@waterx/sdk 4.3.0 → 4.3.2

package/README.md

@@ -113,15 +113,20 @@ ONE **required** client create option, `oracleSource`, names the price-update so
 
 **Multi-source fed sets.** With a list, ONE build fetches and feeds EVERY listed source's data in the same PTB; the chain's per-ticker aggregator **weight tables** decide which contributions count — feeding an unweighted rule's price is dropped on-chain, while starving a weighted rule aborts. That asymmetry is what makes weight migrations (Core→Pro, Pyth↔waterx coexistence) safe: keep the list a **superset** of every ticker's weighted rule set and flip weights per ticker at any time — an env edit, never an SDK release. (One caveat: waterx's feed call burns a per-symbol signed-timestamp high-water mark regardless of weights — see the replay note below.)
 
-**No cross-source fallback, no feeds guard at init.** Construction rejects an empty/nullish `oracleSource`, but a listed source whose feed for a requested ticker is absent is **not** an error at client creation — the build fails at **tx-build** only when **no** listed source serves the ticker (constant-only tickers, which need no price update, are exempt). A present-but-wrong feed id is not validated by the SDK; it aborts on-chain at dry-run.
+**No cross-source fallback, no feeds guard at init.** Construction rejects an empty/nullish `oracleSource` **and any value outside `ORACLE_SOURCES`** (a legacy `'core'` / `'pyth'` string fails at `create`), but a listed source whose feed for a requested ticker is absent is **not** an error at client creation — the build fails at **tx-build** only when **no** listed source serves the ticker (constant-only tickers, which need no price update, are exempt). A present-but-wrong feed id is not validated by the SDK; it aborts on-chain at dry-run.
 
 Every source's external infra is a **rule-owned per-network table**, never deployment-overridable and never in the config JSON: `PYTH_CORE_INFRA` (`src/oracle/pyth.ts` — Pyth state ids + the keyless Core Hermes endpoint, read-plane accessor `pythCoreHermesEndpoint(network)`), `LAZER_INFRA` (`src/oracle/rules/pyth-lazer-rule.ts`), `WATERX_INFRA` (`src/oracle/rules/waterx-rule.ts` — testnet `quote-center-staging.waterx.app` / mainnet `quote-center.waterx.app`, accessor `waterxQuoteCenterEndpoint(network)`). For **price READS** under a fed set without `pyth_rule`, the documented Pyth Pro base (`pythProHermesEndpoint()` — identical for every subscriber, auth via the Bearer key) applies: resolve the read endpoint with `resolveHermesReadEndpoint(network, sources, override?)` instead of branching by hand, and pair it with `resolveOracleReadPlan` for the per-source served-sets/ids. `client.pyth` is the access-only `PythAccessConfig` — just the caller-supplied `pythApiKey` / `pythFetch` create options (a secret has no place in a public CDN JSON); `client.waterx` is likewise `WaterxAccessConfig` (`waterxEndpoint` / `waterxFetch` overrides only; fetch policy resolves **`waterxFetch` → built-in defaults** — deliberately no `pythFetch` fallback, sources never share config). See the browser/CORS note below.
 
 ```ts
-// Per-environment wiring — the consumer owns the env var, not the SDK:
+// Per-environment wiring — the consumer owns the env var, not the SDK.
+// parseOracleSourceList is THE canonical parser (trim, drop empty entries,
+// validate every value, dedupe, throw operator-actionably) — never a bare
+// split-and-cast, which would hand the strict constructor untrimmed junk.
+import { parseOracleSourceList } from "@waterx/sdk/oracle";
+
 const perp = await PerpClient.create(network, {
   waterxConfigUrl,
-  oracleSource: process.env.ORACLE_SOURCE!.split(",") as OracleSource[], // REQUIRED; comma list = the fed set
+  oracleSource: parseOracleSourceList(process.env.ORACLE_SOURCE), // REQUIRED; comma list = the fed set
   pythApiKey: process.env.PYTH_API_KEY, // required iff 'pyth_lazer_rule' is listed (Lazer is auth-first)
 });
 ```
@@ -133,7 +138,7 @@ This is the coexistence rollout pattern: staging lists every source under migrat
 Every source plugs in the same way — routing is driven **only** by the client's `oracleSource` option (never a config `enabled` flag, never `process.env`):
 
 1. **Implement `PriceUpdateRule`** in `src/oracle/rules/<name>-rule.ts` — all port fields (`src/oracle/price-update-rule.ts`): `kind`, `requiresFeeSource` (`true` iff the on-chain verify draws a per-update fee — gates the fail-fast fee-source check), `supportedTickers`, `fetchUpdateData`, `narrowUpdateData` (subset a cached whole-universe payload to one build's tickers — a divisible payload returns a per-feed subset, an indivisible one returns itself whole iff fully covered; uncovered ticker → `null` miss), `buildUpdateCalls`.
-2. **Register it** in `src/oracle/rule-registry.ts` (`DEFAULT_RULES`) under a new `OracleSource` value (added to the union in `price-update-rule.ts`).
+2. **Register it** in `src/oracle/rule-registry.ts` (`DEFAULT_RULES`) under a new `OracleSource` value — added to `ORACLE_SOURCES` in `price-update-rule.ts` (the union derives from that list; a registry test pins every listed value to a registered rule).
 3. **Publish the on-chain rule package** — its config entry (package ids, per-ticker `feeds`) arrives via the normal `waterx-config` deploy pipeline; type it in `OraclePackages` (`src/oracle/config.ts`).
 4. **Add SDK infra constants** if the source needs external infra that is not part of the config JSON (API endpoints, verifier packages, state objects) — a **rule-owned** per-network table inside the rule's own file, mirroring `LAZER_INFRA` / `WATERX_INFRA` (never on the shared client, never in `oracle/config.ts`). Wire its read-plane served-set/ids into `resolveOracleReadPlan` (`src/oracle/read-plane.ts`).
 5. **Consumers flip `oracleSource`** per environment — no consumer code change, no SDK re-release.

package/dist/cjs/src/oracle/aggregate.d.ts

@@ -38,9 +38,10 @@ import { type WaterxSignedEnvelope } from "./rules/waterx-rule.ts";
  *   if it is stale — it never aborts — so the call stays mandatory while
  *   `pyth_rule` remains in the ticker's on-chain weighted set
  *   (`EMissingPriceSource` requires every weighted rule to appear).
- * - **Lazer** — fed when `lazerUpdate` is supplied: the verified
- *   `pyth_lazer::update::Update` produced by this PTB's lazer update leg
- *   (see `PythLazerRule.buildUpdateCalls`). If the ticker's aggregator does
+ * - **Lazer** — fed when `lazerUpdate` is supplied: the verified update this
+ *   PTB's lazer update leg produced with the network's verify entry
+ *   (`update_v2::Update` on mainnet, `update::Update` on testnet — see
+ *   `PythLazerRule.buildUpdateCalls`). If the ticker's aggregator does
  *   not (yet) weight `PythLazerRule`, the contribution is silently dropped
  *   on-chain — feeding ahead of the weight migration is harmless.
  * - **Supra** — fed alongside Pyth/Lazer when supra is enabled + wired

package/dist/cjs/src/oracle/aggregate.js

@@ -29,6 +29,7 @@ exports.aggregateTickerWithPyth = aggregateTickerWithPyth;
 exports.aggregateTickerWithConstant = aggregateTickerWithConstant;
 exports.refreshOraclePrices = refreshOraclePrices;
 const oracle_ts_1 = require("../generated/waterx_oracle/oracle.js");
+const record_ts_1 = require("../utils/record.js");
 const pyth_ts_1 = require("./pyth.js");
 const rule_registry_ts_1 = require("./rule-registry.js");
 const constant_rule_ts_1 = require("./rules/constant-rule.js");
@@ -89,9 +90,10 @@ async function resolveGroupUpdateData(host, group, provider) {
  *   if it is stale — it never aborts — so the call stays mandatory while
  *   `pyth_rule` remains in the ticker's on-chain weighted set
  *   (`EMissingPriceSource` requires every weighted rule to appear).
- * - **Lazer** — fed when `lazerUpdate` is supplied: the verified
- *   `pyth_lazer::update::Update` produced by this PTB's lazer update leg
- *   (see `PythLazerRule.buildUpdateCalls`). If the ticker's aggregator does
+ * - **Lazer** — fed when `lazerUpdate` is supplied: the verified update this
+ *   PTB's lazer update leg produced with the network's verify entry
+ *   (`update_v2::Update` on mainnet, `update::Update` on testnet — see
+ *   `PythLazerRule.buildUpdateCalls`). If the ticker's aggregator does
  *   not (yet) weight `PythLazerRule`, the contribution is silently dropped
  *   on-chain — feeding ahead of the weight migration is harmless.
  * - **Supra** — fed alongside Pyth/Lazer when supra is enabled + wired
@@ -169,7 +171,7 @@ function aggregateTickerWithPyth(tx, host, args) {
  * {@link refreshOraclePrices}), which feeds both.
  */
 function aggregateTickerWithConstant(tx, host, args) {
-    if (host.config.packages.pyth_rule?.feeds?.[args.ticker] !== undefined) {
+    if ((0, record_ts_1.ownEntry)(host.config.packages.pyth_rule?.feeds, args.ticker) !== undefined) {
         throw new Error(`'${args.ticker}' is in pyth_rule.feeds (dual-feed) — feed both via aggregateTicker({ priceInfoObjectId }) / refreshOraclePrices, not aggregateTickerWithConstant`);
     }
     aggregateTicker(tx, host, { ticker: args.ticker });
@@ -230,7 +232,7 @@ async function refreshOraclePrices(tx, host, tickers, opts = {}) {
     // price_info_object lookup for every ticker with a pyth_rule.feeds entry —
     // needed by aggregateTicker's (unchanged) Pyth feed step below regardless of
     // which rule performed the on-chain update for that ticker.
-    const pythTickers = tickers.filter((t) => host.config.packages.pyth_rule?.feeds?.[t] !== undefined);
+    const pythTickers = tickers.filter((t) => (0, record_ts_1.ownEntry)(host.config.packages.pyth_rule?.feeds, t) !== undefined);
     const priceInfoByTicker = new Map();
     pythTickers.forEach((t) => priceInfoByTicker.set(t, host.getPythFeed(t).price_info_object));
     // The fed set is a LIST (`host.oracleSources`, normalized + deduped at

package/dist/cjs/src/oracle/index.d.ts

@@ -21,13 +21,15 @@ export type { FetchPolicy } from "./update-fetch.ts";
 export { PythCache, fetchPriceFeedsUpdateData, endpointSupportedFeedIds, probeMissingFeeds, buildPythPriceUpdateCalls, pythCoreHermesEndpoint, pythProHermesEndpoint, PYTH_PRO_HERMES_ENDPOINT, updatePythPrices, HermesEndpointRejectedAllFeedsError, MISSING_FEED_MEMO_TTL_MS, OracleFeeSourceUnavailableError, } from "./pyth.ts";
 export type { OracleFeeSource } from "./pyth.ts";
 export type { PriceUpdateRule, PriceUpdateRuleKind, RuleUpdateData, RuleUpdateHandle, BuildUpdateOpts, OracleSource, UpdateDataProvider, } from "./price-update-rule.ts";
+export { ORACLE_SOURCES } from "./price-update-rule.ts";
+export { isOracleSource, parseOracleSourceList } from "./source-list.ts";
 export { resolveOracleReadPlan, resolveHermesReadEndpoint } from "./read-plane.ts";
 export type { OracleReadPlan } from "./read-plane.ts";
 export { PythCoreRule } from "./rules/pyth-core-rule.ts";
 export type { PythCoreUpdatePayload } from "./rules/pyth-core-rule.ts";
 export { PythLazerRule, LazerApiKeyMissingError } from "./rules/pyth-lazer-rule.ts";
 export type { PythLazerUpdatePayload } from "./rules/pyth-lazer-rule.ts";
-export { WaterxRule, parseSignedEnvelope, BATCH_PRICE_INTENT, WATERX_INFRA, waterxQuoteCenterEndpoint, } from "./rules/waterx-rule.ts";
+export { WaterxRule, parseSignedEnvelope, BATCH_PRICE_INTENT, WATERX_INFRA, waterxQuoteCenterEndpoint, waterxEnvelopeOf, } from "./rules/waterx-rule.ts";
 export type { WaterxUpdatePayload, WaterxSignedEnvelope, WaterxBatchItem, } from "./rules/waterx-rule.ts";
 export { OracleSourceNotImplementedError, resolveOracleRule } from "./rule-registry.ts";
 export { aggregateTicker, aggregateTickerWithPyth, aggregateTickerWithConstant, refreshOraclePrices, } from "./aggregate.ts";

package/dist/cjs/src/oracle/index.js

@@ -17,7 +17,7 @@
  * rules that consume it are separate concerns.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.reimbursePythSponsor = exports.openPythSponsorFund = exports.refreshOraclePrices = exports.aggregateTickerWithConstant = exports.aggregateTickerWithPyth = exports.aggregateTicker = exports.resolveOracleRule = exports.OracleSourceNotImplementedError = exports.waterxQuoteCenterEndpoint = exports.WATERX_INFRA = exports.BATCH_PRICE_INTENT = exports.parseSignedEnvelope = exports.WaterxRule = exports.LazerApiKeyMissingError = exports.PythLazerRule = exports.PythCoreRule = exports.resolveHermesReadEndpoint = exports.resolveOracleReadPlan = exports.OracleFeeSourceUnavailableError = exports.MISSING_FEED_MEMO_TTL_MS = exports.HermesEndpointRejectedAllFeedsError = exports.updatePythPrices = exports.PYTH_PRO_HERMES_ENDPOINT = exports.pythProHermesEndpoint = exports.pythCoreHermesEndpoint = exports.buildPythPriceUpdateCalls = exports.probeMissingFeeds = exports.endpointSupportedFeedIds = exports.fetchPriceFeedsUpdateData = exports.PythCache = exports.joinEndpointPath = exports.fetchWithPolicy = exports.FetchPolicyError = void 0;
+exports.reimbursePythSponsor = exports.openPythSponsorFund = exports.refreshOraclePrices = exports.aggregateTickerWithConstant = exports.aggregateTickerWithPyth = exports.aggregateTicker = exports.resolveOracleRule = exports.OracleSourceNotImplementedError = exports.waterxEnvelopeOf = exports.waterxQuoteCenterEndpoint = exports.WATERX_INFRA = exports.BATCH_PRICE_INTENT = exports.parseSignedEnvelope = exports.WaterxRule = exports.LazerApiKeyMissingError = exports.PythLazerRule = exports.PythCoreRule = exports.resolveHermesReadEndpoint = exports.resolveOracleReadPlan = exports.parseOracleSourceList = exports.isOracleSource = exports.ORACLE_SOURCES = exports.OracleFeeSourceUnavailableError = exports.MISSING_FEED_MEMO_TTL_MS = exports.HermesEndpointRejectedAllFeedsError = exports.updatePythPrices = exports.PYTH_PRO_HERMES_ENDPOINT = exports.pythProHermesEndpoint = exports.pythCoreHermesEndpoint = exports.buildPythPriceUpdateCalls = exports.probeMissingFeeds = exports.endpointSupportedFeedIds = exports.fetchPriceFeedsUpdateData = exports.PythCache = exports.joinEndpointPath = exports.fetchWithPolicy = exports.FetchPolicyError = void 0;
 // Shared fetch resilience wrapper — `FetchPolicyError` is re-exported (not
 // just the type) so a consumer (e.g. a BE prefetch cache) can `instanceof`
 // it off the failure `fetchPriceFeedsUpdateData` / `PythLazerRule` /
@@ -57,6 +57,13 @@ Object.defineProperty(exports, "updatePythPrices", { enumerable: true, get: func
 Object.defineProperty(exports, "HermesEndpointRejectedAllFeedsError", { enumerable: true, get: function () { return pyth_ts_1.HermesEndpointRejectedAllFeedsError; } });
 Object.defineProperty(exports, "MISSING_FEED_MEMO_TTL_MS", { enumerable: true, get: function () { return pyth_ts_1.MISSING_FEED_MEMO_TTL_MS; } });
 Object.defineProperty(exports, "OracleFeeSourceUnavailableError", { enumerable: true, get: function () { return pyth_ts_1.OracleFeeSourceUnavailableError; } });
+// Canonical OracleSource value list + THE env-string parser consumers fold
+// onto — semantics and rationale in `source-list.ts`'s header.
+var price_update_rule_ts_1 = require("./price-update-rule.js");
+Object.defineProperty(exports, "ORACLE_SOURCES", { enumerable: true, get: function () { return price_update_rule_ts_1.ORACLE_SOURCES; } });
+var source_list_ts_1 = require("./source-list.js");
+Object.defineProperty(exports, "isOracleSource", { enumerable: true, get: function () { return source_list_ts_1.isOracleSource; } });
+Object.defineProperty(exports, "parseOracleSourceList", { enumerable: true, get: function () { return source_list_ts_1.parseOracleSourceList; } });
 // Per-source READ-plane resolution — which tickers a source can price
 // off-chain and with which ids (`resolveOracleReadPlan`), and which
 // Hermes-compatible base the hermes plans execute against
@@ -86,6 +93,9 @@ Object.defineProperty(exports, "parseSignedEnvelope", { enumerable: true, get: f
 Object.defineProperty(exports, "BATCH_PRICE_INTENT", { enumerable: true, get: function () { return waterx_rule_ts_1.BATCH_PRICE_INTENT; } });
 Object.defineProperty(exports, "WATERX_INFRA", { enumerable: true, get: function () { return waterx_rule_ts_1.WATERX_INFRA; } });
 Object.defineProperty(exports, "waterxQuoteCenterEndpoint", { enumerable: true, get: function () { return waterx_rule_ts_1.waterxQuoteCenterEndpoint; } });
+// Rule-owned payload accessor (kind-check + unwrap in one place) — never
+// hand-cast the payload shape.
+Object.defineProperty(exports, "waterxEnvelopeOf", { enumerable: true, get: function () { return waterx_rule_ts_1.waterxEnvelopeOf; } });
 // `resolveOracleRule` is the ONE source→rule registry — exported so external
 // consumers (e.g. a BE prefetch cache that keys per source and needs each
 // source's `supportedTickers`/`fetchUpdateData`) resolve through it instead of

package/dist/cjs/src/oracle/price-update-rule.d.ts

@@ -20,14 +20,28 @@ import type { OracleHost } from "./host.ts";
 import type { OracleFeeSource, PythCache } from "./pyth.ts";
 export type PriceUpdateRuleKind = "pyth_rule" | "pyth_lazer_rule" | "supra_rule" | "constant_rule" | "waterx_rule";
 /**
- * The subset of `PriceUpdateRuleKind`s listable in a client's `oracleSource`
- * create option (see `OracleHost.oracleSources`) — i.e. rules that can serve as
- * the on-chain price *update* leg `refreshOraclePrices` runs before aggregating.
- * `supra_rule` and `constant_rule` are auxiliary rules fed alongside whichever
- * source is selected (see `aggregateTicker`), not sources themselves. The SDK
- * never reads `process.env` — consumers resolve their own env var to this type.
+ * The canonical list of selectable oracle sources — the SINGLE authority the
+ * {@link OracleSource} union derives from (the value-list→union derive
+ * idiom of `unified-client.ts`'s `NON_CLIENT_FIRST`, plus `Object.freeze`
+ * so the immutability is RUNTIME truth: `as const` alone would let a JS
+ * consumer push into the array and desync the membership Set built from it
+ * in `source-list.ts`). Runtime membership checks and the `ORACLE_SOURCE`
+ * env parser live there, on `isOracleSource` / `parseOracleSourceList`.
+ * Only sources belong here: `supra_rule` and `constant_rule` are auxiliary
+ * rules fed alongside whichever sources are selected (see
+ * `aggregateTicker`), not sources themselves — the `satisfies` keeps
+ * entries inside `PriceUpdateRuleKind` but adding an auxiliary rule to this
+ * list is an (incorrect) editorial decision this comment exists to prevent.
  */
-export type OracleSource = "pyth_rule" | "pyth_lazer_rule" | "waterx_rule";
+export declare const ORACLE_SOURCES: readonly ["pyth_rule", "pyth_lazer_rule", "waterx_rule"];
+/**
+ * The kinds listable in a client's `oracleSource` create option (see
+ * `OracleHost.oracleSources`) — i.e. rules that can serve as the on-chain
+ * price *update* leg `refreshOraclePrices` runs before aggregating. Derived
+ * from {@link ORACLE_SOURCES}. The SDK never reads `process.env` — consumers
+ * resolve their own env var to this type.
+ */
+export type OracleSource = (typeof ORACLE_SOURCES)[number];
 /**
  * Off-chain payload fetched by a rule, tagged by `kind` so a caller holding
  * several rules' results can tell them apart. `payload` is `unknown` here —
@@ -69,14 +83,22 @@ export declare function assertRuleUpdateData<T>(data: RuleUpdateData, kind: Pric
  * return when its collector-feed leg needs a value produced by the update leg
  * *within the same PTB*. Pyth Core needs none (its feed leg reads the shared
  * `PriceInfoObject` the update leg refreshed), so it returns `void`. The Lazer
- * rule returns the verified `pyth_lazer::update::Update` result — one
+ * rule returns the verified-update result of its network's verify entry — one
  * signature verification covers every feed in the payload, and
  * `pyth_lazer_rule::feed` takes it by reference per ticker (see
  * `aggregateTicker`'s `lazerUpdate` arg).
  */
 export type RuleUpdateHandle = {
     readonly kind: "pyth_lazer_rule";
-    /** Result of `pyth_lazer::parse_and_verify_le_ecdsa_update` in this PTB. */
+    /**
+     * Opaque result of this network's `LAZER_INFRA.verify_entry` in this PTB,
+     * passed straight to `pyth_lazer_rule::feed`. The Move type is
+     * network-dependent and never named here: mainnet's
+     * `pyth_lazer::parse_and_verify_le_ecdsa_update_v2` yields
+     * `pyth_lazer::update_v2::Update`, testnet's v1
+     * `…_le_ecdsa_update` yields `pyth_lazer::update::Update`, and each
+     * network's `pyth_lazer_rule` is published bound to the matching one.
+     */
     readonly update: TransactionArgument;
 };
 /**

package/dist/cjs/src/oracle/price-update-rule.js

@@ -17,7 +17,27 @@
  * through this port; `aggregate.ts` stays the sole orchestrator.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.ORACLE_SOURCES = void 0;
 exports.assertRuleUpdateData = assertRuleUpdateData;
+/**
+ * The canonical list of selectable oracle sources — the SINGLE authority the
+ * {@link OracleSource} union derives from (the value-list→union derive
+ * idiom of `unified-client.ts`'s `NON_CLIENT_FIRST`, plus `Object.freeze`
+ * so the immutability is RUNTIME truth: `as const` alone would let a JS
+ * consumer push into the array and desync the membership Set built from it
+ * in `source-list.ts`). Runtime membership checks and the `ORACLE_SOURCE`
+ * env parser live there, on `isOracleSource` / `parseOracleSourceList`.
+ * Only sources belong here: `supra_rule` and `constant_rule` are auxiliary
+ * rules fed alongside whichever sources are selected (see
+ * `aggregateTicker`), not sources themselves — the `satisfies` keeps
+ * entries inside `PriceUpdateRuleKind` but adding an auxiliary rule to this
+ * list is an (incorrect) editorial decision this comment exists to prevent.
+ */
+exports.ORACLE_SOURCES = Object.freeze([
+    "pyth_rule",
+    "pyth_lazer_rule",
+    "waterx_rule",
+]);
 /**
  * Shared null → kind → shape guard ladder for a `PriceUpdateRule.buildUpdateCalls`
  * payload — every rule's `buildUpdateCalls` needs the exact same three checks,

package/dist/cjs/src/oracle/read-plane.js

@@ -14,6 +14,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveHermesReadEndpoint = resolveHermesReadEndpoint;
 exports.resolveOracleReadPlan = resolveOracleReadPlan;
+const record_ts_1 = require("../utils/record.js");
 const pyth_ts_1 = require("./pyth.js");
 /**
  * Resolve `source`'s read plan for `tickers`. Pure config lookup — no
@@ -47,26 +48,32 @@ function resolveOracleReadPlan(host, source, tickers) {
     switch (source) {
         case "pyth_rule":
         case "pyth_lazer_rule": {
+            // All ticker lookups go through `ownEntry` (own-keys-only): a ticker
+            // named like an Object.prototype key ("toString", "constructor", …)
+            // must read as not-listed, not as an inherited Function.
             const hexFeeds = host.config.packages.pyth_rule?.feeds;
             const feedIdByTicker = new Map();
             for (const ticker of tickers) {
-                const feedId = hexFeeds?.[ticker]?.feed_id;
+                const feedId = (0, record_ts_1.ownEntry)(hexFeeds, ticker)?.feed_id;
                 if (feedId !== undefined)
                     feedIdByTicker.set(ticker, feedId);
             }
             // For pyth_rule the write and read namespaces coincide, so `unreadable`
             // is always empty; for lazer it is exactly the hex-entry gap.
             const writeFeeds = source === "pyth_lazer_rule" ? host.config.packages.pyth_lazer_rule?.feeds : hexFeeds;
-            const unreadable = tickers.filter((ticker) => writeFeeds?.[ticker] !== undefined && !feedIdByTicker.has(ticker));
+            const unreadable = tickers.filter((ticker) => (0, record_ts_1.ownEntry)(writeFeeds, ticker) !== undefined && !feedIdByTicker.has(ticker));
             return { plane: "hermes", feedIdByTicker, unreadable };
         }
         case "waterx_rule": {
             // Absent feeds block ⇒ serves nothing (see the OracleReadPlan doc) —
-            // never claim tickers the config doesn't name.
+            // never claim tickers the config doesn't name. `ownEntry` (own-keys-
+            // only, never the `in` operator or a bare bracket read) so a
+            // prototype-key ticker can't count as feeds-listed and poison the
+            // quote-center batch (which 404s whole batches on unknown symbols).
             const feeds = host.config.packages.waterx_rule?.feeds;
             return {
                 plane: "quote_center",
-                tickers: feeds ? tickers.filter((ticker) => ticker in feeds) : [],
+                tickers: tickers.filter((ticker) => (0, record_ts_1.ownEntry)(feeds, ticker) !== undefined),
                 unreadable: [],
             };
         }

package/dist/cjs/src/oracle/rules/pyth-core-rule.js

@@ -9,6 +9,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PythCoreRule = void 0;
+const record_ts_1 = require("../../utils/record.js");
 const price_update_rule_ts_1 = require("../price-update-rule.js");
 const pyth_ts_1 = require("../pyth.js");
 /**
@@ -79,7 +80,7 @@ exports.PythCoreRule = {
         for (const ticker of tickers) {
             // Same lookup as `host.getPythFeed(ticker)` minus its throw — an
             // unlisted ticker is a miss here, not an error.
-            const feedId = host.config.packages.pyth_rule?.feeds?.[ticker]?.feed_id;
+            const feedId = (0, record_ts_1.ownEntry)(host.config.packages.pyth_rule?.feeds, ticker)?.feed_id;
             if (feedId === undefined || !packedFeedIds.has(feedId))
                 return null;
             feedIds.push(feedId);

package/dist/cjs/src/oracle/rules/pyth-lazer-rule.d.ts

@@ -4,8 +4,9 @@
  * appends per lazer-routed ticker. Fetches one `leEcdsa` payload for all
  * requested integer feed ids from the Lazer HTTP API (Bearer-authenticated
  * via the `pythApiKey` create option), verifies it ONCE on-chain via
- * `pyth_lazer::parse_and_verify_le_ecdsa_update`, and hands the resulting
- * `Update` PTB value back through a `RuleUpdateHandle` for the feed calls.
+ * `pyth_lazer`'s verify entry for that network (see `LAZER_INFRA`), and hands the
+ * resulting `Update` PTB value back through a `RuleUpdateHandle` for the feed
+ * calls.
  */
 import type { Transaction, TransactionArgument } from "@mysten/sui/transactions";
 import type { Network } from "../../constants.ts";
@@ -21,16 +22,33 @@ import { type PriceUpdateRule } from "../price-update-rule.ts";
  *   `POST /v1/latest_price` (Bearer-authenticated). The service is
  *   network-agnostic (one signed payload verifies on any chain that trusts the
  *   Lazer signers), so both networks share the production host.
- * - `verifier_package` — the Sui package carrying
- *   `pyth_lazer::parse_and_verify_le_ecdsa_update`. Per-network: testnet is
- *   still the original v1 publish; mainnet is the v2-upgraded package (which
- *   still exposes the v1 entry `pyth_lazer_rule` binds). Values mirror the
- *   contract repo's `pyth_lazer_rule/Move.toml` published-at pins.
+ * - `verifier_package` / `verify_entry` — the Sui package carrying the verify
+ *   call, and which entry to call. These track what `pyth_lazer_rule` binds on
+ *   that network, so they move together:
+ *   - **mainnet** — the v2 package `0xefbfd064…` and the **v2** entry. The rule
+ *     was republished v2-bound after a 2026-08-05 mainnet probe: the ORIGINAL
+ *     package `0x7b502c…` now aborts `EDifferentVersion` (`state::current_cap`)
+ *     for any payload — the shared `State` has been migrated past that code —
+ *     and its v1 entry aborts `EInvalidChannel` on `fixed_rate@1000ms`, the only
+ *     channel WaterX's Pyth Pro grant permits.
+ *   - **testnet** — still the original v1 publish, which has no `update_v2`
+ *     module at all, so the v1 entry is the only one that exists there.
+ *   Both entries take `(state, clock, bytes)` and accept the same `leEcdsa`
+ *   payload. Values mirror the contract repo's `pyth_lazer_rule/Move.toml`
+ *   published-at pins.
  */
 export declare const LAZER_INFRA: Record<Network, {
     endpoint: string;
     verifier_package: string;
+    verify_entry: LazerVerifyEntry;
+    channel: string;
 }>;
+/**
+ * The `pyth_lazer` verify entry a network's deployed rule consumes. `_v2`
+ * returns `update_v2::Update`; the v1 entry returns `update::Update`, and the
+ * two are NOT interchangeable — the rule's `feed` takes one concrete type.
+ */
+export type LazerVerifyEntry = "parse_and_verify_le_ecdsa_update" | "parse_and_verify_le_ecdsa_update_v2";
 /** `pyth_lazer_rule`'s narrowed `RuleUpdateData.payload` shape. */
 export interface PythLazerUpdatePayload {
     /** One signed `leEcdsa` message carrying every requested feed. */

package/dist/cjs/src/oracle/rules/pyth-lazer-rule.js

@@ -5,13 +5,15 @@
  * appends per lazer-routed ticker. Fetches one `leEcdsa` payload for all
  * requested integer feed ids from the Lazer HTTP API (Bearer-authenticated
  * via the `pythApiKey` create option), verifies it ONCE on-chain via
- * `pyth_lazer::parse_and_verify_le_ecdsa_update`, and hands the resulting
- * `Update` PTB value back through a `RuleUpdateHandle` for the feed calls.
+ * `pyth_lazer`'s verify entry for that network (see `LAZER_INFRA`), and hands the
+ * resulting `Update` PTB value back through a `RuleUpdateHandle` for the feed
+ * calls.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PythLazerRule = exports.LazerApiKeyMissingError = exports.LAZER_INFRA = void 0;
 exports.feedLazerRule = feedLazerRule;
 const bcs_1 = require("@mysten/bcs");
+const record_ts_1 = require("../../utils/record.js");
 const price_update_rule_ts_1 = require("../price-update-rule.js");
 const update_fetch_ts_1 = require("../update-fetch.js");
 /**
@@ -24,20 +26,33 @@ const update_fetch_ts_1 = require("../update-fetch.js");
  *   `POST /v1/latest_price` (Bearer-authenticated). The service is
  *   network-agnostic (one signed payload verifies on any chain that trusts the
  *   Lazer signers), so both networks share the production host.
- * - `verifier_package` — the Sui package carrying
- *   `pyth_lazer::parse_and_verify_le_ecdsa_update`. Per-network: testnet is
- *   still the original v1 publish; mainnet is the v2-upgraded package (which
- *   still exposes the v1 entry `pyth_lazer_rule` binds). Values mirror the
- *   contract repo's `pyth_lazer_rule/Move.toml` published-at pins.
+ * - `verifier_package` / `verify_entry` — the Sui package carrying the verify
+ *   call, and which entry to call. These track what `pyth_lazer_rule` binds on
+ *   that network, so they move together:
+ *   - **mainnet** — the v2 package `0xefbfd064…` and the **v2** entry. The rule
+ *     was republished v2-bound after a 2026-08-05 mainnet probe: the ORIGINAL
+ *     package `0x7b502c…` now aborts `EDifferentVersion` (`state::current_cap`)
+ *     for any payload — the shared `State` has been migrated past that code —
+ *     and its v1 entry aborts `EInvalidChannel` on `fixed_rate@1000ms`, the only
+ *     channel WaterX's Pyth Pro grant permits.
+ *   - **testnet** — still the original v1 publish, which has no `update_v2`
+ *     module at all, so the v1 entry is the only one that exists there.
+ *   Both entries take `(state, clock, bytes)` and accept the same `leEcdsa`
+ *   payload. Values mirror the contract repo's `pyth_lazer_rule/Move.toml`
+ *   published-at pins.
  */
 exports.LAZER_INFRA = {
     MAINNET: {
         endpoint: "https://pyth-lazer.dourolabs.app",
         verifier_package: "0xefbfd064480777699fd9c557a5804d72ace7bc82661fdc8d1f1a44ea6d92ee10",
+        verify_entry: "parse_and_verify_le_ecdsa_update_v2",
+        channel: "fixed_rate@1000ms",
     },
     TESTNET: {
         endpoint: "https://pyth-lazer.dourolabs.app",
         verifier_package: "0xf5bd2141967507050a91b58de3d95e77c432cd90d1799ee46effc27430a68c21",
+        verify_entry: "parse_and_verify_le_ecdsa_update",
+        channel: "fixed_rate@200ms",
     },
 };
 /**
@@ -55,9 +70,15 @@ exports.LAZER_INFRA = {
  *   and every xStock — are `min_channel: fixed_rate@200ms` (Lazer symbol
  *   registry, verified 2026-07-22: the same 29-feed batch 400s at
  *   `real_time`/`50ms` and serves 200 with the leEcdsa blob at `200ms`).
- *   200ms is the fastest channel every configured feed supports, and the
- *   deployed rule accepts it: the v1 on-chain `channel::from_u8` aborts only
- *   on the 1000ms fixed-rate channel (real_time / 50ms / 200ms are safe).
+ *   The channel is therefore per-network (`LAZER_INFRA[network].channel`), and
+ *   it is bounded from BOTH sides — by what the feeds publish and by what the
+ *   grant allows:
+ *   - **mainnet: `fixed_rate@1000ms`.** WaterX's Pyth Pro grant no longer
+ *     permits anything faster ("Channel fixed_rate@200ms violates rate limit.
+ *     Minimum allowed channel is 1000ms", measured 2026-08-05), and the
+ *     mainnet rule is v2-bound, so it accepts that channel.
+ *   - **testnet: `fixed_rate@200ms`.** Its rule is still v1-bound, and the v1
+ *     on-chain `channel::from_u8` aborts on the 1000ms channel.
  * - `formats: leEcdsa` + `jsonBinaryEncoding: hex` — the Sui verifier takes
  *   the `leEcdsa` framing; hex matches `fromHex` below.
  */
@@ -65,7 +86,6 @@ const LAZER_LATEST_PRICE_REQUEST = {
     properties: ["price", "exponent", "confidence"],
     formats: ["leEcdsa"],
     jsonBinaryEncoding: "hex",
-    channel: "fixed_rate@200ms",
 };
 /**
  * Shape check ONLY — the `kind` discriminant is checked separately by the
@@ -108,7 +128,7 @@ function requireLazerPackage(host) {
  * retry/timeout/Bearer policy as `fetchPriceFeedsUpdateData`, unified so
  * both oracle sources fail the same way under upstream degradation.
  */
-async function fetchLazerSignedUpdate(endpoint, apiKey, feedIds, fetchOpts) {
+async function fetchLazerSignedUpdate(endpoint, channel, apiKey, feedIds, fetchOpts) {
     // joinEndpointPath preserves any base path on the endpoint — the same
     // leading-slash `new URL` footgun that 404'd every feed on the Pyth Pro
     // Hermes endpoint (see update-fetch.ts). Defensive here: the default
@@ -119,7 +139,7 @@ async function fetchLazerSignedUpdate(endpoint, apiKey, feedIds, fetchOpts) {
         res = await (0, update_fetch_ts_1.fetchWithPolicy)(url.toString(), {
             method: "POST",
             headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({ priceFeedIds: feedIds, ...LAZER_LATEST_PRICE_REQUEST }),
+            body: JSON.stringify({ priceFeedIds: feedIds, ...LAZER_LATEST_PRICE_REQUEST, channel }),
         }, { apiKey, ...fetchOpts });
     }
     catch (err) {
@@ -167,7 +187,9 @@ exports.PythLazerRule = {
         // not fail per ticker as if only that feed were missing.
         const { feeds } = requireLazerPackage(host);
         const feedIds = tickers.map((ticker) => {
-            const feedId = feeds[ticker];
+            // ownEntry: a prototype-key ticker ("toString") must throw here as
+            // unlisted, not turn an inherited Function into a "feed id".
+            const feedId = (0, record_ts_1.ownEntry)(feeds, ticker);
             if (feedId === undefined) {
                 throw new Error(`No pyth_lazer_rule feed listed for ticker: ${ticker}`);
             }
@@ -177,13 +199,13 @@ exports.PythLazerRule = {
         if (!apiKey) {
             throw new LazerApiKeyMissingError();
         }
-        const update = await fetchLazerSignedUpdate(exports.LAZER_INFRA[host.network].endpoint, apiKey, feedIds, host.pyth.fetch);
+        const update = await fetchLazerSignedUpdate(exports.LAZER_INFRA[host.network].endpoint, exports.LAZER_INFRA[host.network].channel, apiKey, feedIds, host.pyth.fetch);
         return { kind: "pyth_lazer_rule", payload: { update, feedIds } };
     },
     /**
      * A Lazer payload is ONE signed `leEcdsa` message covering every feed it was
      * fetched for — verification is a single flat signature check over the whole
-     * message (`parse_and_verify_le_ecdsa_update`, no per-feed cost), so the
+     * message (one `parse_and_verify_le_ecdsa_update*` call, no per-feed cost), so the
      * payload is indivisible: it can only be served whole. Returns the whole
      * payload iff every requested ticker's integer feed id is packed in THIS
      * payload's `feedIds`; any coverage gap (unlisted ticker, or a feed this
@@ -195,26 +217,31 @@ exports.PythLazerRule = {
             return null;
         const packedFeedIds = new Set(payload.feedIds);
         for (const ticker of tickers) {
-            const feedId = host.config.packages.pyth_lazer_rule?.feeds?.[ticker];
+            const feedId = (0, record_ts_1.ownEntry)(host.config.packages.pyth_lazer_rule?.feeds, ticker);
             if (feedId === undefined || !packedFeedIds.has(feedId))
                 return null;
         }
         return { kind: "pyth_lazer_rule", payload };
     },
     /**
-     * Appends the single `parse_and_verify_le_ecdsa_update(state, clock, bytes)`
+     * Appends the single `parse_and_verify_le_ecdsa_update*(state, clock, bytes)`
      * call — one secp256k1 signature check covering every feed in the payload —
      * and returns its `Update` result as the handle the per-ticker feed leg
      * consumes. `opts.cache` / `opts.feeSource` are Pyth-Core-specific and
      * ignored (Lazer verification charges no update fee).
+     *
+     * The entry name comes from `LAZER_INFRA[network].verify_entry`: mainnet's
+     * rule binds `update_v2`, testnet's is still the v1 publish. Both take
+     * `(state, clock, bytes)` and accept the same `leEcdsa` payload.
      */
     buildUpdateCalls(tx, host, data, _opts) {
         const payload = (0, price_update_rule_ts_1.assertRuleUpdateData)(data, "pyth_lazer_rule", isPythLazerUpdatePayloadShape, "{ update: Uint8Array; feedIds: number[] }");
         if (!payload)
             return undefined;
         const lazer = requireLazerPackage(host);
+        const infra = exports.LAZER_INFRA[host.network];
         const [update] = tx.moveCall({
-            target: `${exports.LAZER_INFRA[host.network].verifier_package}::pyth_lazer::parse_and_verify_le_ecdsa_update`,
+            target: `${infra.verifier_package}::pyth_lazer::${infra.verify_entry}`,
             arguments: [tx.object(lazer.state), tx.object.clock(), tx.pure.vector("u8", payload.update)],
         });
         return { kind: "pyth_lazer_rule", update };

package/dist/cjs/src/oracle/rules/waterx-rule.js

@@ -31,6 +31,7 @@ exports.waterxEnvelopeOf = waterxEnvelopeOf;
 exports.feedWaterxRule = feedWaterxRule;
 const bcs_1 = require("@mysten/bcs");
 const waterx_rule_ts_1 = require("../../generated/waterx_rule/waterx_rule.js");
+const record_ts_1 = require("../../utils/record.js");
 const price_update_rule_ts_1 = require("../price-update-rule.js");
 const update_fetch_ts_1 = require("../update-fetch.js");
 /** The single signing intent the quote-center emits — exported so read-plane
@@ -267,7 +268,9 @@ exports.WaterxRule = {
         // not fail per ticker as if only that feed were missing.
         const { feeds } = requireWaterxPackage(host);
         for (const ticker of tickers) {
-            if (feeds[ticker] === undefined) {
+            // ownEntry: a prototype-key ticker ("toString") must throw here as
+            // unlisted, not pass as an inherited Function and reach the network.
+            if ((0, record_ts_1.ownEntry)(feeds, ticker) === undefined) {
                 throw new Error(`No waterx_rule feed listed for ticker: ${ticker}`);
             }
         }

package/dist/cjs/src/oracle/source-list.d.ts

@@ -0,0 +1,36 @@
+/**
+ * `source-list.ts` — THE parser for a consumer's `ORACLE_SOURCE` env string
+ * (comma list of `OracleSource` values → the fed set). The FE and BE
+ * previously carried twin hand-written parsers whose semantics drifted once
+ * in review (a trailing comma booted one deployment green and 500'd the
+ * other); this canonical behavior is what both fold onto:
+ *
+ *  - split on `,`, trim entries, DROP empties (trailing/doubled commas are
+ *    the most common env typo, never a boot failure)
+ *  - validate every entry against {@link ORACLE_SOURCES}
+ *  - dedupe, order-preserving (list order is consumer read-plane policy —
+ *    the SDK's own fed-set build treats the list as a set)
+ *  - throw an operator-actionable error on empty/unset/invalid input —
+ *    there is NO default oracle source
+ *
+ * The SDK still never reads `process.env` — callers pass the raw string.
+ *
+ * STRICTER than the consumers' previous `in`-operator checks: a value named
+ * like an `Object.prototype` key (`toString`, `constructor`, …) passed those
+ * and died deep in the stack; `Set.has` rejects it here at parse.
+ *
+ * Zod adopters: this THROWS a plain Error. Inside a zod `.transform()` a
+ * throw escapes `schema.parse()` un-aggregated and masks sibling issues —
+ * wrap it: `try { return parseOracleSourceList(raw); } catch (e) {
+ * ctx.addIssue({ code: "custom", message: (e as Error).message }); return
+ * z.NEVER; }`.
+ */
+import { type OracleSource } from "./price-update-rule.ts";
+/**
+ * THE runtime membership check for {@link ORACLE_SOURCES} — the parser below
+ * and `PerpClient`'s ctor validation both use this one predicate, so the env
+ * parser and the create-option front door can never disagree. `Set.has`,
+ * never `in`/bracket reads (prototype-chain safe by construction).
+ */
+export declare function isOracleSource(value: string): value is OracleSource;
+export declare function parseOracleSourceList(raw: string | null | undefined): OracleSource[];