[{"data":1,"prerenderedAt":1403},["ShallowReactive",2],{"navigation_docs":3,"-use-cases-audit-pipeline":515,"-use-cases-audit-pipeline-surround":1398},[4,30,80,123,298,430,485],{"title":5,"path":6,"stem":7,"children":8,"page":29},"Start","\u002Fstart","1.start",[9,14,19,24],{"title":10,"path":11,"stem":12,"icon":13},"Introduction","\u002Fstart\u002Fintroduction","1.start\u002F1.introduction","i-lucide-info",{"title":15,"path":16,"stem":17,"icon":18},"Why start with evlog","\u002Fstart\u002Fwhy-evlog","1.start\u002F2.why-evlog","i-lucide-rocket",{"title":20,"path":21,"stem":22,"icon":23},"Installation","\u002Fstart\u002Finstallation","1.start\u002F3.installation","i-lucide-download",{"title":25,"path":26,"stem":27,"icon":28},"Quick Start","\u002Fstart\u002Fquick-start","1.start\u002F4.quick-start","i-lucide-zap",false,{"title":31,"path":32,"stem":33,"children":34,"page":29},"Learn","\u002Flearn","2.learn",[35,40,45,50,55,60,65,70,75],{"title":36,"path":37,"stem":38,"icon":39},"Overview","\u002Flearn\u002Foverview","2.learn\u002F0.overview","i-lucide-list",{"title":41,"path":42,"stem":43,"icon":44},"Simple Logging","\u002Flearn\u002Fsimple-logging","2.learn\u002F1.simple-logging","i-lucide-terminal",{"title":46,"path":47,"stem":48,"icon":49},"Wide Events","\u002Flearn\u002Fwide-events","2.learn\u002F2.wide-events","i-lucide-layers",{"title":51,"path":52,"stem":53,"icon":54},"Structured Errors","\u002Flearn\u002Fstructured-errors","2.learn\u002F3.structured-errors","i-lucide-shield-alert",{"title":56,"path":57,"stem":58,"icon":59},"Lifecycle","\u002Flearn\u002Flifecycle","2.learn\u002F4.lifecycle","i-lucide-arrow-right-left",{"title":61,"path":62,"stem":63,"icon":64},"Sampling","\u002Flearn\u002Fsampling","2.learn\u002F5.sampling","i-lucide-filter",{"title":66,"path":67,"stem":68,"icon":69},"Auto-Redaction","\u002Flearn\u002Fredaction","2.learn\u002F6.redaction","i-lucide-eye-off",{"title":71,"path":72,"stem":73,"icon":74},"Typed Fields","\u002Flearn\u002Ftyped-fields","2.learn\u002F7.typed-fields","i-simple-icons-typescript",{"title":76,"path":77,"stem":78,"icon":79},"Catalogs","\u002Flearn\u002Fcatalogs","2.learn\u002F8.catalogs","i-lucide-book-open",{"title":81,"path":82,"stem":83,"children":84,"page":29},"CLI","\u002Fcli","3.cli",[85,88,93,98,103,108,113,118],{"title":36,"path":86,"stem":87,"icon":44},"\u002Fcli\u002Foverview","3.cli\u002F0.overview",{"title":89,"path":90,"stem":91,"icon":92},"init","\u002Fcli\u002Finit","3.cli\u002F1.init","i-lucide-wand-sparkles",{"title":94,"path":95,"stem":96,"icon":97},"map","\u002Fcli\u002Fmap","3.cli\u002F2.map","i-lucide-radar",{"title":99,"path":100,"stem":101,"icon":102},"Rules","\u002Fcli\u002Frules","3.cli\u002F3.rules","i-lucide-list-checks",{"title":104,"path":105,"stem":106,"icon":107},"Scoring","\u002Fcli\u002Fscoring","3.cli\u002F4.scoring","i-lucide-gauge",{"title":109,"path":110,"stem":111,"icon":112},"CI","\u002Fcli\u002Fci","3.cli\u002F5.ci","i-lucide-git-pull-request",{"title":114,"path":115,"stem":116,"icon":117},"doctor","\u002Fcli\u002Fdoctor","3.cli\u002F6.doctor","i-lucide-stethoscope",{"title":119,"path":120,"stem":121,"icon":122},"telemetry","\u002Fcli\u002Ftelemetry","3.cli\u002F7.telemetry","i-lucide-bar-chart-3",{"title":124,"path":125,"stem":126,"children":127,"page":29},"Integrate","\u002Fintegrate","4.integrate",[128,132,210],{"title":36,"path":129,"stem":130,"icon":131},"\u002Fintegrate\u002Foverview","4.integrate\u002F0.overview","i-lucide-plug",{"title":133,"path":134,"stem":135,"children":136,"page":29},"Adapters","\u002Fintegrate\u002Fadapters","4.integrate\u002Fadapters",[137,140,180,190],{"title":36,"path":138,"stem":139,"icon":39},"\u002Fintegrate\u002Fadapters\u002Foverview","4.integrate\u002Fadapters\u002F01.overview",{"title":141,"path":142,"stem":143,"children":144,"page":29},"Cloud","\u002Fintegrate\u002Fadapters\u002Fcloud","4.integrate\u002Fadapters\u002Fcloud",[145,150,155,160,165,170,175],{"title":146,"path":147,"stem":148,"icon":149},"Axiom","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Faxiom","4.integrate\u002Fadapters\u002Fcloud\u002F01.axiom","i-custom-axiom",{"title":151,"path":152,"stem":153,"icon":154},"OTLP","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fotlp","4.integrate\u002Fadapters\u002Fcloud\u002F02.otlp","i-simple-icons-opentelemetry",{"title":156,"path":157,"stem":158,"icon":159},"PostHog","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fposthog","4.integrate\u002Fadapters\u002Fcloud\u002F03.posthog","i-simple-icons-posthog",{"title":161,"path":162,"stem":163,"icon":164},"Sentry","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fsentry","4.integrate\u002Fadapters\u002Fcloud\u002F04.sentry","i-simple-icons-sentry",{"title":166,"path":167,"stem":168,"icon":169},"Better Stack","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fbetter-stack","4.integrate\u002Fadapters\u002Fcloud\u002F05.better-stack","i-simple-icons-betterstack",{"title":171,"path":172,"stem":173,"icon":174},"Datadog","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fdatadog","4.integrate\u002Fadapters\u002Fcloud\u002F06.datadog","i-simple-icons-datadog",{"title":176,"path":177,"stem":178,"icon":179},"HyperDX","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fhyperdx","4.integrate\u002Fadapters\u002Fcloud\u002F07.hyperdx","i-custom-hyperdx",{"title":181,"path":182,"stem":183,"children":184,"page":29},"Cloud or Self-Hosted","\u002Fintegrate\u002Fadapters\u002Fhybrid","4.integrate\u002Fadapters\u002Fhybrid",[185],{"title":186,"path":187,"stem":188,"icon":189},"Grafana Loki","\u002Fintegrate\u002Fadapters\u002Fhybrid\u002Floki","4.integrate\u002Fadapters\u002Fhybrid\u002F01.loki","i-simple-icons-grafana",{"title":191,"path":192,"stem":193,"children":194,"page":29},"Self-Hosted","\u002Fintegrate\u002Fadapters\u002Fself-hosted","4.integrate\u002Fadapters\u002Fself-hosted",[195,200,205],{"title":196,"path":197,"stem":198,"icon":199},"File System","\u002Fintegrate\u002Fadapters\u002Fself-hosted\u002Ffs","4.integrate\u002Fadapters\u002Fself-hosted\u002F01.fs","i-lucide-hard-drive",{"title":201,"path":202,"stem":203,"icon":204},"NuxtHub","\u002Fintegrate\u002Fadapters\u002Fself-hosted\u002Fnuxthub","4.integrate\u002Fadapters\u002Fself-hosted\u002F02.nuxthub","i-simple-icons-nuxt",{"title":206,"path":207,"stem":208,"icon":209},"Memory","\u002Fintegrate\u002Fadapters\u002Fself-hosted\u002Fmemory","4.integrate\u002Fadapters\u002Fself-hosted\u002F03.memory","i-lucide-cpu",{"title":211,"path":212,"stem":213,"children":214,"page":29},"Frameworks","\u002Fintegrate\u002Fframeworks","4.integrate\u002Fframeworks",[215,219,224,229,234,239,244,249,254,259,264,269,274,279,283,288,293],{"title":36,"path":216,"stem":217,"icon":218},"\u002Fintegrate\u002Fframeworks\u002Foverview","4.integrate\u002Fframeworks\u002F00.overview","i-lucide-layout-grid",{"title":220,"path":221,"stem":222,"icon":223},"Nuxt","\u002Fintegrate\u002Fframeworks\u002Fnuxt","4.integrate\u002Fframeworks\u002F01.nuxt","i-simple-icons-nuxtdotjs",{"title":225,"path":226,"stem":227,"icon":228},"Next.js","\u002Fintegrate\u002Fframeworks\u002Fnextjs","4.integrate\u002Fframeworks\u002F02.nextjs","i-simple-icons-nextdotjs",{"title":230,"path":231,"stem":232,"icon":233},"SvelteKit","\u002Fintegrate\u002Fframeworks\u002Fsveltekit","4.integrate\u002Fframeworks\u002F03.sveltekit","i-simple-icons-svelte",{"title":235,"path":236,"stem":237,"icon":238},"Nitro","\u002Fintegrate\u002Fframeworks\u002Fnitro","4.integrate\u002Fframeworks\u002F04.nitro","i-custom-nitro",{"title":240,"path":241,"stem":242,"icon":243},"TanStack Start","\u002Fintegrate\u002Fframeworks\u002Ftanstack-start","4.integrate\u002Fframeworks\u002F05.tanstack-start","i-custom-tanstack",{"title":245,"path":246,"stem":247,"icon":248},"NestJS","\u002Fintegrate\u002Fframeworks\u002Fnestjs","4.integrate\u002Fframeworks\u002F06.nestjs","i-simple-icons-nestjs",{"title":250,"path":251,"stem":252,"icon":253},"Express","\u002Fintegrate\u002Fframeworks\u002Fexpress","4.integrate\u002Fframeworks\u002F07.express","i-simple-icons-express",{"title":255,"path":256,"stem":257,"icon":258},"Hono","\u002Fintegrate\u002Fframeworks\u002Fhono","4.integrate\u002Fframeworks\u002F08.hono","i-simple-icons-hono",{"title":260,"path":261,"stem":262,"icon":263},"Fastify","\u002Fintegrate\u002Fframeworks\u002Ffastify","4.integrate\u002Fframeworks\u002F09.fastify","i-simple-icons-fastify",{"title":265,"path":266,"stem":267,"icon":268},"Elysia","\u002Fintegrate\u002Fframeworks\u002Felysia","4.integrate\u002Fframeworks\u002F10.elysia","i-custom-elysia",{"title":270,"path":271,"stem":272,"icon":273},"React Router","\u002Fintegrate\u002Fframeworks\u002Freact-router","4.integrate\u002Fframeworks\u002F11.react-router","i-custom-reactrouter",{"title":275,"path":276,"stem":277,"icon":278},"Cloudflare Workers","\u002Fintegrate\u002Fframeworks\u002Fcloudflare-workers","4.integrate\u002Fframeworks\u002F12.cloudflare-workers","i-simple-icons-cloudflare",{"title":280,"path":281,"stem":282,"icon":74},"Standalone","\u002Fintegrate\u002Fframeworks\u002Fstandalone","4.integrate\u002Fframeworks\u002F13.standalone",{"title":284,"path":285,"stem":286,"icon":287},"Astro","\u002Fintegrate\u002Fframeworks\u002Fastro","4.integrate\u002Fframeworks\u002F14.astro","i-simple-icons-astro",{"title":289,"path":290,"stem":291,"icon":292},"oRPC","\u002Fintegrate\u002Fframeworks\u002Forpc","4.integrate\u002Fframeworks\u002F15.orpc","i-lucide-network",{"title":294,"path":295,"stem":296,"icon":297},"AWS Lambda","\u002Fintegrate\u002Fframeworks\u002Faws-lambda","4.integrate\u002Fframeworks\u002F16.aws-lambda","i-custom-lambda",{"title":299,"path":300,"stem":301,"children":302,"page":29},"Use Cases","\u002Fuse-cases","5.use-cases",[303,306,311,340,367,399,420,425],{"title":36,"path":304,"stem":305,"icon":102},"\u002Fuse-cases\u002Foverview","5.use-cases\u002F0.overview",{"title":307,"path":308,"stem":309,"icon":310},"Client Logging","\u002Fuse-cases\u002Fclient-logging","5.use-cases\u002F1.client-logging","i-lucide-monitor",{"title":312,"icon":313,"path":314,"stem":315,"children":316,"page":29},"AI SDK","i-simple-icons-vercel","\u002Fuse-cases\u002Fai-sdk","5.use-cases\u002F2.ai-sdk",[317,320,325,330,335],{"title":36,"path":318,"stem":319,"icon":39},"\u002Fuse-cases\u002Fai-sdk\u002Foverview","5.use-cases\u002F2.ai-sdk\u002F01.overview",{"title":321,"path":322,"stem":323,"icon":324},"Usage","\u002Fuse-cases\u002Fai-sdk\u002Fusage","5.use-cases\u002F2.ai-sdk\u002F02.usage","i-lucide-code",{"title":326,"path":327,"stem":328,"icon":329},"Options","\u002Fuse-cases\u002Fai-sdk\u002Foptions","5.use-cases\u002F2.ai-sdk\u002F03.options","i-lucide-sliders",{"title":331,"path":332,"stem":333,"icon":334},"Metadata","\u002Fuse-cases\u002Fai-sdk\u002Fmetadata","5.use-cases\u002F2.ai-sdk\u002F04.metadata","i-lucide-database",{"title":336,"path":337,"stem":338,"icon":339},"Telemetry","\u002Fuse-cases\u002Fai-sdk\u002Ftelemetry","5.use-cases\u002F2.ai-sdk\u002F05.telemetry","i-lucide-activity",{"title":341,"icon":342,"path":343,"stem":344,"children":345,"page":29},"Better Auth","i-simple-icons-betterauth","\u002Fuse-cases\u002Fbetter-auth","5.use-cases\u002F3.better-auth",[346,349,354,359,363],{"title":36,"path":347,"stem":348,"icon":39},"\u002Fuse-cases\u002Fbetter-auth\u002Foverview","5.use-cases\u002F3.better-auth\u002F01.overview",{"title":350,"path":351,"stem":352,"icon":353},"Identify User","\u002Fuse-cases\u002Fbetter-auth\u002Fidentify-user","5.use-cases\u002F3.better-auth\u002F02.identify-user","i-lucide-user-check",{"title":355,"path":356,"stem":357,"icon":358},"Middleware","\u002Fuse-cases\u002Fbetter-auth\u002Fmiddleware","5.use-cases\u002F3.better-auth\u002F03.middleware","i-lucide-shield",{"title":360,"path":361,"stem":362,"icon":310},"Client Sync","\u002Fuse-cases\u002Fbetter-auth\u002Fclient-sync","5.use-cases\u002F3.better-auth\u002F04.client-sync",{"title":364,"path":365,"stem":366,"icon":107},"Performance","\u002Fuse-cases\u002Fbetter-auth\u002Fperformance","5.use-cases\u002F3.better-auth\u002F05.performance",{"title":368,"icon":369,"path":370,"stem":371,"children":372,"page":29},"Audit Logs","i-lucide-shield-check","\u002Fuse-cases\u002Faudit","5.use-cases\u002F4.audit",[373,376,381,386,391,395],{"title":36,"path":374,"stem":375,"icon":39},"\u002Fuse-cases\u002Faudit\u002Foverview","5.use-cases\u002F4.audit\u002F01.overview",{"title":377,"path":378,"stem":379,"icon":380},"Schema","\u002Fuse-cases\u002Faudit\u002Fschema","5.use-cases\u002F4.audit\u002F02.schema","i-lucide-file-text",{"title":382,"path":383,"stem":384,"icon":385},"Recording","\u002Fuse-cases\u002Faudit\u002Frecording","5.use-cases\u002F4.audit\u002F03.recording","i-lucide-pen-line",{"title":387,"path":388,"stem":389,"icon":390},"Drains","\u002Fuse-cases\u002Faudit\u002Fpipeline","5.use-cases\u002F4.audit\u002F04.pipeline","i-lucide-link",{"title":392,"path":393,"stem":394,"icon":369},"Compliance","\u002Fuse-cases\u002Faudit\u002Fcompliance","5.use-cases\u002F4.audit\u002F05.compliance",{"title":396,"path":397,"stem":398,"icon":79},"Recipes","\u002Fuse-cases\u002Faudit\u002Frecipes","5.use-cases\u002F4.audit\u002F06.recipes",{"title":336,"icon":107,"path":400,"stem":401,"children":402,"page":29},"\u002Fuse-cases\u002Ftelemetry","5.use-cases\u002F4.telemetry",[403,406,411,416],{"title":36,"path":404,"stem":405,"icon":39},"\u002Fuse-cases\u002Ftelemetry\u002Foverview","5.use-cases\u002F4.telemetry\u002F01.overview",{"title":407,"path":408,"stem":409,"icon":410},"Setup","\u002Fuse-cases\u002Ftelemetry\u002Fsetup","5.use-cases\u002F4.telemetry\u002F02.setup","i-lucide-wrench",{"title":412,"path":413,"stem":414,"icon":415},"Ingest","\u002Fuse-cases\u002Ftelemetry\u002Fingest","5.use-cases\u002F4.telemetry\u002F03.ingest","i-lucide-server",{"title":417,"path":418,"stem":419,"icon":79},"Reference","\u002Fuse-cases\u002Ftelemetry\u002Freference","5.use-cases\u002F4.telemetry\u002F04.reference",{"title":421,"path":422,"stem":423,"icon":424},"Enrichers","\u002Fuse-cases\u002Fenrichers","5.use-cases\u002F5.enrichers","i-lucide-sparkles",{"title":426,"path":427,"stem":428,"icon":429},"eve","\u002Fuse-cases\u002Feve","5.use-cases\u002F5.eve","i-custom-eve",{"title":431,"path":432,"stem":433,"children":434,"page":29},"Extend","\u002Fextend","6.extend",[435,439,444,449,454,458,462,466,470,475,480],{"title":36,"path":436,"stem":437,"icon":438},"\u002Fextend\u002Foverview","6.extend\u002F0.overview","i-lucide-blocks",{"title":440,"path":441,"stem":442,"icon":443},"Stream","\u002Fextend\u002Fstream","6.extend\u002F1.stream","i-lucide-radio-tower",{"title":445,"path":446,"stem":447,"icon":448},"Custom framework","\u002Fextend\u002Fcustom-framework","6.extend\u002F10.custom-framework","i-lucide-puzzle",{"title":450,"path":451,"stem":452,"icon":453},"FS reader","\u002Fextend\u002Ffs-reader","6.extend\u002F2.fs-reader","i-lucide-folder-search",{"title":396,"path":455,"stem":456,"icon":457},"\u002Fextend\u002Fconsumer-recipes","6.extend\u002F3.consumer-recipes","i-lucide-chef-hat",{"title":459,"path":460,"stem":461,"icon":438},"Plugins","\u002Fextend\u002Fplugins","6.extend\u002F4.plugins",{"title":463,"path":464,"stem":465,"icon":424},"Custom enrichers","\u002Fextend\u002Fcustom-enrichers","6.extend\u002F5.custom-enrichers",{"title":467,"path":468,"stem":469,"icon":64},"Tail sampling","\u002Fextend\u002Ftail-sampling","6.extend\u002F6.tail-sampling",{"title":471,"path":472,"stem":473,"icon":474},"Identity headers","\u002Fextend\u002Fidentity-headers","6.extend\u002F7.identity-headers","i-lucide-fingerprint",{"title":476,"path":477,"stem":478,"icon":479},"Custom drains","\u002Fextend\u002Fcustom-drains","6.extend\u002F8.custom-drains","i-lucide-share-2",{"title":481,"path":482,"stem":483,"icon":484},"Drain pipeline","\u002Fextend\u002Fdrain-pipeline","6.extend\u002F9.drain-pipeline","i-lucide-workflow",{"title":417,"path":486,"stem":487,"children":488,"page":29},"\u002Freference","7.reference",[489,494,497,502,506,511],{"title":490,"path":491,"stem":492,"icon":493},"Configuration","\u002Freference\u002Fconfiguration","7.reference\u002F1.configuration","i-lucide-settings",{"title":364,"path":495,"stem":496,"icon":107},"\u002Freference\u002Fperformance","7.reference\u002F2.performance",{"title":498,"path":499,"stem":500,"icon":501},"Vite Plugin","\u002Freference\u002Fvite-plugin","7.reference\u002F3.vite-plugin","i-custom-vite",{"title":503,"path":504,"stem":505,"icon":369},"Best Practices","\u002Freference\u002Fbest-practices","7.reference\u002F4.best-practices",{"title":507,"path":508,"stem":509,"icon":510},"vs Other Loggers","\u002Freference\u002Fvs-other-loggers","7.reference\u002F5.vs-other-loggers","i-lucide-scale",{"title":512,"path":513,"stem":514,"icon":424},"Agent Skills","\u002Freference\u002Fagent-skills","7.reference\u002F6.agent-skills",{"id":516,"title":517,"body":518,"description":1387,"extension":1388,"links":1389,"meta":1394,"navigation":1395,"path":388,"seo":1396,"stem":389,"__hash__":1397},"docs\u002F5.use-cases\u002F4.audit\u002F04.pipeline.md","Drains & Integrity",{"type":519,"value":520,"toc":1379},"minimark",[521,538,545,554,641,644,767,785,791,811,825,962,969,1021,1027,1032,1038,1095,1112,1117,1120,1195,1199,1202,1351,1357,1360,1375],[522,523,524,525,529,530,533,534,537],"p",{},"Three building blocks: ",[526,527,528],"code",{},"auditEnricher"," fills context, ",[526,531,532],{},"auditOnly"," routes audits to a dedicated drain, and ",[526,535,536],{},"signed"," adds tamper-evident integrity. Each is opt-in and replaceable.",[539,540,542],"h2",{"id":541},"auditenricher",[526,543,544],{},"auditEnricher()",[522,546,547,549,550,553],{},[526,548,544],{}," populates ",[526,551,552],{},"event.audit.context.{requestId, traceId, ip, userAgent, tenantId}",". Skip it and ship a custom enricher if your strategy differs.",[555,556,562],"pre",{"className":557,"code":558,"filename":559,"language":560,"meta":561,"style":561},"language-typescript shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","import { auditEnricher } from 'evlog'\n\nnitro.hooks.hook('evlog:enrich', auditEnricher())\n","server\u002Fplugins\u002Fevlog.ts","typescript","",[526,563,564,597,604],{"__ignoreMap":561},[565,566,569,573,577,581,584,587,590,594],"span",{"class":567,"line":568},"line",1,[565,570,572],{"class":571},"s7zQu","import",[565,574,576],{"class":575},"sMK4o"," {",[565,578,580],{"class":579},"sTEyZ"," auditEnricher",[565,582,583],{"class":575}," }",[565,585,586],{"class":571}," from",[565,588,589],{"class":575}," '",[565,591,593],{"class":592},"sfazB","evlog",[565,595,596],{"class":575},"'\n",[565,598,600],{"class":567,"line":599},2,[565,601,603],{"emptyLinePlaceholder":602},true,"\n",[565,605,607,610,613,616,618,622,625,628,631,633,636,638],{"class":567,"line":606},3,[565,608,609],{"class":579},"nitro",[565,611,612],{"class":575},".",[565,614,615],{"class":579},"hooks",[565,617,612],{"class":575},[565,619,621],{"class":620},"s2Zo4","hook",[565,623,624],{"class":579},"(",[565,626,627],{"class":575},"'",[565,629,630],{"class":592},"evlog:enrich",[565,632,627],{"class":575},[565,634,635],{"class":575},",",[565,637,580],{"class":620},[565,639,640],{"class":579},"())\n",[522,642,643],{},"For multi-tenant apps and custom session bridges, pass options:",[555,645,647],{"className":557,"code":646,"language":560,"meta":561,"style":561},"nitro.hooks.hook('evlog:enrich', auditEnricher({\n  tenantId: ctx => ctx.event.tenant as string | undefined,\n  bridge: { getSession: async ctx => readSessionActor(ctx.headers) },\n}))\n",[526,648,649,678,722,758],{"__ignoreMap":561},[565,650,651,653,655,657,659,661,663,665,667,669,671,673,675],{"class":567,"line":568},[565,652,609],{"class":579},[565,654,612],{"class":575},[565,656,615],{"class":579},[565,658,612],{"class":575},[565,660,621],{"class":620},[565,662,624],{"class":579},[565,664,627],{"class":575},[565,666,630],{"class":592},[565,668,627],{"class":575},[565,670,635],{"class":575},[565,672,580],{"class":620},[565,674,624],{"class":579},[565,676,677],{"class":575},"{\n",[565,679,680,683,686,690,694,696,698,701,703,706,709,713,716,719],{"class":567,"line":599},[565,681,682],{"class":620},"  tenantId",[565,684,685],{"class":575},":",[565,687,689],{"class":688},"sHdIc"," ctx",[565,691,693],{"class":692},"spNyl"," =>",[565,695,689],{"class":579},[565,697,612],{"class":575},[565,699,700],{"class":579},"event",[565,702,612],{"class":575},[565,704,705],{"class":579},"tenant ",[565,707,708],{"class":571},"as",[565,710,712],{"class":711},"sBMFI"," string",[565,714,715],{"class":575}," |",[565,717,718],{"class":711}," undefined",[565,720,721],{"class":575},",\n",[565,723,724,728,730,732,735,737,740,742,744,747,750,752,755],{"class":567,"line":606},[565,725,727],{"class":726},"swJcz","  bridge",[565,729,685],{"class":575},[565,731,576],{"class":575},[565,733,734],{"class":620}," getSession",[565,736,685],{"class":575},[565,738,739],{"class":692}," async",[565,741,689],{"class":688},[565,743,693],{"class":692},[565,745,746],{"class":620}," readSessionActor",[565,748,749],{"class":579},"(ctx",[565,751,612],{"class":575},[565,753,754],{"class":579},"headers) ",[565,756,757],{"class":575},"},\n",[565,759,761,764],{"class":567,"line":760},4,[565,762,763],{"class":575},"}",[565,765,766],{"class":579},"))\n",[522,768,769,770,772,773,776,777,780,781,784],{},"Without ",[526,771,528],{},", ",[526,774,775],{},"audit.context"," stays empty — auditors and incident responders need at least ",[526,778,779],{},"requestId"," and ",[526,782,783],{},"ip"," to triangulate a recorded action.",[539,786,788],{"id":787},"auditonly",[526,789,790],{},"auditOnly()",[792,793,794,798,799,802,803,806,807,810],"tip",{},[795,796,797],"strong",{},"Why filter audits to a separate sink?"," Three reasons: ",[795,800,801],{},"cost"," (audit volume is tiny next to product telemetry — keep them separate so retention costs don't explode), ",[795,804,805],{},"permissions"," (the audit dataset should be read-only for engineers and write-only for the app), and ",[795,808,809],{},"retention"," (audits often live 7+ years; product logs rarely live more than 90 days).",[522,812,813,816,817,820,821,824],{},[526,814,815],{},"auditOnly(drain)"," only forwards events with an ",[526,818,819],{},"audit"," field. Compose with ",[795,822,823],{},"any"," drain:",[555,826,828],{"className":557,"code":827,"language":560,"meta":561,"style":561},"import { auditOnly } from 'evlog'\nimport { createAxiomDrain } from 'evlog\u002Faxiom'\n\n\u002F\u002F Send audits to a dedicated Axiom dataset:\nnitro.hooks.hook('evlog:drain', auditOnly(\n  createAxiomDrain({ dataset: 'audit', apiKey: process.env.AXIOM_AUDIT_API_KEY }),\n))\n",[526,829,830,849,869,873,879,908,957],{"__ignoreMap":561},[565,831,832,834,836,839,841,843,845,847],{"class":567,"line":568},[565,833,572],{"class":571},[565,835,576],{"class":575},[565,837,838],{"class":579}," auditOnly",[565,840,583],{"class":575},[565,842,586],{"class":571},[565,844,589],{"class":575},[565,846,593],{"class":592},[565,848,596],{"class":575},[565,850,851,853,855,858,860,862,864,867],{"class":567,"line":599},[565,852,572],{"class":571},[565,854,576],{"class":575},[565,856,857],{"class":579}," createAxiomDrain",[565,859,583],{"class":575},[565,861,586],{"class":571},[565,863,589],{"class":575},[565,865,866],{"class":592},"evlog\u002Faxiom",[565,868,596],{"class":575},[565,870,871],{"class":567,"line":606},[565,872,603],{"emptyLinePlaceholder":602},[565,874,875],{"class":567,"line":760},[565,876,878],{"class":877},"sHwdD","\u002F\u002F Send audits to a dedicated Axiom dataset:\n",[565,880,882,884,886,888,890,892,894,896,899,901,903,905],{"class":567,"line":881},5,[565,883,609],{"class":579},[565,885,612],{"class":575},[565,887,615],{"class":579},[565,889,612],{"class":575},[565,891,621],{"class":620},[565,893,624],{"class":579},[565,895,627],{"class":575},[565,897,898],{"class":592},"evlog:drain",[565,900,627],{"class":575},[565,902,635],{"class":575},[565,904,838],{"class":620},[565,906,907],{"class":579},"(\n",[565,909,911,914,916,919,922,924,926,928,930,932,935,937,940,942,945,947,950,952,955],{"class":567,"line":910},6,[565,912,913],{"class":620},"  createAxiomDrain",[565,915,624],{"class":579},[565,917,918],{"class":575},"{",[565,920,921],{"class":726}," dataset",[565,923,685],{"class":575},[565,925,589],{"class":575},[565,927,819],{"class":592},[565,929,627],{"class":575},[565,931,635],{"class":575},[565,933,934],{"class":726}," apiKey",[565,936,685],{"class":575},[565,938,939],{"class":579}," process",[565,941,612],{"class":575},[565,943,944],{"class":579},"env",[565,946,612],{"class":575},[565,948,949],{"class":579},"AXIOM_AUDIT_API_KEY ",[565,951,763],{"class":575},[565,953,954],{"class":579},")",[565,956,721],{"class":575},[565,958,960],{"class":567,"line":959},7,[565,961,766],{"class":579},[522,963,964,965,968],{},"Set ",[526,966,967],{},"await: true"," to make audit writes synchronous (no fire-and-forget for audits — crash-safe by default):",[555,970,972],{"className":557,"code":971,"language":560,"meta":561,"style":561},"auditOnly(createFsDrain({ dir: '.audit' }), { await: true })\n",[526,973,974],{"__ignoreMap":561},[565,975,976,978,980,983,985,987,990,992,994,997,999,1001,1003,1005,1007,1010,1012,1016,1018],{"class":567,"line":568},[565,977,532],{"class":620},[565,979,624],{"class":579},[565,981,982],{"class":620},"createFsDrain",[565,984,624],{"class":579},[565,986,918],{"class":575},[565,988,989],{"class":726}," dir",[565,991,685],{"class":575},[565,993,589],{"class":575},[565,995,996],{"class":592},".audit",[565,998,627],{"class":575},[565,1000,583],{"class":575},[565,1002,954],{"class":579},[565,1004,635],{"class":575},[565,1006,576],{"class":575},[565,1008,1009],{"class":726}," await",[565,1011,685],{"class":575},[565,1013,1015],{"class":1014},"sfNiH"," true",[565,1017,583],{"class":575},[565,1019,1020],{"class":579},")\n",[522,1022,1023,1024,1026],{},"The ",[526,1025,967],{}," flag costs you a small bit of latency per request that records an audit (one synchronous drain call), but guarantees the audit hits disk before the response is sent. For compliance-grade audits, the trade-off is always worth it.",[539,1028,1029],{"id":536},[526,1030,1031],{},"signed()",[522,1033,1034,1037],{},[526,1035,1036],{},"signed(drain, opts)"," adds tamper-evident integrity. Two strategies:",[1039,1040,1041,1057],"table",{},[1042,1043,1044],"thead",{},[1045,1046,1047,1051,1054],"tr",{},[1048,1049,1050],"th",{},"Strategy",[1048,1052,1053],{},"What it adds",[1048,1055,1056],{},"Use case",[1058,1059,1060,1077],"tbody",{},[1045,1061,1062,1068,1074],{},[1063,1064,1065],"td",{},[526,1066,1067],{},"'hmac'",[1063,1069,1070,1073],{},[526,1071,1072],{},"event.audit.signature"," (HMAC of the canonical event)",[1063,1075,1076],{},"Single-event integrity check (any later mutation fails verification).",[1045,1078,1079,1084,1092],{},[1063,1080,1081],{},[526,1082,1083],{},"'hash-chain'",[1063,1085,1086,780,1089],{},[526,1087,1088],{},"event.audit.prevHash",[526,1090,1091],{},"event.audit.hash",[1063,1093,1094],{},"A verifiable chain — deletions and reordering also become detectable.",[792,1096,1097,1103,1104,1108,1109,1111],{},[795,1098,1099,1100,1102],{},"What ",[526,1101,1031],{}," actually buys you."," Detection, not prevention. Anyone with write access to the underlying sink can still nuke the file or table — but the chain proves ",[1105,1106,1107],"em",{},"which"," events were dropped or modified after the fact. Skip ",[526,1110,1031],{}," if you already write to an append-only \u002F WORM store (S3 Object Lock, Postgres with row-level immutability, BigQuery append-only tables); doubling integrity layers just adds latency without raising the bar.",[1113,1114,1116],"h3",{"id":1115},"hmac","HMAC",[522,1118,1119],{},"Each event gets a signature. Tampering with one row breaks that row's verification, but doesn't break later rows.",[555,1121,1123],{"className":557,"code":1122,"language":560,"meta":561,"style":561},"import { signed } from 'evlog'\n\nsigned(drain, { strategy: 'hmac', secret: process.env.AUDIT_SECRET! })\n",[526,1124,1125,1144,1148],{"__ignoreMap":561},[565,1126,1127,1129,1131,1134,1136,1138,1140,1142],{"class":567,"line":568},[565,1128,572],{"class":571},[565,1130,576],{"class":575},[565,1132,1133],{"class":579}," signed",[565,1135,583],{"class":575},[565,1137,586],{"class":571},[565,1139,589],{"class":575},[565,1141,593],{"class":592},[565,1143,596],{"class":575},[565,1145,1146],{"class":567,"line":599},[565,1147,603],{"emptyLinePlaceholder":602},[565,1149,1150,1152,1155,1157,1159,1162,1164,1166,1168,1170,1172,1175,1177,1179,1181,1183,1185,1188,1191,1193],{"class":567,"line":606},[565,1151,536],{"class":620},[565,1153,1154],{"class":579},"(drain",[565,1156,635],{"class":575},[565,1158,576],{"class":575},[565,1160,1161],{"class":726}," strategy",[565,1163,685],{"class":575},[565,1165,589],{"class":575},[565,1167,1115],{"class":592},[565,1169,627],{"class":575},[565,1171,635],{"class":575},[565,1173,1174],{"class":726}," secret",[565,1176,685],{"class":575},[565,1178,939],{"class":579},[565,1180,612],{"class":575},[565,1182,944],{"class":579},[565,1184,612],{"class":575},[565,1186,1187],{"class":579},"AUDIT_SECRET",[565,1189,1190],{"class":575},"!",[565,1192,583],{"class":575},[565,1194,1020],{"class":579},[1113,1196,1198],{"id":1197},"hash-chain","Hash-chain",[522,1200,1201],{},"Each event references the previous event's hash. Deleting any row breaks the chain forward of that point, so the verifier can pinpoint the exact row that was tampered with.",[555,1203,1205],{"className":557,"code":1204,"language":560,"meta":561,"style":561},"signed(drain, {\n  strategy: 'hash-chain',\n  state: {\n    load: () => fs.readFile('.audit\u002Fhead', 'utf8').catch(() => null),\n    save: (h) => fs.writeFile('.audit\u002Fhead', h),\n  },\n})\n",[526,1206,1207,1218,1233,1242,1301,1340,1345],{"__ignoreMap":561},[565,1208,1209,1211,1213,1215],{"class":567,"line":568},[565,1210,536],{"class":620},[565,1212,1154],{"class":579},[565,1214,635],{"class":575},[565,1216,1217],{"class":575}," {\n",[565,1219,1220,1223,1225,1227,1229,1231],{"class":567,"line":599},[565,1221,1222],{"class":726},"  strategy",[565,1224,685],{"class":575},[565,1226,589],{"class":575},[565,1228,1197],{"class":592},[565,1230,627],{"class":575},[565,1232,721],{"class":575},[565,1234,1235,1238,1240],{"class":567,"line":606},[565,1236,1237],{"class":726},"  state",[565,1239,685],{"class":575},[565,1241,1217],{"class":575},[565,1243,1244,1247,1249,1252,1254,1257,1259,1262,1264,1266,1269,1271,1273,1275,1278,1280,1282,1284,1287,1289,1292,1294,1297,1299],{"class":567,"line":760},[565,1245,1246],{"class":620},"    load",[565,1248,685],{"class":575},[565,1250,1251],{"class":575}," ()",[565,1253,693],{"class":692},[565,1255,1256],{"class":579}," fs",[565,1258,612],{"class":575},[565,1260,1261],{"class":620},"readFile",[565,1263,624],{"class":579},[565,1265,627],{"class":575},[565,1267,1268],{"class":592},".audit\u002Fhead",[565,1270,627],{"class":575},[565,1272,635],{"class":575},[565,1274,589],{"class":575},[565,1276,1277],{"class":592},"utf8",[565,1279,627],{"class":575},[565,1281,954],{"class":579},[565,1283,612],{"class":575},[565,1285,1286],{"class":620},"catch",[565,1288,624],{"class":579},[565,1290,1291],{"class":575},"()",[565,1293,693],{"class":692},[565,1295,1296],{"class":575}," null",[565,1298,954],{"class":579},[565,1300,721],{"class":575},[565,1302,1303,1306,1308,1311,1314,1316,1318,1320,1322,1325,1327,1329,1331,1333,1335,1338],{"class":567,"line":881},[565,1304,1305],{"class":620},"    save",[565,1307,685],{"class":575},[565,1309,1310],{"class":575}," (",[565,1312,1313],{"class":688},"h",[565,1315,954],{"class":575},[565,1317,693],{"class":692},[565,1319,1256],{"class":579},[565,1321,612],{"class":575},[565,1323,1324],{"class":620},"writeFile",[565,1326,624],{"class":579},[565,1328,627],{"class":575},[565,1330,1268],{"class":592},[565,1332,627],{"class":575},[565,1334,635],{"class":575},[565,1336,1337],{"class":579}," h)",[565,1339,721],{"class":575},[565,1341,1342],{"class":567,"line":910},[565,1343,1344],{"class":575},"  },\n",[565,1346,1347,1349],{"class":567,"line":959},[565,1348,763],{"class":575},[565,1350,1020],{"class":579},[522,1352,1023,1353,1356],{},[526,1354,1355],{},"state"," config is required for cross-process or durable chains: load the previous head hash from your own store (Redis, Postgres, file) before each event, save the new head after.",[1358,1359],"hash-chain-tamper",{},[1361,1362,1363,1364,1367,1368,1371,1372,612],"note",{},"A CLI to walk and verify the chain (",[526,1365,1366],{},"evlog audit verify",") is on the roadmap. Until then, validate by recomputing the hashes of stored events and comparing each ",[526,1369,1370],{},"prevHash"," against the previous event's ",[526,1373,1374],{},"hash",[1376,1377,1378],"style",{},"html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sHdIc, html code.shiki .sHdIc{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#EEFFFF;--shiki-default-font-style:italic;--shiki-dark:#BABED8;--shiki-dark-font-style:italic}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sfNiH, html code.shiki .sfNiH{--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC}",{"title":561,"searchDepth":599,"depth":599,"links":1380},[1381,1382,1383],{"id":541,"depth":599,"text":544},{"id":787,"depth":599,"text":790},{"id":536,"depth":599,"text":1031,"children":1384},[1385,1386],{"id":1115,"depth":606,"text":1116},{"id":1197,"depth":606,"text":1198},"auditEnricher to auto-fill request context, auditOnly to route audits to a dedicated sink, and signed for tamper-evident HMAC or hash-chain integrity.","md",[1390,1393],{"label":382,"icon":385,"to":383,"color":1391,"variant":1392},"neutral","subtle",{"label":392,"icon":369,"to":393,"color":1391,"variant":1392},{},{"title":387,"icon":390},{"title":517,"description":1387},"3WNlOjtJ5lfdHjYt6yZU7XwwlUIN95fS3mx0giockts",[1399,1401],{"title":382,"path":383,"stem":384,"description":1400,"icon":385,"children":-1},"log.audit, log.audit.deny, standalone audit(), withAudit auto-instrumentation, defineAuditAction and defineAuditCatalog registries, and auditDiff change patches.",{"title":392,"path":393,"stem":394,"description":1402,"icon":369,"children":-1},"Integrity, redact presets, GDPR vs append-only, retention windows, and the most common pitfalls when shipping audit logs to production.",1785610607173]