chore: bump oracle package id to 0x869b2d4, prune unused dev deps

[11felix]

Updates ALPHAFI_LATEST_ORACLE_PACKAGE_ID in prodConstants to the newly published oracle package, and prunes unused devDependencies (babel-loader, eslint prettier/react plugins; adds node-cron, prettier) with the matching lockfile shrink. Companion PRs in alphalend-contracts, alphalend-sdk-rust, and alphafi-multisig.

[jangid]

operate.md review — oracle package-id bump (SDK side)

Re-derived this run against current HEAD. CI green. MERGEABLE / BLOCKED (pending second review, not a conflict).

The on-chain read gate is already cleared — this PR carries no deploy prerequisite

The companion review on alphalend-contracts#159 flagged that off-chain readers must not be repointed to 0x869b2d44… until update_version has run, because verify_version_read (alphafi_oracle/sources/oracle.move:580-584) aborts ErrReadVersionMismatch while the read_version dynamic field is absent — and unlike verify_version, the read path holds &Oracle and cannot self-migrate.

That gate is satisfied on mainnet already. Querying Oracle 0xce4ca140…db6b096 directly over mainnet GraphQL returns all 6 dynamic fields, including:

field name (base64 → decoded)	type	value
dmVyc2lvbg== → version	u64	1
cmVhZF92ZXJzaW9u → read_version	u64	1
key 2	0x869b2d44…d72d25::oracle::OracleLazer	—

• verify_version_read passes: read_version exists and 1 <= CURRENT_READ_VERSION (oracle.move:89).
• verify_version passes: version = 1 == CURRENT_VERSION (oracle.move:77).
• The OracleLazer source is already typed at 0x869b2d44…, so the new package has been executed against this object, not merely published.

get_price_info through the new package therefore works today. No multisig transaction needs to precede this merge.

Cross-repo completeness

0x7671937b…f19fd4 survives in exactly three files org-wide, covered one-to-one by alphalend-contracts#159, alphalend-sdk-rust#217, and alphalend-sdk-js#170; alphafi-multisig already carries the new id on main. Every downstream consumer (alphalend-ws, alphalend-api, alphalend-liquidator, alphalend-data-sdk, alphafi-sdk-rust, alphafi-fe) takes both SDKs as path/file: dependencies, so propagation is by submodule bump + image build — no npm publish step to forget. The type-origin constant 0x378b2a10… is correctly untouched; Published.toml confirms the same lineage at version = 5.

devDependency churn — checked, all legitimate

The body says "prunes unused devDeps"; the diff also adds two. Both are real, not bloat:

• node-cron@^4.6.0 — imported by scripts/updatePriceScript.ts:1 (import cron from "node-cron"), i.e. it was a missing devDep the script depended on transitively.
• prettier@^3.9.6 — the direct binary, replacing the removed eslint-config-prettier / eslint-plugin-prettier wrappers.

Removed (babel-loader, the two prettier ESLint plugins, eslint-plugin-react) have zero import sites in the repo. Lockfile shrink matches. lint/test/build all SUCCESS on this HEAD.

The test-file migration off SuiJsonRpcClient to SuiGraphQLClient is a necessary consequence of JSON-RPC being withdrawn from public fullnodes, and the rewrite correctly handles the MoveValue/MoveObject union plus cursor pagination — the old code only ever read getDynamicFields' first page.

Findings

None blocking.

Approving. Approvals: 2/2 after this one — merge-ready. Merge the three companion PRs together so no repo is left pointing at the retired id.

[jangid]

operate.md: clean — CI green (build/lint/test SUCCESS). Read-path version gate already satisfied on mainnet, so no multisig prerequisite. devDep churn checked: node-cron is genuinely used by scripts/updatePriceScript.ts and prettier replaces the removed ESLint wrappers — additions are legitimate, removals have no import sites. Approvals: 2/2 — merge-ready; land with the two companions.