@zintrust/core 2.5.6 → 2.5.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zintrust/core",
-  "version": "2.5.6",
+  "version": "2.5.8",
   "description": "Production-grade TypeScript backend framework for JavaScript",
   "homepage": "https://zintrust.com",
   "repository": {

package/src/http/middleware/BodyParsingMiddleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BodyParsingMiddleware.d.ts","sourceRoot":"","sources":["../../../../src/http/middleware/BodyParsingMiddleware.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AA6R9D;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,UA4CnC,CAAC;AAEF,eAAe,qBAAqB,CAAC"}
+{"version":3,"file":"BodyParsingMiddleware.d.ts","sourceRoot":"","sources":["../../../../src/http/middleware/BodyParsingMiddleware.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAwV9D;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,UA4CnC,CAAC;AAEF,eAAe,qBAAqB,CAAC"}

package/src/http/middleware/BodyParsingMiddleware.js

@@ -156,6 +156,29 @@ const parseJsonBody = (text, contentType, res) => {
         return null;
     }
 };
+/**
+ * Attempt to recover a JSON string that was stored as raw text or bytes
+ * due to a missing or incorrect Content-Type header.
+ *
+ * Only plain objects `{...}` are considered for recovery — arrays, strings,
+ * and primitives are left unchanged. This minimizes false positives for
+ * legitimate text or binary payloads that happen to start with `{`.
+ */
+const tryRecoverTextJsonBody = (body) => {
+    const trimmed = body.trim();
+    if (trimmed.startsWith('{') && trimmed.endsWith('}')) {
+        try {
+            const parsed = JSON.parse(trimmed);
+            if (typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed)) {
+                return parsed;
+            }
+        }
+        catch {
+            // Not valid JSON — leave original unchanged
+        }
+    }
+    return body;
+};
 const setRequestBody = (req, rawResult, contentType) => {
     const isUrlEncoded = contentType.includes('application/x-www-form-urlencoded');
     const isText = contentType.startsWith('text/') || contentType.includes('application/xml');
@@ -164,9 +187,26 @@ const setRequestBody = (req, rawResult, contentType) => {
         req.setBody(parseUrlEncodedBody(text));
     }
     else if (isText) {
-        req.setBody(text);
+        // Recovery: JSON body sent with text Content-Type (e.g. text/plain)
+        // is stored as a raw string. Detect a JSON object and parse it.
+        req.setBody(tryRecoverTextJsonBody(text));
     }
     else if (contentType !== '') {
+        // Recovery: JSON body sent with an unknown Content-Type is stored as
+        // raw bytes. Try to decode as text and check for JSON.
+        const decoded = text.trim();
+        if (decoded.startsWith('{') && decoded.endsWith('}')) {
+            try {
+                const parsed = JSON.parse(decoded);
+                if (typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed)) {
+                    req.setBody(parsed);
+                    return;
+                }
+            }
+            catch {
+                // Not valid JSON — fall through to bytes
+            }
+        }
         req.setBody(rawResult.bytes);
     }
 };
@@ -213,6 +253,25 @@ const parseUrlEncodedBody = (text) => {
         }
         out[key] = [existing, value];
     }
+    // Recovery: if a JSON payload is sent with the wrong Content-Type header
+    // (e.g. application/x-www-form-urlencoded instead of application/json),
+    // URLSearchParams will treat the entire JSON string as a single key with
+    // an empty value. Detect this degenerate case and fall back to JSON.parse.
+    const keys = Object.keys(out);
+    if (keys.length === 1 && out[keys[0]] === '') {
+        const maybeJson = keys[0].trim();
+        if (maybeJson.startsWith('{') && maybeJson.endsWith('}')) {
+            try {
+                const parsed = JSON.parse(maybeJson);
+                if (typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed)) {
+                    return parsed;
+                }
+            }
+            catch {
+                // Not valid JSON — leave original result unchanged
+            }
+        }
+    }
     return out;
 };
 const processBodyParsing = async (req, res, contentType, maxBytes) => {

package/src/http/parsers/BodyParsers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BodyParsers.d.ts","sourceRoot":"","sources":["../../../../src/http/parsers/BodyParsers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,UAAU,gBAAgB;IACxB,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,OAAO,EAAE,CAAC;IACpD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,UAAU,WAAW;IACnB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;IACvC,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,gBAAgB,CAAC;CAChD;AA6ID,eAAO,MAAM,WAAW;;;;IAKtB;;OAEG;cACO,WAAW,EAAE;IAIvB;;OAEG;4BACqB,MAAM,GAAG,WAAW,GAAG,SAAS;IAIxD;;OAEG;uBACgB,MAAM,QAAQ,MAAM,GAAG,MAAM,GAAG,gBAAgB;EAQnE,CAAC;AAEH,eAAe,WAAW,CAAC"}
+{"version":3,"file":"BodyParsers.d.ts","sourceRoot":"","sources":["../../../../src/http/parsers/BodyParsers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,UAAU,gBAAgB;IACxB,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,OAAO,EAAE,CAAC;IACpD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,UAAU,WAAW;IACnB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;IACvC,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,gBAAgB,CAAC;CAChD;AAiLD,eAAO,MAAM,WAAW;;;;IAKtB;;OAEG;cACO,WAAW,EAAE;IAIvB;;OAEG;4BACqB,MAAM,GAAG,WAAW,GAAG,SAAS;IAIxD;;OAEG;uBACgB,MAAM,QAAQ,MAAM,GAAG,MAAM,GAAG,gBAAgB;EAQnE,CAAC;AAEH,eAAe,WAAW,CAAC"}

package/src/http/parsers/BodyParsers.js

@@ -2,6 +2,31 @@
  * Body Parsers - Content-Type specific parsing
  * Handles form-data, plain text, CSV, and other non-JSON formats
  */
+/**
+ * Attempt to recover a JSON string that was parsed as a single form-urlencoded key.
+ * This handles cases where clients send JSON with the wrong Content-Type header.
+ */
+const tryRecoverJsonBody = (result) => {
+    const keys = Object.keys(result);
+    if (keys.length !== 1)
+        return undefined;
+    const singleValue = result[keys[0]];
+    if (singleValue !== '')
+        return undefined;
+    const maybeJson = keys[0].trim();
+    if (!maybeJson.startsWith('{') || !maybeJson.endsWith('}'))
+        return undefined;
+    try {
+        const parsed = JSON.parse(maybeJson);
+        if (typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed)) {
+            return parsed;
+        }
+    }
+    catch {
+        // Not valid JSON — leave original result unchanged
+    }
+    return undefined;
+};
 /**
  * URL-encoded form data parser
  * Content-Type: application/x-www-form-urlencoded
@@ -30,6 +55,13 @@ const FormDataParser = {
                     result[key] = value;
                 }
             }
+            // Recovery: if a JSON payload is sent with the wrong Content-Type header,
+            // URLSearchParams will treat the entire JSON string as a single key with
+            // an empty value. Detect this degenerate case and fall back to JSON.parse.
+            const recovered = tryRecoverJsonBody(result);
+            if (recovered !== undefined) {
+                return { ok: true, data: recovered };
+            }
             return { ok: true, data: result };
         }
         catch (error) {

package/src/index.js

@@ -1,11 +1,11 @@
 /**
- * @zintrust/core v2.5.6
+ * @zintrust/core v2.5.8
  *
  * ZinTrust Framework - Production-Grade TypeScript Backend
  * Built for performance, type safety, and exceptional developer experience
  *
  * Build Information:
- *   Built: 2026-06-12T14:17:16.252Z
+ *   Built: 2026-06-12T18:44:49.274Z
  *   Node: >=20.0.0
  *   License: MIT
  *
@@ -21,7 +21,7 @@
  * Available at runtime for debugging and health checks
  */
 export const ZINTRUST_VERSION = '0.1.41';
-export const ZINTRUST_BUILD_DATE = '2026-06-12T14:17:16.216Z'; // Replaced during build
+export const ZINTRUST_BUILD_DATE = '2026-06-12T18:44:49.232Z'; // Replaced during build
 export { Application } from './boot/Application.js';
 export { AwsSigV4 } from './common/index.js';
 export { SignedRequest } from './security/SignedRequest.js';