[{"data":1,"prerenderedAt":1331},["ShallowReactive",2],{"navigation_docs":3,"-use-cases-audit-pipeline":443,"-use-cases-audit-pipeline-surround":1326},[4,30,80,249,357,412],{"title":5,"path":6,"stem":7,"children":8,"page":29},"Start","\u002Fstart","1.start",[9,14,19,24],{"title":10,"path":11,"stem":12,"icon":13},"Introduction","\u002Fstart\u002Fintroduction","1.start\u002F1.introduction","i-lucide-info",{"title":15,"path":16,"stem":17,"icon":18},"Why start with evlog","\u002Fstart\u002Fwhy-evlog","1.start\u002F2.why-evlog","i-lucide-rocket",{"title":20,"path":21,"stem":22,"icon":23},"Installation","\u002Fstart\u002Finstallation","1.start\u002F3.installation","i-lucide-download",{"title":25,"path":26,"stem":27,"icon":28},"Quick Start","\u002Fstart\u002Fquick-start","1.start\u002F4.quick-start","i-lucide-zap",false,{"title":31,"path":32,"stem":33,"children":34,"page":29},"Learn","\u002Flearn","2.learn",[35,40,45,50,55,60,65,70,75],{"title":36,"path":37,"stem":38,"icon":39},"Overview","\u002Flearn\u002Foverview","2.learn\u002F0.overview","i-lucide-list",{"title":41,"path":42,"stem":43,"icon":44},"Simple Logging","\u002Flearn\u002Fsimple-logging","2.learn\u002F1.simple-logging","i-lucide-terminal",{"title":46,"path":47,"stem":48,"icon":49},"Wide Events","\u002Flearn\u002Fwide-events","2.learn\u002F2.wide-events","i-lucide-layers",{"title":51,"path":52,"stem":53,"icon":54},"Structured Errors","\u002Flearn\u002Fstructured-errors","2.learn\u002F3.structured-errors","i-lucide-shield-alert",{"title":56,"path":57,"stem":58,"icon":59},"Lifecycle","\u002Flearn\u002Flifecycle","2.learn\u002F4.lifecycle","i-lucide-arrow-right-left",{"title":61,"path":62,"stem":63,"icon":64},"Sampling","\u002Flearn\u002Fsampling","2.learn\u002F5.sampling","i-lucide-filter",{"title":66,"path":67,"stem":68,"icon":69},"Auto-Redaction","\u002Flearn\u002Fredaction","2.learn\u002F6.redaction","i-lucide-eye-off",{"title":71,"path":72,"stem":73,"icon":74},"Typed Fields","\u002Flearn\u002Ftyped-fields","2.learn\u002F7.typed-fields","i-simple-icons-typescript",{"title":76,"path":77,"stem":78,"icon":79},"Catalogs","\u002Flearn\u002Fcatalogs","2.learn\u002F8.catalogs","i-lucide-book-open",{"title":81,"path":82,"stem":83,"children":84,"page":29},"Integrate","\u002Fintegrate","3.integrate",[85,89,157],{"title":36,"path":86,"stem":87,"icon":88},"\u002Fintegrate\u002Foverview","3.integrate\u002F0.overview","i-lucide-plug",{"title":90,"path":91,"stem":92,"children":93,"page":29},"Adapters","\u002Fintegrate\u002Fadapters","3.integrate\u002Fadapters",[94,97,137],{"title":36,"path":95,"stem":96,"icon":39},"\u002Fintegrate\u002Fadapters\u002Foverview","3.integrate\u002Fadapters\u002F01.overview",{"title":98,"path":99,"stem":100,"children":101,"page":29},"Cloud","\u002Fintegrate\u002Fadapters\u002Fcloud","3.integrate\u002Fadapters\u002Fcloud",[102,107,112,117,122,127,132],{"title":103,"path":104,"stem":105,"icon":106},"Axiom","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Faxiom","3.integrate\u002Fadapters\u002Fcloud\u002F01.axiom","i-custom-axiom",{"title":108,"path":109,"stem":110,"icon":111},"OTLP","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fotlp","3.integrate\u002Fadapters\u002Fcloud\u002F02.otlp","i-simple-icons-opentelemetry",{"title":113,"path":114,"stem":115,"icon":116},"PostHog","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fposthog","3.integrate\u002Fadapters\u002Fcloud\u002F03.posthog","i-simple-icons-posthog",{"title":118,"path":119,"stem":120,"icon":121},"Sentry","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fsentry","3.integrate\u002Fadapters\u002Fcloud\u002F04.sentry","i-simple-icons-sentry",{"title":123,"path":124,"stem":125,"icon":126},"Better Stack","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fbetter-stack","3.integrate\u002Fadapters\u002Fcloud\u002F05.better-stack","i-simple-icons-betterstack",{"title":128,"path":129,"stem":130,"icon":131},"Datadog","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fdatadog","3.integrate\u002Fadapters\u002Fcloud\u002F06.datadog","i-simple-icons-datadog",{"title":133,"path":134,"stem":135,"icon":136},"HyperDX","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fhyperdx","3.integrate\u002Fadapters\u002Fcloud\u002F07.hyperdx","i-custom-hyperdx",{"title":138,"path":139,"stem":140,"children":141,"page":29},"Self-Hosted","\u002Fintegrate\u002Fadapters\u002Fself-hosted","3.integrate\u002Fadapters\u002Fself-hosted",[142,147,152],{"title":143,"path":144,"stem":145,"icon":146},"File System","\u002Fintegrate\u002Fadapters\u002Fself-hosted\u002Ffs","3.integrate\u002Fadapters\u002Fself-hosted\u002F01.fs","i-lucide-hard-drive",{"title":148,"path":149,"stem":150,"icon":151},"NuxtHub","\u002Fintegrate\u002Fadapters\u002Fself-hosted\u002Fnuxthub","3.integrate\u002Fadapters\u002Fself-hosted\u002F02.nuxthub","i-simple-icons-nuxt",{"title":153,"path":154,"stem":155,"icon":156},"Memory","\u002Fintegrate\u002Fadapters\u002Fself-hosted\u002Fmemory","3.integrate\u002Fadapters\u002Fself-hosted\u002F03.memory","i-lucide-cpu",{"title":158,"path":159,"stem":160,"children":161,"page":29},"Frameworks","\u002Fintegrate\u002Fframeworks","3.integrate\u002Fframeworks",[162,166,171,176,181,186,191,196,201,206,211,216,221,226,230,235,240,245],{"title":36,"path":163,"stem":164,"icon":165},"\u002Fintegrate\u002Fframeworks\u002Foverview","3.integrate\u002Fframeworks\u002F00.overview","i-lucide-layout-grid",{"title":167,"path":168,"stem":169,"icon":170},"Nuxt","\u002Fintegrate\u002Fframeworks\u002Fnuxt","3.integrate\u002Fframeworks\u002F01.nuxt","i-simple-icons-nuxtdotjs",{"title":172,"path":173,"stem":174,"icon":175},"Next.js","\u002Fintegrate\u002Fframeworks\u002Fnextjs","3.integrate\u002Fframeworks\u002F02.nextjs","i-simple-icons-nextdotjs",{"title":177,"path":178,"stem":179,"icon":180},"SvelteKit","\u002Fintegrate\u002Fframeworks\u002Fsveltekit","3.integrate\u002Fframeworks\u002F03.sveltekit","i-simple-icons-svelte",{"title":182,"path":183,"stem":184,"icon":185},"Nitro","\u002Fintegrate\u002Fframeworks\u002Fnitro","3.integrate\u002Fframeworks\u002F04.nitro","i-custom-nitro",{"title":187,"path":188,"stem":189,"icon":190},"TanStack Start","\u002Fintegrate\u002Fframeworks\u002Ftanstack-start","3.integrate\u002Fframeworks\u002F05.tanstack-start","i-custom-tanstack",{"title":192,"path":193,"stem":194,"icon":195},"NestJS","\u002Fintegrate\u002Fframeworks\u002Fnestjs","3.integrate\u002Fframeworks\u002F06.nestjs","i-simple-icons-nestjs",{"title":197,"path":198,"stem":199,"icon":200},"Express","\u002Fintegrate\u002Fframeworks\u002Fexpress","3.integrate\u002Fframeworks\u002F07.express","i-simple-icons-express",{"title":202,"path":203,"stem":204,"icon":205},"Hono","\u002Fintegrate\u002Fframeworks\u002Fhono","3.integrate\u002Fframeworks\u002F08.hono","i-simple-icons-hono",{"title":207,"path":208,"stem":209,"icon":210},"Fastify","\u002Fintegrate\u002Fframeworks\u002Ffastify","3.integrate\u002Fframeworks\u002F09.fastify","i-simple-icons-fastify",{"title":212,"path":213,"stem":214,"icon":215},"Elysia","\u002Fintegrate\u002Fframeworks\u002Felysia","3.integrate\u002Fframeworks\u002F10.elysia","i-custom-elysia",{"title":217,"path":218,"stem":219,"icon":220},"React Router","\u002Fintegrate\u002Fframeworks\u002Freact-router","3.integrate\u002Fframeworks\u002F11.react-router","i-custom-reactrouter",{"title":222,"path":223,"stem":224,"icon":225},"Cloudflare Workers","\u002Fintegrate\u002Fframeworks\u002Fcloudflare-workers","3.integrate\u002Fframeworks\u002F12.cloudflare-workers","i-simple-icons-cloudflare",{"title":227,"path":228,"stem":229,"icon":74},"Standalone","\u002Fintegrate\u002Fframeworks\u002Fstandalone","3.integrate\u002Fframeworks\u002F13.standalone",{"title":231,"path":232,"stem":233,"icon":234},"Astro","\u002Fintegrate\u002Fframeworks\u002Fastro","3.integrate\u002Fframeworks\u002F14.astro","i-simple-icons-astro",{"title":236,"path":237,"stem":238,"icon":239},"oRPC","\u002Fintegrate\u002Fframeworks\u002Forpc","3.integrate\u002Fframeworks\u002F15.orpc","i-lucide-network",{"title":241,"path":242,"stem":243,"icon":244},"AWS Lambda","\u002Fintegrate\u002Fframeworks\u002Faws-lambda","3.integrate\u002Fframeworks\u002F16.aws-lambda","i-custom-lambda",{"title":246,"path":247,"stem":248,"icon":44},"CLI","\u002Fintegrate\u002Fframeworks\u002Fcli","3.integrate\u002Fframeworks\u002F17.cli",{"title":250,"path":251,"stem":252,"children":253,"page":29},"Use Cases","\u002Fuse-cases","4.use-cases",[254,258,263,292,320,352],{"title":36,"path":255,"stem":256,"icon":257},"\u002Fuse-cases\u002Foverview","4.use-cases\u002F0.overview","i-lucide-list-checks",{"title":259,"path":260,"stem":261,"icon":262},"Client Logging","\u002Fuse-cases\u002Fclient-logging","4.use-cases\u002F1.client-logging","i-lucide-monitor",{"title":264,"icon":265,"path":266,"stem":267,"children":268,"page":29},"AI SDK","i-simple-icons-vercel","\u002Fuse-cases\u002Fai-sdk","4.use-cases\u002F2.ai-sdk",[269,272,277,282,287],{"title":36,"path":270,"stem":271,"icon":39},"\u002Fuse-cases\u002Fai-sdk\u002Foverview","4.use-cases\u002F2.ai-sdk\u002F01.overview",{"title":273,"path":274,"stem":275,"icon":276},"Usage","\u002Fuse-cases\u002Fai-sdk\u002Fusage","4.use-cases\u002F2.ai-sdk\u002F02.usage","i-lucide-code",{"title":278,"path":279,"stem":280,"icon":281},"Options","\u002Fuse-cases\u002Fai-sdk\u002Foptions","4.use-cases\u002F2.ai-sdk\u002F03.options","i-lucide-sliders",{"title":283,"path":284,"stem":285,"icon":286},"Metadata","\u002Fuse-cases\u002Fai-sdk\u002Fmetadata","4.use-cases\u002F2.ai-sdk\u002F04.metadata","i-lucide-database",{"title":288,"path":289,"stem":290,"icon":291},"Telemetry","\u002Fuse-cases\u002Fai-sdk\u002Ftelemetry","4.use-cases\u002F2.ai-sdk\u002F05.telemetry","i-lucide-activity",{"title":293,"icon":294,"path":295,"stem":296,"children":297,"page":29},"Better Auth","i-simple-icons-betterauth","\u002Fuse-cases\u002Fbetter-auth","4.use-cases\u002F3.better-auth",[298,301,306,311,315],{"title":36,"path":299,"stem":300,"icon":39},"\u002Fuse-cases\u002Fbetter-auth\u002Foverview","4.use-cases\u002F3.better-auth\u002F01.overview",{"title":302,"path":303,"stem":304,"icon":305},"Identify User","\u002Fuse-cases\u002Fbetter-auth\u002Fidentify-user","4.use-cases\u002F3.better-auth\u002F02.identify-user","i-lucide-user-check",{"title":307,"path":308,"stem":309,"icon":310},"Middleware","\u002Fuse-cases\u002Fbetter-auth\u002Fmiddleware","4.use-cases\u002F3.better-auth\u002F03.middleware","i-lucide-shield",{"title":312,"path":313,"stem":314,"icon":262},"Client Sync","\u002Fuse-cases\u002Fbetter-auth\u002Fclient-sync","4.use-cases\u002F3.better-auth\u002F04.client-sync",{"title":316,"path":317,"stem":318,"icon":319},"Performance","\u002Fuse-cases\u002Fbetter-auth\u002Fperformance","4.use-cases\u002F3.better-auth\u002F05.performance","i-lucide-gauge",{"title":321,"icon":322,"path":323,"stem":324,"children":325,"page":29},"Audit Logs","i-lucide-shield-check","\u002Fuse-cases\u002Faudit","4.use-cases\u002F4.audit",[326,329,334,339,344,348],{"title":36,"path":327,"stem":328,"icon":39},"\u002Fuse-cases\u002Faudit\u002Foverview","4.use-cases\u002F4.audit\u002F01.overview",{"title":330,"path":331,"stem":332,"icon":333},"Schema","\u002Fuse-cases\u002Faudit\u002Fschema","4.use-cases\u002F4.audit\u002F02.schema","i-lucide-file-text",{"title":335,"path":336,"stem":337,"icon":338},"Recording","\u002Fuse-cases\u002Faudit\u002Frecording","4.use-cases\u002F4.audit\u002F03.recording","i-lucide-pen-line",{"title":340,"path":341,"stem":342,"icon":343},"Drains","\u002Fuse-cases\u002Faudit\u002Fpipeline","4.use-cases\u002F4.audit\u002F04.pipeline","i-lucide-link",{"title":345,"path":346,"stem":347,"icon":322},"Compliance","\u002Fuse-cases\u002Faudit\u002Fcompliance","4.use-cases\u002F4.audit\u002F05.compliance",{"title":349,"path":350,"stem":351,"icon":79},"Recipes","\u002Fuse-cases\u002Faudit\u002Frecipes","4.use-cases\u002F4.audit\u002F06.recipes",{"title":353,"path":354,"stem":355,"icon":356},"Enrichers","\u002Fuse-cases\u002Fenrichers","4.use-cases\u002F5.enrichers","i-lucide-sparkles",{"title":358,"path":359,"stem":360,"children":361,"page":29},"Extend","\u002Fextend","5.extend",[362,366,371,376,381,385,389,393,397,402,407],{"title":36,"path":363,"stem":364,"icon":365},"\u002Fextend\u002Foverview","5.extend\u002F0.overview","i-lucide-blocks",{"title":367,"path":368,"stem":369,"icon":370},"Stream","\u002Fextend\u002Fstream","5.extend\u002F1.stream","i-lucide-radio-tower",{"title":372,"path":373,"stem":374,"icon":375},"Custom framework","\u002Fextend\u002Fcustom-framework","5.extend\u002F10.custom-framework","i-lucide-puzzle",{"title":377,"path":378,"stem":379,"icon":380},"FS reader","\u002Fextend\u002Ffs-reader","5.extend\u002F2.fs-reader","i-lucide-folder-search",{"title":349,"path":382,"stem":383,"icon":384},"\u002Fextend\u002Fconsumer-recipes","5.extend\u002F3.consumer-recipes","i-lucide-chef-hat",{"title":386,"path":387,"stem":388,"icon":365},"Plugins","\u002Fextend\u002Fplugins","5.extend\u002F4.plugins",{"title":390,"path":391,"stem":392,"icon":356},"Custom enrichers","\u002Fextend\u002Fcustom-enrichers","5.extend\u002F5.custom-enrichers",{"title":394,"path":395,"stem":396,"icon":64},"Tail sampling","\u002Fextend\u002Ftail-sampling","5.extend\u002F6.tail-sampling",{"title":398,"path":399,"stem":400,"icon":401},"Identity headers","\u002Fextend\u002Fidentity-headers","5.extend\u002F7.identity-headers","i-lucide-fingerprint",{"title":403,"path":404,"stem":405,"icon":406},"Custom drains","\u002Fextend\u002Fcustom-drains","5.extend\u002F8.custom-drains","i-lucide-share-2",{"title":408,"path":409,"stem":410,"icon":411},"Drain pipeline","\u002Fextend\u002Fdrain-pipeline","5.extend\u002F9.drain-pipeline","i-lucide-workflow",{"title":413,"path":414,"stem":415,"children":416,"page":29},"Reference","\u002Freference","6.reference",[417,422,425,430,434,439],{"title":418,"path":419,"stem":420,"icon":421},"Configuration","\u002Freference\u002Fconfiguration","6.reference\u002F1.configuration","i-lucide-settings",{"title":316,"path":423,"stem":424,"icon":319},"\u002Freference\u002Fperformance","6.reference\u002F2.performance",{"title":426,"path":427,"stem":428,"icon":429},"Vite Plugin","\u002Freference\u002Fvite-plugin","6.reference\u002F3.vite-plugin","i-custom-vite",{"title":431,"path":432,"stem":433,"icon":322},"Best Practices","\u002Freference\u002Fbest-practices","6.reference\u002F4.best-practices",{"title":435,"path":436,"stem":437,"icon":438},"vs Other Loggers","\u002Freference\u002Fvs-other-loggers","6.reference\u002F5.vs-other-loggers","i-lucide-scale",{"title":440,"path":441,"stem":442,"icon":356},"Agent Skills","\u002Freference\u002Fagent-skills","6.reference\u002F6.agent-skills",{"id":444,"title":445,"body":446,"description":1315,"extension":1316,"links":1317,"meta":1322,"navigation":1323,"path":341,"seo":1324,"stem":342,"__hash__":1325},"docs\u002F4.use-cases\u002F4.audit\u002F04.pipeline.md","Drains & Integrity",{"type":447,"value":448,"toc":1307},"minimark",[449,466,473,482,569,572,695,713,719,739,753,890,897,949,955,960,966,1023,1040,1045,1048,1123,1127,1130,1279,1285,1288,1303],[450,451,452,453,457,458,461,462,465],"p",{},"Three building blocks: ",[454,455,456],"code",{},"auditEnricher"," fills context, ",[454,459,460],{},"auditOnly"," routes audits to a dedicated drain, and ",[454,463,464],{},"signed"," adds tamper-evident integrity. Each is opt-in and replaceable.",[467,468,470],"h2",{"id":469},"auditenricher",[454,471,472],{},"auditEnricher()",[450,474,475,477,478,481],{},[454,476,472],{}," populates ",[454,479,480],{},"event.audit.context.{requestId, traceId, ip, userAgent, tenantId}",". Skip it and ship a custom enricher if your strategy differs.",[483,484,490],"pre",{"className":485,"code":486,"filename":487,"language":488,"meta":489,"style":489},"language-typescript shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","import { auditEnricher } from 'evlog'\n\nnitro.hooks.hook('evlog:enrich', auditEnricher())\n","server\u002Fplugins\u002Fevlog.ts","typescript","",[454,491,492,525,532],{"__ignoreMap":489},[493,494,497,501,505,509,512,515,518,522],"span",{"class":495,"line":496},"line",1,[493,498,500],{"class":499},"s7zQu","import",[493,502,504],{"class":503},"sMK4o"," {",[493,506,508],{"class":507},"sTEyZ"," auditEnricher",[493,510,511],{"class":503}," }",[493,513,514],{"class":499}," from",[493,516,517],{"class":503}," '",[493,519,521],{"class":520},"sfazB","evlog",[493,523,524],{"class":503},"'\n",[493,526,528],{"class":495,"line":527},2,[493,529,531],{"emptyLinePlaceholder":530},true,"\n",[493,533,535,538,541,544,546,550,553,556,559,561,564,566],{"class":495,"line":534},3,[493,536,537],{"class":507},"nitro",[493,539,540],{"class":503},".",[493,542,543],{"class":507},"hooks",[493,545,540],{"class":503},[493,547,549],{"class":548},"s2Zo4","hook",[493,551,552],{"class":507},"(",[493,554,555],{"class":503},"'",[493,557,558],{"class":520},"evlog:enrich",[493,560,555],{"class":503},[493,562,563],{"class":503},",",[493,565,508],{"class":548},[493,567,568],{"class":507},"())\n",[450,570,571],{},"For multi-tenant apps and custom session bridges, pass options:",[483,573,575],{"className":485,"code":574,"language":488,"meta":489,"style":489},"nitro.hooks.hook('evlog:enrich', auditEnricher({\n  tenantId: ctx => ctx.event.tenant as string | undefined,\n  bridge: { getSession: async ctx => readSessionActor(ctx.headers) },\n}))\n",[454,576,577,606,650,686],{"__ignoreMap":489},[493,578,579,581,583,585,587,589,591,593,595,597,599,601,603],{"class":495,"line":496},[493,580,537],{"class":507},[493,582,540],{"class":503},[493,584,543],{"class":507},[493,586,540],{"class":503},[493,588,549],{"class":548},[493,590,552],{"class":507},[493,592,555],{"class":503},[493,594,558],{"class":520},[493,596,555],{"class":503},[493,598,563],{"class":503},[493,600,508],{"class":548},[493,602,552],{"class":507},[493,604,605],{"class":503},"{\n",[493,607,608,611,614,618,622,624,626,629,631,634,637,641,644,647],{"class":495,"line":527},[493,609,610],{"class":548},"  tenantId",[493,612,613],{"class":503},":",[493,615,617],{"class":616},"sHdIc"," ctx",[493,619,621],{"class":620},"spNyl"," =>",[493,623,617],{"class":507},[493,625,540],{"class":503},[493,627,628],{"class":507},"event",[493,630,540],{"class":503},[493,632,633],{"class":507},"tenant ",[493,635,636],{"class":499},"as",[493,638,640],{"class":639},"sBMFI"," string",[493,642,643],{"class":503}," |",[493,645,646],{"class":639}," undefined",[493,648,649],{"class":503},",\n",[493,651,652,656,658,660,663,665,668,670,672,675,678,680,683],{"class":495,"line":534},[493,653,655],{"class":654},"swJcz","  bridge",[493,657,613],{"class":503},[493,659,504],{"class":503},[493,661,662],{"class":548}," getSession",[493,664,613],{"class":503},[493,666,667],{"class":620}," async",[493,669,617],{"class":616},[493,671,621],{"class":620},[493,673,674],{"class":548}," readSessionActor",[493,676,677],{"class":507},"(ctx",[493,679,540],{"class":503},[493,681,682],{"class":507},"headers) ",[493,684,685],{"class":503},"},\n",[493,687,689,692],{"class":495,"line":688},4,[493,690,691],{"class":503},"}",[493,693,694],{"class":507},"))\n",[450,696,697,698,700,701,704,705,708,709,712],{},"Without ",[454,699,456],{},", ",[454,702,703],{},"audit.context"," stays empty — auditors and incident responders need at least ",[454,706,707],{},"requestId"," and ",[454,710,711],{},"ip"," to triangulate a recorded action.",[467,714,716],{"id":715},"auditonly",[454,717,718],{},"auditOnly()",[720,721,722,726,727,730,731,734,735,738],"tip",{},[723,724,725],"strong",{},"Why filter audits to a separate sink?"," Three reasons: ",[723,728,729],{},"cost"," (audit volume is tiny next to product telemetry — keep them separate so retention costs don't explode), ",[723,732,733],{},"permissions"," (the audit dataset should be read-only for engineers and write-only for the app), and ",[723,736,737],{},"retention"," (audits often live 7+ years; product logs rarely live more than 90 days).",[450,740,741,744,745,748,749,752],{},[454,742,743],{},"auditOnly(drain)"," only forwards events with an ",[454,746,747],{},"audit"," field. Compose with ",[723,750,751],{},"any"," drain:",[483,754,756],{"className":485,"code":755,"language":488,"meta":489,"style":489},"import { auditOnly } from 'evlog'\nimport { createAxiomDrain } from 'evlog\u002Faxiom'\n\n\u002F\u002F Send audits to a dedicated Axiom dataset:\nnitro.hooks.hook('evlog:drain', auditOnly(\n  createAxiomDrain({ dataset: 'audit', apiKey: process.env.AXIOM_AUDIT_API_KEY }),\n))\n",[454,757,758,777,797,801,807,836,885],{"__ignoreMap":489},[493,759,760,762,764,767,769,771,773,775],{"class":495,"line":496},[493,761,500],{"class":499},[493,763,504],{"class":503},[493,765,766],{"class":507}," auditOnly",[493,768,511],{"class":503},[493,770,514],{"class":499},[493,772,517],{"class":503},[493,774,521],{"class":520},[493,776,524],{"class":503},[493,778,779,781,783,786,788,790,792,795],{"class":495,"line":527},[493,780,500],{"class":499},[493,782,504],{"class":503},[493,784,785],{"class":507}," createAxiomDrain",[493,787,511],{"class":503},[493,789,514],{"class":499},[493,791,517],{"class":503},[493,793,794],{"class":520},"evlog\u002Faxiom",[493,796,524],{"class":503},[493,798,799],{"class":495,"line":534},[493,800,531],{"emptyLinePlaceholder":530},[493,802,803],{"class":495,"line":688},[493,804,806],{"class":805},"sHwdD","\u002F\u002F Send audits to a dedicated Axiom dataset:\n",[493,808,810,812,814,816,818,820,822,824,827,829,831,833],{"class":495,"line":809},5,[493,811,537],{"class":507},[493,813,540],{"class":503},[493,815,543],{"class":507},[493,817,540],{"class":503},[493,819,549],{"class":548},[493,821,552],{"class":507},[493,823,555],{"class":503},[493,825,826],{"class":520},"evlog:drain",[493,828,555],{"class":503},[493,830,563],{"class":503},[493,832,766],{"class":548},[493,834,835],{"class":507},"(\n",[493,837,839,842,844,847,850,852,854,856,858,860,863,865,868,870,873,875,878,880,883],{"class":495,"line":838},6,[493,840,841],{"class":548},"  createAxiomDrain",[493,843,552],{"class":507},[493,845,846],{"class":503},"{",[493,848,849],{"class":654}," dataset",[493,851,613],{"class":503},[493,853,517],{"class":503},[493,855,747],{"class":520},[493,857,555],{"class":503},[493,859,563],{"class":503},[493,861,862],{"class":654}," apiKey",[493,864,613],{"class":503},[493,866,867],{"class":507}," process",[493,869,540],{"class":503},[493,871,872],{"class":507},"env",[493,874,540],{"class":503},[493,876,877],{"class":507},"AXIOM_AUDIT_API_KEY ",[493,879,691],{"class":503},[493,881,882],{"class":507},")",[493,884,649],{"class":503},[493,886,888],{"class":495,"line":887},7,[493,889,694],{"class":507},[450,891,892,893,896],{},"Set ",[454,894,895],{},"await: true"," to make audit writes synchronous (no fire-and-forget for audits — crash-safe by default):",[483,898,900],{"className":485,"code":899,"language":488,"meta":489,"style":489},"auditOnly(createFsDrain({ dir: '.audit' }), { await: true })\n",[454,901,902],{"__ignoreMap":489},[493,903,904,906,908,911,913,915,918,920,922,925,927,929,931,933,935,938,940,944,946],{"class":495,"line":496},[493,905,460],{"class":548},[493,907,552],{"class":507},[493,909,910],{"class":548},"createFsDrain",[493,912,552],{"class":507},[493,914,846],{"class":503},[493,916,917],{"class":654}," dir",[493,919,613],{"class":503},[493,921,517],{"class":503},[493,923,924],{"class":520},".audit",[493,926,555],{"class":503},[493,928,511],{"class":503},[493,930,882],{"class":507},[493,932,563],{"class":503},[493,934,504],{"class":503},[493,936,937],{"class":654}," await",[493,939,613],{"class":503},[493,941,943],{"class":942},"sfNiH"," true",[493,945,511],{"class":503},[493,947,948],{"class":507},")\n",[450,950,951,952,954],{},"The ",[454,953,895],{}," flag costs you a small bit of latency per request that records an audit (one synchronous drain call), but guarantees the audit hits disk before the response is sent. For compliance-grade audits, the trade-off is always worth it.",[467,956,957],{"id":464},[454,958,959],{},"signed()",[450,961,962,965],{},[454,963,964],{},"signed(drain, opts)"," adds tamper-evident integrity. Two strategies:",[967,968,969,985],"table",{},[970,971,972],"thead",{},[973,974,975,979,982],"tr",{},[976,977,978],"th",{},"Strategy",[976,980,981],{},"What it adds",[976,983,984],{},"Use case",[986,987,988,1005],"tbody",{},[973,989,990,996,1002],{},[991,992,993],"td",{},[454,994,995],{},"'hmac'",[991,997,998,1001],{},[454,999,1000],{},"event.audit.signature"," (HMAC of the canonical event)",[991,1003,1004],{},"Single-event integrity check (any later mutation fails verification).",[973,1006,1007,1012,1020],{},[991,1008,1009],{},[454,1010,1011],{},"'hash-chain'",[991,1013,1014,708,1017],{},[454,1015,1016],{},"event.audit.prevHash",[454,1018,1019],{},"event.audit.hash",[991,1021,1022],{},"A verifiable chain — deletions and reordering also become detectable.",[720,1024,1025,1031,1032,1036,1037,1039],{},[723,1026,1027,1028,1030],{},"What ",[454,1029,959],{}," actually buys you."," Detection, not prevention. Anyone with write access to the underlying sink can still nuke the file or table — but the chain proves ",[1033,1034,1035],"em",{},"which"," events were dropped or modified after the fact. Skip ",[454,1038,959],{}," if you already write to an append-only \u002F WORM store (S3 Object Lock, Postgres with row-level immutability, BigQuery append-only tables); doubling integrity layers just adds latency without raising the bar.",[1041,1042,1044],"h3",{"id":1043},"hmac","HMAC",[450,1046,1047],{},"Each event gets a signature. Tampering with one row breaks that row's verification, but doesn't break later rows.",[483,1049,1051],{"className":485,"code":1050,"language":488,"meta":489,"style":489},"import { signed } from 'evlog'\n\nsigned(drain, { strategy: 'hmac', secret: process.env.AUDIT_SECRET! })\n",[454,1052,1053,1072,1076],{"__ignoreMap":489},[493,1054,1055,1057,1059,1062,1064,1066,1068,1070],{"class":495,"line":496},[493,1056,500],{"class":499},[493,1058,504],{"class":503},[493,1060,1061],{"class":507}," signed",[493,1063,511],{"class":503},[493,1065,514],{"class":499},[493,1067,517],{"class":503},[493,1069,521],{"class":520},[493,1071,524],{"class":503},[493,1073,1074],{"class":495,"line":527},[493,1075,531],{"emptyLinePlaceholder":530},[493,1077,1078,1080,1083,1085,1087,1090,1092,1094,1096,1098,1100,1103,1105,1107,1109,1111,1113,1116,1119,1121],{"class":495,"line":534},[493,1079,464],{"class":548},[493,1081,1082],{"class":507},"(drain",[493,1084,563],{"class":503},[493,1086,504],{"class":503},[493,1088,1089],{"class":654}," strategy",[493,1091,613],{"class":503},[493,1093,517],{"class":503},[493,1095,1043],{"class":520},[493,1097,555],{"class":503},[493,1099,563],{"class":503},[493,1101,1102],{"class":654}," secret",[493,1104,613],{"class":503},[493,1106,867],{"class":507},[493,1108,540],{"class":503},[493,1110,872],{"class":507},[493,1112,540],{"class":503},[493,1114,1115],{"class":507},"AUDIT_SECRET",[493,1117,1118],{"class":503},"!",[493,1120,511],{"class":503},[493,1122,948],{"class":507},[1041,1124,1126],{"id":1125},"hash-chain","Hash-chain",[450,1128,1129],{},"Each event references the previous event's hash. Deleting any row breaks the chain forward of that point, so the verifier can pinpoint the exact row that was tampered with.",[483,1131,1133],{"className":485,"code":1132,"language":488,"meta":489,"style":489},"signed(drain, {\n  strategy: 'hash-chain',\n  state: {\n    load: () => fs.readFile('.audit\u002Fhead', 'utf8').catch(() => null),\n    save: (h) => fs.writeFile('.audit\u002Fhead', h),\n  },\n})\n",[454,1134,1135,1146,1161,1170,1229,1268,1273],{"__ignoreMap":489},[493,1136,1137,1139,1141,1143],{"class":495,"line":496},[493,1138,464],{"class":548},[493,1140,1082],{"class":507},[493,1142,563],{"class":503},[493,1144,1145],{"class":503}," {\n",[493,1147,1148,1151,1153,1155,1157,1159],{"class":495,"line":527},[493,1149,1150],{"class":654},"  strategy",[493,1152,613],{"class":503},[493,1154,517],{"class":503},[493,1156,1125],{"class":520},[493,1158,555],{"class":503},[493,1160,649],{"class":503},[493,1162,1163,1166,1168],{"class":495,"line":534},[493,1164,1165],{"class":654},"  state",[493,1167,613],{"class":503},[493,1169,1145],{"class":503},[493,1171,1172,1175,1177,1180,1182,1185,1187,1190,1192,1194,1197,1199,1201,1203,1206,1208,1210,1212,1215,1217,1220,1222,1225,1227],{"class":495,"line":688},[493,1173,1174],{"class":548},"    load",[493,1176,613],{"class":503},[493,1178,1179],{"class":503}," ()",[493,1181,621],{"class":620},[493,1183,1184],{"class":507}," fs",[493,1186,540],{"class":503},[493,1188,1189],{"class":548},"readFile",[493,1191,552],{"class":507},[493,1193,555],{"class":503},[493,1195,1196],{"class":520},".audit\u002Fhead",[493,1198,555],{"class":503},[493,1200,563],{"class":503},[493,1202,517],{"class":503},[493,1204,1205],{"class":520},"utf8",[493,1207,555],{"class":503},[493,1209,882],{"class":507},[493,1211,540],{"class":503},[493,1213,1214],{"class":548},"catch",[493,1216,552],{"class":507},[493,1218,1219],{"class":503},"()",[493,1221,621],{"class":620},[493,1223,1224],{"class":503}," null",[493,1226,882],{"class":507},[493,1228,649],{"class":503},[493,1230,1231,1234,1236,1239,1242,1244,1246,1248,1250,1253,1255,1257,1259,1261,1263,1266],{"class":495,"line":809},[493,1232,1233],{"class":548},"    save",[493,1235,613],{"class":503},[493,1237,1238],{"class":503}," (",[493,1240,1241],{"class":616},"h",[493,1243,882],{"class":503},[493,1245,621],{"class":620},[493,1247,1184],{"class":507},[493,1249,540],{"class":503},[493,1251,1252],{"class":548},"writeFile",[493,1254,552],{"class":507},[493,1256,555],{"class":503},[493,1258,1196],{"class":520},[493,1260,555],{"class":503},[493,1262,563],{"class":503},[493,1264,1265],{"class":507}," h)",[493,1267,649],{"class":503},[493,1269,1270],{"class":495,"line":838},[493,1271,1272],{"class":503},"  },\n",[493,1274,1275,1277],{"class":495,"line":887},[493,1276,691],{"class":503},[493,1278,948],{"class":507},[450,1280,951,1281,1284],{},[454,1282,1283],{},"state"," config is required for cross-process or durable chains: load the previous head hash from your own store (Redis, Postgres, file) before each event, save the new head after.",[1286,1287],"hash-chain-tamper",{},[1289,1290,1291,1292,1295,1296,1299,1300,540],"note",{},"A CLI to walk and verify the chain (",[454,1293,1294],{},"evlog audit verify",") is on the roadmap. Until then, validate by recomputing the hashes of stored events and comparing each ",[454,1297,1298],{},"prevHash"," against the previous event's ",[454,1301,1302],{},"hash",[1304,1305,1306],"style",{},"html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sHdIc, html code.shiki .sHdIc{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#EEFFFF;--shiki-default-font-style:italic;--shiki-dark:#BABED8;--shiki-dark-font-style:italic}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sfNiH, html code.shiki .sfNiH{--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC}",{"title":489,"searchDepth":527,"depth":527,"links":1308},[1309,1310,1311],{"id":469,"depth":527,"text":472},{"id":715,"depth":527,"text":718},{"id":464,"depth":527,"text":959,"children":1312},[1313,1314],{"id":1043,"depth":534,"text":1044},{"id":1125,"depth":534,"text":1126},"auditEnricher to auto-fill request context, auditOnly to route audits to a dedicated sink, and signed for tamper-evident HMAC or hash-chain integrity.","md",[1318,1321],{"label":335,"icon":338,"to":336,"color":1319,"variant":1320},"neutral","subtle",{"label":345,"icon":322,"to":346,"color":1319,"variant":1320},{},{"title":340,"icon":343},{"title":445,"description":1315},"itxrFd63uwkkpvv72OfsxMn_ZEQXyktrhxz-jpcd2cQ",[1327,1329],{"title":335,"path":336,"stem":337,"description":1328,"icon":338,"children":-1},"log.audit, log.audit.deny, standalone audit(), withAudit auto-instrumentation, defineAuditAction and defineAuditCatalog registries, and auditDiff change patches.",{"title":345,"path":346,"stem":347,"description":1330,"icon":322,"children":-1},"Integrity, redact presets, GDPR vs append-only, retention windows, and the most common pitfalls when shipping audit logs to production.",1780168571957]