@steemit/steem-js 1.0.18 → 1.0.20

package/dist/auth/account-update-chain.d.ts

@@ -1,13 +1,37 @@
 /**
- * Chain-safe JSON normalization for account_update operations.
- * Matches steem::protocol::account_update_operation and authority (FC_REFLECT).
- * Broadcast via JSON-RPC uses fc::from_variant; malformed shapes cause bad_cast_exception.
+ * Chain-safe JSON normalization for `account_update` operations.
+ *
+ * Protocol types (steem/libraries/protocol):
+ * - `authority` — weight_threshold (uint32), account_auths / key_auths (fc::flat_map)
+ * - `account_update_operation` — account, optional owner/active/posting, memo_key, json_metadata (string)
+ *
+ * JSON-RPC (`condenser_api.broadcast_transaction` → fc::from_variant):
+ * - `authority` is a variant_object, not a bare key_auths array.
+ * - `fc::flat_map` serializes as an array of [key, weight] pairs (see fc/container/flat.hpp),
+ *   not a JSON object `{ "key": weight }` — object maps cause bad_cast_exception.
+ * - `json_metadata` must be a string (protocol `string`), not a parsed JSON object.
+ *
+ * Binary signing (transaction digest) uses the same logical fields; the serializer packs
+ * flat_maps as sorted on-wire maps (see serializeAuthority in serializer/transaction.ts).
+ */
+/** One entry in an fc::flat_map after JSON (de)serialization: [key, weight]. */
+export type AuthorityWeightPair = [string, number];
+/**
+ * `steem::protocol::authority` as returned by condenser / required for broadcast JSON.
+ * account_auths: flat_map<account_name_type, uint16>
+ * key_auths: flat_map<public_key_type, uint16> (keys are "STM..." strings in JSON)
  */
 export type ChainAuthority = {
     weight_threshold: number;
-    account_auths: [string, number][];
-    key_auths: [string, number][];
+    /** FC flat_map JSON: `[["account", weight], ...]` */
+    account_auths: AuthorityWeightPair[];
+    /** FC flat_map JSON: `[["STM...", weight], ...]` */
+    key_auths: AuthorityWeightPair[];
 };
+/**
+ * `steem::protocol::account_update_operation` payload for JSON broadcast and signing.
+ * Operation tuple form: `["account_update", AccountUpdatePayload]`.
+ */
 export type AccountUpdatePayload = {
     account: string;
     owner: ChainAuthority;
@@ -17,11 +41,17 @@ export type AccountUpdatePayload = {
     json_metadata: string;
 };
 export type OperationTuple = [string, Record<string, unknown>];
-/** Steem broadcast JSON requires json_metadata to be a string (not object/array). */
+/**
+ * Coerce `json_metadata` to protocol `string` (FC string field).
+ * Node rejects object/array variants with bad_cast when broadcasting.
+ */
 export declare function normalizeChainJsonMetadata(value: unknown): string;
-/** Normalize API authority data (handles object-maps and malformed arrays). */
+/** Normalize API authority data (get_accounts-style input; accepts pair arrays or object maps). */
 export declare function normalizeAuthoritySource(source: unknown): ChainAuthority;
-/** Coerce account_update operation payload to chain-safe JSON (for signing and broadcast). */
+/**
+ * Coerce account_update operation payload to protocol JSON shape for signing and broadcast.
+ * Emits fc::flat_map fields as pair arrays, not object maps.
+ */
 export declare function sanitizeAccountUpdatePayload(payload: Record<string, unknown>): AccountUpdatePayload;
 /**
  * Normalize an operation tuple before signing or JSON broadcast.

package/dist/auth/index.d.ts

@@ -1,5 +1,5 @@
 export { normalizeOperationForBroadcast, normalizeTransactionForBroadcast, normalizeChainJsonMetadata, sanitizeAccountUpdatePayload, normalizeAuthoritySource, resolveAuthorityForSerialize, } from './account-update-chain';
-export type { ChainAuthority, AccountUpdatePayload, OperationTuple } from './account-update-chain';
+export type { AuthorityWeightPair, ChainAuthority, AccountUpdatePayload, OperationTuple, } from './account-update-chain';
 export interface KeyPair {
     privateKey: string;
     publicKey: string;
@@ -49,3 +49,4 @@ export declare const verifyTransaction: (transaction: unknown, publicKey: string
 export declare const getPublicKey: (privateKey: string) => string;
 export declare const getPrivateKey: (seed: string) => string;
 export declare const signTransaction: (trx: unknown, keys: string[]) => unknown;
+export { serializeTransaction } from './serializer/transaction';

package/dist/browser.esm.js

@@ -25301,11 +25301,25 @@ if (typeof BigInt === "function") {
 }
 
 /**
- * Chain-safe JSON normalization for account_update operations.
- * Matches steem::protocol::account_update_operation and authority (FC_REFLECT).
- * Broadcast via JSON-RPC uses fc::from_variant; malformed shapes cause bad_cast_exception.
+ * Chain-safe JSON normalization for `account_update` operations.
+ *
+ * Protocol types (steem/libraries/protocol):
+ * - `authority` — weight_threshold (uint32), account_auths / key_auths (fc::flat_map)
+ * - `account_update_operation` — account, optional owner/active/posting, memo_key, json_metadata (string)
+ *
+ * JSON-RPC (`condenser_api.broadcast_transaction` → fc::from_variant):
+ * - `authority` is a variant_object, not a bare key_auths array.
+ * - `fc::flat_map` serializes as an array of [key, weight] pairs (see fc/container/flat.hpp),
+ *   not a JSON object `{ "key": weight }` — object maps cause bad_cast_exception.
+ * - `json_metadata` must be a string (protocol `string`), not a parsed JSON object.
+ *
+ * Binary signing (transaction digest) uses the same logical fields; the serializer packs
+ * flat_maps as sorted on-wire maps (see serializeAuthority in serializer/transaction.ts).
+ */
+/**
+ * Coerce `json_metadata` to protocol `string` (FC string field).
+ * Node rejects object/array variants with bad_cast when broadcasting.
  */
-/** Steem broadcast JSON requires json_metadata to be a string (not object/array). */
 function normalizeChainJsonMetadata(value) {
     if (typeof value === 'string')
         return value;
@@ -25317,6 +25331,10 @@ function normalizeChainJsonMetadata(value) {
         return JSON.stringify(value);
     return String(value);
 }
+/**
+ * Parse fc::flat_map JSON (pair array) or mistaken object-map input into pair arrays.
+ * Broadcast output always uses pair arrays per fc::from_variant(flat_map).
+ */
 function toAuthPairs(raw) {
     if (Array.isArray(raw)) {
         return raw
@@ -25345,7 +25363,7 @@ function toKeyAuthPairs(raw) {
     }
     return [];
 }
-/** Normalize API authority data (handles object-maps and malformed arrays). */
+/** Normalize API authority data (get_accounts-style input; accepts pair arrays or object maps). */
 function normalizeAuthoritySource(source) {
     if (Array.isArray(source) || !source || typeof source !== 'object') {
         return { weight_threshold: 1, account_auths: [], key_auths: [] };
@@ -25371,7 +25389,10 @@ function sanitizeAuthority(value, field) {
     }
     return { weight_threshold, account_auths, key_auths };
 }
-/** Coerce account_update operation payload to chain-safe JSON (for signing and broadcast). */
+/**
+ * Coerce account_update operation payload to protocol JSON shape for signing and broadcast.
+ * Emits fc::flat_map fields as pair arrays, not object maps.
+ */
 function sanitizeAccountUpdatePayload(payload) {
     return {
         account: String(payload.account || ''),
@@ -25783,8 +25804,9 @@ function serializeAccountCreate(bb, data) {
     writeString(bb, String(dataObj.json_metadata || ''));
 }
 /**
- * Serialize account_update operation.
- * Format: account, optional owner (1 byte + authority?), optional active, optional posting, memo_key, json_metadata.
+ * Serialize account_update_operation (steem_operations.hpp).
+ * JSON fields: account, owner/active/posting (authority objects), memo_key, json_metadata (string).
+ * Optional authorities use a presence byte before serializeAuthority.
  */
 function serializeAccountUpdate(bb, data) {
     const dataObj = data;
@@ -26451,7 +26473,26 @@ function serializeCustomJson(bb, data) {
     writeString(bb, String(dataObj.json || '{}'));
 }
 /**
- * Serialize Authority
+ * Read authority map fields for binary packing (on-wire sorted flat_map).
+ * JSON-RPC uses fc::flat_map → array of [key, weight] pairs; object maps are accepted
+ * here only so callers that forgot to normalize still sign the intended keys.
+ */
+function authorityMapEntries(raw) {
+    if (Array.isArray(raw)) {
+        return raw
+            .filter((entry) => Array.isArray(entry) && entry.length >= 2)
+            .map(([key, weight]) => [String(key), Number(weight)])
+            .filter(([, weight]) => Number.isFinite(weight));
+    }
+    if (raw && typeof raw === 'object') {
+        return Object.entries(raw)
+            .map(([key, weight]) => [String(key), Number(weight)])
+            .filter(([, weight]) => Number.isFinite(weight));
+    }
+    return [];
+}
+/**
+ * Serialize steem::protocol::authority (weight_threshold + sorted account/key flat_maps).
  */
 function serializeAuthority(bb, auth) {
     if (Array.isArray(auth)) {
@@ -26463,40 +26504,19 @@ function serializeAuthority(bb, auth) {
     const authObj = auth;
     bb.writeUint32(authObj.weight_threshold || 1);
     // Account auths (map<string, uint16>)
-    const accountAuths = (Array.isArray(authObj.account_auths) ? authObj.account_auths : []);
-    // Maps in Steem serialization are sorted by key
-    const accountAuthsArray = accountAuths;
-    accountAuthsArray.sort((a, b) => {
-        const aKey = Array.isArray(a) && a[0] ? String(a[0]) : '';
-        const bKey = Array.isArray(b) && b[0] ? String(b[0]) : '';
-        return aKey.localeCompare(bKey);
-    });
+    const accountAuths = authorityMapEntries(authObj.account_auths).sort((a, b) => a[0].localeCompare(b[0]));
     bb.writeVarint32(accountAuths.length);
-    for (const authEntry of accountAuths) {
-        if (Array.isArray(authEntry) && authEntry.length >= 2) {
-            writeString(bb, String(authEntry[0]));
-            bb.writeUint16(authEntry[1]);
-        }
+    for (const [account, weight] of accountAuths) {
+        writeString(bb, account);
+        bb.writeUint16(weight);
     }
     // Key auths (map<public_key, uint16>)
-    const keyAuths = (Array.isArray(authObj.key_auths) ? authObj.key_auths : []);
-    // Maps in Steem serialization are sorted by key (public key string)
-    // But serialized as bytes. Usually sorting by string representation of public key works.
-    const keyAuthsArray = keyAuths;
-    keyAuthsArray.sort((a, b) => {
-        const aKey = Array.isArray(a) && a[0] ? String(a[0]) : '';
-        const bKey = Array.isArray(b) && b[0] ? String(b[0]) : '';
-        return aKey.localeCompare(bKey);
-    });
+    const keyAuths = authorityMapEntries(authObj.key_auths).sort((a, b) => a[0].localeCompare(b[0]));
     bb.writeVarint32(keyAuths.length);
-    for (const keyAuth of keyAuths) {
-        if (Array.isArray(keyAuth) && keyAuth.length >= 2) {
-            const keyStr = String(keyAuth[0]);
-            const weight = keyAuth[1];
-            const pubKey = PublicKey.fromStringOrThrow(keyStr);
-            bb.append(pubKey.toBuffer());
-            bb.writeUint16(weight);
-        }
+    for (const [keyStr, weight] of keyAuths) {
+        const pubKey = PublicKey.fromStringOrThrow(keyStr);
+        bb.append(pubKey.toBuffer());
+        bb.writeUint16(weight);
     }
 }
 /**
@@ -26836,18 +26856,34 @@ const verifySignature = (message, signature, publicKey) => {
         return false;
     }
 };
+// Serialize a transaction to its binary form for digest calculation.
+// Alias for transaction.toBuffer() so verifyTransaction mirrors signTransaction's
+// serialization path exactly (signTransaction calls transaction.toBuffer at line 161).
+const serializeTrx = (trx) => transaction.toBuffer(trx);
 const verifyTransaction = (transaction, publicKey) => {
     try {
         const pub = PublicKey.fromString(publicKey);
         if (!pub)
             return false;
-        const serialized = bufferExports.Buffer.from(JSON.stringify(transaction));
         const trx = transaction;
         if (!trx.signatures || !Array.isArray(trx.signatures))
             return false;
+        // Reconstruct the exact digest signTransaction signs over:
+        //   Buffer.concat([chain_id, transaction.toBuffer(normalizedTrx)])
+        // signatures are NOT part of the signed digest — signTransaction serializes
+        // BEFORE attaching signatures — so strip them before serializing, otherwise
+        // serializeTransaction() would emit the signatures array and change the digest.
+        const normalizedTrx = normalizeTransactionForBroadcast(trx);
+        // Build a copy without the signatures key, so serializeTransaction() does not
+        // emit the signatures array into the digest (signTransaction serializes pre-signature).
+        const trxWithoutSigs = { ...normalizedTrx };
+        delete trxWithoutSigs.signatures;
+        const chainId = getConfig().get('chain_id') || '';
+        const cid = bufferExports.Buffer.from(chainId, 'hex');
+        const buf = serializeTrx(trxWithoutSigs);
         return trx.signatures.some((sig) => {
             const signature = Signature.fromHex(sig);
-            return signature.verifyBuffer(serialized, pub);
+            return signature.verifyBuffer(bufferExports.Buffer.concat([cid, buf]), pub);
         });
     }
     catch {
@@ -26892,6 +26928,7 @@ const auth = /*#__PURE__*/Object.freeze({
 	normalizeTransactionForBroadcast: normalizeTransactionForBroadcast,
 	resolveAuthorityForSerialize: resolveAuthorityForSerialize,
 	sanitizeAccountUpdatePayload: sanitizeAccountUpdatePayload,
+	serializeTransaction: serializeTransaction,
 	sign: sign$1,
 	signTransaction: signTransaction,
 	toWif: toWif,
@@ -29700,7 +29737,7 @@ const steem = {
     memo,
     operations,
     utils: utils$3,
-    version: '1.0.18',
+    version: '1.0.20',
     config: {
         set: (options) => {
             // If nodes is provided, extract the first node as url for API