[Sajadlance]

Request logger:

• Mask common credential fields in request bodies by default
  (DEFAULT_MASKED_BODY_KEYS), with the same semantics as the header and
  query masks: omitted means the defaults, an array replaces them, and
  false or [] turns masking off.
• Export the frozen body, header and query default lists so an
  application can extend them.
• Warn once at creation when includeRequestBody, includeRequestHeaders,
  includeResponseHeaders or enrich capture data that nothing writes
  (no includeHttpContext and no custom messageBuilder).

Types:

• Every optional data property of the public interfaces accepts an
  explicit undefined, so Express, Router and node:http mounts, and
  possibly-undefined option values, compile under
  exactOptionalPropertyTypes without a cast. A type-level spec compiles
  consumer fixtures with the flag on.

Fixes:

• An explicit undefined rotation maxSize / maxFiles, or a null rotation,
  now means the documented default instead of disabling the size cap
  and retention; audit-file names stay stable.
• Under --unhandled-rejections=strict a rejection is recorded once. It is
  still recorded at once as the uncaughtException Node raises, and the
  paired rejection event is skipped. ES-module entry errors are recorded
  exactly as before.

Docs:

• Correct the stale level "http" JSDoc, the nonexistent includeRequestBody
  allow list, and the README middleware examples. Document the mount-order
  trade-off, the crash-exit interplay with your own handlers and with
  --unhandled-rejections, and the Quick Start defaults.

Version bump to 1.3.0 and CHANGELOG promotion ([1.3.0] - 2026-09-28) are included.

Local gates: npm run verify (Node 24) all five PASS; full jest suite with coverage on Node 18.20.8 and 22.23.2: 1149 passed, 1 skipped (the win32-only case), 100% coverage.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!