feat(oracle): default price updates to Lazer

[preyam2002]

Summary

• remove the public useLazer client option
• route all price refreshes through the existing Lazer /lazer/update path
• fail closed when the Lazer proxy is unavailable instead of falling back to Pyth
• accept a caller-supplied signed Lazer payload: lazerUpdateBytes on every params interface that takes priceUpdateCoinTypes (plus FlashRepayParams), or as a third argument to updatePrices / updateAllPrices / updatePricesLazer; with it supplied, transaction building makes no request to the proxy, so a CORS-blocked browser or an API outage doesn't prevent transacting

Validation

• npm run build
• npm test (58 tests)
• npx eslint 'src/**/*.ts' '__tests__/**/*.ts'

Scope

No dependency or lockfile changes. API changes are additive only (optional param field + optional trailing argument).

[jangid]

operate.md full-sweep review — PR #164 (default price updates to Lazer, Pyth Lazer rollout). CI green (test/lint/build); mergeable but BEHIND (update from main required); approvals 0/2. No prior reviews to dedup against.

Cutover verified: no functional useLazer references remain (only a stale comment at devConstants.ts:75), Pyth imports cleanly dropped from client.ts, fail-closed confirmed (fetchLazerUpdateBytes propagates proxy errors with no Pyth fallback). No new any; TS strict preserved.

Findings:

• 🟡 Testnet/devnet now unconditionally route through Lazer, contradicting a retained comment. devConstants.ts:74-75 vs client.ts:189-195: the kept comment states the testnet v1 Lazer package lacks parse_and_verify_le_ecdsa_update_v2 so "the verify call won't resolve on testnet." Removing useLazer deletes the exact guard that comment says to keep. Testnet/devnet price-update txs will build but abort on-chain; mainnet is unaffected. Please confirm: intended (then fix the contradictory comment) or a testnet guard is required.
• 🟢 client.ts:189-195 — updatePrices and updateAllPrices now have identical bodies; consider consolidating/documenting.
• 🟢 oracle.ts:35,100 — getPriceInfoObjectIdsWithUpdate / updatePriceTransaction are no longer used by production code (tests/commented only).
• 🟢 Test gap — the deleted "no premature cutover" suite wasn't replaced with a positive assertion that the new default routes to Lazer across networks.

Recommendation: hold merge — update the branch (BEHIND), obtain 2 approvals, and confirm the testnet Lazer behavior above. No prod-mainnet correctness blocker in the code itself.

[preyam2002]

@claude review

[jangid]

operate.md review — alphalend-sdk-js#164 (2026-08-02)

Re-derived against HEAD 2026-07-27. CI green (3 contexts). MERGEABLE / BLOCKED. Approvals 1/2 — 11felix approved 2026-08-01T11:16Z, after HEAD, so it is current.

Supersedes my 2026-07-23 comment on this PR. (That one carried its marker on the last line rather than the first, so it isn't locatable for in-place update; this comment has it first and is the one future runs will maintain.)

✅ My 2026-07-23 🟡 is resolved — verified at every call site, not just the one I was looking at

The finding was that removing useLazer left testnet/devnet unconditionally routed through Lazer, contradicting the retained note that the testnet package is v1 and lacks parse_and_verify_le_ecdsa_update_v2.

A network guard now exists, and I enumerated every price-refresh call site in src/core/client.ts rather than confirming the first one:

:584  if (this.network === "mainnet") { await this.updatePrices(…) } else { await setPrices(tx) }
:697  same shape
:855  same shape
:1179 this.network === "mainnet" && … → this.updatePrices(…)
:1445 this.network === "mainnet" && … ? this.updatePrices(…)
:1604 if (this.network === "mainnet") { updateAllPrices(…) / updatePrices(…) } else { setPrices(tx) }

updatePrices / updateAllPrices (:193, :201) have no other callers, and setPrices(tx) is the non-mainnet path at every branch. Testnet and devnet never reach appendLazerUpdate, so the on-chain abort I flagged cannot occur. Closed.

✅ The deploy prerequisite is satisfied — the Lazer proxy is live

This PR fails closed when the proxy is unreachable (fetchLazerUpdateBytes propagates, no Pyth fallback), so its safety depends on alphalend-api's /lazer/* routes actually being mounted — they are absent entirely unless the access token is configured. Verified against production this run:

GET https://api.alphalend.xyz/lazer/prices  → HTTP 200, 3 833 bytes, live quotes
GET https://api.alphalend.xyz/lazer/update  → HTTP 200

Real data, current publish times. The route also appears in the service's own metrics inventory. So the proxy is deployed and configured; merging this does not strand mainnet price refreshes.

Findings

• 🟢 Stale comment, now doubly so — src/constants/devConstants.ts:73-75 still reads "keep useLazer off here until Pyth ships a v2 testnet package". useLazer no longer exists, and the guard is now by network, not by that flag. One-line cleanup.
• 🟢 Carried from the prior pass, unchanged and non-blocking: updatePrices / updateAllPrices bodies are near-identical (:193, :201); oracle.ts getPriceInfoObjectIdsWithUpdate / updatePriceTransaction are no longer used by production code.

Nothing blocking.

Approving. Approvals: 2/2 after this one — merge-ready.

[jangid]

operate.md: clean — CI green. My 2026-07-23 finding (testnet/devnet unconditionally routed through Lazer) is resolved: I enumerated every price-refresh call site in client.ts (:584, :697, :855, :1179, :1445, :1604) and all six are network-guarded with setPrices() on the non-mainnet branch, and updatePrices/updateAllPrices have no other callers. Also verified the fail-closed dependency is satisfied — api.alphalend.xyz/lazer/prices and /lazer/update both return 200 with live data in production. Remaining items are 🟢 cosmetic (the stale useLazer comment at devConstants.ts:73-75). Approvals: 2/2 — merge-ready.