MEET PUMI.

A zero-dependency JSON-RPC client talks to whatever endpoint SOLANA_RPC_URL points at. Reads are cheap, cached briefly, and time-boxed so a slow RPC degrades to an honest error instead of a hung request.

Methods used

getBalance, getSignaturesForAddress, getSignatureStatuses, getTokenSupply, getTokenLargestAccounts, getAccountInfo (jsonParsed).

Address classification

The account owner tells Pumi whether an address is a wallet (System Program), a mint or token account (Token / Token-2022 program), or program-owned — so "analyze this" routes correctly.

Bonding-curve state

Pump.fun's curve lives in a PDA under program 6EF8rr…F6P. Reading its virtual reserves gives exact progress; the adapter exposes a slot for that decoder.

New-launch stream

Discovery subscribes to the pump.fun program via logsSubscribe / programSubscribe on a WebSocket RPC from the worker, not from serverless routes.

// src/integrations/solana/rpc.ts
const [owner, balance] = await Promise.all([
  getAccountOwner(address),
  getBalance(address),
]);
// System Program → wallet
// Token / Token-2022 → mint or token account
// 6EF8rr…F6P-owned → bonding curve PDA

Launching is split into prepare → authorize → submit → verify. Each phase has a hard boundary; nothing can skip ahead. Natural language becomes a LaunchRequest, and a LaunchRequest cannot become a transaction without an allow-listed signer.

Prepare (pure)

Validates Metaplex limits — name ≤ 32, symbol ≤ 10, description ≤ 1000 — and URL fields. Produces a short-lived request with a unique id and a monotonic nonce. Runs in the browser for previews; touches nothing.

Authorize

An allow-listed wallet signs the canonical request hash. Signatures are checked against LAUNCH_AUTHORIZED_SIGNERS. Request ids are single-use; stale nonces are rejected.

Spending controls

LAUNCH_MAX_SOL_PER_TX caps the initial buy. Metadata is uploaded to IPFS before the create instruction is built by the Pump.fun-compatible service.

Verify

No success message until getSignatureStatuses reports confirmed/finalized. Then Pumi reports the mint and signature with explorer links.

// src/integrations/launch/guards.ts
assertLaunchAllowed(request, auth);
//  ✓ auth.requestId === request.requestId
//  ✓ signer ∈ LAUNCH_AUTHORIZED_SIGNERS
//  ✓ now < request.expiresAt
//  ✓ requestId unused · nonce increasing
//  ✓ initialBuySol ≤ LAUNCH_MAX_SOL_PER_TX
markConsumed(request);          // after hand-off
await service.verify(signature); // before any "done"

A worker process polls the mentions timeline (or consumes a filtered stream), de-duplicates by tweet id, and runs the exact same intent → tools → model loop as the web terminal. Replies are chunked into ≤ 280-char threads.

Ingestion

GET /2/users/:id/mentions with since_id; every tweet id is recorded before processing so a crash can't double-reply.

Identity binding

An X account is never trusted as a wallet owner. Launch authorization comes from a signed message by an allow-listed wallet, linked out-of-band — a mention can only prepare.

Reply contract

Plain text, under 500 characters per reply, no markdown. Research results cite tool data; if a tool was unavailable, the reply says so.

Operational

Rate limits are respected per endpoint, every reply is logged with its intent and tool trace, and the worker refuses to start without the tokens it needs.

// src/integrations/x/mentions.ts
for (const m of await client.fetchMentions(lastSeenId)) {
  const reply = await handleMention(m); // intent → tools → model
  await client.reply(reply);            // ≤ 280-char thread
}
// launch intents → "prepared · AWAITING AUTHORIZATION"