@waterx/sdk 4.3.2 → 4.3.3

package/dist/cjs/src/perp/client.d.ts

@@ -32,10 +32,11 @@ export interface CreateClientOptions extends LoadConfigOptions {
      *   and a `pythApiKey` (Lazer is auth-first); Lazer infra lives in the
      *   source's own `LAZER_INFRA` table.
      * - `'waterx_rule'` — the first-party WaterX quote-center (Nautilus-TEE,
-     *   ed25519-signed batches): ONE envelope covering the build's tickers,
-     *   verified AND fed by a single `collect_batch_latest` per collector. No
-     *   credential and no per-update fee; needs `packages.waterx_rule` with
-     *   feeds. Quote-center infra lives in the source's own `WATERX_INFRA`
+     *   ed25519-signed prices): one signed Merkle LEAF per ticker, verified AND
+     *   fed by a single `collect_single_with_proof` per collector (falling back to
+     *   one whole-batch envelope + `collect_batch_latest` against a quote-center
+     *   with no leaf route). No credential and no per-update fee; needs
+     *   `packages.waterx_rule` with feeds. Quote-center infra lives in the source's own `WATERX_INFRA`
      *   table; endpoint/transport overridable via
      *   {@link CreateClientOptions.waterxEndpoint} /
      *   {@link CreateClientOptions.waterxFetch} — the browser-CORS proxy hook,
@@ -72,15 +73,16 @@ export interface CreateClientOptions extends LoadConfigOptions {
      * Quote-center base URL for `oracleSource: 'waterx_rule'` — overrides the
      * source's own per-network `WATERX_INFRA` default.
      *
-     * This is the one source a BROWSER fetches itself (the signed envelope is
-     * pulled from the page), so it is bound by the quote-center deployment's CORS
+     * This is the one source a BROWSER fetches itself (the signed price is pulled
+     * from the page), so it is bound by the quote-center deployment's CORS
      * allowlist. A front end whose origin is not allowed — or one that must route
      * egress through its own backend — points this at a same-origin proxy that
-     * forwards `GET /v1/quotes/update`. Unused by the Pyth sources.
+     * forwards `GET /v1/quotes/leaves` (and `GET /v1/quotes/update`, the fallback
+     * route). Unused by the Pyth sources.
      *
      * An absolute URL. Any base PATH is preserved (`joinEndpointPath`), so
      * `https://app.example/api/quote-center` fetches
-     * `https://app.example/api/quote-center/v1/quotes/update` — a proxy route
+     * `https://app.example/api/quote-center/v1/quotes/leaves` — a proxy route
      * survives instead of being rewritten to the origin root.
      */
     waterxEndpoint?: string;

package/dist/cjs/src/perp/index.d.ts

@@ -13,8 +13,8 @@ export type { EstLiqPriceViewOpts } from "./liq-view.ts";
 export * from "./user/index.ts";
 export * from "./tx-builders.ts";
 export * from "./fetch.ts";
-export { FetchPolicyError, LazerApiKeyMissingError, OracleFeeSourceUnavailableError, OracleSourceNotImplementedError, PythCache, aggregateTicker, aggregateTickerWithConstant, aggregateTickerWithPyth, ORACLE_SOURCES, buildPythPriceUpdateCalls, fetchPriceFeedsUpdateData, isOracleSource, parseOracleSourceList, pythCoreHermesEndpoint, pythProHermesEndpoint, refreshOraclePrices, resolveHermesReadEndpoint, updatePythPrices, waterxEnvelopeOf, waterxQuoteCenterEndpoint, } from "../oracle/index.ts";
-export type { FetchPolicy, OracleFeeSource, OracleSource, UpdateDataProvider, } from "../oracle/index.ts";
+export { FetchPolicyError, LazerApiKeyMissingError, OracleFeeSourceUnavailableError, OracleSourceNotImplementedError, PythCache, aggregateTicker, aggregateTickerWithConstant, aggregateTickerWithPyth, ORACLE_SOURCES, buildPythPriceUpdateCalls, fetchPriceFeedsUpdateData, isOracleSource, parseOracleSourceList, pythCoreHermesEndpoint, pythProHermesEndpoint, refreshOraclePrices, resolveHermesReadEndpoint, updatePythPrices, waterxEnvelopeOf, waterxLeavesOf, parseSignedLeaves, MERKLE_ROOT_INTENT, waterxQuoteCenterEndpoint, } from "../oracle/index.ts";
+export type { FetchPolicy, OracleFeeSource, OracleSource, UpdateDataProvider, WaterxBatchItem, WaterxEnvelopePayload, WaterxLeafPayload, WaterxSignedEnvelope, WaterxSignedLeaf, WaterxUpdatePayload, } from "../oracle/index.ts";
 export { fetchDepositVaa, fetchVaa, listBridgeWithdrawalVaas, listVaasByEmitter, padEvmEmitter, toWormholescanEmitter, vaaBase64ToBytes, vaaBase64ToHex, vaaBytesToBase64, waitForVaa, } from "../account/funding/wormhole.ts";
 export type { VaaListItem, VaaResponse, WormholescanOptions } from "../account/funding/wormhole.ts";
 export { AccountData as AccountDataBcs, GlobalConfigData as GlobalConfigDataBcs, MarketData as MarketDataBcs, OrderData as OrderDataBcs, PoolData as PoolDataBcs, PositionData as PositionDataBcs, RedeemRequestData as RedeemRequestDataBcs, TokenPoolData as TokenPoolDataBcs, } from "../generated/waterx_perp_view/view.ts";

package/dist/cjs/src/perp/index.js

@@ -37,8 +37,8 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getCollateralAssets = exports.getMarketTickers = exports.TOKEN_DECIMALS = exports.COLLATERAL_DECIMALS = exports.WLP_DECIMALS = exports.SUI_DECIMALS = exports.MS_PER_YEAR = exports.MS_PER_HOUR = exports.MS_PER_MINUTE = exports.STAKING_PERM_ALL = exports.STAKING_PERM_CLAIM_REWARD = exports.STAKING_PERM_REDEEM_STAKE = exports.STAKING_PERM_DEPOSIT_STAKE = exports.PERM_WITHDRAW_COLLATERAL = exports.PERM_REDEEM_WLP = exports.PERM_PLACE_ORDER = exports.PERM_OPEN_POSITION = exports.PERM_MINT_WLP = exports.PERM_INCREASE_POSITION = exports.PERM_DEPOSIT_COLLATERAL = exports.PERM_DECREASE_POSITION = exports.PERM_CLOSE_POSITION = exports.PERM_CANCEL_ORDER = exports.PERM_ALL_TRADING = exports.PERM_ALL = exports.ORDER_TAG_WILDCARD = exports.ORDER_STOP_SELL = exports.ORDER_STOP_BUY = exports.ORDER_LIMIT_SELL = exports.ORDER_LIMIT_BUY = exports.FLOAT_SCALE = exports.DRY_RUN_SENDER = exports.DOUBLE_SCALE = exports.BPS_SCALE = exports.ACTION_WITHDRAW_COLLATERAL = exports.ACTION_UPDATE_ORDER = exports.ACTION_PLACE_ORDER = exports.ACTION_OPEN_POSITION = exports.ACTION_LIQUIDATE = exports.ACTION_INCREASE_POSITION = exports.ACTION_DEPOSIT_COLLATERAL = exports.ACTION_DECREASE_POSITION = exports.ACTION_CLOSE_POSITION = exports.ACTION_CANCEL_PRE_ORDER = exports.ACTION_CANCEL_ORDER = exports.ACTION_ADD_PRE_ORDER = exports.loadConfig = exports.clearConfigCache = exports.WORMHOLE_DEFAULTS = exports.PerpClient = void 0;
-exports.fetchDepositVaa = exports.waterxQuoteCenterEndpoint = exports.waterxEnvelopeOf = exports.updatePythPrices = exports.resolveHermesReadEndpoint = exports.refreshOraclePrices = exports.pythProHermesEndpoint = exports.pythCoreHermesEndpoint = exports.parseOracleSourceList = exports.isOracleSource = exports.fetchPriceFeedsUpdateData = exports.buildPythPriceUpdateCalls = exports.ORACLE_SOURCES = exports.aggregateTickerWithPyth = exports.aggregateTickerWithConstant = exports.aggregateTicker = exports.PythCache = exports.OracleSourceNotImplementedError = exports.OracleFeeSourceUnavailableError = exports.LazerApiKeyMissingError = exports.FetchPolicyError = exports.calcEstLiqPriceRawFromView = exports.formatFundingInterval = exports.rawPrice = exports.decodeFundingIndexDelta = exports.calcWlpRedeemOut = exports.calcWlpPrice = exports.calcWlpMintOut = exports.calcWlpIncentiveApy = exports.calcViewEstLiqFeesUsd = exports.calcUnrealizedPnl = exports.calcTotalTradingFeeRate = exports.calcTokenUtilizationBps = exports.calcRealLiqNetCostUsd = exports.calcPositionBorrowFee = exports.calcNotional = exports.calcMaxReducibleCollateralUsd = exports.calcLeverage = exports.calcImpactFeeRate = exports.calcFundingRate = exports.calcFundingFeeUsd = exports.calcFee = exports.calcEstLiqPriceRaw = exports.calcEstLiqPrice = exports.calcEffectiveCollateralUsd = exports.calcDynamicFeeBps = exports.calcBorrowRateAccrual = exports.calcBorrowRate = exports.annualizeFundingRate = exports.annualizedApyFromRatio = void 0;
-exports.withdrawalQueueCalls = exports.nativeCustodyCalls = exports.referralCalls = exports.pythSponsorRuleCalls = exports.pythRuleCalls = exports.oracleCalls = exports.stakingCalls = exports.wxaAccountCalls = exports.viewCalls = exports.lpPoolCalls = exports.tradingCalls = exports.MarketConfigBcs = exports.MarketBcs = exports.OrderBcs = exports.PositionBcs = exports.TokenPoolDataBcs = exports.RedeemRequestDataBcs = exports.PositionDataBcs = exports.PoolDataBcs = exports.OrderDataBcs = exports.MarketDataBcs = exports.GlobalConfigDataBcs = exports.AccountDataBcs = exports.waitForVaa = exports.vaaBytesToBase64 = exports.vaaBase64ToHex = exports.vaaBase64ToBytes = exports.toWormholescanEmitter = exports.padEvmEmitter = exports.listVaasByEmitter = exports.listBridgeWithdrawalVaas = exports.fetchVaa = void 0;
+exports.parseSignedLeaves = exports.waterxLeavesOf = exports.waterxEnvelopeOf = exports.updatePythPrices = exports.resolveHermesReadEndpoint = exports.refreshOraclePrices = exports.pythProHermesEndpoint = exports.pythCoreHermesEndpoint = exports.parseOracleSourceList = exports.isOracleSource = exports.fetchPriceFeedsUpdateData = exports.buildPythPriceUpdateCalls = exports.ORACLE_SOURCES = exports.aggregateTickerWithPyth = exports.aggregateTickerWithConstant = exports.aggregateTicker = exports.PythCache = exports.OracleSourceNotImplementedError = exports.OracleFeeSourceUnavailableError = exports.LazerApiKeyMissingError = exports.FetchPolicyError = exports.calcEstLiqPriceRawFromView = exports.formatFundingInterval = exports.rawPrice = exports.decodeFundingIndexDelta = exports.calcWlpRedeemOut = exports.calcWlpPrice = exports.calcWlpMintOut = exports.calcWlpIncentiveApy = exports.calcViewEstLiqFeesUsd = exports.calcUnrealizedPnl = exports.calcTotalTradingFeeRate = exports.calcTokenUtilizationBps = exports.calcRealLiqNetCostUsd = exports.calcPositionBorrowFee = exports.calcNotional = exports.calcMaxReducibleCollateralUsd = exports.calcLeverage = exports.calcImpactFeeRate = exports.calcFundingRate = exports.calcFundingFeeUsd = exports.calcFee = exports.calcEstLiqPriceRaw = exports.calcEstLiqPrice = exports.calcEffectiveCollateralUsd = exports.calcDynamicFeeBps = exports.calcBorrowRateAccrual = exports.calcBorrowRate = exports.annualizeFundingRate = exports.annualizedApyFromRatio = void 0;
+exports.withdrawalQueueCalls = exports.nativeCustodyCalls = exports.referralCalls = exports.pythSponsorRuleCalls = exports.pythRuleCalls = exports.oracleCalls = exports.stakingCalls = exports.wxaAccountCalls = exports.viewCalls = exports.lpPoolCalls = exports.tradingCalls = exports.MarketConfigBcs = exports.MarketBcs = exports.OrderBcs = exports.PositionBcs = exports.TokenPoolDataBcs = exports.RedeemRequestDataBcs = exports.PositionDataBcs = exports.PoolDataBcs = exports.OrderDataBcs = exports.MarketDataBcs = exports.GlobalConfigDataBcs = exports.AccountDataBcs = exports.waitForVaa = exports.vaaBytesToBase64 = exports.vaaBase64ToHex = exports.vaaBase64ToBytes = exports.toWormholescanEmitter = exports.padEvmEmitter = exports.listVaasByEmitter = exports.listBridgeWithdrawalVaas = exports.fetchVaa = exports.fetchDepositVaa = exports.waterxQuoteCenterEndpoint = exports.MERKLE_ROOT_INTENT = void 0;
 // ======== Core ========
 var client_ts_1 = require("./client.js");
 Object.defineProperty(exports, "PerpClient", { enumerable: true, get: function () { return client_ts_1.PerpClient; } });
@@ -155,6 +155,14 @@ Object.defineProperty(exports, "refreshOraclePrices", { enumerable: true, get: f
 Object.defineProperty(exports, "resolveHermesReadEndpoint", { enumerable: true, get: function () { return index_ts_1.resolveHermesReadEndpoint; } });
 Object.defineProperty(exports, "updatePythPrices", { enumerable: true, get: function () { return index_ts_1.updatePythPrices; } });
 Object.defineProperty(exports, "waterxEnvelopeOf", { enumerable: true, get: function () { return index_ts_1.waterxEnvelopeOf; } });
+// Leaves are the DEFAULT waterx wire shape, so their accessor + parser belong
+// on the same surface as `waterxEnvelopeOf` (and on the root, which re-exports
+// this file). A prefetch cache written against the envelope-only surface would
+// otherwise get `null` from its only accessor on the normal path and have to
+// discover `@waterx/sdk/oracle` to fix it.
+Object.defineProperty(exports, "waterxLeavesOf", { enumerable: true, get: function () { return index_ts_1.waterxLeavesOf; } });
+Object.defineProperty(exports, "parseSignedLeaves", { enumerable: true, get: function () { return index_ts_1.parseSignedLeaves; } });
+Object.defineProperty(exports, "MERKLE_ROOT_INTENT", { enumerable: true, get: function () { return index_ts_1.MERKLE_ROOT_INTENT; } });
 Object.defineProperty(exports, "waterxQuoteCenterEndpoint", { enumerable: true, get: function () { return index_ts_1.waterxQuoteCenterEndpoint; } });
 // ======== Wormhole / Wormholescan utilities (credit bridge) ========
 var wormhole_ts_1 = require("../account/funding/wormhole.js");

package/dist/cjs/src/unified-client.d.ts

@@ -406,7 +406,7 @@ export interface ClientCreateOptions {
      * the quote-center deployment's CORS allowlist: a front end whose origin is
      * not allowed points this at its own same-origin proxy. An absolute URL whose
      * base PATH is preserved — `https://app.example/api/quote-center` fetches
-     * `…/api/quote-center/v1/quotes/update`. Unused by the Pyth sources.
+     * `…/api/quote-center/v1/quotes/leaves`. Unused by the Pyth sources.
      */
     waterxEndpoint?: string;
     /**

package/dist/src/generated/waterx_rule/waterx_rule.d.ts

@@ -70,6 +70,11 @@ export declare const BatchPricePayload: MoveStruct<{
         length: number;
     }, string>;
 }, "@waterx/rule::waterx_rule::BatchPricePayload">;
+export declare const MerkleRoot: MoveStruct<{
+    root: import("@mysten/sui/bcs").BcsType<number[], Iterable<number> & {
+        length: number;
+    }, string>;
+}, "@waterx/rule::waterx_rule::MerkleRoot">;
 export declare const FeedConfig: MoveStruct<{
     ticker: import("@mysten/sui/bcs").BcsType<string, string, "string">;
     sources: import("@mysten/sui/bcs").BcsType<string[], Iterable<string | number | bigint> & {
@@ -214,17 +219,82 @@ export interface CollectBatchLatestOptions {
  * and so aborts on any stale item, this path runs alongside Pyth/Supra. To let
  * those cover a lagging TEE — the blast-radius bound in the GCP ADR — a
  * _freshness_ miss ABSTAINS (records `none`, which `aggregator::remove_outliers`
- * drops before the `weight_threshold` fail-closed check). A _config/integrity_
- * mismatch (source / ticker / method / confidence / deviation) still ABORTS: an
- * enclave whose signed payload disagrees with the on-chain feed config is a red
- * flag, not a liveness blip. Bad signature, malformed batch, a future timestamp,
- * and replay always abort.
+ * drops before the `weight_threshold` fail-closed check), and so does a _replayed_
+ * signed timestamp (the chain already accepted that snapshot — the on-chain price
+ * is at least as fresh, and two concurrent keeper PTBs sharing one envelope must
+ * not kill each other). A _config/integrity_ mismatch (source / ticker / method /
+ * confidence / deviation) still ABORTS: an enclave whose signed payload disagrees
+ * with the on-chain feed config is a red flag, not a liveness blip. Bad signature,
+ * malformed batch, and a future timestamp always abort.
  *
  * Every gate is identical to `feed_batch_item_latest`; only the abort-vs-abstain
- * disposition of the two freshness gates differs, and the sink is the caller's
- * collector rather than a fresh single-rule one.
+ * disposition of the freshness + replay gates differs, and the sink is the
+ * caller's collector rather than a fresh single-rule one.
  */
 export declare function collectBatchLatest(options: CollectBatchLatestOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
+export interface FeedSingleWithProofArguments {
+    oracleObj: RawTransactionArgument<string>;
+    config: RawTransactionArgument<string>;
+    enclaveConfig: RawTransactionArgument<string>;
+    enclave: RawTransactionArgument<string>;
+    timestampMs: RawTransactionArgument<number | bigint>;
+    item: TransactionArgument;
+    proof: RawTransactionArgument<Array<Array<number>>>;
+    sig: RawTransactionArgument<Array<number>>;
+}
+export interface FeedSingleWithProofOptions {
+    package?: string;
+    arguments: FeedSingleWithProofArguments | [
+        oracleObj: RawTransactionArgument<string>,
+        config: RawTransactionArgument<string>,
+        enclaveConfig: RawTransactionArgument<string>,
+        enclave: RawTransactionArgument<string>,
+        timestampMs: RawTransactionArgument<number | bigint>,
+        item: TransactionArgument,
+        proof: RawTransactionArgument<Array<Array<number>>>,
+        sig: RawTransactionArgument<Array<number>>
+    ];
+}
+/**
+ * Streaming per-symbol sibling of `feed_batch_latest`. Verifies ONE enclave
+ * signature over a Merkle `root`, checks `item` is a leaf of that root via
+ * `proof`, then runs the identical per-item gates + `oracle::aggregate`. Use for a
+ * WaterxRule-only aggregator; for a Pyth-coexisting aggregator use
+ * `collect_single_with_proof`.
+ */
+export declare function feedSingleWithProof(options: FeedSingleWithProofOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
+export interface CollectSingleWithProofArguments {
+    collector: TransactionArgument;
+    config: RawTransactionArgument<string>;
+    enclaveConfig: RawTransactionArgument<string>;
+    enclave: RawTransactionArgument<string>;
+    timestampMs: RawTransactionArgument<number | bigint>;
+    item: TransactionArgument;
+    proof: RawTransactionArgument<Array<Array<number>>>;
+    sig: RawTransactionArgument<Array<number>>;
+}
+export interface CollectSingleWithProofOptions {
+    package?: string;
+    arguments: CollectSingleWithProofArguments | [
+        collector: TransactionArgument,
+        config: RawTransactionArgument<string>,
+        enclaveConfig: RawTransactionArgument<string>,
+        enclave: RawTransactionArgument<string>,
+        timestampMs: RawTransactionArgument<number | bigint>,
+        item: TransactionArgument,
+        proof: RawTransactionArgument<Array<Array<number>>>,
+        sig: RawTransactionArgument<Array<number>>
+    ];
+}
+/**
+ * Collect-only sibling of `feed_single_with_proof` for the dual-rule latest path
+ * (WaterX alongside Pyth on one aggregator), mirroring `collect_batch_latest`:
+ * verifies root + proof, feeds the leaf into the caller's `PriceCollector` WITHOUT
+ * calling `oracle::aggregate`. Abort vs abstain matches `collect_batch_latest`
+ * exactly — a config/integrity mismatch aborts, a freshness miss abstains so Pyth
+ * can cover a lagging TEE.
+ */
+export declare function collectSingleWithProof(options: CollectSingleWithProofOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
 export interface QuoteForTimestampArguments {
     config: RawTransactionArgument<string>;
     enclaveConfig: RawTransactionArgument<string>;
@@ -421,6 +491,27 @@ export interface BatchPriceIntentOptions {
     ];
 }
 export declare function batchPriceIntent(options?: BatchPriceIntentOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
+export interface MerkleRootIntentOptions {
+    package?: string;
+    arguments?: [
+    ];
+}
+export declare function merkleRootIntent(options?: MerkleRootIntentOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
+export interface LeafHashOfArguments {
+    item: TransactionArgument;
+}
+export interface LeafHashOfOptions {
+    package?: string;
+    arguments: LeafHashOfArguments | [
+        item: TransactionArgument
+    ];
+}
+/**
+ * The keccak256 leaf hash for `item` — `keccak256(0x00 || BCS(item))`. Exposed so
+ * the off-chain builder / SDK can be pinned against the on-chain encoding in a
+ * cross-implementation golden test.
+ */
+export declare function leafHashOf(options: LeafHashOfOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
 export interface MaxBatchSizeOptions {
     package?: string;
     arguments?: [
@@ -717,6 +808,48 @@ export interface SourceGataUsdtPerpWsOptions {
     ];
 }
 export declare function sourceGataUsdtPerpWs(options?: SourceGataUsdtPerpWsOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
+export interface SourceBybitSpotWsOptions {
+    package?: string;
+    arguments?: [
+    ];
+}
+export declare function sourceBybitSpotWs(options?: SourceBybitSpotWsOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
+export interface SourceXstockEquityRestOptions {
+    package?: string;
+    arguments?: [
+    ];
+}
+export declare function sourceXstockEquityRest(options?: SourceXstockEquityRestOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
+export interface SourceOkxSpotWsOptions {
+    package?: string;
+    arguments?: [
+    ];
+}
+export declare function sourceOkxSpotWs(options?: SourceOkxSpotWsOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
+export interface SourceHyperliquidPerpWsOptions {
+    package?: string;
+    arguments?: [
+    ];
+}
+export declare function sourceHyperliquidPerpWs(options?: SourceHyperliquidPerpWsOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
+export interface SourceGateioSpotWsOptions {
+    package?: string;
+    arguments?: [
+    ];
+}
+export declare function sourceGateioSpotWs(options?: SourceGateioSpotWsOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
+export interface SourceKrakenSpotWsOptions {
+    package?: string;
+    arguments?: [
+    ];
+}
+export declare function sourceKrakenSpotWs(options?: SourceKrakenSpotWsOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
+export interface SourcePythLazerWsOptions {
+    package?: string;
+    arguments?: [
+    ];
+}
+export declare function sourcePythLazerWs(options?: SourcePythLazerWsOptions): (tx: Transaction) => import("@mysten/sui/transactions").TransactionResult;
 export interface MethodDirectOptions {
     package?: string;
     arguments?: [

package/dist/src/generated/waterx_rule/waterx_rule.js

@@ -41,6 +41,9 @@ export const BatchPriceItem = new MoveStruct({ name: `${$moduleName}::BatchPrice
 export const BatchPricePayload = new MoveStruct({ name: `${$moduleName}::BatchPricePayload`, fields: {
         items: bcs.vector(BatchPriceItem)
     } });
+export const MerkleRoot = new MoveStruct({ name: `${$moduleName}::MerkleRoot`, fields: {
+        root: bcs.vector(bcs.u8())
+    } });
 export const FeedConfig = new MoveStruct({ name: `${$moduleName}::FeedConfig`, fields: {
         ticker: bcs.string(),
         sources: bcs.vector(bcs.u64()),
@@ -126,15 +129,17 @@ export function feedBatchLatest(options) {
  * and so aborts on any stale item, this path runs alongside Pyth/Supra. To let
  * those cover a lagging TEE — the blast-radius bound in the GCP ADR — a
  * _freshness_ miss ABSTAINS (records `none`, which `aggregator::remove_outliers`
- * drops before the `weight_threshold` fail-closed check). A _config/integrity_
- * mismatch (source / ticker / method / confidence / deviation) still ABORTS: an
- * enclave whose signed payload disagrees with the on-chain feed config is a red
- * flag, not a liveness blip. Bad signature, malformed batch, a future timestamp,
- * and replay always abort.
+ * drops before the `weight_threshold` fail-closed check), and so does a _replayed_
+ * signed timestamp (the chain already accepted that snapshot — the on-chain price
+ * is at least as fresh, and two concurrent keeper PTBs sharing one envelope must
+ * not kill each other). A _config/integrity_ mismatch (source / ticker / method /
+ * confidence / deviation) still ABORTS: an enclave whose signed payload disagrees
+ * with the on-chain feed config is a red flag, not a liveness blip. Bad signature,
+ * malformed batch, and a future timestamp always abort.
  *
  * Every gate is identical to `feed_batch_item_latest`; only the abort-vs-abstain
- * disposition of the two freshness gates differs, and the sink is the caller's
- * collector rather than a fresh single-rule one.
+ * disposition of the freshness + replay gates differs, and the sink is the
+ * caller's collector rather than a fresh single-rule one.
  */
 export function collectBatchLatest(options) {
     const packageAddress = options.package ?? '@waterx/rule';
@@ -156,6 +161,63 @@ export function collectBatchLatest(options) {
         arguments: normalizeMoveArguments(options.arguments, argumentsTypes, parameterNames),
     });
 }
+/**
+ * Streaming per-symbol sibling of `feed_batch_latest`. Verifies ONE enclave
+ * signature over a Merkle `root`, checks `item` is a leaf of that root via
+ * `proof`, then runs the identical per-item gates + `oracle::aggregate`. Use for a
+ * WaterxRule-only aggregator; for a Pyth-coexisting aggregator use
+ * `collect_single_with_proof`.
+ */
+export function feedSingleWithProof(options) {
+    const packageAddress = options.package ?? '@waterx/rule';
+    const argumentsTypes = [
+        null,
+        null,
+        '0x2::clock::Clock',
+        null,
+        null,
+        'u64',
+        null,
+        'vector<vector<u8>>',
+        'vector<u8>'
+    ];
+    const parameterNames = ["oracleObj", "config", "enclaveConfig", "enclave", "timestampMs", "item", "proof", "sig"];
+    return (tx) => tx.moveCall({
+        package: packageAddress,
+        module: 'waterx_rule',
+        function: 'feed_single_with_proof',
+        arguments: normalizeMoveArguments(options.arguments, argumentsTypes, parameterNames),
+    });
+}
+/**
+ * Collect-only sibling of `feed_single_with_proof` for the dual-rule latest path
+ * (WaterX alongside Pyth on one aggregator), mirroring `collect_batch_latest`:
+ * verifies root + proof, feeds the leaf into the caller's `PriceCollector` WITHOUT
+ * calling `oracle::aggregate`. Abort vs abstain matches `collect_batch_latest`
+ * exactly — a config/integrity mismatch aborts, a freshness miss abstains so Pyth
+ * can cover a lagging TEE.
+ */
+export function collectSingleWithProof(options) {
+    const packageAddress = options.package ?? '@waterx/rule';
+    const argumentsTypes = [
+        null,
+        null,
+        '0x2::clock::Clock',
+        null,
+        null,
+        'u64',
+        null,
+        'vector<vector<u8>>',
+        'vector<u8>'
+    ];
+    const parameterNames = ["collector", "config", "enclaveConfig", "enclave", "timestampMs", "item", "proof", "sig"];
+    return (tx) => tx.moveCall({
+        package: packageAddress,
+        module: 'waterx_rule',
+        function: 'collect_single_with_proof',
+        arguments: normalizeMoveArguments(options.arguments, argumentsTypes, parameterNames),
+    });
+}
 /**
  * Verifies a historical quote without touching `waterx_oracle`.
  *
@@ -347,6 +409,32 @@ export function batchPriceIntent(options = {}) {
         function: 'batch_price_intent',
     });
 }
+export function merkleRootIntent(options = {}) {
+    const packageAddress = options.package ?? '@waterx/rule';
+    return (tx) => tx.moveCall({
+        package: packageAddress,
+        module: 'waterx_rule',
+        function: 'merkle_root_intent',
+    });
+}
+/**
+ * The keccak256 leaf hash for `item` — `keccak256(0x00 || BCS(item))`. Exposed so
+ * the off-chain builder / SDK can be pinned against the on-chain encoding in a
+ * cross-implementation golden test.
+ */
+export function leafHashOf(options) {
+    const packageAddress = options.package ?? '@waterx/rule';
+    const argumentsTypes = [
+        null
+    ];
+    const parameterNames = ["item"];
+    return (tx) => tx.moveCall({
+        package: packageAddress,
+        module: 'waterx_rule',
+        function: 'leaf_hash_of',
+        arguments: normalizeMoveArguments(options.arguments, argumentsTypes, parameterNames),
+    });
+}
 export function maxBatchSize(options = {}) {
     const packageAddress = options.package ?? '@waterx/rule';
     return (tx) => tx.moveCall({
@@ -733,6 +821,62 @@ export function sourceGataUsdtPerpWs(options = {}) {
         function: 'source_gata_usdt_perp_ws',
     });
 }
+export function sourceBybitSpotWs(options = {}) {
+    const packageAddress = options.package ?? '@waterx/rule';
+    return (tx) => tx.moveCall({
+        package: packageAddress,
+        module: 'waterx_rule',
+        function: 'source_bybit_spot_ws',
+    });
+}
+export function sourceXstockEquityRest(options = {}) {
+    const packageAddress = options.package ?? '@waterx/rule';
+    return (tx) => tx.moveCall({
+        package: packageAddress,
+        module: 'waterx_rule',
+        function: 'source_xstock_equity_rest',
+    });
+}
+export function sourceOkxSpotWs(options = {}) {
+    const packageAddress = options.package ?? '@waterx/rule';
+    return (tx) => tx.moveCall({
+        package: packageAddress,
+        module: 'waterx_rule',
+        function: 'source_okx_spot_ws',
+    });
+}
+export function sourceHyperliquidPerpWs(options = {}) {
+    const packageAddress = options.package ?? '@waterx/rule';
+    return (tx) => tx.moveCall({
+        package: packageAddress,
+        module: 'waterx_rule',
+        function: 'source_hyperliquid_perp_ws',
+    });
+}
+export function sourceGateioSpotWs(options = {}) {
+    const packageAddress = options.package ?? '@waterx/rule';
+    return (tx) => tx.moveCall({
+        package: packageAddress,
+        module: 'waterx_rule',
+        function: 'source_gateio_spot_ws',
+    });
+}
+export function sourceKrakenSpotWs(options = {}) {
+    const packageAddress = options.package ?? '@waterx/rule';
+    return (tx) => tx.moveCall({
+        package: packageAddress,
+        module: 'waterx_rule',
+        function: 'source_kraken_spot_ws',
+    });
+}
+export function sourcePythLazerWs(options = {}) {
+    const packageAddress = options.package ?? '@waterx/rule';
+    return (tx) => tx.moveCall({
+        package: packageAddress,
+        module: 'waterx_rule',
+        function: 'source_pyth_lazer_ws',
+    });
+}
 export function methodDirect(options = {}) {
     const packageAddress = options.package ?? '@waterx/rule';
     return (tx) => tx.moveCall({

package/dist/src/oracle/aggregate.d.ts

@@ -26,7 +26,7 @@ import type { Transaction, TransactionArgument } from "@mysten/sui/transactions"
 import type { OracleHost } from "./host.ts";
 import type { OracleSource, PriceUpdateRule, UpdateDataProvider } from "./price-update-rule.ts";
 import { type OracleFeeSource, type PythCache } from "./pyth.ts";
-import { type WaterxSignedEnvelope } from "./rules/waterx-rule.ts";
+import { type WaterxSignedEnvelope, type WaterxSignedLeaf } from "./rules/waterx-rule.ts";
 /**
  * Aggregate one ticker's price into the shared `Oracle`: build a collector, feed
  * every rule the ticker is configured for, then `aggregate`.
@@ -57,6 +57,9 @@ export declare function aggregateTicker(tx: Transaction, host: OracleHost, args:
     ticker: string;
     priceInfoObjectId?: string;
     lazerUpdate?: TransactionArgument;
+    /** This ticker's signed Merkle leaf — the default waterx shape. */
+    waterxLeaf?: WaterxSignedLeaf;
+    /** Batch envelope covering this ticker — the fallback waterx shape. */
     waterxEnvelope?: WaterxSignedEnvelope;
 }): void;
 /**

package/dist/src/oracle/aggregate.js

@@ -30,7 +30,7 @@ import { feedConstantRule } from "./rules/constant-rule.js";
 import { feedLazerRule } from "./rules/pyth-lazer-rule.js";
 import { feedPythRule } from "./rules/pyth-rule.js";
 import { maybeFeedSupra } from "./rules/supra-rule.js";
-import { feedWaterxRule, waterxEnvelopeOf, } from "./rules/waterx-rule.js";
+import { feedWaterxRule, feedWaterxRuleWithProof, waterxEnvelopeOf, waterxLeavesOf, } from "./rules/waterx-rule.js";
 /**
  * Resolve one group's off-chain update payload for {@link refreshOraclePrices}:
  * try `provider.get(source, tickers)` first (when a provider is configured),
@@ -114,17 +114,25 @@ export function aggregateTicker(tx, host, args) {
         feedLazerRule(tx, host, collector, args.lazerUpdate);
         fed = true;
     }
-    if (args.waterxEnvelope !== undefined) {
-        // waterx_rule::collect_batch_latest verifies the batch signature and feeds
-        // this collector's symbol from the batch. If the ticker's aggregator does
-        // not (yet) weight `WaterxRule`, the contribution is silently dropped
-        // on-chain — feeding ahead of the weight migration is safe for THIS tx.
-        // CAVEAT (unlike lazer): the feed call records a per-symbol signed-
-        // timestamp high-water mark REGARDLESS of weights, and a replayed
-        // timestamp ABORTS (`EReplayedSignature`, audit F-014) — so two PTBs
-        // carrying the same envelope for the same symbol cannot both land; the
-        // second aborts even where waterx is unweighted. See WaterxRule's module
-        // header.
+    // One waterx leg at most, and the leaf shape wins: both entries record the
+    // same per-symbol signed-timestamp high-water mark and feed the same rule
+    // witness into this collector, so emitting both would make the second one
+    // abstain on its own predecessor's mark for no gain. `refreshOraclePrices`
+    // only ever supplies one; a caller that passes both gets the cheaper leg.
+    if (args.waterxLeaf !== undefined) {
+        // waterx_rule::collect_single_with_proof re-derives the snapshot root from
+        // this leaf + its proof, verifies the enclave signature over that root, and
+        // feeds the price. If the ticker's aggregator does not (yet) weight
+        // `WaterxRule`, the contribution is silently dropped on-chain — feeding
+        // ahead of the weight migration is safe. See WaterxRule's module header for
+        // the abort-vs-abstain split.
+        feedWaterxRuleWithProof(tx, host, collector, args.waterxLeaf);
+        fed = true;
+    }
+    else if (args.waterxEnvelope !== undefined) {
+        // Fallback shape: collect_batch_latest re-verifies the WHOLE batch
+        // signature (every item rebuilt in-PTB) and feeds this collector's symbol
+        // out of it. Only reached against a quote-center with no leaf route.
         feedWaterxRule(tx, host, collector, args.waterxEnvelope);
         fed = true;
     }
@@ -217,11 +225,11 @@ export async function refreshOraclePrices(tx, host, tickers, opts = {}) {
     if (tickers.length === 0)
         return;
     // Dedupe the caller's list (order-preserving): a repeated ticker would
-    // otherwise aggregate TWICE in this one PTB — wasted gas for every rule,
-    // and a hard ABORT under waterx: the second `collect_batch_latest` carries
-    // the same envelope, and the on-chain per-symbol replay guard rejects an
-    // already-accepted signed timestamp (`EReplayedSignature`, F-014) even
-    // inside a single transaction.
+    // otherwise aggregate TWICE in this one PTB — wasted gas for every rule, and
+    // under waterx the second collect would be dead weight on top of that: the
+    // on-chain per-symbol replay guard (F-014) sees its own predecessor's
+    // high-water mark from earlier in this same transaction and abstains, so the
+    // repeat pays full verification cost to contribute nothing.
     tickers = [...new Set(tickers)];
     // price_info_object lookup for every ticker with a pyth_rule.feeds entry —
     // needed by aggregateTicker's (unchanged) Pyth feed step below regardless of
@@ -292,10 +300,12 @@ export async function refreshOraclePrices(tx, host, tickers, opts = {}) {
     // leg needs per-ticker data from its update leg must decide its carry here
     // — falling through silently would starve its weighted tickers on-chain.
     const lazerUpdateByTicker = new Map();
-    // Signed batch envelope per waterx-served ticker. Unlike Lazer's shared PTB
-    // handle, waterx's verify+feed is bundled into `collect_batch_latest` in the
-    // per-ticker feed leg, so its `buildUpdateCalls` emits nothing and the
-    // envelope is carried straight from the group's fetched data.
+    // Signed waterx data per served ticker — a per-symbol Merkle leaf normally, a
+    // shared batch envelope on the fallback shape. Unlike Lazer's shared PTB
+    // handle, waterx's verify+feed is bundled into the per-ticker collect call, so
+    // its `buildUpdateCalls` emits nothing and the signed data is carried straight
+    // from the group's fetched data.
+    const waterxLeafByTicker = new Map();
     const waterxEnvelopeByTicker = new Map();
     for (const [i, group] of groups.entries()) {
         const data = dataByGroup[i] ?? null;
@@ -319,12 +329,45 @@ export async function refreshOraclePrices(tx, host, tickers, opts = {}) {
                 break;
             case "waterx_rule": {
                 // waterx_rule emits no shared handle (verify+feed is bundled into the
-                // per-ticker `collect_batch_latest`), so the envelope is carried
-                // straight from this group's fetched data to the feed leg below.
-                const envelope = waterxEnvelopeOf(data);
-                if (envelope) {
-                    for (const ticker of group.tickers)
-                        waterxEnvelopeByTicker.set(ticker, envelope);
+                // per-ticker collect call), so the signed data is carried straight from
+                // this group's fetched data to the feed leg below. Leaves are per-symbol
+                // and indexed BY symbol — never fanned out across the group like the
+                // envelope, since each leaf only verifies for its own symbol
+                // (`ECollectorSymbolMismatch`). A leaf for a symbol outside this group is
+                // dropped rather than carried: the feed leg is keyed by ticker anyway.
+                const leaves = waterxLeavesOf(data);
+                // `length > 0` matters: `{ leaves: [] }` is shape-valid (`[].every(...)`
+                // is `true`), so a bare truthiness test would TAKE this branch, carry
+                // nothing, and `break` past the envelope branch below.
+                if (leaves && leaves.length > 0) {
+                    const served = new Set(group.tickers);
+                    for (const leaf of leaves) {
+                        if (served.has(leaf.symbol))
+                            waterxLeafByTicker.set(leaf.symbol, leaf);
+                    }
+                }
+                else {
+                    const envelope = waterxEnvelopeOf(data);
+                    if (envelope) {
+                        for (const ticker of group.tickers)
+                            waterxEnvelopeByTicker.set(ticker, envelope);
+                    }
+                }
+                // Fail the BUILD, not the chain. Both suppliers of `data` already
+                // guarantee full coverage — the live fetch through `assertCoverage`, a
+                // cached payload through `narrowUpdateData` (which returns `null`, i.e.
+                // "miss → live fetch", rather than a partial) — so reaching here with a
+                // ticker uncarried means one of those invariants broke. Left alone it
+                // emits a collector with no waterx leg, which surfaces MUCH later as an
+                // opaque on-chain `EMissingPriceSource` (or, if the rule is unweighted
+                // for that ticker, as a silently thinner weighted set). This names the
+                // tickers instead.
+                const uncarried = group.tickers.filter((t) => !waterxLeafByTicker.has(t) && !waterxEnvelopeByTicker.has(t));
+                if (uncarried.length > 0) {
+                    throw new Error(`waterx_rule update data carries no signed price for ticker(s): ${uncarried.join(", ")}. ` +
+                        "Expected one signed leaf per ticker (or a batch envelope covering all of " +
+                        "them) — a payload that serves none of a group's tickers must be reported " +
+                        "as a miss, not fed.");
                 }
                 break;
             }
@@ -340,6 +383,7 @@ export async function refreshOraclePrices(tx, host, tickers, opts = {}) {
             ticker,
             priceInfoObjectId: priceInfoByTicker.get(ticker),
             lazerUpdate: lazerUpdateByTicker.get(ticker),
+            waterxLeaf: waterxLeafByTicker.get(ticker),
             waterxEnvelope: waterxEnvelopeByTicker.get(ticker),
         });
     }