nos-rescue 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Laurens Verspeek
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,171 @@
+# nos-rescue
+
+Rescue staked **NOS** (and any other SOL / SPL tokens) from a **compromised Solana wallet**, when the attacker holds the same private key.
+
+The trick: **a separate, uncompromised wallet pays every transaction fee and every rent deposit.** The compromised wallet therefore never needs — and never keeps — any SOL. That alone stops most attackers, because without SOL they cannot broadcast a single transaction. This tool then races them: it unstakes, and withdraws each released slice of NOS straight to a safe wallet as it vests, while continuously sweeping out anything (SOL or tokens) that lands in the compromised wallet.
+
+> ⚠️ This is an emergency-response tool for **your own** compromised wallet. You need the compromised wallet's private key, a funded fee-payer wallet, and a safe destination address.
+
+## For victims: run it right now, no clone needed
+
+Your wallet was just hacked and you found this page? Three ways to run the tool, easiest first:
+
+1. **One HTML file (recommended):** [download `nos-rescue.html` from the latest release](https://github.com/laurensV/nos-rescue/releases/latest/download/nos-rescue.html), double-click it, fill in the wallets, click **Start rescue**. Everything runs locally in your browser tab; keys never leave it. Verify the file's SHA-256 against the release notes before pasting keys in. (If your browser refuses `file://`, run `npx serve` in the download folder and open the printed URL.)
+2. **npx (terminal):** `npx nos-rescue status <your-wallet>` to look, `npx nos-rescue rescue …` to act. Requires Node.js ≥ 20.18. See [Usage](#usage).
+3. **Hosted app:** the docs site at **<https://laurensv.github.io/nos-rescue/>** explains everything and hosts [a copy of the app](https://laurensv.github.io/nos-rescue/app.html) — convenient for a first look, but download the file and run it locally for the real rescue.
+
+Whichever you pick: create a **fresh fee-payer wallet** with a little SOL (~0.1), choose a **safe destination** the attacker can't touch, and try **dry run** first if you have the nerve to spare.
+
+## How Nosana unstaking works (why this is a race)
+
+- NOS is staked with a lock **duration** (14–365 days).
+- `unstake` starts a linear release: after unstaking, NOS vests linearly over `duration`, and any released amount can be `withdraw`n.
+- **Whoever holds the key can unstake and withdraw.** If the attacker also unstakes, the vesting clock is shared — every second, a bit more becomes withdrawable, and it's first-come-first-served on each slice.
+
+So the strategy is:
+
+1. **Unstake immediately** (the attacker will too; the clock is the same for both).
+2. **Keep sweeping** all SOL out of the compromised wallet. This is the real defense: with no SOL, the attacker can't broadcast a single transaction, so they can't withdraw anything. Sweeping is **event-driven**: a websocket watcher on the wallet and its token accounts triggers a sweep in well under a second when anything lands; interval polling is only the backup.
+3. **Withdraw the released NOS to the safe wallet on a sensible cadence** (see below), and do a final withdraw + close at full vest.
+
+The on-chain `withdraw` and rewards `claim` both let you name the **destination token account**, so NOS goes **directly to the safe wallet**, never through the compromised one.
+
+### How often should you withdraw?
+
+A slice of NOS is released *every second*, so "withdraw every slice" would mean a transaction every second — pointless fee-burn. What actually matters:
+
+- **The sweep is the defense.** As long as the compromised wallet has no SOL, the attacker cannot withdraw at all, so you don't need to race on withdrawals — you can safely batch them.
+- **Withdrawing is a safety net** in case the attacker manages to get a withdraw through (e.g. they bring their *own* fee payer). Smaller intervals shrink the amount exposed if that happens, at the cost of more fees.
+
+So the cadences are decoupled:
+
+- **CLI**: sweeps instantly on websocket events (polling every `--sweep-interval`, default 15s, as backup) and withdraws at most every `--withdraw-interval` (default `3600` = hourly; set `0` to only withdraw once fully vested; `--no-auto-withdraw` to never auto-withdraw). A final withdraw + stake-account close always fires at full vest.
+- **Web UI**: the loop sweeps continuously but does **not** auto-withdraw (a browser tab isn't a reliable long-running daemon). Click **Withdraw released NOS** whenever you want to bank what's vested so far; the final withdraw + close still happen automatically at full vest.
+
+## Two ways to run it
+
+- **Web UI** (local browser page) — easiest for a non-technical victim. Paste the two keys and the safe address, watch a live activity log. `npm run web`.
+- **CLI** — best for unattended/server use near a fast RPC. `node dist/cli.js …`.
+
+Both drive the exact same rescue engine (`src/lib/`).
+
+## Install
+
+```bash
+npm install
+npm run build   # builds the CLI (dist/)
+```
+
+Requires Node.js ≥ 20.18.
+
+## Web UI
+
+```bash
+npm run web           # dev server at http://localhost:5173
+# or produce a static bundle you can open/host locally:
+npm run web:build     # outputs to dist-web/
+npm run web:preview
+# or build the single self-contained file (what releases ship):
+npm run web:build:single   # outputs dist-single/nos-rescue.html
+```
+
+Open the page, fill in **Network**, an optional fast **RPC**, the **compromised wallet key**, the **fee payer key**, and the **safe destination address**, then:
+
+- **Check status** — read-only view of stake, vesting timeline, pending rewards, balances.
+- **Start rescue** — runs the daemon in the tab: sweeps continuously and unstakes, but does **not** auto-withdraw. **Keep the tab open**; the loop lives there.
+- **Withdraw released NOS** — banks whatever has vested so far to the safe wallet. Click it whenever; the final withdraw + close still fire automatically at full vest.
+- **Stop** — halts after the current iteration.
+
+Keys are pasted directly into the page (base58 or a `keypair.json` array), held only in the tab's memory, and never sent anywhere except as signed transactions to your RPC. Run it on a machine you trust.
+
+## The three wallets
+
+| Role | What it is | Needs SOL? |
+|------|-----------|-----------|
+| **Compromised** | The hacked wallet holding the stake. You provide its key. | No |
+| **Fee payer** | A separate, clean wallet you control. Pays all fees + rent. | **Yes** — fund it with some SOL |
+| **Safe** | Destination address. Receives all rescued NOS/SOL/tokens. | No |
+
+## Usage
+
+Provide keys via flags, environment variables, or interactive hidden prompt. Every `node dist/cli.js` below can be replaced with `npx nos-rescue` if you installed nothing.
+
+```bash
+# Inspect a wallet's stake / rewards / balances (read-only, no keys needed)
+node dist/cli.js status <WALLET_ADDRESS>
+
+# Full rescue daemon (recommended): sweep, unstake, withdraw-as-it-vests, close, keep sweeping
+node dist/cli.js rescue \
+  --rpc "https://your-fast-rpc" \
+  --safe <SAFE_ADDRESS> \
+  --hacked-key ./hacked.json \
+  --payer-key ./payer.json
+
+# Or with environment variables (keeps keys out of shell history)
+export NOS_RESCUE_RPC="https://your-fast-rpc"
+export NOS_RESCUE_SAFE="<SAFE_ADDRESS>"
+export NOS_RESCUE_HACKED_KEY="<base58 or path>"
+export NOS_RESCUE_PAYER_KEY="<base58 or path>"
+node dist/cli.js rescue
+```
+
+Individual one-shot commands are also available:
+
+```bash
+node dist/cli.js unstake     # claim rewards to safe wallet, close reward acct, unstake (atomic)
+node dist/cli.js withdraw    # withdraw currently-released NOS to the safe wallet
+node dist/cli.js sweep       # move all SOL + SPL tokens out (add --watch to loop)
+```
+
+Keys accepted as **base58 private key** or a path to a **`keypair.json`** (the Solana CLI array format).
+
+### Dry run
+
+Add the global `--dry-run` flag to any command to **simulate every transaction instead of sending it** — a sanity check before anything moves. Each transaction is built and signed exactly as it would be for real, run through `simulateTransaction`, and logged with its outcome. `rescue --dry-run` does one full pass and exits.
+
+```bash
+node dist/cli.js --dry-run rescue   # shows exactly what would happen; nothing is sent
+```
+
+### RPC endpoint
+
+Works out of the box on a public RPC, but a public RPC is slow and rate-limited — in a race against an attacker that can cost you slices. **Strongly recommended:** a fast private RPC (Helius / QuickNode / Triton free tiers all work) via `--rpc` or `NOS_RESCUE_RPC`.
+
+The websocket endpoint defaults to the RPC URL with `ws(s)://`. If your provider uses a different websocket URL (or you run against a local validator, where it's port 8900), pass `--ws <url>` or `NOS_RESCUE_WS`.
+
+## What the `rescue` daemon does each loop
+
+1. Ensures the safe wallet has a NOS token account (rent paid by the fee payer).
+2. **Checks the fee payer's balance** — if it can't pay for a transaction anymore, the rescue pauses and alerts every pass until you fund it (and warns early when it's merely low).
+3. Sweeps all SOL + SPL/Token-2022 balances from the compromised wallet to the safe wallet, and **closes each drained token account so its ~0.002 SOL rent also goes to the safe wallet** (empty accounts are closed for their rent too; wrapped SOL is unwrapped by closing). A pass runs instantly whenever the websocket sees value land.
+4. If still staked: **claims pending rewards to the safe wallet, closes the reward account, and unstakes — all in one atomic transaction.**
+5. If unstaked and auto-withdraw is on: **withdraws the released NOS to the safe wallet on the configured cadence** (default hourly).
+6. If the attacker re-stakes to grief you: detects it and unstakes again.
+7. When fully vested: **withdraws the remainder and closes the stake account** (rent released, then swept).
+8. Keeps sweeping incoming SOL/tokens forever (until you Ctrl-C).
+
+Every transaction is signed by both the compromised wallet (as authority) and the fee payer (who pays), so the compromised wallet spends nothing.
+
+## Architecture
+
+The core is a reusable, browser-safe library under [`src/lib/`](src/lib/) (exported from `src/lib/index.ts`). Both front-ends are thin wrappers over it: the CLI in [`src/cli.ts`](src/cli.ts) and the local web UI in [`web/`](web/) (Vite + vanilla TS).
+
+- `stake.ts` — stake account decoding, live vesting math (ported from the on-chain `StakeAccount::withdraw`), unstake/withdraw/close instruction builders.
+- `rewards.ts` — `nosana-rewards` `claim` / `close` instructions (hand-built, since `@nosana/kit` doesn't wrap them) so rewards route to the safe wallet.
+- `sweep.ts` — enumerate and move all SOL + SPL/Token-2022 balances, creating destination ATAs with fee-payer rent and closing drained source accounts (rent → safe wallet).
+- `watch.ts` — websocket subscriptions (wallet account + token accounts by owner, at `processed` commitment) that wake the sweep loop instantly, with auto-reconnect.
+- `rescue.ts` — the orchestration daemon.
+
+Built on [`@nosana/kit`](https://www.npmjs.com/package/@nosana/kit), which natively supports a distinct fee payer (`client.solana.feePayer`) and per-ATA rent payer.
+
+## Verification
+
+- `npm test` runs the unit suite: the vesting math (`withdrawableAmount`) pinned against the on-chain formula across edge cases, sweep instruction building (transfer + close, rent reclaim, frozen accounts, wSOL unwrap), and the websocket notification parsing.
+- The sweep engine, websocket-triggered sweeping, ATA rent reclaim, dry-run, and fee-payer pause/resume have been **executed end-to-end against a local `solana-test-validator`** (real transactions; sub-second sweep reaction measured).
+- The unstake-with-rewards-claim and the withdraw-via-separate-fee-payer transactions have been **simulated successfully against live mainnet stake accounts** (see `status` on any real staker to inspect state). No mainnet transactions are broadcast during simulation.
+
+## Security notes
+
+- Private keys are only ever held in memory; nothing is written to disk. `.gitignore` excludes `*.key` and `keypair*.json`.
+- Prefer the interactive prompt or env vars over shell flags (flags land in shell history).
+- This tool moves assets **out** of a wallet you say is compromised. Double-check the `--safe` address — funds sent there are the whole point, and irreversible.

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,196 @@
+#!/usr/bin/env node
+import { Command } from 'commander';
+import { address } from '@solana/kit';
+import { createNosanaClient, NosanaNetwork } from '@nosana/kit';
+import { resolveWallet } from './lib/wallets.js';
+import { fetchStakeInfo } from './lib/stake.js';
+import { fetchRewardAccount, fetchReflectionAccount, pendingRewards } from './lib/rewards.js';
+import { ensureSafeNosAta, formatDuration, formatNos, formatSol, runRescue, sweepOnce, unstakeNow, withdrawReleased, } from './lib/rescue.js';
+import { createWaker, watchWalletActivity } from './lib/watch.js';
+import { NOS_DECIMALS } from './lib/constants.js';
+const program = new Command()
+    .name('nos-rescue')
+    .description('Rescue staked NOS (and everything else) from a compromised wallet.\n' +
+    'All transaction fees and rent are paid by a separate, uncompromised fee payer,\n' +
+    'so the compromised wallet never needs — and never keeps — any SOL.')
+    .option('--rpc <url>', 'Solana RPC endpoint (env: NOS_RESCUE_RPC). A fast private RPC strongly recommended')
+    .option('--ws <url>', 'websocket endpoint (env: NOS_RESCUE_WS); default: the RPC endpoint with ws(s)://')
+    .option('--network <net>', 'mainnet or devnet', 'mainnet')
+    .option('--hacked-key <key>', 'compromised wallet: base58 key or keypair.json path (env: NOS_RESCUE_HACKED_KEY)')
+    .option('--payer-key <key>', 'fee payer wallet: base58 key or keypair.json path (env: NOS_RESCUE_PAYER_KEY)')
+    .option('--safe <address>', 'SAFE destination wallet address (env: NOS_RESCUE_SAFE)')
+    .option('--dry-run', 'simulate every transaction instead of sending it (nothing moves on-chain)');
+function log(msg) {
+    console.log(`[${new Date().toISOString()}] ${msg}`);
+}
+function makeClient(opts) {
+    const network = opts.network === 'devnet' ? NosanaNetwork.DEVNET : NosanaNetwork.MAINNET;
+    const rpcEndpoint = opts.rpc ?? process.env.NOS_RESCUE_RPC;
+    const wsEndpoint = opts.ws ?? process.env.NOS_RESCUE_WS;
+    const solana = {
+        ...(rpcEndpoint ? { rpcEndpoint } : {}),
+        ...(wsEndpoint ? { wsEndpoint } : {}),
+    };
+    const client = createNosanaClient(network, Object.keys(solana).length ? { solana } : undefined);
+    if (!rpcEndpoint) {
+        console.warn('WARNING: using the default public RPC endpoint. In a race against an attacker,\n' +
+            'a fast private RPC (Helius/QuickNode/Triton free tier works) can make the difference.\n' +
+            'Pass one with --rpc <url> or NOS_RESCUE_RPC.\n');
+    }
+    return client;
+}
+async function makeContext(opts) {
+    const client = makeClient(opts);
+    const hacked = await resolveWallet({
+        value: opts.hackedKey,
+        envVar: 'NOS_RESCUE_HACKED_KEY',
+        promptLabel: 'COMPROMISED wallet key',
+    });
+    const payer = await resolveWallet({
+        value: opts.payerKey,
+        envVar: 'NOS_RESCUE_PAYER_KEY',
+        promptLabel: 'FEE PAYER wallet key',
+    });
+    const safeRaw = opts.safe ?? process.env.NOS_RESCUE_SAFE;
+    if (!safeRaw)
+        throw new Error('Missing safe destination address (--safe or NOS_RESCUE_SAFE)');
+    const safe = address(safeRaw);
+    if (safe === hacked.address)
+        throw new Error('Safe address must differ from the compromised wallet');
+    if (payer.address === hacked.address)
+        throw new Error('Fee payer must be a different (uncompromised) wallet');
+    client.wallet = hacked;
+    client.solana.feePayer = payer;
+    if (opts.dryRun)
+        log('DRY RUN enabled: transactions are simulated, nothing is sent.');
+    return { client, network: opts.network, hacked, payer, safe, log, dryRun: opts.dryRun };
+}
+function abortSignalOnSigint() {
+    const controller = new AbortController();
+    process.on('SIGINT', () => {
+        log('Stopping...');
+        controller.abort();
+    });
+    return controller.signal;
+}
+program
+    .command('status')
+    .description('show stake, rewards and balances of a wallet (no keys needed)')
+    .argument('<owner>', 'wallet address to inspect')
+    .action(async (owner) => {
+    const opts = program.opts();
+    const client = makeClient(opts);
+    const ownerAddr = address(owner);
+    const sol = await client.solana.getBalance(ownerAddr);
+    const nos = await client.nos.getBalance(ownerAddr).catch(() => 0n);
+    console.log(`Wallet:        ${ownerAddr}`);
+    console.log(`SOL balance:   ${formatSol(sol)}`);
+    console.log(`NOS balance:   ${formatNos(nos)}`);
+    const stake = await fetchStakeInfo(client, ownerAddr);
+    if (!stake) {
+        console.log('Stake:         none');
+    }
+    else {
+        console.log(`Stake account: ${stake.address}`);
+        console.log(`  staked:      ${formatNos(stake.amount)}`);
+        console.log(`  duration:    ${formatDuration(Number(stake.duration))}`);
+        if (stake.timeUnstake === 0n) {
+            console.log('  state:       STAKED (not unstaked yet)');
+        }
+        else {
+            const now = Math.floor(Date.now() / 1000);
+            console.log(`  state:       UNSTAKED at ${new Date(Number(stake.timeUnstake) * 1000).toISOString()}`);
+            console.log(`  vault:       ${formatNos(stake.vaultBalance)}`);
+            console.log(`  withdrawable now: ${formatNos(stake.withdrawable)}`);
+            console.log(`  fully vested: ${new Date(Number(stake.fullyVestedAt) * 1000).toISOString()} (${formatDuration(Number(stake.fullyVestedAt) - now)} left)`);
+        }
+    }
+    const reward = await fetchRewardAccount(client, ownerAddr);
+    if (!reward) {
+        console.log('Rewards:       no reward account (already closed or never opened)');
+    }
+    else {
+        const reflection = await fetchReflectionAccount(client);
+        console.log(`Rewards:       ~${formatNos(pendingRewards(reward, reflection))} pending (account ${reward.address})`);
+    }
+});
+program
+    .command('rescue')
+    .description('full rescue daemon: sweep continuously, unstake, withdraw on a cadence, close')
+    .option('--sweep-interval <seconds>', 'seconds between backup sweep/status polls (websocket events trigger sweeps instantly)', '15')
+    .option('--withdraw-interval <seconds>', 'min seconds between partial withdrawals; 0 = only at full vest', '3600')
+    .option('--no-auto-withdraw', 'do not withdraw automatically; sweep only (withdraw with the `withdraw` command)')
+    .option('--min-withdraw <nos>', 'minimum withdrawable NOS before sending a partial withdraw tx', '0')
+    .action(async (cmdOpts) => {
+    const ctx = await makeContext(program.opts());
+    const minWithdraw = BigInt(Math.round(parseFloat(cmdOpts.minWithdraw) * 10 ** NOS_DECIMALS));
+    await runRescue(ctx, {
+        sweepIntervalSeconds: parseInt(cmdOpts.sweepInterval, 10),
+        withdrawIntervalSeconds: parseInt(cmdOpts.withdrawInterval, 10),
+        autoWithdraw: cmdOpts.autoWithdraw,
+        minWithdraw,
+        signal: abortSignalOnSigint(),
+    });
+});
+program
+    .command('unstake')
+    .description('one-shot: claim rewards to safe wallet, close reward account, unstake (atomic)')
+    .action(async () => {
+    const ctx = await makeContext(program.opts());
+    const stake = await fetchStakeInfo(ctx.client, ctx.hacked.address);
+    if (!stake)
+        throw new Error('No stake account found for this wallet');
+    if (stake.timeUnstake !== 0n) {
+        log('Already unstaked; nothing to do.');
+        return;
+    }
+    const safeNosAta = await ensureSafeNosAta(ctx);
+    await unstakeNow(ctx, stake, safeNosAta);
+});
+program
+    .command('withdraw')
+    .description('one-shot: withdraw currently released NOS to the safe wallet (and close if fully vested)')
+    .action(async () => {
+    const ctx = await makeContext(program.opts());
+    const safeNosAta = await ensureSafeNosAta(ctx);
+    const res = await withdrawReleased(ctx, safeNosAta);
+    if (!res.stake)
+        throw new Error('No stake account found for this wallet');
+    if (res.withdrawn === 0n && !res.closed)
+        log('Nothing withdrawable right now.');
+});
+program
+    .command('sweep')
+    .description('move all SOL and SPL tokens out of the compromised wallet')
+    .option('--watch', 'keep watching (websocket-triggered, interval polling as backup) and sweeping', false)
+    .option('--interval <seconds>', 'seconds between backup sweeps in watch mode', '15')
+    .action(async (cmdOpts) => {
+    const ctx = await makeContext(program.opts());
+    const signal = abortSignalOnSigint();
+    const interval = parseInt(cmdOpts.interval, 10) * 1000;
+    const waker = createWaker();
+    if (cmdOpts.watch) {
+        watchWalletActivity({
+            client: ctx.client,
+            owner: ctx.hacked.address,
+            log,
+            signal,
+            onActivity: (source) => {
+                log(`Websocket: incoming value detected (${source}); sweeping immediately`);
+                waker.wake();
+            },
+        });
+    }
+    do {
+        const moved = await sweepOnce(ctx);
+        if (moved === 0)
+            log('Nothing to sweep.');
+        if (cmdOpts.watch)
+            await waker.wait(interval, signal);
+    } while (cmdOpts.watch && !signal.aborted);
+});
+program.parseAsync().catch((err) => {
+    console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);
+    process.exit(1);
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,OAAO,EAAgB,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAkC,MAAM,aAAa,CAAC;AAChG,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAC9F,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,SAAS,EACT,SAAS,EACT,SAAS,EACT,SAAS,EACT,UAAU,EACV,gBAAgB,GAEjB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAYlD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE;KAC1B,IAAI,CAAC,YAAY,CAAC;KAClB,WAAW,CACV,sEAAsE;IACpE,kFAAkF;IAClF,oEAAoE,CACvE;KACA,MAAM,CAAC,aAAa,EAAE,oFAAoF,CAAC;KAC3G,MAAM,CAAC,YAAY,EAAE,kFAAkF,CAAC;KACxG,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,EAAE,SAAS,CAAC;KACzD,MAAM,CAAC,oBAAoB,EAAE,kFAAkF,CAAC;KAChH,MAAM,CAAC,mBAAmB,EAAE,+EAA+E,CAAC;KAC5G,MAAM,CAAC,kBAAkB,EAAE,wDAAwD,CAAC;KACpF,MAAM,CAAC,WAAW,EAAE,2EAA2E,CAAC,CAAC;AAEpG,SAAS,GAAG,CAAC,GAAW;IACtB,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,GAAG,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,UAAU,CAAC,IAAgB;IAClC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC;IACzF,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACxD,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC;IACF,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAChG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,CAAC,IAAI,CACV,kFAAkF;YAChF,yFAAyF;YACzF,gDAAgD,CACnD,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAgB;IACzC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;QACjC,KAAK,EAAE,IAAI,CAAC,SAAS;QACrB,MAAM,EAAE,uBAAuB;QAC/B,WAAW,EAAE,wBAAwB;KACtC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC;QAChC,KAAK,EAAE,IAAI,CAAC,QAAQ;QACpB,MAAM,EAAE,sBAAsB;QAC9B,WAAW,EAAE,sBAAsB;KACpC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IACzD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAC9F,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE9B,IAAI,IAAI,KAAK,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IACrG,IAAI,KAAK,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAE9G,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,MAAM,CAAC,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC;IAC/B,IAAI,IAAI,CAAC,MAAM;QAAE,GAAG,CAAC,+DAA+D,CAAC,CAAC;IACtF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;AAC1F,CAAC;AAED,SAAS,mBAAmB;IAC1B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;QACxB,GAAG,CAAC,aAAa,CAAC,CAAC;QACnB,UAAU,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IACH,OAAO,UAAU,CAAC,MAAM,CAAC;AAC3B,CAAC;AAED,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,+DAA+D,CAAC;KAC5E,QAAQ,CAAC,SAAS,EAAE,2BAA2B,CAAC;KAChD,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,EAAE;IAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAc,CAAC;IACxC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,SAAS,GAAY,OAAO,CAAC,KAAK,CAAC,CAAC;IAE1C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACnE,OAAO,CAAC,GAAG,CAAC,kBAAkB,SAAS,EAAE,CAAC,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,kBAAkB,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,kBAAkB,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhD,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,kBAAkB,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,kBAAkB,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;QACxE,IAAI,KAAK,CAAC,WAAW,KAAK,EAAE,EAAE,CAAC;YAC7B,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;QAC1D,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YACtG,OAAO,CAAC,GAAG,CAAC,kBAAkB,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAC/D,OAAO,CAAC,GAAG,CAAC,uBAAuB,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YACpE,OAAO,CAAC,GAAG,CACT,mBAAmB,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC,QAAQ,CAC5I,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;IACnF,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,mBAAmB,SAAS,CAAC,cAAc,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,qBAAqB,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;IACtH,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,+EAA+E,CAAC;KAC5F,MAAM,CAAC,4BAA4B,EAAE,uFAAuF,EAAE,IAAI,CAAC;KACnI,MAAM,CAAC,+BAA+B,EAAE,gEAAgE,EAAE,MAAM,CAAC;KACjH,MAAM,CAAC,oBAAoB,EAAE,kFAAkF,CAAC;KAChH,MAAM,CAAC,sBAAsB,EAAE,+DAA+D,EAAE,GAAG,CAAC;KACpG,MAAM,CAAC,KAAK,EAAE,OAAwG,EAAE,EAAE;IACzH,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,IAAI,EAAc,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,YAAY,CAAC,CAAC,CAAC;IAC7F,MAAM,SAAS,CAAC,GAAG,EAAE;QACnB,oBAAoB,EAAE,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC;QACzD,uBAAuB,EAAE,QAAQ,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC;QAC/D,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW;QACX,MAAM,EAAE,mBAAmB,EAAE;KAC9B,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,gFAAgF,CAAC;KAC7F,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,IAAI,EAAc,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACtE,IAAI,KAAK,CAAC,WAAW,KAAK,EAAE,EAAE,CAAC;QAC7B,GAAG,CAAC,kCAAkC,CAAC,CAAC;QACxC,OAAO;IACT,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;AAC3C,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,UAAU,CAAC;KACnB,WAAW,CAAC,0FAA0F,CAAC;KACvG,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,IAAI,EAAc,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC1E,IAAI,GAAG,CAAC,SAAS,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM;QAAE,GAAG,CAAC,iCAAiC,CAAC,CAAC;AAClF,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,2DAA2D,CAAC;KACxE,MAAM,CAAC,SAAS,EAAE,8EAA8E,EAAE,KAAK,CAAC;KACxG,MAAM,CAAC,sBAAsB,EAAE,6CAA6C,EAAE,IAAI,CAAC;KACnF,MAAM,CAAC,KAAK,EAAE,OAA6C,EAAE,EAAE;IAC9D,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,IAAI,EAAc,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC;IACvD,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;IAC5B,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,mBAAmB,CAAC;YAClB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO;YACzB,GAAG;YACH,MAAM;YACN,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE;gBACrB,GAAG,CAAC,uCAAuC,MAAM,yBAAyB,CAAC,CAAC;gBAC5E,KAAK,CAAC,IAAI,EAAE,CAAC;YACf,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IACD,GAAG,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,CAAC;YAAE,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAC1C,IAAI,OAAO,CAAC,KAAK;YAAE,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxD,CAAC,QAAQ,OAAO,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE;AAC7C,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC1C,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/lib/browserWallet.d.ts

@@ -0,0 +1,8 @@
+import { type Wallet } from '@nosana/kit';
+/**
+ * Browser-safe wallet parsing. Accepts either:
+ *  - a base58 private key string, or
+ *  - the contents of a Solana `keypair.json` (a JSON array of 64 bytes).
+ * (No filesystem access — the user pastes the key material directly.)
+ */
+export declare function walletFromInput(raw: string): Promise<Wallet>;

package/dist/lib/browserWallet.js

@@ -0,0 +1,19 @@
+import { createWalletFromBase58, createWalletFromBytes } from '@nosana/kit';
+/**
+ * Browser-safe wallet parsing. Accepts either:
+ *  - a base58 private key string, or
+ *  - the contents of a Solana `keypair.json` (a JSON array of 64 bytes).
+ * (No filesystem access — the user pastes the key material directly.)
+ */
+export async function walletFromInput(raw) {
+    const trimmed = raw.trim();
+    if (trimmed.startsWith('[')) {
+        const bytes = Uint8Array.from(JSON.parse(trimmed));
+        if (bytes.length !== 64) {
+            throw new Error(`Expected a 64-byte keypair array, got ${bytes.length} bytes`);
+        }
+        return createWalletFromBytes(bytes);
+    }
+    return createWalletFromBase58(trimmed);
+}
+//# sourceMappingURL=browserWallet.js.map

package/dist/lib/browserWallet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browserWallet.js","sourceRoot":"","sources":["../../src/lib/browserWallet.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAe,MAAM,aAAa,CAAC;AAEzF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAW;IAC/C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAa,CAAC,CAAC;QAC/D,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,yCAAyC,KAAK,CAAC,MAAM,QAAQ,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,sBAAsB,CAAC,OAAO,CAAC,CAAC;AACzC,CAAC"}

package/dist/lib/constants.d.ts

@@ -0,0 +1,20 @@
+import { type Address } from '@solana/kit';
+export declare const NOS_DECIMALS = 6;
+/** nosana-rewards program (not wrapped by @nosana/kit, so we build its instructions manually) */
+export declare const REWARDS_PROGRAM: Address<"nosRB8DUV67oLNrL45bo2pFLrmsWPiewe2Lk2DRNYCp">;
+export declare const TOKEN_PROGRAM: Address<"TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA">;
+export declare const TOKEN_2022_PROGRAM: Address<"TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb">;
+/** Native (wrapped SOL) mint; closing a wSOL account unwraps it. */
+export declare const WRAPPED_SOL_MINT: Address<"So11111111111111111111111111111111111111112">;
+export declare const NOS_MINT: Record<'mainnet' | 'devnet', Address>;
+/**
+ * Anchor instruction discriminators: sha256("global:<name>")[0..8], precomputed
+ * so this module stays browser-safe (no node:crypto). Verified against the
+ * on-chain nosana-rewards program via mainnet simulation.
+ */
+export declare const ANCHOR_DISCRIMINATORS: {
+    readonly claim: Uint8Array<ArrayBuffer>;
+    readonly close: Uint8Array<ArrayBuffer>;
+};
+/** Base transaction fee per signature; a wallet below this can't pay for any transaction itself. */
+export declare const LAMPORTS_PER_SIGNATURE = 5000n;

package/dist/lib/constants.js

@@ -0,0 +1,24 @@
+import { address } from '@solana/kit';
+export const NOS_DECIMALS = 6;
+/** nosana-rewards program (not wrapped by @nosana/kit, so we build its instructions manually) */
+export const REWARDS_PROGRAM = address('nosRB8DUV67oLNrL45bo2pFLrmsWPiewe2Lk2DRNYCp');
+export const TOKEN_PROGRAM = address('TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA');
+export const TOKEN_2022_PROGRAM = address('TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb');
+/** Native (wrapped SOL) mint; closing a wSOL account unwraps it. */
+export const WRAPPED_SOL_MINT = address('So11111111111111111111111111111111111111112');
+export const NOS_MINT = {
+    mainnet: address('nosXBVoaCTtYdLvKY6Csb4AC8JCdQKKAaWYtx2ZMoo7'),
+    devnet: address('devr1BGQndEW5k5zfvG5FsLyZv1Ap73vNgAHcQ9sUVP'),
+};
+/**
+ * Anchor instruction discriminators: sha256("global:<name>")[0..8], precomputed
+ * so this module stays browser-safe (no node:crypto). Verified against the
+ * on-chain nosana-rewards program via mainnet simulation.
+ */
+export const ANCHOR_DISCRIMINATORS = {
+    claim: Uint8Array.from([62, 198, 214, 193, 213, 159, 108, 210]),
+    close: Uint8Array.from([98, 165, 201, 177, 108, 65, 206, 96]),
+};
+/** Base transaction fee per signature; a wallet below this can't pay for any transaction itself. */
+export const LAMPORTS_PER_SIGNATURE = 5000n;
+//# sourceMappingURL=constants.js.map

package/dist/lib/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/lib/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAgB,MAAM,aAAa,CAAC;AAEpD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC;AAE9B,iGAAiG;AACjG,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC,6CAA6C,CAAC,CAAC;AAEtF,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC,6CAA6C,CAAC,CAAC;AACpF,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC,6CAA6C,CAAC,CAAC;AAEzF,oEAAoE;AACpE,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC,6CAA6C,CAAC,CAAC;AAEvF,MAAM,CAAC,MAAM,QAAQ,GAA0C;IAC7D,OAAO,EAAE,OAAO,CAAC,6CAA6C,CAAC;IAC/D,MAAM,EAAE,OAAO,CAAC,6CAA6C,CAAC;CAC/D,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC/D,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;CACrD,CAAC;AAEX,oGAAoG;AACpG,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,CAAC"}

package/dist/lib/index.d.ts

@@ -0,0 +1,7 @@
+export * from './constants.js';
+export * from './browserWallet.js';
+export * from './rewards.js';
+export * from './stake.js';
+export * from './sweep.js';
+export * from './rescue.js';
+export * from './watch.js';

package/dist/lib/index.js

@@ -0,0 +1,8 @@
+export * from './constants.js';
+export * from './browserWallet.js';
+export * from './rewards.js';
+export * from './stake.js';
+export * from './sweep.js';
+export * from './rescue.js';
+export * from './watch.js';
+//# sourceMappingURL=index.js.map

package/dist/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/lib/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/lib/rescue.d.ts

@@ -0,0 +1,85 @@
+import type { Address } from '@solana/kit';
+import type { NosanaClient, Wallet } from '@nosana/kit';
+import { type StakeInfo } from './stake.js';
+export interface RescueContext {
+    client: NosanaClient;
+    network: 'mainnet' | 'devnet';
+    hacked: Wallet;
+    payer: Wallet;
+    safe: Address;
+    log: (msg: string) => void;
+    /** simulate every transaction instead of sending it — nothing moves on-chain */
+    dryRun?: boolean;
+}
+export interface RescueOptions {
+    /**
+     * Seconds between sweep/status iterations (default 15). This polling is the
+     * BACKUP: the primary defense is the websocket watcher, which wakes the loop
+     * the moment SOL or tokens land in the compromised wallet. Polling covers
+     * websocket downtime and anything the subscriptions miss.
+     */
+    sweepIntervalSeconds?: number;
+    /**
+     * Whether the loop withdraws released NOS on its own (default true). Set false
+     * for a manual model (e.g. the web UI's "Withdraw" button), where the loop only
+     * sweeps and reports.
+     */
+    autoWithdraw?: boolean;
+    /**
+     * When auto-withdrawing, the minimum seconds between partial withdrawals
+     * (default 3600 = hourly). A released "slice" accrues every second, so
+     * withdrawing constantly would be pure fee waste; this batches it. `0` means
+     * only withdraw once the stake is fully vested. A final withdraw + close always
+     * fires at full vest regardless of this value.
+     */
+    withdrawIntervalSeconds?: number;
+    /** Minimum withdrawable NOS (base units) before a partial withdraw is worth a tx (default 0). */
+    minWithdraw?: bigint;
+    /** stop signal */
+    signal?: AbortSignal;
+}
+export interface WithdrawResult {
+    /** NOS moved to the safe wallet on this call (base units) */
+    withdrawn: bigint;
+    /** whether the stake account was closed (fully rescued) */
+    closed: boolean;
+    /** the stake as observed, or null if there is no stake account */
+    stake: StakeInfo | null;
+}
+export declare function formatNos(amount: bigint): string;
+export declare function formatSol(lamports: bigint): string;
+/** Derive (and if needed create, rent paid by the rescue payer) the safe wallet's NOS ATA. */
+export declare function ensureSafeNosAta(ctx: RescueContext): Promise<Address>;
+/** Sweep all SOL + SPL balances out of the hacked wallet. Returns number of assets moved. */
+export declare function sweepOnce(ctx: RescueContext): Promise<number>;
+/** Claim rewards, close the rewards account and unstake — atomically. */
+export declare function unstakeNow(ctx: RescueContext, stake: StakeInfo, safeNosAta: Address): Promise<void>;
+/**
+ * Withdraw all currently-released NOS from the (unstaked) vault straight to the
+ * safe wallet, and — if the stake is fully vested — close the stake account to
+ * release its rent (which the sweep then collects). Safe to call any time; it
+ * fetches fresh stake state and no-ops when there's nothing to do. This is the
+ * single path shared by the loop, the CLI `withdraw` command, and the web button.
+ */
+export declare function withdrawReleased(ctx: RescueContext, safeNosAta: Address, opts?: {
+    minWithdraw?: bigint;
+}): Promise<WithdrawResult>;
+/**
+ * The full rescue daemon:
+ *   1. sweep whatever is in the hacked wallet right now
+ *   2. unstake immediately (claim + close rewards + unstake, atomic)
+ *   3. loop: keep sweeping incoming SOL/tokens (the defense — this starves the
+ *      attacker of the SOL they'd need to move anything), and, if auto-withdraw
+ *      is on, withdraw released NOS to the safe wallet on the configured cadence
+ *      (not every slice — a slice accrues every second)
+ *   4. re-unstake if the attacker restakes to grief the vest
+ *   5. at full vest: withdraw the remainder, close the stake account, sweep the rent
+ *
+ * Sweeping is event-driven: a websocket watcher on the wallet and its token
+ * accounts wakes the loop the moment value lands (sub-second reaction); the
+ * sweepInterval polling is the backup when the websocket is down.
+ *
+ * Runs until aborted; after the stake is fully rescued it keeps sweeping.
+ */
+export declare function runRescue(ctx: RescueContext, options?: RescueOptions): Promise<void>;
+export declare function formatDuration(seconds: number): string;