@viwoapp/sdk 0.1.3 → 0.1.6

package/README.md

@@ -5,9 +5,31 @@
 
 TypeScript SDK for VCoin Protocol Integration on Solana.
 
-**Version:** 0.1.3 (Phase 5 Security Update)
+**Version:** 0.1.6 (Bug Fixes)
 
-## What's New in v0.1.2
+## What's New in v0.1.5
+
+- **ViLink Nonce-Based PDA:** Action PDAs now use deterministic `nonce` instead of `timestamp`
+- **New Field:** `actionNonce` added to `ViLinkAction` interface
+- **New Type:** `UserActionStatsExtended` with `actionNonce` counter
+- **New Method:** `getViLinkActionByNonce()` PDA helper for new derivation
+- **New Method:** `getNextNonce()` utility to get next nonce for action creation
+- **Updated Methods:** `getAction()`, `isActionValid()`, `buildExecuteTipAction()` now use nonce
+- **Deprecated:** `getActionByTimestamp()` - use `getAction()` with nonce instead
+
+### Breaking Change
+
+ViLink action PDA derivation changed from timestamp to nonce:
+```typescript
+// Old (deprecated)
+const action = await client.vilink.getAction(creator, timestamp);
+
+// New (v0.1.5+)
+const nonce = await client.vilink.getNextNonce(creator);
+const action = await client.vilink.getAction(creator, nonce);
+```
+
+## What's New in v0.1.4
 
 - **New Constants:** `MERKLE_PROOF_MAX_SIZE`, `MAX_EPOCH_BITMAP`, `LEGACY_SLASH_DEPRECATED`
 - **New Enum:** `VoteChoice` for typed governance voting (Against, For, Abstain)
@@ -155,8 +177,14 @@ const uri = client.vilink.generateUri(actionId);
 // Generate QR code data
 const qrData = client.vilink.generateQRData(actionId);
 
-// Check action validity
-const { valid, reason } = await client.vilink.isActionValid(creator, timestamp);
+// Get next nonce for action creation (v0.1.5+)
+const nonce = await client.vilink.getNextNonce();
+
+// Get action by creator + nonce (v0.1.5+)
+const action = await client.vilink.getAction(creator, nonce);
+
+// Check action validity (uses nonce, not timestamp)
+const { valid, reason } = await client.vilink.isActionValid(creator, nonce);
 ```
 
 ### Gasless (`client.gasless`)
@@ -255,7 +283,7 @@ import {
   SECURITY_CONSTANTS,
   VALID_URI_PREFIXES,
   MERKLE_CONSTANTS,
-  // v0.1.2 additions
+  // v0.1.4 additions
   MERKLE_PROOF_MAX_SIZE,    // 32 - prevents DoS
   MAX_EPOCH_BITMAP,         // 1023 - max epoch with bitmap
   LEGACY_SLASH_DEPRECATED,  // true - use propose_slash flow
@@ -267,9 +295,9 @@ SECURITY_CONSTANTS.slashApprovalTimelock;        // 48 hours
 SECURITY_CONSTANTS.maxFeeSlippageBps;            // 500 (5%)
 SECURITY_CONSTANTS.oracleConsensusRequired;      // 3-of-N
 SECURITY_CONSTANTS.circuitBreakerCooldown;       // 6 hours
-SECURITY_CONSTANTS.merkleProofMaxSize;           // 32 (v0.1.2)
-SECURITY_CONSTANTS.maxEpochBitmap;               // 1023 (v0.1.2)
-SECURITY_CONSTANTS.votingPowerVerifiedOnChain;   // true (v0.1.2)
+SECURITY_CONSTANTS.merkleProofMaxSize;           // 32 (v0.1.4)
+SECURITY_CONSTANTS.maxEpochBitmap;               // 1023 (v0.1.4)
+SECURITY_CONSTANTS.votingPowerVerifiedOnChain;   // true (v0.1.4)
 ```
 
 ## Types
@@ -286,7 +314,7 @@ import type {
   Proposal,
   VoteRecord,
   ProposalStatus,
-  VoteChoice,            // v0.1.2: Against, For, Abstain
+  VoteChoice,            // v0.1.4: Against, For, Abstain
   GovernanceConfig,
   Delegation,
   PrivateVotingConfig,
@@ -300,9 +328,10 @@ import type {
   
   // ViLink
   ViLinkConfig,
-  ViLinkAction,
+  ViLinkAction,              // v0.1.5: includes actionNonce
   ActionType,
   CreateActionParams,
+  UserActionStatsExtended,   // v0.1.5: includes actionNonce counter
   
   // Gasless
   GaslessConfig,

package/dist/index.d.mts

@@ -241,7 +241,19 @@ declare class PDAs {
     getEpochDistribution(epoch: BN): PublicKey;
     getUserClaim(user: PublicKey): PublicKey;
     getViLinkConfig(): PublicKey;
-    getViLinkAction(creator: PublicKey, timestamp: BN): PublicKey;
+    /**
+     * Get ViLink action PDA
+     * @param creator - The action creator's public key
+     * @param nonce - M-04: The action nonce (deterministic counter, NOT timestamp)
+     * @deprecated Use getViLinkActionByNonce for clarity
+     */
+    getViLinkAction(creator: PublicKey, nonce: BN): PublicKey;
+    /**
+     * Get ViLink action PDA using nonce (M-04 fix)
+     * @param creator - The action creator's public key
+     * @param nonce - The action nonce from UserActionStats.actionNonce
+     */
+    getViLinkActionByNonce(creator: PublicKey, nonce: BN): PublicKey;
     getUserActionStats(user: PublicKey): PublicKey;
     getGaslessConfig(): PublicKey;
     getSessionKey(user: PublicKey, sessionPubkey: PublicKey): PublicKey;
@@ -442,6 +454,8 @@ interface ViLinkAction {
     executed: boolean;
     executionCount: number;
     maxExecutions: number;
+    /** M-04: Nonce used for deterministic PDA derivation (replaces timestamp) */
+    actionNonce: BN;
 }
 interface CreateActionParams {
     actionType: ActionType;
@@ -452,6 +466,27 @@ interface CreateActionParams {
     maxExecutions?: number;
     contentId?: Uint8Array;
     metadata?: string;
+    /**
+     * M-04: Nonce for deterministic PDA derivation.
+     * If not provided, fetched from user's action_nonce in UserActionStats.
+     */
+    nonce?: BN;
+}
+/** M-04: User action statistics with nonce tracking */
+interface UserActionStatsExtended {
+    user: PublicKey;
+    actionsCreated: BN;
+    actionsExecuted: BN;
+    tipsSent: BN;
+    tipsReceived: BN;
+    vcoinSent: BN;
+    vcoinReceived: BN;
+    vouchesGiven: BN;
+    followsGiven: BN;
+    firstActionAt: BN;
+    lastActionAt: BN;
+    /** M-04: Next nonce to use when creating an action */
+    actionNonce: BN;
 }
 declare enum FeeMethod {
     PlatformSubsidized = 0,
@@ -824,9 +859,15 @@ declare class ViLinkClient {
      */
     getConfig(): Promise<ViLinkConfig | null>;
     /**
-     * Get action by ID
+     * Get action by nonce (M-04: deterministic PDA derivation)
+     * @param creator - The action creator's public key
+     * @param nonce - The action nonce (from UserActionStats.actionNonce at creation time)
+     */
+    getAction(creator: PublicKey, nonce: BN): Promise<ViLinkAction | null>;
+    /**
+     * @deprecated Use getAction with nonce parameter instead
      */
-    getAction(creator: PublicKey, timestamp: BN): Promise<ViLinkAction | null>;
+    getActionByTimestamp(creator: PublicKey, timestamp: BN): Promise<ViLinkAction | null>;
     /**
      * Get user action statistics
      */
@@ -841,8 +882,10 @@ declare class ViLinkClient {
     isActionTypeEnabled(actionType: ActionType): Promise<boolean>;
     /**
      * Check if action is valid for execution
+     * @param creator - The action creator's public key
+     * @param nonce - M-04: The action nonce (NOT timestamp)
      */
-    isActionValid(creator: PublicKey, timestamp: BN): Promise<{
+    isActionValid(creator: PublicKey, nonce: BN): Promise<{
         valid: boolean;
         reason?: string;
     }>;
@@ -899,8 +942,15 @@ declare class ViLinkClient {
     }): Promise<Transaction>;
     /**
      * Build execute tip action transaction
+     * @param creator - The action creator's public key
+     * @param nonce - M-04: The action nonce (NOT timestamp)
+     */
+    buildExecuteTipAction(creator: PublicKey, nonce: BN): Promise<Transaction>;
+    /**
+     * Get the next nonce for creating an action (M-04)
+     * Fetches from UserActionStats.actionNonce on-chain
      */
-    buildExecuteTipAction(creator: PublicKey, timestamp: BN): Promise<Transaction>;
+    getNextNonce(user?: PublicKey): Promise<BN>;
 }
 
 /**
@@ -1352,4 +1402,4 @@ declare class StakingClient {
     buildExtendLockTransaction(newDuration: number): Promise<Transaction>;
 }
 
-export { ACTION_SCOPES, ActionType, CONTENT_CONSTANTS, type ClaimRewardsParams, type ConnectionConfig, ContentClient, type ContentRecord, ContentState, type CreateActionParams, type CreateProposalParams, type CreateSessionParams, type DecryptionShare, type Delegation, type EpochDistribution, FIVE_A_CONSTANTS, FeeMethod, FiveAClient, type FiveAConfig, type FiveAScore, GASLESS_CONSTANTS, GOVERNANCE_CONSTANTS, GaslessClient, type GaslessConfig, GovernanceClient, type GovernanceConfig, type HookConfig, type Identity, IdentityClient, type IdentityConfig, LEGACY_SLASH_DEPRECATED, LOCK_DURATIONS, MAX_EPOCH_BITMAP, MAX_URI_LENGTH, MERKLE_CONSTANTS, MERKLE_PROOF_MAX_SIZE, PDAs, PROGRAM_IDS, type PendingAuthorityFields, type PendingScoreUpdate, type PrivateVotingConfig, type Proposal, ProposalStatus, type RegistryConfig, RewardsClient, type RewardsPoolConfig, SECURITY_CONSTANTS, SEEDS, SSCRE_CONSTANTS, STAKING_TIERS, type SessionKey, type SlashRequest, SlashStatus, type StakeParams, StakingClient, type StakingPool, StakingTier, TransactionBuilder, type UserClaim, type UserEnergy, type UserGaslessStats, type UserStake, VALID_URI_PREFIXES, VCOIN_DECIMALS, VCOIN_INITIAL_CIRCULATING, VCOIN_TOTAL_SUPPLY, type VCoinConfig, VEVCOIN_DECIMALS, VILINK_CONSTANTS, VerificationLevel, type ViLinkAction, ViLinkClient, type ViLinkConfig, ViWoClient, ViWoConnection, VoteChoice, type VoteRecord, type VouchRecord, type WalletAdapter, dateToTimestamp, formatVCoin, getCurrentTimestamp, parseVCoin, timestampToDate };
+export { ACTION_SCOPES, ActionType, CONTENT_CONSTANTS, type ClaimRewardsParams, type ConnectionConfig, ContentClient, type ContentRecord, ContentState, type CreateActionParams, type CreateProposalParams, type CreateSessionParams, type DecryptionShare, type Delegation, type EpochDistribution, FIVE_A_CONSTANTS, FeeMethod, FiveAClient, type FiveAConfig, type FiveAScore, GASLESS_CONSTANTS, GOVERNANCE_CONSTANTS, GaslessClient, type GaslessConfig, GovernanceClient, type GovernanceConfig, type HookConfig, type Identity, IdentityClient, type IdentityConfig, LEGACY_SLASH_DEPRECATED, LOCK_DURATIONS, MAX_EPOCH_BITMAP, MAX_URI_LENGTH, MERKLE_CONSTANTS, MERKLE_PROOF_MAX_SIZE, PDAs, PROGRAM_IDS, type PendingAuthorityFields, type PendingScoreUpdate, type PrivateVotingConfig, type Proposal, ProposalStatus, type RegistryConfig, RewardsClient, type RewardsPoolConfig, SECURITY_CONSTANTS, SEEDS, SSCRE_CONSTANTS, STAKING_TIERS, type SessionKey, type SlashRequest, SlashStatus, type StakeParams, StakingClient, type StakingPool, StakingTier, TransactionBuilder, type UserActionStatsExtended, type UserClaim, type UserEnergy, type UserGaslessStats, type UserStake, VALID_URI_PREFIXES, VCOIN_DECIMALS, VCOIN_INITIAL_CIRCULATING, VCOIN_TOTAL_SUPPLY, type VCoinConfig, VEVCOIN_DECIMALS, VILINK_CONSTANTS, VerificationLevel, type ViLinkAction, ViLinkClient, type ViLinkConfig, ViWoClient, ViWoConnection, VoteChoice, type VoteRecord, type VouchRecord, type WalletAdapter, dateToTimestamp, formatVCoin, getCurrentTimestamp, parseVCoin, timestampToDate };

package/dist/index.d.ts

@@ -241,7 +241,19 @@ declare class PDAs {
     getEpochDistribution(epoch: BN): PublicKey;
     getUserClaim(user: PublicKey): PublicKey;
     getViLinkConfig(): PublicKey;
-    getViLinkAction(creator: PublicKey, timestamp: BN): PublicKey;
+    /**
+     * Get ViLink action PDA
+     * @param creator - The action creator's public key
+     * @param nonce - M-04: The action nonce (deterministic counter, NOT timestamp)
+     * @deprecated Use getViLinkActionByNonce for clarity
+     */
+    getViLinkAction(creator: PublicKey, nonce: BN): PublicKey;
+    /**
+     * Get ViLink action PDA using nonce (M-04 fix)
+     * @param creator - The action creator's public key
+     * @param nonce - The action nonce from UserActionStats.actionNonce
+     */
+    getViLinkActionByNonce(creator: PublicKey, nonce: BN): PublicKey;
     getUserActionStats(user: PublicKey): PublicKey;
     getGaslessConfig(): PublicKey;
     getSessionKey(user: PublicKey, sessionPubkey: PublicKey): PublicKey;
@@ -442,6 +454,8 @@ interface ViLinkAction {
     executed: boolean;
     executionCount: number;
     maxExecutions: number;
+    /** M-04: Nonce used for deterministic PDA derivation (replaces timestamp) */
+    actionNonce: BN;
 }
 interface CreateActionParams {
     actionType: ActionType;
@@ -452,6 +466,27 @@ interface CreateActionParams {
     maxExecutions?: number;
     contentId?: Uint8Array;
     metadata?: string;
+    /**
+     * M-04: Nonce for deterministic PDA derivation.
+     * If not provided, fetched from user's action_nonce in UserActionStats.
+     */
+    nonce?: BN;
+}
+/** M-04: User action statistics with nonce tracking */
+interface UserActionStatsExtended {
+    user: PublicKey;
+    actionsCreated: BN;
+    actionsExecuted: BN;
+    tipsSent: BN;
+    tipsReceived: BN;
+    vcoinSent: BN;
+    vcoinReceived: BN;
+    vouchesGiven: BN;
+    followsGiven: BN;
+    firstActionAt: BN;
+    lastActionAt: BN;
+    /** M-04: Next nonce to use when creating an action */
+    actionNonce: BN;
 }
 declare enum FeeMethod {
     PlatformSubsidized = 0,
@@ -824,9 +859,15 @@ declare class ViLinkClient {
      */
     getConfig(): Promise<ViLinkConfig | null>;
     /**
-     * Get action by ID
+     * Get action by nonce (M-04: deterministic PDA derivation)
+     * @param creator - The action creator's public key
+     * @param nonce - The action nonce (from UserActionStats.actionNonce at creation time)
+     */
+    getAction(creator: PublicKey, nonce: BN): Promise<ViLinkAction | null>;
+    /**
+     * @deprecated Use getAction with nonce parameter instead
      */
-    getAction(creator: PublicKey, timestamp: BN): Promise<ViLinkAction | null>;
+    getActionByTimestamp(creator: PublicKey, timestamp: BN): Promise<ViLinkAction | null>;
     /**
      * Get user action statistics
      */
@@ -841,8 +882,10 @@ declare class ViLinkClient {
     isActionTypeEnabled(actionType: ActionType): Promise<boolean>;
     /**
      * Check if action is valid for execution
+     * @param creator - The action creator's public key
+     * @param nonce - M-04: The action nonce (NOT timestamp)
      */
-    isActionValid(creator: PublicKey, timestamp: BN): Promise<{
+    isActionValid(creator: PublicKey, nonce: BN): Promise<{
         valid: boolean;
         reason?: string;
     }>;
@@ -899,8 +942,15 @@ declare class ViLinkClient {
     }): Promise<Transaction>;
     /**
      * Build execute tip action transaction
+     * @param creator - The action creator's public key
+     * @param nonce - M-04: The action nonce (NOT timestamp)
+     */
+    buildExecuteTipAction(creator: PublicKey, nonce: BN): Promise<Transaction>;
+    /**
+     * Get the next nonce for creating an action (M-04)
+     * Fetches from UserActionStats.actionNonce on-chain
      */
-    buildExecuteTipAction(creator: PublicKey, timestamp: BN): Promise<Transaction>;
+    getNextNonce(user?: PublicKey): Promise<BN>;
 }
 
 /**
@@ -1352,4 +1402,4 @@ declare class StakingClient {
     buildExtendLockTransaction(newDuration: number): Promise<Transaction>;
 }
 
-export { ACTION_SCOPES, ActionType, CONTENT_CONSTANTS, type ClaimRewardsParams, type ConnectionConfig, ContentClient, type ContentRecord, ContentState, type CreateActionParams, type CreateProposalParams, type CreateSessionParams, type DecryptionShare, type Delegation, type EpochDistribution, FIVE_A_CONSTANTS, FeeMethod, FiveAClient, type FiveAConfig, type FiveAScore, GASLESS_CONSTANTS, GOVERNANCE_CONSTANTS, GaslessClient, type GaslessConfig, GovernanceClient, type GovernanceConfig, type HookConfig, type Identity, IdentityClient, type IdentityConfig, LEGACY_SLASH_DEPRECATED, LOCK_DURATIONS, MAX_EPOCH_BITMAP, MAX_URI_LENGTH, MERKLE_CONSTANTS, MERKLE_PROOF_MAX_SIZE, PDAs, PROGRAM_IDS, type PendingAuthorityFields, type PendingScoreUpdate, type PrivateVotingConfig, type Proposal, ProposalStatus, type RegistryConfig, RewardsClient, type RewardsPoolConfig, SECURITY_CONSTANTS, SEEDS, SSCRE_CONSTANTS, STAKING_TIERS, type SessionKey, type SlashRequest, SlashStatus, type StakeParams, StakingClient, type StakingPool, StakingTier, TransactionBuilder, type UserClaim, type UserEnergy, type UserGaslessStats, type UserStake, VALID_URI_PREFIXES, VCOIN_DECIMALS, VCOIN_INITIAL_CIRCULATING, VCOIN_TOTAL_SUPPLY, type VCoinConfig, VEVCOIN_DECIMALS, VILINK_CONSTANTS, VerificationLevel, type ViLinkAction, ViLinkClient, type ViLinkConfig, ViWoClient, ViWoConnection, VoteChoice, type VoteRecord, type VouchRecord, type WalletAdapter, dateToTimestamp, formatVCoin, getCurrentTimestamp, parseVCoin, timestampToDate };
+export { ACTION_SCOPES, ActionType, CONTENT_CONSTANTS, type ClaimRewardsParams, type ConnectionConfig, ContentClient, type ContentRecord, ContentState, type CreateActionParams, type CreateProposalParams, type CreateSessionParams, type DecryptionShare, type Delegation, type EpochDistribution, FIVE_A_CONSTANTS, FeeMethod, FiveAClient, type FiveAConfig, type FiveAScore, GASLESS_CONSTANTS, GOVERNANCE_CONSTANTS, GaslessClient, type GaslessConfig, GovernanceClient, type GovernanceConfig, type HookConfig, type Identity, IdentityClient, type IdentityConfig, LEGACY_SLASH_DEPRECATED, LOCK_DURATIONS, MAX_EPOCH_BITMAP, MAX_URI_LENGTH, MERKLE_CONSTANTS, MERKLE_PROOF_MAX_SIZE, PDAs, PROGRAM_IDS, type PendingAuthorityFields, type PendingScoreUpdate, type PrivateVotingConfig, type Proposal, ProposalStatus, type RegistryConfig, RewardsClient, type RewardsPoolConfig, SECURITY_CONSTANTS, SEEDS, SSCRE_CONSTANTS, STAKING_TIERS, type SessionKey, type SlashRequest, SlashStatus, type StakeParams, StakingClient, type StakingPool, StakingTier, TransactionBuilder, type UserActionStatsExtended, type UserClaim, type UserEnergy, type UserGaslessStats, type UserStake, VALID_URI_PREFIXES, VCOIN_DECIMALS, VCOIN_INITIAL_CIRCULATING, VCOIN_TOTAL_SUPPLY, type VCoinConfig, VEVCOIN_DECIMALS, VILINK_CONSTANTS, VerificationLevel, type ViLinkAction, ViLinkClient, type ViLinkConfig, ViWoClient, ViWoConnection, VoteChoice, type VoteRecord, type VouchRecord, type WalletAdapter, dateToTimestamp, formatVCoin, getCurrentTimestamp, parseVCoin, timestampToDate };

package/dist/index.js

@@ -428,12 +428,26 @@ var PDAs = class {
     );
     return pda;
   }
-  getViLinkAction(creator, timestamp) {
+  /**
+   * Get ViLink action PDA
+   * @param creator - The action creator's public key
+   * @param nonce - M-04: The action nonce (deterministic counter, NOT timestamp)
+   * @deprecated Use getViLinkActionByNonce for clarity
+   */
+  getViLinkAction(creator, nonce) {
+    return this.getViLinkActionByNonce(creator, nonce);
+  }
+  /**
+   * Get ViLink action PDA using nonce (M-04 fix)
+   * @param creator - The action creator's public key
+   * @param nonce - The action nonce from UserActionStats.actionNonce
+   */
+  getViLinkActionByNonce(creator, nonce) {
     const [pda] = import_web32.PublicKey.findProgramAddressSync(
       [
         Buffer.from(SEEDS.action),
         creator.toBuffer(),
-        timestamp.toArrayLike(Buffer, "le", 8)
+        nonce.toArrayLike(Buffer, "le", 8)
       ],
       this.programIds.vilinkProtocol
     );
@@ -1291,11 +1305,13 @@ var ViLinkClient = class {
     }
   }
   /**
-   * Get action by ID
+   * Get action by nonce (M-04: deterministic PDA derivation)
+   * @param creator - The action creator's public key
+   * @param nonce - The action nonce (from UserActionStats.actionNonce at creation time)
    */
-  async getAction(creator, timestamp) {
+  async getAction(creator, nonce) {
     try {
-      const actionPda = this.client.pdas.getViLinkAction(creator, timestamp);
+      const actionPda = this.client.pdas.getViLinkActionByNonce(creator, nonce);
       const accountInfo = await this.client.connection.connection.getAccountInfo(actionPda);
       if (!accountInfo) {
         return null;
@@ -1310,12 +1326,20 @@ var ViLinkClient = class {
         expiresAt: new import_anchor5.BN(data.slice(145, 153), "le"),
         executed: data[153] !== 0,
         executionCount: data.readUInt32LE(193),
-        maxExecutions: data.readUInt32LE(197)
+        maxExecutions: data.readUInt32LE(197),
+        actionNonce: nonce
+        // M-04: Store nonce for reference
       };
     } catch {
       return null;
     }
   }
+  /**
+   * @deprecated Use getAction with nonce parameter instead
+   */
+  async getActionByTimestamp(creator, timestamp) {
+    return this.getAction(creator, timestamp);
+  }
   /**
    * Get user action statistics
    */
@@ -1370,9 +1394,11 @@ var ViLinkClient = class {
   }
   /**
    * Check if action is valid for execution
+   * @param creator - The action creator's public key
+   * @param nonce - M-04: The action nonce (NOT timestamp)
    */
-  async isActionValid(creator, timestamp) {
-    const action = await this.getAction(creator, timestamp);
+  async isActionValid(creator, nonce) {
+    const action = await this.getAction(creator, nonce);
     if (!action) {
       return { valid: false, reason: "Action not found" };
     }
@@ -1472,22 +1498,35 @@ var ViLinkClient = class {
   }
   /**
    * Build execute tip action transaction
+   * @param creator - The action creator's public key
+   * @param nonce - M-04: The action nonce (NOT timestamp)
    */
-  async buildExecuteTipAction(creator, timestamp) {
+  async buildExecuteTipAction(creator, nonce) {
     if (!this.client.publicKey) {
       throw new Error("Wallet not connected");
     }
-    const { valid, reason } = await this.isActionValid(creator, timestamp);
+    const { valid, reason } = await this.isActionValid(creator, nonce);
     if (!valid) {
       throw new Error(reason);
     }
-    const action = await this.getAction(creator, timestamp);
+    const action = await this.getAction(creator, nonce);
     if (action?.creator.equals(this.client.publicKey)) {
       throw new Error("Cannot execute own action");
     }
     const tx = new import_web36.Transaction();
     return tx;
   }
+  /**
+   * Get the next nonce for creating an action (M-04)
+   * Fetches from UserActionStats.actionNonce on-chain
+   */
+  async getNextNonce(user) {
+    const stats = await this.getUserStats(user);
+    if (!stats) {
+      return new import_anchor5.BN(0);
+    }
+    return new import_anchor5.BN(stats.actionsCreated.toNumber());
+  }
 };
 
 // src/gasless/index.ts

package/dist/index.mjs

@@ -359,12 +359,26 @@ var PDAs = class {
     );
     return pda;
   }
-  getViLinkAction(creator, timestamp) {
+  /**
+   * Get ViLink action PDA
+   * @param creator - The action creator's public key
+   * @param nonce - M-04: The action nonce (deterministic counter, NOT timestamp)
+   * @deprecated Use getViLinkActionByNonce for clarity
+   */
+  getViLinkAction(creator, nonce) {
+    return this.getViLinkActionByNonce(creator, nonce);
+  }
+  /**
+   * Get ViLink action PDA using nonce (M-04 fix)
+   * @param creator - The action creator's public key
+   * @param nonce - The action nonce from UserActionStats.actionNonce
+   */
+  getViLinkActionByNonce(creator, nonce) {
     const [pda] = PublicKey2.findProgramAddressSync(
       [
         Buffer.from(SEEDS.action),
         creator.toBuffer(),
-        timestamp.toArrayLike(Buffer, "le", 8)
+        nonce.toArrayLike(Buffer, "le", 8)
       ],
       this.programIds.vilinkProtocol
     );
@@ -1222,11 +1236,13 @@ var ViLinkClient = class {
     }
   }
   /**
-   * Get action by ID
+   * Get action by nonce (M-04: deterministic PDA derivation)
+   * @param creator - The action creator's public key
+   * @param nonce - The action nonce (from UserActionStats.actionNonce at creation time)
    */
-  async getAction(creator, timestamp) {
+  async getAction(creator, nonce) {
     try {
-      const actionPda = this.client.pdas.getViLinkAction(creator, timestamp);
+      const actionPda = this.client.pdas.getViLinkActionByNonce(creator, nonce);
       const accountInfo = await this.client.connection.connection.getAccountInfo(actionPda);
       if (!accountInfo) {
         return null;
@@ -1241,12 +1257,20 @@ var ViLinkClient = class {
         expiresAt: new BN5(data.slice(145, 153), "le"),
         executed: data[153] !== 0,
         executionCount: data.readUInt32LE(193),
-        maxExecutions: data.readUInt32LE(197)
+        maxExecutions: data.readUInt32LE(197),
+        actionNonce: nonce
+        // M-04: Store nonce for reference
       };
     } catch {
       return null;
     }
   }
+  /**
+   * @deprecated Use getAction with nonce parameter instead
+   */
+  async getActionByTimestamp(creator, timestamp) {
+    return this.getAction(creator, timestamp);
+  }
   /**
    * Get user action statistics
    */
@@ -1301,9 +1325,11 @@ var ViLinkClient = class {
   }
   /**
    * Check if action is valid for execution
+   * @param creator - The action creator's public key
+   * @param nonce - M-04: The action nonce (NOT timestamp)
    */
-  async isActionValid(creator, timestamp) {
-    const action = await this.getAction(creator, timestamp);
+  async isActionValid(creator, nonce) {
+    const action = await this.getAction(creator, nonce);
     if (!action) {
       return { valid: false, reason: "Action not found" };
     }
@@ -1403,22 +1429,35 @@ var ViLinkClient = class {
   }
   /**
    * Build execute tip action transaction
+   * @param creator - The action creator's public key
+   * @param nonce - M-04: The action nonce (NOT timestamp)
    */
-  async buildExecuteTipAction(creator, timestamp) {
+  async buildExecuteTipAction(creator, nonce) {
     if (!this.client.publicKey) {
       throw new Error("Wallet not connected");
     }
-    const { valid, reason } = await this.isActionValid(creator, timestamp);
+    const { valid, reason } = await this.isActionValid(creator, nonce);
     if (!valid) {
       throw new Error(reason);
     }
-    const action = await this.getAction(creator, timestamp);
+    const action = await this.getAction(creator, nonce);
     if (action?.creator.equals(this.client.publicKey)) {
       throw new Error("Cannot execute own action");
     }
     const tx = new Transaction5();
     return tx;
   }
+  /**
+   * Get the next nonce for creating an action (M-04)
+   * Fetches from UserActionStats.actionNonce on-chain
+   */
+  async getNextNonce(user) {
+    const stats = await this.getUserStats(user);
+    if (!stats) {
+      return new BN5(0);
+    }
+    return new BN5(stats.actionsCreated.toNumber());
+  }
 };
 
 // src/gasless/index.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@viwoapp/sdk",
-  "version": "0.1.3",
+  "version": "0.1.6",
   "description": "ViWoApp SDK - TypeScript SDK for VCoin Protocol Integration",
   "main": "dist/index.js",
   "module": "dist/index.esm.js",