Architecture

The intent is parsed against a schema. Addresses must be base58 of the right length; amounts must be whole numbers written as strings, because JSON has no bigint and a u64 parsed as a number is silently rounded above 2^53.

refusesa malformed address, a zero amount, a sender equal to the recipient, a decimal in a base units field

Instructions are assembled server side. For a transfer that means reading which token program owns the mint, deriving the recipient's associated account, and adding an idempotent create when it does not exist yet. For a swap and a launch the instructions come from Jupiter and pump.fun respectively, and the preview says so.

refusesa mint that is not a mint, a mint account that already exists at a launch address

The unsigned transaction is simulated against mainnet with signature verification off, so the only failures reported are real ones. The compute units consumed are read from that simulation rather than guessed.

refusesanything the chain says would fail, before a wallet is ever opened

A sentence, a numbered list of what the transaction does, and every cost with how it was obtained: measured, or a protocol constant. The sentence and the bytes are generated from the same intent, so they cannot describe different things.

refusesnothing: this is where a person decides

Your wallet signs. PYNODE holds no key, has no field for a seed phrase anywhere, and never asks for one. A launch adds a second signature from a mint key generated in your browser and discarded after use.

refusesa wallet that will only sign and send together is told so rather than silently bypassing the next stage

The signed transaction is decoded and its MESSAGE region is compared byte for byte with the message that was prepared. Only an exact match is broadcast.

refusesany transaction that changed between the review and the network, with nothing sent

The signature is polled until the chain reports it confirmed or failed, or until its blockhash expires. Expired is reported as expired.

refusesresubmitting. A retry with a fresh blockhash is a second transaction that can land beside the first

The outcome is written with its signature and slot. A payment is settled, and a launch recorded, only after a server has read the chain back and found what it expected.

refuseswriting a row because an API returned 200