[{"data":1,"prerenderedAt":1327},["ShallowReactive",2],{"navigation_docs":3,"-use-cases-audit-pipeline":439,"-use-cases-audit-pipeline-surround":1322},[4,30,80,245,353,408],{"title":5,"path":6,"stem":7,"children":8,"page":29},"Start","\u002Fstart","1.start",[9,14,19,24],{"title":10,"path":11,"stem":12,"icon":13},"Introduction","\u002Fstart\u002Fintroduction","1.start\u002F1.introduction","i-lucide-info",{"title":15,"path":16,"stem":17,"icon":18},"Why start with evlog","\u002Fstart\u002Fwhy-evlog","1.start\u002F2.why-evlog","i-lucide-rocket",{"title":20,"path":21,"stem":22,"icon":23},"Installation","\u002Fstart\u002Finstallation","1.start\u002F3.installation","i-lucide-download",{"title":25,"path":26,"stem":27,"icon":28},"Quick Start","\u002Fstart\u002Fquick-start","1.start\u002F4.quick-start","i-lucide-zap",false,{"title":31,"path":32,"stem":33,"children":34,"page":29},"Learn","\u002Flearn","2.learn",[35,40,45,50,55,60,65,70,75],{"title":36,"path":37,"stem":38,"icon":39},"Overview","\u002Flearn\u002Foverview","2.learn\u002F0.overview","i-lucide-list",{"title":41,"path":42,"stem":43,"icon":44},"Simple Logging","\u002Flearn\u002Fsimple-logging","2.learn\u002F1.simple-logging","i-lucide-terminal",{"title":46,"path":47,"stem":48,"icon":49},"Wide Events","\u002Flearn\u002Fwide-events","2.learn\u002F2.wide-events","i-lucide-layers",{"title":51,"path":52,"stem":53,"icon":54},"Structured Errors","\u002Flearn\u002Fstructured-errors","2.learn\u002F3.structured-errors","i-lucide-shield-alert",{"title":56,"path":57,"stem":58,"icon":59},"Lifecycle","\u002Flearn\u002Flifecycle","2.learn\u002F4.lifecycle","i-lucide-arrow-right-left",{"title":61,"path":62,"stem":63,"icon":64},"Sampling","\u002Flearn\u002Fsampling","2.learn\u002F5.sampling","i-lucide-filter",{"title":66,"path":67,"stem":68,"icon":69},"Auto-Redaction","\u002Flearn\u002Fredaction","2.learn\u002F6.redaction","i-lucide-eye-off",{"title":71,"path":72,"stem":73,"icon":74},"Typed Fields","\u002Flearn\u002Ftyped-fields","2.learn\u002F7.typed-fields","i-simple-icons-typescript",{"title":76,"path":77,"stem":78,"icon":79},"Catalogs","\u002Flearn\u002Fcatalogs","2.learn\u002F8.catalogs","i-lucide-book-open",{"title":81,"path":82,"stem":83,"children":84,"page":29},"Integrate","\u002Fintegrate","3.integrate",[85,89,157],{"title":36,"path":86,"stem":87,"icon":88},"\u002Fintegrate\u002Foverview","3.integrate\u002F0.overview","i-lucide-plug",{"title":90,"path":91,"stem":92,"children":93,"page":29},"Adapters","\u002Fintegrate\u002Fadapters","3.integrate\u002Fadapters",[94,97,137],{"title":36,"path":95,"stem":96,"icon":39},"\u002Fintegrate\u002Fadapters\u002Foverview","3.integrate\u002Fadapters\u002F01.overview",{"title":98,"path":99,"stem":100,"children":101,"page":29},"Cloud","\u002Fintegrate\u002Fadapters\u002Fcloud","3.integrate\u002Fadapters\u002Fcloud",[102,107,112,117,122,127,132],{"title":103,"path":104,"stem":105,"icon":106},"Axiom","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Faxiom","3.integrate\u002Fadapters\u002Fcloud\u002F01.axiom","i-custom-axiom",{"title":108,"path":109,"stem":110,"icon":111},"OTLP","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fotlp","3.integrate\u002Fadapters\u002Fcloud\u002F02.otlp","i-simple-icons-opentelemetry",{"title":113,"path":114,"stem":115,"icon":116},"PostHog","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fposthog","3.integrate\u002Fadapters\u002Fcloud\u002F03.posthog","i-simple-icons-posthog",{"title":118,"path":119,"stem":120,"icon":121},"Sentry","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fsentry","3.integrate\u002Fadapters\u002Fcloud\u002F04.sentry","i-simple-icons-sentry",{"title":123,"path":124,"stem":125,"icon":126},"Better Stack","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fbetter-stack","3.integrate\u002Fadapters\u002Fcloud\u002F05.better-stack","i-simple-icons-betterstack",{"title":128,"path":129,"stem":130,"icon":131},"Datadog","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fdatadog","3.integrate\u002Fadapters\u002Fcloud\u002F06.datadog","i-simple-icons-datadog",{"title":133,"path":134,"stem":135,"icon":136},"HyperDX","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fhyperdx","3.integrate\u002Fadapters\u002Fcloud\u002F07.hyperdx","i-custom-hyperdx",{"title":138,"path":139,"stem":140,"children":141,"page":29},"Self-Hosted","\u002Fintegrate\u002Fadapters\u002Fself-hosted","3.integrate\u002Fadapters\u002Fself-hosted",[142,147,152],{"title":143,"path":144,"stem":145,"icon":146},"File System","\u002Fintegrate\u002Fadapters\u002Fself-hosted\u002Ffs","3.integrate\u002Fadapters\u002Fself-hosted\u002F01.fs","i-lucide-hard-drive",{"title":148,"path":149,"stem":150,"icon":151},"NuxtHub","\u002Fintegrate\u002Fadapters\u002Fself-hosted\u002Fnuxthub","3.integrate\u002Fadapters\u002Fself-hosted\u002F02.nuxthub","i-simple-icons-nuxt",{"title":153,"path":154,"stem":155,"icon":156},"Memory","\u002Fintegrate\u002Fadapters\u002Fself-hosted\u002Fmemory","3.integrate\u002Fadapters\u002Fself-hosted\u002F03.memory","i-lucide-cpu",{"title":158,"path":159,"stem":160,"children":161,"page":29},"Frameworks","\u002Fintegrate\u002Fframeworks","3.integrate\u002Fframeworks",[162,166,171,176,181,186,191,196,201,206,211,216,221,226,230,235,240],{"title":36,"path":163,"stem":164,"icon":165},"\u002Fintegrate\u002Fframeworks\u002Foverview","3.integrate\u002Fframeworks\u002F00.overview","i-lucide-layout-grid",{"title":167,"path":168,"stem":169,"icon":170},"Nuxt","\u002Fintegrate\u002Fframeworks\u002Fnuxt","3.integrate\u002Fframeworks\u002F01.nuxt","i-simple-icons-nuxtdotjs",{"title":172,"path":173,"stem":174,"icon":175},"Next.js","\u002Fintegrate\u002Fframeworks\u002Fnextjs","3.integrate\u002Fframeworks\u002F02.nextjs","i-simple-icons-nextdotjs",{"title":177,"path":178,"stem":179,"icon":180},"SvelteKit","\u002Fintegrate\u002Fframeworks\u002Fsveltekit","3.integrate\u002Fframeworks\u002F03.sveltekit","i-simple-icons-svelte",{"title":182,"path":183,"stem":184,"icon":185},"Nitro","\u002Fintegrate\u002Fframeworks\u002Fnitro","3.integrate\u002Fframeworks\u002F04.nitro","i-custom-nitro",{"title":187,"path":188,"stem":189,"icon":190},"TanStack Start","\u002Fintegrate\u002Fframeworks\u002Ftanstack-start","3.integrate\u002Fframeworks\u002F05.tanstack-start","i-custom-tanstack",{"title":192,"path":193,"stem":194,"icon":195},"NestJS","\u002Fintegrate\u002Fframeworks\u002Fnestjs","3.integrate\u002Fframeworks\u002F06.nestjs","i-simple-icons-nestjs",{"title":197,"path":198,"stem":199,"icon":200},"Express","\u002Fintegrate\u002Fframeworks\u002Fexpress","3.integrate\u002Fframeworks\u002F07.express","i-simple-icons-express",{"title":202,"path":203,"stem":204,"icon":205},"Hono","\u002Fintegrate\u002Fframeworks\u002Fhono","3.integrate\u002Fframeworks\u002F08.hono","i-simple-icons-hono",{"title":207,"path":208,"stem":209,"icon":210},"Fastify","\u002Fintegrate\u002Fframeworks\u002Ffastify","3.integrate\u002Fframeworks\u002F09.fastify","i-simple-icons-fastify",{"title":212,"path":213,"stem":214,"icon":215},"Elysia","\u002Fintegrate\u002Fframeworks\u002Felysia","3.integrate\u002Fframeworks\u002F10.elysia","i-custom-elysia",{"title":217,"path":218,"stem":219,"icon":220},"React Router","\u002Fintegrate\u002Fframeworks\u002Freact-router","3.integrate\u002Fframeworks\u002F11.react-router","i-custom-reactrouter",{"title":222,"path":223,"stem":224,"icon":225},"Cloudflare Workers","\u002Fintegrate\u002Fframeworks\u002Fcloudflare-workers","3.integrate\u002Fframeworks\u002F12.cloudflare-workers","i-simple-icons-cloudflare",{"title":227,"path":228,"stem":229,"icon":74},"Standalone","\u002Fintegrate\u002Fframeworks\u002Fstandalone","3.integrate\u002Fframeworks\u002F13.standalone",{"title":231,"path":232,"stem":233,"icon":234},"Astro","\u002Fintegrate\u002Fframeworks\u002Fastro","3.integrate\u002Fframeworks\u002F14.astro","i-simple-icons-astro",{"title":236,"path":237,"stem":238,"icon":239},"oRPC","\u002Fintegrate\u002Fframeworks\u002Forpc","3.integrate\u002Fframeworks\u002F15.orpc","i-lucide-network",{"title":241,"path":242,"stem":243,"icon":244},"AWS Lambda","\u002Fintegrate\u002Fframeworks\u002Faws-lambda","3.integrate\u002Fframeworks\u002F16.aws-lambda","i-custom-lambda",{"title":246,"path":247,"stem":248,"children":249,"page":29},"Use Cases","\u002Fuse-cases","4.use-cases",[250,254,259,288,316,348],{"title":36,"path":251,"stem":252,"icon":253},"\u002Fuse-cases\u002Foverview","4.use-cases\u002F0.overview","i-lucide-list-checks",{"title":255,"path":256,"stem":257,"icon":258},"Client Logging","\u002Fuse-cases\u002Fclient-logging","4.use-cases\u002F1.client-logging","i-lucide-monitor",{"title":260,"icon":261,"path":262,"stem":263,"children":264,"page":29},"AI SDK","i-simple-icons-vercel","\u002Fuse-cases\u002Fai-sdk","4.use-cases\u002F2.ai-sdk",[265,268,273,278,283],{"title":36,"path":266,"stem":267,"icon":39},"\u002Fuse-cases\u002Fai-sdk\u002Foverview","4.use-cases\u002F2.ai-sdk\u002F01.overview",{"title":269,"path":270,"stem":271,"icon":272},"Usage","\u002Fuse-cases\u002Fai-sdk\u002Fusage","4.use-cases\u002F2.ai-sdk\u002F02.usage","i-lucide-code",{"title":274,"path":275,"stem":276,"icon":277},"Options","\u002Fuse-cases\u002Fai-sdk\u002Foptions","4.use-cases\u002F2.ai-sdk\u002F03.options","i-lucide-sliders",{"title":279,"path":280,"stem":281,"icon":282},"Metadata","\u002Fuse-cases\u002Fai-sdk\u002Fmetadata","4.use-cases\u002F2.ai-sdk\u002F04.metadata","i-lucide-database",{"title":284,"path":285,"stem":286,"icon":287},"Telemetry","\u002Fuse-cases\u002Fai-sdk\u002Ftelemetry","4.use-cases\u002F2.ai-sdk\u002F05.telemetry","i-lucide-activity",{"title":289,"icon":290,"path":291,"stem":292,"children":293,"page":29},"Better Auth","i-simple-icons-betterauth","\u002Fuse-cases\u002Fbetter-auth","4.use-cases\u002F3.better-auth",[294,297,302,307,311],{"title":36,"path":295,"stem":296,"icon":39},"\u002Fuse-cases\u002Fbetter-auth\u002Foverview","4.use-cases\u002F3.better-auth\u002F01.overview",{"title":298,"path":299,"stem":300,"icon":301},"Identify User","\u002Fuse-cases\u002Fbetter-auth\u002Fidentify-user","4.use-cases\u002F3.better-auth\u002F02.identify-user","i-lucide-user-check",{"title":303,"path":304,"stem":305,"icon":306},"Middleware","\u002Fuse-cases\u002Fbetter-auth\u002Fmiddleware","4.use-cases\u002F3.better-auth\u002F03.middleware","i-lucide-shield",{"title":308,"path":309,"stem":310,"icon":258},"Client Sync","\u002Fuse-cases\u002Fbetter-auth\u002Fclient-sync","4.use-cases\u002F3.better-auth\u002F04.client-sync",{"title":312,"path":313,"stem":314,"icon":315},"Performance","\u002Fuse-cases\u002Fbetter-auth\u002Fperformance","4.use-cases\u002F3.better-auth\u002F05.performance","i-lucide-gauge",{"title":317,"icon":318,"path":319,"stem":320,"children":321,"page":29},"Audit Logs","i-lucide-shield-check","\u002Fuse-cases\u002Faudit","4.use-cases\u002F4.audit",[322,325,330,335,340,344],{"title":36,"path":323,"stem":324,"icon":39},"\u002Fuse-cases\u002Faudit\u002Foverview","4.use-cases\u002F4.audit\u002F01.overview",{"title":326,"path":327,"stem":328,"icon":329},"Schema","\u002Fuse-cases\u002Faudit\u002Fschema","4.use-cases\u002F4.audit\u002F02.schema","i-lucide-file-text",{"title":331,"path":332,"stem":333,"icon":334},"Recording","\u002Fuse-cases\u002Faudit\u002Frecording","4.use-cases\u002F4.audit\u002F03.recording","i-lucide-pen-line",{"title":336,"path":337,"stem":338,"icon":339},"Drains","\u002Fuse-cases\u002Faudit\u002Fpipeline","4.use-cases\u002F4.audit\u002F04.pipeline","i-lucide-link",{"title":341,"path":342,"stem":343,"icon":318},"Compliance","\u002Fuse-cases\u002Faudit\u002Fcompliance","4.use-cases\u002F4.audit\u002F05.compliance",{"title":345,"path":346,"stem":347,"icon":79},"Recipes","\u002Fuse-cases\u002Faudit\u002Frecipes","4.use-cases\u002F4.audit\u002F06.recipes",{"title":349,"path":350,"stem":351,"icon":352},"Enrichers","\u002Fuse-cases\u002Fenrichers","4.use-cases\u002F5.enrichers","i-lucide-sparkles",{"title":354,"path":355,"stem":356,"children":357,"page":29},"Extend","\u002Fextend","5.extend",[358,362,367,372,377,381,385,389,393,398,403],{"title":36,"path":359,"stem":360,"icon":361},"\u002Fextend\u002Foverview","5.extend\u002F0.overview","i-lucide-blocks",{"title":363,"path":364,"stem":365,"icon":366},"Stream","\u002Fextend\u002Fstream","5.extend\u002F1.stream","i-lucide-radio-tower",{"title":368,"path":369,"stem":370,"icon":371},"Custom framework","\u002Fextend\u002Fcustom-framework","5.extend\u002F10.custom-framework","i-lucide-puzzle",{"title":373,"path":374,"stem":375,"icon":376},"FS reader","\u002Fextend\u002Ffs-reader","5.extend\u002F2.fs-reader","i-lucide-folder-search",{"title":345,"path":378,"stem":379,"icon":380},"\u002Fextend\u002Fconsumer-recipes","5.extend\u002F3.consumer-recipes","i-lucide-chef-hat",{"title":382,"path":383,"stem":384,"icon":361},"Plugins","\u002Fextend\u002Fplugins","5.extend\u002F4.plugins",{"title":386,"path":387,"stem":388,"icon":352},"Custom enrichers","\u002Fextend\u002Fcustom-enrichers","5.extend\u002F5.custom-enrichers",{"title":390,"path":391,"stem":392,"icon":64},"Tail sampling","\u002Fextend\u002Ftail-sampling","5.extend\u002F6.tail-sampling",{"title":394,"path":395,"stem":396,"icon":397},"Identity headers","\u002Fextend\u002Fidentity-headers","5.extend\u002F7.identity-headers","i-lucide-fingerprint",{"title":399,"path":400,"stem":401,"icon":402},"Custom drains","\u002Fextend\u002Fcustom-drains","5.extend\u002F8.custom-drains","i-lucide-share-2",{"title":404,"path":405,"stem":406,"icon":407},"Drain pipeline","\u002Fextend\u002Fdrain-pipeline","5.extend\u002F9.drain-pipeline","i-lucide-workflow",{"title":409,"path":410,"stem":411,"children":412,"page":29},"Reference","\u002Freference","6.reference",[413,418,421,426,430,435],{"title":414,"path":415,"stem":416,"icon":417},"Configuration","\u002Freference\u002Fconfiguration","6.reference\u002F1.configuration","i-lucide-settings",{"title":312,"path":419,"stem":420,"icon":315},"\u002Freference\u002Fperformance","6.reference\u002F2.performance",{"title":422,"path":423,"stem":424,"icon":425},"Vite Plugin","\u002Freference\u002Fvite-plugin","6.reference\u002F3.vite-plugin","i-custom-vite",{"title":427,"path":428,"stem":429,"icon":318},"Best Practices","\u002Freference\u002Fbest-practices","6.reference\u002F4.best-practices",{"title":431,"path":432,"stem":433,"icon":434},"vs Other Loggers","\u002Freference\u002Fvs-other-loggers","6.reference\u002F5.vs-other-loggers","i-lucide-scale",{"title":436,"path":437,"stem":438,"icon":352},"Agent Skills","\u002Freference\u002Fagent-skills","6.reference\u002F6.agent-skills",{"id":440,"title":441,"body":442,"description":1311,"extension":1312,"links":1313,"meta":1318,"navigation":1319,"path":337,"seo":1320,"stem":338,"__hash__":1321},"docs\u002F4.use-cases\u002F4.audit\u002F04.pipeline.md","Drains & Integrity",{"type":443,"value":444,"toc":1303},"minimark",[445,462,469,478,565,568,691,709,715,735,749,886,893,945,951,956,962,1019,1036,1041,1044,1119,1123,1126,1275,1281,1284,1299],[446,447,448,449,453,454,457,458,461],"p",{},"Three building blocks: ",[450,451,452],"code",{},"auditEnricher"," fills context, ",[450,455,456],{},"auditOnly"," routes audits to a dedicated drain, and ",[450,459,460],{},"signed"," adds tamper-evident integrity. Each is opt-in and replaceable.",[463,464,466],"h2",{"id":465},"auditenricher",[450,467,468],{},"auditEnricher()",[446,470,471,473,474,477],{},[450,472,468],{}," populates ",[450,475,476],{},"event.audit.context.{requestId, traceId, ip, userAgent, tenantId}",". Skip it and ship a custom enricher if your strategy differs.",[479,480,486],"pre",{"className":481,"code":482,"filename":483,"language":484,"meta":485,"style":485},"language-typescript shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","import { auditEnricher } from 'evlog'\n\nnitro.hooks.hook('evlog:enrich', auditEnricher())\n","server\u002Fplugins\u002Fevlog.ts","typescript","",[450,487,488,521,528],{"__ignoreMap":485},[489,490,493,497,501,505,508,511,514,518],"span",{"class":491,"line":492},"line",1,[489,494,496],{"class":495},"s7zQu","import",[489,498,500],{"class":499},"sMK4o"," {",[489,502,504],{"class":503},"sTEyZ"," auditEnricher",[489,506,507],{"class":499}," }",[489,509,510],{"class":495}," from",[489,512,513],{"class":499}," '",[489,515,517],{"class":516},"sfazB","evlog",[489,519,520],{"class":499},"'\n",[489,522,524],{"class":491,"line":523},2,[489,525,527],{"emptyLinePlaceholder":526},true,"\n",[489,529,531,534,537,540,542,546,549,552,555,557,560,562],{"class":491,"line":530},3,[489,532,533],{"class":503},"nitro",[489,535,536],{"class":499},".",[489,538,539],{"class":503},"hooks",[489,541,536],{"class":499},[489,543,545],{"class":544},"s2Zo4","hook",[489,547,548],{"class":503},"(",[489,550,551],{"class":499},"'",[489,553,554],{"class":516},"evlog:enrich",[489,556,551],{"class":499},[489,558,559],{"class":499},",",[489,561,504],{"class":544},[489,563,564],{"class":503},"())\n",[446,566,567],{},"For multi-tenant apps and custom session bridges, pass options:",[479,569,571],{"className":481,"code":570,"language":484,"meta":485,"style":485},"nitro.hooks.hook('evlog:enrich', auditEnricher({\n  tenantId: ctx => ctx.event.tenant as string | undefined,\n  bridge: { getSession: async ctx => readSessionActor(ctx.headers) },\n}))\n",[450,572,573,602,646,682],{"__ignoreMap":485},[489,574,575,577,579,581,583,585,587,589,591,593,595,597,599],{"class":491,"line":492},[489,576,533],{"class":503},[489,578,536],{"class":499},[489,580,539],{"class":503},[489,582,536],{"class":499},[489,584,545],{"class":544},[489,586,548],{"class":503},[489,588,551],{"class":499},[489,590,554],{"class":516},[489,592,551],{"class":499},[489,594,559],{"class":499},[489,596,504],{"class":544},[489,598,548],{"class":503},[489,600,601],{"class":499},"{\n",[489,603,604,607,610,614,618,620,622,625,627,630,633,637,640,643],{"class":491,"line":523},[489,605,606],{"class":544},"  tenantId",[489,608,609],{"class":499},":",[489,611,613],{"class":612},"sHdIc"," ctx",[489,615,617],{"class":616},"spNyl"," =>",[489,619,613],{"class":503},[489,621,536],{"class":499},[489,623,624],{"class":503},"event",[489,626,536],{"class":499},[489,628,629],{"class":503},"tenant ",[489,631,632],{"class":495},"as",[489,634,636],{"class":635},"sBMFI"," string",[489,638,639],{"class":499}," |",[489,641,642],{"class":635}," undefined",[489,644,645],{"class":499},",\n",[489,647,648,652,654,656,659,661,664,666,668,671,674,676,679],{"class":491,"line":530},[489,649,651],{"class":650},"swJcz","  bridge",[489,653,609],{"class":499},[489,655,500],{"class":499},[489,657,658],{"class":544}," getSession",[489,660,609],{"class":499},[489,662,663],{"class":616}," async",[489,665,613],{"class":612},[489,667,617],{"class":616},[489,669,670],{"class":544}," readSessionActor",[489,672,673],{"class":503},"(ctx",[489,675,536],{"class":499},[489,677,678],{"class":503},"headers) ",[489,680,681],{"class":499},"},\n",[489,683,685,688],{"class":491,"line":684},4,[489,686,687],{"class":499},"}",[489,689,690],{"class":503},"))\n",[446,692,693,694,696,697,700,701,704,705,708],{},"Without ",[450,695,452],{},", ",[450,698,699],{},"audit.context"," stays empty — auditors and incident responders need at least ",[450,702,703],{},"requestId"," and ",[450,706,707],{},"ip"," to triangulate a recorded action.",[463,710,712],{"id":711},"auditonly",[450,713,714],{},"auditOnly()",[716,717,718,722,723,726,727,730,731,734],"tip",{},[719,720,721],"strong",{},"Why filter audits to a separate sink?"," Three reasons: ",[719,724,725],{},"cost"," (audit volume is tiny next to product telemetry — keep them separate so retention costs don't explode), ",[719,728,729],{},"permissions"," (the audit dataset should be read-only for engineers and write-only for the app), and ",[719,732,733],{},"retention"," (audits often live 7+ years; product logs rarely live more than 90 days).",[446,736,737,740,741,744,745,748],{},[450,738,739],{},"auditOnly(drain)"," only forwards events with an ",[450,742,743],{},"audit"," field. Compose with ",[719,746,747],{},"any"," drain:",[479,750,752],{"className":481,"code":751,"language":484,"meta":485,"style":485},"import { auditOnly } from 'evlog'\nimport { createAxiomDrain } from 'evlog\u002Faxiom'\n\n\u002F\u002F Send audits to a dedicated Axiom dataset:\nnitro.hooks.hook('evlog:drain', auditOnly(\n  createAxiomDrain({ dataset: 'audit', apiKey: process.env.AXIOM_AUDIT_API_KEY }),\n))\n",[450,753,754,773,793,797,803,832,881],{"__ignoreMap":485},[489,755,756,758,760,763,765,767,769,771],{"class":491,"line":492},[489,757,496],{"class":495},[489,759,500],{"class":499},[489,761,762],{"class":503}," auditOnly",[489,764,507],{"class":499},[489,766,510],{"class":495},[489,768,513],{"class":499},[489,770,517],{"class":516},[489,772,520],{"class":499},[489,774,775,777,779,782,784,786,788,791],{"class":491,"line":523},[489,776,496],{"class":495},[489,778,500],{"class":499},[489,780,781],{"class":503}," createAxiomDrain",[489,783,507],{"class":499},[489,785,510],{"class":495},[489,787,513],{"class":499},[489,789,790],{"class":516},"evlog\u002Faxiom",[489,792,520],{"class":499},[489,794,795],{"class":491,"line":530},[489,796,527],{"emptyLinePlaceholder":526},[489,798,799],{"class":491,"line":684},[489,800,802],{"class":801},"sHwdD","\u002F\u002F Send audits to a dedicated Axiom dataset:\n",[489,804,806,808,810,812,814,816,818,820,823,825,827,829],{"class":491,"line":805},5,[489,807,533],{"class":503},[489,809,536],{"class":499},[489,811,539],{"class":503},[489,813,536],{"class":499},[489,815,545],{"class":544},[489,817,548],{"class":503},[489,819,551],{"class":499},[489,821,822],{"class":516},"evlog:drain",[489,824,551],{"class":499},[489,826,559],{"class":499},[489,828,762],{"class":544},[489,830,831],{"class":503},"(\n",[489,833,835,838,840,843,846,848,850,852,854,856,859,861,864,866,869,871,874,876,879],{"class":491,"line":834},6,[489,836,837],{"class":544},"  createAxiomDrain",[489,839,548],{"class":503},[489,841,842],{"class":499},"{",[489,844,845],{"class":650}," dataset",[489,847,609],{"class":499},[489,849,513],{"class":499},[489,851,743],{"class":516},[489,853,551],{"class":499},[489,855,559],{"class":499},[489,857,858],{"class":650}," apiKey",[489,860,609],{"class":499},[489,862,863],{"class":503}," process",[489,865,536],{"class":499},[489,867,868],{"class":503},"env",[489,870,536],{"class":499},[489,872,873],{"class":503},"AXIOM_AUDIT_API_KEY ",[489,875,687],{"class":499},[489,877,878],{"class":503},")",[489,880,645],{"class":499},[489,882,884],{"class":491,"line":883},7,[489,885,690],{"class":503},[446,887,888,889,892],{},"Set ",[450,890,891],{},"await: true"," to make audit writes synchronous (no fire-and-forget for audits — crash-safe by default):",[479,894,896],{"className":481,"code":895,"language":484,"meta":485,"style":485},"auditOnly(createFsDrain({ dir: '.audit' }), { await: true })\n",[450,897,898],{"__ignoreMap":485},[489,899,900,902,904,907,909,911,914,916,918,921,923,925,927,929,931,934,936,940,942],{"class":491,"line":492},[489,901,456],{"class":544},[489,903,548],{"class":503},[489,905,906],{"class":544},"createFsDrain",[489,908,548],{"class":503},[489,910,842],{"class":499},[489,912,913],{"class":650}," dir",[489,915,609],{"class":499},[489,917,513],{"class":499},[489,919,920],{"class":516},".audit",[489,922,551],{"class":499},[489,924,507],{"class":499},[489,926,878],{"class":503},[489,928,559],{"class":499},[489,930,500],{"class":499},[489,932,933],{"class":650}," await",[489,935,609],{"class":499},[489,937,939],{"class":938},"sfNiH"," true",[489,941,507],{"class":499},[489,943,944],{"class":503},")\n",[446,946,947,948,950],{},"The ",[450,949,891],{}," flag costs you a small bit of latency per request that records an audit (one synchronous drain call), but guarantees the audit hits disk before the response is sent. For compliance-grade audits, the trade-off is always worth it.",[463,952,953],{"id":460},[450,954,955],{},"signed()",[446,957,958,961],{},[450,959,960],{},"signed(drain, opts)"," adds tamper-evident integrity. Two strategies:",[963,964,965,981],"table",{},[966,967,968],"thead",{},[969,970,971,975,978],"tr",{},[972,973,974],"th",{},"Strategy",[972,976,977],{},"What it adds",[972,979,980],{},"Use case",[982,983,984,1001],"tbody",{},[969,985,986,992,998],{},[987,988,989],"td",{},[450,990,991],{},"'hmac'",[987,993,994,997],{},[450,995,996],{},"event.audit.signature"," (HMAC of the canonical event)",[987,999,1000],{},"Single-event integrity check (any later mutation fails verification).",[969,1002,1003,1008,1016],{},[987,1004,1005],{},[450,1006,1007],{},"'hash-chain'",[987,1009,1010,704,1013],{},[450,1011,1012],{},"event.audit.prevHash",[450,1014,1015],{},"event.audit.hash",[987,1017,1018],{},"A verifiable chain — deletions and reordering also become detectable.",[716,1020,1021,1027,1028,1032,1033,1035],{},[719,1022,1023,1024,1026],{},"What ",[450,1025,955],{}," actually buys you."," Detection, not prevention. Anyone with write access to the underlying sink can still nuke the file or table — but the chain proves ",[1029,1030,1031],"em",{},"which"," events were dropped or modified after the fact. Skip ",[450,1034,955],{}," if you already write to an append-only \u002F WORM store (S3 Object Lock, Postgres with row-level immutability, BigQuery append-only tables); doubling integrity layers just adds latency without raising the bar.",[1037,1038,1040],"h3",{"id":1039},"hmac","HMAC",[446,1042,1043],{},"Each event gets a signature. Tampering with one row breaks that row's verification, but doesn't break later rows.",[479,1045,1047],{"className":481,"code":1046,"language":484,"meta":485,"style":485},"import { signed } from 'evlog'\n\nsigned(drain, { strategy: 'hmac', secret: process.env.AUDIT_SECRET! })\n",[450,1048,1049,1068,1072],{"__ignoreMap":485},[489,1050,1051,1053,1055,1058,1060,1062,1064,1066],{"class":491,"line":492},[489,1052,496],{"class":495},[489,1054,500],{"class":499},[489,1056,1057],{"class":503}," signed",[489,1059,507],{"class":499},[489,1061,510],{"class":495},[489,1063,513],{"class":499},[489,1065,517],{"class":516},[489,1067,520],{"class":499},[489,1069,1070],{"class":491,"line":523},[489,1071,527],{"emptyLinePlaceholder":526},[489,1073,1074,1076,1079,1081,1083,1086,1088,1090,1092,1094,1096,1099,1101,1103,1105,1107,1109,1112,1115,1117],{"class":491,"line":530},[489,1075,460],{"class":544},[489,1077,1078],{"class":503},"(drain",[489,1080,559],{"class":499},[489,1082,500],{"class":499},[489,1084,1085],{"class":650}," strategy",[489,1087,609],{"class":499},[489,1089,513],{"class":499},[489,1091,1039],{"class":516},[489,1093,551],{"class":499},[489,1095,559],{"class":499},[489,1097,1098],{"class":650}," secret",[489,1100,609],{"class":499},[489,1102,863],{"class":503},[489,1104,536],{"class":499},[489,1106,868],{"class":503},[489,1108,536],{"class":499},[489,1110,1111],{"class":503},"AUDIT_SECRET",[489,1113,1114],{"class":499},"!",[489,1116,507],{"class":499},[489,1118,944],{"class":503},[1037,1120,1122],{"id":1121},"hash-chain","Hash-chain",[446,1124,1125],{},"Each event references the previous event's hash. Deleting any row breaks the chain forward of that point, so the verifier can pinpoint the exact row that was tampered with.",[479,1127,1129],{"className":481,"code":1128,"language":484,"meta":485,"style":485},"signed(drain, {\n  strategy: 'hash-chain',\n  state: {\n    load: () => fs.readFile('.audit\u002Fhead', 'utf8').catch(() => null),\n    save: (h) => fs.writeFile('.audit\u002Fhead', h),\n  },\n})\n",[450,1130,1131,1142,1157,1166,1225,1264,1269],{"__ignoreMap":485},[489,1132,1133,1135,1137,1139],{"class":491,"line":492},[489,1134,460],{"class":544},[489,1136,1078],{"class":503},[489,1138,559],{"class":499},[489,1140,1141],{"class":499}," {\n",[489,1143,1144,1147,1149,1151,1153,1155],{"class":491,"line":523},[489,1145,1146],{"class":650},"  strategy",[489,1148,609],{"class":499},[489,1150,513],{"class":499},[489,1152,1121],{"class":516},[489,1154,551],{"class":499},[489,1156,645],{"class":499},[489,1158,1159,1162,1164],{"class":491,"line":530},[489,1160,1161],{"class":650},"  state",[489,1163,609],{"class":499},[489,1165,1141],{"class":499},[489,1167,1168,1171,1173,1176,1178,1181,1183,1186,1188,1190,1193,1195,1197,1199,1202,1204,1206,1208,1211,1213,1216,1218,1221,1223],{"class":491,"line":684},[489,1169,1170],{"class":544},"    load",[489,1172,609],{"class":499},[489,1174,1175],{"class":499}," ()",[489,1177,617],{"class":616},[489,1179,1180],{"class":503}," fs",[489,1182,536],{"class":499},[489,1184,1185],{"class":544},"readFile",[489,1187,548],{"class":503},[489,1189,551],{"class":499},[489,1191,1192],{"class":516},".audit\u002Fhead",[489,1194,551],{"class":499},[489,1196,559],{"class":499},[489,1198,513],{"class":499},[489,1200,1201],{"class":516},"utf8",[489,1203,551],{"class":499},[489,1205,878],{"class":503},[489,1207,536],{"class":499},[489,1209,1210],{"class":544},"catch",[489,1212,548],{"class":503},[489,1214,1215],{"class":499},"()",[489,1217,617],{"class":616},[489,1219,1220],{"class":499}," null",[489,1222,878],{"class":503},[489,1224,645],{"class":499},[489,1226,1227,1230,1232,1235,1238,1240,1242,1244,1246,1249,1251,1253,1255,1257,1259,1262],{"class":491,"line":805},[489,1228,1229],{"class":544},"    save",[489,1231,609],{"class":499},[489,1233,1234],{"class":499}," (",[489,1236,1237],{"class":612},"h",[489,1239,878],{"class":499},[489,1241,617],{"class":616},[489,1243,1180],{"class":503},[489,1245,536],{"class":499},[489,1247,1248],{"class":544},"writeFile",[489,1250,548],{"class":503},[489,1252,551],{"class":499},[489,1254,1192],{"class":516},[489,1256,551],{"class":499},[489,1258,559],{"class":499},[489,1260,1261],{"class":503}," h)",[489,1263,645],{"class":499},[489,1265,1266],{"class":491,"line":834},[489,1267,1268],{"class":499},"  },\n",[489,1270,1271,1273],{"class":491,"line":883},[489,1272,687],{"class":499},[489,1274,944],{"class":503},[446,1276,947,1277,1280],{},[450,1278,1279],{},"state"," config is required for cross-process or durable chains: load the previous head hash from your own store (Redis, Postgres, file) before each event, save the new head after.",[1282,1283],"hash-chain-tamper",{},[1285,1286,1287,1288,1291,1292,1295,1296,536],"note",{},"A CLI to walk and verify the chain (",[450,1289,1290],{},"evlog audit verify",") is on the roadmap. Until then, validate by recomputing the hashes of stored events and comparing each ",[450,1293,1294],{},"prevHash"," against the previous event's ",[450,1297,1298],{},"hash",[1300,1301,1302],"style",{},"html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sHdIc, html code.shiki .sHdIc{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#EEFFFF;--shiki-default-font-style:italic;--shiki-dark:#BABED8;--shiki-dark-font-style:italic}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sfNiH, html code.shiki .sfNiH{--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC}",{"title":485,"searchDepth":523,"depth":523,"links":1304},[1305,1306,1307],{"id":465,"depth":523,"text":468},{"id":711,"depth":523,"text":714},{"id":460,"depth":523,"text":955,"children":1308},[1309,1310],{"id":1039,"depth":530,"text":1040},{"id":1121,"depth":530,"text":1122},"auditEnricher to auto-fill request context, auditOnly to route audits to a dedicated sink, and signed for tamper-evident HMAC or hash-chain integrity.","md",[1314,1317],{"label":331,"icon":334,"to":332,"color":1315,"variant":1316},"neutral","subtle",{"label":341,"icon":318,"to":342,"color":1315,"variant":1316},{},{"title":336,"icon":339},{"title":441,"description":1311},"itxrFd63uwkkpvv72OfsxMn_ZEQXyktrhxz-jpcd2cQ",[1323,1325],{"title":331,"path":332,"stem":333,"description":1324,"icon":334,"children":-1},"log.audit, log.audit.deny, standalone audit(), withAudit auto-instrumentation, defineAuditAction and defineAuditCatalog registries, and auditDiff change patches.",{"title":341,"path":342,"stem":343,"description":1326,"icon":318,"children":-1},"Integrity, redact presets, GDPR vs append-only, retention windows, and the most common pitfalls when shipping audit logs to production.",1779694503535]