[{"data":1,"prerenderedAt":1290},["ShallowReactive",2],{"navigation_docs":3,"-logging-audit-pipeline":402,"-logging-audit-pipeline-surround":1285},[4,35,159,201,289,299,386],{"title":5,"path":6,"stem":7,"children":8,"page":34},"Getting Started","\u002Fgetting-started","1.getting-started",[9,14,19,24,29],{"title":10,"path":11,"stem":12,"icon":13},"Introduction","\u002Fgetting-started\u002Fintroduction","1.getting-started\u002F1.introduction","i-lucide-info",{"title":15,"path":16,"stem":17,"icon":18},"Installation","\u002Fgetting-started\u002Finstallation","1.getting-started\u002F2.installation","i-lucide-download",{"title":20,"path":21,"stem":22,"icon":23},"Quick Start","\u002Fgetting-started\u002Fquick-start","1.getting-started\u002F3.quick-start","i-lucide-zap",{"title":25,"path":26,"stem":27,"icon":28},"Agent Skills","\u002Fgetting-started\u002Fagent-skills","1.getting-started\u002F4.agent-skills","i-lucide-sparkles",{"title":30,"path":31,"stem":32,"icon":33},"vs Other Loggers","\u002Fgetting-started\u002Fvs-other-loggers","1.getting-started\u002F5.vs-other-loggers","i-lucide-scale",false,{"title":36,"path":37,"stem":38,"children":39,"page":34},"Logging","\u002Flogging","2.logging",[40,45,50,55,60,65,70,99,127],{"title":41,"path":42,"stem":43,"icon":44},"Overview","\u002Flogging\u002Foverview","2.logging\u002F0.overview","i-lucide-list",{"title":46,"path":47,"stem":48,"icon":49},"Simple Logging","\u002Flogging\u002Fsimple-logging","2.logging\u002F1.simple-logging","i-lucide-terminal",{"title":51,"path":52,"stem":53,"icon":54},"Wide Events","\u002Flogging\u002Fwide-events","2.logging\u002F2.wide-events","i-lucide-layers",{"title":56,"path":57,"stem":58,"icon":59},"Structured Errors","\u002Flogging\u002Fstructured-errors","2.logging\u002F3.structured-errors","i-lucide-shield-alert",{"title":61,"path":62,"stem":63,"icon":64},"Catalogs","\u002Flogging\u002Fcatalogs","2.logging\u002F4.catalogs","i-lucide-book-open",{"title":66,"path":67,"stem":68,"icon":69},"Client Logging","\u002Flogging\u002Fclient-logging","2.logging\u002F5.client-logging","i-lucide-monitor",{"title":71,"icon":72,"path":73,"stem":74,"children":75,"page":34},"AI SDK","i-simple-icons-vercel","\u002Flogging\u002Fai-sdk","2.logging\u002F6.ai-sdk",[76,79,84,89,94],{"title":41,"path":77,"stem":78,"icon":44},"\u002Flogging\u002Fai-sdk\u002Foverview","2.logging\u002F6.ai-sdk\u002F01.overview",{"title":80,"path":81,"stem":82,"icon":83},"Usage","\u002Flogging\u002Fai-sdk\u002Fusage","2.logging\u002F6.ai-sdk\u002F02.usage","i-lucide-code",{"title":85,"path":86,"stem":87,"icon":88},"Options","\u002Flogging\u002Fai-sdk\u002Foptions","2.logging\u002F6.ai-sdk\u002F03.options","i-lucide-sliders",{"title":90,"path":91,"stem":92,"icon":93},"Metadata","\u002Flogging\u002Fai-sdk\u002Fmetadata","2.logging\u002F6.ai-sdk\u002F04.metadata","i-lucide-database",{"title":95,"path":96,"stem":97,"icon":98},"Telemetry","\u002Flogging\u002Fai-sdk\u002Ftelemetry","2.logging\u002F6.ai-sdk\u002F05.telemetry","i-lucide-activity",{"title":100,"icon":101,"path":102,"stem":103,"children":104,"page":34},"Better Auth","i-simple-icons-betterauth","\u002Flogging\u002Fbetter-auth","2.logging\u002F7.better-auth",[105,108,113,118,122],{"title":41,"path":106,"stem":107,"icon":44},"\u002Flogging\u002Fbetter-auth\u002Foverview","2.logging\u002F7.better-auth\u002F01.overview",{"title":109,"path":110,"stem":111,"icon":112},"Identify User","\u002Flogging\u002Fbetter-auth\u002Fidentify-user","2.logging\u002F7.better-auth\u002F02.identify-user","i-lucide-user-check",{"title":114,"path":115,"stem":116,"icon":117},"Middleware","\u002Flogging\u002Fbetter-auth\u002Fmiddleware","2.logging\u002F7.better-auth\u002F03.middleware","i-lucide-shield",{"title":119,"path":120,"stem":121,"icon":69},"Client Sync","\u002Flogging\u002Fbetter-auth\u002Fclient-sync","2.logging\u002F7.better-auth\u002F04.client-sync",{"title":123,"path":124,"stem":125,"icon":126},"Performance","\u002Flogging\u002Fbetter-auth\u002Fperformance","2.logging\u002F7.better-auth\u002F05.performance","i-lucide-gauge",{"title":128,"icon":129,"path":130,"stem":131,"children":132,"page":34},"Audit Logs","i-lucide-shield-check","\u002Flogging\u002Faudit","2.logging\u002F8.audit",[133,136,141,146,151,155],{"title":41,"path":134,"stem":135,"icon":44},"\u002Flogging\u002Faudit\u002Foverview","2.logging\u002F8.audit\u002F01.overview",{"title":137,"path":138,"stem":139,"icon":140},"Schema","\u002Flogging\u002Faudit\u002Fschema","2.logging\u002F8.audit\u002F02.schema","i-lucide-file-text",{"title":142,"path":143,"stem":144,"icon":145},"Recording","\u002Flogging\u002Faudit\u002Frecording","2.logging\u002F8.audit\u002F03.recording","i-lucide-pen-line",{"title":147,"path":148,"stem":149,"icon":150},"Drains","\u002Flogging\u002Faudit\u002Fpipeline","2.logging\u002F8.audit\u002F04.pipeline","i-lucide-link",{"title":152,"path":153,"stem":154,"icon":129},"Compliance","\u002Flogging\u002Faudit\u002Fcompliance","2.logging\u002F8.audit\u002F05.compliance",{"title":156,"path":157,"stem":158,"icon":64},"Recipes","\u002Flogging\u002Faudit\u002Frecipes","2.logging\u002F8.audit\u002F06.recipes",{"title":160,"path":161,"stem":162,"children":163,"page":34},"Core Concepts","\u002Fcore-concepts","3.core-concepts",[164,169,174,179,184,188,191,196],{"title":165,"path":166,"stem":167,"icon":168},"Lifecycle","\u002Fcore-concepts\u002Flifecycle","3.core-concepts\u002F0.lifecycle","i-lucide-arrow-right-left",{"title":170,"path":171,"stem":172,"icon":173},"Configuration","\u002Fcore-concepts\u002Fconfiguration","3.core-concepts\u002F1.configuration","i-lucide-settings",{"title":175,"path":176,"stem":177,"icon":178},"Sampling","\u002Fcore-concepts\u002Fsampling","3.core-concepts\u002F2.sampling","i-lucide-filter",{"title":180,"path":181,"stem":182,"icon":183},"Typed Fields","\u002Fcore-concepts\u002Ftyped-fields","3.core-concepts\u002F3.typed-fields","i-simple-icons-typescript",{"title":185,"path":186,"stem":187,"icon":129},"Best Practices","\u002Fcore-concepts\u002Fbest-practices","3.core-concepts\u002F4.best-practices",{"title":123,"path":189,"stem":190,"icon":126},"\u002Fcore-concepts\u002Fperformance","3.core-concepts\u002F5.performance",{"title":192,"path":193,"stem":194,"icon":195},"Vite Plugin","\u002Fcore-concepts\u002Fvite-plugin","3.core-concepts\u002F6.vite-plugin","i-custom-vite",{"title":197,"path":198,"stem":199,"icon":200},"Auto-Redaction","\u002Fcore-concepts\u002Fredaction","3.core-concepts\u002F7.redaction","i-lucide-eye-off",{"title":202,"path":203,"stem":204,"children":205,"page":34},"Frameworks","\u002Fframeworks","4.frameworks",[206,210,215,220,225,230,235,240,245,250,255,260,265,270,274,279,284],{"title":41,"path":207,"stem":208,"icon":209},"\u002Fframeworks\u002Foverview","4.frameworks\u002F00.overview","i-lucide-layout-grid",{"title":211,"path":212,"stem":213,"icon":214},"Nuxt","\u002Fframeworks\u002Fnuxt","4.frameworks\u002F01.nuxt","i-simple-icons-nuxtdotjs",{"title":216,"path":217,"stem":218,"icon":219},"Next.js","\u002Fframeworks\u002Fnextjs","4.frameworks\u002F02.nextjs","i-simple-icons-nextdotjs",{"title":221,"path":222,"stem":223,"icon":224},"SvelteKit","\u002Fframeworks\u002Fsveltekit","4.frameworks\u002F03.sveltekit","i-simple-icons-svelte",{"title":226,"path":227,"stem":228,"icon":229},"Nitro","\u002Fframeworks\u002Fnitro","4.frameworks\u002F04.nitro","i-custom-nitro",{"title":231,"path":232,"stem":233,"icon":234},"TanStack Start","\u002Fframeworks\u002Ftanstack-start","4.frameworks\u002F05.tanstack-start","i-custom-tanstack",{"title":236,"path":237,"stem":238,"icon":239},"NestJS","\u002Fframeworks\u002Fnestjs","4.frameworks\u002F06.nestjs","i-simple-icons-nestjs",{"title":241,"path":242,"stem":243,"icon":244},"Express","\u002Fframeworks\u002Fexpress","4.frameworks\u002F07.express","i-simple-icons-express",{"title":246,"path":247,"stem":248,"icon":249},"Hono","\u002Fframeworks\u002Fhono","4.frameworks\u002F08.hono","i-simple-icons-hono",{"title":251,"path":252,"stem":253,"icon":254},"Fastify","\u002Fframeworks\u002Ffastify","4.frameworks\u002F09.fastify","i-simple-icons-fastify",{"title":256,"path":257,"stem":258,"icon":259},"Elysia","\u002Fframeworks\u002Felysia","4.frameworks\u002F10.elysia","i-custom-elysia",{"title":261,"path":262,"stem":263,"icon":264},"React Router","\u002Fframeworks\u002Freact-router","4.frameworks\u002F11.react-router","i-custom-reactrouter",{"title":266,"path":267,"stem":268,"icon":269},"Cloudflare Workers","\u002Fframeworks\u002Fcloudflare-workers","4.frameworks\u002F12.cloudflare-workers","i-simple-icons-cloudflare",{"title":271,"path":272,"stem":273,"icon":183},"Standalone","\u002Fframeworks\u002Fstandalone","4.frameworks\u002F13.standalone",{"title":275,"path":276,"stem":277,"icon":278},"Astro","\u002Fframeworks\u002Fastro","4.frameworks\u002F14.astro","i-simple-icons-astro",{"title":280,"path":281,"stem":282,"icon":283},"AWS Lambda","\u002Fframeworks\u002Faws-lambda","4.frameworks\u002F16.aws-lambda","i-custom-lambda",{"title":285,"path":286,"stem":287,"icon":288},"Custom Integration","\u002Fframeworks\u002Fcustom-integration","4.frameworks\u002F17.custom-integration","i-lucide-puzzle",{"title":290,"path":291,"stem":292,"children":293,"page":34},"Build On Top","\u002Fbuild-on-top","5.build-on-top",[294],{"title":295,"path":296,"stem":297,"icon":298},"FS reader","\u002Fbuild-on-top\u002Ffs-reader","5.build-on-top\u002F4.fs-reader","i-lucide-folder-search",{"title":300,"path":301,"stem":302,"children":303,"page":34},"Adapters","\u002Fadapters","6.adapters",[304,307,347,362],{"title":41,"path":305,"stem":306,"icon":44},"\u002Fadapters\u002Foverview","6.adapters\u002F01.overview",{"title":308,"path":309,"stem":310,"children":311,"page":34},"Cloud destinations","\u002Fadapters\u002Fcloud","6.adapters\u002F02.cloud",[312,317,322,327,332,337,342],{"title":313,"path":314,"stem":315,"icon":316},"Axiom","\u002Fadapters\u002Fcloud\u002Faxiom","6.adapters\u002F02.cloud\u002F01.axiom","i-custom-axiom",{"title":318,"path":319,"stem":320,"icon":321},"OTLP","\u002Fadapters\u002Fcloud\u002Fotlp","6.adapters\u002F02.cloud\u002F02.otlp","i-simple-icons-opentelemetry",{"title":323,"path":324,"stem":325,"icon":326},"PostHog","\u002Fadapters\u002Fcloud\u002Fposthog","6.adapters\u002F02.cloud\u002F03.posthog","i-simple-icons-posthog",{"title":328,"path":329,"stem":330,"icon":331},"Sentry","\u002Fadapters\u002Fcloud\u002Fsentry","6.adapters\u002F02.cloud\u002F04.sentry","i-simple-icons-sentry",{"title":333,"path":334,"stem":335,"icon":336},"Better Stack","\u002Fadapters\u002Fcloud\u002Fbetter-stack","6.adapters\u002F02.cloud\u002F05.better-stack","i-simple-icons-betterstack",{"title":338,"path":339,"stem":340,"icon":341},"Datadog","\u002Fadapters\u002Fcloud\u002Fdatadog","6.adapters\u002F02.cloud\u002F06.datadog","i-simple-icons-datadog",{"title":343,"path":344,"stem":345,"icon":346},"HyperDX","\u002Fadapters\u002Fcloud\u002Fhyperdx","6.adapters\u002F02.cloud\u002F07.hyperdx","i-custom-hyperdx",{"title":348,"path":349,"stem":350,"children":351,"page":34},"Self-hosted","\u002Fadapters\u002Fself-hosted","6.adapters\u002F03.self-hosted",[352,357],{"title":353,"path":354,"stem":355,"icon":356},"File System","\u002Fadapters\u002Fself-hosted\u002Ffs","6.adapters\u002F03.self-hosted\u002F01.fs","i-lucide-hard-drive",{"title":358,"path":359,"stem":360,"icon":361},"NuxtHub","\u002Fadapters\u002Fself-hosted\u002Fnuxthub","6.adapters\u002F03.self-hosted\u002F02.nuxthub","i-simple-icons-nuxt",{"title":363,"path":364,"stem":365,"children":366,"page":34},"Building blocks","\u002Fadapters\u002Fbuilding-blocks","6.adapters\u002F04.building-blocks",[367,372,377,381],{"title":368,"path":369,"stem":370,"icon":371},"Pipeline","\u002Fadapters\u002Fbuilding-blocks\u002Fpipeline","6.adapters\u002F04.building-blocks\u002F01.pipeline","i-lucide-workflow",{"title":373,"path":374,"stem":375,"icon":376},"HTTP","\u002Fadapters\u002Fbuilding-blocks\u002Fhttp","6.adapters\u002F04.building-blocks\u002F02.http","i-lucide-globe",{"title":378,"path":379,"stem":380,"icon":83},"Custom Adapters","\u002Fadapters\u002Fbuilding-blocks\u002Fcustom","6.adapters\u002F04.building-blocks\u002F03.custom",{"title":382,"path":383,"stem":384,"icon":385},"Toolkit","\u002Fadapters\u002Fbuilding-blocks\u002Ftoolkit","6.adapters\u002F04.building-blocks\u002F04.toolkit","i-lucide-blocks",{"title":387,"path":388,"stem":389,"children":390,"page":34},"Enrichers","\u002Fenrichers","7.enrichers",[391,394,398],{"title":41,"path":392,"stem":393,"icon":28},"\u002Fenrichers\u002Foverview","7.enrichers\u002F1.overview",{"title":395,"path":396,"stem":397,"icon":288},"Built-in","\u002Fenrichers\u002Fbuilt-in","7.enrichers\u002F2.built-in",{"title":399,"path":400,"stem":401,"icon":83},"Custom","\u002Fenrichers\u002Fcustom","7.enrichers\u002F3.custom",{"id":403,"title":404,"body":405,"description":1274,"extension":1275,"links":1276,"meta":1281,"navigation":1282,"path":148,"seo":1283,"stem":149,"__hash__":1284},"docs\u002F2.logging\u002F8.audit\u002F04.pipeline.md","Drains & Integrity",{"type":406,"value":407,"toc":1266},"minimark",[408,425,432,441,528,531,654,672,678,698,712,849,856,908,914,919,925,982,999,1004,1007,1082,1086,1089,1238,1244,1247,1262],[409,410,411,412,416,417,420,421,424],"p",{},"Three building blocks: ",[413,414,415],"code",{},"auditEnricher"," fills context, ",[413,418,419],{},"auditOnly"," routes audits to a dedicated drain, and ",[413,422,423],{},"signed"," adds tamper-evident integrity. Each is opt-in and replaceable.",[426,427,429],"h2",{"id":428},"auditenricher",[413,430,431],{},"auditEnricher()",[409,433,434,436,437,440],{},[413,435,431],{}," populates ",[413,438,439],{},"event.audit.context.{requestId, traceId, ip, userAgent, tenantId}",". Skip it and ship a custom enricher if your strategy differs.",[442,443,449],"pre",{"className":444,"code":445,"filename":446,"language":447,"meta":448,"style":448},"language-typescript shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","import { auditEnricher } from 'evlog'\n\nnitro.hooks.hook('evlog:enrich', auditEnricher())\n","server\u002Fplugins\u002Fevlog.ts","typescript","",[413,450,451,484,491],{"__ignoreMap":448},[452,453,456,460,464,468,471,474,477,481],"span",{"class":454,"line":455},"line",1,[452,457,459],{"class":458},"s7zQu","import",[452,461,463],{"class":462},"sMK4o"," {",[452,465,467],{"class":466},"sTEyZ"," auditEnricher",[452,469,470],{"class":462}," }",[452,472,473],{"class":458}," from",[452,475,476],{"class":462}," '",[452,478,480],{"class":479},"sfazB","evlog",[452,482,483],{"class":462},"'\n",[452,485,487],{"class":454,"line":486},2,[452,488,490],{"emptyLinePlaceholder":489},true,"\n",[452,492,494,497,500,503,505,509,512,515,518,520,523,525],{"class":454,"line":493},3,[452,495,496],{"class":466},"nitro",[452,498,499],{"class":462},".",[452,501,502],{"class":466},"hooks",[452,504,499],{"class":462},[452,506,508],{"class":507},"s2Zo4","hook",[452,510,511],{"class":466},"(",[452,513,514],{"class":462},"'",[452,516,517],{"class":479},"evlog:enrich",[452,519,514],{"class":462},[452,521,522],{"class":462},",",[452,524,467],{"class":507},[452,526,527],{"class":466},"())\n",[409,529,530],{},"For multi-tenant apps and custom session bridges, pass options:",[442,532,534],{"className":444,"code":533,"language":447,"meta":448,"style":448},"nitro.hooks.hook('evlog:enrich', auditEnricher({\n  tenantId: ctx => ctx.event.tenant as string | undefined,\n  bridge: { getSession: async ctx => readSessionActor(ctx.headers) },\n}))\n",[413,535,536,565,609,645],{"__ignoreMap":448},[452,537,538,540,542,544,546,548,550,552,554,556,558,560,562],{"class":454,"line":455},[452,539,496],{"class":466},[452,541,499],{"class":462},[452,543,502],{"class":466},[452,545,499],{"class":462},[452,547,508],{"class":507},[452,549,511],{"class":466},[452,551,514],{"class":462},[452,553,517],{"class":479},[452,555,514],{"class":462},[452,557,522],{"class":462},[452,559,467],{"class":507},[452,561,511],{"class":466},[452,563,564],{"class":462},"{\n",[452,566,567,570,573,577,581,583,585,588,590,593,596,600,603,606],{"class":454,"line":486},[452,568,569],{"class":507},"  tenantId",[452,571,572],{"class":462},":",[452,574,576],{"class":575},"sHdIc"," ctx",[452,578,580],{"class":579},"spNyl"," =>",[452,582,576],{"class":466},[452,584,499],{"class":462},[452,586,587],{"class":466},"event",[452,589,499],{"class":462},[452,591,592],{"class":466},"tenant ",[452,594,595],{"class":458},"as",[452,597,599],{"class":598},"sBMFI"," string",[452,601,602],{"class":462}," |",[452,604,605],{"class":598}," undefined",[452,607,608],{"class":462},",\n",[452,610,611,615,617,619,622,624,627,629,631,634,637,639,642],{"class":454,"line":493},[452,612,614],{"class":613},"swJcz","  bridge",[452,616,572],{"class":462},[452,618,463],{"class":462},[452,620,621],{"class":507}," getSession",[452,623,572],{"class":462},[452,625,626],{"class":579}," async",[452,628,576],{"class":575},[452,630,580],{"class":579},[452,632,633],{"class":507}," readSessionActor",[452,635,636],{"class":466},"(ctx",[452,638,499],{"class":462},[452,640,641],{"class":466},"headers) ",[452,643,644],{"class":462},"},\n",[452,646,648,651],{"class":454,"line":647},4,[452,649,650],{"class":462},"}",[452,652,653],{"class":466},"))\n",[409,655,656,657,659,660,663,664,667,668,671],{},"Without ",[413,658,415],{},", ",[413,661,662],{},"audit.context"," stays empty — auditors and incident responders need at least ",[413,665,666],{},"requestId"," and ",[413,669,670],{},"ip"," to triangulate a recorded action.",[426,673,675],{"id":674},"auditonly",[413,676,677],{},"auditOnly()",[679,680,681,685,686,689,690,693,694,697],"tip",{},[682,683,684],"strong",{},"Why filter audits to a separate sink?"," Three reasons: ",[682,687,688],{},"cost"," (audit volume is tiny next to product telemetry — keep them separate so retention costs don't explode), ",[682,691,692],{},"permissions"," (the audit dataset should be read-only for engineers and write-only for the app), and ",[682,695,696],{},"retention"," (audits often live 7+ years; product logs rarely live more than 90 days).",[409,699,700,703,704,707,708,711],{},[413,701,702],{},"auditOnly(drain)"," only forwards events with an ",[413,705,706],{},"audit"," field. Compose with ",[682,709,710],{},"any"," drain:",[442,713,715],{"className":444,"code":714,"language":447,"meta":448,"style":448},"import { auditOnly } from 'evlog'\nimport { createAxiomDrain } from 'evlog\u002Faxiom'\n\n\u002F\u002F Send audits to a dedicated Axiom dataset:\nnitro.hooks.hook('evlog:drain', auditOnly(\n  createAxiomDrain({ dataset: 'audit', token: process.env.AXIOM_AUDIT_TOKEN }),\n))\n",[413,716,717,736,756,760,766,795,844],{"__ignoreMap":448},[452,718,719,721,723,726,728,730,732,734],{"class":454,"line":455},[452,720,459],{"class":458},[452,722,463],{"class":462},[452,724,725],{"class":466}," auditOnly",[452,727,470],{"class":462},[452,729,473],{"class":458},[452,731,476],{"class":462},[452,733,480],{"class":479},[452,735,483],{"class":462},[452,737,738,740,742,745,747,749,751,754],{"class":454,"line":486},[452,739,459],{"class":458},[452,741,463],{"class":462},[452,743,744],{"class":466}," createAxiomDrain",[452,746,470],{"class":462},[452,748,473],{"class":458},[452,750,476],{"class":462},[452,752,753],{"class":479},"evlog\u002Faxiom",[452,755,483],{"class":462},[452,757,758],{"class":454,"line":493},[452,759,490],{"emptyLinePlaceholder":489},[452,761,762],{"class":454,"line":647},[452,763,765],{"class":764},"sHwdD","\u002F\u002F Send audits to a dedicated Axiom dataset:\n",[452,767,769,771,773,775,777,779,781,783,786,788,790,792],{"class":454,"line":768},5,[452,770,496],{"class":466},[452,772,499],{"class":462},[452,774,502],{"class":466},[452,776,499],{"class":462},[452,778,508],{"class":507},[452,780,511],{"class":466},[452,782,514],{"class":462},[452,784,785],{"class":479},"evlog:drain",[452,787,514],{"class":462},[452,789,522],{"class":462},[452,791,725],{"class":507},[452,793,794],{"class":466},"(\n",[452,796,798,801,803,806,809,811,813,815,817,819,822,824,827,829,832,834,837,839,842],{"class":454,"line":797},6,[452,799,800],{"class":507},"  createAxiomDrain",[452,802,511],{"class":466},[452,804,805],{"class":462},"{",[452,807,808],{"class":613}," dataset",[452,810,572],{"class":462},[452,812,476],{"class":462},[452,814,706],{"class":479},[452,816,514],{"class":462},[452,818,522],{"class":462},[452,820,821],{"class":613}," token",[452,823,572],{"class":462},[452,825,826],{"class":466}," process",[452,828,499],{"class":462},[452,830,831],{"class":466},"env",[452,833,499],{"class":462},[452,835,836],{"class":466},"AXIOM_AUDIT_TOKEN ",[452,838,650],{"class":462},[452,840,841],{"class":466},")",[452,843,608],{"class":462},[452,845,847],{"class":454,"line":846},7,[452,848,653],{"class":466},[409,850,851,852,855],{},"Set ",[413,853,854],{},"await: true"," to make audit writes synchronous (no fire-and-forget for audits — crash-safe by default):",[442,857,859],{"className":444,"code":858,"language":447,"meta":448,"style":448},"auditOnly(createFsDrain({ dir: '.audit' }), { await: true })\n",[413,860,861],{"__ignoreMap":448},[452,862,863,865,867,870,872,874,877,879,881,884,886,888,890,892,894,897,899,903,905],{"class":454,"line":455},[452,864,419],{"class":507},[452,866,511],{"class":466},[452,868,869],{"class":507},"createFsDrain",[452,871,511],{"class":466},[452,873,805],{"class":462},[452,875,876],{"class":613}," dir",[452,878,572],{"class":462},[452,880,476],{"class":462},[452,882,883],{"class":479},".audit",[452,885,514],{"class":462},[452,887,470],{"class":462},[452,889,841],{"class":466},[452,891,522],{"class":462},[452,893,463],{"class":462},[452,895,896],{"class":613}," await",[452,898,572],{"class":462},[452,900,902],{"class":901},"sfNiH"," true",[452,904,470],{"class":462},[452,906,907],{"class":466},")\n",[409,909,910,911,913],{},"The ",[413,912,854],{}," flag costs you a small bit of latency per request that records an audit (one synchronous drain call), but guarantees the audit hits disk before the response is sent. For compliance-grade audits, the trade-off is always worth it.",[426,915,916],{"id":423},[413,917,918],{},"signed()",[409,920,921,924],{},[413,922,923],{},"signed(drain, opts)"," adds tamper-evident integrity. Two strategies:",[926,927,928,944],"table",{},[929,930,931],"thead",{},[932,933,934,938,941],"tr",{},[935,936,937],"th",{},"Strategy",[935,939,940],{},"What it adds",[935,942,943],{},"Use case",[945,946,947,964],"tbody",{},[932,948,949,955,961],{},[950,951,952],"td",{},[413,953,954],{},"'hmac'",[950,956,957,960],{},[413,958,959],{},"event.audit.signature"," (HMAC of the canonical event)",[950,962,963],{},"Single-event integrity check (any later mutation fails verification).",[932,965,966,971,979],{},[950,967,968],{},[413,969,970],{},"'hash-chain'",[950,972,973,667,976],{},[413,974,975],{},"event.audit.prevHash",[413,977,978],{},"event.audit.hash",[950,980,981],{},"A verifiable chain — deletions and reordering also become detectable.",[679,983,984,990,991,995,996,998],{},[682,985,986,987,989],{},"What ",[413,988,918],{}," actually buys you."," Detection, not prevention. Anyone with write access to the underlying sink can still nuke the file or table — but the chain proves ",[992,993,994],"em",{},"which"," events were dropped or modified after the fact. Skip ",[413,997,918],{}," if you already write to an append-only \u002F WORM store (S3 Object Lock, Postgres with row-level immutability, BigQuery append-only tables); doubling integrity layers just adds latency without raising the bar.",[1000,1001,1003],"h3",{"id":1002},"hmac","HMAC",[409,1005,1006],{},"Each event gets a signature. Tampering with one row breaks that row's verification, but doesn't break later rows.",[442,1008,1010],{"className":444,"code":1009,"language":447,"meta":448,"style":448},"import { signed } from 'evlog'\n\nsigned(drain, { strategy: 'hmac', secret: process.env.AUDIT_SECRET! })\n",[413,1011,1012,1031,1035],{"__ignoreMap":448},[452,1013,1014,1016,1018,1021,1023,1025,1027,1029],{"class":454,"line":455},[452,1015,459],{"class":458},[452,1017,463],{"class":462},[452,1019,1020],{"class":466}," signed",[452,1022,470],{"class":462},[452,1024,473],{"class":458},[452,1026,476],{"class":462},[452,1028,480],{"class":479},[452,1030,483],{"class":462},[452,1032,1033],{"class":454,"line":486},[452,1034,490],{"emptyLinePlaceholder":489},[452,1036,1037,1039,1042,1044,1046,1049,1051,1053,1055,1057,1059,1062,1064,1066,1068,1070,1072,1075,1078,1080],{"class":454,"line":493},[452,1038,423],{"class":507},[452,1040,1041],{"class":466},"(drain",[452,1043,522],{"class":462},[452,1045,463],{"class":462},[452,1047,1048],{"class":613}," strategy",[452,1050,572],{"class":462},[452,1052,476],{"class":462},[452,1054,1002],{"class":479},[452,1056,514],{"class":462},[452,1058,522],{"class":462},[452,1060,1061],{"class":613}," secret",[452,1063,572],{"class":462},[452,1065,826],{"class":466},[452,1067,499],{"class":462},[452,1069,831],{"class":466},[452,1071,499],{"class":462},[452,1073,1074],{"class":466},"AUDIT_SECRET",[452,1076,1077],{"class":462},"!",[452,1079,470],{"class":462},[452,1081,907],{"class":466},[1000,1083,1085],{"id":1084},"hash-chain","Hash-chain",[409,1087,1088],{},"Each event references the previous event's hash. Deleting any row breaks the chain forward of that point, so the verifier can pinpoint the exact row that was tampered with.",[442,1090,1092],{"className":444,"code":1091,"language":447,"meta":448,"style":448},"signed(drain, {\n  strategy: 'hash-chain',\n  state: {\n    load: () => fs.readFile('.audit\u002Fhead', 'utf8').catch(() => null),\n    save: (h) => fs.writeFile('.audit\u002Fhead', h),\n  },\n})\n",[413,1093,1094,1105,1120,1129,1188,1227,1232],{"__ignoreMap":448},[452,1095,1096,1098,1100,1102],{"class":454,"line":455},[452,1097,423],{"class":507},[452,1099,1041],{"class":466},[452,1101,522],{"class":462},[452,1103,1104],{"class":462}," {\n",[452,1106,1107,1110,1112,1114,1116,1118],{"class":454,"line":486},[452,1108,1109],{"class":613},"  strategy",[452,1111,572],{"class":462},[452,1113,476],{"class":462},[452,1115,1084],{"class":479},[452,1117,514],{"class":462},[452,1119,608],{"class":462},[452,1121,1122,1125,1127],{"class":454,"line":493},[452,1123,1124],{"class":613},"  state",[452,1126,572],{"class":462},[452,1128,1104],{"class":462},[452,1130,1131,1134,1136,1139,1141,1144,1146,1149,1151,1153,1156,1158,1160,1162,1165,1167,1169,1171,1174,1176,1179,1181,1184,1186],{"class":454,"line":647},[452,1132,1133],{"class":507},"    load",[452,1135,572],{"class":462},[452,1137,1138],{"class":462}," ()",[452,1140,580],{"class":579},[452,1142,1143],{"class":466}," fs",[452,1145,499],{"class":462},[452,1147,1148],{"class":507},"readFile",[452,1150,511],{"class":466},[452,1152,514],{"class":462},[452,1154,1155],{"class":479},".audit\u002Fhead",[452,1157,514],{"class":462},[452,1159,522],{"class":462},[452,1161,476],{"class":462},[452,1163,1164],{"class":479},"utf8",[452,1166,514],{"class":462},[452,1168,841],{"class":466},[452,1170,499],{"class":462},[452,1172,1173],{"class":507},"catch",[452,1175,511],{"class":466},[452,1177,1178],{"class":462},"()",[452,1180,580],{"class":579},[452,1182,1183],{"class":462}," null",[452,1185,841],{"class":466},[452,1187,608],{"class":462},[452,1189,1190,1193,1195,1198,1201,1203,1205,1207,1209,1212,1214,1216,1218,1220,1222,1225],{"class":454,"line":768},[452,1191,1192],{"class":507},"    save",[452,1194,572],{"class":462},[452,1196,1197],{"class":462}," (",[452,1199,1200],{"class":575},"h",[452,1202,841],{"class":462},[452,1204,580],{"class":579},[452,1206,1143],{"class":466},[452,1208,499],{"class":462},[452,1210,1211],{"class":507},"writeFile",[452,1213,511],{"class":466},[452,1215,514],{"class":462},[452,1217,1155],{"class":479},[452,1219,514],{"class":462},[452,1221,522],{"class":462},[452,1223,1224],{"class":466}," h)",[452,1226,608],{"class":462},[452,1228,1229],{"class":454,"line":797},[452,1230,1231],{"class":462},"  },\n",[452,1233,1234,1236],{"class":454,"line":846},[452,1235,650],{"class":462},[452,1237,907],{"class":466},[409,1239,910,1240,1243],{},[413,1241,1242],{},"state"," config is required for cross-process or durable chains: load the previous head hash from your own store (Redis, Postgres, file) before each event, save the new head after.",[1245,1246],"hash-chain-tamper",{},[1248,1249,1250,1251,1254,1255,1258,1259,499],"note",{},"A CLI to walk and verify the chain (",[413,1252,1253],{},"evlog audit verify",") is on the roadmap. Until then, validate by recomputing the hashes of stored events and comparing each ",[413,1256,1257],{},"prevHash"," against the previous event's ",[413,1260,1261],{},"hash",[1263,1264,1265],"style",{},"html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sHdIc, html code.shiki .sHdIc{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#EEFFFF;--shiki-default-font-style:italic;--shiki-dark:#BABED8;--shiki-dark-font-style:italic}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sfNiH, html code.shiki .sfNiH{--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC}",{"title":448,"searchDepth":486,"depth":486,"links":1267},[1268,1269,1270],{"id":428,"depth":486,"text":431},{"id":674,"depth":486,"text":677},{"id":423,"depth":486,"text":918,"children":1271},[1272,1273],{"id":1002,"depth":493,"text":1003},{"id":1084,"depth":493,"text":1085},"auditEnricher to auto-fill request context, auditOnly to route audits to a dedicated sink, and signed for tamper-evident HMAC or hash-chain integrity.","md",[1277,1280],{"label":142,"icon":145,"to":143,"color":1278,"variant":1279},"neutral","subtle",{"label":152,"icon":129,"to":153,"color":1278,"variant":1279},{},{"title":147,"icon":150},{"title":404,"description":1274},"_3JRqd31dDWZXAN9m-j4Ikhyg3JwAr_LT4cmpgR6ppw",[1286,1288],{"title":142,"path":143,"stem":144,"description":1287,"icon":145,"children":-1},"log.audit, log.audit.deny, standalone audit(), withAudit auto-instrumentation, defineAuditAction and defineAuditCatalog registries, and auditDiff change patches.",{"title":152,"path":153,"stem":154,"description":1289,"icon":129,"children":-1},"Integrity, redact presets, GDPR vs append-only, retention windows, and the most common pitfalls when shipping audit logs to production.",1778325969550]