[{"data":1,"prerenderedAt":1322},["ShallowReactive",2],{"navigation_docs":3,"-use-cases-audit-pipeline":434,"-use-cases-audit-pipeline-surround":1317},[4,30,80,240,348,403],{"title":5,"path":6,"stem":7,"children":8,"page":29},"Start","\u002Fstart","1.start",[9,14,19,24],{"title":10,"path":11,"stem":12,"icon":13},"Introduction","\u002Fstart\u002Fintroduction","1.start\u002F1.introduction","i-lucide-info",{"title":15,"path":16,"stem":17,"icon":18},"Why start with evlog","\u002Fstart\u002Fwhy-evlog","1.start\u002F2.why-evlog","i-lucide-rocket",{"title":20,"path":21,"stem":22,"icon":23},"Installation","\u002Fstart\u002Finstallation","1.start\u002F3.installation","i-lucide-download",{"title":25,"path":26,"stem":27,"icon":28},"Quick Start","\u002Fstart\u002Fquick-start","1.start\u002F4.quick-start","i-lucide-zap",false,{"title":31,"path":32,"stem":33,"children":34,"page":29},"Learn","\u002Flearn","2.learn",[35,40,45,50,55,60,65,70,75],{"title":36,"path":37,"stem":38,"icon":39},"Overview","\u002Flearn\u002Foverview","2.learn\u002F0.overview","i-lucide-list",{"title":41,"path":42,"stem":43,"icon":44},"Simple Logging","\u002Flearn\u002Fsimple-logging","2.learn\u002F1.simple-logging","i-lucide-terminal",{"title":46,"path":47,"stem":48,"icon":49},"Wide Events","\u002Flearn\u002Fwide-events","2.learn\u002F2.wide-events","i-lucide-layers",{"title":51,"path":52,"stem":53,"icon":54},"Structured Errors","\u002Flearn\u002Fstructured-errors","2.learn\u002F3.structured-errors","i-lucide-shield-alert",{"title":56,"path":57,"stem":58,"icon":59},"Lifecycle","\u002Flearn\u002Flifecycle","2.learn\u002F4.lifecycle","i-lucide-arrow-right-left",{"title":61,"path":62,"stem":63,"icon":64},"Sampling","\u002Flearn\u002Fsampling","2.learn\u002F5.sampling","i-lucide-filter",{"title":66,"path":67,"stem":68,"icon":69},"Auto-Redaction","\u002Flearn\u002Fredaction","2.learn\u002F6.redaction","i-lucide-eye-off",{"title":71,"path":72,"stem":73,"icon":74},"Typed Fields","\u002Flearn\u002Ftyped-fields","2.learn\u002F7.typed-fields","i-simple-icons-typescript",{"title":76,"path":77,"stem":78,"icon":79},"Catalogs","\u002Flearn\u002Fcatalogs","2.learn\u002F8.catalogs","i-lucide-book-open",{"title":81,"path":82,"stem":83,"children":84,"page":29},"Integrate","\u002Fintegrate","3.integrate",[85,89,152],{"title":36,"path":86,"stem":87,"icon":88},"\u002Fintegrate\u002Foverview","3.integrate\u002F0.overview","i-lucide-plug",{"title":90,"path":91,"stem":92,"children":93,"page":29},"Adapters","\u002Fintegrate\u002Fadapters","3.integrate\u002Fadapters",[94,97,137],{"title":36,"path":95,"stem":96,"icon":39},"\u002Fintegrate\u002Fadapters\u002Foverview","3.integrate\u002Fadapters\u002F01.overview",{"title":98,"path":99,"stem":100,"children":101,"page":29},"Cloud","\u002Fintegrate\u002Fadapters\u002Fcloud","3.integrate\u002Fadapters\u002Fcloud",[102,107,112,117,122,127,132],{"title":103,"path":104,"stem":105,"icon":106},"Axiom","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Faxiom","3.integrate\u002Fadapters\u002Fcloud\u002F01.axiom","i-custom-axiom",{"title":108,"path":109,"stem":110,"icon":111},"OTLP","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fotlp","3.integrate\u002Fadapters\u002Fcloud\u002F02.otlp","i-simple-icons-opentelemetry",{"title":113,"path":114,"stem":115,"icon":116},"PostHog","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fposthog","3.integrate\u002Fadapters\u002Fcloud\u002F03.posthog","i-simple-icons-posthog",{"title":118,"path":119,"stem":120,"icon":121},"Sentry","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fsentry","3.integrate\u002Fadapters\u002Fcloud\u002F04.sentry","i-simple-icons-sentry",{"title":123,"path":124,"stem":125,"icon":126},"Better Stack","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fbetter-stack","3.integrate\u002Fadapters\u002Fcloud\u002F05.better-stack","i-simple-icons-betterstack",{"title":128,"path":129,"stem":130,"icon":131},"Datadog","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fdatadog","3.integrate\u002Fadapters\u002Fcloud\u002F06.datadog","i-simple-icons-datadog",{"title":133,"path":134,"stem":135,"icon":136},"HyperDX","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fhyperdx","3.integrate\u002Fadapters\u002Fcloud\u002F07.hyperdx","i-custom-hyperdx",{"title":138,"path":139,"stem":140,"children":141,"page":29},"Self-Hosted","\u002Fintegrate\u002Fadapters\u002Fself-hosted","3.integrate\u002Fadapters\u002Fself-hosted",[142,147],{"title":143,"path":144,"stem":145,"icon":146},"File System","\u002Fintegrate\u002Fadapters\u002Fself-hosted\u002Ffs","3.integrate\u002Fadapters\u002Fself-hosted\u002F01.fs","i-lucide-hard-drive",{"title":148,"path":149,"stem":150,"icon":151},"NuxtHub","\u002Fintegrate\u002Fadapters\u002Fself-hosted\u002Fnuxthub","3.integrate\u002Fadapters\u002Fself-hosted\u002F02.nuxthub","i-simple-icons-nuxt",{"title":153,"path":154,"stem":155,"children":156,"page":29},"Frameworks","\u002Fintegrate\u002Fframeworks","3.integrate\u002Fframeworks",[157,161,166,171,176,181,186,191,196,201,206,211,216,221,225,230,235],{"title":36,"path":158,"stem":159,"icon":160},"\u002Fintegrate\u002Fframeworks\u002Foverview","3.integrate\u002Fframeworks\u002F00.overview","i-lucide-layout-grid",{"title":162,"path":163,"stem":164,"icon":165},"Nuxt","\u002Fintegrate\u002Fframeworks\u002Fnuxt","3.integrate\u002Fframeworks\u002F01.nuxt","i-simple-icons-nuxtdotjs",{"title":167,"path":168,"stem":169,"icon":170},"Next.js","\u002Fintegrate\u002Fframeworks\u002Fnextjs","3.integrate\u002Fframeworks\u002F02.nextjs","i-simple-icons-nextdotjs",{"title":172,"path":173,"stem":174,"icon":175},"SvelteKit","\u002Fintegrate\u002Fframeworks\u002Fsveltekit","3.integrate\u002Fframeworks\u002F03.sveltekit","i-simple-icons-svelte",{"title":177,"path":178,"stem":179,"icon":180},"Nitro","\u002Fintegrate\u002Fframeworks\u002Fnitro","3.integrate\u002Fframeworks\u002F04.nitro","i-custom-nitro",{"title":182,"path":183,"stem":184,"icon":185},"TanStack Start","\u002Fintegrate\u002Fframeworks\u002Ftanstack-start","3.integrate\u002Fframeworks\u002F05.tanstack-start","i-custom-tanstack",{"title":187,"path":188,"stem":189,"icon":190},"NestJS","\u002Fintegrate\u002Fframeworks\u002Fnestjs","3.integrate\u002Fframeworks\u002F06.nestjs","i-simple-icons-nestjs",{"title":192,"path":193,"stem":194,"icon":195},"Express","\u002Fintegrate\u002Fframeworks\u002Fexpress","3.integrate\u002Fframeworks\u002F07.express","i-simple-icons-express",{"title":197,"path":198,"stem":199,"icon":200},"Hono","\u002Fintegrate\u002Fframeworks\u002Fhono","3.integrate\u002Fframeworks\u002F08.hono","i-simple-icons-hono",{"title":202,"path":203,"stem":204,"icon":205},"Fastify","\u002Fintegrate\u002Fframeworks\u002Ffastify","3.integrate\u002Fframeworks\u002F09.fastify","i-simple-icons-fastify",{"title":207,"path":208,"stem":209,"icon":210},"Elysia","\u002Fintegrate\u002Fframeworks\u002Felysia","3.integrate\u002Fframeworks\u002F10.elysia","i-custom-elysia",{"title":212,"path":213,"stem":214,"icon":215},"React Router","\u002Fintegrate\u002Fframeworks\u002Freact-router","3.integrate\u002Fframeworks\u002F11.react-router","i-custom-reactrouter",{"title":217,"path":218,"stem":219,"icon":220},"Cloudflare Workers","\u002Fintegrate\u002Fframeworks\u002Fcloudflare-workers","3.integrate\u002Fframeworks\u002F12.cloudflare-workers","i-simple-icons-cloudflare",{"title":222,"path":223,"stem":224,"icon":74},"Standalone","\u002Fintegrate\u002Fframeworks\u002Fstandalone","3.integrate\u002Fframeworks\u002F13.standalone",{"title":226,"path":227,"stem":228,"icon":229},"Astro","\u002Fintegrate\u002Fframeworks\u002Fastro","3.integrate\u002Fframeworks\u002F14.astro","i-simple-icons-astro",{"title":231,"path":232,"stem":233,"icon":234},"oRPC","\u002Fintegrate\u002Fframeworks\u002Forpc","3.integrate\u002Fframeworks\u002F15.orpc","i-lucide-network",{"title":236,"path":237,"stem":238,"icon":239},"AWS Lambda","\u002Fintegrate\u002Fframeworks\u002Faws-lambda","3.integrate\u002Fframeworks\u002F16.aws-lambda","i-custom-lambda",{"title":241,"path":242,"stem":243,"children":244,"page":29},"Use Cases","\u002Fuse-cases","4.use-cases",[245,249,254,283,311,343],{"title":36,"path":246,"stem":247,"icon":248},"\u002Fuse-cases\u002Foverview","4.use-cases\u002F0.overview","i-lucide-list-checks",{"title":250,"path":251,"stem":252,"icon":253},"Client Logging","\u002Fuse-cases\u002Fclient-logging","4.use-cases\u002F1.client-logging","i-lucide-monitor",{"title":255,"icon":256,"path":257,"stem":258,"children":259,"page":29},"AI SDK","i-simple-icons-vercel","\u002Fuse-cases\u002Fai-sdk","4.use-cases\u002F2.ai-sdk",[260,263,268,273,278],{"title":36,"path":261,"stem":262,"icon":39},"\u002Fuse-cases\u002Fai-sdk\u002Foverview","4.use-cases\u002F2.ai-sdk\u002F01.overview",{"title":264,"path":265,"stem":266,"icon":267},"Usage","\u002Fuse-cases\u002Fai-sdk\u002Fusage","4.use-cases\u002F2.ai-sdk\u002F02.usage","i-lucide-code",{"title":269,"path":270,"stem":271,"icon":272},"Options","\u002Fuse-cases\u002Fai-sdk\u002Foptions","4.use-cases\u002F2.ai-sdk\u002F03.options","i-lucide-sliders",{"title":274,"path":275,"stem":276,"icon":277},"Metadata","\u002Fuse-cases\u002Fai-sdk\u002Fmetadata","4.use-cases\u002F2.ai-sdk\u002F04.metadata","i-lucide-database",{"title":279,"path":280,"stem":281,"icon":282},"Telemetry","\u002Fuse-cases\u002Fai-sdk\u002Ftelemetry","4.use-cases\u002F2.ai-sdk\u002F05.telemetry","i-lucide-activity",{"title":284,"icon":285,"path":286,"stem":287,"children":288,"page":29},"Better Auth","i-simple-icons-betterauth","\u002Fuse-cases\u002Fbetter-auth","4.use-cases\u002F3.better-auth",[289,292,297,302,306],{"title":36,"path":290,"stem":291,"icon":39},"\u002Fuse-cases\u002Fbetter-auth\u002Foverview","4.use-cases\u002F3.better-auth\u002F01.overview",{"title":293,"path":294,"stem":295,"icon":296},"Identify User","\u002Fuse-cases\u002Fbetter-auth\u002Fidentify-user","4.use-cases\u002F3.better-auth\u002F02.identify-user","i-lucide-user-check",{"title":298,"path":299,"stem":300,"icon":301},"Middleware","\u002Fuse-cases\u002Fbetter-auth\u002Fmiddleware","4.use-cases\u002F3.better-auth\u002F03.middleware","i-lucide-shield",{"title":303,"path":304,"stem":305,"icon":253},"Client Sync","\u002Fuse-cases\u002Fbetter-auth\u002Fclient-sync","4.use-cases\u002F3.better-auth\u002F04.client-sync",{"title":307,"path":308,"stem":309,"icon":310},"Performance","\u002Fuse-cases\u002Fbetter-auth\u002Fperformance","4.use-cases\u002F3.better-auth\u002F05.performance","i-lucide-gauge",{"title":312,"icon":313,"path":314,"stem":315,"children":316,"page":29},"Audit Logs","i-lucide-shield-check","\u002Fuse-cases\u002Faudit","4.use-cases\u002F4.audit",[317,320,325,330,335,339],{"title":36,"path":318,"stem":319,"icon":39},"\u002Fuse-cases\u002Faudit\u002Foverview","4.use-cases\u002F4.audit\u002F01.overview",{"title":321,"path":322,"stem":323,"icon":324},"Schema","\u002Fuse-cases\u002Faudit\u002Fschema","4.use-cases\u002F4.audit\u002F02.schema","i-lucide-file-text",{"title":326,"path":327,"stem":328,"icon":329},"Recording","\u002Fuse-cases\u002Faudit\u002Frecording","4.use-cases\u002F4.audit\u002F03.recording","i-lucide-pen-line",{"title":331,"path":332,"stem":333,"icon":334},"Drains","\u002Fuse-cases\u002Faudit\u002Fpipeline","4.use-cases\u002F4.audit\u002F04.pipeline","i-lucide-link",{"title":336,"path":337,"stem":338,"icon":313},"Compliance","\u002Fuse-cases\u002Faudit\u002Fcompliance","4.use-cases\u002F4.audit\u002F05.compliance",{"title":340,"path":341,"stem":342,"icon":79},"Recipes","\u002Fuse-cases\u002Faudit\u002Frecipes","4.use-cases\u002F4.audit\u002F06.recipes",{"title":344,"path":345,"stem":346,"icon":347},"Enrichers","\u002Fuse-cases\u002Fenrichers","4.use-cases\u002F5.enrichers","i-lucide-sparkles",{"title":349,"path":350,"stem":351,"children":352,"page":29},"Extend","\u002Fextend","5.extend",[353,357,362,367,372,376,380,384,388,393,398],{"title":36,"path":354,"stem":355,"icon":356},"\u002Fextend\u002Foverview","5.extend\u002F0.overview","i-lucide-blocks",{"title":358,"path":359,"stem":360,"icon":361},"Stream","\u002Fextend\u002Fstream","5.extend\u002F1.stream","i-lucide-radio-tower",{"title":363,"path":364,"stem":365,"icon":366},"Custom framework","\u002Fextend\u002Fcustom-framework","5.extend\u002F10.custom-framework","i-lucide-puzzle",{"title":368,"path":369,"stem":370,"icon":371},"FS reader","\u002Fextend\u002Ffs-reader","5.extend\u002F2.fs-reader","i-lucide-folder-search",{"title":340,"path":373,"stem":374,"icon":375},"\u002Fextend\u002Fconsumer-recipes","5.extend\u002F3.consumer-recipes","i-lucide-chef-hat",{"title":377,"path":378,"stem":379,"icon":356},"Plugins","\u002Fextend\u002Fplugins","5.extend\u002F4.plugins",{"title":381,"path":382,"stem":383,"icon":347},"Custom enrichers","\u002Fextend\u002Fcustom-enrichers","5.extend\u002F5.custom-enrichers",{"title":385,"path":386,"stem":387,"icon":64},"Tail sampling","\u002Fextend\u002Ftail-sampling","5.extend\u002F6.tail-sampling",{"title":389,"path":390,"stem":391,"icon":392},"Identity headers","\u002Fextend\u002Fidentity-headers","5.extend\u002F7.identity-headers","i-lucide-fingerprint",{"title":394,"path":395,"stem":396,"icon":397},"Custom drains","\u002Fextend\u002Fcustom-drains","5.extend\u002F8.custom-drains","i-lucide-share-2",{"title":399,"path":400,"stem":401,"icon":402},"Drain pipeline","\u002Fextend\u002Fdrain-pipeline","5.extend\u002F9.drain-pipeline","i-lucide-workflow",{"title":404,"path":405,"stem":406,"children":407,"page":29},"Reference","\u002Freference","6.reference",[408,413,416,421,425,430],{"title":409,"path":410,"stem":411,"icon":412},"Configuration","\u002Freference\u002Fconfiguration","6.reference\u002F1.configuration","i-lucide-settings",{"title":307,"path":414,"stem":415,"icon":310},"\u002Freference\u002Fperformance","6.reference\u002F2.performance",{"title":417,"path":418,"stem":419,"icon":420},"Vite Plugin","\u002Freference\u002Fvite-plugin","6.reference\u002F3.vite-plugin","i-custom-vite",{"title":422,"path":423,"stem":424,"icon":313},"Best Practices","\u002Freference\u002Fbest-practices","6.reference\u002F4.best-practices",{"title":426,"path":427,"stem":428,"icon":429},"vs Other Loggers","\u002Freference\u002Fvs-other-loggers","6.reference\u002F5.vs-other-loggers","i-lucide-scale",{"title":431,"path":432,"stem":433,"icon":347},"Agent Skills","\u002Freference\u002Fagent-skills","6.reference\u002F6.agent-skills",{"id":435,"title":436,"body":437,"description":1306,"extension":1307,"links":1308,"meta":1313,"navigation":1314,"path":332,"seo":1315,"stem":333,"__hash__":1316},"docs\u002F4.use-cases\u002F4.audit\u002F04.pipeline.md","Drains & Integrity",{"type":438,"value":439,"toc":1298},"minimark",[440,457,464,473,560,563,686,704,710,730,744,881,888,940,946,951,957,1014,1031,1036,1039,1114,1118,1121,1270,1276,1279,1294],[441,442,443,444,448,449,452,453,456],"p",{},"Three building blocks: ",[445,446,447],"code",{},"auditEnricher"," fills context, ",[445,450,451],{},"auditOnly"," routes audits to a dedicated drain, and ",[445,454,455],{},"signed"," adds tamper-evident integrity. Each is opt-in and replaceable.",[458,459,461],"h2",{"id":460},"auditenricher",[445,462,463],{},"auditEnricher()",[441,465,466,468,469,472],{},[445,467,463],{}," populates ",[445,470,471],{},"event.audit.context.{requestId, traceId, ip, userAgent, tenantId}",". Skip it and ship a custom enricher if your strategy differs.",[474,475,481],"pre",{"className":476,"code":477,"filename":478,"language":479,"meta":480,"style":480},"language-typescript shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","import { auditEnricher } from 'evlog'\n\nnitro.hooks.hook('evlog:enrich', auditEnricher())\n","server\u002Fplugins\u002Fevlog.ts","typescript","",[445,482,483,516,523],{"__ignoreMap":480},[484,485,488,492,496,500,503,506,509,513],"span",{"class":486,"line":487},"line",1,[484,489,491],{"class":490},"s7zQu","import",[484,493,495],{"class":494},"sMK4o"," {",[484,497,499],{"class":498},"sTEyZ"," auditEnricher",[484,501,502],{"class":494}," }",[484,504,505],{"class":490}," from",[484,507,508],{"class":494}," '",[484,510,512],{"class":511},"sfazB","evlog",[484,514,515],{"class":494},"'\n",[484,517,519],{"class":486,"line":518},2,[484,520,522],{"emptyLinePlaceholder":521},true,"\n",[484,524,526,529,532,535,537,541,544,547,550,552,555,557],{"class":486,"line":525},3,[484,527,528],{"class":498},"nitro",[484,530,531],{"class":494},".",[484,533,534],{"class":498},"hooks",[484,536,531],{"class":494},[484,538,540],{"class":539},"s2Zo4","hook",[484,542,543],{"class":498},"(",[484,545,546],{"class":494},"'",[484,548,549],{"class":511},"evlog:enrich",[484,551,546],{"class":494},[484,553,554],{"class":494},",",[484,556,499],{"class":539},[484,558,559],{"class":498},"())\n",[441,561,562],{},"For multi-tenant apps and custom session bridges, pass options:",[474,564,566],{"className":476,"code":565,"language":479,"meta":480,"style":480},"nitro.hooks.hook('evlog:enrich', auditEnricher({\n  tenantId: ctx => ctx.event.tenant as string | undefined,\n  bridge: { getSession: async ctx => readSessionActor(ctx.headers) },\n}))\n",[445,567,568,597,641,677],{"__ignoreMap":480},[484,569,570,572,574,576,578,580,582,584,586,588,590,592,594],{"class":486,"line":487},[484,571,528],{"class":498},[484,573,531],{"class":494},[484,575,534],{"class":498},[484,577,531],{"class":494},[484,579,540],{"class":539},[484,581,543],{"class":498},[484,583,546],{"class":494},[484,585,549],{"class":511},[484,587,546],{"class":494},[484,589,554],{"class":494},[484,591,499],{"class":539},[484,593,543],{"class":498},[484,595,596],{"class":494},"{\n",[484,598,599,602,605,609,613,615,617,620,622,625,628,632,635,638],{"class":486,"line":518},[484,600,601],{"class":539},"  tenantId",[484,603,604],{"class":494},":",[484,606,608],{"class":607},"sHdIc"," ctx",[484,610,612],{"class":611},"spNyl"," =>",[484,614,608],{"class":498},[484,616,531],{"class":494},[484,618,619],{"class":498},"event",[484,621,531],{"class":494},[484,623,624],{"class":498},"tenant ",[484,626,627],{"class":490},"as",[484,629,631],{"class":630},"sBMFI"," string",[484,633,634],{"class":494}," |",[484,636,637],{"class":630}," undefined",[484,639,640],{"class":494},",\n",[484,642,643,647,649,651,654,656,659,661,663,666,669,671,674],{"class":486,"line":525},[484,644,646],{"class":645},"swJcz","  bridge",[484,648,604],{"class":494},[484,650,495],{"class":494},[484,652,653],{"class":539}," getSession",[484,655,604],{"class":494},[484,657,658],{"class":611}," async",[484,660,608],{"class":607},[484,662,612],{"class":611},[484,664,665],{"class":539}," readSessionActor",[484,667,668],{"class":498},"(ctx",[484,670,531],{"class":494},[484,672,673],{"class":498},"headers) ",[484,675,676],{"class":494},"},\n",[484,678,680,683],{"class":486,"line":679},4,[484,681,682],{"class":494},"}",[484,684,685],{"class":498},"))\n",[441,687,688,689,691,692,695,696,699,700,703],{},"Without ",[445,690,447],{},", ",[445,693,694],{},"audit.context"," stays empty — auditors and incident responders need at least ",[445,697,698],{},"requestId"," and ",[445,701,702],{},"ip"," to triangulate a recorded action.",[458,705,707],{"id":706},"auditonly",[445,708,709],{},"auditOnly()",[711,712,713,717,718,721,722,725,726,729],"tip",{},[714,715,716],"strong",{},"Why filter audits to a separate sink?"," Three reasons: ",[714,719,720],{},"cost"," (audit volume is tiny next to product telemetry — keep them separate so retention costs don't explode), ",[714,723,724],{},"permissions"," (the audit dataset should be read-only for engineers and write-only for the app), and ",[714,727,728],{},"retention"," (audits often live 7+ years; product logs rarely live more than 90 days).",[441,731,732,735,736,739,740,743],{},[445,733,734],{},"auditOnly(drain)"," only forwards events with an ",[445,737,738],{},"audit"," field. Compose with ",[714,741,742],{},"any"," drain:",[474,745,747],{"className":476,"code":746,"language":479,"meta":480,"style":480},"import { auditOnly } from 'evlog'\nimport { createAxiomDrain } from 'evlog\u002Faxiom'\n\n\u002F\u002F Send audits to a dedicated Axiom dataset:\nnitro.hooks.hook('evlog:drain', auditOnly(\n  createAxiomDrain({ dataset: 'audit', token: process.env.AXIOM_AUDIT_TOKEN }),\n))\n",[445,748,749,768,788,792,798,827,876],{"__ignoreMap":480},[484,750,751,753,755,758,760,762,764,766],{"class":486,"line":487},[484,752,491],{"class":490},[484,754,495],{"class":494},[484,756,757],{"class":498}," auditOnly",[484,759,502],{"class":494},[484,761,505],{"class":490},[484,763,508],{"class":494},[484,765,512],{"class":511},[484,767,515],{"class":494},[484,769,770,772,774,777,779,781,783,786],{"class":486,"line":518},[484,771,491],{"class":490},[484,773,495],{"class":494},[484,775,776],{"class":498}," createAxiomDrain",[484,778,502],{"class":494},[484,780,505],{"class":490},[484,782,508],{"class":494},[484,784,785],{"class":511},"evlog\u002Faxiom",[484,787,515],{"class":494},[484,789,790],{"class":486,"line":525},[484,791,522],{"emptyLinePlaceholder":521},[484,793,794],{"class":486,"line":679},[484,795,797],{"class":796},"sHwdD","\u002F\u002F Send audits to a dedicated Axiom dataset:\n",[484,799,801,803,805,807,809,811,813,815,818,820,822,824],{"class":486,"line":800},5,[484,802,528],{"class":498},[484,804,531],{"class":494},[484,806,534],{"class":498},[484,808,531],{"class":494},[484,810,540],{"class":539},[484,812,543],{"class":498},[484,814,546],{"class":494},[484,816,817],{"class":511},"evlog:drain",[484,819,546],{"class":494},[484,821,554],{"class":494},[484,823,757],{"class":539},[484,825,826],{"class":498},"(\n",[484,828,830,833,835,838,841,843,845,847,849,851,854,856,859,861,864,866,869,871,874],{"class":486,"line":829},6,[484,831,832],{"class":539},"  createAxiomDrain",[484,834,543],{"class":498},[484,836,837],{"class":494},"{",[484,839,840],{"class":645}," dataset",[484,842,604],{"class":494},[484,844,508],{"class":494},[484,846,738],{"class":511},[484,848,546],{"class":494},[484,850,554],{"class":494},[484,852,853],{"class":645}," token",[484,855,604],{"class":494},[484,857,858],{"class":498}," process",[484,860,531],{"class":494},[484,862,863],{"class":498},"env",[484,865,531],{"class":494},[484,867,868],{"class":498},"AXIOM_AUDIT_TOKEN ",[484,870,682],{"class":494},[484,872,873],{"class":498},")",[484,875,640],{"class":494},[484,877,879],{"class":486,"line":878},7,[484,880,685],{"class":498},[441,882,883,884,887],{},"Set ",[445,885,886],{},"await: true"," to make audit writes synchronous (no fire-and-forget for audits — crash-safe by default):",[474,889,891],{"className":476,"code":890,"language":479,"meta":480,"style":480},"auditOnly(createFsDrain({ dir: '.audit' }), { await: true })\n",[445,892,893],{"__ignoreMap":480},[484,894,895,897,899,902,904,906,909,911,913,916,918,920,922,924,926,929,931,935,937],{"class":486,"line":487},[484,896,451],{"class":539},[484,898,543],{"class":498},[484,900,901],{"class":539},"createFsDrain",[484,903,543],{"class":498},[484,905,837],{"class":494},[484,907,908],{"class":645}," dir",[484,910,604],{"class":494},[484,912,508],{"class":494},[484,914,915],{"class":511},".audit",[484,917,546],{"class":494},[484,919,502],{"class":494},[484,921,873],{"class":498},[484,923,554],{"class":494},[484,925,495],{"class":494},[484,927,928],{"class":645}," await",[484,930,604],{"class":494},[484,932,934],{"class":933},"sfNiH"," true",[484,936,502],{"class":494},[484,938,939],{"class":498},")\n",[441,941,942,943,945],{},"The ",[445,944,886],{}," flag costs you a small bit of latency per request that records an audit (one synchronous drain call), but guarantees the audit hits disk before the response is sent. For compliance-grade audits, the trade-off is always worth it.",[458,947,948],{"id":455},[445,949,950],{},"signed()",[441,952,953,956],{},[445,954,955],{},"signed(drain, opts)"," adds tamper-evident integrity. Two strategies:",[958,959,960,976],"table",{},[961,962,963],"thead",{},[964,965,966,970,973],"tr",{},[967,968,969],"th",{},"Strategy",[967,971,972],{},"What it adds",[967,974,975],{},"Use case",[977,978,979,996],"tbody",{},[964,980,981,987,993],{},[982,983,984],"td",{},[445,985,986],{},"'hmac'",[982,988,989,992],{},[445,990,991],{},"event.audit.signature"," (HMAC of the canonical event)",[982,994,995],{},"Single-event integrity check (any later mutation fails verification).",[964,997,998,1003,1011],{},[982,999,1000],{},[445,1001,1002],{},"'hash-chain'",[982,1004,1005,699,1008],{},[445,1006,1007],{},"event.audit.prevHash",[445,1009,1010],{},"event.audit.hash",[982,1012,1013],{},"A verifiable chain — deletions and reordering also become detectable.",[711,1015,1016,1022,1023,1027,1028,1030],{},[714,1017,1018,1019,1021],{},"What ",[445,1020,950],{}," actually buys you."," Detection, not prevention. Anyone with write access to the underlying sink can still nuke the file or table — but the chain proves ",[1024,1025,1026],"em",{},"which"," events were dropped or modified after the fact. Skip ",[445,1029,950],{}," if you already write to an append-only \u002F WORM store (S3 Object Lock, Postgres with row-level immutability, BigQuery append-only tables); doubling integrity layers just adds latency without raising the bar.",[1032,1033,1035],"h3",{"id":1034},"hmac","HMAC",[441,1037,1038],{},"Each event gets a signature. Tampering with one row breaks that row's verification, but doesn't break later rows.",[474,1040,1042],{"className":476,"code":1041,"language":479,"meta":480,"style":480},"import { signed } from 'evlog'\n\nsigned(drain, { strategy: 'hmac', secret: process.env.AUDIT_SECRET! })\n",[445,1043,1044,1063,1067],{"__ignoreMap":480},[484,1045,1046,1048,1050,1053,1055,1057,1059,1061],{"class":486,"line":487},[484,1047,491],{"class":490},[484,1049,495],{"class":494},[484,1051,1052],{"class":498}," signed",[484,1054,502],{"class":494},[484,1056,505],{"class":490},[484,1058,508],{"class":494},[484,1060,512],{"class":511},[484,1062,515],{"class":494},[484,1064,1065],{"class":486,"line":518},[484,1066,522],{"emptyLinePlaceholder":521},[484,1068,1069,1071,1074,1076,1078,1081,1083,1085,1087,1089,1091,1094,1096,1098,1100,1102,1104,1107,1110,1112],{"class":486,"line":525},[484,1070,455],{"class":539},[484,1072,1073],{"class":498},"(drain",[484,1075,554],{"class":494},[484,1077,495],{"class":494},[484,1079,1080],{"class":645}," strategy",[484,1082,604],{"class":494},[484,1084,508],{"class":494},[484,1086,1034],{"class":511},[484,1088,546],{"class":494},[484,1090,554],{"class":494},[484,1092,1093],{"class":645}," secret",[484,1095,604],{"class":494},[484,1097,858],{"class":498},[484,1099,531],{"class":494},[484,1101,863],{"class":498},[484,1103,531],{"class":494},[484,1105,1106],{"class":498},"AUDIT_SECRET",[484,1108,1109],{"class":494},"!",[484,1111,502],{"class":494},[484,1113,939],{"class":498},[1032,1115,1117],{"id":1116},"hash-chain","Hash-chain",[441,1119,1120],{},"Each event references the previous event's hash. Deleting any row breaks the chain forward of that point, so the verifier can pinpoint the exact row that was tampered with.",[474,1122,1124],{"className":476,"code":1123,"language":479,"meta":480,"style":480},"signed(drain, {\n  strategy: 'hash-chain',\n  state: {\n    load: () => fs.readFile('.audit\u002Fhead', 'utf8').catch(() => null),\n    save: (h) => fs.writeFile('.audit\u002Fhead', h),\n  },\n})\n",[445,1125,1126,1137,1152,1161,1220,1259,1264],{"__ignoreMap":480},[484,1127,1128,1130,1132,1134],{"class":486,"line":487},[484,1129,455],{"class":539},[484,1131,1073],{"class":498},[484,1133,554],{"class":494},[484,1135,1136],{"class":494}," {\n",[484,1138,1139,1142,1144,1146,1148,1150],{"class":486,"line":518},[484,1140,1141],{"class":645},"  strategy",[484,1143,604],{"class":494},[484,1145,508],{"class":494},[484,1147,1116],{"class":511},[484,1149,546],{"class":494},[484,1151,640],{"class":494},[484,1153,1154,1157,1159],{"class":486,"line":525},[484,1155,1156],{"class":645},"  state",[484,1158,604],{"class":494},[484,1160,1136],{"class":494},[484,1162,1163,1166,1168,1171,1173,1176,1178,1181,1183,1185,1188,1190,1192,1194,1197,1199,1201,1203,1206,1208,1211,1213,1216,1218],{"class":486,"line":679},[484,1164,1165],{"class":539},"    load",[484,1167,604],{"class":494},[484,1169,1170],{"class":494}," ()",[484,1172,612],{"class":611},[484,1174,1175],{"class":498}," fs",[484,1177,531],{"class":494},[484,1179,1180],{"class":539},"readFile",[484,1182,543],{"class":498},[484,1184,546],{"class":494},[484,1186,1187],{"class":511},".audit\u002Fhead",[484,1189,546],{"class":494},[484,1191,554],{"class":494},[484,1193,508],{"class":494},[484,1195,1196],{"class":511},"utf8",[484,1198,546],{"class":494},[484,1200,873],{"class":498},[484,1202,531],{"class":494},[484,1204,1205],{"class":539},"catch",[484,1207,543],{"class":498},[484,1209,1210],{"class":494},"()",[484,1212,612],{"class":611},[484,1214,1215],{"class":494}," null",[484,1217,873],{"class":498},[484,1219,640],{"class":494},[484,1221,1222,1225,1227,1230,1233,1235,1237,1239,1241,1244,1246,1248,1250,1252,1254,1257],{"class":486,"line":800},[484,1223,1224],{"class":539},"    save",[484,1226,604],{"class":494},[484,1228,1229],{"class":494}," (",[484,1231,1232],{"class":607},"h",[484,1234,873],{"class":494},[484,1236,612],{"class":611},[484,1238,1175],{"class":498},[484,1240,531],{"class":494},[484,1242,1243],{"class":539},"writeFile",[484,1245,543],{"class":498},[484,1247,546],{"class":494},[484,1249,1187],{"class":511},[484,1251,546],{"class":494},[484,1253,554],{"class":494},[484,1255,1256],{"class":498}," h)",[484,1258,640],{"class":494},[484,1260,1261],{"class":486,"line":829},[484,1262,1263],{"class":494},"  },\n",[484,1265,1266,1268],{"class":486,"line":878},[484,1267,682],{"class":494},[484,1269,939],{"class":498},[441,1271,942,1272,1275],{},[445,1273,1274],{},"state"," config is required for cross-process or durable chains: load the previous head hash from your own store (Redis, Postgres, file) before each event, save the new head after.",[1277,1278],"hash-chain-tamper",{},[1280,1281,1282,1283,1286,1287,1290,1291,531],"note",{},"A CLI to walk and verify the chain (",[445,1284,1285],{},"evlog audit verify",") is on the roadmap. Until then, validate by recomputing the hashes of stored events and comparing each ",[445,1288,1289],{},"prevHash"," against the previous event's ",[445,1292,1293],{},"hash",[1295,1296,1297],"style",{},"html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sHdIc, html code.shiki .sHdIc{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#EEFFFF;--shiki-default-font-style:italic;--shiki-dark:#BABED8;--shiki-dark-font-style:italic}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sfNiH, html code.shiki .sfNiH{--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC}",{"title":480,"searchDepth":518,"depth":518,"links":1299},[1300,1301,1302],{"id":460,"depth":518,"text":463},{"id":706,"depth":518,"text":709},{"id":455,"depth":518,"text":950,"children":1303},[1304,1305],{"id":1034,"depth":525,"text":1035},{"id":1116,"depth":525,"text":1117},"auditEnricher to auto-fill request context, auditOnly to route audits to a dedicated sink, and signed for tamper-evident HMAC or hash-chain integrity.","md",[1309,1312],{"label":326,"icon":329,"to":327,"color":1310,"variant":1311},"neutral","subtle",{"label":336,"icon":313,"to":337,"color":1310,"variant":1311},{},{"title":331,"icon":334},{"title":436,"description":1306},"LSIG7lYQpD2WWwt5mxihPEgrxDkMPCXYx3ekIMTwyWk",[1318,1320],{"title":326,"path":327,"stem":328,"description":1319,"icon":329,"children":-1},"log.audit, log.audit.deny, standalone audit(), withAudit auto-instrumentation, defineAuditAction and defineAuditCatalog registries, and auditDiff change patches.",{"title":336,"path":337,"stem":338,"description":1321,"icon":313,"children":-1},"Integrity, redact presets, GDPR vs append-only, retention windows, and the most common pitfalls when shipping audit logs to production.",1778445519908]