[{"data":1,"prerenderedAt":1276},["ShallowReactive",2],{"navigation_docs":3,"-logging-audit-pipeline":388,"-logging-audit-pipeline-surround":1271},[4,35,155,197,285,372],{"title":5,"path":6,"stem":7,"children":8,"page":34},"Getting Started","\u002Fgetting-started","1.getting-started",[9,14,19,24,29],{"title":10,"path":11,"stem":12,"icon":13},"Introduction","\u002Fgetting-started\u002Fintroduction","1.getting-started\u002F1.introduction","i-lucide-info",{"title":15,"path":16,"stem":17,"icon":18},"Installation","\u002Fgetting-started\u002Finstallation","1.getting-started\u002F2.installation","i-lucide-download",{"title":20,"path":21,"stem":22,"icon":23},"Quick Start","\u002Fgetting-started\u002Fquick-start","1.getting-started\u002F3.quick-start","i-lucide-zap",{"title":25,"path":26,"stem":27,"icon":28},"Agent Skills","\u002Fgetting-started\u002Fagent-skills","1.getting-started\u002F4.agent-skills","i-lucide-sparkles",{"title":30,"path":31,"stem":32,"icon":33},"vs Other Loggers","\u002Fgetting-started\u002Fvs-other-loggers","1.getting-started\u002F5.vs-other-loggers","i-lucide-scale",false,{"title":36,"path":37,"stem":38,"children":39,"page":34},"Logging","\u002Flogging","2.logging",[40,45,50,55,60,65,94,122],{"title":41,"path":42,"stem":43,"icon":44},"Overview","\u002Flogging\u002Foverview","2.logging\u002F0.overview","i-lucide-list",{"title":46,"path":47,"stem":48,"icon":49},"Simple Logging","\u002Flogging\u002Fsimple-logging","2.logging\u002F1.simple-logging","i-lucide-terminal",{"title":51,"path":52,"stem":53,"icon":54},"Wide Events","\u002Flogging\u002Fwide-events","2.logging\u002F2.wide-events","i-lucide-layers",{"title":56,"path":57,"stem":58,"icon":59},"Structured Errors","\u002Flogging\u002Fstructured-errors","2.logging\u002F3.structured-errors","i-lucide-shield-alert",{"title":61,"path":62,"stem":63,"icon":64},"Client Logging","\u002Flogging\u002Fclient-logging","2.logging\u002F4.client-logging","i-lucide-monitor",{"title":66,"icon":67,"path":68,"stem":69,"children":70,"page":34},"AI SDK","i-simple-icons-vercel","\u002Flogging\u002Fai-sdk","2.logging\u002F5.ai-sdk",[71,74,79,84,89],{"title":41,"path":72,"stem":73,"icon":44},"\u002Flogging\u002Fai-sdk\u002Foverview","2.logging\u002F5.ai-sdk\u002F01.overview",{"title":75,"path":76,"stem":77,"icon":78},"Usage","\u002Flogging\u002Fai-sdk\u002Fusage","2.logging\u002F5.ai-sdk\u002F02.usage","i-lucide-code",{"title":80,"path":81,"stem":82,"icon":83},"Options","\u002Flogging\u002Fai-sdk\u002Foptions","2.logging\u002F5.ai-sdk\u002F03.options","i-lucide-sliders",{"title":85,"path":86,"stem":87,"icon":88},"Metadata","\u002Flogging\u002Fai-sdk\u002Fmetadata","2.logging\u002F5.ai-sdk\u002F04.metadata","i-lucide-database",{"title":90,"path":91,"stem":92,"icon":93},"Telemetry","\u002Flogging\u002Fai-sdk\u002Ftelemetry","2.logging\u002F5.ai-sdk\u002F05.telemetry","i-lucide-activity",{"title":95,"icon":96,"path":97,"stem":98,"children":99,"page":34},"Better Auth","i-simple-icons-betterauth","\u002Flogging\u002Fbetter-auth","2.logging\u002F6.better-auth",[100,103,108,113,117],{"title":41,"path":101,"stem":102,"icon":44},"\u002Flogging\u002Fbetter-auth\u002Foverview","2.logging\u002F6.better-auth\u002F01.overview",{"title":104,"path":105,"stem":106,"icon":107},"Identify User","\u002Flogging\u002Fbetter-auth\u002Fidentify-user","2.logging\u002F6.better-auth\u002F02.identify-user","i-lucide-user-check",{"title":109,"path":110,"stem":111,"icon":112},"Middleware","\u002Flogging\u002Fbetter-auth\u002Fmiddleware","2.logging\u002F6.better-auth\u002F03.middleware","i-lucide-shield",{"title":114,"path":115,"stem":116,"icon":64},"Client Sync","\u002Flogging\u002Fbetter-auth\u002Fclient-sync","2.logging\u002F6.better-auth\u002F04.client-sync",{"title":118,"path":119,"stem":120,"icon":121},"Performance","\u002Flogging\u002Fbetter-auth\u002Fperformance","2.logging\u002F6.better-auth\u002F05.performance","i-lucide-gauge",{"title":123,"icon":124,"path":125,"stem":126,"children":127,"page":34},"Audit Logs","i-lucide-shield-check","\u002Flogging\u002Faudit","2.logging\u002F7.audit",[128,131,136,141,146,150],{"title":41,"path":129,"stem":130,"icon":44},"\u002Flogging\u002Faudit\u002Foverview","2.logging\u002F7.audit\u002F01.overview",{"title":132,"path":133,"stem":134,"icon":135},"Schema","\u002Flogging\u002Faudit\u002Fschema","2.logging\u002F7.audit\u002F02.schema","i-lucide-file-text",{"title":137,"path":138,"stem":139,"icon":140},"Recording","\u002Flogging\u002Faudit\u002Frecording","2.logging\u002F7.audit\u002F03.recording","i-lucide-pen-line",{"title":142,"path":143,"stem":144,"icon":145},"Drains","\u002Flogging\u002Faudit\u002Fpipeline","2.logging\u002F7.audit\u002F04.pipeline","i-lucide-link",{"title":147,"path":148,"stem":149,"icon":124},"Compliance","\u002Flogging\u002Faudit\u002Fcompliance","2.logging\u002F7.audit\u002F05.compliance",{"title":151,"path":152,"stem":153,"icon":154},"Recipes","\u002Flogging\u002Faudit\u002Frecipes","2.logging\u002F7.audit\u002F06.recipes","i-lucide-book-open",{"title":156,"path":157,"stem":158,"children":159,"page":34},"Core Concepts","\u002Fcore-concepts","3.core-concepts",[160,165,170,175,180,184,187,192],{"title":161,"path":162,"stem":163,"icon":164},"Lifecycle","\u002Fcore-concepts\u002Flifecycle","3.core-concepts\u002F0.lifecycle","i-lucide-arrow-right-left",{"title":166,"path":167,"stem":168,"icon":169},"Configuration","\u002Fcore-concepts\u002Fconfiguration","3.core-concepts\u002F1.configuration","i-lucide-settings",{"title":171,"path":172,"stem":173,"icon":174},"Sampling","\u002Fcore-concepts\u002Fsampling","3.core-concepts\u002F2.sampling","i-lucide-filter",{"title":176,"path":177,"stem":178,"icon":179},"Typed Fields","\u002Fcore-concepts\u002Ftyped-fields","3.core-concepts\u002F3.typed-fields","i-simple-icons-typescript",{"title":181,"path":182,"stem":183,"icon":124},"Best Practices","\u002Fcore-concepts\u002Fbest-practices","3.core-concepts\u002F4.best-practices",{"title":118,"path":185,"stem":186,"icon":121},"\u002Fcore-concepts\u002Fperformance","3.core-concepts\u002F5.performance",{"title":188,"path":189,"stem":190,"icon":191},"Vite Plugin","\u002Fcore-concepts\u002Fvite-plugin","3.core-concepts\u002F6.vite-plugin","i-custom-vite",{"title":193,"path":194,"stem":195,"icon":196},"Auto-Redaction","\u002Fcore-concepts\u002Fredaction","3.core-concepts\u002F7.redaction","i-lucide-eye-off",{"title":198,"path":199,"stem":200,"children":201,"page":34},"Frameworks","\u002Fframeworks","4.frameworks",[202,206,211,216,221,226,231,236,241,246,251,256,261,266,270,275,280],{"title":41,"path":203,"stem":204,"icon":205},"\u002Fframeworks\u002Foverview","4.frameworks\u002F00.overview","i-lucide-layout-grid",{"title":207,"path":208,"stem":209,"icon":210},"Nuxt","\u002Fframeworks\u002Fnuxt","4.frameworks\u002F01.nuxt","i-simple-icons-nuxtdotjs",{"title":212,"path":213,"stem":214,"icon":215},"Next.js","\u002Fframeworks\u002Fnextjs","4.frameworks\u002F02.nextjs","i-simple-icons-nextdotjs",{"title":217,"path":218,"stem":219,"icon":220},"SvelteKit","\u002Fframeworks\u002Fsveltekit","4.frameworks\u002F03.sveltekit","i-simple-icons-svelte",{"title":222,"path":223,"stem":224,"icon":225},"Nitro","\u002Fframeworks\u002Fnitro","4.frameworks\u002F04.nitro","i-custom-nitro",{"title":227,"path":228,"stem":229,"icon":230},"TanStack Start","\u002Fframeworks\u002Ftanstack-start","4.frameworks\u002F05.tanstack-start","i-custom-tanstack",{"title":232,"path":233,"stem":234,"icon":235},"NestJS","\u002Fframeworks\u002Fnestjs","4.frameworks\u002F06.nestjs","i-simple-icons-nestjs",{"title":237,"path":238,"stem":239,"icon":240},"Express","\u002Fframeworks\u002Fexpress","4.frameworks\u002F07.express","i-simple-icons-express",{"title":242,"path":243,"stem":244,"icon":245},"Hono","\u002Fframeworks\u002Fhono","4.frameworks\u002F08.hono","i-simple-icons-hono",{"title":247,"path":248,"stem":249,"icon":250},"Fastify","\u002Fframeworks\u002Ffastify","4.frameworks\u002F09.fastify","i-simple-icons-fastify",{"title":252,"path":253,"stem":254,"icon":255},"Elysia","\u002Fframeworks\u002Felysia","4.frameworks\u002F10.elysia","i-custom-elysia",{"title":257,"path":258,"stem":259,"icon":260},"React Router","\u002Fframeworks\u002Freact-router","4.frameworks\u002F11.react-router","i-custom-reactrouter",{"title":262,"path":263,"stem":264,"icon":265},"Cloudflare Workers","\u002Fframeworks\u002Fcloudflare-workers","4.frameworks\u002F12.cloudflare-workers","i-simple-icons-cloudflare",{"title":267,"path":268,"stem":269,"icon":179},"Standalone","\u002Fframeworks\u002Fstandalone","4.frameworks\u002F13.standalone",{"title":271,"path":272,"stem":273,"icon":274},"Astro","\u002Fframeworks\u002Fastro","4.frameworks\u002F14.astro","i-simple-icons-astro",{"title":276,"path":277,"stem":278,"icon":279},"AWS Lambda","\u002Fframeworks\u002Faws-lambda","4.frameworks\u002F16.aws-lambda","i-custom-lambda",{"title":281,"path":282,"stem":283,"icon":284},"Custom Integration","\u002Fframeworks\u002Fcustom-integration","4.frameworks\u002F17.custom-integration","i-lucide-puzzle",{"title":286,"path":287,"stem":288,"children":289,"page":34},"Adapters","\u002Fadapters","6.adapters",[290,293,333,348],{"title":41,"path":291,"stem":292,"icon":44},"\u002Fadapters\u002Foverview","6.adapters\u002F01.overview",{"title":294,"path":295,"stem":296,"children":297,"page":34},"Cloud destinations","\u002Fadapters\u002Fcloud","6.adapters\u002F02.cloud",[298,303,308,313,318,323,328],{"title":299,"path":300,"stem":301,"icon":302},"Axiom","\u002Fadapters\u002Fcloud\u002Faxiom","6.adapters\u002F02.cloud\u002F01.axiom","i-custom-axiom",{"title":304,"path":305,"stem":306,"icon":307},"OTLP","\u002Fadapters\u002Fcloud\u002Fotlp","6.adapters\u002F02.cloud\u002F02.otlp","i-simple-icons-opentelemetry",{"title":309,"path":310,"stem":311,"icon":312},"PostHog","\u002Fadapters\u002Fcloud\u002Fposthog","6.adapters\u002F02.cloud\u002F03.posthog","i-simple-icons-posthog",{"title":314,"path":315,"stem":316,"icon":317},"Sentry","\u002Fadapters\u002Fcloud\u002Fsentry","6.adapters\u002F02.cloud\u002F04.sentry","i-simple-icons-sentry",{"title":319,"path":320,"stem":321,"icon":322},"Better Stack","\u002Fadapters\u002Fcloud\u002Fbetter-stack","6.adapters\u002F02.cloud\u002F05.better-stack","i-simple-icons-betterstack",{"title":324,"path":325,"stem":326,"icon":327},"Datadog","\u002Fadapters\u002Fcloud\u002Fdatadog","6.adapters\u002F02.cloud\u002F06.datadog","i-simple-icons-datadog",{"title":329,"path":330,"stem":331,"icon":332},"HyperDX","\u002Fadapters\u002Fcloud\u002Fhyperdx","6.adapters\u002F02.cloud\u002F07.hyperdx","i-custom-hyperdx",{"title":334,"path":335,"stem":336,"children":337,"page":34},"Self-hosted","\u002Fadapters\u002Fself-hosted","6.adapters\u002F03.self-hosted",[338,343],{"title":339,"path":340,"stem":341,"icon":342},"File System","\u002Fadapters\u002Fself-hosted\u002Ffs","6.adapters\u002F03.self-hosted\u002F01.fs","i-lucide-hard-drive",{"title":344,"path":345,"stem":346,"icon":347},"NuxtHub","\u002Fadapters\u002Fself-hosted\u002Fnuxthub","6.adapters\u002F03.self-hosted\u002F02.nuxthub","i-simple-icons-nuxt",{"title":349,"path":350,"stem":351,"children":352,"page":34},"Building blocks","\u002Fadapters\u002Fbuilding-blocks","6.adapters\u002F04.building-blocks",[353,358,363,367],{"title":354,"path":355,"stem":356,"icon":357},"Pipeline","\u002Fadapters\u002Fbuilding-blocks\u002Fpipeline","6.adapters\u002F04.building-blocks\u002F01.pipeline","i-lucide-workflow",{"title":359,"path":360,"stem":361,"icon":362},"HTTP","\u002Fadapters\u002Fbuilding-blocks\u002Fhttp","6.adapters\u002F04.building-blocks\u002F02.http","i-lucide-globe",{"title":364,"path":365,"stem":366,"icon":78},"Custom Adapters","\u002Fadapters\u002Fbuilding-blocks\u002Fcustom","6.adapters\u002F04.building-blocks\u002F03.custom",{"title":368,"path":369,"stem":370,"icon":371},"Toolkit","\u002Fadapters\u002Fbuilding-blocks\u002Ftoolkit","6.adapters\u002F04.building-blocks\u002F04.toolkit","i-lucide-blocks",{"title":373,"path":374,"stem":375,"children":376,"page":34},"Enrichers","\u002Fenrichers","7.enrichers",[377,380,384],{"title":41,"path":378,"stem":379,"icon":28},"\u002Fenrichers\u002Foverview","7.enrichers\u002F1.overview",{"title":381,"path":382,"stem":383,"icon":284},"Built-in","\u002Fenrichers\u002Fbuilt-in","7.enrichers\u002F2.built-in",{"title":385,"path":386,"stem":387,"icon":78},"Custom","\u002Fenrichers\u002Fcustom","7.enrichers\u002F3.custom",{"id":389,"title":390,"body":391,"description":1260,"extension":1261,"links":1262,"meta":1267,"navigation":1268,"path":143,"seo":1269,"stem":144,"__hash__":1270},"docs\u002F2.logging\u002F7.audit\u002F04.pipeline.md","Drains & Integrity",{"type":392,"value":393,"toc":1252},"minimark",[394,411,418,427,514,517,640,658,664,684,698,835,842,894,900,905,911,968,985,990,993,1068,1072,1075,1224,1230,1233,1248],[395,396,397,398,402,403,406,407,410],"p",{},"Three building blocks: ",[399,400,401],"code",{},"auditEnricher"," fills context, ",[399,404,405],{},"auditOnly"," routes audits to a dedicated drain, and ",[399,408,409],{},"signed"," adds tamper-evident integrity. Each is opt-in and replaceable.",[412,413,415],"h2",{"id":414},"auditenricher",[399,416,417],{},"auditEnricher()",[395,419,420,422,423,426],{},[399,421,417],{}," populates ",[399,424,425],{},"event.audit.context.{requestId, traceId, ip, userAgent, tenantId}",". Skip it and ship a custom enricher if your strategy differs.",[428,429,435],"pre",{"className":430,"code":431,"filename":432,"language":433,"meta":434,"style":434},"language-typescript shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","import { auditEnricher } from 'evlog'\n\nnitro.hooks.hook('evlog:enrich', auditEnricher())\n","server\u002Fplugins\u002Fevlog.ts","typescript","",[399,436,437,470,477],{"__ignoreMap":434},[438,439,442,446,450,454,457,460,463,467],"span",{"class":440,"line":441},"line",1,[438,443,445],{"class":444},"s7zQu","import",[438,447,449],{"class":448},"sMK4o"," {",[438,451,453],{"class":452},"sTEyZ"," auditEnricher",[438,455,456],{"class":448}," }",[438,458,459],{"class":444}," from",[438,461,462],{"class":448}," '",[438,464,466],{"class":465},"sfazB","evlog",[438,468,469],{"class":448},"'\n",[438,471,473],{"class":440,"line":472},2,[438,474,476],{"emptyLinePlaceholder":475},true,"\n",[438,478,480,483,486,489,491,495,498,501,504,506,509,511],{"class":440,"line":479},3,[438,481,482],{"class":452},"nitro",[438,484,485],{"class":448},".",[438,487,488],{"class":452},"hooks",[438,490,485],{"class":448},[438,492,494],{"class":493},"s2Zo4","hook",[438,496,497],{"class":452},"(",[438,499,500],{"class":448},"'",[438,502,503],{"class":465},"evlog:enrich",[438,505,500],{"class":448},[438,507,508],{"class":448},",",[438,510,453],{"class":493},[438,512,513],{"class":452},"())\n",[395,515,516],{},"For multi-tenant apps and custom session bridges, pass options:",[428,518,520],{"className":430,"code":519,"language":433,"meta":434,"style":434},"nitro.hooks.hook('evlog:enrich', auditEnricher({\n  tenantId: ctx => ctx.event.tenant as string | undefined,\n  bridge: { getSession: async ctx => readSessionActor(ctx.headers) },\n}))\n",[399,521,522,551,595,631],{"__ignoreMap":434},[438,523,524,526,528,530,532,534,536,538,540,542,544,546,548],{"class":440,"line":441},[438,525,482],{"class":452},[438,527,485],{"class":448},[438,529,488],{"class":452},[438,531,485],{"class":448},[438,533,494],{"class":493},[438,535,497],{"class":452},[438,537,500],{"class":448},[438,539,503],{"class":465},[438,541,500],{"class":448},[438,543,508],{"class":448},[438,545,453],{"class":493},[438,547,497],{"class":452},[438,549,550],{"class":448},"{\n",[438,552,553,556,559,563,567,569,571,574,576,579,582,586,589,592],{"class":440,"line":472},[438,554,555],{"class":493},"  tenantId",[438,557,558],{"class":448},":",[438,560,562],{"class":561},"sHdIc"," ctx",[438,564,566],{"class":565},"spNyl"," =>",[438,568,562],{"class":452},[438,570,485],{"class":448},[438,572,573],{"class":452},"event",[438,575,485],{"class":448},[438,577,578],{"class":452},"tenant ",[438,580,581],{"class":444},"as",[438,583,585],{"class":584},"sBMFI"," string",[438,587,588],{"class":448}," |",[438,590,591],{"class":584}," undefined",[438,593,594],{"class":448},",\n",[438,596,597,601,603,605,608,610,613,615,617,620,623,625,628],{"class":440,"line":479},[438,598,600],{"class":599},"swJcz","  bridge",[438,602,558],{"class":448},[438,604,449],{"class":448},[438,606,607],{"class":493}," getSession",[438,609,558],{"class":448},[438,611,612],{"class":565}," async",[438,614,562],{"class":561},[438,616,566],{"class":565},[438,618,619],{"class":493}," readSessionActor",[438,621,622],{"class":452},"(ctx",[438,624,485],{"class":448},[438,626,627],{"class":452},"headers) ",[438,629,630],{"class":448},"},\n",[438,632,634,637],{"class":440,"line":633},4,[438,635,636],{"class":448},"}",[438,638,639],{"class":452},"))\n",[395,641,642,643,645,646,649,650,653,654,657],{},"Without ",[399,644,401],{},", ",[399,647,648],{},"audit.context"," stays empty — auditors and incident responders need at least ",[399,651,652],{},"requestId"," and ",[399,655,656],{},"ip"," to triangulate a recorded action.",[412,659,661],{"id":660},"auditonly",[399,662,663],{},"auditOnly()",[665,666,667,671,672,675,676,679,680,683],"tip",{},[668,669,670],"strong",{},"Why filter audits to a separate sink?"," Three reasons: ",[668,673,674],{},"cost"," (audit volume is tiny next to product telemetry — keep them separate so retention costs don't explode), ",[668,677,678],{},"permissions"," (the audit dataset should be read-only for engineers and write-only for the app), and ",[668,681,682],{},"retention"," (audits often live 7+ years; product logs rarely live more than 90 days).",[395,685,686,689,690,693,694,697],{},[399,687,688],{},"auditOnly(drain)"," only forwards events with an ",[399,691,692],{},"audit"," field. Compose with ",[668,695,696],{},"any"," drain:",[428,699,701],{"className":430,"code":700,"language":433,"meta":434,"style":434},"import { auditOnly } from 'evlog'\nimport { createAxiomDrain } from 'evlog\u002Faxiom'\n\n\u002F\u002F Send audits to a dedicated Axiom dataset:\nnitro.hooks.hook('evlog:drain', auditOnly(\n  createAxiomDrain({ dataset: 'audit', token: process.env.AXIOM_AUDIT_TOKEN }),\n))\n",[399,702,703,722,742,746,752,781,830],{"__ignoreMap":434},[438,704,705,707,709,712,714,716,718,720],{"class":440,"line":441},[438,706,445],{"class":444},[438,708,449],{"class":448},[438,710,711],{"class":452}," auditOnly",[438,713,456],{"class":448},[438,715,459],{"class":444},[438,717,462],{"class":448},[438,719,466],{"class":465},[438,721,469],{"class":448},[438,723,724,726,728,731,733,735,737,740],{"class":440,"line":472},[438,725,445],{"class":444},[438,727,449],{"class":448},[438,729,730],{"class":452}," createAxiomDrain",[438,732,456],{"class":448},[438,734,459],{"class":444},[438,736,462],{"class":448},[438,738,739],{"class":465},"evlog\u002Faxiom",[438,741,469],{"class":448},[438,743,744],{"class":440,"line":479},[438,745,476],{"emptyLinePlaceholder":475},[438,747,748],{"class":440,"line":633},[438,749,751],{"class":750},"sHwdD","\u002F\u002F Send audits to a dedicated Axiom dataset:\n",[438,753,755,757,759,761,763,765,767,769,772,774,776,778],{"class":440,"line":754},5,[438,756,482],{"class":452},[438,758,485],{"class":448},[438,760,488],{"class":452},[438,762,485],{"class":448},[438,764,494],{"class":493},[438,766,497],{"class":452},[438,768,500],{"class":448},[438,770,771],{"class":465},"evlog:drain",[438,773,500],{"class":448},[438,775,508],{"class":448},[438,777,711],{"class":493},[438,779,780],{"class":452},"(\n",[438,782,784,787,789,792,795,797,799,801,803,805,808,810,813,815,818,820,823,825,828],{"class":440,"line":783},6,[438,785,786],{"class":493},"  createAxiomDrain",[438,788,497],{"class":452},[438,790,791],{"class":448},"{",[438,793,794],{"class":599}," dataset",[438,796,558],{"class":448},[438,798,462],{"class":448},[438,800,692],{"class":465},[438,802,500],{"class":448},[438,804,508],{"class":448},[438,806,807],{"class":599}," token",[438,809,558],{"class":448},[438,811,812],{"class":452}," process",[438,814,485],{"class":448},[438,816,817],{"class":452},"env",[438,819,485],{"class":448},[438,821,822],{"class":452},"AXIOM_AUDIT_TOKEN ",[438,824,636],{"class":448},[438,826,827],{"class":452},")",[438,829,594],{"class":448},[438,831,833],{"class":440,"line":832},7,[438,834,639],{"class":452},[395,836,837,838,841],{},"Set ",[399,839,840],{},"await: true"," to make audit writes synchronous (no fire-and-forget for audits — crash-safe by default):",[428,843,845],{"className":430,"code":844,"language":433,"meta":434,"style":434},"auditOnly(createFsDrain({ dir: '.audit' }), { await: true })\n",[399,846,847],{"__ignoreMap":434},[438,848,849,851,853,856,858,860,863,865,867,870,872,874,876,878,880,883,885,889,891],{"class":440,"line":441},[438,850,405],{"class":493},[438,852,497],{"class":452},[438,854,855],{"class":493},"createFsDrain",[438,857,497],{"class":452},[438,859,791],{"class":448},[438,861,862],{"class":599}," dir",[438,864,558],{"class":448},[438,866,462],{"class":448},[438,868,869],{"class":465},".audit",[438,871,500],{"class":448},[438,873,456],{"class":448},[438,875,827],{"class":452},[438,877,508],{"class":448},[438,879,449],{"class":448},[438,881,882],{"class":599}," await",[438,884,558],{"class":448},[438,886,888],{"class":887},"sfNiH"," true",[438,890,456],{"class":448},[438,892,893],{"class":452},")\n",[395,895,896,897,899],{},"The ",[399,898,840],{}," flag costs you a small bit of latency per request that records an audit (one synchronous drain call), but guarantees the audit hits disk before the response is sent. For compliance-grade audits, the trade-off is always worth it.",[412,901,902],{"id":409},[399,903,904],{},"signed()",[395,906,907,910],{},[399,908,909],{},"signed(drain, opts)"," adds tamper-evident integrity. Two strategies:",[912,913,914,930],"table",{},[915,916,917],"thead",{},[918,919,920,924,927],"tr",{},[921,922,923],"th",{},"Strategy",[921,925,926],{},"What it adds",[921,928,929],{},"Use case",[931,932,933,950],"tbody",{},[918,934,935,941,947],{},[936,937,938],"td",{},[399,939,940],{},"'hmac'",[936,942,943,946],{},[399,944,945],{},"event.audit.signature"," (HMAC of the canonical event)",[936,948,949],{},"Single-event integrity check (any later mutation fails verification).",[918,951,952,957,965],{},[936,953,954],{},[399,955,956],{},"'hash-chain'",[936,958,959,653,962],{},[399,960,961],{},"event.audit.prevHash",[399,963,964],{},"event.audit.hash",[936,966,967],{},"A verifiable chain — deletions and reordering also become detectable.",[665,969,970,976,977,981,982,984],{},[668,971,972,973,975],{},"What ",[399,974,904],{}," actually buys you."," Detection, not prevention. Anyone with write access to the underlying sink can still nuke the file or table — but the chain proves ",[978,979,980],"em",{},"which"," events were dropped or modified after the fact. Skip ",[399,983,904],{}," if you already write to an append-only \u002F WORM store (S3 Object Lock, Postgres with row-level immutability, BigQuery append-only tables); doubling integrity layers just adds latency without raising the bar.",[986,987,989],"h3",{"id":988},"hmac","HMAC",[395,991,992],{},"Each event gets a signature. Tampering with one row breaks that row's verification, but doesn't break later rows.",[428,994,996],{"className":430,"code":995,"language":433,"meta":434,"style":434},"import { signed } from 'evlog'\n\nsigned(drain, { strategy: 'hmac', secret: process.env.AUDIT_SECRET! })\n",[399,997,998,1017,1021],{"__ignoreMap":434},[438,999,1000,1002,1004,1007,1009,1011,1013,1015],{"class":440,"line":441},[438,1001,445],{"class":444},[438,1003,449],{"class":448},[438,1005,1006],{"class":452}," signed",[438,1008,456],{"class":448},[438,1010,459],{"class":444},[438,1012,462],{"class":448},[438,1014,466],{"class":465},[438,1016,469],{"class":448},[438,1018,1019],{"class":440,"line":472},[438,1020,476],{"emptyLinePlaceholder":475},[438,1022,1023,1025,1028,1030,1032,1035,1037,1039,1041,1043,1045,1048,1050,1052,1054,1056,1058,1061,1064,1066],{"class":440,"line":479},[438,1024,409],{"class":493},[438,1026,1027],{"class":452},"(drain",[438,1029,508],{"class":448},[438,1031,449],{"class":448},[438,1033,1034],{"class":599}," strategy",[438,1036,558],{"class":448},[438,1038,462],{"class":448},[438,1040,988],{"class":465},[438,1042,500],{"class":448},[438,1044,508],{"class":448},[438,1046,1047],{"class":599}," secret",[438,1049,558],{"class":448},[438,1051,812],{"class":452},[438,1053,485],{"class":448},[438,1055,817],{"class":452},[438,1057,485],{"class":448},[438,1059,1060],{"class":452},"AUDIT_SECRET",[438,1062,1063],{"class":448},"!",[438,1065,456],{"class":448},[438,1067,893],{"class":452},[986,1069,1071],{"id":1070},"hash-chain","Hash-chain",[395,1073,1074],{},"Each event references the previous event's hash. Deleting any row breaks the chain forward of that point, so the verifier can pinpoint the exact row that was tampered with.",[428,1076,1078],{"className":430,"code":1077,"language":433,"meta":434,"style":434},"signed(drain, {\n  strategy: 'hash-chain',\n  state: {\n    load: () => fs.readFile('.audit\u002Fhead', 'utf8').catch(() => null),\n    save: (h) => fs.writeFile('.audit\u002Fhead', h),\n  },\n})\n",[399,1079,1080,1091,1106,1115,1174,1213,1218],{"__ignoreMap":434},[438,1081,1082,1084,1086,1088],{"class":440,"line":441},[438,1083,409],{"class":493},[438,1085,1027],{"class":452},[438,1087,508],{"class":448},[438,1089,1090],{"class":448}," {\n",[438,1092,1093,1096,1098,1100,1102,1104],{"class":440,"line":472},[438,1094,1095],{"class":599},"  strategy",[438,1097,558],{"class":448},[438,1099,462],{"class":448},[438,1101,1070],{"class":465},[438,1103,500],{"class":448},[438,1105,594],{"class":448},[438,1107,1108,1111,1113],{"class":440,"line":479},[438,1109,1110],{"class":599},"  state",[438,1112,558],{"class":448},[438,1114,1090],{"class":448},[438,1116,1117,1120,1122,1125,1127,1130,1132,1135,1137,1139,1142,1144,1146,1148,1151,1153,1155,1157,1160,1162,1165,1167,1170,1172],{"class":440,"line":633},[438,1118,1119],{"class":493},"    load",[438,1121,558],{"class":448},[438,1123,1124],{"class":448}," ()",[438,1126,566],{"class":565},[438,1128,1129],{"class":452}," fs",[438,1131,485],{"class":448},[438,1133,1134],{"class":493},"readFile",[438,1136,497],{"class":452},[438,1138,500],{"class":448},[438,1140,1141],{"class":465},".audit\u002Fhead",[438,1143,500],{"class":448},[438,1145,508],{"class":448},[438,1147,462],{"class":448},[438,1149,1150],{"class":465},"utf8",[438,1152,500],{"class":448},[438,1154,827],{"class":452},[438,1156,485],{"class":448},[438,1158,1159],{"class":493},"catch",[438,1161,497],{"class":452},[438,1163,1164],{"class":448},"()",[438,1166,566],{"class":565},[438,1168,1169],{"class":448}," null",[438,1171,827],{"class":452},[438,1173,594],{"class":448},[438,1175,1176,1179,1181,1184,1187,1189,1191,1193,1195,1198,1200,1202,1204,1206,1208,1211],{"class":440,"line":754},[438,1177,1178],{"class":493},"    save",[438,1180,558],{"class":448},[438,1182,1183],{"class":448}," (",[438,1185,1186],{"class":561},"h",[438,1188,827],{"class":448},[438,1190,566],{"class":565},[438,1192,1129],{"class":452},[438,1194,485],{"class":448},[438,1196,1197],{"class":493},"writeFile",[438,1199,497],{"class":452},[438,1201,500],{"class":448},[438,1203,1141],{"class":465},[438,1205,500],{"class":448},[438,1207,508],{"class":448},[438,1209,1210],{"class":452}," h)",[438,1212,594],{"class":448},[438,1214,1215],{"class":440,"line":783},[438,1216,1217],{"class":448},"  },\n",[438,1219,1220,1222],{"class":440,"line":832},[438,1221,636],{"class":448},[438,1223,893],{"class":452},[395,1225,896,1226,1229],{},[399,1227,1228],{},"state"," config is required for cross-process or durable chains: load the previous head hash from your own store (Redis, Postgres, file) before each event, save the new head after.",[1231,1232],"hash-chain-tamper",{},[1234,1235,1236,1237,1240,1241,1244,1245,485],"note",{},"A CLI to walk and verify the chain (",[399,1238,1239],{},"evlog audit verify",") is on the roadmap. Until then, validate by recomputing the hashes of stored events and comparing each ",[399,1242,1243],{},"prevHash"," against the previous event's ",[399,1246,1247],{},"hash",[1249,1250,1251],"style",{},"html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sHdIc, html code.shiki .sHdIc{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#EEFFFF;--shiki-default-font-style:italic;--shiki-dark:#BABED8;--shiki-dark-font-style:italic}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sfNiH, html code.shiki .sfNiH{--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC}",{"title":434,"searchDepth":472,"depth":472,"links":1253},[1254,1255,1256],{"id":414,"depth":472,"text":417},{"id":660,"depth":472,"text":663},{"id":409,"depth":472,"text":904,"children":1257},[1258,1259],{"id":988,"depth":479,"text":989},{"id":1070,"depth":479,"text":1071},"auditEnricher to auto-fill request context, auditOnly to route audits to a dedicated sink, and signed for tamper-evident HMAC or hash-chain integrity.","md",[1263,1266],{"label":137,"icon":140,"to":138,"color":1264,"variant":1265},"neutral","subtle",{"label":147,"icon":124,"to":148,"color":1264,"variant":1265},{},{"title":142,"icon":145},{"title":390,"description":1260},"GEXuhugd6TFc7NRoRY3BCs8ZL7SY0MIi_BxCcK9uj1M",[1272,1274],{"title":137,"path":138,"stem":139,"description":1273,"icon":140,"children":-1},"log.audit, log.audit.deny, standalone audit(), withAudit auto-instrumentation, defineAuditAction registries, and auditDiff change patches.",{"title":147,"path":148,"stem":149,"description":1275,"icon":124,"children":-1},"Integrity, redact presets, GDPR vs append-only, retention windows, and the most common pitfalls when shipping audit logs to production.",1777911266366]