@steemit/steem-js 1.0.18 → 1.0.20

package/dist/index.umd.js

@@ -24987,11 +24987,25 @@
 	}
 
 	/**
-	 * Chain-safe JSON normalization for account_update operations.
-	 * Matches steem::protocol::account_update_operation and authority (FC_REFLECT).
-	 * Broadcast via JSON-RPC uses fc::from_variant; malformed shapes cause bad_cast_exception.
+	 * Chain-safe JSON normalization for `account_update` operations.
+	 *
+	 * Protocol types (steem/libraries/protocol):
+	 * - `authority` — weight_threshold (uint32), account_auths / key_auths (fc::flat_map)
+	 * - `account_update_operation` — account, optional owner/active/posting, memo_key, json_metadata (string)
+	 *
+	 * JSON-RPC (`condenser_api.broadcast_transaction` → fc::from_variant):
+	 * - `authority` is a variant_object, not a bare key_auths array.
+	 * - `fc::flat_map` serializes as an array of [key, weight] pairs (see fc/container/flat.hpp),
+	 *   not a JSON object `{ "key": weight }` — object maps cause bad_cast_exception.
+	 * - `json_metadata` must be a string (protocol `string`), not a parsed JSON object.
+	 *
+	 * Binary signing (transaction digest) uses the same logical fields; the serializer packs
+	 * flat_maps as sorted on-wire maps (see serializeAuthority in serializer/transaction.ts).
+	 */
+	/**
+	 * Coerce `json_metadata` to protocol `string` (FC string field).
+	 * Node rejects object/array variants with bad_cast when broadcasting.
 	 */
-	/** Steem broadcast JSON requires json_metadata to be a string (not object/array). */
 	function normalizeChainJsonMetadata(value) {
 	    if (typeof value === 'string')
 	        return value;
@@ -25003,6 +25017,10 @@
 	        return JSON.stringify(value);
 	    return String(value);
 	}
+	/**
+	 * Parse fc::flat_map JSON (pair array) or mistaken object-map input into pair arrays.
+	 * Broadcast output always uses pair arrays per fc::from_variant(flat_map).
+	 */
 	function toAuthPairs(raw) {
 	    if (Array.isArray(raw)) {
 	        return raw
@@ -25031,7 +25049,7 @@
 	    }
 	    return [];
 	}
-	/** Normalize API authority data (handles object-maps and malformed arrays). */
+	/** Normalize API authority data (get_accounts-style input; accepts pair arrays or object maps). */
 	function normalizeAuthoritySource(source) {
 	    if (Array.isArray(source) || !source || typeof source !== 'object') {
 	        return { weight_threshold: 1, account_auths: [], key_auths: [] };
@@ -25057,7 +25075,10 @@
 	    }
 	    return { weight_threshold, account_auths, key_auths };
 	}
-	/** Coerce account_update operation payload to chain-safe JSON (for signing and broadcast). */
+	/**
+	 * Coerce account_update operation payload to protocol JSON shape for signing and broadcast.
+	 * Emits fc::flat_map fields as pair arrays, not object maps.
+	 */
 	function sanitizeAccountUpdatePayload(payload) {
 	    return {
 	        account: String(payload.account || ''),
@@ -25469,8 +25490,9 @@
 	    writeString(bb, String(dataObj.json_metadata || ''));
 	}
 	/**
-	 * Serialize account_update operation.
-	 * Format: account, optional owner (1 byte + authority?), optional active, optional posting, memo_key, json_metadata.
+	 * Serialize account_update_operation (steem_operations.hpp).
+	 * JSON fields: account, owner/active/posting (authority objects), memo_key, json_metadata (string).
+	 * Optional authorities use a presence byte before serializeAuthority.
 	 */
 	function serializeAccountUpdate(bb, data) {
 	    const dataObj = data;
@@ -26137,7 +26159,26 @@
 	    writeString(bb, String(dataObj.json || '{}'));
 	}
 	/**
-	 * Serialize Authority
+	 * Read authority map fields for binary packing (on-wire sorted flat_map).
+	 * JSON-RPC uses fc::flat_map → array of [key, weight] pairs; object maps are accepted
+	 * here only so callers that forgot to normalize still sign the intended keys.
+	 */
+	function authorityMapEntries(raw) {
+	    if (Array.isArray(raw)) {
+	        return raw
+	            .filter((entry) => Array.isArray(entry) && entry.length >= 2)
+	            .map(([key, weight]) => [String(key), Number(weight)])
+	            .filter(([, weight]) => Number.isFinite(weight));
+	    }
+	    if (raw && typeof raw === 'object') {
+	        return Object.entries(raw)
+	            .map(([key, weight]) => [String(key), Number(weight)])
+	            .filter(([, weight]) => Number.isFinite(weight));
+	    }
+	    return [];
+	}
+	/**
+	 * Serialize steem::protocol::authority (weight_threshold + sorted account/key flat_maps).
 	 */
 	function serializeAuthority(bb, auth) {
 	    if (Array.isArray(auth)) {
@@ -26149,40 +26190,19 @@
 	    const authObj = auth;
 	    bb.writeUint32(authObj.weight_threshold || 1);
 	    // Account auths (map<string, uint16>)
-	    const accountAuths = (Array.isArray(authObj.account_auths) ? authObj.account_auths : []);
-	    // Maps in Steem serialization are sorted by key
-	    const accountAuthsArray = accountAuths;
-	    accountAuthsArray.sort((a, b) => {
-	        const aKey = Array.isArray(a) && a[0] ? String(a[0]) : '';
-	        const bKey = Array.isArray(b) && b[0] ? String(b[0]) : '';
-	        return aKey.localeCompare(bKey);
-	    });
+	    const accountAuths = authorityMapEntries(authObj.account_auths).sort((a, b) => a[0].localeCompare(b[0]));
 	    bb.writeVarint32(accountAuths.length);
-	    for (const authEntry of accountAuths) {
-	        if (Array.isArray(authEntry) && authEntry.length >= 2) {
-	            writeString(bb, String(authEntry[0]));
-	            bb.writeUint16(authEntry[1]);
-	        }
+	    for (const [account, weight] of accountAuths) {
+	        writeString(bb, account);
+	        bb.writeUint16(weight);
 	    }
 	    // Key auths (map<public_key, uint16>)
-	    const keyAuths = (Array.isArray(authObj.key_auths) ? authObj.key_auths : []);
-	    // Maps in Steem serialization are sorted by key (public key string)
-	    // But serialized as bytes. Usually sorting by string representation of public key works.
-	    const keyAuthsArray = keyAuths;
-	    keyAuthsArray.sort((a, b) => {
-	        const aKey = Array.isArray(a) && a[0] ? String(a[0]) : '';
-	        const bKey = Array.isArray(b) && b[0] ? String(b[0]) : '';
-	        return aKey.localeCompare(bKey);
-	    });
+	    const keyAuths = authorityMapEntries(authObj.key_auths).sort((a, b) => a[0].localeCompare(b[0]));
 	    bb.writeVarint32(keyAuths.length);
-	    for (const keyAuth of keyAuths) {
-	        if (Array.isArray(keyAuth) && keyAuth.length >= 2) {
-	            const keyStr = String(keyAuth[0]);
-	            const weight = keyAuth[1];
-	            const pubKey = PublicKey.fromStringOrThrow(keyStr);
-	            bb.append(pubKey.toBuffer());
-	            bb.writeUint16(weight);
-	        }
+	    for (const [keyStr, weight] of keyAuths) {
+	        const pubKey = PublicKey.fromStringOrThrow(keyStr);
+	        bb.append(pubKey.toBuffer());
+	        bb.writeUint16(weight);
 	    }
 	}
 	/**
@@ -26522,18 +26542,34 @@
 	        return false;
 	    }
 	};
+	// Serialize a transaction to its binary form for digest calculation.
+	// Alias for transaction.toBuffer() so verifyTransaction mirrors signTransaction's
+	// serialization path exactly (signTransaction calls transaction.toBuffer at line 161).
+	const serializeTrx = (trx) => transaction.toBuffer(trx);
 	const verifyTransaction = (transaction, publicKey) => {
 	    try {
 	        const pub = PublicKey.fromString(publicKey);
 	        if (!pub)
 	            return false;
-	        const serialized = buffer.Buffer.from(JSON.stringify(transaction));
 	        const trx = transaction;
 	        if (!trx.signatures || !Array.isArray(trx.signatures))
 	            return false;
+	        // Reconstruct the exact digest signTransaction signs over:
+	        //   Buffer.concat([chain_id, transaction.toBuffer(normalizedTrx)])
+	        // signatures are NOT part of the signed digest — signTransaction serializes
+	        // BEFORE attaching signatures — so strip them before serializing, otherwise
+	        // serializeTransaction() would emit the signatures array and change the digest.
+	        const normalizedTrx = normalizeTransactionForBroadcast(trx);
+	        // Build a copy without the signatures key, so serializeTransaction() does not
+	        // emit the signatures array into the digest (signTransaction serializes pre-signature).
+	        const trxWithoutSigs = { ...normalizedTrx };
+	        delete trxWithoutSigs.signatures;
+	        const chainId = getConfig().get('chain_id') || '';
+	        const cid = buffer.Buffer.from(chainId, 'hex');
+	        const buf = serializeTrx(trxWithoutSigs);
 	        return trx.signatures.some((sig) => {
 	            const signature = Signature.fromHex(sig);
-	            return signature.verifyBuffer(serialized, pub);
+	            return signature.verifyBuffer(buffer.Buffer.concat([cid, buf]), pub);
 	        });
 	    }
 	    catch {
@@ -26578,6 +26614,7 @@
 		normalizeTransactionForBroadcast: normalizeTransactionForBroadcast,
 		resolveAuthorityForSerialize: resolveAuthorityForSerialize,
 		sanitizeAccountUpdatePayload: sanitizeAccountUpdatePayload,
+		serializeTransaction: serializeTransaction,
 		sign: sign$1,
 		signTransaction: signTransaction,
 		toWif: toWif,
@@ -29399,7 +29436,7 @@
 	    operations,
 	    utils: utils$n,
 	    ...crypto$1,
-	    version: '1.0.18',
+	    version: '1.0.20',
 	    config: {
 	        set: (options) => {
 	            // If nodes is provided, extract the first node as url for API