@usearete/sdk 0.8.1 → 0.9.0

package/dist/index.cjs

@@ -3324,6 +3324,274 @@ function createChainClient(httpBaseUrl, fetchImpl) {
     };
 }
 
+class TransactionTransportError extends Error {
+    constructor(status, body) {
+        super(body.message);
+        this.name = 'TransactionTransportError';
+        this.status = status;
+        this.code = body.code;
+        this.retryable = body.retryable;
+        this.requestId = body.request_id;
+        this.submissionState = body.submission_state;
+        this.signature = body.signature;
+        this.details = body.details;
+    }
+}
+function decimal(value) {
+    return value === undefined ? undefined : value.toString(10);
+}
+function bigintField(value, field) {
+    if (typeof value !== 'string' || !/^\d+$/.test(value)) {
+        throw new Error(`Invalid decimal u64 field '${field}' in transaction response`);
+    }
+    return BigInt(value);
+}
+function optionalBigint(value, field) {
+    return value === undefined || value === null ? undefined : bigintField(value, field);
+}
+function requestBody(value) {
+    return JSON.stringify(Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== undefined)));
+}
+async function parseError(response) {
+    let body = {};
+    try {
+        body = await response.json();
+    }
+    catch {
+        // Public errors are deliberately synthesized without reflecting raw bodies.
+    }
+    return new TransactionTransportError(response.status, {
+        code: typeof body.code === 'string' ? body.code : 'transaction_transport_error',
+        message: typeof body.message === 'string' ? body.message : `Transaction request failed (${response.status})`,
+        retryable: body.retryable === true,
+        request_id: body.request_id ?? body.requestId,
+        submission_state: body.submission_state
+            ?? body.submissionState,
+        signature: body.signature,
+        details: body.details,
+    });
+}
+function createTransactionTransport(baseUrl, authenticatedFetch) {
+    const root = `${baseUrl.replace(/\/$/, '')}/transactions/v1`;
+    const post = async (route, body, scope) => {
+        const response = await authenticatedFetch(`${root}/${route}`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: requestBody(body),
+        }, scope, true);
+        if (!response.ok)
+            throw await parseError(response);
+        return response.json();
+    };
+    return {
+        async getLatestBlockhash(options = {}) {
+            const value = await post('latest-blockhash', {
+                commitment: options.commitment,
+                minContextSlot: decimal(options.minContextSlot),
+            }, 'transaction:inspect');
+            return {
+                blockhash: String(value.blockhash),
+                contextSlot: bigintField(value.contextSlot, 'contextSlot'),
+                lastValidBlockHeight: bigintField(value.lastValidBlockHeight, 'lastValidBlockHeight'),
+            };
+        },
+        async getFeeForMessage(message, options = {}) {
+            const value = await post('fee', {
+                message,
+                commitment: options.commitment,
+                minContextSlot: decimal(options.minContextSlot),
+            }, 'transaction:inspect');
+            return {
+                feeLamports: value.feeLamports === null ? null : bigintField(value.feeLamports, 'feeLamports'),
+                contextSlot: bigintField(value.contextSlot, 'contextSlot'),
+            };
+        },
+        async simulateTransaction(transaction, options = {}) {
+            const value = await post('simulate', {
+                transaction,
+                commitment: options.commitment,
+                minContextSlot: decimal(options.minContextSlot),
+                accounts: options.accounts ? { addresses: options.accounts } : undefined,
+                innerInstructions: options.innerInstructions,
+                replaceRecentBlockhash: options.replaceRecentBlockhash,
+            }, 'transaction:inspect');
+            return {
+                contextSlot: bigintField(value.contextSlot, 'contextSlot'),
+                err: value.err ?? null,
+                logs: value.logs ?? null,
+                unitsConsumed: optionalBigint(value.unitsConsumed, 'unitsConsumed'),
+                accounts: value.accounts,
+            };
+        },
+        sendTransaction(transaction, options = {}) {
+            return post('send', {
+                transaction,
+                skipPreflight: options.skipPreflight,
+                preflightCommitment: options.preflightCommitment,
+                minContextSlot: decimal(options.minContextSlot),
+            }, 'transaction:send');
+        },
+        async getSignatureStatus(signature, options = {}) {
+            const value = await post('signature-status', {
+                signature,
+                searchTransactionHistory: options.searchTransactionHistory,
+            }, 'transaction:inspect');
+            const status = value?.status;
+            if (!status)
+                return null;
+            return {
+                signature,
+                slot: status.slot === null ? null : bigintField(status.slot, 'slot'),
+                confirmationStatus: status.confirmationStatus,
+                err: status.err ?? null,
+            };
+        },
+        async getBlockHeight(options = {}) {
+            const value = await post('block-height', {
+                commitment: options.commitment,
+                minContextSlot: decimal(options.minContextSlot),
+            }, 'transaction:inspect');
+            return bigintField(value.blockHeight, 'blockHeight');
+        },
+    };
+}
+
+function isSecureOrLoopbackHttpUrl$1(value) {
+    try {
+        const url = new URL(value);
+        return url.protocol === 'https:'
+            || (url.protocol === 'http:'
+                && ['localhost', '127.0.0.1', '::1'].includes(url.hostname));
+    }
+    catch {
+        return false;
+    }
+}
+function validateBinding(capability, binding, requiredScopes) {
+    const auth = binding?.auth;
+    const complete = binding
+        && isSecureOrLoopbackHttpUrl$1(binding.endpoint)
+        && /^sgb_[A-Za-z0-9_-]{32}$/.test(binding.solanaGatewayBindingId)
+        && binding.cluster.trim().length > 0
+        && binding.region.trim().length > 0
+        && auth
+        && typeof auth.required === 'boolean'
+        && auth.mode === binding.authPolicy
+        && isSecureOrLoopbackHttpUrl$1(auth.sessionEndpoint)
+        && isSecureOrLoopbackHttpUrl$1(auth.jwksUrl)
+        && auth.tokenTransport === 'bearer'
+        && auth.audience === 'arete:solana-gateway'
+        && auth.targetKind === 'solana-gateway-binding'
+        && auth.targetId === binding.solanaGatewayBindingId
+        && Array.isArray(auth.scopes)
+        && requiredScopes.every((scope) => auth.scopes.includes(scope))
+        && Array.isArray(auth.acceptedKeyClasses)
+        && typeof auth.transactionEntitlementRequired === 'boolean';
+    if (!complete) {
+        throw new AreteError(`Hosted Solana gateway ${capability} binding is incomplete or inconsistent`, 'INVALID_CONFIG');
+    }
+}
+function resolveFetch(fetchImpl) {
+    if (fetchImpl)
+        return fetchImpl;
+    if (typeof globalThis.fetch === 'function')
+        return globalThis.fetch.bind(globalThis);
+    throw new AreteError('A fetch implementation is required for hosted Solana gateway transports', 'INVALID_CONFIG');
+}
+function hasRuntimeAuthStrategy(auth) {
+    return auth?.token !== undefined
+        || auth?.getToken !== undefined
+        || auth?.tokenEndpoint !== undefined;
+}
+function bindingAuthConfig(binding, runtimeAuth) {
+    if (hasRuntimeAuthStrategy(runtimeAuth))
+        return runtimeAuth;
+    if (!binding.auth.required)
+        return runtimeAuth;
+    return { ...runtimeAuth, tokenEndpoint: binding.auth.sessionEndpoint };
+}
+function refreshableErrorCode(response) {
+    const wireCode = response.headers.get('X-Error-Code');
+    return wireCode !== null
+        && shouldRefreshToken(parseErrorCode(wireCode.trim().replace(/_/g, '-')));
+}
+/**
+ * Construct explicit hosted chain and transaction transports from generated
+ * gateway descriptors. Tokens are isolated by exact binding target and scope.
+ */
+function createHostedSolanaGatewayTransports(bindings, options = {}) {
+    validateBinding('chain', bindings.chain, ['read']);
+    validateBinding('transactions', bindings.transactions, ['transaction:inspect', 'transaction:send']);
+    const fetchImpl = resolveFetch(options.fetch);
+    const managers = new Map();
+    const bindingAuthentication = (binding) => {
+        const auth = bindingAuthConfig(binding, options.auth);
+        if (auth?.token !== undefined) {
+            if (!auth.token) {
+                throw new AreteError('Authentication token is empty', 'TOKEN_INVALID');
+            }
+            return {
+                staticToken: auth.token,
+                target: {
+                    targetKind: 'solana-gateway-binding',
+                    targetId: binding.solanaGatewayBindingId,
+                },
+            };
+        }
+        let manager;
+        if (auth && (auth.getToken || auth.tokenEndpoint)) {
+            const identity = hasRuntimeAuthStrategy(options.auth)
+                ? 'runtime-auth-strategy'
+                : `session-endpoint:${binding.auth.sessionEndpoint}`;
+            manager = managers.get(identity);
+            if (!manager) {
+                manager = new ConnectionManager({ websocketUrl: null, auth, fetch: fetchImpl });
+                managers.set(identity, manager);
+            }
+        }
+        return {
+            manager,
+            target: {
+                targetKind: 'solana-gateway-binding',
+                targetId: binding.solanaGatewayBindingId,
+            },
+        };
+    };
+    const authenticatedFetch = (authentication) => async (input, init, scope, requirePreDispatchMarker) => {
+        const request = { ...authentication.target, scopes: [scope] };
+        const attempt = async (forceRefresh) => {
+            const token = authentication.staticToken
+                ?? (authentication.manager
+                    ? await authentication.manager.getHttpAuthToken(request, forceRefresh)
+                    : undefined);
+            const headers = new Headers(init?.headers);
+            if (token)
+                headers.set('authorization', `Bearer ${token}`);
+            return fetchImpl(input, { ...init, headers });
+        };
+        let response = await attempt(false);
+        const explicitlyNotDispatched = response.headers.get('X-Arete-Upstream-Attempted') === 'false';
+        if (!response.ok
+            && authentication.manager
+            && refreshableErrorCode(response)
+            && (!requirePreDispatchMarker || explicitlyNotDispatched)) {
+            authentication.manager.clearHttpAuthToken(request);
+            response = await attempt(true);
+        }
+        return response;
+    };
+    const chainAuthentication = bindingAuthentication(bindings.chain);
+    const transactionAuthentication = bindingAuthentication(bindings.transactions);
+    const chainFetch = authenticatedFetch(chainAuthentication);
+    const transactionFetch = authenticatedFetch(transactionAuthentication);
+    return {
+        chain: createChainClient(bindings.chain.endpoint, ((input, init) => chainFetch(typeof input === 'string'
+            ? input
+            : input instanceof URL ? input.toString() : input.url, init, 'read', false))),
+        transactions: createTransactionTransport(bindings.transactions.endpoint, (input, init, scope, requirePreDispatchMarker) => transactionFetch(input, init, scope, requirePreDispatchMarker)),
+    };
+}
+
 /*! noble-ed25519 - MIT License (c) 2019 Paul Miller (paulmillr.com) */
 /**
  * 4KB JS implementation of ed25519 EdDSA signatures.
@@ -5954,237 +6222,105 @@ function isRefreshableErrorCode(code) {
 }
 function parseProgramReadResponse(response, path, body) {
     if (!response.ok) {
-        throw new ReadRequestError({
-            status: response.status,
-            path,
-            body,
-            serverErrorCode: responseErrorCode(response, body),
-        });
-    }
-    try {
-        return JSON.parse(body);
-    }
-    catch (error) {
-        throw new AreteError(`Program read '${path}' returned invalid JSON`, 'INVALID_RESPONSE', error);
-    }
-}
-function hostedAuthConfig(binding, runtimeAuth) {
-    const metadata = binding.auth;
-    const runtimeStrategyConfigured = runtimeAuth?.token !== undefined
-        || runtimeAuth?.getToken !== undefined
-        || runtimeAuth?.tokenEndpoint !== undefined;
-    if (runtimeStrategyConfigured)
-        return runtimeAuth;
-    if (metadata.required === false)
-        return runtimeAuth;
-    return { ...runtimeAuth, tokenEndpoint: metadata.sessionEndpoint };
-}
-function hostedAuth(config) {
-    const auth = hostedAuthConfig(config.binding, config.auth);
-    if (auth?.token !== undefined && !auth.token) {
-        throw new AreteError('Authentication token is empty', 'TOKEN_INVALID');
-    }
-    const bindingId = config.binding.programReadBindingId;
-    if (!auth || auth.token !== undefined) {
-        return { staticToken: auth?.token };
-    }
-    return {
-        manager: new ConnectionManager({ websocketUrl: null, auth, fetch: config.fetch }),
-        target: {
-            targetKind: 'program-read-binding',
-            targetId: bindingId,
-            programReleaseHash: config.release.programReleaseHash,
-        },
-    };
-}
-function requestPath(release, request) {
-    const releaseHash = encodeURIComponent(release.programReleaseHash).replace(/%3A/g, ':');
-    const root = `/v1/releases/${releaseHash}`
-        + `/accounts/${encodeURIComponent(request.account)}`;
-    if (request.operation === 'fetchMany')
-        return root;
-    const addressPath = `${root.replace(/\/+$/, '')}/${encodeURIComponent(request.address)}`;
-    return request.operation === 'exists' ? `${addressPath}/exists` : addressPath;
-}
-function createProgramReadTransport(config) {
-    if (config.kind === 'unavailable') {
-        return {
-            async read() {
-                throw new AreteError(config.message, 'INVALID_CONFIG');
-            },
-        };
-    }
-    const auth = config.kind === 'hosted-binding' ? hostedAuth(config) : undefined;
-    const endpoint = config.kind === 'hosted-binding'
-        ? config.binding.endpoint
-        : config.endpoint;
-    return {
-        async read(request) {
-            const path = requestPath(config.release, request);
-            const input = appendUrl(endpoint, path);
-            const attempt = async (forceRefresh) => {
-                const token = auth?.staticToken
-                    ?? (auth?.manager && auth.target
-                        ? await auth.manager.getHttpAuthToken(auth.target, ['read'], forceRefresh)
-                        : undefined);
-                const headers = new Headers(request.operation === 'fetchMany'
-                    ? { 'content-type': 'application/json' }
-                    : undefined);
-                if (token)
-                    headers.set('authorization', `Bearer ${token}`);
-                return config.fetch(input, {
-                    method: request.operation === 'fetchMany' ? 'POST' : 'GET',
-                    headers,
-                    body: request.operation === 'fetchMany'
-                        ? JSON.stringify({ addresses: request.addresses })
-                        : undefined,
-                });
-            };
-            let response = await attempt(false);
-            let body = await response.text();
-            const wireCode = responseErrorCode(response, body);
-            if (response.status === 401
-                && wireCode
-                && isRefreshableErrorCode(wireCode)
-                && auth?.manager
-                && auth.target) {
-                auth.manager.clearHttpAuthToken(auth.target);
-                response = await attempt(true);
-                body = await response.text();
-            }
-            return parseProgramReadResponse(response, path, body);
-        },
-    };
-}
-
-class TransactionTransportError extends Error {
-    constructor(status, body) {
-        super(body.message);
-        this.name = 'TransactionTransportError';
-        this.status = status;
-        this.code = body.code;
-        this.retryable = body.retryable;
-        this.requestId = body.request_id;
-        this.submissionState = body.submission_state;
-        this.signature = body.signature;
-        this.details = body.details;
-    }
-}
-function decimal(value) {
-    return value === undefined ? undefined : value.toString(10);
-}
-function bigintField(value, field) {
-    if (typeof value !== 'string' || !/^\d+$/.test(value)) {
-        throw new Error(`Invalid decimal u64 field '${field}' in transaction response`);
-    }
-    return BigInt(value);
-}
-function optionalBigint(value, field) {
-    return value === undefined || value === null ? undefined : bigintField(value, field);
-}
-function requestBody(value) {
-    return JSON.stringify(Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== undefined)));
-}
-async function parseError(response) {
-    let body = {};
-    try {
-        body = await response.json();
-    }
-    catch {
-        // Public errors are deliberately synthesized without reflecting raw bodies.
-    }
-    return new TransactionTransportError(response.status, {
-        code: typeof body.code === 'string' ? body.code : 'transaction_transport_error',
-        message: typeof body.message === 'string' ? body.message : `Transaction request failed (${response.status})`,
-        retryable: body.retryable === true,
-        request_id: body.request_id ?? body.requestId,
-        submission_state: body.submission_state
-            ?? body.submissionState,
-        signature: body.signature,
-        details: body.details,
-    });
-}
-function createTransactionTransport(baseUrl, authenticatedFetch) {
-    const root = `${baseUrl.replace(/\/$/, '')}/transactions/v1`;
-    const post = async (route, body, scope) => {
-        const response = await authenticatedFetch(`${root}/${route}`, {
-            method: 'POST',
-            headers: { 'content-type': 'application/json' },
-            body: requestBody(body),
-        }, scope, true);
-        if (!response.ok)
-            throw await parseError(response);
-        return response.json();
-    };
-    return {
-        async getLatestBlockhash(options = {}) {
-            const value = await post('latest-blockhash', {
-                commitment: options.commitment,
-                minContextSlot: decimal(options.minContextSlot),
-            }, 'transaction:inspect');
-            return {
-                blockhash: String(value.blockhash),
-                contextSlot: bigintField(value.contextSlot, 'contextSlot'),
-                lastValidBlockHeight: bigintField(value.lastValidBlockHeight, 'lastValidBlockHeight'),
-            };
-        },
-        async getFeeForMessage(message, options = {}) {
-            const value = await post('fee', {
-                message,
-                commitment: options.commitment,
-                minContextSlot: decimal(options.minContextSlot),
-            }, 'transaction:inspect');
-            return {
-                feeLamports: value.feeLamports === null ? null : bigintField(value.feeLamports, 'feeLamports'),
-                contextSlot: bigintField(value.contextSlot, 'contextSlot'),
-            };
-        },
-        async simulateTransaction(transaction, options = {}) {
-            const value = await post('simulate', {
-                transaction,
-                commitment: options.commitment,
-                minContextSlot: decimal(options.minContextSlot),
-                accounts: options.accounts ? { addresses: options.accounts } : undefined,
-                innerInstructions: options.innerInstructions,
-                replaceRecentBlockhash: options.replaceRecentBlockhash,
-            }, 'transaction:inspect');
-            return {
-                contextSlot: bigintField(value.contextSlot, 'contextSlot'),
-                err: value.err ?? null,
-                logs: value.logs ?? null,
-                unitsConsumed: optionalBigint(value.unitsConsumed, 'unitsConsumed'),
-                accounts: value.accounts,
-            };
-        },
-        sendTransaction(transaction, options = {}) {
-            return post('send', {
-                transaction,
-                skipPreflight: options.skipPreflight,
-                preflightCommitment: options.preflightCommitment,
-                minContextSlot: decimal(options.minContextSlot),
-            }, 'transaction:send');
+        throw new ReadRequestError({
+            status: response.status,
+            path,
+            body,
+            serverErrorCode: responseErrorCode(response, body),
+        });
+    }
+    try {
+        return JSON.parse(body);
+    }
+    catch (error) {
+        throw new AreteError(`Program read '${path}' returned invalid JSON`, 'INVALID_RESPONSE', error);
+    }
+}
+function hostedAuthConfig(binding, runtimeAuth) {
+    const metadata = binding.auth;
+    const runtimeStrategyConfigured = runtimeAuth?.token !== undefined
+        || runtimeAuth?.getToken !== undefined
+        || runtimeAuth?.tokenEndpoint !== undefined;
+    if (runtimeStrategyConfigured)
+        return runtimeAuth;
+    if (metadata.required === false)
+        return runtimeAuth;
+    return { ...runtimeAuth, tokenEndpoint: metadata.sessionEndpoint };
+}
+function hostedAuth(config) {
+    const auth = hostedAuthConfig(config.binding, config.auth);
+    if (auth?.token !== undefined && !auth.token) {
+        throw new AreteError('Authentication token is empty', 'TOKEN_INVALID');
+    }
+    const bindingId = config.binding.programReadBindingId;
+    if (!auth || auth.token !== undefined) {
+        return { staticToken: auth?.token };
+    }
+    return {
+        manager: new ConnectionManager({ websocketUrl: null, auth, fetch: config.fetch }),
+        target: {
+            targetKind: 'program-read-binding',
+            targetId: bindingId,
+            programReleaseHash: config.release.programReleaseHash,
         },
-        async getSignatureStatus(signature, options = {}) {
-            const value = await post('signature-status', {
-                signature,
-                searchTransactionHistory: options.searchTransactionHistory,
-            }, 'transaction:inspect');
-            const status = value?.status;
-            if (!status)
-                return null;
-            return {
-                signature,
-                slot: status.slot === null ? null : bigintField(status.slot, 'slot'),
-                confirmationStatus: status.confirmationStatus,
-                err: status.err ?? null,
+    };
+}
+function requestPath(release, request) {
+    const releaseHash = encodeURIComponent(release.programReleaseHash).replace(/%3A/g, ':');
+    const root = `/v1/releases/${releaseHash}`
+        + `/accounts/${encodeURIComponent(request.account)}`;
+    if (request.operation === 'fetchMany')
+        return root;
+    const addressPath = `${root.replace(/\/+$/, '')}/${encodeURIComponent(request.address)}`;
+    return request.operation === 'exists' ? `${addressPath}/exists` : addressPath;
+}
+function createProgramReadTransport(config) {
+    if (config.kind === 'unavailable') {
+        return {
+            async read() {
+                throw new AreteError(config.message, 'INVALID_CONFIG');
+            },
+        };
+    }
+    const auth = config.kind === 'hosted-binding' ? hostedAuth(config) : undefined;
+    const endpoint = config.kind === 'hosted-binding'
+        ? config.binding.endpoint
+        : config.endpoint;
+    return {
+        async read(request) {
+            const path = requestPath(config.release, request);
+            const input = appendUrl(endpoint, path);
+            const attempt = async (forceRefresh) => {
+                const token = auth?.staticToken
+                    ?? (auth?.manager && auth.target
+                        ? await auth.manager.getHttpAuthToken(auth.target, ['read'], forceRefresh)
+                        : undefined);
+                const headers = new Headers(request.operation === 'fetchMany'
+                    ? { 'content-type': 'application/json' }
+                    : undefined);
+                if (token)
+                    headers.set('authorization', `Bearer ${token}`);
+                return config.fetch(input, {
+                    method: request.operation === 'fetchMany' ? 'POST' : 'GET',
+                    headers,
+                    body: request.operation === 'fetchMany'
+                        ? JSON.stringify({ addresses: request.addresses })
+                        : undefined,
+                });
             };
-        },
-        async getBlockHeight(options = {}) {
-            const value = await post('block-height', {
-                commitment: options.commitment,
-                minContextSlot: decimal(options.minContextSlot),
-            }, 'transaction:inspect');
-            return bigintField(value.blockHeight, 'blockHeight');
+            let response = await attempt(false);
+            let body = await response.text();
+            const wireCode = responseErrorCode(response, body);
+            if (response.status === 401
+                && wireCode
+                && isRefreshableErrorCode(wireCode)
+                && auth?.manager
+                && auth.target) {
+                auth.manager.clearHttpAuthToken(auth.target);
+                response = await attempt(true);
+                body = await response.text();
+            }
+            return parseProgramReadResponse(response, path, body);
         },
     };
 }
@@ -6204,7 +6340,7 @@ function validateReleaseIdentity(programName, definition, release) {
 function isNonEmptyString(value) {
     return typeof value === 'string' && value.trim().length > 0;
 }
-function isSecureOrLoopbackHttpUrl$1(value) {
+function isSecureOrLoopbackHttpUrl(value) {
     try {
         const url = new URL(value);
         return url.protocol === 'https:'
@@ -6235,12 +6371,12 @@ function validateProgramReadDescriptor(programName, descriptor) {
     }
     const { binding } = descriptor.transport;
     if (!binding
-        || !isSecureOrLoopbackHttpUrl$1(binding.endpoint)
+        || !isSecureOrLoopbackHttpUrl(binding.endpoint)
         || !/^prb_[A-Za-z0-9_-]{32}$/.test(binding.programReadBindingId)
         || !binding.auth
         || binding.auth.targetKind !== 'program-read-binding'
         || binding.auth.targetId !== binding.programReadBindingId
-        || !isSecureOrLoopbackHttpUrl$1(binding.auth.sessionEndpoint)) {
+        || !isSecureOrLoopbackHttpUrl(binding.auth.sessionEndpoint)) {
         throw new AreteError(`Program '${programName}' hosted binding requires secure endpoints, a canonical binding ID, and matching program-read-binding auth metadata`, 'INVALID_CONFIG');
     }
 }
@@ -6402,12 +6538,19 @@ let Arete$1 = class Arete {
         });
         this._views = createTypedViews(this.stack, this.storage, this.subscriptionRegistry);
         this._queries = this.buildQueries();
-        this._chain = options.chain ?? createChainClient(this.httpBaseUrl ?? '', ((input, init) => this.authenticatedStackFetch(typeof input === 'string'
+        const hostedGateway = this.stack.gateway
+            && (options.chain === undefined || options.transactions === undefined)
+            ? createHostedSolanaGatewayTransports(this.stack.gateway, {
+                auth: options.auth,
+                fetch: this.fetchImpl,
+            })
+            : undefined;
+        this._chain = options.chain ?? hostedGateway?.chain ?? createChainClient(this.httpBaseUrl ?? '', ((input, init) => this.authenticatedStackFetch(typeof input === 'string'
             ? input
             : input instanceof URL
                 ? input.toString()
                 : input.url, init, ['read'])));
-        this._transactions = options.transactions ?? createTransactionTransport(this.httpBaseUrl ?? '', (input, init, scope, requirePreDispatchMarker) => this.authenticatedStackFetch(input, init, [scope], requirePreDispatchMarker));
+        this._transactions = options.transactions ?? hostedGateway?.transactions ?? createTransactionTransport(this.httpBaseUrl ?? '', (input, init, scope, requirePreDispatchMarker) => this.authenticatedStackFetch(input, init, [scope], requirePreDispatchMarker));
         this._programs = this.buildPrograms();
     }
     resolveFetchImpl() {
@@ -6941,6 +7084,7 @@ function programAsStack(name, program, descriptor) {
         views: {},
         programs: { [name]: program },
         ...(descriptor ? { programReads: { [name]: descriptor } } : {}),
+        ...(program.gateway ? { gateway: program.gateway } : {}),
     };
 }
 async function createSession(definition, ...args) {
@@ -6950,8 +7094,16 @@ async function createSession(definition, ...args) {
     if (stackEntries.length === 0 && programEntries.length === 0) {
         throw new AreteError('createSession requires at least one stack or program member', 'INVALID_CONFIG');
     }
-    if (definition.mode === 'composition' && (!options?.chain || !options?.transactions)) {
-        throw new AreteError('composition sessions require explicit chain and transaction transports', 'INVALID_CONFIG');
+    const generatedGateway = definition.gateway && (!options?.chain || !options?.transactions)
+        ? createHostedSolanaGatewayTransports(definition.gateway, {
+            auth: options?.auth,
+            fetch: options?.fetch,
+        })
+        : undefined;
+    const sharedChain = options?.chain ?? generatedGateway?.chain;
+    const sharedTransactions = options?.transactions ?? generatedGateway?.transactions;
+    if (definition.mode === 'composition' && (!sharedChain || !sharedTransactions)) {
+        throw new AreteError('composition sessions require generated or explicit chain and transaction transports', 'INVALID_CONFIG');
     }
     if (definition.mode === 'composition' && options?.endpoints !== undefined) {
         throw new AreteError('composition sessions require per-member live endpoints, not shared fallback endpoints', 'INVALID_CONFIG');
@@ -6978,7 +7130,11 @@ async function createSession(definition, ...args) {
     const connectedStacks = await Promise.all(stackEntries.map(async ([key, stack]) => {
         const memberOptions = options?.stacks?.[key];
         const effectiveStack = withPrograms(stack, memberOptions?.programs);
-        const connectOptions = resolveMemberConnectOptions(effectiveStack, memberOptions, options, false);
+        const connectOptions = resolveMemberConnectOptions(effectiveStack, memberOptions, {
+            ...options,
+            chain: sharedChain,
+            transactions: sharedTransactions,
+        }, false);
         const client = await Arete$1.connect(stack, {
             ...connectOptions,
             programs: memberOptions?.programs,
@@ -6988,7 +7144,11 @@ async function createSession(definition, ...args) {
     }));
     const connectedPrograms = await Promise.all(programEntries.map(async ([key, program]) => {
         const syntheticStack = programAsStack(key, program, definition.programReads?.[key]);
-        const connectOptions = resolveMemberConnectOptions(syntheticStack, options?.programs?.[key], options, true);
+        const connectOptions = resolveMemberConnectOptions(syntheticStack, options?.programs?.[key], {
+            ...options,
+            chain: sharedChain,
+            transactions: sharedTransactions,
+        }, true);
         const client = await Arete$1.connect(syntheticStack, connectOptions);
         return [key, client];
     }));
@@ -6997,7 +7157,7 @@ async function createSession(definition, ...args) {
         ...connectedPrograms.map(([, client]) => client),
     ];
     const executionHost = memberClients[0];
-    const transactions = options?.transactions ?? executionHost.transactions;
+    const transactions = sharedTransactions ?? executionHost.transactions;
     const stacks = Object.fromEntries(connectedStacks);
     const explicitProgramKeys = new Set(connectedPrograms.map(([key]) => key));
     const programOwners = new Map();
@@ -7026,7 +7186,7 @@ async function createSession(definition, ...args) {
         }
     }
     const programs = promotedPrograms;
-    const chain = options?.chain ?? (options?.endpoints?.http !== undefined
+    const chain = sharedChain ?? (options?.endpoints?.http !== undefined
         ? createChainClient(options.endpoints.http, (options?.fetch ?? globalThis.fetch?.bind(globalThis)))
         : executionHost.chain);
     const session = {
@@ -7103,142 +7263,6 @@ function flowOperation(prepare) {
     };
 }
 
-function isSecureOrLoopbackHttpUrl(value) {
-    try {
-        const url = new URL(value);
-        return url.protocol === 'https:'
-            || (url.protocol === 'http:'
-                && ['localhost', '127.0.0.1', '::1'].includes(url.hostname));
-    }
-    catch {
-        return false;
-    }
-}
-function validateBinding(capability, binding, requiredScopes) {
-    const auth = binding?.auth;
-    const complete = binding
-        && isSecureOrLoopbackHttpUrl(binding.endpoint)
-        && /^sgb_[A-Za-z0-9_-]{32}$/.test(binding.solanaGatewayBindingId)
-        && binding.cluster.trim().length > 0
-        && binding.region.trim().length > 0
-        && auth
-        && typeof auth.required === 'boolean'
-        && auth.mode === binding.authPolicy
-        && isSecureOrLoopbackHttpUrl(auth.sessionEndpoint)
-        && isSecureOrLoopbackHttpUrl(auth.jwksUrl)
-        && auth.tokenTransport === 'bearer'
-        && auth.audience === 'arete:solana-gateway'
-        && auth.targetKind === 'solana-gateway-binding'
-        && auth.targetId === binding.solanaGatewayBindingId
-        && Array.isArray(auth.scopes)
-        && requiredScopes.every((scope) => auth.scopes.includes(scope))
-        && Array.isArray(auth.acceptedKeyClasses)
-        && typeof auth.transactionEntitlementRequired === 'boolean';
-    if (!complete) {
-        throw new AreteError(`Hosted Solana gateway ${capability} binding is incomplete or inconsistent`, 'INVALID_CONFIG');
-    }
-}
-function resolveFetch(fetchImpl) {
-    if (fetchImpl)
-        return fetchImpl;
-    if (typeof globalThis.fetch === 'function')
-        return globalThis.fetch.bind(globalThis);
-    throw new AreteError('A fetch implementation is required for hosted Solana gateway transports', 'INVALID_CONFIG');
-}
-function hasRuntimeAuthStrategy(auth) {
-    return auth?.token !== undefined
-        || auth?.getToken !== undefined
-        || auth?.tokenEndpoint !== undefined;
-}
-function bindingAuthConfig(binding, runtimeAuth) {
-    if (hasRuntimeAuthStrategy(runtimeAuth))
-        return runtimeAuth;
-    if (!binding.auth.required)
-        return runtimeAuth;
-    return { ...runtimeAuth, tokenEndpoint: binding.auth.sessionEndpoint };
-}
-function refreshableErrorCode(response) {
-    const wireCode = response.headers.get('X-Error-Code');
-    return wireCode !== null
-        && shouldRefreshToken(parseErrorCode(wireCode.trim().replace(/_/g, '-')));
-}
-/**
- * Construct explicit hosted chain and transaction transports from generated
- * gateway descriptors. Tokens are isolated by exact binding target and scope.
- */
-function createHostedSolanaGatewayTransports(bindings, options = {}) {
-    validateBinding('chain', bindings.chain, ['read']);
-    validateBinding('transactions', bindings.transactions, ['transaction:inspect', 'transaction:send']);
-    const fetchImpl = resolveFetch(options.fetch);
-    const managers = new Map();
-    const bindingAuthentication = (binding) => {
-        const auth = bindingAuthConfig(binding, options.auth);
-        if (auth?.token !== undefined) {
-            if (!auth.token) {
-                throw new AreteError('Authentication token is empty', 'TOKEN_INVALID');
-            }
-            return {
-                staticToken: auth.token,
-                target: {
-                    targetKind: 'solana-gateway-binding',
-                    targetId: binding.solanaGatewayBindingId,
-                },
-            };
-        }
-        let manager;
-        if (auth && (auth.getToken || auth.tokenEndpoint)) {
-            const identity = hasRuntimeAuthStrategy(options.auth)
-                ? 'runtime-auth-strategy'
-                : `session-endpoint:${binding.auth.sessionEndpoint}`;
-            manager = managers.get(identity);
-            if (!manager) {
-                manager = new ConnectionManager({ websocketUrl: null, auth, fetch: fetchImpl });
-                managers.set(identity, manager);
-            }
-        }
-        return {
-            manager,
-            target: {
-                targetKind: 'solana-gateway-binding',
-                targetId: binding.solanaGatewayBindingId,
-            },
-        };
-    };
-    const authenticatedFetch = (authentication) => async (input, init, scope, requirePreDispatchMarker) => {
-        const request = { ...authentication.target, scopes: [scope] };
-        const attempt = async (forceRefresh) => {
-            const token = authentication.staticToken
-                ?? (authentication.manager
-                    ? await authentication.manager.getHttpAuthToken(request, forceRefresh)
-                    : undefined);
-            const headers = new Headers(init?.headers);
-            if (token)
-                headers.set('authorization', `Bearer ${token}`);
-            return fetchImpl(input, { ...init, headers });
-        };
-        let response = await attempt(false);
-        const explicitlyNotDispatched = response.headers.get('X-Arete-Upstream-Attempted') === 'false';
-        if (!response.ok
-            && authentication.manager
-            && refreshableErrorCode(response)
-            && (!requirePreDispatchMarker || explicitlyNotDispatched)) {
-            authentication.manager.clearHttpAuthToken(request);
-            response = await attempt(true);
-        }
-        return response;
-    };
-    const chainAuthentication = bindingAuthentication(bindings.chain);
-    const transactionAuthentication = bindingAuthentication(bindings.transactions);
-    const chainFetch = authenticatedFetch(chainAuthentication);
-    const transactionFetch = authenticatedFetch(transactionAuthentication);
-    return {
-        chain: createChainClient(bindings.chain.endpoint, ((input, init) => chainFetch(typeof input === 'string'
-            ? input
-            : input instanceof URL ? input.toString() : input.url, init, 'read', false))),
-        transactions: createTransactionTransport(bindings.transactions.endpoint, (input, init, scope, requirePreDispatchMarker) => transactionFetch(input, init, scope, requirePreDispatchMarker)),
-    };
-}
-
 function chainAccountLoader(chain) {
     return {
         async getAccount(address) {