Solana Dev

# Solana Development Skill (framework-kit-first)

## What this Skill is for
Use this Skill when the user asks for:
- Solana dApp UI work (React / Next.js)
- Wallet connection + signing flows
- Transaction building / sending / confirmation UX
- On-chain program development (Anchor or Pinocchio)
- Client SDK generation (typed program clients)
- Local testing (LiteSVM, Mollusk, Surfpool)
- Security hardening and audit-style reviews
- Confidential transfers (Token-2022 ZK extension)
- **Toolchain setup, version mismatches, GLIBC errors, dependency conflicts**
- **Upgrading Anchor/Solana CLI versions, migration between versions**

## Default stack decisions (opinionated)
1) **UI: framework-kit first**
- Use `@solana/client` + `@solana/react-hooks`.
- Prefer Wallet Standard discovery/connect via the framework-kit client.

2) **SDK: @solana/kit first**
- Build clients with `createClient()` from `@solana/kit`, then `.use(...)` plugins:
  ```ts
  createClient()
    .use(signer(mySigner))
    .use(solanaRpc({ rpcUrl }));
  // or solanaLocalRpc / solanaDevnetRpc / solanaMainnetRpc from @solana/kit-plugin-rpc
  ```
- Default to `signer()` / `signerFromFile()` / `generatedSigner()` from
  `@solana/kit-plugin-signer` — they set both `payer` and `identity` to the same keypair (the
  common case). For fresh local/devnet signers, install the RPC/LiteSVM plugin after
  `generatedSigner()`, then fund with `airdropSigner(...)`. Reach for the role-specific variants
  (`payer()` + `identity()`) only when fees and authority must come from different keypairs.
- Use `@solana-program/*` program plugins (e.g., `tokenProgram()`) for fluent instruction APIs.
- Prefer Kit types (`Address`, `Signer`, transaction message APIs, codecs).

3) **Legacy compatibility: web3.js only at boundaries**
- If you must integrate a library that expects web3.js objects (`PublicKey`, `Transaction`, `Connection`),
  use `@solana/web3-compat` as the boundary adapter.
- Do not let web3.js types leak across the entire app; contain them to adapter modules.

4) **Programs**
- Default: Anchor (fast iteration, IDL generation, mature tooling).
- Performance/footprint: Pinocchio when you need CU optimization, minimal binary size,
  zero dependencies, or fine-grained control over parsing/allocations.

5) **Testing**
- Default: LiteSVM or Mollusk for unit tests (fast feedback, runs in-process).
- Use Surfpool for integration tests against realistic cluster state (mainnet/devnet) locally.
- Use solana-test-validator only when you need specific RPC behaviors not emulated by LiteSVM.

## Agent safety guardrails

### Transaction review (W009)
- **Never sign or send transactions without explicit user approval.** Always display the transaction summary (recipient, amount, token, fee payer, cluster) and wait for confirmation before proceeding.
- **Never ask for or store private keys, seed phrases, or keypair files.** Use wallet-standard signing flows where the wallet holds the keys.
- **Default to devnet/localnet.** Never target mainnet unless the user explicitly requests it and confirms the cluster.
- *