[{"data":1,"prerenderedAt":1332},["ShallowReactive",2],{"navigation_docs":3,"-use-cases-audit-pipeline":444,"-use-cases-audit-pipeline-surround":1327},[4,30,80,245,358,413],{"title":5,"path":6,"stem":7,"children":8,"page":29},"Start","\u002Fstart","1.start",[9,14,19,24],{"title":10,"path":11,"stem":12,"icon":13},"Introduction","\u002Fstart\u002Fintroduction","1.start\u002F1.introduction","i-lucide-info",{"title":15,"path":16,"stem":17,"icon":18},"Why start with evlog","\u002Fstart\u002Fwhy-evlog","1.start\u002F2.why-evlog","i-lucide-rocket",{"title":20,"path":21,"stem":22,"icon":23},"Installation","\u002Fstart\u002Finstallation","1.start\u002F3.installation","i-lucide-download",{"title":25,"path":26,"stem":27,"icon":28},"Quick Start","\u002Fstart\u002Fquick-start","1.start\u002F4.quick-start","i-lucide-zap",false,{"title":31,"path":32,"stem":33,"children":34,"page":29},"Learn","\u002Flearn","2.learn",[35,40,45,50,55,60,65,70,75],{"title":36,"path":37,"stem":38,"icon":39},"Overview","\u002Flearn\u002Foverview","2.learn\u002F0.overview","i-lucide-list",{"title":41,"path":42,"stem":43,"icon":44},"Simple Logging","\u002Flearn\u002Fsimple-logging","2.learn\u002F1.simple-logging","i-lucide-terminal",{"title":46,"path":47,"stem":48,"icon":49},"Wide Events","\u002Flearn\u002Fwide-events","2.learn\u002F2.wide-events","i-lucide-layers",{"title":51,"path":52,"stem":53,"icon":54},"Structured Errors","\u002Flearn\u002Fstructured-errors","2.learn\u002F3.structured-errors","i-lucide-shield-alert",{"title":56,"path":57,"stem":58,"icon":59},"Lifecycle","\u002Flearn\u002Flifecycle","2.learn\u002F4.lifecycle","i-lucide-arrow-right-left",{"title":61,"path":62,"stem":63,"icon":64},"Sampling","\u002Flearn\u002Fsampling","2.learn\u002F5.sampling","i-lucide-filter",{"title":66,"path":67,"stem":68,"icon":69},"Auto-Redaction","\u002Flearn\u002Fredaction","2.learn\u002F6.redaction","i-lucide-eye-off",{"title":71,"path":72,"stem":73,"icon":74},"Typed Fields","\u002Flearn\u002Ftyped-fields","2.learn\u002F7.typed-fields","i-simple-icons-typescript",{"title":76,"path":77,"stem":78,"icon":79},"Catalogs","\u002Flearn\u002Fcatalogs","2.learn\u002F8.catalogs","i-lucide-book-open",{"title":81,"path":82,"stem":83,"children":84,"page":29},"Integrate","\u002Fintegrate","3.integrate",[85,89,157],{"title":36,"path":86,"stem":87,"icon":88},"\u002Fintegrate\u002Foverview","3.integrate\u002F0.overview","i-lucide-plug",{"title":90,"path":91,"stem":92,"children":93,"page":29},"Adapters","\u002Fintegrate\u002Fadapters","3.integrate\u002Fadapters",[94,97,137],{"title":36,"path":95,"stem":96,"icon":39},"\u002Fintegrate\u002Fadapters\u002Foverview","3.integrate\u002Fadapters\u002F01.overview",{"title":98,"path":99,"stem":100,"children":101,"page":29},"Cloud","\u002Fintegrate\u002Fadapters\u002Fcloud","3.integrate\u002Fadapters\u002Fcloud",[102,107,112,117,122,127,132],{"title":103,"path":104,"stem":105,"icon":106},"Axiom","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Faxiom","3.integrate\u002Fadapters\u002Fcloud\u002F01.axiom","i-custom-axiom",{"title":108,"path":109,"stem":110,"icon":111},"OTLP","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fotlp","3.integrate\u002Fadapters\u002Fcloud\u002F02.otlp","i-simple-icons-opentelemetry",{"title":113,"path":114,"stem":115,"icon":116},"PostHog","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fposthog","3.integrate\u002Fadapters\u002Fcloud\u002F03.posthog","i-simple-icons-posthog",{"title":118,"path":119,"stem":120,"icon":121},"Sentry","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fsentry","3.integrate\u002Fadapters\u002Fcloud\u002F04.sentry","i-simple-icons-sentry",{"title":123,"path":124,"stem":125,"icon":126},"Better Stack","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fbetter-stack","3.integrate\u002Fadapters\u002Fcloud\u002F05.better-stack","i-simple-icons-betterstack",{"title":128,"path":129,"stem":130,"icon":131},"Datadog","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fdatadog","3.integrate\u002Fadapters\u002Fcloud\u002F06.datadog","i-simple-icons-datadog",{"title":133,"path":134,"stem":135,"icon":136},"HyperDX","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fhyperdx","3.integrate\u002Fadapters\u002Fcloud\u002F07.hyperdx","i-custom-hyperdx",{"title":138,"path":139,"stem":140,"children":141,"page":29},"Self-Hosted","\u002Fintegrate\u002Fadapters\u002Fself-hosted","3.integrate\u002Fadapters\u002Fself-hosted",[142,147,152],{"title":143,"path":144,"stem":145,"icon":146},"File System","\u002Fintegrate\u002Fadapters\u002Fself-hosted\u002Ffs","3.integrate\u002Fadapters\u002Fself-hosted\u002F01.fs","i-lucide-hard-drive",{"title":148,"path":149,"stem":150,"icon":151},"NuxtHub","\u002Fintegrate\u002Fadapters\u002Fself-hosted\u002Fnuxthub","3.integrate\u002Fadapters\u002Fself-hosted\u002F02.nuxthub","i-simple-icons-nuxt",{"title":153,"path":154,"stem":155,"icon":156},"Memory","\u002Fintegrate\u002Fadapters\u002Fself-hosted\u002Fmemory","3.integrate\u002Fadapters\u002Fself-hosted\u002F03.memory","i-lucide-cpu",{"title":158,"path":159,"stem":160,"children":161,"page":29},"Frameworks","\u002Fintegrate\u002Fframeworks","3.integrate\u002Fframeworks",[162,166,171,176,181,186,191,196,201,206,211,216,221,226,230,235,240],{"title":36,"path":163,"stem":164,"icon":165},"\u002Fintegrate\u002Fframeworks\u002Foverview","3.integrate\u002Fframeworks\u002F00.overview","i-lucide-layout-grid",{"title":167,"path":168,"stem":169,"icon":170},"Nuxt","\u002Fintegrate\u002Fframeworks\u002Fnuxt","3.integrate\u002Fframeworks\u002F01.nuxt","i-simple-icons-nuxtdotjs",{"title":172,"path":173,"stem":174,"icon":175},"Next.js","\u002Fintegrate\u002Fframeworks\u002Fnextjs","3.integrate\u002Fframeworks\u002F02.nextjs","i-simple-icons-nextdotjs",{"title":177,"path":178,"stem":179,"icon":180},"SvelteKit","\u002Fintegrate\u002Fframeworks\u002Fsveltekit","3.integrate\u002Fframeworks\u002F03.sveltekit","i-simple-icons-svelte",{"title":182,"path":183,"stem":184,"icon":185},"Nitro","\u002Fintegrate\u002Fframeworks\u002Fnitro","3.integrate\u002Fframeworks\u002F04.nitro","i-custom-nitro",{"title":187,"path":188,"stem":189,"icon":190},"TanStack Start","\u002Fintegrate\u002Fframeworks\u002Ftanstack-start","3.integrate\u002Fframeworks\u002F05.tanstack-start","i-custom-tanstack",{"title":192,"path":193,"stem":194,"icon":195},"NestJS","\u002Fintegrate\u002Fframeworks\u002Fnestjs","3.integrate\u002Fframeworks\u002F06.nestjs","i-simple-icons-nestjs",{"title":197,"path":198,"stem":199,"icon":200},"Express","\u002Fintegrate\u002Fframeworks\u002Fexpress","3.integrate\u002Fframeworks\u002F07.express","i-simple-icons-express",{"title":202,"path":203,"stem":204,"icon":205},"Hono","\u002Fintegrate\u002Fframeworks\u002Fhono","3.integrate\u002Fframeworks\u002F08.hono","i-simple-icons-hono",{"title":207,"path":208,"stem":209,"icon":210},"Fastify","\u002Fintegrate\u002Fframeworks\u002Ffastify","3.integrate\u002Fframeworks\u002F09.fastify","i-simple-icons-fastify",{"title":212,"path":213,"stem":214,"icon":215},"Elysia","\u002Fintegrate\u002Fframeworks\u002Felysia","3.integrate\u002Fframeworks\u002F10.elysia","i-custom-elysia",{"title":217,"path":218,"stem":219,"icon":220},"React Router","\u002Fintegrate\u002Fframeworks\u002Freact-router","3.integrate\u002Fframeworks\u002F11.react-router","i-custom-reactrouter",{"title":222,"path":223,"stem":224,"icon":225},"Cloudflare Workers","\u002Fintegrate\u002Fframeworks\u002Fcloudflare-workers","3.integrate\u002Fframeworks\u002F12.cloudflare-workers","i-simple-icons-cloudflare",{"title":227,"path":228,"stem":229,"icon":74},"Standalone","\u002Fintegrate\u002Fframeworks\u002Fstandalone","3.integrate\u002Fframeworks\u002F13.standalone",{"title":231,"path":232,"stem":233,"icon":234},"Astro","\u002Fintegrate\u002Fframeworks\u002Fastro","3.integrate\u002Fframeworks\u002F14.astro","i-simple-icons-astro",{"title":236,"path":237,"stem":238,"icon":239},"oRPC","\u002Fintegrate\u002Fframeworks\u002Forpc","3.integrate\u002Fframeworks\u002F15.orpc","i-lucide-network",{"title":241,"path":242,"stem":243,"icon":244},"AWS Lambda","\u002Fintegrate\u002Fframeworks\u002Faws-lambda","3.integrate\u002Fframeworks\u002F16.aws-lambda","i-custom-lambda",{"title":246,"path":247,"stem":248,"children":249,"page":29},"Use Cases","\u002Fuse-cases","4.use-cases",[250,254,259,288,316,348,353],{"title":36,"path":251,"stem":252,"icon":253},"\u002Fuse-cases\u002Foverview","4.use-cases\u002F0.overview","i-lucide-list-checks",{"title":255,"path":256,"stem":257,"icon":258},"Client Logging","\u002Fuse-cases\u002Fclient-logging","4.use-cases\u002F1.client-logging","i-lucide-monitor",{"title":260,"icon":261,"path":262,"stem":263,"children":264,"page":29},"AI SDK","i-simple-icons-vercel","\u002Fuse-cases\u002Fai-sdk","4.use-cases\u002F2.ai-sdk",[265,268,273,278,283],{"title":36,"path":266,"stem":267,"icon":39},"\u002Fuse-cases\u002Fai-sdk\u002Foverview","4.use-cases\u002F2.ai-sdk\u002F01.overview",{"title":269,"path":270,"stem":271,"icon":272},"Usage","\u002Fuse-cases\u002Fai-sdk\u002Fusage","4.use-cases\u002F2.ai-sdk\u002F02.usage","i-lucide-code",{"title":274,"path":275,"stem":276,"icon":277},"Options","\u002Fuse-cases\u002Fai-sdk\u002Foptions","4.use-cases\u002F2.ai-sdk\u002F03.options","i-lucide-sliders",{"title":279,"path":280,"stem":281,"icon":282},"Metadata","\u002Fuse-cases\u002Fai-sdk\u002Fmetadata","4.use-cases\u002F2.ai-sdk\u002F04.metadata","i-lucide-database",{"title":284,"path":285,"stem":286,"icon":287},"Telemetry","\u002Fuse-cases\u002Fai-sdk\u002Ftelemetry","4.use-cases\u002F2.ai-sdk\u002F05.telemetry","i-lucide-activity",{"title":289,"icon":290,"path":291,"stem":292,"children":293,"page":29},"Better Auth","i-simple-icons-betterauth","\u002Fuse-cases\u002Fbetter-auth","4.use-cases\u002F3.better-auth",[294,297,302,307,311],{"title":36,"path":295,"stem":296,"icon":39},"\u002Fuse-cases\u002Fbetter-auth\u002Foverview","4.use-cases\u002F3.better-auth\u002F01.overview",{"title":298,"path":299,"stem":300,"icon":301},"Identify User","\u002Fuse-cases\u002Fbetter-auth\u002Fidentify-user","4.use-cases\u002F3.better-auth\u002F02.identify-user","i-lucide-user-check",{"title":303,"path":304,"stem":305,"icon":306},"Middleware","\u002Fuse-cases\u002Fbetter-auth\u002Fmiddleware","4.use-cases\u002F3.better-auth\u002F03.middleware","i-lucide-shield",{"title":308,"path":309,"stem":310,"icon":258},"Client Sync","\u002Fuse-cases\u002Fbetter-auth\u002Fclient-sync","4.use-cases\u002F3.better-auth\u002F04.client-sync",{"title":312,"path":313,"stem":314,"icon":315},"Performance","\u002Fuse-cases\u002Fbetter-auth\u002Fperformance","4.use-cases\u002F3.better-auth\u002F05.performance","i-lucide-gauge",{"title":317,"icon":318,"path":319,"stem":320,"children":321,"page":29},"Audit Logs","i-lucide-shield-check","\u002Fuse-cases\u002Faudit","4.use-cases\u002F4.audit",[322,325,330,335,340,344],{"title":36,"path":323,"stem":324,"icon":39},"\u002Fuse-cases\u002Faudit\u002Foverview","4.use-cases\u002F4.audit\u002F01.overview",{"title":326,"path":327,"stem":328,"icon":329},"Schema","\u002Fuse-cases\u002Faudit\u002Fschema","4.use-cases\u002F4.audit\u002F02.schema","i-lucide-file-text",{"title":331,"path":332,"stem":333,"icon":334},"Recording","\u002Fuse-cases\u002Faudit\u002Frecording","4.use-cases\u002F4.audit\u002F03.recording","i-lucide-pen-line",{"title":336,"path":337,"stem":338,"icon":339},"Drains","\u002Fuse-cases\u002Faudit\u002Fpipeline","4.use-cases\u002F4.audit\u002F04.pipeline","i-lucide-link",{"title":341,"path":342,"stem":343,"icon":318},"Compliance","\u002Fuse-cases\u002Faudit\u002Fcompliance","4.use-cases\u002F4.audit\u002F05.compliance",{"title":345,"path":346,"stem":347,"icon":79},"Recipes","\u002Fuse-cases\u002Faudit\u002Frecipes","4.use-cases\u002F4.audit\u002F06.recipes",{"title":349,"path":350,"stem":351,"icon":352},"Enrichers","\u002Fuse-cases\u002Fenrichers","4.use-cases\u002F5.enrichers","i-lucide-sparkles",{"title":354,"path":355,"stem":356,"icon":357},"eve","\u002Fuse-cases\u002Feve","4.use-cases\u002F5.eve","i-custom-eve",{"title":359,"path":360,"stem":361,"children":362,"page":29},"Extend","\u002Fextend","5.extend",[363,367,372,377,382,386,390,394,398,403,408],{"title":36,"path":364,"stem":365,"icon":366},"\u002Fextend\u002Foverview","5.extend\u002F0.overview","i-lucide-blocks",{"title":368,"path":369,"stem":370,"icon":371},"Stream","\u002Fextend\u002Fstream","5.extend\u002F1.stream","i-lucide-radio-tower",{"title":373,"path":374,"stem":375,"icon":376},"Custom framework","\u002Fextend\u002Fcustom-framework","5.extend\u002F10.custom-framework","i-lucide-puzzle",{"title":378,"path":379,"stem":380,"icon":381},"FS reader","\u002Fextend\u002Ffs-reader","5.extend\u002F2.fs-reader","i-lucide-folder-search",{"title":345,"path":383,"stem":384,"icon":385},"\u002Fextend\u002Fconsumer-recipes","5.extend\u002F3.consumer-recipes","i-lucide-chef-hat",{"title":387,"path":388,"stem":389,"icon":366},"Plugins","\u002Fextend\u002Fplugins","5.extend\u002F4.plugins",{"title":391,"path":392,"stem":393,"icon":352},"Custom enrichers","\u002Fextend\u002Fcustom-enrichers","5.extend\u002F5.custom-enrichers",{"title":395,"path":396,"stem":397,"icon":64},"Tail sampling","\u002Fextend\u002Ftail-sampling","5.extend\u002F6.tail-sampling",{"title":399,"path":400,"stem":401,"icon":402},"Identity headers","\u002Fextend\u002Fidentity-headers","5.extend\u002F7.identity-headers","i-lucide-fingerprint",{"title":404,"path":405,"stem":406,"icon":407},"Custom drains","\u002Fextend\u002Fcustom-drains","5.extend\u002F8.custom-drains","i-lucide-share-2",{"title":409,"path":410,"stem":411,"icon":412},"Drain pipeline","\u002Fextend\u002Fdrain-pipeline","5.extend\u002F9.drain-pipeline","i-lucide-workflow",{"title":414,"path":415,"stem":416,"children":417,"page":29},"Reference","\u002Freference","6.reference",[418,423,426,431,435,440],{"title":419,"path":420,"stem":421,"icon":422},"Configuration","\u002Freference\u002Fconfiguration","6.reference\u002F1.configuration","i-lucide-settings",{"title":312,"path":424,"stem":425,"icon":315},"\u002Freference\u002Fperformance","6.reference\u002F2.performance",{"title":427,"path":428,"stem":429,"icon":430},"Vite Plugin","\u002Freference\u002Fvite-plugin","6.reference\u002F3.vite-plugin","i-custom-vite",{"title":432,"path":433,"stem":434,"icon":318},"Best Practices","\u002Freference\u002Fbest-practices","6.reference\u002F4.best-practices",{"title":436,"path":437,"stem":438,"icon":439},"vs Other Loggers","\u002Freference\u002Fvs-other-loggers","6.reference\u002F5.vs-other-loggers","i-lucide-scale",{"title":441,"path":442,"stem":443,"icon":352},"Agent Skills","\u002Freference\u002Fagent-skills","6.reference\u002F6.agent-skills",{"id":445,"title":446,"body":447,"description":1316,"extension":1317,"links":1318,"meta":1323,"navigation":1324,"path":337,"seo":1325,"stem":338,"__hash__":1326},"docs\u002F4.use-cases\u002F4.audit\u002F04.pipeline.md","Drains & Integrity",{"type":448,"value":449,"toc":1308},"minimark",[450,467,474,483,570,573,696,714,720,740,754,891,898,950,956,961,967,1024,1041,1046,1049,1124,1128,1131,1280,1286,1289,1304],[451,452,453,454,458,459,462,463,466],"p",{},"Three building blocks: ",[455,456,457],"code",{},"auditEnricher"," fills context, ",[455,460,461],{},"auditOnly"," routes audits to a dedicated drain, and ",[455,464,465],{},"signed"," adds tamper-evident integrity. Each is opt-in and replaceable.",[468,469,471],"h2",{"id":470},"auditenricher",[455,472,473],{},"auditEnricher()",[451,475,476,478,479,482],{},[455,477,473],{}," populates ",[455,480,481],{},"event.audit.context.{requestId, traceId, ip, userAgent, tenantId}",". Skip it and ship a custom enricher if your strategy differs.",[484,485,491],"pre",{"className":486,"code":487,"filename":488,"language":489,"meta":490,"style":490},"language-typescript shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","import { auditEnricher } from 'evlog'\n\nnitro.hooks.hook('evlog:enrich', auditEnricher())\n","server\u002Fplugins\u002Fevlog.ts","typescript","",[455,492,493,526,533],{"__ignoreMap":490},[494,495,498,502,506,510,513,516,519,523],"span",{"class":496,"line":497},"line",1,[494,499,501],{"class":500},"s7zQu","import",[494,503,505],{"class":504},"sMK4o"," {",[494,507,509],{"class":508},"sTEyZ"," auditEnricher",[494,511,512],{"class":504}," }",[494,514,515],{"class":500}," from",[494,517,518],{"class":504}," '",[494,520,522],{"class":521},"sfazB","evlog",[494,524,525],{"class":504},"'\n",[494,527,529],{"class":496,"line":528},2,[494,530,532],{"emptyLinePlaceholder":531},true,"\n",[494,534,536,539,542,545,547,551,554,557,560,562,565,567],{"class":496,"line":535},3,[494,537,538],{"class":508},"nitro",[494,540,541],{"class":504},".",[494,543,544],{"class":508},"hooks",[494,546,541],{"class":504},[494,548,550],{"class":549},"s2Zo4","hook",[494,552,553],{"class":508},"(",[494,555,556],{"class":504},"'",[494,558,559],{"class":521},"evlog:enrich",[494,561,556],{"class":504},[494,563,564],{"class":504},",",[494,566,509],{"class":549},[494,568,569],{"class":508},"())\n",[451,571,572],{},"For multi-tenant apps and custom session bridges, pass options:",[484,574,576],{"className":486,"code":575,"language":489,"meta":490,"style":490},"nitro.hooks.hook('evlog:enrich', auditEnricher({\n  tenantId: ctx => ctx.event.tenant as string | undefined,\n  bridge: { getSession: async ctx => readSessionActor(ctx.headers) },\n}))\n",[455,577,578,607,651,687],{"__ignoreMap":490},[494,579,580,582,584,586,588,590,592,594,596,598,600,602,604],{"class":496,"line":497},[494,581,538],{"class":508},[494,583,541],{"class":504},[494,585,544],{"class":508},[494,587,541],{"class":504},[494,589,550],{"class":549},[494,591,553],{"class":508},[494,593,556],{"class":504},[494,595,559],{"class":521},[494,597,556],{"class":504},[494,599,564],{"class":504},[494,601,509],{"class":549},[494,603,553],{"class":508},[494,605,606],{"class":504},"{\n",[494,608,609,612,615,619,623,625,627,630,632,635,638,642,645,648],{"class":496,"line":528},[494,610,611],{"class":549},"  tenantId",[494,613,614],{"class":504},":",[494,616,618],{"class":617},"sHdIc"," ctx",[494,620,622],{"class":621},"spNyl"," =>",[494,624,618],{"class":508},[494,626,541],{"class":504},[494,628,629],{"class":508},"event",[494,631,541],{"class":504},[494,633,634],{"class":508},"tenant ",[494,636,637],{"class":500},"as",[494,639,641],{"class":640},"sBMFI"," string",[494,643,644],{"class":504}," |",[494,646,647],{"class":640}," undefined",[494,649,650],{"class":504},",\n",[494,652,653,657,659,661,664,666,669,671,673,676,679,681,684],{"class":496,"line":535},[494,654,656],{"class":655},"swJcz","  bridge",[494,658,614],{"class":504},[494,660,505],{"class":504},[494,662,663],{"class":549}," getSession",[494,665,614],{"class":504},[494,667,668],{"class":621}," async",[494,670,618],{"class":617},[494,672,622],{"class":621},[494,674,675],{"class":549}," readSessionActor",[494,677,678],{"class":508},"(ctx",[494,680,541],{"class":504},[494,682,683],{"class":508},"headers) ",[494,685,686],{"class":504},"},\n",[494,688,690,693],{"class":496,"line":689},4,[494,691,692],{"class":504},"}",[494,694,695],{"class":508},"))\n",[451,697,698,699,701,702,705,706,709,710,713],{},"Without ",[455,700,457],{},", ",[455,703,704],{},"audit.context"," stays empty — auditors and incident responders need at least ",[455,707,708],{},"requestId"," and ",[455,711,712],{},"ip"," to triangulate a recorded action.",[468,715,717],{"id":716},"auditonly",[455,718,719],{},"auditOnly()",[721,722,723,727,728,731,732,735,736,739],"tip",{},[724,725,726],"strong",{},"Why filter audits to a separate sink?"," Three reasons: ",[724,729,730],{},"cost"," (audit volume is tiny next to product telemetry — keep them separate so retention costs don't explode), ",[724,733,734],{},"permissions"," (the audit dataset should be read-only for engineers and write-only for the app), and ",[724,737,738],{},"retention"," (audits often live 7+ years; product logs rarely live more than 90 days).",[451,741,742,745,746,749,750,753],{},[455,743,744],{},"auditOnly(drain)"," only forwards events with an ",[455,747,748],{},"audit"," field. Compose with ",[724,751,752],{},"any"," drain:",[484,755,757],{"className":486,"code":756,"language":489,"meta":490,"style":490},"import { auditOnly } from 'evlog'\nimport { createAxiomDrain } from 'evlog\u002Faxiom'\n\n\u002F\u002F Send audits to a dedicated Axiom dataset:\nnitro.hooks.hook('evlog:drain', auditOnly(\n  createAxiomDrain({ dataset: 'audit', apiKey: process.env.AXIOM_AUDIT_API_KEY }),\n))\n",[455,758,759,778,798,802,808,837,886],{"__ignoreMap":490},[494,760,761,763,765,768,770,772,774,776],{"class":496,"line":497},[494,762,501],{"class":500},[494,764,505],{"class":504},[494,766,767],{"class":508}," auditOnly",[494,769,512],{"class":504},[494,771,515],{"class":500},[494,773,518],{"class":504},[494,775,522],{"class":521},[494,777,525],{"class":504},[494,779,780,782,784,787,789,791,793,796],{"class":496,"line":528},[494,781,501],{"class":500},[494,783,505],{"class":504},[494,785,786],{"class":508}," createAxiomDrain",[494,788,512],{"class":504},[494,790,515],{"class":500},[494,792,518],{"class":504},[494,794,795],{"class":521},"evlog\u002Faxiom",[494,797,525],{"class":504},[494,799,800],{"class":496,"line":535},[494,801,532],{"emptyLinePlaceholder":531},[494,803,804],{"class":496,"line":689},[494,805,807],{"class":806},"sHwdD","\u002F\u002F Send audits to a dedicated Axiom dataset:\n",[494,809,811,813,815,817,819,821,823,825,828,830,832,834],{"class":496,"line":810},5,[494,812,538],{"class":508},[494,814,541],{"class":504},[494,816,544],{"class":508},[494,818,541],{"class":504},[494,820,550],{"class":549},[494,822,553],{"class":508},[494,824,556],{"class":504},[494,826,827],{"class":521},"evlog:drain",[494,829,556],{"class":504},[494,831,564],{"class":504},[494,833,767],{"class":549},[494,835,836],{"class":508},"(\n",[494,838,840,843,845,848,851,853,855,857,859,861,864,866,869,871,874,876,879,881,884],{"class":496,"line":839},6,[494,841,842],{"class":549},"  createAxiomDrain",[494,844,553],{"class":508},[494,846,847],{"class":504},"{",[494,849,850],{"class":655}," dataset",[494,852,614],{"class":504},[494,854,518],{"class":504},[494,856,748],{"class":521},[494,858,556],{"class":504},[494,860,564],{"class":504},[494,862,863],{"class":655}," apiKey",[494,865,614],{"class":504},[494,867,868],{"class":508}," process",[494,870,541],{"class":504},[494,872,873],{"class":508},"env",[494,875,541],{"class":504},[494,877,878],{"class":508},"AXIOM_AUDIT_API_KEY ",[494,880,692],{"class":504},[494,882,883],{"class":508},")",[494,885,650],{"class":504},[494,887,889],{"class":496,"line":888},7,[494,890,695],{"class":508},[451,892,893,894,897],{},"Set ",[455,895,896],{},"await: true"," to make audit writes synchronous (no fire-and-forget for audits — crash-safe by default):",[484,899,901],{"className":486,"code":900,"language":489,"meta":490,"style":490},"auditOnly(createFsDrain({ dir: '.audit' }), { await: true })\n",[455,902,903],{"__ignoreMap":490},[494,904,905,907,909,912,914,916,919,921,923,926,928,930,932,934,936,939,941,945,947],{"class":496,"line":497},[494,906,461],{"class":549},[494,908,553],{"class":508},[494,910,911],{"class":549},"createFsDrain",[494,913,553],{"class":508},[494,915,847],{"class":504},[494,917,918],{"class":655}," dir",[494,920,614],{"class":504},[494,922,518],{"class":504},[494,924,925],{"class":521},".audit",[494,927,556],{"class":504},[494,929,512],{"class":504},[494,931,883],{"class":508},[494,933,564],{"class":504},[494,935,505],{"class":504},[494,937,938],{"class":655}," await",[494,940,614],{"class":504},[494,942,944],{"class":943},"sfNiH"," true",[494,946,512],{"class":504},[494,948,949],{"class":508},")\n",[451,951,952,953,955],{},"The ",[455,954,896],{}," flag costs you a small bit of latency per request that records an audit (one synchronous drain call), but guarantees the audit hits disk before the response is sent. For compliance-grade audits, the trade-off is always worth it.",[468,957,958],{"id":465},[455,959,960],{},"signed()",[451,962,963,966],{},[455,964,965],{},"signed(drain, opts)"," adds tamper-evident integrity. Two strategies:",[968,969,970,986],"table",{},[971,972,973],"thead",{},[974,975,976,980,983],"tr",{},[977,978,979],"th",{},"Strategy",[977,981,982],{},"What it adds",[977,984,985],{},"Use case",[987,988,989,1006],"tbody",{},[974,990,991,997,1003],{},[992,993,994],"td",{},[455,995,996],{},"'hmac'",[992,998,999,1002],{},[455,1000,1001],{},"event.audit.signature"," (HMAC of the canonical event)",[992,1004,1005],{},"Single-event integrity check (any later mutation fails verification).",[974,1007,1008,1013,1021],{},[992,1009,1010],{},[455,1011,1012],{},"'hash-chain'",[992,1014,1015,709,1018],{},[455,1016,1017],{},"event.audit.prevHash",[455,1019,1020],{},"event.audit.hash",[992,1022,1023],{},"A verifiable chain — deletions and reordering also become detectable.",[721,1025,1026,1032,1033,1037,1038,1040],{},[724,1027,1028,1029,1031],{},"What ",[455,1030,960],{}," actually buys you."," Detection, not prevention. Anyone with write access to the underlying sink can still nuke the file or table — but the chain proves ",[1034,1035,1036],"em",{},"which"," events were dropped or modified after the fact. Skip ",[455,1039,960],{}," if you already write to an append-only \u002F WORM store (S3 Object Lock, Postgres with row-level immutability, BigQuery append-only tables); doubling integrity layers just adds latency without raising the bar.",[1042,1043,1045],"h3",{"id":1044},"hmac","HMAC",[451,1047,1048],{},"Each event gets a signature. Tampering with one row breaks that row's verification, but doesn't break later rows.",[484,1050,1052],{"className":486,"code":1051,"language":489,"meta":490,"style":490},"import { signed } from 'evlog'\n\nsigned(drain, { strategy: 'hmac', secret: process.env.AUDIT_SECRET! })\n",[455,1053,1054,1073,1077],{"__ignoreMap":490},[494,1055,1056,1058,1060,1063,1065,1067,1069,1071],{"class":496,"line":497},[494,1057,501],{"class":500},[494,1059,505],{"class":504},[494,1061,1062],{"class":508}," signed",[494,1064,512],{"class":504},[494,1066,515],{"class":500},[494,1068,518],{"class":504},[494,1070,522],{"class":521},[494,1072,525],{"class":504},[494,1074,1075],{"class":496,"line":528},[494,1076,532],{"emptyLinePlaceholder":531},[494,1078,1079,1081,1084,1086,1088,1091,1093,1095,1097,1099,1101,1104,1106,1108,1110,1112,1114,1117,1120,1122],{"class":496,"line":535},[494,1080,465],{"class":549},[494,1082,1083],{"class":508},"(drain",[494,1085,564],{"class":504},[494,1087,505],{"class":504},[494,1089,1090],{"class":655}," strategy",[494,1092,614],{"class":504},[494,1094,518],{"class":504},[494,1096,1044],{"class":521},[494,1098,556],{"class":504},[494,1100,564],{"class":504},[494,1102,1103],{"class":655}," secret",[494,1105,614],{"class":504},[494,1107,868],{"class":508},[494,1109,541],{"class":504},[494,1111,873],{"class":508},[494,1113,541],{"class":504},[494,1115,1116],{"class":508},"AUDIT_SECRET",[494,1118,1119],{"class":504},"!",[494,1121,512],{"class":504},[494,1123,949],{"class":508},[1042,1125,1127],{"id":1126},"hash-chain","Hash-chain",[451,1129,1130],{},"Each event references the previous event's hash. Deleting any row breaks the chain forward of that point, so the verifier can pinpoint the exact row that was tampered with.",[484,1132,1134],{"className":486,"code":1133,"language":489,"meta":490,"style":490},"signed(drain, {\n  strategy: 'hash-chain',\n  state: {\n    load: () => fs.readFile('.audit\u002Fhead', 'utf8').catch(() => null),\n    save: (h) => fs.writeFile('.audit\u002Fhead', h),\n  },\n})\n",[455,1135,1136,1147,1162,1171,1230,1269,1274],{"__ignoreMap":490},[494,1137,1138,1140,1142,1144],{"class":496,"line":497},[494,1139,465],{"class":549},[494,1141,1083],{"class":508},[494,1143,564],{"class":504},[494,1145,1146],{"class":504}," {\n",[494,1148,1149,1152,1154,1156,1158,1160],{"class":496,"line":528},[494,1150,1151],{"class":655},"  strategy",[494,1153,614],{"class":504},[494,1155,518],{"class":504},[494,1157,1126],{"class":521},[494,1159,556],{"class":504},[494,1161,650],{"class":504},[494,1163,1164,1167,1169],{"class":496,"line":535},[494,1165,1166],{"class":655},"  state",[494,1168,614],{"class":504},[494,1170,1146],{"class":504},[494,1172,1173,1176,1178,1181,1183,1186,1188,1191,1193,1195,1198,1200,1202,1204,1207,1209,1211,1213,1216,1218,1221,1223,1226,1228],{"class":496,"line":689},[494,1174,1175],{"class":549},"    load",[494,1177,614],{"class":504},[494,1179,1180],{"class":504}," ()",[494,1182,622],{"class":621},[494,1184,1185],{"class":508}," fs",[494,1187,541],{"class":504},[494,1189,1190],{"class":549},"readFile",[494,1192,553],{"class":508},[494,1194,556],{"class":504},[494,1196,1197],{"class":521},".audit\u002Fhead",[494,1199,556],{"class":504},[494,1201,564],{"class":504},[494,1203,518],{"class":504},[494,1205,1206],{"class":521},"utf8",[494,1208,556],{"class":504},[494,1210,883],{"class":508},[494,1212,541],{"class":504},[494,1214,1215],{"class":549},"catch",[494,1217,553],{"class":508},[494,1219,1220],{"class":504},"()",[494,1222,622],{"class":621},[494,1224,1225],{"class":504}," null",[494,1227,883],{"class":508},[494,1229,650],{"class":504},[494,1231,1232,1235,1237,1240,1243,1245,1247,1249,1251,1254,1256,1258,1260,1262,1264,1267],{"class":496,"line":810},[494,1233,1234],{"class":549},"    save",[494,1236,614],{"class":504},[494,1238,1239],{"class":504}," (",[494,1241,1242],{"class":617},"h",[494,1244,883],{"class":504},[494,1246,622],{"class":621},[494,1248,1185],{"class":508},[494,1250,541],{"class":504},[494,1252,1253],{"class":549},"writeFile",[494,1255,553],{"class":508},[494,1257,556],{"class":504},[494,1259,1197],{"class":521},[494,1261,556],{"class":504},[494,1263,564],{"class":504},[494,1265,1266],{"class":508}," h)",[494,1268,650],{"class":504},[494,1270,1271],{"class":496,"line":839},[494,1272,1273],{"class":504},"  },\n",[494,1275,1276,1278],{"class":496,"line":888},[494,1277,692],{"class":504},[494,1279,949],{"class":508},[451,1281,952,1282,1285],{},[455,1283,1284],{},"state"," config is required for cross-process or durable chains: load the previous head hash from your own store (Redis, Postgres, file) before each event, save the new head after.",[1287,1288],"hash-chain-tamper",{},[1290,1291,1292,1293,1296,1297,1300,1301,541],"note",{},"A CLI to walk and verify the chain (",[455,1294,1295],{},"evlog audit verify",") is on the roadmap. Until then, validate by recomputing the hashes of stored events and comparing each ",[455,1298,1299],{},"prevHash"," against the previous event's ",[455,1302,1303],{},"hash",[1305,1306,1307],"style",{},"html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sHdIc, html code.shiki .sHdIc{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#EEFFFF;--shiki-default-font-style:italic;--shiki-dark:#BABED8;--shiki-dark-font-style:italic}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sfNiH, html code.shiki .sfNiH{--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC}",{"title":490,"searchDepth":528,"depth":528,"links":1309},[1310,1311,1312],{"id":470,"depth":528,"text":473},{"id":716,"depth":528,"text":719},{"id":465,"depth":528,"text":960,"children":1313},[1314,1315],{"id":1044,"depth":535,"text":1045},{"id":1126,"depth":535,"text":1127},"auditEnricher to auto-fill request context, auditOnly to route audits to a dedicated sink, and signed for tamper-evident HMAC or hash-chain integrity.","md",[1319,1322],{"label":331,"icon":334,"to":332,"color":1320,"variant":1321},"neutral","subtle",{"label":341,"icon":318,"to":342,"color":1320,"variant":1321},{},{"title":336,"icon":339},{"title":446,"description":1316},"itxrFd63uwkkpvv72OfsxMn_ZEQXyktrhxz-jpcd2cQ",[1328,1330],{"title":331,"path":332,"stem":333,"description":1329,"icon":334,"children":-1},"log.audit, log.audit.deny, standalone audit(), withAudit auto-instrumentation, defineAuditAction and defineAuditCatalog registries, and auditDiff change patches.",{"title":341,"path":342,"stem":343,"description":1331,"icon":318,"children":-1},"Integrity, redact presets, GDPR vs append-only, retention windows, and the most common pitfalls when shipping audit logs to production.",1782925726053]