[{"data":1,"prerenderedAt":1352},["ShallowReactive",2],{"navigation_docs":3,"-use-cases-audit-pipeline":464,"-use-cases-audit-pipeline-surround":1347},[4,30,80,245,379,434],{"title":5,"path":6,"stem":7,"children":8,"page":29},"Start","\u002Fstart","1.start",[9,14,19,24],{"title":10,"path":11,"stem":12,"icon":13},"Introduction","\u002Fstart\u002Fintroduction","1.start\u002F1.introduction","i-lucide-info",{"title":15,"path":16,"stem":17,"icon":18},"Why start with evlog","\u002Fstart\u002Fwhy-evlog","1.start\u002F2.why-evlog","i-lucide-rocket",{"title":20,"path":21,"stem":22,"icon":23},"Installation","\u002Fstart\u002Finstallation","1.start\u002F3.installation","i-lucide-download",{"title":25,"path":26,"stem":27,"icon":28},"Quick Start","\u002Fstart\u002Fquick-start","1.start\u002F4.quick-start","i-lucide-zap",false,{"title":31,"path":32,"stem":33,"children":34,"page":29},"Learn","\u002Flearn","2.learn",[35,40,45,50,55,60,65,70,75],{"title":36,"path":37,"stem":38,"icon":39},"Overview","\u002Flearn\u002Foverview","2.learn\u002F0.overview","i-lucide-list",{"title":41,"path":42,"stem":43,"icon":44},"Simple Logging","\u002Flearn\u002Fsimple-logging","2.learn\u002F1.simple-logging","i-lucide-terminal",{"title":46,"path":47,"stem":48,"icon":49},"Wide Events","\u002Flearn\u002Fwide-events","2.learn\u002F2.wide-events","i-lucide-layers",{"title":51,"path":52,"stem":53,"icon":54},"Structured Errors","\u002Flearn\u002Fstructured-errors","2.learn\u002F3.structured-errors","i-lucide-shield-alert",{"title":56,"path":57,"stem":58,"icon":59},"Lifecycle","\u002Flearn\u002Flifecycle","2.learn\u002F4.lifecycle","i-lucide-arrow-right-left",{"title":61,"path":62,"stem":63,"icon":64},"Sampling","\u002Flearn\u002Fsampling","2.learn\u002F5.sampling","i-lucide-filter",{"title":66,"path":67,"stem":68,"icon":69},"Auto-Redaction","\u002Flearn\u002Fredaction","2.learn\u002F6.redaction","i-lucide-eye-off",{"title":71,"path":72,"stem":73,"icon":74},"Typed Fields","\u002Flearn\u002Ftyped-fields","2.learn\u002F7.typed-fields","i-simple-icons-typescript",{"title":76,"path":77,"stem":78,"icon":79},"Catalogs","\u002Flearn\u002Fcatalogs","2.learn\u002F8.catalogs","i-lucide-book-open",{"title":81,"path":82,"stem":83,"children":84,"page":29},"Integrate","\u002Fintegrate","3.integrate",[85,89,157],{"title":36,"path":86,"stem":87,"icon":88},"\u002Fintegrate\u002Foverview","3.integrate\u002F0.overview","i-lucide-plug",{"title":90,"path":91,"stem":92,"children":93,"page":29},"Adapters","\u002Fintegrate\u002Fadapters","3.integrate\u002Fadapters",[94,97,137],{"title":36,"path":95,"stem":96,"icon":39},"\u002Fintegrate\u002Fadapters\u002Foverview","3.integrate\u002Fadapters\u002F01.overview",{"title":98,"path":99,"stem":100,"children":101,"page":29},"Cloud","\u002Fintegrate\u002Fadapters\u002Fcloud","3.integrate\u002Fadapters\u002Fcloud",[102,107,112,117,122,127,132],{"title":103,"path":104,"stem":105,"icon":106},"Axiom","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Faxiom","3.integrate\u002Fadapters\u002Fcloud\u002F01.axiom","i-custom-axiom",{"title":108,"path":109,"stem":110,"icon":111},"OTLP","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fotlp","3.integrate\u002Fadapters\u002Fcloud\u002F02.otlp","i-simple-icons-opentelemetry",{"title":113,"path":114,"stem":115,"icon":116},"PostHog","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fposthog","3.integrate\u002Fadapters\u002Fcloud\u002F03.posthog","i-simple-icons-posthog",{"title":118,"path":119,"stem":120,"icon":121},"Sentry","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fsentry","3.integrate\u002Fadapters\u002Fcloud\u002F04.sentry","i-simple-icons-sentry",{"title":123,"path":124,"stem":125,"icon":126},"Better Stack","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fbetter-stack","3.integrate\u002Fadapters\u002Fcloud\u002F05.better-stack","i-simple-icons-betterstack",{"title":128,"path":129,"stem":130,"icon":131},"Datadog","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fdatadog","3.integrate\u002Fadapters\u002Fcloud\u002F06.datadog","i-simple-icons-datadog",{"title":133,"path":134,"stem":135,"icon":136},"HyperDX","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fhyperdx","3.integrate\u002Fadapters\u002Fcloud\u002F07.hyperdx","i-custom-hyperdx",{"title":138,"path":139,"stem":140,"children":141,"page":29},"Self-Hosted","\u002Fintegrate\u002Fadapters\u002Fself-hosted","3.integrate\u002Fadapters\u002Fself-hosted",[142,147,152],{"title":143,"path":144,"stem":145,"icon":146},"File System","\u002Fintegrate\u002Fadapters\u002Fself-hosted\u002Ffs","3.integrate\u002Fadapters\u002Fself-hosted\u002F01.fs","i-lucide-hard-drive",{"title":148,"path":149,"stem":150,"icon":151},"NuxtHub","\u002Fintegrate\u002Fadapters\u002Fself-hosted\u002Fnuxthub","3.integrate\u002Fadapters\u002Fself-hosted\u002F02.nuxthub","i-simple-icons-nuxt",{"title":153,"path":154,"stem":155,"icon":156},"Memory","\u002Fintegrate\u002Fadapters\u002Fself-hosted\u002Fmemory","3.integrate\u002Fadapters\u002Fself-hosted\u002F03.memory","i-lucide-cpu",{"title":158,"path":159,"stem":160,"children":161,"page":29},"Frameworks","\u002Fintegrate\u002Fframeworks","3.integrate\u002Fframeworks",[162,166,171,176,181,186,191,196,201,206,211,216,221,226,230,235,240],{"title":36,"path":163,"stem":164,"icon":165},"\u002Fintegrate\u002Fframeworks\u002Foverview","3.integrate\u002Fframeworks\u002F00.overview","i-lucide-layout-grid",{"title":167,"path":168,"stem":169,"icon":170},"Nuxt","\u002Fintegrate\u002Fframeworks\u002Fnuxt","3.integrate\u002Fframeworks\u002F01.nuxt","i-simple-icons-nuxtdotjs",{"title":172,"path":173,"stem":174,"icon":175},"Next.js","\u002Fintegrate\u002Fframeworks\u002Fnextjs","3.integrate\u002Fframeworks\u002F02.nextjs","i-simple-icons-nextdotjs",{"title":177,"path":178,"stem":179,"icon":180},"SvelteKit","\u002Fintegrate\u002Fframeworks\u002Fsveltekit","3.integrate\u002Fframeworks\u002F03.sveltekit","i-simple-icons-svelte",{"title":182,"path":183,"stem":184,"icon":185},"Nitro","\u002Fintegrate\u002Fframeworks\u002Fnitro","3.integrate\u002Fframeworks\u002F04.nitro","i-custom-nitro",{"title":187,"path":188,"stem":189,"icon":190},"TanStack Start","\u002Fintegrate\u002Fframeworks\u002Ftanstack-start","3.integrate\u002Fframeworks\u002F05.tanstack-start","i-custom-tanstack",{"title":192,"path":193,"stem":194,"icon":195},"NestJS","\u002Fintegrate\u002Fframeworks\u002Fnestjs","3.integrate\u002Fframeworks\u002F06.nestjs","i-simple-icons-nestjs",{"title":197,"path":198,"stem":199,"icon":200},"Express","\u002Fintegrate\u002Fframeworks\u002Fexpress","3.integrate\u002Fframeworks\u002F07.express","i-simple-icons-express",{"title":202,"path":203,"stem":204,"icon":205},"Hono","\u002Fintegrate\u002Fframeworks\u002Fhono","3.integrate\u002Fframeworks\u002F08.hono","i-simple-icons-hono",{"title":207,"path":208,"stem":209,"icon":210},"Fastify","\u002Fintegrate\u002Fframeworks\u002Ffastify","3.integrate\u002Fframeworks\u002F09.fastify","i-simple-icons-fastify",{"title":212,"path":213,"stem":214,"icon":215},"Elysia","\u002Fintegrate\u002Fframeworks\u002Felysia","3.integrate\u002Fframeworks\u002F10.elysia","i-custom-elysia",{"title":217,"path":218,"stem":219,"icon":220},"React Router","\u002Fintegrate\u002Fframeworks\u002Freact-router","3.integrate\u002Fframeworks\u002F11.react-router","i-custom-reactrouter",{"title":222,"path":223,"stem":224,"icon":225},"Cloudflare Workers","\u002Fintegrate\u002Fframeworks\u002Fcloudflare-workers","3.integrate\u002Fframeworks\u002F12.cloudflare-workers","i-simple-icons-cloudflare",{"title":227,"path":228,"stem":229,"icon":74},"Standalone","\u002Fintegrate\u002Fframeworks\u002Fstandalone","3.integrate\u002Fframeworks\u002F13.standalone",{"title":231,"path":232,"stem":233,"icon":234},"Astro","\u002Fintegrate\u002Fframeworks\u002Fastro","3.integrate\u002Fframeworks\u002F14.astro","i-simple-icons-astro",{"title":236,"path":237,"stem":238,"icon":239},"oRPC","\u002Fintegrate\u002Fframeworks\u002Forpc","3.integrate\u002Fframeworks\u002F15.orpc","i-lucide-network",{"title":241,"path":242,"stem":243,"icon":244},"AWS Lambda","\u002Fintegrate\u002Fframeworks\u002Faws-lambda","3.integrate\u002Fframeworks\u002F16.aws-lambda","i-custom-lambda",{"title":246,"path":247,"stem":248,"children":249,"page":29},"Use Cases","\u002Fuse-cases","4.use-cases",[250,254,259,288,316,348,369,374],{"title":36,"path":251,"stem":252,"icon":253},"\u002Fuse-cases\u002Foverview","4.use-cases\u002F0.overview","i-lucide-list-checks",{"title":255,"path":256,"stem":257,"icon":258},"Client Logging","\u002Fuse-cases\u002Fclient-logging","4.use-cases\u002F1.client-logging","i-lucide-monitor",{"title":260,"icon":261,"path":262,"stem":263,"children":264,"page":29},"AI SDK","i-simple-icons-vercel","\u002Fuse-cases\u002Fai-sdk","4.use-cases\u002F2.ai-sdk",[265,268,273,278,283],{"title":36,"path":266,"stem":267,"icon":39},"\u002Fuse-cases\u002Fai-sdk\u002Foverview","4.use-cases\u002F2.ai-sdk\u002F01.overview",{"title":269,"path":270,"stem":271,"icon":272},"Usage","\u002Fuse-cases\u002Fai-sdk\u002Fusage","4.use-cases\u002F2.ai-sdk\u002F02.usage","i-lucide-code",{"title":274,"path":275,"stem":276,"icon":277},"Options","\u002Fuse-cases\u002Fai-sdk\u002Foptions","4.use-cases\u002F2.ai-sdk\u002F03.options","i-lucide-sliders",{"title":279,"path":280,"stem":281,"icon":282},"Metadata","\u002Fuse-cases\u002Fai-sdk\u002Fmetadata","4.use-cases\u002F2.ai-sdk\u002F04.metadata","i-lucide-database",{"title":284,"path":285,"stem":286,"icon":287},"Telemetry","\u002Fuse-cases\u002Fai-sdk\u002Ftelemetry","4.use-cases\u002F2.ai-sdk\u002F05.telemetry","i-lucide-activity",{"title":289,"icon":290,"path":291,"stem":292,"children":293,"page":29},"Better Auth","i-simple-icons-betterauth","\u002Fuse-cases\u002Fbetter-auth","4.use-cases\u002F3.better-auth",[294,297,302,307,311],{"title":36,"path":295,"stem":296,"icon":39},"\u002Fuse-cases\u002Fbetter-auth\u002Foverview","4.use-cases\u002F3.better-auth\u002F01.overview",{"title":298,"path":299,"stem":300,"icon":301},"Identify User","\u002Fuse-cases\u002Fbetter-auth\u002Fidentify-user","4.use-cases\u002F3.better-auth\u002F02.identify-user","i-lucide-user-check",{"title":303,"path":304,"stem":305,"icon":306},"Middleware","\u002Fuse-cases\u002Fbetter-auth\u002Fmiddleware","4.use-cases\u002F3.better-auth\u002F03.middleware","i-lucide-shield",{"title":308,"path":309,"stem":310,"icon":258},"Client Sync","\u002Fuse-cases\u002Fbetter-auth\u002Fclient-sync","4.use-cases\u002F3.better-auth\u002F04.client-sync",{"title":312,"path":313,"stem":314,"icon":315},"Performance","\u002Fuse-cases\u002Fbetter-auth\u002Fperformance","4.use-cases\u002F3.better-auth\u002F05.performance","i-lucide-gauge",{"title":317,"icon":318,"path":319,"stem":320,"children":321,"page":29},"Audit Logs","i-lucide-shield-check","\u002Fuse-cases\u002Faudit","4.use-cases\u002F4.audit",[322,325,330,335,340,344],{"title":36,"path":323,"stem":324,"icon":39},"\u002Fuse-cases\u002Faudit\u002Foverview","4.use-cases\u002F4.audit\u002F01.overview",{"title":326,"path":327,"stem":328,"icon":329},"Schema","\u002Fuse-cases\u002Faudit\u002Fschema","4.use-cases\u002F4.audit\u002F02.schema","i-lucide-file-text",{"title":331,"path":332,"stem":333,"icon":334},"Recording","\u002Fuse-cases\u002Faudit\u002Frecording","4.use-cases\u002F4.audit\u002F03.recording","i-lucide-pen-line",{"title":336,"path":337,"stem":338,"icon":339},"Drains","\u002Fuse-cases\u002Faudit\u002Fpipeline","4.use-cases\u002F4.audit\u002F04.pipeline","i-lucide-link",{"title":341,"path":342,"stem":343,"icon":318},"Compliance","\u002Fuse-cases\u002Faudit\u002Fcompliance","4.use-cases\u002F4.audit\u002F05.compliance",{"title":345,"path":346,"stem":347,"icon":79},"Recipes","\u002Fuse-cases\u002Faudit\u002Frecipes","4.use-cases\u002F4.audit\u002F06.recipes",{"title":284,"icon":315,"path":349,"stem":350,"children":351,"page":29},"\u002Fuse-cases\u002Ftelemetry","4.use-cases\u002F4.telemetry",[352,355,360,365],{"title":36,"path":353,"stem":354,"icon":39},"\u002Fuse-cases\u002Ftelemetry\u002Foverview","4.use-cases\u002F4.telemetry\u002F01.overview",{"title":356,"path":357,"stem":358,"icon":359},"Setup","\u002Fuse-cases\u002Ftelemetry\u002Fsetup","4.use-cases\u002F4.telemetry\u002F02.setup","i-lucide-wrench",{"title":361,"path":362,"stem":363,"icon":364},"Ingest","\u002Fuse-cases\u002Ftelemetry\u002Fingest","4.use-cases\u002F4.telemetry\u002F03.ingest","i-lucide-server",{"title":366,"path":367,"stem":368,"icon":79},"Reference","\u002Fuse-cases\u002Ftelemetry\u002Freference","4.use-cases\u002F4.telemetry\u002F04.reference",{"title":370,"path":371,"stem":372,"icon":373},"Enrichers","\u002Fuse-cases\u002Fenrichers","4.use-cases\u002F5.enrichers","i-lucide-sparkles",{"title":375,"path":376,"stem":377,"icon":378},"eve","\u002Fuse-cases\u002Feve","4.use-cases\u002F5.eve","i-custom-eve",{"title":380,"path":381,"stem":382,"children":383,"page":29},"Extend","\u002Fextend","5.extend",[384,388,393,398,403,407,411,415,419,424,429],{"title":36,"path":385,"stem":386,"icon":387},"\u002Fextend\u002Foverview","5.extend\u002F0.overview","i-lucide-blocks",{"title":389,"path":390,"stem":391,"icon":392},"Stream","\u002Fextend\u002Fstream","5.extend\u002F1.stream","i-lucide-radio-tower",{"title":394,"path":395,"stem":396,"icon":397},"Custom framework","\u002Fextend\u002Fcustom-framework","5.extend\u002F10.custom-framework","i-lucide-puzzle",{"title":399,"path":400,"stem":401,"icon":402},"FS reader","\u002Fextend\u002Ffs-reader","5.extend\u002F2.fs-reader","i-lucide-folder-search",{"title":345,"path":404,"stem":405,"icon":406},"\u002Fextend\u002Fconsumer-recipes","5.extend\u002F3.consumer-recipes","i-lucide-chef-hat",{"title":408,"path":409,"stem":410,"icon":387},"Plugins","\u002Fextend\u002Fplugins","5.extend\u002F4.plugins",{"title":412,"path":413,"stem":414,"icon":373},"Custom enrichers","\u002Fextend\u002Fcustom-enrichers","5.extend\u002F5.custom-enrichers",{"title":416,"path":417,"stem":418,"icon":64},"Tail sampling","\u002Fextend\u002Ftail-sampling","5.extend\u002F6.tail-sampling",{"title":420,"path":421,"stem":422,"icon":423},"Identity headers","\u002Fextend\u002Fidentity-headers","5.extend\u002F7.identity-headers","i-lucide-fingerprint",{"title":425,"path":426,"stem":427,"icon":428},"Custom drains","\u002Fextend\u002Fcustom-drains","5.extend\u002F8.custom-drains","i-lucide-share-2",{"title":430,"path":431,"stem":432,"icon":433},"Drain pipeline","\u002Fextend\u002Fdrain-pipeline","5.extend\u002F9.drain-pipeline","i-lucide-workflow",{"title":366,"path":435,"stem":436,"children":437,"page":29},"\u002Freference","6.reference",[438,443,446,451,455,460],{"title":439,"path":440,"stem":441,"icon":442},"Configuration","\u002Freference\u002Fconfiguration","6.reference\u002F1.configuration","i-lucide-settings",{"title":312,"path":444,"stem":445,"icon":315},"\u002Freference\u002Fperformance","6.reference\u002F2.performance",{"title":447,"path":448,"stem":449,"icon":450},"Vite Plugin","\u002Freference\u002Fvite-plugin","6.reference\u002F3.vite-plugin","i-custom-vite",{"title":452,"path":453,"stem":454,"icon":318},"Best Practices","\u002Freference\u002Fbest-practices","6.reference\u002F4.best-practices",{"title":456,"path":457,"stem":458,"icon":459},"vs Other Loggers","\u002Freference\u002Fvs-other-loggers","6.reference\u002F5.vs-other-loggers","i-lucide-scale",{"title":461,"path":462,"stem":463,"icon":373},"Agent Skills","\u002Freference\u002Fagent-skills","6.reference\u002F6.agent-skills",{"id":465,"title":466,"body":467,"description":1336,"extension":1337,"links":1338,"meta":1343,"navigation":1344,"path":337,"seo":1345,"stem":338,"__hash__":1346},"docs\u002F4.use-cases\u002F4.audit\u002F04.pipeline.md","Drains & Integrity",{"type":468,"value":469,"toc":1328},"minimark",[470,487,494,503,590,593,716,734,740,760,774,911,918,970,976,981,987,1044,1061,1066,1069,1144,1148,1151,1300,1306,1309,1324],[471,472,473,474,478,479,482,483,486],"p",{},"Three building blocks: ",[475,476,477],"code",{},"auditEnricher"," fills context, ",[475,480,481],{},"auditOnly"," routes audits to a dedicated drain, and ",[475,484,485],{},"signed"," adds tamper-evident integrity. Each is opt-in and replaceable.",[488,489,491],"h2",{"id":490},"auditenricher",[475,492,493],{},"auditEnricher()",[471,495,496,498,499,502],{},[475,497,493],{}," populates ",[475,500,501],{},"event.audit.context.{requestId, traceId, ip, userAgent, tenantId}",". Skip it and ship a custom enricher if your strategy differs.",[504,505,511],"pre",{"className":506,"code":507,"filename":508,"language":509,"meta":510,"style":510},"language-typescript shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","import { auditEnricher } from 'evlog'\n\nnitro.hooks.hook('evlog:enrich', auditEnricher())\n","server\u002Fplugins\u002Fevlog.ts","typescript","",[475,512,513,546,553],{"__ignoreMap":510},[514,515,518,522,526,530,533,536,539,543],"span",{"class":516,"line":517},"line",1,[514,519,521],{"class":520},"s7zQu","import",[514,523,525],{"class":524},"sMK4o"," {",[514,527,529],{"class":528},"sTEyZ"," auditEnricher",[514,531,532],{"class":524}," }",[514,534,535],{"class":520}," from",[514,537,538],{"class":524}," '",[514,540,542],{"class":541},"sfazB","evlog",[514,544,545],{"class":524},"'\n",[514,547,549],{"class":516,"line":548},2,[514,550,552],{"emptyLinePlaceholder":551},true,"\n",[514,554,556,559,562,565,567,571,574,577,580,582,585,587],{"class":516,"line":555},3,[514,557,558],{"class":528},"nitro",[514,560,561],{"class":524},".",[514,563,564],{"class":528},"hooks",[514,566,561],{"class":524},[514,568,570],{"class":569},"s2Zo4","hook",[514,572,573],{"class":528},"(",[514,575,576],{"class":524},"'",[514,578,579],{"class":541},"evlog:enrich",[514,581,576],{"class":524},[514,583,584],{"class":524},",",[514,586,529],{"class":569},[514,588,589],{"class":528},"())\n",[471,591,592],{},"For multi-tenant apps and custom session bridges, pass options:",[504,594,596],{"className":506,"code":595,"language":509,"meta":510,"style":510},"nitro.hooks.hook('evlog:enrich', auditEnricher({\n  tenantId: ctx => ctx.event.tenant as string | undefined,\n  bridge: { getSession: async ctx => readSessionActor(ctx.headers) },\n}))\n",[475,597,598,627,671,707],{"__ignoreMap":510},[514,599,600,602,604,606,608,610,612,614,616,618,620,622,624],{"class":516,"line":517},[514,601,558],{"class":528},[514,603,561],{"class":524},[514,605,564],{"class":528},[514,607,561],{"class":524},[514,609,570],{"class":569},[514,611,573],{"class":528},[514,613,576],{"class":524},[514,615,579],{"class":541},[514,617,576],{"class":524},[514,619,584],{"class":524},[514,621,529],{"class":569},[514,623,573],{"class":528},[514,625,626],{"class":524},"{\n",[514,628,629,632,635,639,643,645,647,650,652,655,658,662,665,668],{"class":516,"line":548},[514,630,631],{"class":569},"  tenantId",[514,633,634],{"class":524},":",[514,636,638],{"class":637},"sHdIc"," ctx",[514,640,642],{"class":641},"spNyl"," =>",[514,644,638],{"class":528},[514,646,561],{"class":524},[514,648,649],{"class":528},"event",[514,651,561],{"class":524},[514,653,654],{"class":528},"tenant ",[514,656,657],{"class":520},"as",[514,659,661],{"class":660},"sBMFI"," string",[514,663,664],{"class":524}," |",[514,666,667],{"class":660}," undefined",[514,669,670],{"class":524},",\n",[514,672,673,677,679,681,684,686,689,691,693,696,699,701,704],{"class":516,"line":555},[514,674,676],{"class":675},"swJcz","  bridge",[514,678,634],{"class":524},[514,680,525],{"class":524},[514,682,683],{"class":569}," getSession",[514,685,634],{"class":524},[514,687,688],{"class":641}," async",[514,690,638],{"class":637},[514,692,642],{"class":641},[514,694,695],{"class":569}," readSessionActor",[514,697,698],{"class":528},"(ctx",[514,700,561],{"class":524},[514,702,703],{"class":528},"headers) ",[514,705,706],{"class":524},"},\n",[514,708,710,713],{"class":516,"line":709},4,[514,711,712],{"class":524},"}",[514,714,715],{"class":528},"))\n",[471,717,718,719,721,722,725,726,729,730,733],{},"Without ",[475,720,477],{},", ",[475,723,724],{},"audit.context"," stays empty — auditors and incident responders need at least ",[475,727,728],{},"requestId"," and ",[475,731,732],{},"ip"," to triangulate a recorded action.",[488,735,737],{"id":736},"auditonly",[475,738,739],{},"auditOnly()",[741,742,743,747,748,751,752,755,756,759],"tip",{},[744,745,746],"strong",{},"Why filter audits to a separate sink?"," Three reasons: ",[744,749,750],{},"cost"," (audit volume is tiny next to product telemetry — keep them separate so retention costs don't explode), ",[744,753,754],{},"permissions"," (the audit dataset should be read-only for engineers and write-only for the app), and ",[744,757,758],{},"retention"," (audits often live 7+ years; product logs rarely live more than 90 days).",[471,761,762,765,766,769,770,773],{},[475,763,764],{},"auditOnly(drain)"," only forwards events with an ",[475,767,768],{},"audit"," field. Compose with ",[744,771,772],{},"any"," drain:",[504,775,777],{"className":506,"code":776,"language":509,"meta":510,"style":510},"import { auditOnly } from 'evlog'\nimport { createAxiomDrain } from 'evlog\u002Faxiom'\n\n\u002F\u002F Send audits to a dedicated Axiom dataset:\nnitro.hooks.hook('evlog:drain', auditOnly(\n  createAxiomDrain({ dataset: 'audit', apiKey: process.env.AXIOM_AUDIT_API_KEY }),\n))\n",[475,778,779,798,818,822,828,857,906],{"__ignoreMap":510},[514,780,781,783,785,788,790,792,794,796],{"class":516,"line":517},[514,782,521],{"class":520},[514,784,525],{"class":524},[514,786,787],{"class":528}," auditOnly",[514,789,532],{"class":524},[514,791,535],{"class":520},[514,793,538],{"class":524},[514,795,542],{"class":541},[514,797,545],{"class":524},[514,799,800,802,804,807,809,811,813,816],{"class":516,"line":548},[514,801,521],{"class":520},[514,803,525],{"class":524},[514,805,806],{"class":528}," createAxiomDrain",[514,808,532],{"class":524},[514,810,535],{"class":520},[514,812,538],{"class":524},[514,814,815],{"class":541},"evlog\u002Faxiom",[514,817,545],{"class":524},[514,819,820],{"class":516,"line":555},[514,821,552],{"emptyLinePlaceholder":551},[514,823,824],{"class":516,"line":709},[514,825,827],{"class":826},"sHwdD","\u002F\u002F Send audits to a dedicated Axiom dataset:\n",[514,829,831,833,835,837,839,841,843,845,848,850,852,854],{"class":516,"line":830},5,[514,832,558],{"class":528},[514,834,561],{"class":524},[514,836,564],{"class":528},[514,838,561],{"class":524},[514,840,570],{"class":569},[514,842,573],{"class":528},[514,844,576],{"class":524},[514,846,847],{"class":541},"evlog:drain",[514,849,576],{"class":524},[514,851,584],{"class":524},[514,853,787],{"class":569},[514,855,856],{"class":528},"(\n",[514,858,860,863,865,868,871,873,875,877,879,881,884,886,889,891,894,896,899,901,904],{"class":516,"line":859},6,[514,861,862],{"class":569},"  createAxiomDrain",[514,864,573],{"class":528},[514,866,867],{"class":524},"{",[514,869,870],{"class":675}," dataset",[514,872,634],{"class":524},[514,874,538],{"class":524},[514,876,768],{"class":541},[514,878,576],{"class":524},[514,880,584],{"class":524},[514,882,883],{"class":675}," apiKey",[514,885,634],{"class":524},[514,887,888],{"class":528}," process",[514,890,561],{"class":524},[514,892,893],{"class":528},"env",[514,895,561],{"class":524},[514,897,898],{"class":528},"AXIOM_AUDIT_API_KEY ",[514,900,712],{"class":524},[514,902,903],{"class":528},")",[514,905,670],{"class":524},[514,907,909],{"class":516,"line":908},7,[514,910,715],{"class":528},[471,912,913,914,917],{},"Set ",[475,915,916],{},"await: true"," to make audit writes synchronous (no fire-and-forget for audits — crash-safe by default):",[504,919,921],{"className":506,"code":920,"language":509,"meta":510,"style":510},"auditOnly(createFsDrain({ dir: '.audit' }), { await: true })\n",[475,922,923],{"__ignoreMap":510},[514,924,925,927,929,932,934,936,939,941,943,946,948,950,952,954,956,959,961,965,967],{"class":516,"line":517},[514,926,481],{"class":569},[514,928,573],{"class":528},[514,930,931],{"class":569},"createFsDrain",[514,933,573],{"class":528},[514,935,867],{"class":524},[514,937,938],{"class":675}," dir",[514,940,634],{"class":524},[514,942,538],{"class":524},[514,944,945],{"class":541},".audit",[514,947,576],{"class":524},[514,949,532],{"class":524},[514,951,903],{"class":528},[514,953,584],{"class":524},[514,955,525],{"class":524},[514,957,958],{"class":675}," await",[514,960,634],{"class":524},[514,962,964],{"class":963},"sfNiH"," true",[514,966,532],{"class":524},[514,968,969],{"class":528},")\n",[471,971,972,973,975],{},"The ",[475,974,916],{}," flag costs you a small bit of latency per request that records an audit (one synchronous drain call), but guarantees the audit hits disk before the response is sent. For compliance-grade audits, the trade-off is always worth it.",[488,977,978],{"id":485},[475,979,980],{},"signed()",[471,982,983,986],{},[475,984,985],{},"signed(drain, opts)"," adds tamper-evident integrity. Two strategies:",[988,989,990,1006],"table",{},[991,992,993],"thead",{},[994,995,996,1000,1003],"tr",{},[997,998,999],"th",{},"Strategy",[997,1001,1002],{},"What it adds",[997,1004,1005],{},"Use case",[1007,1008,1009,1026],"tbody",{},[994,1010,1011,1017,1023],{},[1012,1013,1014],"td",{},[475,1015,1016],{},"'hmac'",[1012,1018,1019,1022],{},[475,1020,1021],{},"event.audit.signature"," (HMAC of the canonical event)",[1012,1024,1025],{},"Single-event integrity check (any later mutation fails verification).",[994,1027,1028,1033,1041],{},[1012,1029,1030],{},[475,1031,1032],{},"'hash-chain'",[1012,1034,1035,729,1038],{},[475,1036,1037],{},"event.audit.prevHash",[475,1039,1040],{},"event.audit.hash",[1012,1042,1043],{},"A verifiable chain — deletions and reordering also become detectable.",[741,1045,1046,1052,1053,1057,1058,1060],{},[744,1047,1048,1049,1051],{},"What ",[475,1050,980],{}," actually buys you."," Detection, not prevention. Anyone with write access to the underlying sink can still nuke the file or table — but the chain proves ",[1054,1055,1056],"em",{},"which"," events were dropped or modified after the fact. Skip ",[475,1059,980],{}," if you already write to an append-only \u002F WORM store (S3 Object Lock, Postgres with row-level immutability, BigQuery append-only tables); doubling integrity layers just adds latency without raising the bar.",[1062,1063,1065],"h3",{"id":1064},"hmac","HMAC",[471,1067,1068],{},"Each event gets a signature. Tampering with one row breaks that row's verification, but doesn't break later rows.",[504,1070,1072],{"className":506,"code":1071,"language":509,"meta":510,"style":510},"import { signed } from 'evlog'\n\nsigned(drain, { strategy: 'hmac', secret: process.env.AUDIT_SECRET! })\n",[475,1073,1074,1093,1097],{"__ignoreMap":510},[514,1075,1076,1078,1080,1083,1085,1087,1089,1091],{"class":516,"line":517},[514,1077,521],{"class":520},[514,1079,525],{"class":524},[514,1081,1082],{"class":528}," signed",[514,1084,532],{"class":524},[514,1086,535],{"class":520},[514,1088,538],{"class":524},[514,1090,542],{"class":541},[514,1092,545],{"class":524},[514,1094,1095],{"class":516,"line":548},[514,1096,552],{"emptyLinePlaceholder":551},[514,1098,1099,1101,1104,1106,1108,1111,1113,1115,1117,1119,1121,1124,1126,1128,1130,1132,1134,1137,1140,1142],{"class":516,"line":555},[514,1100,485],{"class":569},[514,1102,1103],{"class":528},"(drain",[514,1105,584],{"class":524},[514,1107,525],{"class":524},[514,1109,1110],{"class":675}," strategy",[514,1112,634],{"class":524},[514,1114,538],{"class":524},[514,1116,1064],{"class":541},[514,1118,576],{"class":524},[514,1120,584],{"class":524},[514,1122,1123],{"class":675}," secret",[514,1125,634],{"class":524},[514,1127,888],{"class":528},[514,1129,561],{"class":524},[514,1131,893],{"class":528},[514,1133,561],{"class":524},[514,1135,1136],{"class":528},"AUDIT_SECRET",[514,1138,1139],{"class":524},"!",[514,1141,532],{"class":524},[514,1143,969],{"class":528},[1062,1145,1147],{"id":1146},"hash-chain","Hash-chain",[471,1149,1150],{},"Each event references the previous event's hash. Deleting any row breaks the chain forward of that point, so the verifier can pinpoint the exact row that was tampered with.",[504,1152,1154],{"className":506,"code":1153,"language":509,"meta":510,"style":510},"signed(drain, {\n  strategy: 'hash-chain',\n  state: {\n    load: () => fs.readFile('.audit\u002Fhead', 'utf8').catch(() => null),\n    save: (h) => fs.writeFile('.audit\u002Fhead', h),\n  },\n})\n",[475,1155,1156,1167,1182,1191,1250,1289,1294],{"__ignoreMap":510},[514,1157,1158,1160,1162,1164],{"class":516,"line":517},[514,1159,485],{"class":569},[514,1161,1103],{"class":528},[514,1163,584],{"class":524},[514,1165,1166],{"class":524}," {\n",[514,1168,1169,1172,1174,1176,1178,1180],{"class":516,"line":548},[514,1170,1171],{"class":675},"  strategy",[514,1173,634],{"class":524},[514,1175,538],{"class":524},[514,1177,1146],{"class":541},[514,1179,576],{"class":524},[514,1181,670],{"class":524},[514,1183,1184,1187,1189],{"class":516,"line":555},[514,1185,1186],{"class":675},"  state",[514,1188,634],{"class":524},[514,1190,1166],{"class":524},[514,1192,1193,1196,1198,1201,1203,1206,1208,1211,1213,1215,1218,1220,1222,1224,1227,1229,1231,1233,1236,1238,1241,1243,1246,1248],{"class":516,"line":709},[514,1194,1195],{"class":569},"    load",[514,1197,634],{"class":524},[514,1199,1200],{"class":524}," ()",[514,1202,642],{"class":641},[514,1204,1205],{"class":528}," fs",[514,1207,561],{"class":524},[514,1209,1210],{"class":569},"readFile",[514,1212,573],{"class":528},[514,1214,576],{"class":524},[514,1216,1217],{"class":541},".audit\u002Fhead",[514,1219,576],{"class":524},[514,1221,584],{"class":524},[514,1223,538],{"class":524},[514,1225,1226],{"class":541},"utf8",[514,1228,576],{"class":524},[514,1230,903],{"class":528},[514,1232,561],{"class":524},[514,1234,1235],{"class":569},"catch",[514,1237,573],{"class":528},[514,1239,1240],{"class":524},"()",[514,1242,642],{"class":641},[514,1244,1245],{"class":524}," null",[514,1247,903],{"class":528},[514,1249,670],{"class":524},[514,1251,1252,1255,1257,1260,1263,1265,1267,1269,1271,1274,1276,1278,1280,1282,1284,1287],{"class":516,"line":830},[514,1253,1254],{"class":569},"    save",[514,1256,634],{"class":524},[514,1258,1259],{"class":524}," (",[514,1261,1262],{"class":637},"h",[514,1264,903],{"class":524},[514,1266,642],{"class":641},[514,1268,1205],{"class":528},[514,1270,561],{"class":524},[514,1272,1273],{"class":569},"writeFile",[514,1275,573],{"class":528},[514,1277,576],{"class":524},[514,1279,1217],{"class":541},[514,1281,576],{"class":524},[514,1283,584],{"class":524},[514,1285,1286],{"class":528}," h)",[514,1288,670],{"class":524},[514,1290,1291],{"class":516,"line":859},[514,1292,1293],{"class":524},"  },\n",[514,1295,1296,1298],{"class":516,"line":908},[514,1297,712],{"class":524},[514,1299,969],{"class":528},[471,1301,972,1302,1305],{},[475,1303,1304],{},"state"," config is required for cross-process or durable chains: load the previous head hash from your own store (Redis, Postgres, file) before each event, save the new head after.",[1307,1308],"hash-chain-tamper",{},[1310,1311,1312,1313,1316,1317,1320,1321,561],"note",{},"A CLI to walk and verify the chain (",[475,1314,1315],{},"evlog audit verify",") is on the roadmap. Until then, validate by recomputing the hashes of stored events and comparing each ",[475,1318,1319],{},"prevHash"," against the previous event's ",[475,1322,1323],{},"hash",[1325,1326,1327],"style",{},"html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sHdIc, html code.shiki .sHdIc{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#EEFFFF;--shiki-default-font-style:italic;--shiki-dark:#BABED8;--shiki-dark-font-style:italic}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sfNiH, html code.shiki .sfNiH{--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC}",{"title":510,"searchDepth":548,"depth":548,"links":1329},[1330,1331,1332],{"id":490,"depth":548,"text":493},{"id":736,"depth":548,"text":739},{"id":485,"depth":548,"text":980,"children":1333},[1334,1335],{"id":1064,"depth":555,"text":1065},{"id":1146,"depth":555,"text":1147},"auditEnricher to auto-fill request context, auditOnly to route audits to a dedicated sink, and signed for tamper-evident HMAC or hash-chain integrity.","md",[1339,1342],{"label":331,"icon":334,"to":332,"color":1340,"variant":1341},"neutral","subtle",{"label":341,"icon":318,"to":342,"color":1340,"variant":1341},{},{"title":336,"icon":339},{"title":466,"description":1336},"itxrFd63uwkkpvv72OfsxMn_ZEQXyktrhxz-jpcd2cQ",[1348,1350],{"title":331,"path":332,"stem":333,"description":1349,"icon":334,"children":-1},"log.audit, log.audit.deny, standalone audit(), withAudit auto-instrumentation, defineAuditAction and defineAuditCatalog registries, and auditDiff change patches.",{"title":341,"path":342,"stem":343,"description":1351,"icon":318,"children":-1},"Integrity, redact presets, GDPR vs append-only, retention windows, and the most common pitfalls when shipping audit logs to production.",1784209296598]