Developers
Developer overview
Architecture, configuration and conventions for building on or contributing to the VIVI web app and its on-chain interfaces.
Last updated 11 November 2026
Architecture
- Web app. Next.js (App Router) with TypeScript and Tailwind CSS. Public pages live under the site routes, the member dashboard under /app.
- Wallets. The Solana wallet adapter provides connection for Phantom, Trust Wallet, Solflare, Backpack, Coinbase Wallet, Ledger and others.
- Chain access. Balances are read with @solana/web3.js and @solana/spl-token against the configured RPC endpoint. The token uses the Token-2022 program.
- Protocol program. An Anchor program is planned to hold stakes, accrue rewards and record delegations.
Configuration
Network and addresses are set through public environment variables, with safe defaults for development. Nothing secret belongs in a NEXT_PUBLIC variable.
| Variable | Purpose |
|---|---|
| NEXT_PUBLIC_SOLANA_NETWORK | One of devnet, testnet or mainnet-beta. Defaults to devnet. |
| NEXT_PUBLIC_RPC_URL | RPC endpoint. Use a dedicated provider in production; public endpoints are rate limited. |
| NEXT_PUBLIC_TOKEN_MINT_ADDRESS | The official VIVI Token-2022 mint. While unset, the app shows a clearly labelled demo balance. |
| NEXT_PUBLIC_STAKING_PROGRAM_ID | The deployed staking program ID. While unset, program calls are simulated. |
| NEXT_PUBLIC_SITE_URL | Canonical site URL used for metadata and the sitemap. |
Project conventions
- Content for documentation and legal pages is typed data in lib/content and rendered by a shared view, so each new page is one entry.
- Placeholder values are collected in lib/config.ts. Replace them there rather than in components.
- Eligibility and jurisdiction rules live in lib/compliance.ts and are enforced by the proxy as well as in the interface.
- Interactive transactions must show the user what is being signed and never request a seed phrase or private key.
Reporting vulnerabilities
Report security issues privately to security@vivi.example. Do not open public issues for vulnerabilities and do not test against other users' funds. A machine-readable contact is published at /.well-known/security.txt.