Reference

Docs

How the parts fit together, what each route does, and the rules this build holds itself to. Short, because a long document about an unfinished product is mostly fiction.

Architecture

Frontend and APINext.js 16, React 19DatabasePostgreSQL 16Migrationsdrizzle-kit, reviewable SQL filesQueuePostgres, for update skip lockedRealtimeServer-Sent Events

Chainmainnet-betaWalletsWallet Standard (Phantom, Solflare)Signaturesed25519, verified server sideComputeProvider adapters: RunPod, Vast.aiWorkerA loop driving one internal endpoint

There is no ORM instance at runtime. Every query is raw, parameterised SQL. The schema file exists for migration generation, which runs in its own process. That is not a style preference: handing the driver to an ORM mutates it, and afterwards a raw query can no longer pass an object to a jsonb column.

Routes

API

Method	Route	What it does
POST	/api/auth/challenge	Issues a single-use nonce and the readable statement your wallet will sign.
POST	/api/auth/verify	Checks an ed25519 signature over that statement and returns a session token. The token is stored only as a sha256 hash.
GET	/api/health	Database, chain and queue, each read live with the instant it was read.
POST	/api/rpc	JSON-RPC proxy. Allowlisted methods only; the upstream key never reaches the browser.
GET	/api/projects	Public projects.
POST	/api/projects	Creates a project. Requires a session.
POST	/api/launch/prepare	Builds and simulates a pump.fun create transaction and returns the message for your wallet to sign. Signs nothing.
POST	/api/launch/submit	Takes a signed transaction, verifies it against the recorded intent instruction by instruction, submits it and waits for confirmation.
POST	/api/ai/jobs	Creates a build job and enqueues it. Requires a session and ownership of the project.
GET	/api/ai/jobs/:id/stream	Server-Sent Events of that job's event rows.
GET	/api/holders/messages?project=	Holder requests for a project.
POST	/api/holders/messages	Submits a holder request. Verifies token balance at submission and records the balance with its reading instant.
GET	/built/:jobId/:path	Serves a build's artefacts. Strict path validation and a content-type allowlist.

RPC proxy

What the browser may ask the chain

Pages reach Solana through /api/rpc, never directly. The upstream url carries an api key, and a key shipped into a JavaScript bundle cannot be taken back out. The allowlist is also a spend limit: credits are charged per method and they differ by an order of magnitude.

Allowed

getAccountInfo, getBalance, getBlockHeight, getFeeForMessage, getGenesisHash, getHealth, getLatestBlockhash, getMinimumBalanceForRentExemption, getMultipleAccounts, getSignatureStatuses, getSlot, getTokenAccountBalance, getTokenAccountsByOwner, getTransaction, getVersion, sendTransaction, simulateTransaction

Refused, with the reason

getProgramAccountscosts about ten times a normal read; needs a server-side caller with a budgetgetBlockreturns whole blocks and is easy to loop over by accidentgetBlockssame, in bulkgetSignaturesForAddressunbounded paging; a browser caller cannot be trusted with the cursorairdropmainnet only, and this method does not exist hererequestAirdropmainnet only, and this method does not exist here

Security

Security rules this build holds to

No private key, seed phrase or custodial wallet is created, stored or requested.
Signing happens in your wallet; submission is a separate explicit action.
A session token is stored as a sha256 hash, so a dump of the table cannot be replayed.
A sign-in nonce is consumed by the same statement that reads it, so two requests cannot both use it.
Rate limits live in the database, so a second application instance does not double them.

A holder message is data, never a command, and never reaches the orchestrator by itself.
Generated code is served to a browser and never executed on this host.
Artefact paths are validated as strings and again after being resolved, which is the check that actually holds.
A submitted transaction is verified against the recorded intent instruction by instruction, not by whether the accounts look plausible.
Error messages never include the upstream RPC url, because it carries the key.

Discipline

Claims this build may not make

that any GPU is available, running or reserved: no provider credential is configured, so inventory is EMPTY
that any AI build has completed or deployed: no model credential is configured, and no sandbox runtime exists on this host
that any token has launched through GUVIX: the launches table holds no confirmed row
any user count, volume, revenue or uptime figure: none has been measured
that anything has been audited, or is production ready

See the measured state →