# Solana Architecture

## Current mainnet posture

- Wallet connection uses `@solana/wallet-adapter-react` and Wallet Standard discovery with `wallets={[]}`.
- Network defaults to Solana mainnet.
- HTTP RPC is proxied through `/api/solana-rpc` so Helius keys stay server-only.
- Signed nonce authentication uses message signing and server verification.
- Sessions expire after 12 hours.
- Mint is live on Solana mainnet via LaunchMyNFT (`/mint`).
- Subject metadata is available at `/api/subjects` and `/api/subjects/[id]`.

## Production boundaries

- Replace in-memory nonce storage with durable server storage.
- Store nonce, wallet, issued time, expiration, and consumed state.
- Add CSRF protection and rate limits to auth endpoints.
- Verify NFT ownership server-side before granting holder permissions.
- Use a collection entitlement interface, not frontend-only gates.
- Use read-only mainnet behavior unless a user explicitly confirms a transaction.

## Never

- never request seed phrases
- never request private keys
- never store private keys
- never auto-sign transactions
- never execute trades
- never hide transaction details
- never promise profit

## Future SDK note

Solana docs recommend `@solana/kit` for new apps. The wallet-adapter layer is intentionally isolated so production RPC and wallet plugins can move toward Kit without changing UI routes.