gRPC auth support: grpcToken through coinHelpers and Blockchain (explicit transport)

[11felix]

Consolidates #174 into this PR (same body of work — #174 is closed in its favor; its commits are included here).

What this adds:

• getCoinObjectCounts / buildMergeCoinsTransaction take an optional grpcToken (alphafi-admin's merge flow needs it for BlockPI).
• AlphalendClientOptions gains grpcUrl/grpcToken, threaded into Blockchain, which now exposes a configured suiGrpcClient (mirrors alphafi-sdk-js#99). SDK reads stay on GraphQL — this is plumbing for consumers and future gRPC reads.

The critical part — explicit transport (Zorag44's blocking finding): SuiGrpcClient's convenience constructor forwards only baseUrl/fetchInit to the transport it builds and silently drops meta, so a client-level token is never sent. Both construction sites here build GrpcWebFetchTransport explicitly (@protobuf-ts/grpcweb-transport added as a direct dependency, ^2.11.1 matching @mysten/sui's own range). Also fixes the devnet-narrowing issue: network passes through unchanged.

Verified: 61/61 tests including __tests__/grpc-transport-auth.test.ts (pins defaultOptions.meta at both the Blockchain and AlphalendClient layers), plus live authenticated reads against BlockPI through the built AlphalendClient (client-level meta → Apikey not found; this shape → success). No behavior change when the options are omitted.

[Zorag44]

operate.md review — head 0af5ec8. Follow-up pass; my earlier review of 7b296e4 stays above unedited for the record, and both findings it raised are now closed.

✅ Both findings resolved

Re-derived against the current diff, not taken on the reply:

• Explicit transport, both construction sites. src/models/blockchain.ts:76-88 and the shared grpcClient helper at src/core/coinHelpers.ts:304-321. Threading reaches them at src/core/client.ts:111-116 (AlphalendClient → Blockchain) and src/core/coinHelpers.ts:82,141.
• 🟡 devnet fixed. network now passes through unchanged (src/models/blockchain.ts:83) with a comment recording why. GRPC_URL covers all three networks, so the client's label and its endpoint agree on devnet.
• Dependency declared — package.json:46 at ^2.11.1, matching @mysten/sui's own declared range; package-lock.json resolves a single hoisted 2.11.1, so there's no second transport implementation.
• Tested at both layers, and the test runs. __tests__/grpc-transport-auth.test.ts pins defaultOptions.meta at the Blockchain layer and through AlphalendClient, plus the absent-token case. Confirmed from the CI log for this head rather than inferred from a green tick: PASS __tests__/grpc-transport-auth.test.ts, Tests: 61 passed, 61 total.
• Empty-string tokens send no header — the conditional spread is falsy on ''.

The live A/B against BlockPI (Apikey not found → authenticated) also closes the gap I'd flagged on my own analysis: I had shown the header was absent, not what the provider does with an anonymous gRPC request.

🟢 Non-blocking

• The two remaining token-less new Blockchain(...) sites are correct, and I can confirm the reasoning rather than just accept it. src/core/coinHelpers.ts:125 is used only for the GraphQL address-balance read (getAddressBalance), while the gRPC work in the same function goes through the tokened grpcClient(network, grpcUrl, grpcToken) at :141 — so the gRPC path there is authenticated. src/models/lendingProtocol.ts:21 builds a client nothing reads (suiGrpcClient still has no in-repo consumers at this head). Deferring both to the "SDK reads move to gRPC" work is the right call; noting only that this PR's own doc comment is what will make that safe, since the next person wiring a gRPC read has to remember the token is per-Blockchain.
• Constructing an unread SuiGrpcClient plus transport on every Blockchain remains minor waste; the options-object consolidation you mention is the natural place to make it lazy.

One correction on the merge story

Your note says the base was retargeted and GitHub will retarget to main when #174 merges. Actual state: base is already main, #174 is CLOSED, and its head ff86d154 is an ancestor of 0af5ec89 — so #176 fully contains that work. No retarget is pending and no merge ordering is required; the threshold is the Protect Main Branch ruleset's 2. Flagging only so nobody waits on a dependency that isn't there.

CI green (test / lint / build). Not a contract PR. Approving — that takes this to 1/2, so it needs one more approval before merge.

Prior findings on this PR are resolved or deliberately deferred as noted; nothing remains open.

[11felix]

@Zorag44 Both findings confirmed and fixed in 0af5ec8.

🔴 meta dropped: reproduced per your method (constructor source + live A/B: client-level meta → Apikey not found, explicit transport → authenticated). Fixed with your suggested shape — explicit GrpcWebFetchTransport, baseUrl moved onto the transport, @protobuf-ts/grpcweb-transport as a direct dependency (^2.11.1, matching @mysten/sui's own range). End-to-end validated through the built AlphalendClient class against BlockPI with a real service key.

🟡 devnet narrowing: fixed — network passes through unchanged, with a comment explaining why (GRPC_URL covers all three networks; the mislabel would confuse network-keyed resolution like MVR).

🟢 On the non-blocking notes: the token-threading shape question is resolved by this PR + #174 sharing one grpcClient/transport construction pattern (this branch now includes #174's commits — base retargeted so the diff stays clean; GitHub will retarget to main when #174 merges). __tests__/grpc-transport-auth.test.ts pins the shipped property at both the Blockchain and AlphalendClient layers (meta present with token, absent without). The other two new Blockchain sites (lendingProtocol, coinHelpers' address-balance read) remain token-less deliberately — nothing reads their gRPC client; wiring them is part of the future 'SDK reads move to gRPC' work along with the options-object constructor consolidation.

[Zorag44]

operate.md: clean — both findings resolved (explicit transport at src/models/blockchain.ts:76-88 and src/core/coinHelpers.ts:304-321; devnet network passthrough at :83), test confirmed running in CI. Non-blocking notes in the summary comment. Approvals: 1/2 — needs 1 more before merge.

[jangid]

operate.md: clean — CI green (test / lint / build), head 0af5ec8. Not a contract PR. Zero review threads open; both findings from the earlier pass are closed on the record and I found nothing new.

Re-derived this run: meta rides an explicitly constructed GrpcWebFetchTransport (with baseUrl moved onto the transport) at both construction sites, @protobuf-ts/grpcweb-transport is a declared direct dependency at ^2.11.1 matching @mysten/sui's own range with a single hoisted resolution in the lockfile, network passes through unchanged so devnet is no longer narrowed, and __tests__/grpc-transport-auth.test.ts pins defaultOptions.meta at both the Blockchain and AlphalendClient layers plus the absent-token case.

This is a merge-order unblocker. alphafi-fe#334 currently fails its build with TS2353: 'grpcUrl' does not exist in type 'AlphalendClientOptions' — verified in the failing run for bf89ac66 this run — because the FE resolves this SDK as a file:../ sibling at main. That build goes green only once this merges.

Approvals: 2/2 — merge is a maintainer call.