@zintrust/core 2.5.7 → 2.5.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zintrust/core",
-  "version": "2.5.7",
+  "version": "2.5.9",
   "description": "Production-grade TypeScript backend framework for JavaScript",
   "homepage": "https://zintrust.com",
   "repository": {

package/src/http/middleware/BodyParsingMiddleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BodyParsingMiddleware.d.ts","sourceRoot":"","sources":["../../../../src/http/middleware/BodyParsingMiddleware.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAiT9D;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,UA4CnC,CAAC;AAEF,eAAe,qBAAqB,CAAC"}
+{"version":3,"file":"BodyParsingMiddleware.d.ts","sourceRoot":"","sources":["../../../../src/http/middleware/BodyParsingMiddleware.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAkY9D;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,UA4CnC,CAAC;AAEF,eAAe,qBAAqB,CAAC"}

package/src/http/middleware/BodyParsingMiddleware.js

@@ -156,6 +156,29 @@ const parseJsonBody = (text, contentType, res) => {
         return null;
     }
 };
+/**
+ * Attempt to recover a JSON string that was stored as raw text or bytes
+ * due to a missing or incorrect Content-Type header.
+ *
+ * Only plain objects `{...}` are considered for recovery — arrays, strings,
+ * and primitives are left unchanged. This minimizes false positives for
+ * legitimate text or binary payloads that happen to start with `{`.
+ */
+const tryRecoverTextJsonBody = (body) => {
+    const trimmed = body.trim();
+    if (trimmed.startsWith('{') && trimmed.endsWith('}')) {
+        try {
+            const parsed = JSON.parse(trimmed);
+            if (typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed)) {
+                return parsed;
+            }
+        }
+        catch {
+            // Not valid JSON — leave original unchanged
+        }
+    }
+    return body;
+};
 const setRequestBody = (req, rawResult, contentType) => {
     const isUrlEncoded = contentType.includes('application/x-www-form-urlencoded');
     const isText = contentType.startsWith('text/') || contentType.includes('application/xml');
@@ -164,9 +187,26 @@ const setRequestBody = (req, rawResult, contentType) => {
         req.setBody(parseUrlEncodedBody(text));
     }
     else if (isText) {
-        req.setBody(text);
+        // Recovery: JSON body sent with text Content-Type (e.g. text/plain)
+        // is stored as a raw string. Detect a JSON object and parse it.
+        req.setBody(tryRecoverTextJsonBody(text));
     }
     else if (contentType !== '') {
+        // Recovery: JSON body sent with an unknown Content-Type is stored as
+        // raw bytes. Try to decode as text and check for JSON.
+        const decoded = text.trim();
+        if (decoded.startsWith('{') && decoded.endsWith('}')) {
+            try {
+                const parsed = JSON.parse(decoded);
+                if (typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed)) {
+                    req.setBody(parsed);
+                    return;
+                }
+            }
+            catch {
+                // Not valid JSON — fall through to bytes
+            }
+        }
         req.setBody(rawResult.bytes);
     }
 };
@@ -198,39 +238,79 @@ const reuseExistingRawBody = (req, res, contentType, existingBytes, existingText
     }
     return applyParsedRequestBody(req, res, rawResult, contentType);
 };
-const parseUrlEncodedBody = (text) => {
+/**
+ * Attempt to parse a string as a JSON object.
+ * Returns the parsed object on success, or null if the string is not
+ * a valid JSON object literal (plain object `{...}`, not array or primitive).
+ */
+const tryParseJsonObject = (text) => {
+    const trimmed = text.trim();
+    if (!trimmed.startsWith('{') || !trimmed.endsWith('}'))
+        return null;
+    try {
+        const parsed = JSON.parse(trimmed);
+        if (typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed)) {
+            return parsed;
+        }
+    }
+    catch {
+        // Not valid JSON
+    }
+    return null;
+};
+/**
+ * Parse URL-encoded form data into a key-value record.
+ * Multiple values for the same key are collected into an array.
+ */
+const parseUrlEncodedParams = (text) => {
     const out = {};
     const params = new URLSearchParams(text);
     for (const [key, value] of params.entries()) {
         const existing = out[key];
         if (existing === undefined) {
             out[key] = value;
-            continue;
         }
-        if (Array.isArray(existing)) {
+        else if (Array.isArray(existing)) {
             existing.push(value);
-            continue;
         }
-        out[key] = [existing, value];
+        else {
+            out[key] = [existing, value];
+        }
+    }
+    return out;
+};
+/**
+ * Detect and recover from a degenerate case where a JSON payload was sent
+ * with a url-encoded Content-Type header. URLSearchParams treats the entire
+ * JSON string as a single key with an empty value, so we try parsing that key.
+ */
+const tryRecoverDegenerateJson = (out) => {
+    const keys = Object.keys(out);
+    if (keys.length !== 1 || out[keys[0]] !== '')
+        return null;
+    const maybeJson = keys[0].trim();
+    const parsed = tryParseJsonObject(maybeJson);
+    if (parsed !== null) {
+        return parsed;
     }
+    return null;
+};
+const parseUrlEncodedBody = (text) => {
+    // JSON-first recovery: parse raw text before URLSearchParams touches it.
+    // URLSearchParams splits on the first '=' (corrupting base64-padded values)
+    // and converts '+' to spaces, making encrypted/base64 fields unrecoverable.
+    const jsonResult = tryParseJsonObject(text);
+    if (jsonResult !== null) {
+        return jsonResult;
+    }
+    const out = parseUrlEncodedParams(text);
     // Recovery: if a JSON payload is sent with the wrong Content-Type header
     // (e.g. application/x-www-form-urlencoded instead of application/json),
     // URLSearchParams will treat the entire JSON string as a single key with
     // an empty value. Detect this degenerate case and fall back to JSON.parse.
-    const keys = Object.keys(out);
-    if (keys.length === 1 && out[keys[0]] === '') {
-        const maybeJson = keys[0].trim();
-        if (maybeJson.startsWith('{') && maybeJson.endsWith('}')) {
-            try {
-                const parsed = JSON.parse(maybeJson);
-                if (typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed)) {
-                    return parsed;
-                }
-            }
-            catch {
-                // Not valid JSON — leave original result unchanged
-            }
-        }
+    const recovered = tryRecoverDegenerateJson(out);
+    if (recovered !== null) {
+        return recovered;
     }
     return out;
 };

package/src/http/parsers/BodyParsers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BodyParsers.d.ts","sourceRoot":"","sources":["../../../../src/http/parsers/BodyParsers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,UAAU,gBAAgB;IACxB,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,OAAO,EAAE,CAAC;IACpD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,UAAU,WAAW;IACnB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;IACvC,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,gBAAgB,CAAC;CAChD;AAiLD,eAAO,MAAM,WAAW;;;;IAKtB;;OAEG;cACO,WAAW,EAAE;IAIvB;;OAEG;4BACqB,MAAM,GAAG,WAAW,GAAG,SAAS;IAIxD;;OAEG;uBACgB,MAAM,QAAQ,MAAM,GAAG,MAAM,GAAG,gBAAgB;EAQnE,CAAC;AAEH,eAAe,WAAW,CAAC"}
+{"version":3,"file":"BodyParsers.d.ts","sourceRoot":"","sources":["../../../../src/http/parsers/BodyParsers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,UAAU,gBAAgB;IACxB,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,OAAO,EAAE,CAAC;IACpD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,UAAU,WAAW;IACnB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;IACvC,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,gBAAgB,CAAC;CAChD;AAoND,eAAO,MAAM,WAAW;;;;IAKtB;;OAEG;cACO,WAAW,EAAE;IAIvB;;OAEG;4BACqB,MAAM,GAAG,WAAW,GAAG,SAAS;IAIxD;;OAEG;uBACgB,MAAM,QAAQ,MAAM,GAAG,MAAM,GAAG,gBAAgB;EAQnE,CAAC;AAEH,eAAe,WAAW,CAAC"}

package/src/http/parsers/BodyParsers.js

@@ -27,6 +27,48 @@ const tryRecoverJsonBody = (result) => {
     }
     return undefined;
 };
+/**
+ * Try to parse raw text as JSON before URLSearchParams touches it.
+ * This handles cases where JSON is sent with application/x-www-form-urlencoded Content-Type,
+ * which would be corrupted by URLSearchParams (splits on '=', converts '+' to spaces).
+ */
+const tryParseJsonRaw = (text) => {
+    const trimmed = text.trim();
+    if (!trimmed.startsWith('{') || !trimmed.endsWith('}'))
+        return undefined;
+    try {
+        const parsed = JSON.parse(trimmed);
+        if (typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed)) {
+            return parsed;
+        }
+    }
+    catch {
+        // Not valid JSON
+    }
+    return undefined;
+};
+/**
+ * Parse URL-encoded string into key-value pairs, handling duplicate keys as arrays.
+ */
+const parseUrlEncodedParams = (text) => {
+    const params = new URLSearchParams(text);
+    const result = {};
+    for (const [key, value] of params.entries()) {
+        if (Object.prototype.hasOwnProperty.call(result, key)) {
+            const existing = result[key];
+            if (Array.isArray(existing)) {
+                existing.push(value);
+            }
+            else {
+                result[key] = [existing, value];
+            }
+        }
+        else {
+            result[key] = value;
+        }
+    }
+    return result;
+};
 /**
  * URL-encoded form data parser
  * Content-Type: application/x-www-form-urlencoded
@@ -38,25 +80,14 @@ const FormDataParser = {
             const text = typeof body === 'string' ? body : body.toString('utf-8');
             if (!text.trim())
                 return { ok: true, data: {} };
-            const params = new URLSearchParams(text);
-            const result = {};
-            for (const [key, value] of params.entries()) {
-                if (Object.prototype.hasOwnProperty.call(result, key)) {
-                    // Handle multiple values with same key
-                    const existing = result[key];
-                    if (Array.isArray(existing)) {
-                        existing.push(value);
-                    }
-                    else {
-                        result[key] = [existing, value];
-                    }
-                }
-                else {
-                    result[key] = value;
-                }
+            // JSON-first recovery: parse raw text before URLSearchParams touches it.
+            const rawJsonResult = tryParseJsonRaw(text);
+            if (rawJsonResult !== undefined) {
+                return { ok: true, data: rawJsonResult };
             }
-            // Recovery: if a JSON payload is sent with the wrong Content-Type header,
-            // URLSearchParams will treat the entire JSON string as a single key with
+            const result = parseUrlEncodedParams(text);
+            // Recovery: if a JSON payload was sent with wrong Content-Type,
+            // URLSearchParams treats the whole JSON string as a single key with
             // an empty value. Detect this degenerate case and fall back to JSON.parse.
             const recovered = tryRecoverJsonBody(result);
             if (recovered !== undefined) {

package/src/index.js

@@ -1,11 +1,11 @@
 /**
- * @zintrust/core v2.5.7
+ * @zintrust/core v2.5.9
  *
  * ZinTrust Framework - Production-Grade TypeScript Backend
  * Built for performance, type safety, and exceptional developer experience
  *
  * Build Information:
- *   Built: 2026-06-12T18:33:47.619Z
+ *   Built: 2026-06-13T09:17:52.095Z
  *   Node: >=20.0.0
  *   License: MIT
  *
@@ -21,7 +21,7 @@
  * Available at runtime for debugging and health checks
  */
 export const ZINTRUST_VERSION = '0.1.41';
-export const ZINTRUST_BUILD_DATE = '2026-06-12T18:33:47.574Z'; // Replaced during build
+export const ZINTRUST_BUILD_DATE = '2026-06-13T09:17:51.999Z'; // Replaced during build
 export { Application } from './boot/Application.js';
 export { AwsSigV4 } from './common/index.js';
 export { SignedRequest } from './security/SignedRequest.js';