@waterx/sdk 4.3.2 → 4.3.3

package/dist/cjs/src/generated/waterx_rule/waterx_rule.d.ts

@@ -70,6 +70,11 @@ export declare const BatchPricePayload: MoveStruct<{
         length: number;
     }, string>;
 }, "@waterx/rule::waterx_rule::BatchPricePayload">;
+export declare const MerkleRoot: MoveStruct<{
+    root: import("@mysten/sui/bcs").BcsType<number[], Iterable<number> & {
+        length: number;
+    }, string>;
+}, "@waterx/rule::waterx_rule::MerkleRoot">;
 export declare const FeedConfig: MoveStruct<{
     ticker: import("@mysten/sui/bcs").BcsType<string, string, "string">;
     sources: import("@mysten/sui/bcs").BcsType<string[], Iterable<string | number | bigint> & {
@@ -214,17 +219,82 @@ export interface CollectBatchLatestOptions {
  * and so aborts on any stale item, this path runs alongside Pyth/Supra. To let
  * those cover a lagging TEE — the blast-radius bound in the GCP ADR — a
  * _freshness_ miss ABSTAINS (records `none`, which `aggregator::remove_outliers`
- * drops before the `weight_threshold` fail-closed check). A _config/integrity_
- * mismatch (source / ticker / method / confidence / deviation) still ABORTS: an
- * enclave whose signed payload disagrees with the on-chain feed config is a red
- * flag, not a liveness blip. Bad signature, malformed batch, a future timestamp,
- * and replay always abort.
+ * drops before the `weight_threshold` fail-closed check), and so does a _replayed_
+ * signed timestamp (the chain already accepted that snapshot — the on-chain price
+ * is at least as fresh, and two concurrent keeper PTBs sharing one envelope must
+ * not kill each other). A _config/integrity_ mismatch (source / ticker / method /
+ * confidence / deviation) still ABORTS: an enclave whose signed payload disagrees
+ * with the on-chain feed config is a red flag, not a liveness blip. Bad signature,
+ * malformed batch, and a future timestamp always abort.
  *
  * Every gate is identical to `feed_batch_item_latest`; only the abort-vs-abstain
- * disposition of the two freshness gates differs, and the sink is the caller's
- * collector rather than a fresh single-rule one.
+ * disposition of the freshness + replay gates differs, and the sink is the
+ * caller's collector rather than a fresh single-rule one.
  */
 export declare function collectBatchLatest(options: CollectBatchLatestOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
+export interface FeedSingleWithProofArguments {
+    oracleObj: RawTransactionArgument<string>;
+    config: RawTransactionArgument<string>;
+    enclaveConfig: RawTransactionArgument<string>;
+    enclave: RawTransactionArgument<string>;
+    timestampMs: RawTransactionArgument<number | bigint>;
+    item: TransactionArgument;
+    proof: RawTransactionArgument<Array<Array<number>>>;
+    sig: RawTransactionArgument<Array<number>>;
+}
+export interface FeedSingleWithProofOptions {
+    package?: string;
+    arguments: FeedSingleWithProofArguments | [
+        oracleObj: RawTransactionArgument<string>,
+        config: RawTransactionArgument<string>,
+        enclaveConfig: RawTransactionArgument<string>,
+        enclave: RawTransactionArgument<string>,
+        timestampMs: RawTransactionArgument<number | bigint>,
+        item: TransactionArgument,
+        proof: RawTransactionArgument<Array<Array<number>>>,
+        sig: RawTransactionArgument<Array<number>>
+    ];
+}
+/**
+ * Streaming per-symbol sibling of `feed_batch_latest`. Verifies ONE enclave
+ * signature over a Merkle `root`, checks `item` is a leaf of that root via
+ * `proof`, then runs the identical per-item gates + `oracle::aggregate`. Use for a
+ * WaterxRule-only aggregator; for a Pyth-coexisting aggregator use
+ * `collect_single_with_proof`.
+ */
+export declare function feedSingleWithProof(options: FeedSingleWithProofOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
+export interface CollectSingleWithProofArguments {
+    collector: TransactionArgument;
+    config: RawTransactionArgument<string>;
+    enclaveConfig: RawTransactionArgument<string>;
+    enclave: RawTransactionArgument<string>;
+    timestampMs: RawTransactionArgument<number | bigint>;
+    item: TransactionArgument;
+    proof: RawTransactionArgument<Array<Array<number>>>;
+    sig: RawTransactionArgument<Array<number>>;
+}
+export interface CollectSingleWithProofOptions {
+    package?: string;
+    arguments: CollectSingleWithProofArguments | [
+        collector: TransactionArgument,
+        config: RawTransactionArgument<string>,
+        enclaveConfig: RawTransactionArgument<string>,
+        enclave: RawTransactionArgument<string>,
+        timestampMs: RawTransactionArgument<number | bigint>,
+        item: TransactionArgument,
+        proof: RawTransactionArgument<Array<Array<number>>>,
+        sig: RawTransactionArgument<Array<number>>
+    ];
+}
+/**
+ * Collect-only sibling of `feed_single_with_proof` for the dual-rule latest path
+ * (WaterX alongside Pyth on one aggregator), mirroring `collect_batch_latest`:
+ * verifies root + proof, feeds the leaf into the caller's `PriceCollector` WITHOUT
+ * calling `oracle::aggregate`. Abort vs abstain matches `collect_batch_latest`
+ * exactly — a config/integrity mismatch aborts, a freshness miss abstains so Pyth
+ * can cover a lagging TEE.
+ */
+export declare function collectSingleWithProof(options: CollectSingleWithProofOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
 export interface QuoteForTimestampArguments {
     config: RawTransactionArgument<string>;
     enclaveConfig: RawTransactionArgument<string>;
@@ -421,6 +491,27 @@ export interface BatchPriceIntentOptions {
     ];
 }
 export declare function batchPriceIntent(options?: BatchPriceIntentOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
+export interface MerkleRootIntentOptions {
+    package?: string;
+    arguments?: [
+    ];
+}
+export declare function merkleRootIntent(options?: MerkleRootIntentOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
+export interface LeafHashOfArguments {
+    item: TransactionArgument;
+}
+export interface LeafHashOfOptions {
+    package?: string;
+    arguments: LeafHashOfArguments | [
+        item: TransactionArgument
+    ];
+}
+/**
+ * The keccak256 leaf hash for `item` — `keccak256(0x00 || BCS(item))`. Exposed so
+ * the off-chain builder / SDK can be pinned against the on-chain encoding in a
+ * cross-implementation golden test.
+ */
+export declare function leafHashOf(options: LeafHashOfOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
 export interface MaxBatchSizeOptions {
     package?: string;
     arguments?: [
@@ -717,6 +808,48 @@ export interface SourceGataUsdtPerpWsOptions {
     ];
 }
 export declare function sourceGataUsdtPerpWs(options?: SourceGataUsdtPerpWsOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
+export interface SourceBybitSpotWsOptions {
+    package?: string;
+    arguments?: [
+    ];
+}
+export declare function sourceBybitSpotWs(options?: SourceBybitSpotWsOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
+export interface SourceXstockEquityRestOptions {
+    package?: string;
+    arguments?: [
+    ];
+}
+export declare function sourceXstockEquityRest(options?: SourceXstockEquityRestOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
+export interface SourceOkxSpotWsOptions {
+    package?: string;
+    arguments?: [
+    ];
+}
+export declare function sourceOkxSpotWs(options?: SourceOkxSpotWsOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
+export interface SourceHyperliquidPerpWsOptions {
+    package?: string;
+    arguments?: [
+    ];
+}
+export declare function sourceHyperliquidPerpWs(options?: SourceHyperliquidPerpWsOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
+export interface SourceGateioSpotWsOptions {
+    package?: string;
+    arguments?: [
+    ];
+}
+export declare function sourceGateioSpotWs(options?: SourceGateioSpotWsOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
+export interface SourceKrakenSpotWsOptions {
+    package?: string;
+    arguments?: [
+    ];
+}
+export declare function sourceKrakenSpotWs(options?: SourceKrakenSpotWsOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
+export interface SourcePythLazerWsOptions {
+    package?: string;
+    arguments?: [
+    ];
+}
+export declare function sourcePythLazerWs(options?: SourcePythLazerWsOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
 export interface MethodDirectOptions {
     package?: string;
     arguments?: [

package/dist/cjs/src/generated/waterx_rule/waterx_rule.js

@@ -36,9 +36,11 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.BatchLatestUpdated = exports.HistoricalPriceVerified = exports.SignedTsHwmKey = exports.Config = exports.VerifiedPrice = exports.FeedConfig = exports.BatchPricePayload = exports.BatchPriceItem = exports.PricePayload = exports.WaterxRule = exports.WATERX_RULE = void 0;
+exports.BatchLatestUpdated = exports.HistoricalPriceVerified = exports.SignedTsHwmKey = exports.Config = exports.VerifiedPrice = exports.FeedConfig = exports.MerkleRoot = exports.BatchPricePayload = exports.BatchPriceItem = exports.PricePayload = exports.WaterxRule = exports.WATERX_RULE = void 0;
 exports.feedBatchLatest = feedBatchLatest;
 exports.collectBatchLatest = collectBatchLatest;
+exports.feedSingleWithProof = feedSingleWithProof;
+exports.collectSingleWithProof = collectSingleWithProof;
 exports.quoteForTimestamp = quoteForTimestamp;
 exports.destroyVerifiedPrice = destroyVerifiedPrice;
 exports.collectVerifiedPrice = collectVerifiedPrice;
@@ -50,6 +52,8 @@ exports.newBatchItem = newBatchItem;
 exports.pushBatchItem = pushBatchItem;
 exports.feedConfig = feedConfig;
 exports.batchPriceIntent = batchPriceIntent;
+exports.merkleRootIntent = merkleRootIntent;
+exports.leafHashOf = leafHashOf;
 exports.maxBatchSize = maxBatchSize;
 exports.batchItems = batchItems;
 exports.batchItemSymbol = batchItemSymbol;
@@ -82,6 +86,13 @@ exports.sourceBinanceUsdmPerpWs = sourceBinanceUsdmPerpWs;
 exports.sourceBybitLinearPerpWs = sourceBybitLinearPerpWs;
 exports.sourceGateioUsdtPerpWs = sourceGateioUsdtPerpWs;
 exports.sourceGataUsdtPerpWs = sourceGataUsdtPerpWs;
+exports.sourceBybitSpotWs = sourceBybitSpotWs;
+exports.sourceXstockEquityRest = sourceXstockEquityRest;
+exports.sourceOkxSpotWs = sourceOkxSpotWs;
+exports.sourceHyperliquidPerpWs = sourceHyperliquidPerpWs;
+exports.sourceGateioSpotWs = sourceGateioSpotWs;
+exports.sourceKrakenSpotWs = sourceKrakenSpotWs;
+exports.sourcePythLazerWs = sourcePythLazerWs;
 exports.methodDirect = methodDirect;
 exports.methodMedian = methodMedian;
 exports.methodConfidence = methodConfidence;
@@ -132,6 +143,9 @@ exports.BatchPriceItem = new index_ts_1.MoveStruct({ name: `${$moduleName}::Batc
 exports.BatchPricePayload = new index_ts_1.MoveStruct({ name: `${$moduleName}::BatchPricePayload`, fields: {
         items: bcs_1.bcs.vector(exports.BatchPriceItem)
     } });
+exports.MerkleRoot = new index_ts_1.MoveStruct({ name: `${$moduleName}::MerkleRoot`, fields: {
+        root: bcs_1.bcs.vector(bcs_1.bcs.u8())
+    } });
 exports.FeedConfig = new index_ts_1.MoveStruct({ name: `${$moduleName}::FeedConfig`, fields: {
         ticker: bcs_1.bcs.string(),
         sources: bcs_1.bcs.vector(bcs_1.bcs.u64()),
@@ -217,15 +231,17 @@ function feedBatchLatest(options) {
  * and so aborts on any stale item, this path runs alongside Pyth/Supra. To let
  * those cover a lagging TEE — the blast-radius bound in the GCP ADR — a
  * _freshness_ miss ABSTAINS (records `none`, which `aggregator::remove_outliers`
- * drops before the `weight_threshold` fail-closed check). A _config/integrity_
- * mismatch (source / ticker / method / confidence / deviation) still ABORTS: an
- * enclave whose signed payload disagrees with the on-chain feed config is a red
- * flag, not a liveness blip. Bad signature, malformed batch, a future timestamp,
- * and replay always abort.
+ * drops before the `weight_threshold` fail-closed check), and so does a _replayed_
+ * signed timestamp (the chain already accepted that snapshot — the on-chain price
+ * is at least as fresh, and two concurrent keeper PTBs sharing one envelope must
+ * not kill each other). A _config/integrity_ mismatch (source / ticker / method /
+ * confidence / deviation) still ABORTS: an enclave whose signed payload disagrees
+ * with the on-chain feed config is a red flag, not a liveness blip. Bad signature,
+ * malformed batch, and a future timestamp always abort.
  *
  * Every gate is identical to `feed_batch_item_latest`; only the abort-vs-abstain
- * disposition of the two freshness gates differs, and the sink is the caller's
- * collector rather than a fresh single-rule one.
+ * disposition of the freshness + replay gates differs, and the sink is the
+ * caller's collector rather than a fresh single-rule one.
  */
 function collectBatchLatest(options) {
     const packageAddress = options.package ?? '@waterx/rule';
@@ -247,6 +263,63 @@ function collectBatchLatest(options) {
         arguments: (0, index_ts_1.normalizeMoveArguments)(options.arguments, argumentsTypes, parameterNames),
     });
 }
+/**
+ * Streaming per-symbol sibling of `feed_batch_latest`. Verifies ONE enclave
+ * signature over a Merkle `root`, checks `item` is a leaf of that root via
+ * `proof`, then runs the identical per-item gates + `oracle::aggregate`. Use for a
+ * WaterxRule-only aggregator; for a Pyth-coexisting aggregator use
+ * `collect_single_with_proof`.
+ */
+function feedSingleWithProof(options) {
+    const packageAddress = options.package ?? '@waterx/rule';
+    const argumentsTypes = [
+        null,
+        null,
+        '0x2::clock::Clock',
+        null,
+        null,
+        'u64',
+        null,
+        'vector<vector<u8>>',
+        'vector<u8>'
+    ];
+    const parameterNames = ["oracleObj", "config", "enclaveConfig", "enclave", "timestampMs", "item", "proof", "sig"];
+    return (tx) => tx.moveCall({
+        package: packageAddress,
+        module: 'waterx_rule',
+        function: 'feed_single_with_proof',
+        arguments: (0, index_ts_1.normalizeMoveArguments)(options.arguments, argumentsTypes, parameterNames),
+    });
+}
+/**
+ * Collect-only sibling of `feed_single_with_proof` for the dual-rule latest path
+ * (WaterX alongside Pyth on one aggregator), mirroring `collect_batch_latest`:
+ * verifies root + proof, feeds the leaf into the caller's `PriceCollector` WITHOUT
+ * calling `oracle::aggregate`. Abort vs abstain matches `collect_batch_latest`
+ * exactly — a config/integrity mismatch aborts, a freshness miss abstains so Pyth
+ * can cover a lagging TEE.
+ */
+function collectSingleWithProof(options) {
+    const packageAddress = options.package ?? '@waterx/rule';
+    const argumentsTypes = [
+        null,
+        null,
+        '0x2::clock::Clock',
+        null,
+        null,
+        'u64',
+        null,
+        'vector<vector<u8>>',
+        'vector<u8>'
+    ];
+    const parameterNames = ["collector", "config", "enclaveConfig", "enclave", "timestampMs", "item", "proof", "sig"];
+    return (tx) => tx.moveCall({
+        package: packageAddress,
+        module: 'waterx_rule',
+        function: 'collect_single_with_proof',
+        arguments: (0, index_ts_1.normalizeMoveArguments)(options.arguments, argumentsTypes, parameterNames),
+    });
+}
 /**
  * Verifies a historical quote without touching `waterx_oracle`.
  *
@@ -438,6 +511,32 @@ function batchPriceIntent(options = {}) {
         function: 'batch_price_intent',
     });
 }
+function merkleRootIntent(options = {}) {
+    const packageAddress = options.package ?? '@waterx/rule';
+    return (tx) => tx.moveCall({
+        package: packageAddress,
+        module: 'waterx_rule',
+        function: 'merkle_root_intent',
+    });
+}
+/**
+ * The keccak256 leaf hash for `item` — `keccak256(0x00 || BCS(item))`. Exposed so
+ * the off-chain builder / SDK can be pinned against the on-chain encoding in a
+ * cross-implementation golden test.
+ */
+function leafHashOf(options) {
+    const packageAddress = options.package ?? '@waterx/rule';
+    const argumentsTypes = [
+        null
+    ];
+    const parameterNames = ["item"];
+    return (tx) => tx.moveCall({
+        package: packageAddress,
+        module: 'waterx_rule',
+        function: 'leaf_hash_of',
+        arguments: (0, index_ts_1.normalizeMoveArguments)(options.arguments, argumentsTypes, parameterNames),
+    });
+}
 function maxBatchSize(options = {}) {
     const packageAddress = options.package ?? '@waterx/rule';
     return (tx) => tx.moveCall({
@@ -824,6 +923,62 @@ function sourceGataUsdtPerpWs(options = {}) {
         function: 'source_gata_usdt_perp_ws',
     });
 }
+function sourceBybitSpotWs(options = {}) {
+    const packageAddress = options.package ?? '@waterx/rule';
+    return (tx) => tx.moveCall({
+        package: packageAddress,
+        module: 'waterx_rule',
+        function: 'source_bybit_spot_ws',
+    });
+}
+function sourceXstockEquityRest(options = {}) {
+    const packageAddress = options.package ?? '@waterx/rule';
+    return (tx) => tx.moveCall({
+        package: packageAddress,
+        module: 'waterx_rule',
+        function: 'source_xstock_equity_rest',
+    });
+}
+function sourceOkxSpotWs(options = {}) {
+    const packageAddress = options.package ?? '@waterx/rule';
+    return (tx) => tx.moveCall({
+        package: packageAddress,
+        module: 'waterx_rule',
+        function: 'source_okx_spot_ws',
+    });
+}
+function sourceHyperliquidPerpWs(options = {}) {
+    const packageAddress = options.package ?? '@waterx/rule';
+    return (tx) => tx.moveCall({
+        package: packageAddress,
+        module: 'waterx_rule',
+        function: 'source_hyperliquid_perp_ws',
+    });
+}
+function sourceGateioSpotWs(options = {}) {
+    const packageAddress = options.package ?? '@waterx/rule';
+    return (tx) => tx.moveCall({
+        package: packageAddress,
+        module: 'waterx_rule',
+        function: 'source_gateio_spot_ws',
+    });
+}
+function sourceKrakenSpotWs(options = {}) {
+    const packageAddress = options.package ?? '@waterx/rule';
+    return (tx) => tx.moveCall({
+        package: packageAddress,
+        module: 'waterx_rule',
+        function: 'source_kraken_spot_ws',
+    });
+}
+function sourcePythLazerWs(options = {}) {
+    const packageAddress = options.package ?? '@waterx/rule';
+    return (tx) => tx.moveCall({
+        package: packageAddress,
+        module: 'waterx_rule',
+        function: 'source_pyth_lazer_ws',
+    });
+}
 function methodDirect(options = {}) {
     const packageAddress = options.package ?? '@waterx/rule';
     return (tx) => tx.moveCall({

package/dist/cjs/src/oracle/aggregate.d.ts

@@ -26,7 +26,7 @@ import type { Transaction, TransactionArgument } from "@mysten/sui/transactions"
 import type { OracleHost } from "./host.ts";
 import type { OracleSource, PriceUpdateRule, UpdateDataProvider } from "./price-update-rule.ts";
 import { type OracleFeeSource, type PythCache } from "./pyth.ts";
-import { type WaterxSignedEnvelope } from "./rules/waterx-rule.ts";
+import { type WaterxSignedEnvelope, type WaterxSignedLeaf } from "./rules/waterx-rule.ts";
 /**
  * Aggregate one ticker's price into the shared `Oracle`: build a collector, feed
  * every rule the ticker is configured for, then `aggregate`.
@@ -57,6 +57,9 @@ export declare function aggregateTicker(tx: Transaction, host: OracleHost, args:
     ticker: string;
     priceInfoObjectId?: string;
     lazerUpdate?: TransactionArgument;
+    /** This ticker's signed Merkle leaf — the default waterx shape. */
+    waterxLeaf?: WaterxSignedLeaf;
+    /** Batch envelope covering this ticker — the fallback waterx shape. */
     waterxEnvelope?: WaterxSignedEnvelope;
 }): void;
 /**

package/dist/cjs/src/oracle/aggregate.js

@@ -120,17 +120,25 @@ function aggregateTicker(tx, host, args) {
         (0, pyth_lazer_rule_ts_1.feedLazerRule)(tx, host, collector, args.lazerUpdate);
         fed = true;
     }
-    if (args.waterxEnvelope !== undefined) {
-        // waterx_rule::collect_batch_latest verifies the batch signature and feeds
-        // this collector's symbol from the batch. If the ticker's aggregator does
-        // not (yet) weight `WaterxRule`, the contribution is silently dropped
-        // on-chain — feeding ahead of the weight migration is safe for THIS tx.
-        // CAVEAT (unlike lazer): the feed call records a per-symbol signed-
-        // timestamp high-water mark REGARDLESS of weights, and a replayed
-        // timestamp ABORTS (`EReplayedSignature`, audit F-014) — so two PTBs
-        // carrying the same envelope for the same symbol cannot both land; the
-        // second aborts even where waterx is unweighted. See WaterxRule's module
-        // header.
+    // One waterx leg at most, and the leaf shape wins: both entries record the
+    // same per-symbol signed-timestamp high-water mark and feed the same rule
+    // witness into this collector, so emitting both would make the second one
+    // abstain on its own predecessor's mark for no gain. `refreshOraclePrices`
+    // only ever supplies one; a caller that passes both gets the cheaper leg.
+    if (args.waterxLeaf !== undefined) {
+        // waterx_rule::collect_single_with_proof re-derives the snapshot root from
+        // this leaf + its proof, verifies the enclave signature over that root, and
+        // feeds the price. If the ticker's aggregator does not (yet) weight
+        // `WaterxRule`, the contribution is silently dropped on-chain — feeding
+        // ahead of the weight migration is safe. See WaterxRule's module header for
+        // the abort-vs-abstain split.
+        (0, waterx_rule_ts_1.feedWaterxRuleWithProof)(tx, host, collector, args.waterxLeaf);
+        fed = true;
+    }
+    else if (args.waterxEnvelope !== undefined) {
+        // Fallback shape: collect_batch_latest re-verifies the WHOLE batch
+        // signature (every item rebuilt in-PTB) and feeds this collector's symbol
+        // out of it. Only reached against a quote-center with no leaf route.
         (0, waterx_rule_ts_1.feedWaterxRule)(tx, host, collector, args.waterxEnvelope);
         fed = true;
     }
@@ -223,11 +231,11 @@ async function refreshOraclePrices(tx, host, tickers, opts = {}) {
     if (tickers.length === 0)
         return;
     // Dedupe the caller's list (order-preserving): a repeated ticker would
-    // otherwise aggregate TWICE in this one PTB — wasted gas for every rule,
-    // and a hard ABORT under waterx: the second `collect_batch_latest` carries
-    // the same envelope, and the on-chain per-symbol replay guard rejects an
-    // already-accepted signed timestamp (`EReplayedSignature`, F-014) even
-    // inside a single transaction.
+    // otherwise aggregate TWICE in this one PTB — wasted gas for every rule, and
+    // under waterx the second collect would be dead weight on top of that: the
+    // on-chain per-symbol replay guard (F-014) sees its own predecessor's
+    // high-water mark from earlier in this same transaction and abstains, so the
+    // repeat pays full verification cost to contribute nothing.
     tickers = [...new Set(tickers)];
     // price_info_object lookup for every ticker with a pyth_rule.feeds entry —
     // needed by aggregateTicker's (unchanged) Pyth feed step below regardless of
@@ -298,10 +306,12 @@ async function refreshOraclePrices(tx, host, tickers, opts = {}) {
     // leg needs per-ticker data from its update leg must decide its carry here
     // — falling through silently would starve its weighted tickers on-chain.
     const lazerUpdateByTicker = new Map();
-    // Signed batch envelope per waterx-served ticker. Unlike Lazer's shared PTB
-    // handle, waterx's verify+feed is bundled into `collect_batch_latest` in the
-    // per-ticker feed leg, so its `buildUpdateCalls` emits nothing and the
-    // envelope is carried straight from the group's fetched data.
+    // Signed waterx data per served ticker — a per-symbol Merkle leaf normally, a
+    // shared batch envelope on the fallback shape. Unlike Lazer's shared PTB
+    // handle, waterx's verify+feed is bundled into the per-ticker collect call, so
+    // its `buildUpdateCalls` emits nothing and the signed data is carried straight
+    // from the group's fetched data.
+    const waterxLeafByTicker = new Map();
     const waterxEnvelopeByTicker = new Map();
     for (const [i, group] of groups.entries()) {
         const data = dataByGroup[i] ?? null;
@@ -325,12 +335,45 @@ async function refreshOraclePrices(tx, host, tickers, opts = {}) {
                 break;
             case "waterx_rule": {
                 // waterx_rule emits no shared handle (verify+feed is bundled into the
-                // per-ticker `collect_batch_latest`), so the envelope is carried
-                // straight from this group's fetched data to the feed leg below.
-                const envelope = (0, waterx_rule_ts_1.waterxEnvelopeOf)(data);
-                if (envelope) {
-                    for (const ticker of group.tickers)
-                        waterxEnvelopeByTicker.set(ticker, envelope);
+                // per-ticker collect call), so the signed data is carried straight from
+                // this group's fetched data to the feed leg below. Leaves are per-symbol
+                // and indexed BY symbol — never fanned out across the group like the
+                // envelope, since each leaf only verifies for its own symbol
+                // (`ECollectorSymbolMismatch`). A leaf for a symbol outside this group is
+                // dropped rather than carried: the feed leg is keyed by ticker anyway.
+                const leaves = (0, waterx_rule_ts_1.waterxLeavesOf)(data);
+                // `length > 0` matters: `{ leaves: [] }` is shape-valid (`[].every(...)`
+                // is `true`), so a bare truthiness test would TAKE this branch, carry
+                // nothing, and `break` past the envelope branch below.
+                if (leaves && leaves.length > 0) {
+                    const served = new Set(group.tickers);
+                    for (const leaf of leaves) {
+                        if (served.has(leaf.symbol))
+                            waterxLeafByTicker.set(leaf.symbol, leaf);
+                    }
+                }
+                else {
+                    const envelope = (0, waterx_rule_ts_1.waterxEnvelopeOf)(data);
+                    if (envelope) {
+                        for (const ticker of group.tickers)
+                            waterxEnvelopeByTicker.set(ticker, envelope);
+                    }
+                }
+                // Fail the BUILD, not the chain. Both suppliers of `data` already
+                // guarantee full coverage — the live fetch through `assertCoverage`, a
+                // cached payload through `narrowUpdateData` (which returns `null`, i.e.
+                // "miss → live fetch", rather than a partial) — so reaching here with a
+                // ticker uncarried means one of those invariants broke. Left alone it
+                // emits a collector with no waterx leg, which surfaces MUCH later as an
+                // opaque on-chain `EMissingPriceSource` (or, if the rule is unweighted
+                // for that ticker, as a silently thinner weighted set). This names the
+                // tickers instead.
+                const uncarried = group.tickers.filter((t) => !waterxLeafByTicker.has(t) && !waterxEnvelopeByTicker.has(t));
+                if (uncarried.length > 0) {
+                    throw new Error(`waterx_rule update data carries no signed price for ticker(s): ${uncarried.join(", ")}. ` +
+                        "Expected one signed leaf per ticker (or a batch envelope covering all of " +
+                        "them) — a payload that serves none of a group's tickers must be reported " +
+                        "as a miss, not fed.");
                 }
                 break;
             }
@@ -346,6 +389,7 @@ async function refreshOraclePrices(tx, host, tickers, opts = {}) {
             ticker,
             priceInfoObjectId: priceInfoByTicker.get(ticker),
             lazerUpdate: lazerUpdateByTicker.get(ticker),
+            waterxLeaf: waterxLeafByTicker.get(ticker),
             waterxEnvelope: waterxEnvelopeByTicker.get(ticker),
         });
     }

package/dist/cjs/src/oracle/config.d.ts

@@ -96,7 +96,8 @@ export interface WaterxRuleFeedEntry {
 /**
  * `waterx_rule` deployment entry — the first-party Nautilus-TEE oracle rule.
  * Read by `WaterxRule` (`rules/waterx-rule.ts`): `feeds` for ticker support,
- * `config`/`enclave_config`/`enclave` for the `collect_batch_latest` call,
+ * `config`/`enclave_config`/`enclave` for the collect call
+ * (`collect_single_with_proof`, or `collect_batch_latest` on the fallback shape),
  * `published_at` for the package address. The off-chain signed price is pulled
  * from the quote-center (endpoint from the rule-owned `WATERX_INFRA` table in
  * `rules/waterx-rule.ts`), not this JSON.
@@ -201,7 +202,7 @@ export interface WaterxAccessConfig {
      * Quote-center base URL override (`waterxEndpoint` create option). A base
      * PATH is preserved — the rule appends via `joinEndpointPath`, so
      * `https://app.example/api/quote-center` resolves to
-     * `…/api/quote-center/v1/quotes/update` and a proxy route is not rewritten
+     * `…/api/quote-center/v1/quotes/leaves` and a proxy route is not rewritten
      * away. A trailing slash is trimmed.
      */
     endpoint?: string;

package/dist/cjs/src/oracle/index.d.ts

@@ -29,8 +29,8 @@ export { PythCoreRule } from "./rules/pyth-core-rule.ts";
 export type { PythCoreUpdatePayload } from "./rules/pyth-core-rule.ts";
 export { PythLazerRule, LazerApiKeyMissingError } from "./rules/pyth-lazer-rule.ts";
 export type { PythLazerUpdatePayload } from "./rules/pyth-lazer-rule.ts";
-export { WaterxRule, parseSignedEnvelope, BATCH_PRICE_INTENT, WATERX_INFRA, waterxQuoteCenterEndpoint, waterxEnvelopeOf, } from "./rules/waterx-rule.ts";
-export type { WaterxUpdatePayload, WaterxSignedEnvelope, WaterxBatchItem, } from "./rules/waterx-rule.ts";
+export { WaterxRule, parseSignedEnvelope, parseSignedLeaves, BATCH_PRICE_INTENT, MERKLE_ROOT_INTENT, WATERX_INFRA, waterxQuoteCenterEndpoint, waterxLeavesOf, waterxEnvelopeOf, } from "./rules/waterx-rule.ts";
+export type { WaterxUpdatePayload, WaterxLeafPayload, WaterxEnvelopePayload, WaterxSignedEnvelope, WaterxSignedLeaf, WaterxBatchItem, } from "./rules/waterx-rule.ts";
 export { OracleSourceNotImplementedError, resolveOracleRule } from "./rule-registry.ts";
 export { aggregateTicker, aggregateTickerWithPyth, aggregateTickerWithConstant, refreshOraclePrices, } from "./aggregate.ts";
 export { openPythSponsorFund, reimbursePythSponsor } from "./rules/sponsor.ts";

package/dist/cjs/src/oracle/index.js

@@ -17,7 +17,7 @@
  * rules that consume it are separate concerns.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.reimbursePythSponsor = exports.openPythSponsorFund = exports.refreshOraclePrices = exports.aggregateTickerWithConstant = exports.aggregateTickerWithPyth = exports.aggregateTicker = exports.resolveOracleRule = exports.OracleSourceNotImplementedError = exports.waterxEnvelopeOf = exports.waterxQuoteCenterEndpoint = exports.WATERX_INFRA = exports.BATCH_PRICE_INTENT = exports.parseSignedEnvelope = exports.WaterxRule = exports.LazerApiKeyMissingError = exports.PythLazerRule = exports.PythCoreRule = exports.resolveHermesReadEndpoint = exports.resolveOracleReadPlan = exports.parseOracleSourceList = exports.isOracleSource = exports.ORACLE_SOURCES = exports.OracleFeeSourceUnavailableError = exports.MISSING_FEED_MEMO_TTL_MS = exports.HermesEndpointRejectedAllFeedsError = exports.updatePythPrices = exports.PYTH_PRO_HERMES_ENDPOINT = exports.pythProHermesEndpoint = exports.pythCoreHermesEndpoint = exports.buildPythPriceUpdateCalls = exports.probeMissingFeeds = exports.endpointSupportedFeedIds = exports.fetchPriceFeedsUpdateData = exports.PythCache = exports.joinEndpointPath = exports.fetchWithPolicy = exports.FetchPolicyError = void 0;
+exports.reimbursePythSponsor = exports.openPythSponsorFund = exports.refreshOraclePrices = exports.aggregateTickerWithConstant = exports.aggregateTickerWithPyth = exports.aggregateTicker = exports.resolveOracleRule = exports.OracleSourceNotImplementedError = exports.waterxEnvelopeOf = exports.waterxLeavesOf = exports.waterxQuoteCenterEndpoint = exports.WATERX_INFRA = exports.MERKLE_ROOT_INTENT = exports.BATCH_PRICE_INTENT = exports.parseSignedLeaves = exports.parseSignedEnvelope = exports.WaterxRule = exports.LazerApiKeyMissingError = exports.PythLazerRule = exports.PythCoreRule = exports.resolveHermesReadEndpoint = exports.resolveOracleReadPlan = exports.parseOracleSourceList = exports.isOracleSource = exports.ORACLE_SOURCES = exports.OracleFeeSourceUnavailableError = exports.MISSING_FEED_MEMO_TTL_MS = exports.HermesEndpointRejectedAllFeedsError = exports.updatePythPrices = exports.PYTH_PRO_HERMES_ENDPOINT = exports.pythProHermesEndpoint = exports.pythCoreHermesEndpoint = exports.buildPythPriceUpdateCalls = exports.probeMissingFeeds = exports.endpointSupportedFeedIds = exports.fetchPriceFeedsUpdateData = exports.PythCache = exports.joinEndpointPath = exports.fetchWithPolicy = exports.FetchPolicyError = void 0;
 // Shared fetch resilience wrapper — `FetchPolicyError` is re-exported (not
 // just the type) so a consumer (e.g. a BE prefetch cache) can `instanceof`
 // it off the failure `fetchPriceFeedsUpdateData` / `PythLazerRule` /
@@ -85,16 +85,21 @@ Object.defineProperty(exports, "PythLazerRule", { enumerable: true, get: functio
 Object.defineProperty(exports, "LazerApiKeyMissingError", { enumerable: true, get: function () { return pyth_lazer_rule_ts_1.LazerApiKeyMissingError; } });
 // `WATERX_INFRA` / `waterxQuoteCenterEndpoint` are the source's own infra table +
 // read-plane accessor (mirrors `pythCoreHermesEndpoint`).
-// WaterX quote-center rule (first-party ed25519 signed batches; `feedWaterxRule`
-// stays internal to `aggregate.ts`).
+// WaterX quote-center rule (first-party ed25519 signed prices; the `feedWaterxRule*`
+// legs stay internal to `aggregate.ts`). Both wire shapes are exported because a
+// BE prefetch cache holds whichever one its quote-center serves: per-symbol
+// Merkle leaves (default) or one indivisible batch envelope (fallback).
 var waterx_rule_ts_1 = require("./rules/waterx-rule.js");
 Object.defineProperty(exports, "WaterxRule", { enumerable: true, get: function () { return waterx_rule_ts_1.WaterxRule; } });
 Object.defineProperty(exports, "parseSignedEnvelope", { enumerable: true, get: function () { return waterx_rule_ts_1.parseSignedEnvelope; } });
+Object.defineProperty(exports, "parseSignedLeaves", { enumerable: true, get: function () { return waterx_rule_ts_1.parseSignedLeaves; } });
 Object.defineProperty(exports, "BATCH_PRICE_INTENT", { enumerable: true, get: function () { return waterx_rule_ts_1.BATCH_PRICE_INTENT; } });
+Object.defineProperty(exports, "MERKLE_ROOT_INTENT", { enumerable: true, get: function () { return waterx_rule_ts_1.MERKLE_ROOT_INTENT; } });
 Object.defineProperty(exports, "WATERX_INFRA", { enumerable: true, get: function () { return waterx_rule_ts_1.WATERX_INFRA; } });
 Object.defineProperty(exports, "waterxQuoteCenterEndpoint", { enumerable: true, get: function () { return waterx_rule_ts_1.waterxQuoteCenterEndpoint; } });
-// Rule-owned payload accessor (kind-check + unwrap in one place) — never
-// hand-cast the payload shape.
+// Rule-owned payload accessors (kind-check + unwrap in one place) — never
+// hand-cast the payload shape, and never assume which variant it is.
+Object.defineProperty(exports, "waterxLeavesOf", { enumerable: true, get: function () { return waterx_rule_ts_1.waterxLeavesOf; } });
 Object.defineProperty(exports, "waterxEnvelopeOf", { enumerable: true, get: function () { return waterx_rule_ts_1.waterxEnvelopeOf; } });
 // `resolveOracleRule` is the ONE source→rule registry — exported so external
 // consumers (e.g. a BE prefetch cache that keys per source and needs each