first
devnet
Protocol reference

Docs

Everything needed to create, verify, index, and extend First artifacts.

Quickstart

First is a client-first Solana creation studio. Connect a wallet, stay on devnet while testing, choose a primitive, preview the payload, and approve each transaction in your wallet. The platform never receives a private key and never signs for a user.

  1. Copy .env.example to .env.local.
  2. Set a reliable Solana RPC endpoint and a 32+ character session secret.
  3. Run npm install, then npm run dev.
  4. Open the Studio and connect a Wallet Standard compatible wallet.

Inscription protocol

First stores an envelope as UTF‑8 instruction data using the audited SPL Memo program. The signer account is included in the instruction, so indexers can verify authorship. A payload may span multiple transactions; every part shares an immutable UUID.

{
  "protocol": "first/1",
  "id": "01997ef0-…",
  "type": "agent",
  "part": 1,
  "total": 2,
  "data": "{\"name\":\"atlas\"…"
}

Reassembly

Find memo instructions whose program ID is MemoSq4gqABAXKb96qnH8TysNcWxMyWCqXgDLGmfcHr, parse envelopes with protocol: first/1, group by id, order by part, verify all parts share the expected signer, and concatenate data.

The studio targets 3,600 payload bytes per part using Solana's v1 transaction format, leaving headroom within its 4,096-byte ceiling for resource configuration, the envelope, account keys, and signature. First checks that the selected wallet explicitly advertises v1 support before sending.

Artifact types

  • text — arbitrary UTF‑8.
  • json — validated and minified JSON.
  • image — typically a compact SVG or data URI. Large raster files are intentionally discouraged.
  • agent — a normalized first/agent/1 manifest.

Token launches

Coin launches use the Token‑2022 program. First creates a mint with Metadata Pointer and Token Metadata extensions, stores the name, symbol, and URI on the mint account, creates the owner's associated token account, and mints the configured supply. When “fixed supply” is enabled, the studio revokes the mint authority after minting. That action cannot be reversed.

Launching a mint does not create a market, liquidity pool, or promise of value. Mainnet operators should add jurisdiction-appropriate disclosures and review token configuration with counsel.

Agent manifests

An agent manifest is not executable bytecode. It is a durable, owner-signed discovery record containing a name, semantic version, HTTPS endpoint, description, and declared capabilities. Consumers must treat endpoint content as untrusted and independently authenticate responses.

{
  "protocol": "first/agent/1",
  "name": "atlas",
  "version": "1.0.0",
  "endpoint": "https://agent.example/.well-known/agent.json",
  "capabilities": ["research", "execute"]
}

Security model

  • Wallet authentication is Sign‑In With Solana style: a short-lived nonce, exact-origin binding, detached Ed25519 signature verification, bounded per-instance throttling, and an HTTP-only SameSite session cookie.
  • Vanity keypairs are generated only in browser memory. Download once, store securely, and never paste a secret key into the site.
  • Every transaction is built client-side and explicitly signed by the connected wallet.
  • V1 transactions set compute and loaded-account-data limits from simulation; unlike legacy transactions, these limits live in transactionConfig.
  • Production deployments must set SESSION_SECRET, use HTTPS, configure a private RPC, add distributed edge rate limiting, enable monitoring, and keep dependencies patched.
  • Review transaction simulations and use devnet before mainnet. Blockchain writes and authority revocations are irreversible.

Production deployment

The app is a standard Next.js service and can run on Cloudflare Workers, Cloud Run, or any Node 22+ container. Configure NEXT_PUBLIC_SOLANA_NETWORK, NEXT_PUBLIC_SOLANA_RPC_URL, and NEXT_PUBLIC_APP_URL at build time, plus a strong server-only SESSION_SECRET at runtime. Static pages are cacheable; wallet and RPC calls remain client-side.

Verification checklist

  • npm ci
  • npm run ci
  • Check /api/health.
  • Exercise a complete devnet inscription and token launch with a disposable wallet.
  • Confirm CSP, distributed rate limiting, alerts, and rollback policy for the deployment provider.

Protocol status

first/1 is intentionally small and open. The repository is the canonical specification. Backward-incompatible revisions must use a new protocol string.