_ts_1.ORACLE_SOURCES);
+/**
+ * THE runtime membership check for {@link ORACLE_SOURCES} — the parser below
+ * and `PerpClient`'s ctor validation both use this one predicate, so the env
+ * parser and the create-option front door can never disagree. `Set.has`,
+ * never `in`/bracket reads (prototype-chain safe by construction).
+ */
+function isOracleSource(value) {
+    return ORACLE_SOURCE_SET.has(value);
+}
+function parseOracleSourceList(raw) {
+    const parts = (raw ?? "")
+        .split(",")
+        .map((part) => part.trim())
+        .filter((part) => part !== "");
+    const sources = parts.filter(isOracleSource);
+    if (parts.length === 0 || sources.length !== parts.length) {
+        const got = raw == null || raw.trim() === "" ? "unset" : `'${raw}'`;
+        throw new Error(`ORACLE_SOURCE must be a comma-separated list of ${price_update_rule_ts_1.ORACLE_SOURCES.join(" | ")} ` +
+            `(got ${got}) — there is NO default oracle source; set it in the deployment's env.`);
+    }
+    return [...new Set(sources)];
+}

package/dist/cjs/src/perp/client.d.ts

@@ -11,7 +11,7 @@
  * {@link PerpConfigView}. This class is just the wiring + factory between them.
  */
 import { BaseLineClient } from "../base-client.ts";
-import type { OracleSource } from "../oracle/price-update-rule.ts";
+import { type OracleSource } from "../oracle/price-update-rule.ts";
 import type { FetchPolicy } from "../oracle/update-fetch.ts";
 import { type LoadConfigOptions, type PythAccessConfig, type PythFetchPolicy, type WaterxAccessConfig, type WaterXConfig, type WormholeInfraConfig } from "./config.ts";
 import type { Network } from "./constants.ts";

package/dist/cjs/src/perp/client.js

@@ -14,6 +14,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PerpClient = void 0;
 const base_client_ts_1 = require("../base-client.js");
+const price_update_rule_ts_1 = require("../oracle/price-update-rule.js");
+const source_list_ts_1 = require("../oracle/source-list.js");
 const config_view_ts_1 = require("./config-view.js");
 const config_ts_1 = require("./config.js");
 class PerpClient extends base_client_ts_1.BaseLineClient {
@@ -49,16 +51,18 @@ class PerpClient extends base_client_ts_1.BaseLineClient {
             ...(opts.waterxEndpoint !== undefined ? { endpoint: opts.waterxEndpoint } : {}),
             ...(opts.waterxFetch !== undefined ? { fetch: opts.waterxFetch } : {}),
         };
-        // Normalize single-or-list to a deduped, order-preserving list. An empty
-        // list — or a nullish/empty entry, the shape an untyped caller produces
-        // by omitting the REQUIRED option — is a caller bug, not "no oracle":
-        // fail construction loudly instead of booting green and surfacing as
-        // `OracleSourceNotImplemented: undefined` at the first tx-build.
+        // Normalize single-or-list to a deduped, order-preserving list, gated by
+        // `isOracleSource` — the SAME predicate `parseOracleSourceList` uses. An
+        // empty list, a nullish entry (an untyped caller omitting the REQUIRED
+        // option), or an unregistered value (`'core'`, `'pyth'`, …) fails
+        // construction loudly instead of booting green and surfacing as
+        // `OracleSourceNotImplemented` at the first tx-build.
         const sources = Array.isArray(opts.oracleSource) ? opts.oracleSource : [opts.oracleSource];
         this.oracleSources = [...new Set(sources)];
         if (this.oracleSources.length === 0 ||
-            this.oracleSources.some((source) => typeof source !== "string" || source.length === 0)) {
-            throw new Error(`oracleSource is REQUIRED and must name at least one source (got ${JSON.stringify(sources)})`);
+            this.oracleSources.some((source) => !(0, source_list_ts_1.isOracleSource)(source))) {
+            throw new Error(`oracleSource is REQUIRED and must name at least one of ${price_update_rule_ts_1.ORACLE_SOURCES.join(" | ")} ` +
+                `(got ${JSON.stringify(sources)})`);
         }
         this.view = new config_view_ts_1.PerpConfigView(() => this.config, () => this.wormhole);
     }

package/dist/cjs/src/perp/config-view.js

@@ -11,6 +11,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PerpConfigView = void 0;
+const record_ts_1 = require("../utils/record.js");
 class PerpConfigView {
     getConfig;
     getWormhole;
@@ -29,21 +30,21 @@ class PerpConfigView {
     }
     /** `waterx_perp.markets[ticker]`, throws if unknown. */
     getMarket(ticker) {
-        const m = this.config.packages.waterx_perp?.markets?.[ticker];
+        const m = (0, record_ts_1.ownEntry)(this.config.packages.waterx_perp?.markets, ticker);
         if (!m)
             throw new Error(`Unknown market ticker: ${ticker}`);
         return m;
     }
     /** `waterx_oracle.aggregators[ticker]`, throws if unknown. */
     getAggregator(ticker) {
-        const a = this.config.packages.waterx_oracle?.aggregators?.[ticker];
+        const a = (0, record_ts_1.ownEntry)(this.config.packages.waterx_oracle?.aggregators, ticker);
         if (!a)
             throw new Error(`No aggregator listed for ticker: ${ticker}`);
         return a;
     }
     /** `pyth_rule.feeds[ticker]`, throws if unknown. */
     getPythFeed(ticker) {
-        const f = this.config.packages.pyth_rule?.feeds?.[ticker];
+        const f = (0, record_ts_1.ownEntry)(this.config.packages.pyth_rule?.feeds, ticker);
         if (!f)
             throw new Error(`No pyth feed listed for ticker: ${ticker}`);
         return f;
@@ -69,7 +70,7 @@ class PerpConfigView {
         const c = this.config.packages.constant_rule;
         if (!c?.published_at || !c.config)
             return false;
-        return c.feeds?.[ticker] !== undefined;
+        return (0, record_ts_1.ownEntry)(c.feeds, ticker) !== undefined;
     }
     /**
      * The `supra_rule` config when it is deployed, enabled, and fully wired
@@ -95,7 +96,7 @@ class PerpConfigView {
      */
     getPoolTokenType(tickerOrName) {
         const poolTokens = this.config.packages.wlp?.pool_tokens ?? {};
-        const exact = poolTokens[tickerOrName];
+        const exact = (0, record_ts_1.ownEntry)(poolTokens, tickerOrName);
         if (exact)
             return exact;
         for (const t of Object.values(poolTokens)) {
@@ -118,7 +119,7 @@ class PerpConfigView {
      * reward coin type, so callers don't need a separate alias-to-type lookup.
      */
     getRewarders(stakeAlias) {
-        const map = this.config.packages.waterx_staking?.rewarders?.[stakeAlias];
+        const map = (0, record_ts_1.ownEntry)(this.config.packages.waterx_staking?.rewarders, stakeAlias);
         if (!map)
             return [];
         return Object.entries(map).map(([alias, entry]) => ({ alias, ...entry }));

package/dist/cjs/src/perp/index.d.ts

@@ -13,7 +13,7 @@ export type { EstLiqPriceViewOpts } from "./liq-view.ts";
 export * from "./user/index.ts";
 export * from "./tx-builders.ts";
 export * from "./fetch.ts";
-export { FetchPolicyError, LazerApiKeyMissingError, OracleFeeSourceUnavailableError, OracleSourceNotImplementedError, PythCache, aggregateTicker, aggregateTickerWithConstant, aggregateTickerWithPyth, buildPythPriceUpdateCalls, fetchPriceFeedsUpdateData, pythCoreHermesEndpoint, pythProHermesEndpoint, resolveHermesReadEndpoint, waterxQuoteCenterEndpoint, refreshOraclePrices, updatePythPrices, } from "../oracle/index.ts";
+export { FetchPolicyError, LazerApiKeyMissingError, OracleFeeSourceUnavailableError, OracleSourceNotImplementedError, PythCache, aggregateTicker, aggregateTickerWithConstant, aggregateTickerWithPyth, ORACLE_SOURCES, buildPythPriceUpdateCalls, fetchPriceFeedsUpdateData, isOracleSource, parseOracleSourceList, pythCoreHermesEndpoint, pythProHermesEndpoint, refreshOraclePrices, resolveHermesReadEndpoint, updatePythPrices, waterxEnvelopeOf, waterxQuoteCenterEndpoint, } from "../oracle/index.ts";
 export type { FetchPolicy, OracleFeeSource, OracleSource, UpdateDataProvider, } from "../oracle/index.ts";
 export { fetchDepositVaa, fetchVaa, listBridgeWithdrawalVaas, listVaasByEmitter, padEvmEmitter, toWormholescanEmitter, vaaBase64ToBytes, vaaBase64ToHex, vaaBytesToBase64, waitForVaa, } from "../account/funding/wormhole.ts";
 export type { VaaListItem, VaaResponse, WormholescanOptions } from "../account/funding/wormhole.ts";

package/dist/cjs/src/perp/index.js

@@ -37,8 +37,8 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getCollateralAssets = exports.getMarketTickers = exports.TOKEN_DECIMALS = exports.COLLATERAL_DECIMALS = exports.WLP_DECIMALS = exports.SUI_DECIMALS = exports.MS_PER_YEAR = exports.MS_PER_HOUR = exports.MS_PER_MINUTE = exports.STAKING_PERM_ALL = exports.STAKING_PERM_CLAIM_REWARD = exports.STAKING_PERM_REDEEM_STAKE = exports.STAKING_PERM_DEPOSIT_STAKE = exports.PERM_WITHDRAW_COLLATERAL = exports.PERM_REDEEM_WLP = exports.PERM_PLACE_ORDER = exports.PERM_OPEN_POSITION = exports.PERM_MINT_WLP = exports.PERM_INCREASE_POSITION = exports.PERM_DEPOSIT_COLLATERAL = exports.PERM_DECREASE_POSITION = exports.PERM_CLOSE_POSITION = exports.PERM_CANCEL_ORDER = exports.PERM_ALL_TRADING = exports.PERM_ALL = exports.ORDER_TAG_WILDCARD = exports.ORDER_STOP_SELL = exports.ORDER_STOP_BUY = exports.ORDER_LIMIT_SELL = exports.ORDER_LIMIT_BUY = exports.FLOAT_SCALE = exports.DRY_RUN_SENDER = exports.DOUBLE_SCALE = exports.BPS_SCALE = exports.ACTION_WITHDRAW_COLLATERAL = exports.ACTION_UPDATE_ORDER = exports.ACTION_PLACE_ORDER = exports.ACTION_OPEN_POSITION = exports.ACTION_LIQUIDATE = exports.ACTION_INCREASE_POSITION = exports.ACTION_DEPOSIT_COLLATERAL = exports.ACTION_DECREASE_POSITION = exports.ACTION_CLOSE_POSITION = exports.ACTION_CANCEL_PRE_ORDER = exports.ACTION_CANCEL_ORDER = exports.ACTION_ADD_PRE_ORDER = exports.loadConfig = exports.clearConfigCache = exports.WORMHOLE_DEFAULTS = exports.PerpClient = void 0;
-exports.padEvmEmitter = exports.listVaasByEmitter = exports.listBridgeWithdrawalVaas = exports.fetchVaa = exports.fetchDepositVaa = exports.updatePythPrices = exports.refreshOraclePrices = exports.waterxQuoteCenterEndpoint = exports.resolveHermesReadEndpoint = exports.pythProHermesEndpoint = exports.pythCoreHermesEndpoint = exports.fetchPriceFeedsUpdateData = exports.buildPythPriceUpdateCalls = exports.aggregateTickerWithPyth = exports.aggregateTickerWithConstant = exports.aggregateTicker = exports.PythCache = exports.OracleSourceNotImplementedError = exports.OracleFeeSourceUnavailableError = exports.LazerApiKeyMissingError = exports.FetchPolicyError = exports.calcEstLiqPriceRawFromView = exports.formatFundingInterval = exports.rawPrice = exports.decodeFundingIndexDelta = exports.calcWlpRedeemOut = exports.calcWlpPrice = exports.calcWlpMintOut = exports.calcWlpIncentiveApy = exports.calcViewEstLiqFeesUsd = exports.calcUnrealizedPnl = exports.calcTotalTradingFeeRate = exports.calcTokenUtilizationBps = exports.calcRealLiqNetCostUsd = exports.calcPositionBorrowFee = exports.calcNotional = exports.calcMaxReducibleCollateralUsd = exports.calcLeverage = exports.calcImpactFeeRate = exports.calcFundingRate = exports.calcFundingFeeUsd = exports.calcFee = exports.calcEstLiqPriceRaw = exports.calcEstLiqPrice = exports.calcEffectiveCollateralUsd = exports.calcDynamicFeeBps = exports.calcBorrowRateAccrual = exports.calcBorrowRate = exports.annualizeFundingRate = exports.annualizedApyFromRatio = void 0;
-exports.withdrawalQueueCalls = exports.nativeCustodyCalls = exports.referralCalls = exports.pythSponsorRuleCalls = exports.pythRuleCalls = exports.oracleCalls = exports.stakingCalls = exports.wxaAccountCalls = exports.viewCalls = exports.lpPoolCalls = exports.tradingCalls = exports.MarketConfigBcs = exports.MarketBcs = exports.OrderBcs = exports.PositionBcs = exports.TokenPoolDataBcs = exports.RedeemRequestDataBcs = exports.PositionDataBcs = exports.PoolDataBcs = exports.OrderDataBcs = exports.MarketDataBcs = exports.GlobalConfigDataBcs = exports.AccountDataBcs = exports.waitForVaa = exports.vaaBytesToBase64 = exports.vaaBase64ToHex = exports.vaaBase64ToBytes = exports.toWormholescanEmitter = void 0;
+exports.fetchDepositVaa = exports.waterxQuoteCenterEndpoint = exports.waterxEnvelopeOf = exports.updatePythPrices = exports.resolveHermesReadEndpoint = exports.refreshOraclePrices = exports.pythProHermesEndpoint = exports.pythCoreHermesEndpoint = exports.parseOracleSourceList = exports.isOracleSource = exports.fetchPriceFeedsUpdateData = exports.buildPythPriceUpdateCalls = exports.ORACLE_SOURCES = exports.aggregateTickerWithPyth = exports.aggregateTickerWithConstant = exports.aggregateTicker = exports.PythCache = exports.OracleSourceNotImplementedError = exports.OracleFeeSourceUnavailableError = exports.LazerApiKeyMissingError = exports.FetchPolicyError = exports.calcEstLiqPriceRawFromView = exports.formatFundingInterval = exports.rawPrice = exports.decodeFundingIndexDelta = exports.calcWlpRedeemOut = exports.calcWlpPrice = exports.calcWlpMintOut = exports.calcWlpIncentiveApy = exports.calcViewEstLiqFeesUsd = exports.calcUnrealizedPnl = exports.calcTotalTradingFeeRate = exports.calcTokenUtilizationBps = exports.calcRealLiqNetCostUsd = exports.calcPositionBorrowFee = exports.calcNotional = exports.calcMaxReducibleCollateralUsd = exports.calcLeverage = exports.calcImpactFeeRate = exports.calcFundingRate = exports.calcFundingFeeUsd = exports.calcFee = exports.calcEstLiqPriceRaw = exports.calcEstLiqPrice = exports.calcEffectiveCollateralUsd = exports.calcDynamicFeeBps = exports.calcBorrowRateAccrual = exports.calcBorrowRate = exports.annualizeFundingRate = exports.annualizedApyFromRatio = void 0;
+exports.withdrawalQueueCalls = exports.nativeCustodyCalls = exports.referralCalls = exports.pythSponsorRuleCalls = exports.pythRuleCalls = exports.oracleCalls = exports.stakingCalls = exports.wxaAccountCalls = exports.viewCalls = exports.lpPoolCalls = exports.tradingCalls = exports.MarketConfigBcs = exports.MarketBcs = exports.OrderBcs = exports.PositionBcs = exports.TokenPoolDataBcs = exports.RedeemRequestDataBcs = exports.PositionDataBcs = exports.PoolDataBcs = exports.OrderDataBcs = exports.MarketDataBcs = exports.GlobalConfigDataBcs = exports.AccountDataBcs = exports.waitForVaa = exports.vaaBytesToBase64 = exports.vaaBase64ToHex = exports.vaaBase64ToBytes = exports.toWormholescanEmitter = exports.padEvmEmitter = exports.listVaasByEmitter = exports.listBridgeWithdrawalVaas = exports.fetchVaa = void 0;
 // ======== Core ========
 var client_ts_1 = require("./client.js");
 Object.defineProperty(exports, "PerpClient", { enumerable: true, get: function () { return client_ts_1.PerpClient; } });
@@ -144,14 +144,18 @@ Object.defineProperty(exports, "PythCache", { enumerable: true, get: function ()
 Object.defineProperty(exports, "aggregateTicker", { enumerable: true, get: function () { return index_ts_1.aggregateTicker; } });
 Object.defineProperty(exports, "aggregateTickerWithConstant", { enumerable: true, get: function () { return index_ts_1.aggregateTickerWithConstant; } });
 Object.defineProperty(exports, "aggregateTickerWithPyth", { enumerable: true, get: function () { return index_ts_1.aggregateTickerWithPyth; } });
+Object.defineProperty(exports, "ORACLE_SOURCES", { enumerable: true, get: function () { return index_ts_1.ORACLE_SOURCES; } });
 Object.defineProperty(exports, "buildPythPriceUpdateCalls", { enumerable: true, get: function () { return index_ts_1.buildPythPriceUpdateCalls; } });
 Object.defineProperty(exports, "fetchPriceFeedsUpdateData", { enumerable: true, get: function () { return index_ts_1.fetchPriceFeedsUpdateData; } });
+Object.defineProperty(exports, "isOracleSource", { enumerable: true, get: function () { return index_ts_1.isOracleSource; } });
+Object.defineProperty(exports, "parseOracleSourceList", { enumerable: true, get: function () { return index_ts_1.parseOracleSourceList; } });
 Object.defineProperty(exports, "pythCoreHermesEndpoint", { enumerable: true, get: function () { return index_ts_1.pythCoreHermesEndpoint; } });
 Object.defineProperty(exports, "pythProHermesEndpoint", { enumerable: true, get: function () { return index_ts_1.pythProHermesEndpoint; } });
-Object.defineProperty(exports, "resolveHermesReadEndpoint", { enumerable: true, get: function () { return index_ts_1.resolveHermesReadEndpoint; } });
-Object.defineProperty(exports, "waterxQuoteCenterEndpoint", { enumerable: true, get: function () { return index_ts_1.waterxQuoteCenterEndpoint; } });
 Object.defineProperty(exports, "refreshOraclePrices", { enumerable: true, get: function () { return index_ts_1.refreshOraclePrices; } });
+Object.defineProperty(exports, "resolveHermesReadEndpoint", { enumerable: true, get: function () { return index_ts_1.resolveHermesReadEndpoint; } });
 Object.defineProperty(exports, "updatePythPrices", { enumerable: true, get: function () { return index_ts_1.updatePythPrices; } });
+Object.defineProperty(exports, "waterxEnvelopeOf", { enumerable: true, get: function () { return index_ts_1.waterxEnvelopeOf; } });
+Object.defineProperty(exports, "waterxQuoteCenterEndpoint", { enumerable: true, get: function () { return index_ts_1.waterxQuoteCenterEndpoint; } });
 // ======== Wormhole / Wormholescan utilities (credit bridge) ========
 var wormhole_ts_1 = require("../account/funding/wormhole.js");
 Object.defineProperty(exports, "fetchDepositVaa", { enumerable: true, get: function () { return wormhole_ts_1.fetchDepositVaa; } });

package/dist/cjs/src/perp/user/staking.js

@@ -55,9 +55,10 @@ exports.unstake = unstake;
 exports.claimReward = claimReward;
 const account_request_ts_1 = require("../../account/account-request.js");
 const staking = __importStar(require("../../generated/waterx_staking/waterx_staking.js"));
+const record_ts_1 = require("../../utils/record.js");
 const validate_ts_1 = require("../../utils/validate.js");
 function pool(client, stakeAlias) {
-    const id = client.config.packages.waterx_staking?.pools?.[stakeAlias];
+    const id = (0, record_ts_1.ownEntry)(client.config.packages.waterx_staking?.pools, stakeAlias);
     if (!id) {
         throw new Error(`config.packages.waterx_staking.pools[${stakeAlias}] is not set — staking is not deployed for this stake type`);
     }

package/dist/cjs/src/utils/config.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getMarketTickers = getMarketTickers;
 exports.getCollateralAssets = getCollateralAssets;
+const record_ts_1 = require("./record.js");
 /** Returns all registered market tickers (e.g. "BTCUSD") from waterx-config. */
 function getMarketTickers(config) {
     return Object.keys(config.packages.waterx_perp.markets);
@@ -15,5 +16,5 @@ function getMarketTickers(config) {
  */
 function getCollateralAssets(config) {
     const feeds = config.packages.pyth_rule?.feeds ?? {};
-    return Object.keys(config.packages.wlp.pool_tokens).filter((t) => feeds[t] !== undefined);
+    return Object.keys(config.packages.wlp.pool_tokens).filter((t) => (0, record_ts_1.ownEntry)(feeds, t) !== undefined);
 }

package/dist/cjs/src/utils/record.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Own-key record lookup. Ticker-keyed config records (`feeds`, `markets`,
+ * `aggregators`) are indexed with caller-supplied strings; a bare bracket
+ * read — like the `in` operator — walks the prototype chain, so a ticker
+ * named like an `Object.prototype` key ("toString", "constructor", …) reads
+ * as an inherited Function instead of "absent" and leaks into batches sent
+ * to the network. Every such lookup funnels through here so the answer is
+ * own-keys-only, everywhere, instead of per-site `Object.hasOwn` guards
+ * that drift.
+ */
+/** `record[key]` iff `key` is an OWN key — `undefined` for an absent record, an absent key, or a prototype-chain hit. */
+export declare function ownEntry<T extends Record<string, unknown>>(record: T | undefined, key: string): T[string] | undefined;

package/dist/cjs/src/utils/record.js

@@ -0,0 +1,22 @@
+"use strict";
+/**
+ * Own-key record lookup. Ticker-keyed config records (`feeds`, `markets`,
+ * `aggregators`) are indexed with caller-supplied strings; a bare bracket
+ * read — like the `in` operator — walks the prototype chain, so a ticker
+ * named like an `Object.prototype` key ("toString", "constructor", …) reads
+ * as an inherited Function instead of "absent" and leaks into batches sent
+ * to the network. Every such lookup funnels through here so the answer is
+ * own-keys-only, everywhere, instead of per-site `Object.hasOwn` guards
+ * that drift.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ownEntry = ownEntry;
+/** `record[key]` iff `key` is an OWN key — `undefined` for an absent record, an absent key, or a prototype-chain hit. */
+function ownEntry(record, key) {
+    // The `T extends Record<...>` form (rather than `Record<string, V>`) keeps
+    // union-typed records inferable; TS then resolves `record[key]` only to the
+    // constraint's `unknown`, so restate the definitionally-true index type.
+    return record !== undefined && Object.hasOwn(record, key)
+        ? record[key]
+        : undefined;
+}

package/dist/src/oracle/aggregate.js

@@ -23,6 +23,7 @@
  * `rule-registry.ts`.
  */
 import { aggregate as aggregateCall, newCollector } from "../generated/waterx_oracle/oracle.js";
+import { ownEntry } from "../utils/record.js";
 import { OracleFeeSourceUnavailableError } from "./pyth.js";
 import { resolveOracleRule } from "./rule-registry.js";
 import { feedConstantRule } from "./rules/constant-rule.js";
@@ -163,7 +164,7 @@ export function aggregateTickerWithPyth(tx, host, args) {
  * {@link refreshOraclePrices}), which feeds both.
  */
 export function aggregateTickerWithConstant(tx, host, args) {
-    if (host.config.packages.pyth_rule?.feeds?.[args.ticker] !== undefined) {
+    if (ownEntry(host.config.packages.pyth_rule?.feeds, args.ticker) !== undefined) {
         throw new Error(`'${args.ticker}' is in pyth_rule.feeds (dual-feed) — feed both via aggregateTicker({ priceInfoObjectId }) / refreshOraclePrices, not aggregateTickerWithConstant`);
     }
     aggregateTicker(tx, host, { ticker: args.ticker });
@@ -224,7 +225,7 @@ export async function refreshOraclePrices(tx, host, tickers, opts = {}) {
     // price_info_object lookup for every ticker with a pyth_rule.feeds entry —
     // needed by aggregateTicker's (unchanged) Pyth feed step below regardless of
     // which rule performed the on-chain update for that ticker.
-    const pythTickers = tickers.filter((t) => host.config.packages.pyth_rule?.feeds?.[t] !== undefined);
+    const pythTickers = tickers.filter((t) => ownEntry(host.config.packages.pyth_rule?.feeds, t) !== undefined);
     const priceInfoByTicker = new Map();
     pythTickers.forEach((t) => priceInfoByTicker.set(t, host.getPythFeed(t).price_info_object));
     // The fed set is a LIST (`host.oracleSources`, normalized + deduped at

package/dist/src/oracle/index.d.ts

@@ -21,13 +21,15 @@ export type { FetchPolicy } from "./update-fetch.ts";
 export { PythCache, fetchPriceFeedsUpdateData, endpointSupportedFeedIds, probeMissingFeeds, buildPythPriceUpdateCalls, pythCoreHermesEndpoint, pythProHermesEndpoint, PYTH_PRO_HERMES_ENDPOINT, updatePythPrices, HermesEndpointRejectedAllFeedsError, MISSING_FEED_MEMO_TTL_MS, OracleFeeSourceUnavailableError, } from "./pyth.ts";
 export type { OracleFeeSource } from "./pyth.ts";
 export type { PriceUpdateRule, PriceUpdateRuleKind, RuleUpdateData, RuleUpdateHandle, BuildUpdateOpts, OracleSource, UpdateDataProvider, } from "./price-update-rule.ts";
+export { ORACLE_SOURCES } from "./price-update-rule.ts";
+export { isOracleSource, parseOracleSourceList } from "./source-list.ts";
 export { resolveOracleReadPlan, resolveHermesReadEndpoint } from "./read-plane.ts";
 export type { OracleReadPlan } from "./read-plane.ts";
 export { PythCoreRule } from "./rules/pyth-core-rule.ts";
 export type { PythCoreUpdatePayload } from "./rules/pyth-core-rule.ts";
 export { PythLazerRule, LazerApiKeyMissingError } from "./rules/pyth-lazer-rule.ts";
 export type { PythLazerUpdatePayload } from "./rules/pyth-lazer-rule.ts";
-export { WaterxRule, parseSignedEnvelope, BATCH_PRICE_INTENT, WATERX_INFRA, waterxQuoteCenterEndpoint, } from "./rules/waterx-rule.ts";
+export { WaterxRule, parseSignedEnvelope, BATCH_PRICE_INTENT, WATERX_INFRA, waterxQuoteCenterEndpoint, waterxEnvelopeOf, } from "./rules/waterx-rule.ts";
 export type { WaterxUpdatePayload, WaterxSignedEnvelope, WaterxBatchItem, } from "./rules/waterx-rule.ts";
 export { OracleSourceNotImplementedError, resolveOracleRule } from "./rule-registry.ts";
 export { aggregateTicker, aggregateTickerWithPyth, aggregateTickerWithConstant, refreshOraclePrices, } from "./aggregate.ts";

package/dist/src/oracle/index.js

@@ -40,6 +40,10 @@ export { PythCache, fetchPriceFeedsUpdateData, endpointSupportedFeedIds, probeMi
 // `resolveHermesReadEndpoint` (pyth_rule listed → Core, else override ??
 // Pro) — never a hand-rolled branch, never a cross-source fallback.
 pythCoreHermesEndpoint, pythProHermesEndpoint, PYTH_PRO_HERMES_ENDPOINT, updatePythPrices, HermesEndpointRejectedAllFeedsError, MISSING_FEED_MEMO_TTL_MS, OracleFeeSourceUnavailableError, } from "./pyth.js";
+// Canonical OracleSource value list + THE env-string parser consumers fold
+// onto — semantics and rationale in `source-list.ts`'s header.
+export { ORACLE_SOURCES } from "./price-update-rule.js";
+export { isOracleSource, parseOracleSourceList } from "./source-list.js";
 // Per-source READ-plane resolution — which tickers a source can price
 // off-chain and with which ids (`resolveOracleReadPlan`), and which
 // Hermes-compatible base the hermes plans execute against
@@ -58,7 +62,10 @@ export { PythLazerRule, LazerApiKeyMissingError } from "./rules/pyth-lazer-rule.
 // read-plane accessor (mirrors `pythCoreHermesEndpoint`).
 // WaterX quote-center rule (first-party ed25519 signed batches; `feedWaterxRule`
 // stays internal to `aggregate.ts`).
-export { WaterxRule, parseSignedEnvelope, BATCH_PRICE_INTENT, WATERX_INFRA, waterxQuoteCenterEndpoint, } from "./rules/waterx-rule.js";
+export { WaterxRule, parseSignedEnvelope, BATCH_PRICE_INTENT, WATERX_INFRA, waterxQuoteCenterEndpoint, 
+// Rule-owned payload accessor (kind-check + unwrap in one place) — never
+// hand-cast the payload shape.
+waterxEnvelopeOf, } from "./rules/waterx-rule.js";
 // `resolveOracleRule` is the ONE source→rule registry — exported so external
 // consumers (e.g. a BE prefetch cache that keys per source and needs each
 // source's `supportedTickers`/`fetchUpdateData`) resolve through it instead of

package/dist/src/oracle/price-update-rule.d.ts

@@ -20,14 +20,28 @@ import type { OracleHost } from "./host.ts";
 import type { OracleFeeSource, PythCache } from "./pyth.ts";
 export type PriceUpdateRuleKind = "pyth_rule" | "pyth_lazer_rule" | "supra_rule" | "constant_rule" | "waterx_rule";
 /**
- * The subset of `PriceUpdateRuleKind`s listable in a client's `oracleSource`
- * create option (see `OracleHost.oracleSources`) — i.e. rules that can serve as
- * the on-chain price *update* leg `refreshOraclePrices` runs before aggregating.
- * `supra_rule` and `constant_rule` are auxiliary rules fed alongside whichever
- * source is selected (see `aggregateTicker`), not sources themselves. The SDK
- * never reads `process.env` — consumers resolve their own env var to this type.
+ * The canonical list of selectable oracle sources — the SINGLE authority the
+ * {@link OracleSource} union derives from (the value-list→union derive
+ * idiom of `unified-client.ts`'s `NON_CLIENT_FIRST`, plus `Object.freeze`
+ * so the immutability is RUNTIME truth: `as const` alone would let a JS
+ * consumer push into the array and desync the membership Set built from it
+ * in `source-list.ts`). Runtime membership checks and the `ORACLE_SOURCE`
+ * env parser live there, on `isOracleSource` / `parseOracleSourceList`.
+ * Only sources belong here: `supra_rule` and `constant_rule` are auxiliary
+ * rules fed alongside whichever sources are selected (see
+ * `aggregateTicker`), not sources themselves — the `satisfies` keeps
+ * entries inside `PriceUpdateRuleKind` but adding an auxiliary rule to this
+ * list is an (incorrect) editorial decision this comment exists to prevent.
  */
-export type OracleSource = "pyth_rule" | "pyth_lazer_rule" | "waterx_rule";
+export declare const ORACLE_SOURCES: readonly ["pyth_rule", "pyth_lazer_rule", "waterx_rule"];
+/**
+ * The kinds listable in a client's `oracleSource` create option (see
+ * `OracleHost.oracleSources`) — i.e. rules that can serve as the on-chain
+ * price *update* leg `refreshOraclePrices` runs before aggregating. Derived
+ * from {@link ORACLE_SOURCES}. The SDK never reads `process.env` — consumers
+ * resolve their own env var to this type.
+ */
+export type OracleSource = (typeof ORACLE_SOURCES)[number];
 /**
  * Off-chain payload fetched by a rule, tagged by `kind` so a caller holding
  * several rules' results can tell them apart. `payload` is `unknown` here —

package/dist/src/oracle/price-update-rule.js

@@ -15,6 +15,25 @@
  * entry via `rule-registry.ts`, then drives fetch + `buildUpdateCalls`
  * through this port; `aggregate.ts` stays the sole orchestrator.
  */
+/**
+ * The canonical list of selectable oracle sources — the SINGLE authority the
+ * {@link OracleSource} union derives from (the value-list→union derive
+ * idiom of `unified-client.ts`'s `NON_CLIENT_FIRST`, plus `Object.freeze`
+ * so the immutability is RUNTIME truth: `as const` alone would let a JS
+ * consumer push into the array and desync the membership Set built from it
+ * in `source-list.ts`). Runtime membership checks and the `ORACLE_SOURCE`
+ * env parser live there, on `isOracleSource` / `parseOracleSourceList`.
+ * Only sources belong here: `supra_rule` and `constant_rule` are auxiliary
+ * rules fed alongside whichever sources are selected (see
+ * `aggregateTicker`), not sources themselves — the `satisfies` keeps
+ * entries inside `PriceUpdateRuleKind` but adding an auxiliary rule to this
+ * list is an (incorrect) editorial decision this comment exists to prevent.
+ */
+export const ORACLE_SOURCES = Object.freeze([
+    "pyth_rule",
+    "pyth_lazer_rule",
+    "waterx_rule",
+]);
 /**
  * Shared null → kind → shape guard ladder for a `PriceUpdateRule.buildUpdateCalls`
  * payload — every rule's `buildUpdateCalls` needs the exact same three checks,

package/dist/src/oracle/read-plane.js

@@ -10,6 +10,7 @@
  * (FE/BE price facades) resolve through this instead of hardcoding which
  * sources share which feeds namespace.
  */
+import { ownEntry } from "../utils/record.js";
 import { pythCoreHermesEndpoint, pythProHermesEndpoint } from "./pyth.js";
 /**
  * Resolve `source`'s read plan for `tickers`. Pure config lookup — no
@@ -43,26 +44,32 @@ export function resolveOracleReadPlan(host, source, tickers) {
     switch (source) {
         case "pyth_rule":
         case "pyth_lazer_rule": {
+            // All ticker lookups go through `ownEntry` (own-keys-only): a ticker
+            // named like an Object.prototype key ("toString", "constructor", …)
+            // must read as not-listed, not as an inherited Function.
             const hexFeeds = host.config.packages.pyth_rule?.feeds;
             const feedIdByTicker = new Map();
             for (const ticker of tickers) {
-                const feedId = hexFeeds?.[ticker]?.feed_id;
+                const feedId = ownEntry(hexFeeds, ticker)?.feed_id;
                 if (feedId !== undefined)
                     feedIdByTicker.set(ticker, feedId);
             }
             // For pyth_rule the write and read namespaces coincide, so `unreadable`
             // is always empty; for lazer it is exactly the hex-entry gap.
             const writeFeeds = source === "pyth_lazer_rule" ? host.config.packages.pyth_lazer_rule?.feeds : hexFeeds;
-            const unreadable = tickers.filter((ticker) => writeFeeds?.[ticker] !== undefined && !feedIdByTicker.has(ticker));
+            const unreadable = tickers.filter((ticker) => ownEntry(writeFeeds, ticker) !== undefined && !feedIdByTicker.has(ticker));
             return { plane: "hermes", feedIdByTicker, unreadable };
         }
         case "waterx_rule": {
             // Absent feeds block ⇒ serves nothing (see the OracleReadPlan doc) —
-            // never claim tickers the config doesn't name.
+            // never claim tickers the config doesn't name. `ownEntry` (own-keys-
+            // only, never the `in` operator or a bare bracket read) so a
+            // prototype-key ticker can't count as feeds-listed and poison the
+            // quote-center batch (which 404s whole batches on unknown symbols).
             const feeds = host.config.packages.waterx_rule?.feeds;
             return {
                 plane: "quote_center",
-                tickers: feeds ? tickers.filter((ticker) => ticker in feeds) : [],
+                tickers: tickers.filter((ticker) => ownEntry(feeds, ticker) !== undefined),
                 unreadable: [],
             };
         }

package/dist/src/oracle/rules/pyth-core-rule.js

@@ -6,6 +6,7 @@
  * across rules by `kind`. Mechanical wrap only — no on-chain/off-chain logic
  * changes vs `../pyth.ts` / `./pyth-rule.ts`.
  */
+import { ownEntry } from "../../utils/record.js";
 import { assertRuleUpdateData, } from "../price-update-rule.js";
 import { buildPythPriceUpdateCalls, endpointSupportedFeedIds, fetchPriceFeedsUpdateData, pythCoreHermesEndpoint, } from "../pyth.js";
 /**
@@ -76,7 +77,7 @@ export const PythCoreRule = {
         for (const ticker of tickers) {
             // Same lookup as `host.getPythFeed(ticker)` minus its throw — an
             // unlisted ticker is a miss here, not an error.
-            const feedId = host.config.packages.pyth_rule?.feeds?.[ticker]?.feed_id;
+            const feedId = ownEntry(host.config.packages.pyth_rule?.feeds, ticker)?.feed_id;
             if (feedId === undefined || !packedFeedIds.has(feedId))
                 return null;
             feedIds.push(feedId);

package/dist/src/oracle/rules/pyth-lazer-rule.js

@@ -8,6 +8,7 @@
  * `Update` PTB value back through a `RuleUpdateHandle` for the feed calls.
  */
 import { fromHex } from "@mysten/bcs";
+import { ownEntry } from "../../utils/record.js";
 import { assertRuleUpdateData, } from "../price-update-rule.js";
 import { fetchWithPolicy, joinEndpointPath, rethrowExhaustedFetch } from "../update-fetch.js";
 /**
@@ -162,7 +163,9 @@ export const PythLazerRule = {
         // not fail per ticker as if only that feed were missing.
         const { feeds } = requireLazerPackage(host);
         const feedIds = tickers.map((ticker) => {
-            const feedId = feeds[ticker];
+            // ownEntry: a prototype-key ticker ("toString") must throw here as
+            // unlisted, not turn an inherited Function into a "feed id".
+            const feedId = ownEntry(feeds, ticker);
             if (feedId === undefined) {
                 throw new Error(`No pyth_lazer_rule feed listed for ticker: ${ticker}`);
             }
@@ -190,7 +193,7 @@ export const PythLazerRule = {
             return null;
         const packedFeedIds = new Set(payload.feedIds);
         for (const ticker of tickers) {
-            const feedId = host.config.packages.pyth_lazer_rule?.feeds?.[ticker];
+            const feedId = ownEntry(host.config.packages.pyth_lazer_rule?.feeds, ticker);
             if (feedId === undefined || !packedFeedIds.has(feedId))
                 return null;
         }

package/dist/src/oracle/rules/waterx-rule.js

@@ -24,6 +24,7 @@
  */
 import { fromHex } from "@mysten/bcs";
 import { collectBatchLatest, newBatchItem, newBatchPayload, pushBatchItem, } from "../../generated/waterx_rule/waterx_rule.js";
+import { ownEntry } from "../../utils/record.js";
 import { assertRuleUpdateData, } from "../price-update-rule.js";
 import { FetchPolicyError, fetchWithPolicy, joinEndpointPath, } from "../update-fetch.js";
 /** The single signing intent the quote-center emits — exported so read-plane
@@ -260,7 +261,9 @@ export const WaterxRule = {
         // not fail per ticker as if only that feed were missing.
         const { feeds } = requireWaterxPackage(host);
         for (const ticker of tickers) {
-            if (feeds[ticker] === undefined) {
+            // ownEntry: a prototype-key ticker ("toString") must throw here as
+            // unlisted, not pass as an inherited Function and reach the network.
+            if (ownEntry(feeds, ticker) === undefined) {
                 throw new Error(`No waterx_rule feed listed for ticker: ${ticker}`);
             }
         }

package/dist/src/oracle/source-list.d.ts

@@ -0,0 +1,36 @@
+/**
+ * `source-list.ts` — THE parser for a consumer's `ORACLE_SOURCE` env string
+ * (comma list of `OracleSource` values → the fed set). The FE and BE
+ * previously carried twin hand-written parsers whose semantics drifted once
+ * in review (a trailing comma booted one deployment green and 500'd the
+ * other); this canonical behavior is what both fold onto:
+ *
+ *  - split on `,`, trim entries, DROP empties (trailing/doubled commas are
+ *    the most common env typo, never a boot failure)
+ *  - validate every entry against {@link ORACLE_SOURCES}
+ *  - dedupe, order-preserving (list order is consumer read-plane policy —
+ *    the SDK's own fed-set build treats the list as a set)
+ *  - throw an operator-actionable error on empty/unset/invalid input —
+ *    there is NO default oracle source
+ *
+ * The SDK still never reads `process.env` — callers pass the raw string.
+ *
+ * STRICTER than the consumers' previous `in`-operator checks: a value named
+ * like an `Object.prototype` key (`toString`, `constructor`, …) passed those
+ * and died deep in the stack; `Set.has` rejects it here at parse.
+ *
+ * Zod adopters: this THROWS a plain Error. Inside a zod `.transform()` a
+ * throw escapes `schema.parse()` un-aggregated and masks sibling issues —
+ * wrap it: `try { return parseOracleSourceList(raw); } catch (e) {
+ * ctx.addIssue({ code: "custom", message: (e as Error).message }); return
+ * z.NEVER; }`.
+ */
+import { type OracleSource } from "./price-update-rule.ts";
+/**
+ * THE runtime membership check for {@link ORACLE_SOURCES} — the parser below
+ * and `PerpClient`'s ctor validation both use this one predicate, so the env
+ * parser and the create-option front door can never disagree. `Set.has`,
+ * never `in`/bracket reads (prototype-chain safe by construction).
+ */
+export declare function isOracleSource(value: string): value is OracleSource;
+export declare function parseOracleSourceList(raw: string | null | undefined): OracleSource[];

package/dist/src/oracle/source-list.js

@@ -0,0 +1,53 @@
+/**
+ * `source-list.ts` — THE parser for a consumer's `ORACLE_SOURCE` env string
+ * (comma list of `OracleSource` values → the fed set). The FE and BE
+ * previously carried twin hand-written parsers whose semantics drifted once
+ * in review (a trailing comma booted one deployment green and 500'd the
+ * other); this canonical behavior is what both fold onto:
+ *
+ *  - split on `,`, trim entries, DROP empties (trailing/doubled commas are
+ *    the most common env typo, never a boot failure)
+ *  - validate every entry against {@link ORACLE_SOURCES}
+ *  - dedupe, order-preserving (list order is consumer read-plane policy —
+ *    the SDK's own fed-set build treats the list as a set)
+ *  - throw an operator-actionable error on empty/unset/invalid input —
+ *    there is NO default oracle source
+ *
+ * The SDK still never reads `process.env` — callers pass the raw string.
+ *
+ * STRICTER than the consumers' previous `in`-operator checks: a value named
+ * like an `Object.prototype` key (`toString`, `constructor`, …) passed those
+ * and died deep in the stack; `Set.has` rejects it here at parse.
+ *
+ * Zod adopters: this THROWS a plain Error. Inside a zod `.transform()` a
+ * throw escapes `schema.parse()` un-aggregated and masks sibling issues —
+ * wrap it: `try { return parseOracleSourceList(raw); } catch (e) {
+ * ctx.addIssue({ code: "custom", message: (e as Error).message }); return
+ * z.NEVER; }`.
+ */
+import { ORACLE_SOURCES } from "./price-update-rule.js";
+// Widened-annotation Set (not an assertion) so the type predicate below
+// narrows by CONSTRUCTION rather than by cast.
+const ORACLE_SOURCE_SET = new Set(ORACLE_SOURCES);
+/**
+ * THE runtime membership check for {@link ORACLE_SOURCES} — the parser below
+ * and `PerpClient`'s ctor validation both use this one predicate, so the env
+ * parser and the create-option front door can never disagree. `Set.has`,
+ * never `in`/bracket reads (prototype-chain safe by construction).
+ */
+export function isOracleSource(value) {
+    return ORACLE_SOURCE_SET.has(value);
+}
+export function parseOracleSourceList(raw) {
+    const parts = (raw ?? "")
+        .split(",")
+        .map((part) => part.trim())
+        .filter((part) => part !== "");
+    const sources = parts.filter(isOracleSource);
+    if (parts.length === 0 || sources.length !== parts.length) {
+        const got = raw == null || raw.trim() === "" ? "unset" : `'${raw}'`;
+        throw new Error(`ORACLE_SOURCE must be a comma-separated list of ${ORACLE_SOURCES.join(" | ")} ` +
+            `(got ${got}) — there is NO default oracle source; set it in the deployment's env.`);
+    }
+    return [...new Set(sources)];
+}

package/dist/src/perp/client.d.ts

@@ -11,7 +11,7 @@
  * {@link PerpConfigView}. This class is just the wiring + factory between them.
  */
 import { BaseLineClient } from "../base-client.ts";
-import type { OracleSource } from "../oracle/price-update-rule.ts";
+import { type OracleSource } from "../oracle/price-update-rule.ts";
 import type { FetchPolicy } from "../oracle/update-fetch.ts";
 import { type LoadConfigOptions, type PythAccessConfig, type PythFetchPolicy, type WaterxAccessConfig, type WaterXConfig, type WormholeInfraConfig } from "./config.ts";
 import type { Network } from "./constants.ts";

package/dist/src/perp/client.js

@@ -11,6 +11,8 @@
  * {@link PerpConfigView}. This class is just the wiring + factory between them.
  */
 import { BaseLineClient } from "../base-client.js";
+import { ORACLE_SOURCES } from "../oracle/price-update-rule.js";
+import { isOracleSource } from "../oracle/source-list.js";
 import { PerpConfigView } from "./config-view.js";
 import { loadConfig, WORMHOLE_DEFAULTS, } from "./config.js";
 export class PerpClient extends BaseLineClient {
@@ -46,16 +48,18 @@ export class PerpClient extends BaseLineClient {
             ...(opts.waterxEndpoint !== undefined ? { endpoint: opts.waterxEndpoint } : {}),
             ...(opts.waterxFetch !== undefined ? { fetch: opts.waterxFetch } : {}),
         };
-        // Normalize single-or-list to a deduped, order-preserving list. An empty
-        // list — or a nullish/empty entry, the shape an untyped caller produces
-        // by omitting the REQUIRED option — is a caller bug, not "no oracle":
-        // fail construction loudly instead of booting green and surfacing as
-        // `OracleSourceNotImplemented: undefined` at the first tx-build.
+        // Normalize single-or-list to a deduped, order-preserving list, gated by
+        // `isOracleSource` — the SAME predicate `parseOracleSourceList` uses. An
+        // empty list, a nullish entry (an untyped caller omitting the REQUIRED
+        // option), or an unregistered value (`'core'`, `'pyth'`, …) fails
+        // construction loudly instead of booting green and surfacing as
+        // `OracleSourceNotImplemented` at the first tx-build.
         const sources = Array.isArray(opts.oracleSource) ? opts.oracleSource : [opts.oracleSource];
         this.oracleSources = [...new Set(sources)];
         if (this.oracleSources.length === 0 ||
-            this.oracleSources.some((source) => typeof source !== "string" || source.length === 0)) {
-            throw new Error(`oracleSource is REQUIRED and must name at least one source (got ${JSON.stringify(sources)})`);
+            this.oracleSources.some((source) => !isOracleSource(source))) {
+            throw new Error(`oracleSource is REQUIRED and must name at least one of ${ORACLE_SOURCES.join(" | ")} ` +
+                `(got ${JSON.stringify(sources)})`);
         }
         this.view = new PerpConfigView(() => this.config, () => this.wormhole);
     }

package/dist/src/perp/config-view.js

@@ -8,6 +8,7 @@
  * callers keep calling `client.getMarket(...)` / `client.wlpType()` unchanged.
  * Tested in isolation against a plain config object — no network needed.
  */
+import { ownEntry } from "../utils/record.js";
 export class PerpConfigView {
     getConfig;
     getWormhole;
@@ -26,21 +27,21 @@ export class PerpConfigView {
     }
     /** `waterx_perp.markets[ticker]`, throws if unknown. */
     getMarket(ticker) {
-        const m = this.config.packages.waterx_perp?.markets?.[ticker];
+        const m = ownEntry(this.config.packages.waterx_perp?.markets, ticker);
         if (!m)
             throw new Error(`Unknown market ticker: ${ticker}`);
         return m;
     }
     /** `waterx_oracle.aggregators[ticker]`, throws if unknown. */
     getAggregator(ticker) {
-        const a = this.config.packages.waterx_oracle?.aggregators?.[ticker];
+        const a = ownEntry(this.config.packages.waterx_oracle?.aggregators, ticker);
         if (!a)
             throw new Error(`No aggregator listed for ticker: ${ticker}`);
         return a;
     }
     /** `pyth_rule.feeds[ticker]`, throws if unknown. */
     getPythFeed(ticker) {
-        const f = this.config.packages.pyth_rule?.feeds?.[ticker];
+        const f = ownEntry(this.config.packages.pyth_rule?.feeds, ticker);
         if (!f)
             throw new Error(`No pyth feed listed for ticker: ${ticker}`);
         return f;
@@ -66,7 +67,7 @@ export class PerpConfigView {
         const c = this.config.packages.constant_rule;
         if (!c?.published_at || !c.config)
             return false;
-        return c.feeds?.[ticker] !== undefined;
+        return ownEntry(c.feeds, ticker) !== undefined;
     }
     /**
      * The `supra_rule` config when it is deployed, enabled, and fully wired
@@ -92,7 +93,7 @@ export class PerpConfigView {
      */
     getPoolTokenType(tickerOrName) {
         const poolTokens = this.config.packages.wlp?.pool_tokens ?? {};
-        const exact = poolTokens[tickerOrName];
+        const exact = ownEntry(poolTokens, tickerOrName);
         if (exact)
             return exact;
         for (const t of Object.values(poolTokens)) {
@@ -115,7 +116,7 @@ export class PerpConfigView {
      * reward coin type, so callers don't need a separate alias-to-type lookup.
      */
     getRewarders(stakeAlias) {
-        const map = this.config.packages.waterx_staking?.rewarders?.[stakeAlias];
+        const map = ownEntry(this.config.packages.waterx_staking?.rewarders, stakeAlias);
         if (!map)
             return [];
         return Object.entries(map).map(([alias, entry]) => ({ alias, ...entry }));

package/dist/src/perp/index.d.ts

@@ -13,7 +13,7 @@ export type { EstLiqPriceViewOpts } from "./liq-view.ts";
 export * from "./user/index.ts";
 export * from "./tx-builders.ts";
 export * from "./fetch.ts";
-export { FetchPolicyError, LazerApiKeyMissingError, OracleFeeSourceUnavailableError, OracleSourceNotImplementedError, PythCache, aggregateTicker, aggregateTickerWithConstant, aggregateTickerWithPyth, buildPythPriceUpdateCalls, fetchPriceFeedsUpdateData, pythCoreHermesEndpoint, pythProHermesEndpoint, resolveHermesReadEndpoint, waterxQuoteCenterEndpoint, refreshOraclePrices, updatePythPrices, } from "../oracle/index.ts";
+export { FetchPolicyError, LazerApiKeyMissingError, OracleFeeSourceUnavailableError, OracleSourceNotImplementedError, PythCache, aggregateTicker, aggregateTickerWithConstant, aggregateTickerWithPyth, ORACLE_SOURCES, buildPythPriceUpdateCalls, fetchPriceFeedsUpdateData, isOracleSource, parseOracleSourceList, pythCoreHermesEndpoint, pythProHermesEndpoint, refreshOraclePrices, resolveHermesReadEndpoint, updatePythPrices, waterxEnvelopeOf, waterxQuoteCenterEndpoint, } from "../oracle/index.ts";
 export type { FetchPolicy, OracleFeeSource, OracleSource, UpdateDataProvider, } from "../oracle/index.ts";
 export { fetchDepositVaa, fetchVaa, listBridgeWithdrawalVaas, listVaasByEmitter, padEvmEmitter, toWormholescanEmitter, vaaBase64ToBytes, vaaBase64ToHex, vaaBytesToBase64, waitForVaa, } from "../account/funding/wormhole.ts";
 export type { VaaListItem, VaaResponse, WormholescanOptions } from "../account/funding/wormhole.ts";

package/dist/src/perp/index.js

@@ -15,7 +15,7 @@ export * from "./tx-builders.js";
 // ======== Read-only queries ========
 export * from "./fetch.js";
 // ======== Oracle utilities (Pyth source + rule aggregation) ========
-export { FetchPolicyError, LazerApiKeyMissingError, OracleFeeSourceUnavailableError, OracleSourceNotImplementedError, PythCache, aggregateTicker, aggregateTickerWithConstant, aggregateTickerWithPyth, buildPythPriceUpdateCalls, fetchPriceFeedsUpdateData, pythCoreHermesEndpoint, pythProHermesEndpoint, resolveHermesReadEndpoint, waterxQuoteCenterEndpoint, refreshOraclePrices, updatePythPrices, } from "../oracle/index.js";
+export { FetchPolicyError, LazerApiKeyMissingError, OracleFeeSourceUnavailableError, OracleSourceNotImplementedError, PythCache, aggregateTicker, aggregateTickerWithConstant, aggregateTickerWithPyth, ORACLE_SOURCES, buildPythPriceUpdateCalls, fetchPriceFeedsUpdateData, isOracleSource, parseOracleSourceList, pythCoreHermesEndpoint, pythProHermesEndpoint, refreshOraclePrices, resolveHermesReadEndpoint, updatePythPrices, waterxEnvelopeOf, waterxQuoteCenterEndpoint, } from "../oracle/index.js";
 // ======== Wormhole / Wormholescan utilities (credit bridge) ========
 export { fetchDepositVaa, fetchVaa, listBridgeWithdrawalVaas, listVaasByEmitter, padEvmEmitter, toWormholescanEmitter, vaaBase64ToBytes, vaaBase64ToHex, vaaBytesToBase64, waitForVaa, } from "../account/funding/wormhole.js";
 // ======== Generated BCS types (sui-ts-codegen) ========

package/dist/src/perp/user/staking.js

@@ -17,9 +17,10 @@
  */
 import { makeSenderRequest } from "../../account/account-request.js";
 import * as staking from "../../generated/waterx_staking/waterx_staking.js";
+import { ownEntry } from "../../utils/record.js";
 import { toU64Arg } from "../../utils/validate.js";
 function pool(client, stakeAlias) {
-    const id = client.config.packages.waterx_staking?.pools?.[stakeAlias];
+    const id = ownEntry(client.config.packages.waterx_staking?.pools, stakeAlias);
     if (!id) {
         throw new Error(`config.packages.waterx_staking.pools[${stakeAlias}] is not set — staking is not deployed for this stake type`);
     }

package/dist/src/utils/config.js

@@ -1,3 +1,4 @@
+import { ownEntry } from "./record.js";
 /** Returns all registered market tickers (e.g. "BTCUSD") from waterx-config. */
 export function getMarketTickers(config) {
     return Object.keys(config.packages.waterx_perp.markets);
@@ -11,5 +12,5 @@ export function getMarketTickers(config) {
  */
 export function getCollateralAssets(config) {
     const feeds = config.packages.pyth_rule?.feeds ?? {};
-    return Object.keys(config.packages.wlp.pool_tokens).filter((t) => feeds[t] !== undefined);
+    return Object.keys(config.packages.wlp.pool_tokens).filter((t) => ownEntry(feeds, t) !== undefined);
 }

package/dist/src/utils/record.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Own-key record lookup. Ticker-keyed config records (`feeds`, `markets`,
+ * `aggregators`) are indexed with caller-supplied strings; a bare bracket
+ * read — like the `in` operator — walks the prototype chain, so a ticker
+ * named like an `Object.prototype` key ("toString", "constructor", …) reads
+ * as an inherited Function instead of "absent" and leaks into batches sent
+ * to the network. Every such lookup funnels through here so the answer is
+ * own-keys-only, everywhere, instead of per-site `Object.hasOwn` guards
+ * that drift.
+ */
+/** `record[key]` iff `key` is an OWN key — `undefined` for an absent record, an absent key, or a prototype-chain hit. */
+export declare function ownEntry<T extends Record<string, unknown>>(record: T | undefined, key: string): T[string] | undefined;

package/dist/src/utils/record.js

@@ -0,0 +1,19 @@
+/**
+ * Own-key record lookup. Ticker-keyed config records (`feeds`, `markets`,
+ * `aggregators`) are indexed with caller-supplied strings; a bare bracket
+ * read — like the `in` operator — walks the prototype chain, so a ticker
+ * named like an `Object.prototype` key ("toString", "constructor", …) reads
+ * as an inherited Function instead of "absent" and leaks into batches sent
+ * to the network. Every such lookup funnels through here so the answer is
+ * own-keys-only, everywhere, instead of per-site `Object.hasOwn` guards
+ * that drift.
+ */
+/** `record[key]` iff `key` is an OWN key — `undefined` for an absent record, an absent key, or a prototype-chain hit. */
+export function ownEntry(record, key) {
+    // The `T extends Record<...>` form (rather than `Record<string, V>`) keeps
+    // union-typed records inferable; TS then resolves `record[key]` only to the
+    // constraint's `unknown`, so restate the definitionally-true index type.
+    return record !== undefined && Object.hasOwn(record, key)
+        ? record[key]
+        : undefined;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@waterx/sdk",
-  "version": "4.3.0",
+  "version": "4.3.1",
   "description": "WaterX SDK — perpetuals and prediction markets on Sui",
   "license": "MIT",
   "author": "WaterX",