fix(hive): accept the ISO form of limit_order_create expiration

[BitHighlander]

The failure

A live hivehub.dev/market/swap order:

Vault Hive sign-operations failed (400):
{"error":"limit_order_create expiration out of uint32 range: NaN"}

{"orderid":1784583895,"owner":"bithighlander22",
 "amount_to_sell":"1.000 HIVE","min_to_receive":"0.048 HBD",
 "fill_or_kill":true,"expiration":"2026-08-16T21:44:55"}

Graphene's time_point_sec is a uint32 on the wire, but hived's JSON representation — and therefore what every Hive library and dApp sends — is a zone-less ISO 8601 string. hive-ops.ts:198 did Number(p.expiration), which is NaN for that form.

No real dApp could place an order. Every existing test passed a unix int (1700003600), so the fixtures encoded the wrong assumption and the entire phase-3 suite went green against a shape nothing actually sends.

The subtle half

timePointSec() accepts the ISO form, an explicit-offset ISO form, a numeric string, and a number. The 'Z' append is the part worth reviewing carefully:

const hasZone = /(?:Z|[+-]\d{2}:?\d{2})$/.test(s)
const ms = Date.parse(hasZone ? s : `${s}Z`)

Graphene timestamps are always UTC, but JS parses the zone-less date-time form as local time (ES2015+). A naive Date.parse would therefore have signed an expiration off by the host's UTC offset:

TZ=America/Denver
  local-parsed: 1786938295
  UTC-parsed:   1786916695   ← correct
  differ by:    6 hours

That fails silently — the order signs, and expires six hours off what the user was shown. A wrong-but-plausible expiration is worse than a rejected one. An explicit offset (…Z, …+02:00) is passed through untouched so it isn't double-shifted.

Unparseable input now names what's wanted instead of surfacing NaN, and a pre-1970 timestamp is rejected by the existing u32 bound rather than wrapping to a huge uint32.

Tests

The exact field payload, ISO/unix byte equality, explicit-offset, numeric-string, rejection of undefined/null/''/'tomorrow'/{}/NaN, and a byte-level assertion that a zone-less stamp encodes as UTC.

Green under four timezones, including a half-hour offset:

TZ=UTC                 48 pass  0 fail
TZ=America/Denver      48 pass  0 fail
TZ=Asia/Kolkata        48 pass  0 fail
TZ=Pacific/Auckland    48 pass  0 fail

Differential-verified. Restoring Number() fails 5 tests. Dropping only the 'Z' append — the silent-drift mutation, the one that still produces a valid signature — still fails 3, including the byte-level UTC assertion.

Zero failures across the deterministic suites (txbuilder, shared, rest-sign-gating).

Notes

• Branched from origin/develop; does not include the unpushed local commits on that branch.
• Independent of feat(emu): expand the confirm dialog to cover the Hive operations #374 (emulator confirm details) — no file overlap.
• The client passes operations through verbatim, which is correct: the serializer owns the wire format, so the fix belongs here rather than normalizing in the extension.
• limit_order_create.expiration is the only time_point_sec field in the 14-op clear-sign table; the tx header's expirationUnix comes from Pioneer as an int and is unaffected.

🤖 Generated with Claude Code