[{"data":1,"prerenderedAt":1388},["ShallowReactive",2],{"navigation_docs":3,"-use-cases-audit-pipeline":500,"-use-cases-audit-pipeline-surround":1383},[4,30,80,118,283,415,470],{"title":5,"path":6,"stem":7,"children":8,"page":29},"Start","\u002Fstart","1.start",[9,14,19,24],{"title":10,"path":11,"stem":12,"icon":13},"Introduction","\u002Fstart\u002Fintroduction","1.start\u002F1.introduction","i-lucide-info",{"title":15,"path":16,"stem":17,"icon":18},"Why start with evlog","\u002Fstart\u002Fwhy-evlog","1.start\u002F2.why-evlog","i-lucide-rocket",{"title":20,"path":21,"stem":22,"icon":23},"Installation","\u002Fstart\u002Finstallation","1.start\u002F3.installation","i-lucide-download",{"title":25,"path":26,"stem":27,"icon":28},"Quick Start","\u002Fstart\u002Fquick-start","1.start\u002F4.quick-start","i-lucide-zap",false,{"title":31,"path":32,"stem":33,"children":34,"page":29},"Learn","\u002Flearn","2.learn",[35,40,45,50,55,60,65,70,75],{"title":36,"path":37,"stem":38,"icon":39},"Overview","\u002Flearn\u002Foverview","2.learn\u002F0.overview","i-lucide-list",{"title":41,"path":42,"stem":43,"icon":44},"Simple Logging","\u002Flearn\u002Fsimple-logging","2.learn\u002F1.simple-logging","i-lucide-terminal",{"title":46,"path":47,"stem":48,"icon":49},"Wide Events","\u002Flearn\u002Fwide-events","2.learn\u002F2.wide-events","i-lucide-layers",{"title":51,"path":52,"stem":53,"icon":54},"Structured Errors","\u002Flearn\u002Fstructured-errors","2.learn\u002F3.structured-errors","i-lucide-shield-alert",{"title":56,"path":57,"stem":58,"icon":59},"Lifecycle","\u002Flearn\u002Flifecycle","2.learn\u002F4.lifecycle","i-lucide-arrow-right-left",{"title":61,"path":62,"stem":63,"icon":64},"Sampling","\u002Flearn\u002Fsampling","2.learn\u002F5.sampling","i-lucide-filter",{"title":66,"path":67,"stem":68,"icon":69},"Auto-Redaction","\u002Flearn\u002Fredaction","2.learn\u002F6.redaction","i-lucide-eye-off",{"title":71,"path":72,"stem":73,"icon":74},"Typed Fields","\u002Flearn\u002Ftyped-fields","2.learn\u002F7.typed-fields","i-simple-icons-typescript",{"title":76,"path":77,"stem":78,"icon":79},"Catalogs","\u002Flearn\u002Fcatalogs","2.learn\u002F8.catalogs","i-lucide-book-open",{"title":81,"path":82,"stem":83,"children":84,"page":29},"CLI","\u002Fcli","3.cli",[85,88,93,98,103,108,113],{"title":36,"path":86,"stem":87,"icon":44},"\u002Fcli\u002Foverview","3.cli\u002F0.overview",{"title":89,"path":90,"stem":91,"icon":92},"map","\u002Fcli\u002Fmap","3.cli\u002F1.map","i-lucide-radar",{"title":94,"path":95,"stem":96,"icon":97},"Rules","\u002Fcli\u002Frules","3.cli\u002F2.rules","i-lucide-list-checks",{"title":99,"path":100,"stem":101,"icon":102},"Scoring","\u002Fcli\u002Fscoring","3.cli\u002F3.scoring","i-lucide-gauge",{"title":104,"path":105,"stem":106,"icon":107},"CI","\u002Fcli\u002Fci","3.cli\u002F4.ci","i-lucide-git-pull-request",{"title":109,"path":110,"stem":111,"icon":112},"doctor","\u002Fcli\u002Fdoctor","3.cli\u002F5.doctor","i-lucide-stethoscope",{"title":114,"path":115,"stem":116,"icon":117},"telemetry","\u002Fcli\u002Ftelemetry","3.cli\u002F6.telemetry","i-lucide-bar-chart-3",{"title":119,"path":120,"stem":121,"children":122,"page":29},"Integrate","\u002Fintegrate","4.integrate",[123,127,195],{"title":36,"path":124,"stem":125,"icon":126},"\u002Fintegrate\u002Foverview","4.integrate\u002F0.overview","i-lucide-plug",{"title":128,"path":129,"stem":130,"children":131,"page":29},"Adapters","\u002Fintegrate\u002Fadapters","4.integrate\u002Fadapters",[132,135,175],{"title":36,"path":133,"stem":134,"icon":39},"\u002Fintegrate\u002Fadapters\u002Foverview","4.integrate\u002Fadapters\u002F01.overview",{"title":136,"path":137,"stem":138,"children":139,"page":29},"Cloud","\u002Fintegrate\u002Fadapters\u002Fcloud","4.integrate\u002Fadapters\u002Fcloud",[140,145,150,155,160,165,170],{"title":141,"path":142,"stem":143,"icon":144},"Axiom","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Faxiom","4.integrate\u002Fadapters\u002Fcloud\u002F01.axiom","i-custom-axiom",{"title":146,"path":147,"stem":148,"icon":149},"OTLP","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fotlp","4.integrate\u002Fadapters\u002Fcloud\u002F02.otlp","i-simple-icons-opentelemetry",{"title":151,"path":152,"stem":153,"icon":154},"PostHog","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fposthog","4.integrate\u002Fadapters\u002Fcloud\u002F03.posthog","i-simple-icons-posthog",{"title":156,"path":157,"stem":158,"icon":159},"Sentry","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fsentry","4.integrate\u002Fadapters\u002Fcloud\u002F04.sentry","i-simple-icons-sentry",{"title":161,"path":162,"stem":163,"icon":164},"Better Stack","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fbetter-stack","4.integrate\u002Fadapters\u002Fcloud\u002F05.better-stack","i-simple-icons-betterstack",{"title":166,"path":167,"stem":168,"icon":169},"Datadog","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fdatadog","4.integrate\u002Fadapters\u002Fcloud\u002F06.datadog","i-simple-icons-datadog",{"title":171,"path":172,"stem":173,"icon":174},"HyperDX","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fhyperdx","4.integrate\u002Fadapters\u002Fcloud\u002F07.hyperdx","i-custom-hyperdx",{"title":176,"path":177,"stem":178,"children":179,"page":29},"Self-Hosted","\u002Fintegrate\u002Fadapters\u002Fself-hosted","4.integrate\u002Fadapters\u002Fself-hosted",[180,185,190],{"title":181,"path":182,"stem":183,"icon":184},"File System","\u002Fintegrate\u002Fadapters\u002Fself-hosted\u002Ffs","4.integrate\u002Fadapters\u002Fself-hosted\u002F01.fs","i-lucide-hard-drive",{"title":186,"path":187,"stem":188,"icon":189},"NuxtHub","\u002Fintegrate\u002Fadapters\u002Fself-hosted\u002Fnuxthub","4.integrate\u002Fadapters\u002Fself-hosted\u002F02.nuxthub","i-simple-icons-nuxt",{"title":191,"path":192,"stem":193,"icon":194},"Memory","\u002Fintegrate\u002Fadapters\u002Fself-hosted\u002Fmemory","4.integrate\u002Fadapters\u002Fself-hosted\u002F03.memory","i-lucide-cpu",{"title":196,"path":197,"stem":198,"children":199,"page":29},"Frameworks","\u002Fintegrate\u002Fframeworks","4.integrate\u002Fframeworks",[200,204,209,214,219,224,229,234,239,244,249,254,259,264,268,273,278],{"title":36,"path":201,"stem":202,"icon":203},"\u002Fintegrate\u002Fframeworks\u002Foverview","4.integrate\u002Fframeworks\u002F00.overview","i-lucide-layout-grid",{"title":205,"path":206,"stem":207,"icon":208},"Nuxt","\u002Fintegrate\u002Fframeworks\u002Fnuxt","4.integrate\u002Fframeworks\u002F01.nuxt","i-simple-icons-nuxtdotjs",{"title":210,"path":211,"stem":212,"icon":213},"Next.js","\u002Fintegrate\u002Fframeworks\u002Fnextjs","4.integrate\u002Fframeworks\u002F02.nextjs","i-simple-icons-nextdotjs",{"title":215,"path":216,"stem":217,"icon":218},"SvelteKit","\u002Fintegrate\u002Fframeworks\u002Fsveltekit","4.integrate\u002Fframeworks\u002F03.sveltekit","i-simple-icons-svelte",{"title":220,"path":221,"stem":222,"icon":223},"Nitro","\u002Fintegrate\u002Fframeworks\u002Fnitro","4.integrate\u002Fframeworks\u002F04.nitro","i-custom-nitro",{"title":225,"path":226,"stem":227,"icon":228},"TanStack Start","\u002Fintegrate\u002Fframeworks\u002Ftanstack-start","4.integrate\u002Fframeworks\u002F05.tanstack-start","i-custom-tanstack",{"title":230,"path":231,"stem":232,"icon":233},"NestJS","\u002Fintegrate\u002Fframeworks\u002Fnestjs","4.integrate\u002Fframeworks\u002F06.nestjs","i-simple-icons-nestjs",{"title":235,"path":236,"stem":237,"icon":238},"Express","\u002Fintegrate\u002Fframeworks\u002Fexpress","4.integrate\u002Fframeworks\u002F07.express","i-simple-icons-express",{"title":240,"path":241,"stem":242,"icon":243},"Hono","\u002Fintegrate\u002Fframeworks\u002Fhono","4.integrate\u002Fframeworks\u002F08.hono","i-simple-icons-hono",{"title":245,"path":246,"stem":247,"icon":248},"Fastify","\u002Fintegrate\u002Fframeworks\u002Ffastify","4.integrate\u002Fframeworks\u002F09.fastify","i-simple-icons-fastify",{"title":250,"path":251,"stem":252,"icon":253},"Elysia","\u002Fintegrate\u002Fframeworks\u002Felysia","4.integrate\u002Fframeworks\u002F10.elysia","i-custom-elysia",{"title":255,"path":256,"stem":257,"icon":258},"React Router","\u002Fintegrate\u002Fframeworks\u002Freact-router","4.integrate\u002Fframeworks\u002F11.react-router","i-custom-reactrouter",{"title":260,"path":261,"stem":262,"icon":263},"Cloudflare Workers","\u002Fintegrate\u002Fframeworks\u002Fcloudflare-workers","4.integrate\u002Fframeworks\u002F12.cloudflare-workers","i-simple-icons-cloudflare",{"title":265,"path":266,"stem":267,"icon":74},"Standalone","\u002Fintegrate\u002Fframeworks\u002Fstandalone","4.integrate\u002Fframeworks\u002F13.standalone",{"title":269,"path":270,"stem":271,"icon":272},"Astro","\u002Fintegrate\u002Fframeworks\u002Fastro","4.integrate\u002Fframeworks\u002F14.astro","i-simple-icons-astro",{"title":274,"path":275,"stem":276,"icon":277},"oRPC","\u002Fintegrate\u002Fframeworks\u002Forpc","4.integrate\u002Fframeworks\u002F15.orpc","i-lucide-network",{"title":279,"path":280,"stem":281,"icon":282},"AWS Lambda","\u002Fintegrate\u002Fframeworks\u002Faws-lambda","4.integrate\u002Fframeworks\u002F16.aws-lambda","i-custom-lambda",{"title":284,"path":285,"stem":286,"children":287,"page":29},"Use Cases","\u002Fuse-cases","5.use-cases",[288,291,296,325,352,384,405,410],{"title":36,"path":289,"stem":290,"icon":97},"\u002Fuse-cases\u002Foverview","5.use-cases\u002F0.overview",{"title":292,"path":293,"stem":294,"icon":295},"Client Logging","\u002Fuse-cases\u002Fclient-logging","5.use-cases\u002F1.client-logging","i-lucide-monitor",{"title":297,"icon":298,"path":299,"stem":300,"children":301,"page":29},"AI SDK","i-simple-icons-vercel","\u002Fuse-cases\u002Fai-sdk","5.use-cases\u002F2.ai-sdk",[302,305,310,315,320],{"title":36,"path":303,"stem":304,"icon":39},"\u002Fuse-cases\u002Fai-sdk\u002Foverview","5.use-cases\u002F2.ai-sdk\u002F01.overview",{"title":306,"path":307,"stem":308,"icon":309},"Usage","\u002Fuse-cases\u002Fai-sdk\u002Fusage","5.use-cases\u002F2.ai-sdk\u002F02.usage","i-lucide-code",{"title":311,"path":312,"stem":313,"icon":314},"Options","\u002Fuse-cases\u002Fai-sdk\u002Foptions","5.use-cases\u002F2.ai-sdk\u002F03.options","i-lucide-sliders",{"title":316,"path":317,"stem":318,"icon":319},"Metadata","\u002Fuse-cases\u002Fai-sdk\u002Fmetadata","5.use-cases\u002F2.ai-sdk\u002F04.metadata","i-lucide-database",{"title":321,"path":322,"stem":323,"icon":324},"Telemetry","\u002Fuse-cases\u002Fai-sdk\u002Ftelemetry","5.use-cases\u002F2.ai-sdk\u002F05.telemetry","i-lucide-activity",{"title":326,"icon":327,"path":328,"stem":329,"children":330,"page":29},"Better Auth","i-simple-icons-betterauth","\u002Fuse-cases\u002Fbetter-auth","5.use-cases\u002F3.better-auth",[331,334,339,344,348],{"title":36,"path":332,"stem":333,"icon":39},"\u002Fuse-cases\u002Fbetter-auth\u002Foverview","5.use-cases\u002F3.better-auth\u002F01.overview",{"title":335,"path":336,"stem":337,"icon":338},"Identify User","\u002Fuse-cases\u002Fbetter-auth\u002Fidentify-user","5.use-cases\u002F3.better-auth\u002F02.identify-user","i-lucide-user-check",{"title":340,"path":341,"stem":342,"icon":343},"Middleware","\u002Fuse-cases\u002Fbetter-auth\u002Fmiddleware","5.use-cases\u002F3.better-auth\u002F03.middleware","i-lucide-shield",{"title":345,"path":346,"stem":347,"icon":295},"Client Sync","\u002Fuse-cases\u002Fbetter-auth\u002Fclient-sync","5.use-cases\u002F3.better-auth\u002F04.client-sync",{"title":349,"path":350,"stem":351,"icon":102},"Performance","\u002Fuse-cases\u002Fbetter-auth\u002Fperformance","5.use-cases\u002F3.better-auth\u002F05.performance",{"title":353,"icon":354,"path":355,"stem":356,"children":357,"page":29},"Audit Logs","i-lucide-shield-check","\u002Fuse-cases\u002Faudit","5.use-cases\u002F4.audit",[358,361,366,371,376,380],{"title":36,"path":359,"stem":360,"icon":39},"\u002Fuse-cases\u002Faudit\u002Foverview","5.use-cases\u002F4.audit\u002F01.overview",{"title":362,"path":363,"stem":364,"icon":365},"Schema","\u002Fuse-cases\u002Faudit\u002Fschema","5.use-cases\u002F4.audit\u002F02.schema","i-lucide-file-text",{"title":367,"path":368,"stem":369,"icon":370},"Recording","\u002Fuse-cases\u002Faudit\u002Frecording","5.use-cases\u002F4.audit\u002F03.recording","i-lucide-pen-line",{"title":372,"path":373,"stem":374,"icon":375},"Drains","\u002Fuse-cases\u002Faudit\u002Fpipeline","5.use-cases\u002F4.audit\u002F04.pipeline","i-lucide-link",{"title":377,"path":378,"stem":379,"icon":354},"Compliance","\u002Fuse-cases\u002Faudit\u002Fcompliance","5.use-cases\u002F4.audit\u002F05.compliance",{"title":381,"path":382,"stem":383,"icon":79},"Recipes","\u002Fuse-cases\u002Faudit\u002Frecipes","5.use-cases\u002F4.audit\u002F06.recipes",{"title":321,"icon":102,"path":385,"stem":386,"children":387,"page":29},"\u002Fuse-cases\u002Ftelemetry","5.use-cases\u002F4.telemetry",[388,391,396,401],{"title":36,"path":389,"stem":390,"icon":39},"\u002Fuse-cases\u002Ftelemetry\u002Foverview","5.use-cases\u002F4.telemetry\u002F01.overview",{"title":392,"path":393,"stem":394,"icon":395},"Setup","\u002Fuse-cases\u002Ftelemetry\u002Fsetup","5.use-cases\u002F4.telemetry\u002F02.setup","i-lucide-wrench",{"title":397,"path":398,"stem":399,"icon":400},"Ingest","\u002Fuse-cases\u002Ftelemetry\u002Fingest","5.use-cases\u002F4.telemetry\u002F03.ingest","i-lucide-server",{"title":402,"path":403,"stem":404,"icon":79},"Reference","\u002Fuse-cases\u002Ftelemetry\u002Freference","5.use-cases\u002F4.telemetry\u002F04.reference",{"title":406,"path":407,"stem":408,"icon":409},"Enrichers","\u002Fuse-cases\u002Fenrichers","5.use-cases\u002F5.enrichers","i-lucide-sparkles",{"title":411,"path":412,"stem":413,"icon":414},"eve","\u002Fuse-cases\u002Feve","5.use-cases\u002F5.eve","i-custom-eve",{"title":416,"path":417,"stem":418,"children":419,"page":29},"Extend","\u002Fextend","6.extend",[420,424,429,434,439,443,447,451,455,460,465],{"title":36,"path":421,"stem":422,"icon":423},"\u002Fextend\u002Foverview","6.extend\u002F0.overview","i-lucide-blocks",{"title":425,"path":426,"stem":427,"icon":428},"Stream","\u002Fextend\u002Fstream","6.extend\u002F1.stream","i-lucide-radio-tower",{"title":430,"path":431,"stem":432,"icon":433},"Custom framework","\u002Fextend\u002Fcustom-framework","6.extend\u002F10.custom-framework","i-lucide-puzzle",{"title":435,"path":436,"stem":437,"icon":438},"FS reader","\u002Fextend\u002Ffs-reader","6.extend\u002F2.fs-reader","i-lucide-folder-search",{"title":381,"path":440,"stem":441,"icon":442},"\u002Fextend\u002Fconsumer-recipes","6.extend\u002F3.consumer-recipes","i-lucide-chef-hat",{"title":444,"path":445,"stem":446,"icon":423},"Plugins","\u002Fextend\u002Fplugins","6.extend\u002F4.plugins",{"title":448,"path":449,"stem":450,"icon":409},"Custom enrichers","\u002Fextend\u002Fcustom-enrichers","6.extend\u002F5.custom-enrichers",{"title":452,"path":453,"stem":454,"icon":64},"Tail sampling","\u002Fextend\u002Ftail-sampling","6.extend\u002F6.tail-sampling",{"title":456,"path":457,"stem":458,"icon":459},"Identity headers","\u002Fextend\u002Fidentity-headers","6.extend\u002F7.identity-headers","i-lucide-fingerprint",{"title":461,"path":462,"stem":463,"icon":464},"Custom drains","\u002Fextend\u002Fcustom-drains","6.extend\u002F8.custom-drains","i-lucide-share-2",{"title":466,"path":467,"stem":468,"icon":469},"Drain pipeline","\u002Fextend\u002Fdrain-pipeline","6.extend\u002F9.drain-pipeline","i-lucide-workflow",{"title":402,"path":471,"stem":472,"children":473,"page":29},"\u002Freference","7.reference",[474,479,482,487,491,496],{"title":475,"path":476,"stem":477,"icon":478},"Configuration","\u002Freference\u002Fconfiguration","7.reference\u002F1.configuration","i-lucide-settings",{"title":349,"path":480,"stem":481,"icon":102},"\u002Freference\u002Fperformance","7.reference\u002F2.performance",{"title":483,"path":484,"stem":485,"icon":486},"Vite Plugin","\u002Freference\u002Fvite-plugin","7.reference\u002F3.vite-plugin","i-custom-vite",{"title":488,"path":489,"stem":490,"icon":354},"Best Practices","\u002Freference\u002Fbest-practices","7.reference\u002F4.best-practices",{"title":492,"path":493,"stem":494,"icon":495},"vs Other Loggers","\u002Freference\u002Fvs-other-loggers","7.reference\u002F5.vs-other-loggers","i-lucide-scale",{"title":497,"path":498,"stem":499,"icon":409},"Agent Skills","\u002Freference\u002Fagent-skills","7.reference\u002F6.agent-skills",{"id":501,"title":502,"body":503,"description":1372,"extension":1373,"links":1374,"meta":1379,"navigation":1380,"path":373,"seo":1381,"stem":374,"__hash__":1382},"docs\u002F5.use-cases\u002F4.audit\u002F04.pipeline.md","Drains & Integrity",{"type":504,"value":505,"toc":1364},"minimark",[506,523,530,539,626,629,752,770,776,796,810,947,954,1006,1012,1017,1023,1080,1097,1102,1105,1180,1184,1187,1336,1342,1345,1360],[507,508,509,510,514,515,518,519,522],"p",{},"Three building blocks: ",[511,512,513],"code",{},"auditEnricher"," fills context, ",[511,516,517],{},"auditOnly"," routes audits to a dedicated drain, and ",[511,520,521],{},"signed"," adds tamper-evident integrity. Each is opt-in and replaceable.",[524,525,527],"h2",{"id":526},"auditenricher",[511,528,529],{},"auditEnricher()",[507,531,532,534,535,538],{},[511,533,529],{}," populates ",[511,536,537],{},"event.audit.context.{requestId, traceId, ip, userAgent, tenantId}",". Skip it and ship a custom enricher if your strategy differs.",[540,541,547],"pre",{"className":542,"code":543,"filename":544,"language":545,"meta":546,"style":546},"language-typescript shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","import { auditEnricher } from 'evlog'\n\nnitro.hooks.hook('evlog:enrich', auditEnricher())\n","server\u002Fplugins\u002Fevlog.ts","typescript","",[511,548,549,582,589],{"__ignoreMap":546},[550,551,554,558,562,566,569,572,575,579],"span",{"class":552,"line":553},"line",1,[550,555,557],{"class":556},"s7zQu","import",[550,559,561],{"class":560},"sMK4o"," {",[550,563,565],{"class":564},"sTEyZ"," auditEnricher",[550,567,568],{"class":560}," }",[550,570,571],{"class":556}," from",[550,573,574],{"class":560}," '",[550,576,578],{"class":577},"sfazB","evlog",[550,580,581],{"class":560},"'\n",[550,583,585],{"class":552,"line":584},2,[550,586,588],{"emptyLinePlaceholder":587},true,"\n",[550,590,592,595,598,601,603,607,610,613,616,618,621,623],{"class":552,"line":591},3,[550,593,594],{"class":564},"nitro",[550,596,597],{"class":560},".",[550,599,600],{"class":564},"hooks",[550,602,597],{"class":560},[550,604,606],{"class":605},"s2Zo4","hook",[550,608,609],{"class":564},"(",[550,611,612],{"class":560},"'",[550,614,615],{"class":577},"evlog:enrich",[550,617,612],{"class":560},[550,619,620],{"class":560},",",[550,622,565],{"class":605},[550,624,625],{"class":564},"())\n",[507,627,628],{},"For multi-tenant apps and custom session bridges, pass options:",[540,630,632],{"className":542,"code":631,"language":545,"meta":546,"style":546},"nitro.hooks.hook('evlog:enrich', auditEnricher({\n  tenantId: ctx => ctx.event.tenant as string | undefined,\n  bridge: { getSession: async ctx => readSessionActor(ctx.headers) },\n}))\n",[511,633,634,663,707,743],{"__ignoreMap":546},[550,635,636,638,640,642,644,646,648,650,652,654,656,658,660],{"class":552,"line":553},[550,637,594],{"class":564},[550,639,597],{"class":560},[550,641,600],{"class":564},[550,643,597],{"class":560},[550,645,606],{"class":605},[550,647,609],{"class":564},[550,649,612],{"class":560},[550,651,615],{"class":577},[550,653,612],{"class":560},[550,655,620],{"class":560},[550,657,565],{"class":605},[550,659,609],{"class":564},[550,661,662],{"class":560},"{\n",[550,664,665,668,671,675,679,681,683,686,688,691,694,698,701,704],{"class":552,"line":584},[550,666,667],{"class":605},"  tenantId",[550,669,670],{"class":560},":",[550,672,674],{"class":673},"sHdIc"," ctx",[550,676,678],{"class":677},"spNyl"," =>",[550,680,674],{"class":564},[550,682,597],{"class":560},[550,684,685],{"class":564},"event",[550,687,597],{"class":560},[550,689,690],{"class":564},"tenant ",[550,692,693],{"class":556},"as",[550,695,697],{"class":696},"sBMFI"," string",[550,699,700],{"class":560}," |",[550,702,703],{"class":696}," undefined",[550,705,706],{"class":560},",\n",[550,708,709,713,715,717,720,722,725,727,729,732,735,737,740],{"class":552,"line":591},[550,710,712],{"class":711},"swJcz","  bridge",[550,714,670],{"class":560},[550,716,561],{"class":560},[550,718,719],{"class":605}," getSession",[550,721,670],{"class":560},[550,723,724],{"class":677}," async",[550,726,674],{"class":673},[550,728,678],{"class":677},[550,730,731],{"class":605}," readSessionActor",[550,733,734],{"class":564},"(ctx",[550,736,597],{"class":560},[550,738,739],{"class":564},"headers) ",[550,741,742],{"class":560},"},\n",[550,744,746,749],{"class":552,"line":745},4,[550,747,748],{"class":560},"}",[550,750,751],{"class":564},"))\n",[507,753,754,755,757,758,761,762,765,766,769],{},"Without ",[511,756,513],{},", ",[511,759,760],{},"audit.context"," stays empty — auditors and incident responders need at least ",[511,763,764],{},"requestId"," and ",[511,767,768],{},"ip"," to triangulate a recorded action.",[524,771,773],{"id":772},"auditonly",[511,774,775],{},"auditOnly()",[777,778,779,783,784,787,788,791,792,795],"tip",{},[780,781,782],"strong",{},"Why filter audits to a separate sink?"," Three reasons: ",[780,785,786],{},"cost"," (audit volume is tiny next to product telemetry — keep them separate so retention costs don't explode), ",[780,789,790],{},"permissions"," (the audit dataset should be read-only for engineers and write-only for the app), and ",[780,793,794],{},"retention"," (audits often live 7+ years; product logs rarely live more than 90 days).",[507,797,798,801,802,805,806,809],{},[511,799,800],{},"auditOnly(drain)"," only forwards events with an ",[511,803,804],{},"audit"," field. Compose with ",[780,807,808],{},"any"," drain:",[540,811,813],{"className":542,"code":812,"language":545,"meta":546,"style":546},"import { auditOnly } from 'evlog'\nimport { createAxiomDrain } from 'evlog\u002Faxiom'\n\n\u002F\u002F Send audits to a dedicated Axiom dataset:\nnitro.hooks.hook('evlog:drain', auditOnly(\n  createAxiomDrain({ dataset: 'audit', apiKey: process.env.AXIOM_AUDIT_API_KEY }),\n))\n",[511,814,815,834,854,858,864,893,942],{"__ignoreMap":546},[550,816,817,819,821,824,826,828,830,832],{"class":552,"line":553},[550,818,557],{"class":556},[550,820,561],{"class":560},[550,822,823],{"class":564}," auditOnly",[550,825,568],{"class":560},[550,827,571],{"class":556},[550,829,574],{"class":560},[550,831,578],{"class":577},[550,833,581],{"class":560},[550,835,836,838,840,843,845,847,849,852],{"class":552,"line":584},[550,837,557],{"class":556},[550,839,561],{"class":560},[550,841,842],{"class":564}," createAxiomDrain",[550,844,568],{"class":560},[550,846,571],{"class":556},[550,848,574],{"class":560},[550,850,851],{"class":577},"evlog\u002Faxiom",[550,853,581],{"class":560},[550,855,856],{"class":552,"line":591},[550,857,588],{"emptyLinePlaceholder":587},[550,859,860],{"class":552,"line":745},[550,861,863],{"class":862},"sHwdD","\u002F\u002F Send audits to a dedicated Axiom dataset:\n",[550,865,867,869,871,873,875,877,879,881,884,886,888,890],{"class":552,"line":866},5,[550,868,594],{"class":564},[550,870,597],{"class":560},[550,872,600],{"class":564},[550,874,597],{"class":560},[550,876,606],{"class":605},[550,878,609],{"class":564},[550,880,612],{"class":560},[550,882,883],{"class":577},"evlog:drain",[550,885,612],{"class":560},[550,887,620],{"class":560},[550,889,823],{"class":605},[550,891,892],{"class":564},"(\n",[550,894,896,899,901,904,907,909,911,913,915,917,920,922,925,927,930,932,935,937,940],{"class":552,"line":895},6,[550,897,898],{"class":605},"  createAxiomDrain",[550,900,609],{"class":564},[550,902,903],{"class":560},"{",[550,905,906],{"class":711}," dataset",[550,908,670],{"class":560},[550,910,574],{"class":560},[550,912,804],{"class":577},[550,914,612],{"class":560},[550,916,620],{"class":560},[550,918,919],{"class":711}," apiKey",[550,921,670],{"class":560},[550,923,924],{"class":564}," process",[550,926,597],{"class":560},[550,928,929],{"class":564},"env",[550,931,597],{"class":560},[550,933,934],{"class":564},"AXIOM_AUDIT_API_KEY ",[550,936,748],{"class":560},[550,938,939],{"class":564},")",[550,941,706],{"class":560},[550,943,945],{"class":552,"line":944},7,[550,946,751],{"class":564},[507,948,949,950,953],{},"Set ",[511,951,952],{},"await: true"," to make audit writes synchronous (no fire-and-forget for audits — crash-safe by default):",[540,955,957],{"className":542,"code":956,"language":545,"meta":546,"style":546},"auditOnly(createFsDrain({ dir: '.audit' }), { await: true })\n",[511,958,959],{"__ignoreMap":546},[550,960,961,963,965,968,970,972,975,977,979,982,984,986,988,990,992,995,997,1001,1003],{"class":552,"line":553},[550,962,517],{"class":605},[550,964,609],{"class":564},[550,966,967],{"class":605},"createFsDrain",[550,969,609],{"class":564},[550,971,903],{"class":560},[550,973,974],{"class":711}," dir",[550,976,670],{"class":560},[550,978,574],{"class":560},[550,980,981],{"class":577},".audit",[550,983,612],{"class":560},[550,985,568],{"class":560},[550,987,939],{"class":564},[550,989,620],{"class":560},[550,991,561],{"class":560},[550,993,994],{"class":711}," await",[550,996,670],{"class":560},[550,998,1000],{"class":999},"sfNiH"," true",[550,1002,568],{"class":560},[550,1004,1005],{"class":564},")\n",[507,1007,1008,1009,1011],{},"The ",[511,1010,952],{}," flag costs you a small bit of latency per request that records an audit (one synchronous drain call), but guarantees the audit hits disk before the response is sent. For compliance-grade audits, the trade-off is always worth it.",[524,1013,1014],{"id":521},[511,1015,1016],{},"signed()",[507,1018,1019,1022],{},[511,1020,1021],{},"signed(drain, opts)"," adds tamper-evident integrity. Two strategies:",[1024,1025,1026,1042],"table",{},[1027,1028,1029],"thead",{},[1030,1031,1032,1036,1039],"tr",{},[1033,1034,1035],"th",{},"Strategy",[1033,1037,1038],{},"What it adds",[1033,1040,1041],{},"Use case",[1043,1044,1045,1062],"tbody",{},[1030,1046,1047,1053,1059],{},[1048,1049,1050],"td",{},[511,1051,1052],{},"'hmac'",[1048,1054,1055,1058],{},[511,1056,1057],{},"event.audit.signature"," (HMAC of the canonical event)",[1048,1060,1061],{},"Single-event integrity check (any later mutation fails verification).",[1030,1063,1064,1069,1077],{},[1048,1065,1066],{},[511,1067,1068],{},"'hash-chain'",[1048,1070,1071,765,1074],{},[511,1072,1073],{},"event.audit.prevHash",[511,1075,1076],{},"event.audit.hash",[1048,1078,1079],{},"A verifiable chain — deletions and reordering also become detectable.",[777,1081,1082,1088,1089,1093,1094,1096],{},[780,1083,1084,1085,1087],{},"What ",[511,1086,1016],{}," actually buys you."," Detection, not prevention. Anyone with write access to the underlying sink can still nuke the file or table — but the chain proves ",[1090,1091,1092],"em",{},"which"," events were dropped or modified after the fact. Skip ",[511,1095,1016],{}," if you already write to an append-only \u002F WORM store (S3 Object Lock, Postgres with row-level immutability, BigQuery append-only tables); doubling integrity layers just adds latency without raising the bar.",[1098,1099,1101],"h3",{"id":1100},"hmac","HMAC",[507,1103,1104],{},"Each event gets a signature. Tampering with one row breaks that row's verification, but doesn't break later rows.",[540,1106,1108],{"className":542,"code":1107,"language":545,"meta":546,"style":546},"import { signed } from 'evlog'\n\nsigned(drain, { strategy: 'hmac', secret: process.env.AUDIT_SECRET! })\n",[511,1109,1110,1129,1133],{"__ignoreMap":546},[550,1111,1112,1114,1116,1119,1121,1123,1125,1127],{"class":552,"line":553},[550,1113,557],{"class":556},[550,1115,561],{"class":560},[550,1117,1118],{"class":564}," signed",[550,1120,568],{"class":560},[550,1122,571],{"class":556},[550,1124,574],{"class":560},[550,1126,578],{"class":577},[550,1128,581],{"class":560},[550,1130,1131],{"class":552,"line":584},[550,1132,588],{"emptyLinePlaceholder":587},[550,1134,1135,1137,1140,1142,1144,1147,1149,1151,1153,1155,1157,1160,1162,1164,1166,1168,1170,1173,1176,1178],{"class":552,"line":591},[550,1136,521],{"class":605},[550,1138,1139],{"class":564},"(drain",[550,1141,620],{"class":560},[550,1143,561],{"class":560},[550,1145,1146],{"class":711}," strategy",[550,1148,670],{"class":560},[550,1150,574],{"class":560},[550,1152,1100],{"class":577},[550,1154,612],{"class":560},[550,1156,620],{"class":560},[550,1158,1159],{"class":711}," secret",[550,1161,670],{"class":560},[550,1163,924],{"class":564},[550,1165,597],{"class":560},[550,1167,929],{"class":564},[550,1169,597],{"class":560},[550,1171,1172],{"class":564},"AUDIT_SECRET",[550,1174,1175],{"class":560},"!",[550,1177,568],{"class":560},[550,1179,1005],{"class":564},[1098,1181,1183],{"id":1182},"hash-chain","Hash-chain",[507,1185,1186],{},"Each event references the previous event's hash. Deleting any row breaks the chain forward of that point, so the verifier can pinpoint the exact row that was tampered with.",[540,1188,1190],{"className":542,"code":1189,"language":545,"meta":546,"style":546},"signed(drain, {\n  strategy: 'hash-chain',\n  state: {\n    load: () => fs.readFile('.audit\u002Fhead', 'utf8').catch(() => null),\n    save: (h) => fs.writeFile('.audit\u002Fhead', h),\n  },\n})\n",[511,1191,1192,1203,1218,1227,1286,1325,1330],{"__ignoreMap":546},[550,1193,1194,1196,1198,1200],{"class":552,"line":553},[550,1195,521],{"class":605},[550,1197,1139],{"class":564},[550,1199,620],{"class":560},[550,1201,1202],{"class":560}," {\n",[550,1204,1205,1208,1210,1212,1214,1216],{"class":552,"line":584},[550,1206,1207],{"class":711},"  strategy",[550,1209,670],{"class":560},[550,1211,574],{"class":560},[550,1213,1182],{"class":577},[550,1215,612],{"class":560},[550,1217,706],{"class":560},[550,1219,1220,1223,1225],{"class":552,"line":591},[550,1221,1222],{"class":711},"  state",[550,1224,670],{"class":560},[550,1226,1202],{"class":560},[550,1228,1229,1232,1234,1237,1239,1242,1244,1247,1249,1251,1254,1256,1258,1260,1263,1265,1267,1269,1272,1274,1277,1279,1282,1284],{"class":552,"line":745},[550,1230,1231],{"class":605},"    load",[550,1233,670],{"class":560},[550,1235,1236],{"class":560}," ()",[550,1238,678],{"class":677},[550,1240,1241],{"class":564}," fs",[550,1243,597],{"class":560},[550,1245,1246],{"class":605},"readFile",[550,1248,609],{"class":564},[550,1250,612],{"class":560},[550,1252,1253],{"class":577},".audit\u002Fhead",[550,1255,612],{"class":560},[550,1257,620],{"class":560},[550,1259,574],{"class":560},[550,1261,1262],{"class":577},"utf8",[550,1264,612],{"class":560},[550,1266,939],{"class":564},[550,1268,597],{"class":560},[550,1270,1271],{"class":605},"catch",[550,1273,609],{"class":564},[550,1275,1276],{"class":560},"()",[550,1278,678],{"class":677},[550,1280,1281],{"class":560}," null",[550,1283,939],{"class":564},[550,1285,706],{"class":560},[550,1287,1288,1291,1293,1296,1299,1301,1303,1305,1307,1310,1312,1314,1316,1318,1320,1323],{"class":552,"line":866},[550,1289,1290],{"class":605},"    save",[550,1292,670],{"class":560},[550,1294,1295],{"class":560}," (",[550,1297,1298],{"class":673},"h",[550,1300,939],{"class":560},[550,1302,678],{"class":677},[550,1304,1241],{"class":564},[550,1306,597],{"class":560},[550,1308,1309],{"class":605},"writeFile",[550,1311,609],{"class":564},[550,1313,612],{"class":560},[550,1315,1253],{"class":577},[550,1317,612],{"class":560},[550,1319,620],{"class":560},[550,1321,1322],{"class":564}," h)",[550,1324,706],{"class":560},[550,1326,1327],{"class":552,"line":895},[550,1328,1329],{"class":560},"  },\n",[550,1331,1332,1334],{"class":552,"line":944},[550,1333,748],{"class":560},[550,1335,1005],{"class":564},[507,1337,1008,1338,1341],{},[511,1339,1340],{},"state"," config is required for cross-process or durable chains: load the previous head hash from your own store (Redis, Postgres, file) before each event, save the new head after.",[1343,1344],"hash-chain-tamper",{},[1346,1347,1348,1349,1352,1353,1356,1357,597],"note",{},"A CLI to walk and verify the chain (",[511,1350,1351],{},"evlog audit verify",") is on the roadmap. Until then, validate by recomputing the hashes of stored events and comparing each ",[511,1354,1355],{},"prevHash"," against the previous event's ",[511,1358,1359],{},"hash",[1361,1362,1363],"style",{},"html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sHdIc, html code.shiki .sHdIc{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#EEFFFF;--shiki-default-font-style:italic;--shiki-dark:#BABED8;--shiki-dark-font-style:italic}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sfNiH, html code.shiki .sfNiH{--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC}",{"title":546,"searchDepth":584,"depth":584,"links":1365},[1366,1367,1368],{"id":526,"depth":584,"text":529},{"id":772,"depth":584,"text":775},{"id":521,"depth":584,"text":1016,"children":1369},[1370,1371],{"id":1100,"depth":591,"text":1101},{"id":1182,"depth":591,"text":1183},"auditEnricher to auto-fill request context, auditOnly to route audits to a dedicated sink, and signed for tamper-evident HMAC or hash-chain integrity.","md",[1375,1378],{"label":367,"icon":370,"to":368,"color":1376,"variant":1377},"neutral","subtle",{"label":377,"icon":354,"to":378,"color":1376,"variant":1377},{},{"title":372,"icon":375},{"title":502,"description":1372},"3WNlOjtJ5lfdHjYt6yZU7XwwlUIN95fS3mx0giockts",[1384,1386],{"title":367,"path":368,"stem":369,"description":1385,"icon":370,"children":-1},"log.audit, log.audit.deny, standalone audit(), withAudit auto-instrumentation, defineAuditAction and defineAuditCatalog registries, and auditDiff change patches.",{"title":377,"path":378,"stem":379,"description":1387,"icon":354,"children":-1},"Integrity, redact presets, GDPR vs append-only, retention windows, and the most common pitfalls when shipping audit logs to production.",1785016745532]