[{"data":1,"prerenderedAt":1342},["ShallowReactive",2],{"navigation_docs":3,"-logging-audit-pipeline":454,"-logging-audit-pipeline-surround":1337},[4,35,159,201,289,352,438],{"title":5,"path":6,"stem":7,"children":8,"page":34},"Getting Started","\u002Fgetting-started","1.getting-started",[9,14,19,24,29],{"title":10,"path":11,"stem":12,"icon":13},"Introduction","\u002Fgetting-started\u002Fintroduction","1.getting-started\u002F1.introduction","i-lucide-info",{"title":15,"path":16,"stem":17,"icon":18},"Installation","\u002Fgetting-started\u002Finstallation","1.getting-started\u002F2.installation","i-lucide-download",{"title":20,"path":21,"stem":22,"icon":23},"Quick Start","\u002Fgetting-started\u002Fquick-start","1.getting-started\u002F3.quick-start","i-lucide-zap",{"title":25,"path":26,"stem":27,"icon":28},"Agent Skills","\u002Fgetting-started\u002Fagent-skills","1.getting-started\u002F4.agent-skills","i-lucide-sparkles",{"title":30,"path":31,"stem":32,"icon":33},"vs Other Loggers","\u002Fgetting-started\u002Fvs-other-loggers","1.getting-started\u002F5.vs-other-loggers","i-lucide-scale",false,{"title":36,"path":37,"stem":38,"children":39,"page":34},"Logging","\u002Flogging","2.logging",[40,45,50,55,60,65,70,99,127],{"title":41,"path":42,"stem":43,"icon":44},"Overview","\u002Flogging\u002Foverview","2.logging\u002F0.overview","i-lucide-list",{"title":46,"path":47,"stem":48,"icon":49},"Simple Logging","\u002Flogging\u002Fsimple-logging","2.logging\u002F1.simple-logging","i-lucide-terminal",{"title":51,"path":52,"stem":53,"icon":54},"Wide Events","\u002Flogging\u002Fwide-events","2.logging\u002F2.wide-events","i-lucide-layers",{"title":56,"path":57,"stem":58,"icon":59},"Structured Errors","\u002Flogging\u002Fstructured-errors","2.logging\u002F3.structured-errors","i-lucide-shield-alert",{"title":61,"path":62,"stem":63,"icon":64},"Catalogs","\u002Flogging\u002Fcatalogs","2.logging\u002F4.catalogs","i-lucide-book-open",{"title":66,"path":67,"stem":68,"icon":69},"Client Logging","\u002Flogging\u002Fclient-logging","2.logging\u002F5.client-logging","i-lucide-monitor",{"title":71,"icon":72,"path":73,"stem":74,"children":75,"page":34},"AI SDK","i-simple-icons-vercel","\u002Flogging\u002Fai-sdk","2.logging\u002F6.ai-sdk",[76,79,84,89,94],{"title":41,"path":77,"stem":78,"icon":44},"\u002Flogging\u002Fai-sdk\u002Foverview","2.logging\u002F6.ai-sdk\u002F01.overview",{"title":80,"path":81,"stem":82,"icon":83},"Usage","\u002Flogging\u002Fai-sdk\u002Fusage","2.logging\u002F6.ai-sdk\u002F02.usage","i-lucide-code",{"title":85,"path":86,"stem":87,"icon":88},"Options","\u002Flogging\u002Fai-sdk\u002Foptions","2.logging\u002F6.ai-sdk\u002F03.options","i-lucide-sliders",{"title":90,"path":91,"stem":92,"icon":93},"Metadata","\u002Flogging\u002Fai-sdk\u002Fmetadata","2.logging\u002F6.ai-sdk\u002F04.metadata","i-lucide-database",{"title":95,"path":96,"stem":97,"icon":98},"Telemetry","\u002Flogging\u002Fai-sdk\u002Ftelemetry","2.logging\u002F6.ai-sdk\u002F05.telemetry","i-lucide-activity",{"title":100,"icon":101,"path":102,"stem":103,"children":104,"page":34},"Better Auth","i-simple-icons-betterauth","\u002Flogging\u002Fbetter-auth","2.logging\u002F7.better-auth",[105,108,113,118,122],{"title":41,"path":106,"stem":107,"icon":44},"\u002Flogging\u002Fbetter-auth\u002Foverview","2.logging\u002F7.better-auth\u002F01.overview",{"title":109,"path":110,"stem":111,"icon":112},"Identify User","\u002Flogging\u002Fbetter-auth\u002Fidentify-user","2.logging\u002F7.better-auth\u002F02.identify-user","i-lucide-user-check",{"title":114,"path":115,"stem":116,"icon":117},"Middleware","\u002Flogging\u002Fbetter-auth\u002Fmiddleware","2.logging\u002F7.better-auth\u002F03.middleware","i-lucide-shield",{"title":119,"path":120,"stem":121,"icon":69},"Client Sync","\u002Flogging\u002Fbetter-auth\u002Fclient-sync","2.logging\u002F7.better-auth\u002F04.client-sync",{"title":123,"path":124,"stem":125,"icon":126},"Performance","\u002Flogging\u002Fbetter-auth\u002Fperformance","2.logging\u002F7.better-auth\u002F05.performance","i-lucide-gauge",{"title":128,"icon":129,"path":130,"stem":131,"children":132,"page":34},"Audit Logs","i-lucide-shield-check","\u002Flogging\u002Faudit","2.logging\u002F8.audit",[133,136,141,146,151,155],{"title":41,"path":134,"stem":135,"icon":44},"\u002Flogging\u002Faudit\u002Foverview","2.logging\u002F8.audit\u002F01.overview",{"title":137,"path":138,"stem":139,"icon":140},"Schema","\u002Flogging\u002Faudit\u002Fschema","2.logging\u002F8.audit\u002F02.schema","i-lucide-file-text",{"title":142,"path":143,"stem":144,"icon":145},"Recording","\u002Flogging\u002Faudit\u002Frecording","2.logging\u002F8.audit\u002F03.recording","i-lucide-pen-line",{"title":147,"path":148,"stem":149,"icon":150},"Drains","\u002Flogging\u002Faudit\u002Fpipeline","2.logging\u002F8.audit\u002F04.pipeline","i-lucide-link",{"title":152,"path":153,"stem":154,"icon":129},"Compliance","\u002Flogging\u002Faudit\u002Fcompliance","2.logging\u002F8.audit\u002F05.compliance",{"title":156,"path":157,"stem":158,"icon":64},"Recipes","\u002Flogging\u002Faudit\u002Frecipes","2.logging\u002F8.audit\u002F06.recipes",{"title":160,"path":161,"stem":162,"children":163,"page":34},"Core Concepts","\u002Fcore-concepts","3.core-concepts",[164,169,174,179,184,188,191,196],{"title":165,"path":166,"stem":167,"icon":168},"Lifecycle","\u002Fcore-concepts\u002Flifecycle","3.core-concepts\u002F0.lifecycle","i-lucide-arrow-right-left",{"title":170,"path":171,"stem":172,"icon":173},"Configuration","\u002Fcore-concepts\u002Fconfiguration","3.core-concepts\u002F1.configuration","i-lucide-settings",{"title":175,"path":176,"stem":177,"icon":178},"Sampling","\u002Fcore-concepts\u002Fsampling","3.core-concepts\u002F2.sampling","i-lucide-filter",{"title":180,"path":181,"stem":182,"icon":183},"Typed Fields","\u002Fcore-concepts\u002Ftyped-fields","3.core-concepts\u002F3.typed-fields","i-simple-icons-typescript",{"title":185,"path":186,"stem":187,"icon":129},"Best Practices","\u002Fcore-concepts\u002Fbest-practices","3.core-concepts\u002F4.best-practices",{"title":123,"path":189,"stem":190,"icon":126},"\u002Fcore-concepts\u002Fperformance","3.core-concepts\u002F5.performance",{"title":192,"path":193,"stem":194,"icon":195},"Vite Plugin","\u002Fcore-concepts\u002Fvite-plugin","3.core-concepts\u002F6.vite-plugin","i-custom-vite",{"title":197,"path":198,"stem":199,"icon":200},"Auto-Redaction","\u002Fcore-concepts\u002Fredaction","3.core-concepts\u002F7.redaction","i-lucide-eye-off",{"title":202,"path":203,"stem":204,"children":205,"page":34},"Frameworks","\u002Fframeworks","4.frameworks",[206,210,215,220,225,230,235,240,245,250,255,260,265,270,274,279,284],{"title":41,"path":207,"stem":208,"icon":209},"\u002Fframeworks\u002Foverview","4.frameworks\u002F00.overview","i-lucide-layout-grid",{"title":211,"path":212,"stem":213,"icon":214},"Nuxt","\u002Fframeworks\u002Fnuxt","4.frameworks\u002F01.nuxt","i-simple-icons-nuxtdotjs",{"title":216,"path":217,"stem":218,"icon":219},"Next.js","\u002Fframeworks\u002Fnextjs","4.frameworks\u002F02.nextjs","i-simple-icons-nextdotjs",{"title":221,"path":222,"stem":223,"icon":224},"SvelteKit","\u002Fframeworks\u002Fsveltekit","4.frameworks\u002F03.sveltekit","i-simple-icons-svelte",{"title":226,"path":227,"stem":228,"icon":229},"Nitro","\u002Fframeworks\u002Fnitro","4.frameworks\u002F04.nitro","i-custom-nitro",{"title":231,"path":232,"stem":233,"icon":234},"TanStack Start","\u002Fframeworks\u002Ftanstack-start","4.frameworks\u002F05.tanstack-start","i-custom-tanstack",{"title":236,"path":237,"stem":238,"icon":239},"NestJS","\u002Fframeworks\u002Fnestjs","4.frameworks\u002F06.nestjs","i-simple-icons-nestjs",{"title":241,"path":242,"stem":243,"icon":244},"Express","\u002Fframeworks\u002Fexpress","4.frameworks\u002F07.express","i-simple-icons-express",{"title":246,"path":247,"stem":248,"icon":249},"Hono","\u002Fframeworks\u002Fhono","4.frameworks\u002F08.hono","i-simple-icons-hono",{"title":251,"path":252,"stem":253,"icon":254},"Fastify","\u002Fframeworks\u002Ffastify","4.frameworks\u002F09.fastify","i-simple-icons-fastify",{"title":256,"path":257,"stem":258,"icon":259},"Elysia","\u002Fframeworks\u002Felysia","4.frameworks\u002F10.elysia","i-custom-elysia",{"title":261,"path":262,"stem":263,"icon":264},"React Router","\u002Fframeworks\u002Freact-router","4.frameworks\u002F11.react-router","i-custom-reactrouter",{"title":266,"path":267,"stem":268,"icon":269},"Cloudflare Workers","\u002Fframeworks\u002Fcloudflare-workers","4.frameworks\u002F12.cloudflare-workers","i-simple-icons-cloudflare",{"title":271,"path":272,"stem":273,"icon":183},"Standalone","\u002Fframeworks\u002Fstandalone","4.frameworks\u002F13.standalone",{"title":275,"path":276,"stem":277,"icon":278},"Astro","\u002Fframeworks\u002Fastro","4.frameworks\u002F14.astro","i-simple-icons-astro",{"title":280,"path":281,"stem":282,"icon":283},"AWS Lambda","\u002Fframeworks\u002Faws-lambda","4.frameworks\u002F16.aws-lambda","i-custom-lambda",{"title":285,"path":286,"stem":287,"icon":288},"Custom Integration","\u002Fframeworks\u002Fcustom-integration","4.frameworks\u002F17.custom-integration","i-lucide-puzzle",{"title":290,"path":291,"stem":292,"children":293,"page":34},"Build on top","\u002Fbuild-on-top","5.build-on-top",[294,297,302,307,312,316,321,326,330,334,338,342,347],{"title":41,"path":295,"stem":296,"icon":54},"\u002Fbuild-on-top\u002Foverview","5.build-on-top\u002F0.overview",{"title":298,"path":299,"stem":300,"icon":301},"In-process stream","\u002Fbuild-on-top\u002Fin-process-stream","5.build-on-top\u002F1.in-process-stream","i-lucide-radio-tower",{"title":303,"path":304,"stem":305,"icon":306},"Fanout","\u002Fbuild-on-top\u002Ffanout-and-multi-drain","5.build-on-top\u002F10.fanout-and-multi-drain","i-lucide-share-2",{"title":308,"path":309,"stem":310,"icon":311},"Identity headers","\u002Fbuild-on-top\u002Fidentity-headers","5.build-on-top\u002F11.identity-headers","i-lucide-fingerprint",{"title":313,"path":314,"stem":315,"icon":288},"Custom framework","\u002Fbuild-on-top\u002Fcustom-framework","5.build-on-top\u002F12.custom-framework",{"title":317,"path":318,"stem":319,"icon":320},"Stream server","\u002Fbuild-on-top\u002Fstream-server","5.build-on-top\u002F2.stream-server","i-lucide-radio",{"title":322,"path":323,"stem":324,"icon":325},"FS reader","\u002Fbuild-on-top\u002Ffs-reader","5.build-on-top\u002F3.fs-reader","i-lucide-folder-search",{"title":156,"path":327,"stem":328,"icon":329},"\u002Fbuild-on-top\u002Fconsumer-recipes","5.build-on-top\u002F4.consumer-recipes","i-lucide-chef-hat",{"title":331,"path":332,"stem":333,"icon":288},"Plugins","\u002Fbuild-on-top\u002Fplugins","5.build-on-top\u002F5.plugins",{"title":335,"path":336,"stem":337,"icon":28},"Custom enrichers","\u002Fbuild-on-top\u002Fcustom-enrichers","5.build-on-top\u002F6.custom-enrichers",{"title":339,"path":340,"stem":341,"icon":178},"Tail sampling","\u002Fbuild-on-top\u002Ftail-sampling","5.build-on-top\u002F7.tail-sampling",{"title":343,"path":344,"stem":345,"icon":346},"Custom drains","\u002Fbuild-on-top\u002Fcustom-drains","5.build-on-top\u002F8.custom-drains","i-lucide-code-2",{"title":348,"path":349,"stem":350,"icon":351},"Drain pipeline","\u002Fbuild-on-top\u002Fdrain-pipeline","5.build-on-top\u002F9.drain-pipeline","i-lucide-workflow",{"title":353,"path":354,"stem":355,"children":356,"page":34},"Adapters","\u002Fadapters","6.adapters",[357,360,400,415],{"title":41,"path":358,"stem":359,"icon":44},"\u002Fadapters\u002Foverview","6.adapters\u002F01.overview",{"title":361,"path":362,"stem":363,"children":364,"page":34},"Cloud destinations","\u002Fadapters\u002Fcloud","6.adapters\u002F02.cloud",[365,370,375,380,385,390,395],{"title":366,"path":367,"stem":368,"icon":369},"Axiom","\u002Fadapters\u002Fcloud\u002Faxiom","6.adapters\u002F02.cloud\u002F01.axiom","i-custom-axiom",{"title":371,"path":372,"stem":373,"icon":374},"OTLP","\u002Fadapters\u002Fcloud\u002Fotlp","6.adapters\u002F02.cloud\u002F02.otlp","i-simple-icons-opentelemetry",{"title":376,"path":377,"stem":378,"icon":379},"PostHog","\u002Fadapters\u002Fcloud\u002Fposthog","6.adapters\u002F02.cloud\u002F03.posthog","i-simple-icons-posthog",{"title":381,"path":382,"stem":383,"icon":384},"Sentry","\u002Fadapters\u002Fcloud\u002Fsentry","6.adapters\u002F02.cloud\u002F04.sentry","i-simple-icons-sentry",{"title":386,"path":387,"stem":388,"icon":389},"Better Stack","\u002Fadapters\u002Fcloud\u002Fbetter-stack","6.adapters\u002F02.cloud\u002F05.better-stack","i-simple-icons-betterstack",{"title":391,"path":392,"stem":393,"icon":394},"Datadog","\u002Fadapters\u002Fcloud\u002Fdatadog","6.adapters\u002F02.cloud\u002F06.datadog","i-simple-icons-datadog",{"title":396,"path":397,"stem":398,"icon":399},"HyperDX","\u002Fadapters\u002Fcloud\u002Fhyperdx","6.adapters\u002F02.cloud\u002F07.hyperdx","i-custom-hyperdx",{"title":401,"path":402,"stem":403,"children":404,"page":34},"Self-hosted","\u002Fadapters\u002Fself-hosted","6.adapters\u002F03.self-hosted",[405,410],{"title":406,"path":407,"stem":408,"icon":409},"File System","\u002Fadapters\u002Fself-hosted\u002Ffs","6.adapters\u002F03.self-hosted\u002F01.fs","i-lucide-hard-drive",{"title":411,"path":412,"stem":413,"icon":414},"NuxtHub","\u002Fadapters\u002Fself-hosted\u002Fnuxthub","6.adapters\u002F03.self-hosted\u002F02.nuxthub","i-simple-icons-nuxt",{"title":416,"path":417,"stem":418,"children":419,"page":34},"Building blocks","\u002Fadapters\u002Fbuilding-blocks","6.adapters\u002F04.building-blocks",[420,424,429,433],{"title":421,"path":422,"stem":423,"icon":351},"Pipeline","\u002Fadapters\u002Fbuilding-blocks\u002Fpipeline","6.adapters\u002F04.building-blocks\u002F01.pipeline",{"title":425,"path":426,"stem":427,"icon":428},"HTTP","\u002Fadapters\u002Fbuilding-blocks\u002Fhttp","6.adapters\u002F04.building-blocks\u002F02.http","i-lucide-globe",{"title":430,"path":431,"stem":432,"icon":83},"Custom Adapters","\u002Fadapters\u002Fbuilding-blocks\u002Fcustom","6.adapters\u002F04.building-blocks\u002F03.custom",{"title":434,"path":435,"stem":436,"icon":437},"Toolkit","\u002Fadapters\u002Fbuilding-blocks\u002Ftoolkit","6.adapters\u002F04.building-blocks\u002F04.toolkit","i-lucide-blocks",{"title":439,"path":440,"stem":441,"children":442,"page":34},"Enrichers","\u002Fenrichers","7.enrichers",[443,446,450],{"title":41,"path":444,"stem":445,"icon":28},"\u002Fenrichers\u002Foverview","7.enrichers\u002F1.overview",{"title":447,"path":448,"stem":449,"icon":288},"Built-in","\u002Fenrichers\u002Fbuilt-in","7.enrichers\u002F2.built-in",{"title":451,"path":452,"stem":453,"icon":83},"Custom","\u002Fenrichers\u002Fcustom","7.enrichers\u002F3.custom",{"id":455,"title":456,"body":457,"description":1326,"extension":1327,"links":1328,"meta":1333,"navigation":1334,"path":148,"seo":1335,"stem":149,"__hash__":1336},"docs\u002F2.logging\u002F8.audit\u002F04.pipeline.md","Drains & Integrity",{"type":458,"value":459,"toc":1318},"minimark",[460,477,484,493,580,583,706,724,730,750,764,901,908,960,966,971,977,1034,1051,1056,1059,1134,1138,1141,1290,1296,1299,1314],[461,462,463,464,468,469,472,473,476],"p",{},"Three building blocks: ",[465,466,467],"code",{},"auditEnricher"," fills context, ",[465,470,471],{},"auditOnly"," routes audits to a dedicated drain, and ",[465,474,475],{},"signed"," adds tamper-evident integrity. Each is opt-in and replaceable.",[478,479,481],"h2",{"id":480},"auditenricher",[465,482,483],{},"auditEnricher()",[461,485,486,488,489,492],{},[465,487,483],{}," populates ",[465,490,491],{},"event.audit.context.{requestId, traceId, ip, userAgent, tenantId}",". Skip it and ship a custom enricher if your strategy differs.",[494,495,501],"pre",{"className":496,"code":497,"filename":498,"language":499,"meta":500,"style":500},"language-typescript shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","import { auditEnricher } from 'evlog'\n\nnitro.hooks.hook('evlog:enrich', auditEnricher())\n","server\u002Fplugins\u002Fevlog.ts","typescript","",[465,502,503,536,543],{"__ignoreMap":500},[504,505,508,512,516,520,523,526,529,533],"span",{"class":506,"line":507},"line",1,[504,509,511],{"class":510},"s7zQu","import",[504,513,515],{"class":514},"sMK4o"," {",[504,517,519],{"class":518},"sTEyZ"," auditEnricher",[504,521,522],{"class":514}," }",[504,524,525],{"class":510}," from",[504,527,528],{"class":514}," '",[504,530,532],{"class":531},"sfazB","evlog",[504,534,535],{"class":514},"'\n",[504,537,539],{"class":506,"line":538},2,[504,540,542],{"emptyLinePlaceholder":541},true,"\n",[504,544,546,549,552,555,557,561,564,567,570,572,575,577],{"class":506,"line":545},3,[504,547,548],{"class":518},"nitro",[504,550,551],{"class":514},".",[504,553,554],{"class":518},"hooks",[504,556,551],{"class":514},[504,558,560],{"class":559},"s2Zo4","hook",[504,562,563],{"class":518},"(",[504,565,566],{"class":514},"'",[504,568,569],{"class":531},"evlog:enrich",[504,571,566],{"class":514},[504,573,574],{"class":514},",",[504,576,519],{"class":559},[504,578,579],{"class":518},"())\n",[461,581,582],{},"For multi-tenant apps and custom session bridges, pass options:",[494,584,586],{"className":496,"code":585,"language":499,"meta":500,"style":500},"nitro.hooks.hook('evlog:enrich', auditEnricher({\n  tenantId: ctx => ctx.event.tenant as string | undefined,\n  bridge: { getSession: async ctx => readSessionActor(ctx.headers) },\n}))\n",[465,587,588,617,661,697],{"__ignoreMap":500},[504,589,590,592,594,596,598,600,602,604,606,608,610,612,614],{"class":506,"line":507},[504,591,548],{"class":518},[504,593,551],{"class":514},[504,595,554],{"class":518},[504,597,551],{"class":514},[504,599,560],{"class":559},[504,601,563],{"class":518},[504,603,566],{"class":514},[504,605,569],{"class":531},[504,607,566],{"class":514},[504,609,574],{"class":514},[504,611,519],{"class":559},[504,613,563],{"class":518},[504,615,616],{"class":514},"{\n",[504,618,619,622,625,629,633,635,637,640,642,645,648,652,655,658],{"class":506,"line":538},[504,620,621],{"class":559},"  tenantId",[504,623,624],{"class":514},":",[504,626,628],{"class":627},"sHdIc"," ctx",[504,630,632],{"class":631},"spNyl"," =>",[504,634,628],{"class":518},[504,636,551],{"class":514},[504,638,639],{"class":518},"event",[504,641,551],{"class":514},[504,643,644],{"class":518},"tenant ",[504,646,647],{"class":510},"as",[504,649,651],{"class":650},"sBMFI"," string",[504,653,654],{"class":514}," |",[504,656,657],{"class":650}," undefined",[504,659,660],{"class":514},",\n",[504,662,663,667,669,671,674,676,679,681,683,686,689,691,694],{"class":506,"line":545},[504,664,666],{"class":665},"swJcz","  bridge",[504,668,624],{"class":514},[504,670,515],{"class":514},[504,672,673],{"class":559}," getSession",[504,675,624],{"class":514},[504,677,678],{"class":631}," async",[504,680,628],{"class":627},[504,682,632],{"class":631},[504,684,685],{"class":559}," readSessionActor",[504,687,688],{"class":518},"(ctx",[504,690,551],{"class":514},[504,692,693],{"class":518},"headers) ",[504,695,696],{"class":514},"},\n",[504,698,700,703],{"class":506,"line":699},4,[504,701,702],{"class":514},"}",[504,704,705],{"class":518},"))\n",[461,707,708,709,711,712,715,716,719,720,723],{},"Without ",[465,710,467],{},", ",[465,713,714],{},"audit.context"," stays empty — auditors and incident responders need at least ",[465,717,718],{},"requestId"," and ",[465,721,722],{},"ip"," to triangulate a recorded action.",[478,725,727],{"id":726},"auditonly",[465,728,729],{},"auditOnly()",[731,732,733,737,738,741,742,745,746,749],"tip",{},[734,735,736],"strong",{},"Why filter audits to a separate sink?"," Three reasons: ",[734,739,740],{},"cost"," (audit volume is tiny next to product telemetry — keep them separate so retention costs don't explode), ",[734,743,744],{},"permissions"," (the audit dataset should be read-only for engineers and write-only for the app), and ",[734,747,748],{},"retention"," (audits often live 7+ years; product logs rarely live more than 90 days).",[461,751,752,755,756,759,760,763],{},[465,753,754],{},"auditOnly(drain)"," only forwards events with an ",[465,757,758],{},"audit"," field. Compose with ",[734,761,762],{},"any"," drain:",[494,765,767],{"className":496,"code":766,"language":499,"meta":500,"style":500},"import { auditOnly } from 'evlog'\nimport { createAxiomDrain } from 'evlog\u002Faxiom'\n\n\u002F\u002F Send audits to a dedicated Axiom dataset:\nnitro.hooks.hook('evlog:drain', auditOnly(\n  createAxiomDrain({ dataset: 'audit', token: process.env.AXIOM_AUDIT_TOKEN }),\n))\n",[465,768,769,788,808,812,818,847,896],{"__ignoreMap":500},[504,770,771,773,775,778,780,782,784,786],{"class":506,"line":507},[504,772,511],{"class":510},[504,774,515],{"class":514},[504,776,777],{"class":518}," auditOnly",[504,779,522],{"class":514},[504,781,525],{"class":510},[504,783,528],{"class":514},[504,785,532],{"class":531},[504,787,535],{"class":514},[504,789,790,792,794,797,799,801,803,806],{"class":506,"line":538},[504,791,511],{"class":510},[504,793,515],{"class":514},[504,795,796],{"class":518}," createAxiomDrain",[504,798,522],{"class":514},[504,800,525],{"class":510},[504,802,528],{"class":514},[504,804,805],{"class":531},"evlog\u002Faxiom",[504,807,535],{"class":514},[504,809,810],{"class":506,"line":545},[504,811,542],{"emptyLinePlaceholder":541},[504,813,814],{"class":506,"line":699},[504,815,817],{"class":816},"sHwdD","\u002F\u002F Send audits to a dedicated Axiom dataset:\n",[504,819,821,823,825,827,829,831,833,835,838,840,842,844],{"class":506,"line":820},5,[504,822,548],{"class":518},[504,824,551],{"class":514},[504,826,554],{"class":518},[504,828,551],{"class":514},[504,830,560],{"class":559},[504,832,563],{"class":518},[504,834,566],{"class":514},[504,836,837],{"class":531},"evlog:drain",[504,839,566],{"class":514},[504,841,574],{"class":514},[504,843,777],{"class":559},[504,845,846],{"class":518},"(\n",[504,848,850,853,855,858,861,863,865,867,869,871,874,876,879,881,884,886,889,891,894],{"class":506,"line":849},6,[504,851,852],{"class":559},"  createAxiomDrain",[504,854,563],{"class":518},[504,856,857],{"class":514},"{",[504,859,860],{"class":665}," dataset",[504,862,624],{"class":514},[504,864,528],{"class":514},[504,866,758],{"class":531},[504,868,566],{"class":514},[504,870,574],{"class":514},[504,872,873],{"class":665}," token",[504,875,624],{"class":514},[504,877,878],{"class":518}," process",[504,880,551],{"class":514},[504,882,883],{"class":518},"env",[504,885,551],{"class":514},[504,887,888],{"class":518},"AXIOM_AUDIT_TOKEN ",[504,890,702],{"class":514},[504,892,893],{"class":518},")",[504,895,660],{"class":514},[504,897,899],{"class":506,"line":898},7,[504,900,705],{"class":518},[461,902,903,904,907],{},"Set ",[465,905,906],{},"await: true"," to make audit writes synchronous (no fire-and-forget for audits — crash-safe by default):",[494,909,911],{"className":496,"code":910,"language":499,"meta":500,"style":500},"auditOnly(createFsDrain({ dir: '.audit' }), { await: true })\n",[465,912,913],{"__ignoreMap":500},[504,914,915,917,919,922,924,926,929,931,933,936,938,940,942,944,946,949,951,955,957],{"class":506,"line":507},[504,916,471],{"class":559},[504,918,563],{"class":518},[504,920,921],{"class":559},"createFsDrain",[504,923,563],{"class":518},[504,925,857],{"class":514},[504,927,928],{"class":665}," dir",[504,930,624],{"class":514},[504,932,528],{"class":514},[504,934,935],{"class":531},".audit",[504,937,566],{"class":514},[504,939,522],{"class":514},[504,941,893],{"class":518},[504,943,574],{"class":514},[504,945,515],{"class":514},[504,947,948],{"class":665}," await",[504,950,624],{"class":514},[504,952,954],{"class":953},"sfNiH"," true",[504,956,522],{"class":514},[504,958,959],{"class":518},")\n",[461,961,962,963,965],{},"The ",[465,964,906],{}," flag costs you a small bit of latency per request that records an audit (one synchronous drain call), but guarantees the audit hits disk before the response is sent. For compliance-grade audits, the trade-off is always worth it.",[478,967,968],{"id":475},[465,969,970],{},"signed()",[461,972,973,976],{},[465,974,975],{},"signed(drain, opts)"," adds tamper-evident integrity. Two strategies:",[978,979,980,996],"table",{},[981,982,983],"thead",{},[984,985,986,990,993],"tr",{},[987,988,989],"th",{},"Strategy",[987,991,992],{},"What it adds",[987,994,995],{},"Use case",[997,998,999,1016],"tbody",{},[984,1000,1001,1007,1013],{},[1002,1003,1004],"td",{},[465,1005,1006],{},"'hmac'",[1002,1008,1009,1012],{},[465,1010,1011],{},"event.audit.signature"," (HMAC of the canonical event)",[1002,1014,1015],{},"Single-event integrity check (any later mutation fails verification).",[984,1017,1018,1023,1031],{},[1002,1019,1020],{},[465,1021,1022],{},"'hash-chain'",[1002,1024,1025,719,1028],{},[465,1026,1027],{},"event.audit.prevHash",[465,1029,1030],{},"event.audit.hash",[1002,1032,1033],{},"A verifiable chain — deletions and reordering also become detectable.",[731,1035,1036,1042,1043,1047,1048,1050],{},[734,1037,1038,1039,1041],{},"What ",[465,1040,970],{}," actually buys you."," Detection, not prevention. Anyone with write access to the underlying sink can still nuke the file or table — but the chain proves ",[1044,1045,1046],"em",{},"which"," events were dropped or modified after the fact. Skip ",[465,1049,970],{}," if you already write to an append-only \u002F WORM store (S3 Object Lock, Postgres with row-level immutability, BigQuery append-only tables); doubling integrity layers just adds latency without raising the bar.",[1052,1053,1055],"h3",{"id":1054},"hmac","HMAC",[461,1057,1058],{},"Each event gets a signature. Tampering with one row breaks that row's verification, but doesn't break later rows.",[494,1060,1062],{"className":496,"code":1061,"language":499,"meta":500,"style":500},"import { signed } from 'evlog'\n\nsigned(drain, { strategy: 'hmac', secret: process.env.AUDIT_SECRET! })\n",[465,1063,1064,1083,1087],{"__ignoreMap":500},[504,1065,1066,1068,1070,1073,1075,1077,1079,1081],{"class":506,"line":507},[504,1067,511],{"class":510},[504,1069,515],{"class":514},[504,1071,1072],{"class":518}," signed",[504,1074,522],{"class":514},[504,1076,525],{"class":510},[504,1078,528],{"class":514},[504,1080,532],{"class":531},[504,1082,535],{"class":514},[504,1084,1085],{"class":506,"line":538},[504,1086,542],{"emptyLinePlaceholder":541},[504,1088,1089,1091,1094,1096,1098,1101,1103,1105,1107,1109,1111,1114,1116,1118,1120,1122,1124,1127,1130,1132],{"class":506,"line":545},[504,1090,475],{"class":559},[504,1092,1093],{"class":518},"(drain",[504,1095,574],{"class":514},[504,1097,515],{"class":514},[504,1099,1100],{"class":665}," strategy",[504,1102,624],{"class":514},[504,1104,528],{"class":514},[504,1106,1054],{"class":531},[504,1108,566],{"class":514},[504,1110,574],{"class":514},[504,1112,1113],{"class":665}," secret",[504,1115,624],{"class":514},[504,1117,878],{"class":518},[504,1119,551],{"class":514},[504,1121,883],{"class":518},[504,1123,551],{"class":514},[504,1125,1126],{"class":518},"AUDIT_SECRET",[504,1128,1129],{"class":514},"!",[504,1131,522],{"class":514},[504,1133,959],{"class":518},[1052,1135,1137],{"id":1136},"hash-chain","Hash-chain",[461,1139,1140],{},"Each event references the previous event's hash. Deleting any row breaks the chain forward of that point, so the verifier can pinpoint the exact row that was tampered with.",[494,1142,1144],{"className":496,"code":1143,"language":499,"meta":500,"style":500},"signed(drain, {\n  strategy: 'hash-chain',\n  state: {\n    load: () => fs.readFile('.audit\u002Fhead', 'utf8').catch(() => null),\n    save: (h) => fs.writeFile('.audit\u002Fhead', h),\n  },\n})\n",[465,1145,1146,1157,1172,1181,1240,1279,1284],{"__ignoreMap":500},[504,1147,1148,1150,1152,1154],{"class":506,"line":507},[504,1149,475],{"class":559},[504,1151,1093],{"class":518},[504,1153,574],{"class":514},[504,1155,1156],{"class":514}," {\n",[504,1158,1159,1162,1164,1166,1168,1170],{"class":506,"line":538},[504,1160,1161],{"class":665},"  strategy",[504,1163,624],{"class":514},[504,1165,528],{"class":514},[504,1167,1136],{"class":531},[504,1169,566],{"class":514},[504,1171,660],{"class":514},[504,1173,1174,1177,1179],{"class":506,"line":545},[504,1175,1176],{"class":665},"  state",[504,1178,624],{"class":514},[504,1180,1156],{"class":514},[504,1182,1183,1186,1188,1191,1193,1196,1198,1201,1203,1205,1208,1210,1212,1214,1217,1219,1221,1223,1226,1228,1231,1233,1236,1238],{"class":506,"line":699},[504,1184,1185],{"class":559},"    load",[504,1187,624],{"class":514},[504,1189,1190],{"class":514}," ()",[504,1192,632],{"class":631},[504,1194,1195],{"class":518}," fs",[504,1197,551],{"class":514},[504,1199,1200],{"class":559},"readFile",[504,1202,563],{"class":518},[504,1204,566],{"class":514},[504,1206,1207],{"class":531},".audit\u002Fhead",[504,1209,566],{"class":514},[504,1211,574],{"class":514},[504,1213,528],{"class":514},[504,1215,1216],{"class":531},"utf8",[504,1218,566],{"class":514},[504,1220,893],{"class":518},[504,1222,551],{"class":514},[504,1224,1225],{"class":559},"catch",[504,1227,563],{"class":518},[504,1229,1230],{"class":514},"()",[504,1232,632],{"class":631},[504,1234,1235],{"class":514}," null",[504,1237,893],{"class":518},[504,1239,660],{"class":514},[504,1241,1242,1245,1247,1250,1253,1255,1257,1259,1261,1264,1266,1268,1270,1272,1274,1277],{"class":506,"line":820},[504,1243,1244],{"class":559},"    save",[504,1246,624],{"class":514},[504,1248,1249],{"class":514}," (",[504,1251,1252],{"class":627},"h",[504,1254,893],{"class":514},[504,1256,632],{"class":631},[504,1258,1195],{"class":518},[504,1260,551],{"class":514},[504,1262,1263],{"class":559},"writeFile",[504,1265,563],{"class":518},[504,1267,566],{"class":514},[504,1269,1207],{"class":531},[504,1271,566],{"class":514},[504,1273,574],{"class":514},[504,1275,1276],{"class":518}," h)",[504,1278,660],{"class":514},[504,1280,1281],{"class":506,"line":849},[504,1282,1283],{"class":514},"  },\n",[504,1285,1286,1288],{"class":506,"line":898},[504,1287,702],{"class":514},[504,1289,959],{"class":518},[461,1291,962,1292,1295],{},[465,1293,1294],{},"state"," config is required for cross-process or durable chains: load the previous head hash from your own store (Redis, Postgres, file) before each event, save the new head after.",[1297,1298],"hash-chain-tamper",{},[1300,1301,1302,1303,1306,1307,1310,1311,551],"note",{},"A CLI to walk and verify the chain (",[465,1304,1305],{},"evlog audit verify",") is on the roadmap. Until then, validate by recomputing the hashes of stored events and comparing each ",[465,1308,1309],{},"prevHash"," against the previous event's ",[465,1312,1313],{},"hash",[1315,1316,1317],"style",{},"html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sHdIc, html code.shiki .sHdIc{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#EEFFFF;--shiki-default-font-style:italic;--shiki-dark:#BABED8;--shiki-dark-font-style:italic}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sfNiH, html code.shiki .sfNiH{--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC}",{"title":500,"searchDepth":538,"depth":538,"links":1319},[1320,1321,1322],{"id":480,"depth":538,"text":483},{"id":726,"depth":538,"text":729},{"id":475,"depth":538,"text":970,"children":1323},[1324,1325],{"id":1054,"depth":545,"text":1055},{"id":1136,"depth":545,"text":1137},"auditEnricher to auto-fill request context, auditOnly to route audits to a dedicated sink, and signed for tamper-evident HMAC or hash-chain integrity.","md",[1329,1332],{"label":142,"icon":145,"to":143,"color":1330,"variant":1331},"neutral","subtle",{"label":152,"icon":129,"to":153,"color":1330,"variant":1331},{},{"title":147,"icon":150},{"title":456,"description":1326},"_3JRqd31dDWZXAN9m-j4Ikhyg3JwAr_LT4cmpgR6ppw",[1338,1340],{"title":142,"path":143,"stem":144,"description":1339,"icon":145,"children":-1},"log.audit, log.audit.deny, standalone audit(), withAudit auto-instrumentation, defineAuditAction and defineAuditCatalog registries, and auditDiff change patches.",{"title":152,"path":153,"stem":154,"description":1341,"icon":129,"children":-1},"Integrity, redact presets, GDPR vs append-only, retention windows, and the most common pitfalls when shipping audit logs to production.",1778340939589]