@waterx/sdk 4.3.2 → 5.0.0

package/dist/cjs/src/oracle/source-list.d.ts

@@ -1,36 +1,40 @@
 /**
- * `source-list.ts` — THE parser for a consumer's `ORACLE_SOURCE` env string
- * (comma list of `OracleSource` values → the fed set). The FE and BE
- * previously carried twin hand-written parsers whose semantics drifted once
- * in review (a trailing comma booted one deployment green and 500'd the
- * other); this canonical behavior is what both fold onto:
+ * `source-list.ts` — THE fed set, derived from the deployment config.
  *
- *  - split on `,`, trim entries, DROP empties (trailing/doubled commas are
- *    the most common env typo, never a boot failure)
- *  - validate every entry against {@link ORACLE_SOURCES}
- *  - dedupe, order-preserving (list order is consumer read-plane policy —
- *    the SDK's own fed-set build treats the list as a set)
- *  - throw an operator-actionable error on empty/unset/invalid input —
- *    there is NO default oracle source
+ * There is no `oracleSource` option and no `ORACLE_SOURCE` env var. Which
+ * sources a build feeds is a property of the DEPLOYMENT, so it is read from
+ * the same canonical JSON that carries their packages and feeds: a source is
+ * in the fed set when its block is published AND carries at least one feed.
  *
- * The SDK still never reads `process.env` — callers pass the raw string.
+ * Why derived rather than declared. The chain arbitrates — per-ticker weights
+ * decide which contributions count, feeding an UNWEIGHTED rule is dropped
+ * on-chain, and starving a WEIGHTED one aborts `EMissingPriceSource`. The
+ * failure is therefore one-sided: over-feeding is free, under-feeding is fatal.
+ * A hand-typed list errs in the fatal direction (the classic being one copied
+ * between networks, naming a source that deployment does not carry); the
+ * config cannot, because it IS what wires the rules. Mainnet derives
+ * `[pyth_lazer_rule, waterx_rule]` and testnet `[waterx_rule]` with no
+ * per-deployment configuration at all.
  *
- * STRICTER than the consumers' previous `in`-operator checks: a value named
- * like an `Object.prototype` key (`toString`, `constructor`, …) passed those
- * and died deep in the stack; `Set.has` rejects it here at parse.
+ * Retired rules are inert here by construction: `pyth_rule` and
+ * `pyth_sponsor_rule` still sit in the live configs, but neither is an
+ * {@link ORACLE_SOURCES} member — there is no rule module that could feed one
+ * — so their blocks are never consulted.
  *
- * Zod adopters: this THROWS a plain Error. Inside a zod `.transform()` a
- * throw escapes `schema.parse()` un-aggregated and masks sibling issues —
- * wrap it: `try { return parseOracleSourceList(raw); } catch (e) {
- * ctx.addIssue({ code: "custom", message: (e as Error).message }); return
- * z.NEVER; }`.
+ * Deliberately NOT filtered by which credentials the caller holds. A keyless
+ * client whose config wires Lazer fails loudly at build
+ * (`LazerApiKeyMissing`); silently dropping the source instead would starve a
+ * rule the chain may weight and turn a clear build error into an opaque
+ * on-chain abort.
  */
+import type { OracleConfig } from "./config.ts";
 import { type OracleSource } from "./price-update-rule.ts";
 /**
- * THE runtime membership check for {@link ORACLE_SOURCES} — the parser below
- * and `PerpClient`'s ctor validation both use this one predicate, so the env
- * parser and the create-option front door can never disagree. `Set.has`,
- * never `in`/bracket reads (prototype-chain safe by construction).
+ * The fed set this deployment wires: every implementable source with a
+ * published package and a non-empty feeds map, in {@link ORACLE_SOURCES}
+ * order.
+ *
+ * Pure and config-only, so consumers can call it before a client exists (e.g.
+ * to pair with {@link missingOracleCredentials} in a boot assert).
  */
-export declare function isOracleSource(value: string): value is OracleSource;
-export declare function parseOracleSourceList(raw: string | null | undefined): OracleSource[];
+export declare function deriveOracleSources(config: OracleConfig): OracleSource[];

package/dist/cjs/src/oracle/source-list.js

@@ -1,57 +1,55 @@
 "use strict";
 /**
- * `source-list.ts` — THE parser for a consumer's `ORACLE_SOURCE` env string
- * (comma list of `OracleSource` values → the fed set). The FE and BE
- * previously carried twin hand-written parsers whose semantics drifted once
- * in review (a trailing comma booted one deployment green and 500'd the
- * other); this canonical behavior is what both fold onto:
+ * `source-list.ts` — THE fed set, derived from the deployment config.
  *
- *  - split on `,`, trim entries, DROP empties (trailing/doubled commas are
- *    the most common env typo, never a boot failure)
- *  - validate every entry against {@link ORACLE_SOURCES}
- *  - dedupe, order-preserving (list order is consumer read-plane policy —
- *    the SDK's own fed-set build treats the list as a set)
- *  - throw an operator-actionable error on empty/unset/invalid input —
- *    there is NO default oracle source
+ * There is no `oracleSource` option and no `ORACLE_SOURCE` env var. Which
+ * sources a build feeds is a property of the DEPLOYMENT, so it is read from
+ * the same canonical JSON that carries their packages and feeds: a source is
+ * in the fed set when its block is published AND carries at least one feed.
  *
- * The SDK still never reads `process.env` — callers pass the raw string.
+ * Why derived rather than declared. The chain arbitrates — per-ticker weights
+ * decide which contributions count, feeding an UNWEIGHTED rule is dropped
+ * on-chain, and starving a WEIGHTED one aborts `EMissingPriceSource`. The
+ * failure is therefore one-sided: over-feeding is free, under-feeding is fatal.
+ * A hand-typed list errs in the fatal direction (the classic being one copied
+ * between networks, naming a source that deployment does not carry); the
+ * config cannot, because it IS what wires the rules. Mainnet derives
+ * `[pyth_lazer_rule, waterx_rule]` and testnet `[waterx_rule]` with no
+ * per-deployment configuration at all.
  *
- * STRICTER than the consumers' previous `in`-operator checks: a value named
- * like an `Object.prototype` key (`toString`, `constructor`, …) passed those
- * and died deep in the stack; `Set.has` rejects it here at parse.
+ * Retired rules are inert here by construction: `pyth_rule` and
+ * `pyth_sponsor_rule` still sit in the live configs, but neither is an
+ * {@link ORACLE_SOURCES} member — there is no rule module that could feed one
+ * — so their blocks are never consulted.
  *
- * Zod adopters: this THROWS a plain Error. Inside a zod `.transform()` a
- * throw escapes `schema.parse()` un-aggregated and masks sibling issues —
- * wrap it: `try { return parseOracleSourceList(raw); } catch (e) {
- * ctx.addIssue({ code: "custom", message: (e as Error).message }); return
- * z.NEVER; }`.
+ * Deliberately NOT filtered by which credentials the caller holds. A keyless
+ * client whose config wires Lazer fails loudly at build
+ * (`LazerApiKeyMissing`); silently dropping the source instead would starve a
+ * rule the chain may weight and turn a clear build error into an opaque
+ * on-chain abort.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isOracleSource = isOracleSource;
-exports.parseOracleSourceList = parseOracleSourceList;
+exports.deriveOracleSources = deriveOracleSources;
 const price_update_rule_ts_1 = require("./price-update-rule.js");
-// Widened-annotation Set (not an assertion) so the type predicate below
-// narrows by CONSTRUCTION rather than by cast.
-const ORACLE_SOURCE_SET = new Set(price_update_rule_ts_1.ORACLE_SOURCES);
 /**
- * THE runtime membership check for {@link ORACLE_SOURCES} — the parser below
- * and `PerpClient`'s ctor validation both use this one predicate, so the env
- * parser and the create-option front door can never disagree. `Set.has`,
- * never `in`/bracket reads (prototype-chain safe by construction).
+ * The fed set this deployment wires: every implementable source with a
+ * published package and a non-empty feeds map, in {@link ORACLE_SOURCES}
+ * order.
+ *
+ * Pure and config-only, so consumers can call it before a client exists (e.g.
+ * to pair with {@link missingOracleCredentials} in a boot assert).
  */
-function isOracleSource(value) {
-    return ORACLE_SOURCE_SET.has(value);
-}
-function parseOracleSourceList(raw) {
-    const parts = (raw ?? "")
-        .split(",")
-        .map((part) => part.trim())
-        .filter((part) => part !== "");
-    const sources = parts.filter(isOracleSource);
-    if (parts.length === 0 || sources.length !== parts.length) {
-        const got = raw == null || raw.trim() === "" ? "unset" : `'${raw}'`;
-        throw new Error(`ORACLE_SOURCE must be a comma-separated list of ${price_update_rule_ts_1.ORACLE_SOURCES.join(" | ")} ` +
-            `(got ${got}) — there is NO default oracle source; set it in the deployment's env.`);
-    }
-    return [...new Set(sources)];
+function deriveOracleSources(config) {
+    return price_update_rule_ts_1.ORACLE_SOURCES.filter((source) => {
+        const block = config.packages[source];
+        if (!block?.published_at || Object.keys(block.feeds ?? {}).length === 0)
+            return false;
+        // `enabled` is the one lever the schema offers for switching a source off,
+        // and with routing derived from config it is the ONLY lever left — so it
+        // is honoured here. Absent means ON: every live config omits it, and a
+        // published block with feeds is a wired source. (`supra_rule` is
+        // default-OFF and requires an explicit `true` — it is an auxiliary leg,
+        // not a source, so the asymmetry is deliberate.)
+        return block.enabled !== false;
+    });
 }

package/dist/cjs/src/oracle/symbol-catalog.d.ts

@@ -0,0 +1,54 @@
+/**
+ * `symbol-catalog.ts` — the Pyth Pro symbol catalog (`GET /v1/symbols`):
+ * every Lazer feed's integer id, its legacy Hermes hex id, its
+ * fully-qualified reference symbol (`Crypto.BTC/USD`, `Equity.US.AAPL/USD`),
+ * its `schedule` string (same grammar `parsePythSchedule` implements), asset
+ * type, state, and fastest channel. This replaces the retired Hermes
+ * `/v2/price_feeds` catalog for BOTH of its jobs: the schedule catalog for
+ * market hours AND the hex↔integer feed-id map.
+ *
+ * KEYLESS — the catalog read requires no Bearer (probed 2026-08-19), so
+ * schedule consumers need no credential. It is also BIG (~4.6MB, ~3.6k
+ * records), hence the generous default timeout; consumers cache the result
+ * (BE service interval-refreshes; FE route caches) rather than fetch per
+ * request.
+ */
+import { type FetchPolicy } from "./update-fetch.ts";
+/**
+ * The Pyth Pro API base every Pro read surface hangs off — the catalog here
+ * and the chart history in `pyth-pro-history.ts`, which imports this. ONE
+ * declaration, mirroring the rule-owned `LAZER_INFRA` / `WATERX_INFRA`
+ * pattern: a Pro host change is a single edit.
+ */
+export declare const PYTH_PRO_API_ENDPOINT = "https://pyth.dourolabs.app";
+/**
+ * One `/v1/symbols` record (the fields consumers key off; extra wire fields
+ * are dropped, not preserved).
+ */
+export type PythSymbolRecord = {
+    /** Integer Lazer feed id — the `pyth_lazer_rule.feeds` id scheme. */
+    pyth_lazer_id: number;
+    /** Legacy Hermes hex feed id, or null for Lazer-only feeds. */
+    hermes_id: string | null;
+    /** Fully-qualified reference symbol, e.g. `Crypto.BTC/USD` — the join key consumers map tickers onto. */
+    symbol: string;
+    /** Pyth market-hours grammar string (absent for some 24/7 feeds). */
+    schedule?: string;
+    /** e.g. `"crypto"`, `"equity"`, `"fx"`, `"metal"`. */
+    asset_type: string;
+    /** Feed lifecycle state (e.g. `"stable"`). */
+    state: string;
+    /** Fastest channel the feed publishes (e.g. `"real_time"`, `"fixed_rate@200ms"`). */
+    min_channel?: string;
+};
+/**
+ * Fetch the full symbol catalog. Returns records with a numeric
+ * `pyth_lazer_id` and a string `symbol`; other fields pass through as-is
+ * (missing → undefined/null per the type). Throws on non-2xx or a non-array
+ * body. `opts.fetch` overrides the retry/timeout policy (and `fetchImpl` for
+ * tests); the default budget is deliberately generous — see the module
+ * header.
+ */
+export declare function fetchPythSymbolCatalog(opts?: {
+    fetch?: FetchPolicy;
+}): Promise<PythSymbolRecord[]>;

package/dist/cjs/src/oracle/symbol-catalog.js

@@ -0,0 +1,69 @@
+"use strict";
+/**
+ * `symbol-catalog.ts` — the Pyth Pro symbol catalog (`GET /v1/symbols`):
+ * every Lazer feed's integer id, its legacy Hermes hex id, its
+ * fully-qualified reference symbol (`Crypto.BTC/USD`, `Equity.US.AAPL/USD`),
+ * its `schedule` string (same grammar `parsePythSchedule` implements), asset
+ * type, state, and fastest channel. This replaces the retired Hermes
+ * `/v2/price_feeds` catalog for BOTH of its jobs: the schedule catalog for
+ * market hours AND the hex↔integer feed-id map.
+ *
+ * KEYLESS — the catalog read requires no Bearer (probed 2026-08-19), so
+ * schedule consumers need no credential. It is also BIG (~4.6MB, ~3.6k
+ * records), hence the generous default timeout; consumers cache the result
+ * (BE service interval-refreshes; FE route caches) rather than fetch per
+ * request.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PYTH_PRO_API_ENDPOINT = void 0;
+exports.fetchPythSymbolCatalog = fetchPythSymbolCatalog;
+const update_fetch_ts_1 = require("./update-fetch.js");
+/**
+ * The Pyth Pro API base every Pro read surface hangs off — the catalog here
+ * and the chart history in `pyth-pro-history.ts`, which imports this. ONE
+ * declaration, mirroring the rule-owned `LAZER_INFRA` / `WATERX_INFRA`
+ * pattern: a Pro host change is a single edit.
+ */
+exports.PYTH_PRO_API_ENDPOINT = "https://pyth.dourolabs.app";
+/** ~4.6MB body — a money-path 15s budget is too tight on slow links. */
+const CATALOG_TIMEOUT_MS = 60_000;
+/**
+ * Fetch the full symbol catalog. Returns records with a numeric
+ * `pyth_lazer_id` and a string `symbol`; other fields pass through as-is
+ * (missing → undefined/null per the type). Throws on non-2xx or a non-array
+ * body. `opts.fetch` overrides the retry/timeout policy (and `fetchImpl` for
+ * tests); the default budget is deliberately generous — see the module
+ * header.
+ */
+async function fetchPythSymbolCatalog(opts) {
+    const url = (0, update_fetch_ts_1.joinEndpointPath)(exports.PYTH_PRO_API_ENDPOINT, "v1/symbols");
+    // Same ordering hazard as the history reader: spreading the caller's policy
+    // over the default let `{ timeoutMs: undefined }` revert the deliberately
+    // generous catalog budget to the 15s money-path default, which this ~4.6MB
+    // body does not fit. An explicit value still wins; absence does not.
+    const res = await (0, update_fetch_ts_1.fetchWithPolicy)(url.toString(), {}, { ...opts?.fetch, timeoutMs: opts?.fetch?.timeoutMs ?? CATALOG_TIMEOUT_MS });
+    if (!res.ok) {
+        throw new Error(`Pyth symbol catalog fetch failed: ${res.status} ${await res.text()}`);
+    }
+    const json = (await res.json());
+    if (!Array.isArray(json)) {
+        throw new Error("Pyth symbol catalog returned a non-array body");
+    }
+    const records = [];
+    for (const raw of json) {
+        // Tolerant per-record gate: one malformed row must not sink the ~3.6k
+        // others (mirrors the schedule parser's skip-a-bad-feed posture).
+        if (typeof raw?.pyth_lazer_id !== "number" || typeof raw.symbol !== "string")
+            continue;
+        records.push({
+            pyth_lazer_id: raw.pyth_lazer_id,
+            hermes_id: typeof raw.hermes_id === "string" ? raw.hermes_id : null,
+            symbol: raw.symbol,
+            ...(typeof raw.schedule === "string" ? { schedule: raw.schedule } : {}),
+            asset_type: typeof raw.asset_type === "string" ? raw.asset_type : "",
+            state: typeof raw.state === "string" ? raw.state : "",
+            ...(typeof raw.min_channel === "string" ? { min_channel: raw.min_channel } : {}),
+        });
+    }
+    return records;
+}

package/dist/cjs/src/oracle/update-fetch.d.ts

@@ -1,14 +1,13 @@
 /**
  * `fetchWithPolicy` — resilience wrapper around `fetch` for the oracle money
  * path's off-chain update-data fetches. Every order/position/collateral
- * tx-build depends on one of these REST calls landing (Hermes VAA for
- * `pyth_rule`, Lazer signed updates for `pyth_lazer_rule`); a bare `fetch`
- * with a single attempt and no retry means one Hermes 429/5xx or timeout
- * fails every trade. `fetchPriceFeedsUpdateData` (`./pyth.ts`),
- * `PythLazerRule.fetchUpdateData`'s Lazer POST (`./rules/pyth-lazer-rule.ts`),
- * and `loadConfig` (`../perp/config.ts`) all delegate here instead of calling
- * `fetch` directly — this is the ONE place a retry/timeout/auth policy is
- * implemented for these fetches.
+ * tx-build depends on one of these REST calls landing (the Lazer signed
+ * update for `pyth_lazer_rule`, the quote-center pull for `waterx_rule`); a
+ * bare `fetch` with a single attempt and no retry means one upstream 429/5xx
+ * or timeout fails every trade. Those two rule fetches, the read executors
+ * (`./read-prices.ts`), the Pyth Pro catalog/history readers, and `loadConfig`
+ * (`../perp/config.ts`) all delegate here instead of calling `fetch` directly
+ * — this is the ONE place a retry/timeout/auth policy is implemented.
  *
  * Policy semantics:
  * - Bearer auth is attached iff `policy.apiKey` is a non-empty string —
@@ -96,14 +95,11 @@ export declare function rethrowExhaustedFetch(err: unknown, describe: (err: Fetc
  * Join an API `path` onto an `endpoint` PRESERVING the endpoint's own base
  * path. `new URL(path, endpoint)` is the footgun this replaces: a
  * leading-slash path is *absolute* and silently discards the endpoint's path
- * — harmless for a bare-origin endpoint (`https://hermes.pyth.network`) but
- * it dropped the `/hermes` prefix of the Pyth Pro compat endpoint and 404'd
- * every feed (see `fetchPriceFeedsUpdateData`). Every oracle fetch that
- * targets `<endpoint><fixed path>` must build its URL here.
+ * — harmless for a bare-origin endpoint, but it is exactly what a consumer's
+ * `waterxEndpoint` proxy route (`https://app.example/api/quote-center`) is
+ * made of, and dropping it silently bypasses the proxy. Every oracle fetch
+ * that targets `<endpoint><fixed path>` must build its URL here.
  */
-/** One canonical trailing-slash trim — `joinEndpointPath` (URL building) and
- * `pyth.ts`'s `memoKey` (endpoint identity) must never drift apart on it. */
-export declare function trimTrailingSlashes(endpoint: string): string;
 export declare function joinEndpointPath(endpoint: string, path: string): URL;
 /**
  * `fetch` with per-attempt timeout, bounded retry + backoff, and optional

package/dist/cjs/src/oracle/update-fetch.js

@@ -2,14 +2,13 @@
 /**
  * `fetchWithPolicy` — resilience wrapper around `fetch` for the oracle money
  * path's off-chain update-data fetches. Every order/position/collateral
- * tx-build depends on one of these REST calls landing (Hermes VAA for
- * `pyth_rule`, Lazer signed updates for `pyth_lazer_rule`); a bare `fetch`
- * with a single attempt and no retry means one Hermes 429/5xx or timeout
- * fails every trade. `fetchPriceFeedsUpdateData` (`./pyth.ts`),
- * `PythLazerRule.fetchUpdateData`'s Lazer POST (`./rules/pyth-lazer-rule.ts`),
- * and `loadConfig` (`../perp/config.ts`) all delegate here instead of calling
- * `fetch` directly — this is the ONE place a retry/timeout/auth policy is
- * implemented for these fetches.
+ * tx-build depends on one of these REST calls landing (the Lazer signed
+ * update for `pyth_lazer_rule`, the quote-center pull for `waterx_rule`); a
+ * bare `fetch` with a single attempt and no retry means one upstream 429/5xx
+ * or timeout fails every trade. Those two rule fetches, the read executors
+ * (`./read-prices.ts`), the Pyth Pro catalog/history readers, and `loadConfig`
+ * (`../perp/config.ts`) all delegate here instead of calling `fetch` directly
+ * — this is the ONE place a retry/timeout/auth policy is implemented.
  *
  * Policy semantics:
  * - Bearer auth is attached iff `policy.apiKey` is a non-empty string —
@@ -56,7 +55,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FetchPolicyError = void 0;
 exports.rethrowExhaustedFetch = rethrowExhaustedFetch;
-exports.trimTrailingSlashes = trimTrailingSlashes;
 exports.joinEndpointPath = joinEndpointPath;
 exports.fetchWithPolicy = fetchWithPolicy;
 const DEFAULT_TIMEOUT_MS = 15_000;
@@ -106,18 +104,13 @@ function rethrowExhaustedFetch(err, describe) {
  * Join an API `path` onto an `endpoint` PRESERVING the endpoint's own base
  * path. `new URL(path, endpoint)` is the footgun this replaces: a
  * leading-slash path is *absolute* and silently discards the endpoint's path
- * — harmless for a bare-origin endpoint (`https://hermes.pyth.network`) but
- * it dropped the `/hermes` prefix of the Pyth Pro compat endpoint and 404'd
- * every feed (see `fetchPriceFeedsUpdateData`). Every oracle fetch that
- * targets `<endpoint><fixed path>` must build its URL here.
+ * — harmless for a bare-origin endpoint, but it is exactly what a consumer's
+ * `waterxEndpoint` proxy route (`https://app.example/api/quote-center`) is
+ * made of, and dropping it silently bypasses the proxy. Every oracle fetch
+ * that targets `<endpoint><fixed path>` must build its URL here.
  */
-/** One canonical trailing-slash trim — `joinEndpointPath` (URL building) and
- * `pyth.ts`'s `memoKey` (endpoint identity) must never drift apart on it. */
-function trimTrailingSlashes(endpoint) {
-    return endpoint.replace(/\/+$/, "");
-}
 function joinEndpointPath(endpoint, path) {
-    return new URL(`${trimTrailingSlashes(endpoint)}/${path.replace(/^\/+/, "")}`);
+    return new URL(`${endpoint.replace(/\/+$/, "")}/${path.replace(/^\/+/, "")}`);
 }
 function isRetryableStatus(status) {
     return status === 429 || status >= 500;

package/dist/cjs/src/oracle/validate.d.ts

@@ -0,0 +1,105 @@
+/**
+ * `validate.ts` — boot-time oracle-deployment asserts consumers (FE/BE) fold
+ * onto instead of each hand-rolling them:
+ *
+ * - {@link assertOracleWriteCoverage} — the "this fed set can actually price
+ *   the tickers I care about" guard. Because every source reads through its
+ *   own feeds namespace, write set == read set — passing this ALSO validates
+ *   the read plane (there is deliberately no separate read-coverage assert).
+ * - {@link missingOracleCredentials} — the env-shaped credential audit: which
+ *   listed sources cannot run with the credentials this deployment supplied.
+ *   Boot-time mirror of `refreshOraclePrices`'s own per-build credential
+ *   pre-check (`aggregate.ts`), keyed off the same rule-owned
+ *   `credential` declaration so the two can never disagree.
+ *
+ * Deliberately NOT called by `PerpClient` itself: client creation stays
+ * guard-free (a source with absent feeds surfaces at tx-build for exactly the
+ * tickers it can't serve). These are for consumers whose deployment policy is
+ * "fail the BOOT, not the first trade".
+ */
+import type { OracleHost } from "./host.ts";
+import { type OracleCredentialKind, type OracleSource } from "./price-update-rule.ts";
+export type { OracleCredentialKind };
+/**
+ * A build depends on a ticker this client's fed set cannot price.
+ *
+ * Raised from two places, deliberately the same type: the per-BUILD composers
+ * (`refreshOraclePrices` skipped the ticker by design — see
+ * `OracleRefreshSummary` — and the composer decided it was load-bearing for
+ * the action) and the boot-time {@link assertOracleWriteCoverage}. One error
+ * for one question: "this fed set cannot price these tickers".
+ */
+export declare class OracleTickerUnservedError extends Error {
+    readonly tickers: string[];
+    readonly sources: readonly string[];
+    constructor(tickers: string[], sources: readonly string[], why?: string);
+}
+/**
+ * Assert this deployment's fed set can price every ticker in `tickers`.
+ *
+ * Throws {@link OracleTickerUnservedError} naming ALL the unservable ones (not
+ * just the first — an operator fixing a config wants the whole list).
+ *
+ * This is the boot-time twin of the per-build behaviour, and it guards the gap
+ * that per-build handling deliberately leaves open: `refreshOraclePrices`
+ * SKIPS a ticker no source serves, and only a composer that happens to depend
+ * on that ticker turns the skip into an error. A market nobody trades today
+ * would therefore stay silently unpriceable until someone did. Pass the ticker
+ * set your deployment cares about (typically every market) and find out at
+ * boot instead.
+ *
+ * It does NOT check "every listed source has feeds" any more: the fed set is
+ * derived from exactly that condition (see `deriveOracleSources`), so that
+ * assert became unreachable for any real client — it could only fire for a
+ * config mutated after construction, which is a test fixture, not a
+ * deployment. Write set == read set by construction (each source reads its own
+ * feeds), so this single assert still covers both planes.
+ */
+export declare function assertOracleWriteCoverage(host: OracleHost, tickers: readonly string[]): void;
+/**
+ * THE acceptance predicate, in partition form — the single definition of
+ * "will `refreshOraclePrices` put a price on chain for this ticker".
+ *
+ * A ticker is servable when some LISTED source's feeds carry it, or when it is
+ * CONSTANT-ONLY: `constant_rule` pins it and no other rule in the config feeds
+ * it. The stricter constant test matters — a constant-pinned ticker that some
+ * other rule also feeds gets aggregated from a constant-only collector, and if
+ * the chain weights that other rule the aggregate aborts `EMissingPriceSource`.
+ * (`aggregateTicker` only appends a supra leg when a price-update source
+ * already fed the collector, so a constant-only collector can never carry one.)
+ *
+ * `covered` lets a caller that has ALREADY resolved which of its tickers its
+ * fed set serves — `refreshOraclePrices`, off its rule groups — pass that in
+ * rather than have it recomputed. Both callers therefore share one rule, which
+ * is the point: a consumer pre-filtering with {@link servableTickers} cannot
+ * hand the build a ticker it will silently skip.
+ *
+ * Order-preserving. The `anyFeed` set is built at most once per call, and only
+ * when a constant-pinned ticker actually needs it.
+ */
+export declare function partitionServableTickers(host: OracleHost, tickers: readonly string[], covered?: ReadonlySet<string>): {
+    servable: string[];
+    unservable: string[];
+};
+/**
+ * The subset of `tickers` this deployment's fed set can actually price — the
+ * servable half of {@link partitionServableTickers}, which is literally the
+ * rule `refreshOraclePrices` applies.
+ */
+export declare function servableTickers(host: OracleHost, tickers: readonly string[]): string[];
+/**
+ * Which of `sources` cannot run with the supplied credentials — one row per
+ * (source, missing credential). Empty array ⇒ the fed set is fully
+ * credentialed. Pure and env-shaped on purpose: consumers call it from their
+ * boot-time env asserts (zod superRefine, config validators) BEFORE any
+ * client exists, passing the raw values their env resolved. The per-build
+ * enforcement twin — `refreshOraclePrices`'s credential pre-check — reads the
+ * same rule-owned `credential` declaration, so a deployment this function passes
+ * cannot later trip that check for a listed source.
+ */
+export declare function missingOracleCredentials(sources: readonly OracleSource[], creds: {
+    pythApiKey?: string;
+}): {
+    source: OracleSource;
+    credential: OracleCredentialKind;
+}[];