nos-rescue 0.1.0

package/dist/lib/sweep.d.ts

@@ -0,0 +1,34 @@
+import { type Address, type Instruction, type TransactionSigner } from '@solana/kit';
+import type { NosanaClient } from '@nosana/kit';
+export interface SweepItem {
+    /** 'SOL' or the token mint */
+    mint: Address | 'SOL';
+    amount: bigint;
+    decimals: number;
+    /** human description for logs */
+    label: string;
+    /** atomic instruction group that moves this asset to the safe wallet */
+    instructions: Instruction[];
+}
+/**
+ * Build instruction groups that move everything of value (SOL + all SPL /
+ * Token-2022 balances) from the compromised wallet to the safe wallet.
+ * Destination ATAs are created idempotently with rent paid by `payer`,
+ * so the compromised wallet never needs a single lamport.
+ *
+ * Token accounts are also CLOSED, with their ~0.002 SOL rent sent straight to
+ * the safe wallet — that reclaims the rent and denies it to the attacker:
+ *   - empty token accounts: close only (pure rent reclaim)
+ *   - wrapped SOL: close only (unwraps balance + rent as native SOL to safe)
+ *   - classic SPL with a balance: transfer + close in the same transaction
+ *   - Token-2022 with a balance: transfer, then close as a SEPARATE group, so
+ *     an extension that blocks closing (e.g. withheld transfer fees) can never
+ *     block the transfer itself
+ */
+export declare function buildSweepInstructions(client: NosanaClient, params: {
+    hacked: TransactionSigner;
+    safe: Address;
+    payer: TransactionSigner;
+    /** ignore SOL balances below this (default: LAMPORTS_PER_SIGNATURE, the minimum useful to an attacker) */
+    minLamports?: bigint;
+}): Promise<SweepItem[]>;

package/dist/lib/sweep.js

@@ -0,0 +1,129 @@
+import { address, } from '@solana/kit';
+import { getTransferSolInstruction } from '@solana-program/system';
+import { findAssociatedTokenPda, getCloseAccountInstruction, getCreateAssociatedTokenIdempotentInstruction, getTransferInstruction, } from '@solana-program/token';
+import { LAMPORTS_PER_SIGNATURE, TOKEN_2022_PROGRAM, TOKEN_PROGRAM, WRAPPED_SOL_MINT, } from './constants.js';
+/**
+ * Build instruction groups that move everything of value (SOL + all SPL /
+ * Token-2022 balances) from the compromised wallet to the safe wallet.
+ * Destination ATAs are created idempotently with rent paid by `payer`,
+ * so the compromised wallet never needs a single lamport.
+ *
+ * Token accounts are also CLOSED, with their ~0.002 SOL rent sent straight to
+ * the safe wallet — that reclaims the rent and denies it to the attacker:
+ *   - empty token accounts: close only (pure rent reclaim)
+ *   - wrapped SOL: close only (unwraps balance + rent as native SOL to safe)
+ *   - classic SPL with a balance: transfer + close in the same transaction
+ *   - Token-2022 with a balance: transfer, then close as a SEPARATE group, so
+ *     an extension that blocks closing (e.g. withheld transfer fees) can never
+ *     block the transfer itself
+ */
+export async function buildSweepInstructions(client, params) {
+    const items = [];
+    const owner = params.hacked.address;
+    for (const tokenProgram of [TOKEN_PROGRAM, TOKEN_2022_PROGRAM]) {
+        const res = await client.solana.rpc
+            .getTokenAccountsByOwner(owner, { programId: tokenProgram }, { encoding: 'jsonParsed' })
+            .send();
+        for (const { pubkey, account } of res.value) {
+            const info = account.data.parsed?.info;
+            if (!info)
+                continue;
+            if (info.state === 'frozen')
+                continue; // can neither transfer nor close
+            const amount = BigInt(info.tokenAmount?.amount ?? '0');
+            const mint = address(info.mint);
+            const decimals = Number(info.tokenAmount?.decimals ?? 0);
+            const closeIx = getCloseAccountInstruction({ account: pubkey, destination: params.safe, owner: params.hacked }, { programAddress: tokenProgram });
+            if (amount === 0n) {
+                items.push({
+                    mint,
+                    amount: 0n,
+                    decimals,
+                    label: `rent of empty token account ${pubkey}`,
+                    instructions: [closeIx],
+                });
+                continue;
+            }
+            if (mint === WRAPPED_SOL_MINT) {
+                items.push({
+                    mint,
+                    amount,
+                    decimals,
+                    label: `${amount} wrapped SOL (unwrapped) + rent of ${pubkey}`,
+                    instructions: [closeIx],
+                });
+                continue;
+            }
+            const [destAta] = await findAssociatedTokenPda({
+                mint,
+                owner: params.safe,
+                tokenProgram,
+            });
+            const moveInstructions = [
+                getCreateAssociatedTokenIdempotentInstruction({
+                    payer: params.payer,
+                    owner: params.safe,
+                    mint,
+                    ata: destAta,
+                    tokenProgram,
+                }),
+                getTransferInstruction({
+                    source: pubkey,
+                    destination: destAta,
+                    authority: params.hacked,
+                    amount,
+                }, { programAddress: tokenProgram }),
+            ];
+            if (tokenProgram === TOKEN_PROGRAM) {
+                // closing a drained classic SPL account can't fail; keep it atomic
+                moveInstructions.push(closeIx);
+                items.push({
+                    mint,
+                    amount,
+                    decimals,
+                    label: `${amount} of ${mint} + account rent`,
+                    instructions: moveInstructions,
+                });
+            }
+            else {
+                items.push({
+                    mint,
+                    amount,
+                    decimals,
+                    label: `${amount} of ${mint}`,
+                    instructions: moveInstructions,
+                });
+                items.push({
+                    mint,
+                    amount: 0n,
+                    decimals,
+                    label: `rent of drained token account ${pubkey}`,
+                    instructions: [closeIx],
+                });
+            }
+        }
+    }
+    // SOL last: fees are paid by `payer`, so the FULL lamport balance can leave.
+    const minLamports = params.minLamports ?? LAMPORTS_PER_SIGNATURE;
+    const lamports = await client.solana.getBalance(owner);
+    if (lamports >= minLamports && lamports > 0n) {
+        items.push({
+            mint: 'SOL',
+            amount: lamports,
+            decimals: 9,
+            label: formatLamports(lamports),
+            instructions: [
+                getTransferSolInstruction({
+                    source: params.hacked,
+                    destination: params.safe,
+                    amount: lamports,
+                }),
+            ],
+        });
+    }
+    return items;
+}
+function formatLamports(lamports) {
+    return `${Number(lamports) / 1e9} SOL`;
+}
+//# sourceMappingURL=sweep.js.map

package/dist/lib/sweep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sweep.js","sourceRoot":"","sources":["../../src/lib/sweep.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,GAIR,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,6CAA6C,EAC7C,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,aAAa,EACb,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AAaxB;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAoB,EACpB,MAMC;IAED,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;IAEpC,KAAK,MAAM,YAAY,IAAI,CAAC,aAAa,EAAE,kBAAkB,CAAC,EAAE,CAAC;QAC/D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG;aAChC,uBAAuB,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;aACvF,IAAI,EAAE,CAAC;QACV,KAAK,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAC5C,MAAM,IAAI,GAAI,OAAO,CAAC,IAAY,CAAC,MAAM,EAAE,IAAI,CAAC;YAChD,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ;gBAAE,SAAS,CAAC,iCAAiC;YACxE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,IAAI,GAAG,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,IAAI,CAAC,CAAC,CAAC;YACzD,MAAM,OAAO,GAAG,0BAA0B,CACxC,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,EACnE,EAAE,cAAc,EAAE,YAAY,EAAE,CACjC,CAAC;YAEF,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;gBAClB,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI;oBACJ,MAAM,EAAE,EAAE;oBACV,QAAQ;oBACR,KAAK,EAAE,+BAA+B,MAAM,EAAE;oBAC9C,YAAY,EAAE,CAAC,OAAO,CAAC;iBACxB,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBAC9B,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI;oBACJ,MAAM;oBACN,QAAQ;oBACR,KAAK,EAAE,GAAG,MAAM,sCAAsC,MAAM,EAAE;oBAC9D,YAAY,EAAE,CAAC,OAAO,CAAC;iBACxB,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,sBAAsB,CAAC;gBAC7C,IAAI;gBACJ,KAAK,EAAE,MAAM,CAAC,IAAI;gBAClB,YAAY;aACb,CAAC,CAAC;YACH,MAAM,gBAAgB,GAAkB;gBACtC,6CAA6C,CAAC;oBAC5C,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,KAAK,EAAE,MAAM,CAAC,IAAI;oBAClB,IAAI;oBACJ,GAAG,EAAE,OAAO;oBACZ,YAAY;iBACb,CAAC;gBACF,sBAAsB,CACpB;oBACE,MAAM,EAAE,MAAM;oBACd,WAAW,EAAE,OAAO;oBACpB,SAAS,EAAE,MAAM,CAAC,MAAM;oBACxB,MAAM;iBACP,EACD,EAAE,cAAc,EAAE,YAAY,EAAE,CACjC;aACF,CAAC;YACF,IAAI,YAAY,KAAK,aAAa,EAAE,CAAC;gBACnC,mEAAmE;gBACnE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC/B,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI;oBACJ,MAAM;oBACN,QAAQ;oBACR,KAAK,EAAE,GAAG,MAAM,OAAO,IAAI,iBAAiB;oBAC5C,YAAY,EAAE,gBAAgB;iBAC/B,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI;oBACJ,MAAM;oBACN,QAAQ;oBACR,KAAK,EAAE,GAAG,MAAM,OAAO,IAAI,EAAE;oBAC7B,YAAY,EAAE,gBAAgB;iBAC/B,CAAC,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI;oBACJ,MAAM,EAAE,EAAE;oBACV,QAAQ;oBACR,KAAK,EAAE,iCAAiC,MAAM,EAAE;oBAChD,YAAY,EAAE,CAAC,OAAO,CAAC;iBACxB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,sBAAsB,CAAC;IACjE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACvD,IAAI,QAAQ,IAAI,WAAW,IAAI,QAAQ,GAAG,EAAE,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,CAAC;YACX,KAAK,EAAE,cAAc,CAAC,QAAQ,CAAC;YAC/B,YAAY,EAAE;gBACZ,yBAAyB,CAAC;oBACxB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,WAAW,EAAE,MAAM,CAAC,IAAI;oBACxB,MAAM,EAAE,QAAQ;iBACjB,CAAC;aACH;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,GAAG,MAAM,CAAC;AACzC,CAAC"}

package/dist/lib/wallets.d.ts

@@ -0,0 +1,14 @@
+import { type Wallet } from '@nosana/kit';
+/**
+ * Resolve a wallet from (in order of precedence):
+ * 1. an explicit value (base58 private key, or path to a keypair.json)
+ * 2. an environment variable holding the same
+ * 3. an interactive hidden prompt
+ */
+export declare function resolveWallet(opts: {
+    value?: string;
+    envVar: string;
+    promptLabel: string;
+}): Promise<Wallet>;
+/** Prompt on the terminal without echoing the typed characters. */
+export declare function promptHidden(question: string): Promise<string>;

package/dist/lib/wallets.js

@@ -0,0 +1,65 @@
+import { existsSync } from 'node:fs';
+import { stdin, stdout } from 'node:process';
+import { createWalletFromBase58, loadWalletFromFile } from '@nosana/kit';
+/**
+ * Resolve a wallet from (in order of precedence):
+ * 1. an explicit value (base58 private key, or path to a keypair.json)
+ * 2. an environment variable holding the same
+ * 3. an interactive hidden prompt
+ */
+export async function resolveWallet(opts) {
+    const raw = opts.value ?? process.env[opts.envVar];
+    if (raw)
+        return walletFromString(raw);
+    const entered = await promptHidden(`Enter ${opts.promptLabel} (base58 private key or path to keypair.json): `);
+    if (!entered)
+        throw new Error(`No ${opts.promptLabel} provided`);
+    return walletFromString(entered.trim());
+}
+async function walletFromString(raw) {
+    if (raw.endsWith('.json') || existsSync(raw)) {
+        return loadWalletFromFile(raw);
+    }
+    return createWalletFromBase58(raw);
+}
+/** Prompt on the terminal without echoing the typed characters. */
+export function promptHidden(question) {
+    return new Promise((resolve, reject) => {
+        if (!stdin.isTTY) {
+            reject(new Error('stdin is not a TTY; provide keys via flags or environment variables'));
+            return;
+        }
+        stdout.write(question);
+        stdin.setRawMode(true);
+        stdin.resume();
+        stdin.setEncoding('utf8');
+        let input = '';
+        const onData = (char) => {
+            switch (char) {
+                case '\n':
+                case '\r':
+                case '': // Ctrl-D
+                    stdin.setRawMode(false);
+                    stdin.pause();
+                    stdin.off('data', onData);
+                    stdout.write('\n');
+                    resolve(input);
+                    break;
+                case '': // Ctrl-C
+                    stdin.setRawMode(false);
+                    stdin.pause();
+                    stdout.write('\n');
+                    process.exit(130);
+                    break;
+                case '': // Backspace
+                case '\b':
+                    input = input.slice(0, -1);
+                    break;
+                default:
+                    input += char;
+            }
+        };
+        stdin.on('data', onData);
+    });
+}
+//# sourceMappingURL=wallets.js.map

package/dist/lib/wallets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wallets.js","sourceRoot":"","sources":["../../src/lib/wallets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAe,MAAM,aAAa,CAAC;AAEtF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAInC;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,GAAG;QAAE,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAEtC,MAAM,OAAO,GAAG,MAAM,YAAY,CAChC,SAAS,IAAI,CAAC,WAAW,iDAAiD,CAC3E,CAAC;IACF,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,WAAW,WAAW,CAAC,CAAC;IACjE,OAAO,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,GAAW;IACzC,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,sBAAsB,CAAC,GAAG,CAAC,CAAC;AACrC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC,CAAC;YACzF,OAAO;QACT,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvB,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACvB,KAAK,CAAC,MAAM,EAAE,CAAC;QACf,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC1B,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE;YAC9B,QAAQ,IAAI,EAAE,CAAC;gBACb,KAAK,IAAI,CAAC;gBACV,KAAK,IAAI,CAAC;gBACV,KAAK,GAAG,EAAE,SAAS;oBACjB,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;oBACxB,KAAK,CAAC,KAAK,EAAE,CAAC;oBACd,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;oBAC1B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBACnB,OAAO,CAAC,KAAK,CAAC,CAAC;oBACf,MAAM;gBACR,KAAK,GAAG,EAAE,SAAS;oBACjB,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;oBACxB,KAAK,CAAC,KAAK,EAAE,CAAC;oBACd,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBACnB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAClB,MAAM;gBACR,KAAK,GAAG,CAAC,CAAC,YAAY;gBACtB,KAAK,IAAI;oBACP,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;oBAC3B,MAAM;gBACR;oBACE,KAAK,IAAI,IAAI,CAAC;YAClB,CAAC;QACH,CAAC,CAAC;QACF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/lib/watch.d.ts

@@ -0,0 +1,41 @@
+import type { Address } from '@solana/kit';
+import type { NosanaClient } from '@nosana/kit';
+/**
+ * A latch that lets a loop sleep until either its polling interval elapses or
+ * a websocket notification wakes it early. A wake() that arrives while the
+ * loop is busy (not waiting) is remembered, so the next wait() returns
+ * immediately instead of losing the event.
+ */
+export interface Waker {
+    wake(): void;
+    /** wait for ms, a wake() call, or signal abort — whichever comes first */
+    wait(ms: number, signal?: AbortSignal): Promise<void>;
+}
+export declare function createWaker(): Waker;
+export interface WatchParams {
+    client: NosanaClient;
+    owner: Address;
+    /**
+     * Called whenever the websocket reports value present in the wallet:
+     * lamports on the wallet account, or a positive balance on any token
+     * account owned by it (existing or freshly created). Notifications that
+     * show the account empty (our own sweep landing) are filtered out.
+     */
+    onActivity: (source: string) => void;
+    log?: (msg: string) => void;
+    signal?: AbortSignal;
+}
+/**
+ * Watch a wallet over websocket so incoming funds are detected in well under a
+ * second instead of on the polling interval:
+ *   - accountSubscribe on the wallet itself (SOL arriving)
+ *   - programSubscribe on both token programs, filtered by owner (offset 32),
+ *     which fires for existing AND newly-created token accounts
+ *
+ * Subscriptions are made at 'processed' commitment for the earliest possible
+ * signal. Each subscription auto-reconnects with backoff; the caller's
+ * interval polling remains the backup while the websocket is down.
+ */
+export declare function watchWalletActivity(params: WatchParams): void;
+/** Token account balance (u64 LE at offset 64), or 0n when absent/closed. */
+export declare function tokenAmountFromBase64(data: string | undefined): bigint;

package/dist/lib/watch.js

@@ -0,0 +1,140 @@
+import { TOKEN_2022_PROGRAM, TOKEN_PROGRAM } from './constants.js';
+export function createWaker() {
+    let pending = false;
+    let release = null;
+    return {
+        wake() {
+            if (release) {
+                const r = release;
+                release = null;
+                r();
+            }
+            else {
+                pending = true;
+            }
+        },
+        wait(ms, signal) {
+            if (pending || signal?.aborted) {
+                pending = false;
+                return Promise.resolve();
+            }
+            return new Promise((resolve) => {
+                const t = setTimeout(done, ms);
+                function done() {
+                    signal?.removeEventListener('abort', done);
+                    clearTimeout(t);
+                    if (release === done)
+                        release = null;
+                    resolve();
+                }
+                release = done;
+                signal?.addEventListener('abort', done);
+            });
+        },
+    };
+}
+/**
+ * Watch a wallet over websocket so incoming funds are detected in well under a
+ * second instead of on the polling interval:
+ *   - accountSubscribe on the wallet itself (SOL arriving)
+ *   - programSubscribe on both token programs, filtered by owner (offset 32),
+ *     which fires for existing AND newly-created token accounts
+ *
+ * Subscriptions are made at 'processed' commitment for the earliest possible
+ * signal. Each subscription auto-reconnects with backoff; the caller's
+ * interval polling remains the backup while the websocket is down.
+ */
+export function watchWalletActivity(params) {
+    const { client, owner, onActivity, log, signal } = params;
+    const subs = client.solana.rpcSubscriptions;
+    const ownerBytes = owner.toString();
+    void runSubscription({
+        label: 'wallet SOL balance',
+        log,
+        signal,
+        subscribe: (abortSignal) => subs.accountNotifications(owner, { commitment: 'processed' }).subscribe({ abortSignal }),
+        onNotification: (notif) => {
+            const lamports = BigInt(notif?.value?.lamports ?? 0);
+            if (lamports > 0n)
+                onActivity('wallet SOL balance');
+        },
+    });
+    for (const [name, program] of [
+        ['token accounts', TOKEN_PROGRAM],
+        ['token-2022 accounts', TOKEN_2022_PROGRAM],
+    ]) {
+        void runSubscription({
+            label: name,
+            log,
+            signal,
+            subscribe: (abortSignal) => subs
+                .programNotifications(program, {
+                commitment: 'processed',
+                encoding: 'base64',
+                // token account owner sits at data offset 32 for both programs
+                filters: [{ memcmp: { offset: 32n, bytes: ownerBytes, encoding: 'base58' } }],
+            })
+                .subscribe({ abortSignal }),
+            onNotification: (notif) => {
+                const data = notif?.value?.account?.data;
+                const amount = tokenAmountFromBase64(Array.isArray(data) ? data[0] : undefined);
+                if (amount > 0n)
+                    onActivity(name);
+            },
+        });
+    }
+}
+/** Token account balance (u64 LE at offset 64), or 0n when absent/closed. */
+export function tokenAmountFromBase64(data) {
+    if (!data)
+        return 0n;
+    let raw;
+    try {
+        raw = atob(data);
+    }
+    catch {
+        return 0n;
+    }
+    if (raw.length < 72)
+        return 0n;
+    let amount = 0n;
+    for (let i = 71; i >= 64; i--) {
+        amount = (amount << 8n) | BigInt(raw.charCodeAt(i));
+    }
+    return amount;
+}
+async function runSubscription(params) {
+    const { label, subscribe, onNotification, log, signal } = params;
+    let backoffMs = 1000;
+    while (!signal?.aborted) {
+        // tie the subscription's lifetime to the caller's signal
+        const controller = new AbortController();
+        const onAbort = () => controller.abort();
+        signal?.addEventListener('abort', onAbort);
+        try {
+            const notifications = await subscribe(controller.signal);
+            log?.(`Websocket: subscribed to ${label}`);
+            backoffMs = 1000;
+            for await (const notification of notifications) {
+                onNotification(notification);
+            }
+            if (!signal?.aborted)
+                log?.(`Websocket: ${label} subscription closed; reconnecting...`);
+        }
+        catch (err) {
+            if (!signal?.aborted) {
+                const msg = err instanceof Error ? err.message : String(err);
+                log?.(`Websocket: ${label} subscription failed (${msg}); retrying in ${Math.round(backoffMs / 1000)}s (polling continues meanwhile)`);
+            }
+        }
+        finally {
+            signal?.removeEventListener('abort', onAbort);
+            controller.abort();
+        }
+        if (signal?.aborted)
+            return;
+        await new Promise((r) => setTimeout(r, backoffMs));
+        backoffMs = Math.min(backoffMs * 2, 30_000);
+    }
+}
+//# sourceMappingURL=watch.js.map

package/dist/lib/watch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"watch.js","sourceRoot":"","sources":["../../src/lib/watch.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAcnE,MAAM,UAAU,WAAW;IACzB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,OAAO,GAAwB,IAAI,CAAC;IACxC,OAAO;QACL,IAAI;YACF,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,CAAC,GAAG,OAAO,CAAC;gBAClB,OAAO,GAAG,IAAI,CAAC;gBACf,CAAC,EAAE,CAAC;YACN,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,EAAU,EAAE,MAAoB;YACnC,IAAI,OAAO,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBAC/B,OAAO,GAAG,KAAK,CAAC;gBAChB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;YAC3B,CAAC;YACD,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBACnC,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC/B,SAAS,IAAI;oBACX,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;oBAC3C,YAAY,CAAC,CAAC,CAAC,CAAC;oBAChB,IAAI,OAAO,KAAK,IAAI;wBAAE,OAAO,GAAG,IAAI,CAAC;oBACrC,OAAO,EAAE,CAAC;gBACZ,CAAC;gBACD,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC1C,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAgBD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAmB;IACrD,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC;IAC5C,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,EAAmC,CAAC;IAErE,KAAK,eAAe,CAAC;QACnB,KAAK,EAAE,oBAAoB;QAC3B,GAAG;QACH,MAAM;QACN,SAAS,EAAE,CAAC,WAAW,EAAE,EAAE,CACzB,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;QAC1F,cAAc,EAAE,CAAC,KAAU,EAAE,EAAE;YAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,IAAI,CAAC,CAAC,CAAC;YACrD,IAAI,QAAQ,GAAG,EAAE;gBAAE,UAAU,CAAC,oBAAoB,CAAC,CAAC;QACtD,CAAC;KACF,CAAC,CAAC;IAEH,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI;QAC5B,CAAC,gBAAgB,EAAE,aAAa,CAAC;QACjC,CAAC,qBAAqB,EAAE,kBAAkB,CAAC;KACnC,EAAE,CAAC;QACX,KAAK,eAAe,CAAC;YACnB,KAAK,EAAE,IAAI;YACX,GAAG;YACH,MAAM;YACN,SAAS,EAAE,CAAC,WAAW,EAAE,EAAE,CACzB,IAAI;iBACD,oBAAoB,CAAC,OAAO,EAAE;gBAC7B,UAAU,EAAE,WAAW;gBACvB,QAAQ,EAAE,QAAQ;gBAClB,+DAA+D;gBAC/D,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC;aAC9E,CAAC;iBACD,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC;YAC/B,cAAc,EAAE,CAAC,KAAU,EAAE,EAAE;gBAC7B,MAAM,IAAI,GAAG,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC;gBACzC,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBAChF,IAAI,MAAM,GAAG,EAAE;oBAAE,UAAU,CAAC,IAAI,CAAC,CAAC;YACpC,CAAC;SACF,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,qBAAqB,CAAC,IAAwB;IAC5D,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,EAAE,CAAC;IAC/B,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9B,MAAM,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,MAM9B;IACC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IACjE,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACxB,yDAAyD;QACzD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACzC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACzD,GAAG,EAAE,CAAC,4BAA4B,KAAK,EAAE,CAAC,CAAC;YAC3C,SAAS,GAAG,IAAI,CAAC;YACjB,IAAI,KAAK,EAAE,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;gBAC/C,cAAc,CAAC,YAAY,CAAC,CAAC;YAC/B,CAAC;YACD,IAAI,CAAC,MAAM,EAAE,OAAO;gBAAE,GAAG,EAAE,CAAC,cAAc,KAAK,uCAAuC,CAAC,CAAC;QAC1F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBACrB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,GAAG,EAAE,CAAC,cAAc,KAAK,yBAAyB,GAAG,kBAAkB,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,iCAAiC,CAAC,CAAC;YACxI,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,UAAU,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QACD,IAAI,MAAM,EAAE,OAAO;YAAE,OAAO;QAC5B,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;QACnD,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC"}

package/package.json

@@ -0,0 +1,68 @@
+{
+  "name": "nos-rescue",
+  "version": "0.1.0",
+  "description": "Rescue staked NOS (and all SOL/SPL tokens) from a compromised Solana wallet — a separate fee payer covers every fee and rent, so the hacked wallet never needs SOL",
+  "type": "module",
+  "license": "MIT",
+  "author": "Laurens Verspeek",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/laurensV/nos-rescue.git"
+  },
+  "homepage": "https://laurensv.github.io/nos-rescue/",
+  "bugs": {
+    "url": "https://github.com/laurensV/nos-rescue/issues"
+  },
+  "keywords": [
+    "solana",
+    "nosana",
+    "nos",
+    "wallet",
+    "rescue",
+    "recovery",
+    "compromised-wallet",
+    "hacked-wallet",
+    "fee-payer",
+    "stake",
+    "unstake",
+    "security"
+  ],
+  "engines": {
+    "node": ">=20.18.0"
+  },
+  "bin": {
+    "nos-rescue": "dist/cli.js"
+  },
+  "main": "dist/lib/index.js",
+  "types": "dist/lib/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "prepublishOnly": "npm run build && npm test",
+    "dev": "tsx src/cli.ts",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "web": "vite",
+    "web:build": "vite build",
+    "web:build:single": "vite build --config vite.single.config.ts",
+    "web:preview": "vite preview"
+  },
+  "dependencies": {
+    "@nosana/kit": "2.7.0",
+    "@solana-program/system": "0.10.0",
+    "@solana-program/token": "0.9.0",
+    "@solana/kit": "5.4.0",
+    "commander": "^12.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.19.27",
+    "tsx": "^4.19.0",
+    "typescript": "^5.7.0",
+    "vite": "^6.0.0",
+    "vite-plugin-singlefile": "^2.3.3",
+    "vitest": "^4.1.10"
+  }
+}