JSON-RPC sunset (2026-07-31): `SuiPythClient` is built on the public fullnode — price updates for non-`pythSponsored` markets will break `withdraw()`/`borrow()`

[arcadeJHS]

Hi!
I'm running supply/withdraw on AlphaLend mainnet via @alphafi/alphalend-sdk (reads on GraphQL, build/sign on gRPC).

Both 3.0.1 and 3.0.2 construct a SuiJsonRpcClient on https://fullnode.mainnet.sui.io/ for SuiPythClient (src/core/client.ts, L117–127 — the constructor comment already notes it's the one remaining JSON-RPC usage; understandable, since every published @pythnetwork/pyth-sui-js is JSON-RPC-only — the latest, 3.0.0, still depends on @mysten/sui@^1.3).

withdraw() (likewise borrow()/claimRewards()/liquidate()) always calls updatePrices(), and for any coin whose metadata is not flagged pythSponsored that routes through SuiPythClient.updatePriceFeeds → the public fullnode.
Probing the live coin metadata today, 9 of 33 mainnet markets are non-sponsored (ALPHA, ALKIMI, SUI_USDE, EBTC, EXBTC, ESUI, EGUSDC, EWAL, ETHIRD).
With mainnet public JSON-RPC endpoints starting to shut down the week of 2026-07-20 (protocol deactivation 07-31), if I understand correctly those markets' withdraw/borrow paths will start failing then.
Sponsored coins (SUI, USDC, …) currently skip the Pyth client entirely — though the coin-metadata fallback defaults pythSponsored: false, so a metadata regression would send every coin down the JSON-RPC path.
supply() (price-update-free) keeps working either way.

Questions:

1. Is a Pyth/JSON-RPC-free price path planned before 2026-07-20? Is PR feat: add Pyth Lazer as an opt-in price source #155 (Pyth Lazer, verify-in-PTB — which looks fullnode-free) the intended replacement, and will it cover the currently non-sponsored markets?

2. Will it ship as a 3.0.x on npm?

3. Separately: 3.0.2 switched withdraw/borrow/claim output delivery from returned coin objects to crediting the sender's address balance via 0x2::coin::send_funds (sendCoinToAddressBalance in src/models/blockchain.ts). Could you document the consumer-side requirements for that (minimum @mysten/sui for balance reads + coin selection over accumulator funds)? Recent @mysten/sui resolves coinWithBalance via FundsWithdrawal/redeem_funds, but apps reading plain coin-object balances may not see the withdrawn funds.

Thanks!

[jangid]

⏰ Escalation — hard external deadline 2026-07-31 (11 days out), still unowned/unlabelled

Surfacing this from today's ops sweep as a top-priority item. SuiPythClient is built on the public fullnode JSON-RPC, which sunsets 2026-07-31. When it goes, withdraw() / borrow() price updates break for every non-pythSponsored market — a user-facing funds-access outage, not a cosmetic break.

Needs, in order:

1. An owner + label now (bug, priority) — 11 days is tight for anything touching the price-update path.
2. Confirm the blast radius: enumerate which live markets are non-pythSponsored today (those are the ones that break), so we know whether this is "a few long-tail markets" or "the core set".
3. Migration target: move SuiPythClient off JSON-RPC onto the gRPC / GraphQL full-node API (or the sponsored-update path where available). This likely overlaps the in-flight Pyth Lazer / Pyth-Core work (alphalend-contracts#151, alphalend-sdk-rust#207) — worth checking whether the Lazer proxy path removes the JSON-RPC dependency for these markets outright, which could make this fall out of that migration rather than a separate fix.

If it can't land safely by 2026-07-31, we need a decision on a stopgap (e.g. temporarily marking affected markets sponsored, or pinning a fallback RPC) before the cutover, not after.