balda 0.0.62 → 0.0.63

package/lib/index.d.cts

@@ -349,6 +349,12 @@ declare class Request<Params extends Record<string, string> = Record<string, str
     file(fieldName: string): FormFile | null;
     get cookies(): Record<string, string>;
     set cookies(value: Record<string, string>);
+    /**
+     * Returns cookies when the cookie middleware has populated them, otherwise undefined.
+     * Useful for compatibility layers that should not throw when cookies are unavailable.
+     * @internal
+     */
+    getOptionalCookies(): Record<string, string> | undefined;
     /**
      * The cookie of the request.
      * @cookie middleware is required
@@ -362,6 +368,12 @@ declare class Request<Params extends Record<string, string> = Record<string, str
     timeout?: boolean;
     get session(): Record<string, any> | undefined;
     set session(value: Record<string, any> | undefined);
+    /**
+     * Returns session data when the session middleware has populated it, otherwise undefined.
+     * Useful for compatibility layers that should not throw when sessions are unavailable.
+     * @internal
+     */
+    getOptionalSession(): Record<string, any> | undefined;
     /**
      * Shared throwing functions to avoid per-instance closure allocation.
      * @internal
@@ -2304,6 +2316,8 @@ type CorsOptions = {
     methods?: CorsMethods[] | string;
     /**
      * Configures the Access-Control-Allow-Headers CORS header. Defaults to allowing all requested headers.
+     * When omitted, Balda echoes `Access-Control-Request-Headers` on preflight requests.
+     * Set this explicitly to override that default behavior.
      */
     allowedHeaders?: string[] | string;
     /**
@@ -4685,7 +4699,9 @@ declare const cookie: (options?: CookieMiddlewareOptions) => TypedMiddleware<{
  * ⚠️ SECURITY WARNING: By default, this plugin allows ALL origins ('*').
  * For production environments, explicitly configure allowed origins.
  *
- * @param options CORS options (all optional)
+ * @param options CORS options (all optional). Omitted options keep Balda's defaults,
+ * including default methods and echoing `Access-Control-Request-Headers` on preflight
+ * requests unless `allowedHeaders` is explicitly overridden.
  *
  * @example
  * // Development (permissive)

package/lib/index.d.ts

@@ -349,6 +349,12 @@ declare class Request<Params extends Record<string, string> = Record<string, str
     file(fieldName: string): FormFile | null;
     get cookies(): Record<string, string>;
     set cookies(value: Record<string, string>);
+    /**
+     * Returns cookies when the cookie middleware has populated them, otherwise undefined.
+     * Useful for compatibility layers that should not throw when cookies are unavailable.
+     * @internal
+     */
+    getOptionalCookies(): Record<string, string> | undefined;
     /**
      * The cookie of the request.
      * @cookie middleware is required
@@ -362,6 +368,12 @@ declare class Request<Params extends Record<string, string> = Record<string, str
     timeout?: boolean;
     get session(): Record<string, any> | undefined;
     set session(value: Record<string, any> | undefined);
+    /**
+     * Returns session data when the session middleware has populated it, otherwise undefined.
+     * Useful for compatibility layers that should not throw when sessions are unavailable.
+     * @internal
+     */
+    getOptionalSession(): Record<string, any> | undefined;
     /**
      * Shared throwing functions to avoid per-instance closure allocation.
      * @internal
@@ -2304,6 +2316,8 @@ type CorsOptions = {
     methods?: CorsMethods[] | string;
     /**
      * Configures the Access-Control-Allow-Headers CORS header. Defaults to allowing all requested headers.
+     * When omitted, Balda echoes `Access-Control-Request-Headers` on preflight requests.
+     * Set this explicitly to override that default behavior.
      */
     allowedHeaders?: string[] | string;
     /**
@@ -4685,7 +4699,9 @@ declare const cookie: (options?: CookieMiddlewareOptions) => TypedMiddleware<{
  * ⚠️ SECURITY WARNING: By default, this plugin allows ALL origins ('*').
  * For production environments, explicitly configure allowed origins.
  *
- * @param options CORS options (all optional)
+ * @param options CORS options (all optional). Omitted options keep Balda's defaults,
+ * including default methods and echoing `Access-Control-Request-Headers` on preflight
+ * requests unless `allowedHeaders` is explicitly overridden.
  *
  * @example
  * // Development (permissive)