[{"data":1,"prerenderedAt":1112},["ShallowReactive",2],{"navigation_docs":3,"-logging-audit-compliance":547,"-logging-audit-compliance-surround":1107},[4,35,159,201,289,446,531],{"title":5,"path":6,"stem":7,"children":8,"page":34},"Getting Started","\u002Fgetting-started","1.getting-started",[9,14,19,24,29],{"title":10,"path":11,"stem":12,"icon":13},"Introduction","\u002Fgetting-started\u002Fintroduction","1.getting-started\u002F1.introduction","i-lucide-info",{"title":15,"path":16,"stem":17,"icon":18},"Installation","\u002Fgetting-started\u002Finstallation","1.getting-started\u002F2.installation","i-lucide-download",{"title":20,"path":21,"stem":22,"icon":23},"Quick Start","\u002Fgetting-started\u002Fquick-start","1.getting-started\u002F3.quick-start","i-lucide-zap",{"title":25,"path":26,"stem":27,"icon":28},"Agent Skills","\u002Fgetting-started\u002Fagent-skills","1.getting-started\u002F4.agent-skills","i-lucide-sparkles",{"title":30,"path":31,"stem":32,"icon":33},"vs Other Loggers","\u002Fgetting-started\u002Fvs-other-loggers","1.getting-started\u002F5.vs-other-loggers","i-lucide-scale",false,{"title":36,"path":37,"stem":38,"children":39,"page":34},"Logging","\u002Flogging","2.logging",[40,45,50,55,60,65,70,99,127],{"title":41,"path":42,"stem":43,"icon":44},"Overview","\u002Flogging\u002Foverview","2.logging\u002F0.overview","i-lucide-list",{"title":46,"path":47,"stem":48,"icon":49},"Simple Logging","\u002Flogging\u002Fsimple-logging","2.logging\u002F1.simple-logging","i-lucide-terminal",{"title":51,"path":52,"stem":53,"icon":54},"Wide Events","\u002Flogging\u002Fwide-events","2.logging\u002F2.wide-events","i-lucide-layers",{"title":56,"path":57,"stem":58,"icon":59},"Structured Errors","\u002Flogging\u002Fstructured-errors","2.logging\u002F3.structured-errors","i-lucide-shield-alert",{"title":61,"path":62,"stem":63,"icon":64},"Catalogs","\u002Flogging\u002Fcatalogs","2.logging\u002F4.catalogs","i-lucide-book-open",{"title":66,"path":67,"stem":68,"icon":69},"Client Logging","\u002Flogging\u002Fclient-logging","2.logging\u002F5.client-logging","i-lucide-monitor",{"title":71,"icon":72,"path":73,"stem":74,"children":75,"page":34},"AI SDK","i-simple-icons-vercel","\u002Flogging\u002Fai-sdk","2.logging\u002F6.ai-sdk",[76,79,84,89,94],{"title":41,"path":77,"stem":78,"icon":44},"\u002Flogging\u002Fai-sdk\u002Foverview","2.logging\u002F6.ai-sdk\u002F01.overview",{"title":80,"path":81,"stem":82,"icon":83},"Usage","\u002Flogging\u002Fai-sdk\u002Fusage","2.logging\u002F6.ai-sdk\u002F02.usage","i-lucide-code",{"title":85,"path":86,"stem":87,"icon":88},"Options","\u002Flogging\u002Fai-sdk\u002Foptions","2.logging\u002F6.ai-sdk\u002F03.options","i-lucide-sliders",{"title":90,"path":91,"stem":92,"icon":93},"Metadata","\u002Flogging\u002Fai-sdk\u002Fmetadata","2.logging\u002F6.ai-sdk\u002F04.metadata","i-lucide-database",{"title":95,"path":96,"stem":97,"icon":98},"Telemetry","\u002Flogging\u002Fai-sdk\u002Ftelemetry","2.logging\u002F6.ai-sdk\u002F05.telemetry","i-lucide-activity",{"title":100,"icon":101,"path":102,"stem":103,"children":104,"page":34},"Better Auth","i-simple-icons-betterauth","\u002Flogging\u002Fbetter-auth","2.logging\u002F7.better-auth",[105,108,113,118,122],{"title":41,"path":106,"stem":107,"icon":44},"\u002Flogging\u002Fbetter-auth\u002Foverview","2.logging\u002F7.better-auth\u002F01.overview",{"title":109,"path":110,"stem":111,"icon":112},"Identify User","\u002Flogging\u002Fbetter-auth\u002Fidentify-user","2.logging\u002F7.better-auth\u002F02.identify-user","i-lucide-user-check",{"title":114,"path":115,"stem":116,"icon":117},"Middleware","\u002Flogging\u002Fbetter-auth\u002Fmiddleware","2.logging\u002F7.better-auth\u002F03.middleware","i-lucide-shield",{"title":119,"path":120,"stem":121,"icon":69},"Client Sync","\u002Flogging\u002Fbetter-auth\u002Fclient-sync","2.logging\u002F7.better-auth\u002F04.client-sync",{"title":123,"path":124,"stem":125,"icon":126},"Performance","\u002Flogging\u002Fbetter-auth\u002Fperformance","2.logging\u002F7.better-auth\u002F05.performance","i-lucide-gauge",{"title":128,"icon":129,"path":130,"stem":131,"children":132,"page":34},"Audit Logs","i-lucide-shield-check","\u002Flogging\u002Faudit","2.logging\u002F8.audit",[133,136,141,146,151,155],{"title":41,"path":134,"stem":135,"icon":44},"\u002Flogging\u002Faudit\u002Foverview","2.logging\u002F8.audit\u002F01.overview",{"title":137,"path":138,"stem":139,"icon":140},"Schema","\u002Flogging\u002Faudit\u002Fschema","2.logging\u002F8.audit\u002F02.schema","i-lucide-file-text",{"title":142,"path":143,"stem":144,"icon":145},"Recording","\u002Flogging\u002Faudit\u002Frecording","2.logging\u002F8.audit\u002F03.recording","i-lucide-pen-line",{"title":147,"path":148,"stem":149,"icon":150},"Drains","\u002Flogging\u002Faudit\u002Fpipeline","2.logging\u002F8.audit\u002F04.pipeline","i-lucide-link",{"title":152,"path":153,"stem":154,"icon":129},"Compliance","\u002Flogging\u002Faudit\u002Fcompliance","2.logging\u002F8.audit\u002F05.compliance",{"title":156,"path":157,"stem":158,"icon":64},"Recipes","\u002Flogging\u002Faudit\u002Frecipes","2.logging\u002F8.audit\u002F06.recipes",{"title":160,"path":161,"stem":162,"children":163,"page":34},"Core Concepts","\u002Fcore-concepts","3.core-concepts",[164,169,174,179,184,188,191,196],{"title":165,"path":166,"stem":167,"icon":168},"Lifecycle","\u002Fcore-concepts\u002Flifecycle","3.core-concepts\u002F0.lifecycle","i-lucide-arrow-right-left",{"title":170,"path":171,"stem":172,"icon":173},"Configuration","\u002Fcore-concepts\u002Fconfiguration","3.core-concepts\u002F1.configuration","i-lucide-settings",{"title":175,"path":176,"stem":177,"icon":178},"Sampling","\u002Fcore-concepts\u002Fsampling","3.core-concepts\u002F2.sampling","i-lucide-filter",{"title":180,"path":181,"stem":182,"icon":183},"Typed Fields","\u002Fcore-concepts\u002Ftyped-fields","3.core-concepts\u002F3.typed-fields","i-simple-icons-typescript",{"title":185,"path":186,"stem":187,"icon":129},"Best Practices","\u002Fcore-concepts\u002Fbest-practices","3.core-concepts\u002F4.best-practices",{"title":123,"path":189,"stem":190,"icon":126},"\u002Fcore-concepts\u002Fperformance","3.core-concepts\u002F5.performance",{"title":192,"path":193,"stem":194,"icon":195},"Vite Plugin","\u002Fcore-concepts\u002Fvite-plugin","3.core-concepts\u002F6.vite-plugin","i-custom-vite",{"title":197,"path":198,"stem":199,"icon":200},"Auto-Redaction","\u002Fcore-concepts\u002Fredaction","3.core-concepts\u002F7.redaction","i-lucide-eye-off",{"title":202,"path":203,"stem":204,"children":205,"page":34},"Frameworks","\u002Fframeworks","4.frameworks",[206,210,215,220,225,230,235,240,245,250,255,260,265,270,274,279,284],{"title":41,"path":207,"stem":208,"icon":209},"\u002Fframeworks\u002Foverview","4.frameworks\u002F00.overview","i-lucide-layout-grid",{"title":211,"path":212,"stem":213,"icon":214},"Nuxt","\u002Fframeworks\u002Fnuxt","4.frameworks\u002F01.nuxt","i-simple-icons-nuxtdotjs",{"title":216,"path":217,"stem":218,"icon":219},"Next.js","\u002Fframeworks\u002Fnextjs","4.frameworks\u002F02.nextjs","i-simple-icons-nextdotjs",{"title":221,"path":222,"stem":223,"icon":224},"SvelteKit","\u002Fframeworks\u002Fsveltekit","4.frameworks\u002F03.sveltekit","i-simple-icons-svelte",{"title":226,"path":227,"stem":228,"icon":229},"Nitro","\u002Fframeworks\u002Fnitro","4.frameworks\u002F04.nitro","i-custom-nitro",{"title":231,"path":232,"stem":233,"icon":234},"TanStack Start","\u002Fframeworks\u002Ftanstack-start","4.frameworks\u002F05.tanstack-start","i-custom-tanstack",{"title":236,"path":237,"stem":238,"icon":239},"NestJS","\u002Fframeworks\u002Fnestjs","4.frameworks\u002F06.nestjs","i-simple-icons-nestjs",{"title":241,"path":242,"stem":243,"icon":244},"Express","\u002Fframeworks\u002Fexpress","4.frameworks\u002F07.express","i-simple-icons-express",{"title":246,"path":247,"stem":248,"icon":249},"Hono","\u002Fframeworks\u002Fhono","4.frameworks\u002F08.hono","i-simple-icons-hono",{"title":251,"path":252,"stem":253,"icon":254},"Fastify","\u002Fframeworks\u002Ffastify","4.frameworks\u002F09.fastify","i-simple-icons-fastify",{"title":256,"path":257,"stem":258,"icon":259},"Elysia","\u002Fframeworks\u002Felysia","4.frameworks\u002F10.elysia","i-custom-elysia",{"title":261,"path":262,"stem":263,"icon":264},"React Router","\u002Fframeworks\u002Freact-router","4.frameworks\u002F11.react-router","i-custom-reactrouter",{"title":266,"path":267,"stem":268,"icon":269},"Cloudflare Workers","\u002Fframeworks\u002Fcloudflare-workers","4.frameworks\u002F12.cloudflare-workers","i-simple-icons-cloudflare",{"title":271,"path":272,"stem":273,"icon":183},"Standalone","\u002Fframeworks\u002Fstandalone","4.frameworks\u002F13.standalone",{"title":275,"path":276,"stem":277,"icon":278},"Astro","\u002Fframeworks\u002Fastro","4.frameworks\u002F14.astro","i-simple-icons-astro",{"title":280,"path":281,"stem":282,"icon":283},"AWS Lambda","\u002Fframeworks\u002Faws-lambda","4.frameworks\u002F16.aws-lambda","i-custom-lambda",{"title":285,"path":286,"stem":287,"icon":288},"Custom Integration","\u002Fframeworks\u002Fcustom-integration","4.frameworks\u002F17.custom-integration","i-lucide-puzzle",{"title":290,"path":291,"stem":292,"children":293,"page":34},"Build on top","\u002Fbuild-on-top","5.build-on-top",[294,297,325,346,373,400,428],{"title":41,"path":295,"stem":296,"icon":54},"\u002Fbuild-on-top\u002Foverview","5.build-on-top\u002F0.overview",{"title":298,"path":299,"stem":300,"children":301,"page":34},"Observers","\u002Fbuild-on-top\u002Fobservers","5.build-on-top\u002Fobservers",[302,306,311,316,321],{"title":41,"path":303,"stem":304,"icon":305},"\u002Fbuild-on-top\u002Fobservers\u002Foverview","5.build-on-top\u002Fobservers\u002F1.overview","i-lucide-eye",{"title":307,"path":308,"stem":309,"icon":310},"Stream API","\u002Fbuild-on-top\u002Fobservers\u002Fin-process-stream","5.build-on-top\u002Fobservers\u002F2.in-process-stream","i-lucide-radio-tower",{"title":312,"path":313,"stem":314,"icon":315},"Stream server","\u002Fbuild-on-top\u002Fobservers\u002Fstream-server","5.build-on-top\u002Fobservers\u002F3.stream-server","i-lucide-radio",{"title":317,"path":318,"stem":319,"icon":320},"FS reader","\u002Fbuild-on-top\u002Fobservers\u002Ffs-reader","5.build-on-top\u002Fobservers\u002F4.fs-reader","i-lucide-folder-search",{"title":156,"path":322,"stem":323,"icon":324},"\u002Fbuild-on-top\u002Fobservers\u002Fconsumer-recipes","5.build-on-top\u002Fobservers\u002F5.consumer-recipes","i-lucide-chef-hat",{"title":326,"path":327,"stem":328,"children":329,"page":34},"Pipeline","\u002Fbuild-on-top\u002Fpipeline","5.build-on-top\u002Fpipeline",[330,334,338,342],{"title":41,"path":331,"stem":332,"icon":333},"\u002Fbuild-on-top\u002Fpipeline\u002Foverview","5.build-on-top\u002Fpipeline\u002F1.overview","i-lucide-workflow",{"title":335,"path":336,"stem":337,"icon":288},"Plugins","\u002Fbuild-on-top\u002Fpipeline\u002Fplugins","5.build-on-top\u002Fpipeline\u002F2.plugins",{"title":339,"path":340,"stem":341,"icon":28},"Custom enrichers","\u002Fbuild-on-top\u002Fpipeline\u002Fcustom-enrichers","5.build-on-top\u002Fpipeline\u002F3.custom-enrichers",{"title":343,"path":344,"stem":345,"icon":178},"Tail sampling","\u002Fbuild-on-top\u002Fpipeline\u002Ftail-sampling","5.build-on-top\u002Fpipeline\u002F4.tail-sampling",{"title":347,"path":348,"stem":349,"children":350,"page":34},"Scenarios","\u002Fbuild-on-top\u002Fscenarios","5.build-on-top\u002Fscenarios",[351,355,359,364,368],{"title":41,"path":352,"stem":353,"icon":354},"\u002Fbuild-on-top\u002Fscenarios\u002Foverview","5.build-on-top\u002Fscenarios\u002F0.overview","i-lucide-clipboard-list",{"title":356,"path":357,"stem":358,"icon":49},"Local debugging toolkit","\u002Fbuild-on-top\u002Fscenarios\u002Flocal-debugging-toolkit","5.build-on-top\u002Fscenarios\u002F1.local-debugging-toolkit",{"title":360,"path":361,"stem":362,"icon":363},"Tenant-aware logging","\u002Fbuild-on-top\u002Fscenarios\u002Ftenant-aware-logging","5.build-on-top\u002Fscenarios\u002F2.tenant-aware-logging","i-lucide-users",{"title":365,"path":366,"stem":367,"icon":129},"Compliance audit","\u002Fbuild-on-top\u002Fscenarios\u002Fcompliance-audit","5.build-on-top\u002Fscenarios\u002F3.compliance-audit",{"title":369,"path":370,"stem":371,"icon":372},"Cross-app error vocab","\u002Fbuild-on-top\u002Fscenarios\u002Fcross-app-error-vocab","5.build-on-top\u002Fscenarios\u002F4.cross-app-error-vocab","i-lucide-book",{"title":374,"path":375,"stem":376,"children":377,"page":34},"Shared packages","\u002Fbuild-on-top\u002Fshared","5.build-on-top\u002Fshared",[378,382,386,391,395],{"title":41,"path":379,"stem":380,"icon":381},"\u002Fbuild-on-top\u002Fshared\u002Foverview","5.build-on-top\u002Fshared\u002F1.overview","i-lucide-package",{"title":383,"path":384,"stem":385,"icon":381},"Catalogs as packages","\u002Fbuild-on-top\u002Fshared\u002Fcatalogs-as-packages","5.build-on-top\u002Fshared\u002F2.catalogs-as-packages",{"title":387,"path":388,"stem":389,"icon":390},"Drains as packages","\u002Fbuild-on-top\u002Fshared\u002Fdrains-as-packages","5.build-on-top\u002Fshared\u002F3.drains-as-packages","i-lucide-package-2",{"title":392,"path":393,"stem":394,"icon":28},"Enrichers as packages","\u002Fbuild-on-top\u002Fshared\u002Fenrichers-as-packages","5.build-on-top\u002Fshared\u002F4.enrichers-as-packages",{"title":396,"path":397,"stem":398,"icon":399},"Integration as package","\u002Fbuild-on-top\u002Fshared\u002Fintegration-as-package","5.build-on-top\u002Fshared\u002F5.integration-as-package","i-lucide-package-check",{"title":401,"path":402,"stem":403,"children":404,"page":34},"Sinks","\u002Fbuild-on-top\u002Fsinks","5.build-on-top\u002Fsinks",[405,409,414,418,423],{"title":41,"path":406,"stem":407,"icon":408},"\u002Fbuild-on-top\u002Fsinks\u002Foverview","5.build-on-top\u002Fsinks\u002F1.overview","i-lucide-arrow-up-from-line",{"title":410,"path":411,"stem":412,"icon":413},"Custom drains","\u002Fbuild-on-top\u002Fsinks\u002Fcustom-drains","5.build-on-top\u002Fsinks\u002F2.custom-drains","i-lucide-code-2",{"title":415,"path":416,"stem":417,"icon":333},"Drain pipeline","\u002Fbuild-on-top\u002Fsinks\u002Fdrain-pipeline","5.build-on-top\u002Fsinks\u002F3.drain-pipeline",{"title":419,"path":420,"stem":421,"icon":422},"Identity headers","\u002Fbuild-on-top\u002Fsinks\u002Fidentity-headers","5.build-on-top\u002Fsinks\u002F4.identity-headers","i-lucide-fingerprint",{"title":424,"path":425,"stem":426,"icon":427},"Fanout","\u002Fbuild-on-top\u002Fsinks\u002Ffanout-and-multi-drain","5.build-on-top\u002Fsinks\u002F5.fanout-and-multi-drain","i-lucide-share-2",{"title":429,"path":430,"stem":431,"children":432,"page":34},"Sources","\u002Fbuild-on-top\u002Fsources","5.build-on-top\u002Fsources",[433,437,441],{"title":41,"path":434,"stem":435,"icon":436},"\u002Fbuild-on-top\u002Fsources\u002Foverview","5.build-on-top\u002Fsources\u002F1.overview","i-lucide-arrow-down-to-line",{"title":438,"path":439,"stem":440,"icon":288},"Custom framework","\u002Fbuild-on-top\u002Fsources\u002Fcustom-framework","5.build-on-top\u002Fsources\u002F2.custom-framework",{"title":442,"path":443,"stem":444,"icon":445},"Middleware toolkit","\u002Fbuild-on-top\u002Fsources\u002Fmiddleware-toolkit","5.build-on-top\u002Fsources\u002F3.middleware-toolkit","i-lucide-wrench",{"title":447,"path":448,"stem":449,"children":450,"page":34},"Adapters","\u002Fadapters","6.adapters",[451,454,494,509],{"title":41,"path":452,"stem":453,"icon":44},"\u002Fadapters\u002Foverview","6.adapters\u002F01.overview",{"title":455,"path":456,"stem":457,"children":458,"page":34},"Cloud destinations","\u002Fadapters\u002Fcloud","6.adapters\u002F02.cloud",[459,464,469,474,479,484,489],{"title":460,"path":461,"stem":462,"icon":463},"Axiom","\u002Fadapters\u002Fcloud\u002Faxiom","6.adapters\u002F02.cloud\u002F01.axiom","i-custom-axiom",{"title":465,"path":466,"stem":467,"icon":468},"OTLP","\u002Fadapters\u002Fcloud\u002Fotlp","6.adapters\u002F02.cloud\u002F02.otlp","i-simple-icons-opentelemetry",{"title":470,"path":471,"stem":472,"icon":473},"PostHog","\u002Fadapters\u002Fcloud\u002Fposthog","6.adapters\u002F02.cloud\u002F03.posthog","i-simple-icons-posthog",{"title":475,"path":476,"stem":477,"icon":478},"Sentry","\u002Fadapters\u002Fcloud\u002Fsentry","6.adapters\u002F02.cloud\u002F04.sentry","i-simple-icons-sentry",{"title":480,"path":481,"stem":482,"icon":483},"Better Stack","\u002Fadapters\u002Fcloud\u002Fbetter-stack","6.adapters\u002F02.cloud\u002F05.better-stack","i-simple-icons-betterstack",{"title":485,"path":486,"stem":487,"icon":488},"Datadog","\u002Fadapters\u002Fcloud\u002Fdatadog","6.adapters\u002F02.cloud\u002F06.datadog","i-simple-icons-datadog",{"title":490,"path":491,"stem":492,"icon":493},"HyperDX","\u002Fadapters\u002Fcloud\u002Fhyperdx","6.adapters\u002F02.cloud\u002F07.hyperdx","i-custom-hyperdx",{"title":495,"path":496,"stem":497,"children":498,"page":34},"Self-hosted","\u002Fadapters\u002Fself-hosted","6.adapters\u002F03.self-hosted",[499,504],{"title":500,"path":501,"stem":502,"icon":503},"File System","\u002Fadapters\u002Fself-hosted\u002Ffs","6.adapters\u002F03.self-hosted\u002F01.fs","i-lucide-hard-drive",{"title":505,"path":506,"stem":507,"icon":508},"NuxtHub","\u002Fadapters\u002Fself-hosted\u002Fnuxthub","6.adapters\u002F03.self-hosted\u002F02.nuxthub","i-simple-icons-nuxt",{"title":510,"path":511,"stem":512,"children":513,"page":34},"Building blocks","\u002Fadapters\u002Fbuilding-blocks","6.adapters\u002F04.building-blocks",[514,517,522,526],{"title":326,"path":515,"stem":516,"icon":333},"\u002Fadapters\u002Fbuilding-blocks\u002Fpipeline","6.adapters\u002F04.building-blocks\u002F01.pipeline",{"title":518,"path":519,"stem":520,"icon":521},"HTTP","\u002Fadapters\u002Fbuilding-blocks\u002Fhttp","6.adapters\u002F04.building-blocks\u002F02.http","i-lucide-globe",{"title":523,"path":524,"stem":525,"icon":83},"Custom Adapters","\u002Fadapters\u002Fbuilding-blocks\u002Fcustom","6.adapters\u002F04.building-blocks\u002F03.custom",{"title":527,"path":528,"stem":529,"icon":530},"Toolkit","\u002Fadapters\u002Fbuilding-blocks\u002Ftoolkit","6.adapters\u002F04.building-blocks\u002F04.toolkit","i-lucide-blocks",{"title":532,"path":533,"stem":534,"children":535,"page":34},"Enrichers","\u002Fenrichers","7.enrichers",[536,539,543],{"title":41,"path":537,"stem":538,"icon":28},"\u002Fenrichers\u002Foverview","7.enrichers\u002F1.overview",{"title":540,"path":541,"stem":542,"icon":288},"Built-in","\u002Fenrichers\u002Fbuilt-in","7.enrichers\u002F2.built-in",{"title":544,"path":545,"stem":546,"icon":83},"Custom","\u002Fenrichers\u002Fcustom","7.enrichers\u002F3.custom",{"id":548,"title":152,"body":549,"description":1096,"extension":1097,"links":1098,"meta":1103,"navigation":1104,"path":153,"seo":1105,"stem":154,"__hash__":1106},"docs\u002F2.logging\u002F8.audit\u002F05.compliance.md",{"type":550,"value":551,"toc":1089},"minimark",[552,565,570,573,686,709,718,722,729,853,891,895,898,911,924,928,931,990,993,997,1085],[553,554,555,556,560,561,564],"p",{},"Compliance frameworks (SOC2, HIPAA, GDPR, PCI) ask the same five questions of every audit log: ",[557,558,559],"strong",{},"who, what, when, from where, with which outcome",", plus ",[557,562,563],{},"how do we know it wasn't tampered with",". evlog answers each one through composition of the existing primitives.",[566,567,569],"h2",{"id":568},"integrity","Integrity",[553,571,572],{},"Hash-chain the audit log so any tampering is detectable. Each event's hash includes the previous hash, so deleting a row breaks the chain forward of that point.",[574,575,580],"pre",{"className":576,"code":577,"language":578,"meta":579,"style":579},"language-typescript shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","auditOnly(\n  signed(createFsDrain({ dir: '.audit' }), { strategy: 'hash-chain' }),\n  { await: true },\n)\n","typescript","",[581,582,583,596,662,680],"code",{"__ignoreMap":579},[584,585,588,592],"span",{"class":586,"line":587},"line",1,[584,589,591],{"class":590},"s2Zo4","auditOnly",[584,593,595],{"class":594},"sTEyZ","(\n",[584,597,599,602,605,608,610,614,618,621,624,628,631,634,637,640,643,646,648,650,653,655,657,659],{"class":586,"line":598},2,[584,600,601],{"class":590},"  signed",[584,603,604],{"class":594},"(",[584,606,607],{"class":590},"createFsDrain",[584,609,604],{"class":594},[584,611,613],{"class":612},"sMK4o","{",[584,615,617],{"class":616},"swJcz"," dir",[584,619,620],{"class":612},":",[584,622,623],{"class":612}," '",[584,625,627],{"class":626},"sfazB",".audit",[584,629,630],{"class":612},"'",[584,632,633],{"class":612}," }",[584,635,636],{"class":594},")",[584,638,639],{"class":612},",",[584,641,642],{"class":612}," {",[584,644,645],{"class":616}," strategy",[584,647,620],{"class":612},[584,649,623],{"class":612},[584,651,652],{"class":626},"hash-chain",[584,654,630],{"class":612},[584,656,633],{"class":612},[584,658,636],{"class":594},[584,660,661],{"class":612},",\n",[584,663,665,668,671,673,677],{"class":586,"line":664},3,[584,666,667],{"class":612},"  {",[584,669,670],{"class":616}," await",[584,672,620],{"class":612},[584,674,676],{"class":675},"sfNiH"," true",[584,678,679],{"class":612}," },\n",[584,681,683],{"class":586,"line":682},4,[584,684,685],{"class":594},")\n",[687,688,689,696,697,700,701,704,705,708],"warning",{},[557,690,691,692,695],{},"Rotate ",[581,693,694],{},"secret"," for HMAC-signed audits annually."," When you rotate, embed a key id alongside the signature (e.g. extend ",[581,698,699],{},"AuditFields"," with ",[581,702,703],{},"keyId"," via ",[581,706,707],{},"declare module",") so old events stay verifiable against the previous secret. Verifiers should look up the key by id, not assume a single global secret.",[553,710,711,712,717],{},"See ",[713,714,716],"a",{"href":715},"\u002Flogging\u002Faudit\u002Fpipeline#signed","Drains & Integrity"," for the difference between HMAC and hash-chain.",[566,719,721],{"id":720},"redact","Redact",[553,723,724,725,728],{},"Audit events run through your existing ",[581,726,727],{},"RedactConfig",". Compose with the strict audit preset to harden PII handling:",[574,730,732],{"className":576,"code":731,"language":578,"meta":579,"style":579},"import { auditRedactPreset } from 'evlog'\n\ninitLogger({\n  redact: {\n    paths: [\n      ...(auditRedactPreset.paths ?? []),\n      'user.password',\n    ],\n  },\n})\n",[581,733,734,758,764,774,784,795,818,831,839,845],{"__ignoreMap":579},[584,735,736,740,742,745,747,750,752,755],{"class":586,"line":587},[584,737,739],{"class":738},"s7zQu","import",[584,741,642],{"class":612},[584,743,744],{"class":594}," auditRedactPreset",[584,746,633],{"class":612},[584,748,749],{"class":738}," from",[584,751,623],{"class":612},[584,753,754],{"class":626},"evlog",[584,756,757],{"class":612},"'\n",[584,759,760],{"class":586,"line":598},[584,761,763],{"emptyLinePlaceholder":762},true,"\n",[584,765,766,769,771],{"class":586,"line":664},[584,767,768],{"class":590},"initLogger",[584,770,604],{"class":594},[584,772,773],{"class":612},"{\n",[584,775,776,779,781],{"class":586,"line":682},[584,777,778],{"class":616},"  redact",[584,780,620],{"class":612},[584,782,783],{"class":612}," {\n",[584,785,787,790,792],{"class":586,"line":786},5,[584,788,789],{"class":616},"    paths",[584,791,620],{"class":612},[584,793,794],{"class":594}," [\n",[584,796,798,801,804,807,810,813,816],{"class":586,"line":797},6,[584,799,800],{"class":612},"      ...",[584,802,803],{"class":594},"(auditRedactPreset",[584,805,806],{"class":612},".",[584,808,809],{"class":594},"paths ",[584,811,812],{"class":612},"??",[584,814,815],{"class":594}," [])",[584,817,661],{"class":612},[584,819,821,824,827,829],{"class":586,"line":820},7,[584,822,823],{"class":612},"      '",[584,825,826],{"class":626},"user.password",[584,828,630],{"class":612},[584,830,661],{"class":612},[584,832,834,837],{"class":586,"line":833},8,[584,835,836],{"class":594},"    ]",[584,838,661],{"class":612},[584,840,842],{"class":586,"line":841},9,[584,843,844],{"class":612},"  },\n",[584,846,848,851],{"class":586,"line":847},10,[584,849,850],{"class":612},"}",[584,852,685],{"class":594},[553,854,855,856,859,860,863,864,867,868,867,871,867,874,867,877,867,880,883,884,887,888,806],{},"The preset drops ",[581,857,858],{},"Authorization"," \u002F ",[581,861,862],{},"Cookie"," headers and common credential field names (",[581,865,866],{},"password",", ",[581,869,870],{},"token",[581,872,873],{},"apiKey",[581,875,876],{},"cardNumber",[581,878,879],{},"cvv",[581,881,882],{},"ssn",") wherever they appear inside ",[581,885,886],{},"audit.changes.before"," and ",[581,889,890],{},"audit.changes.after",[566,892,894],{"id":893},"gdpr-vs-append-only","GDPR vs append-only",[553,896,897],{},"Append-only audit logs collide with GDPR's right to be forgotten. Recommended pattern today:",[899,900,901,905,908],"ol",{},[902,903,904],"li",{},"Keep audit rows immutable.",[902,906,907],{},"Encrypt PII fields with a per-actor key (held outside the audit store).",[902,909,910],{},"To \"forget\" a user, delete their key — the audit row stays, the chain stays valid, the PII becomes unreadable.",[553,912,913,914,917,918,806],{},"A built-in ",[581,915,916],{},"cryptoShredding"," helper is on the ",[713,919,923],{"href":920,"rel":921},"https:\u002F\u002Fgithub.com\u002FHugoRCD\u002Fevlog\u002Fissues",[922],"nofollow","follow-up roadmap",[566,925,927],{"id":926},"retention","Retention",[553,929,930],{},"Retention is a storage-layer concern by design. evlog's audit layer doesn't enforce retention windows because every supported sink already has a stronger, audited mechanism for it. Pick the one matching your sink:",[932,933,934,947],"table",{},[935,936,937],"thead",{},[938,939,940,944],"tr",{},[941,942,943],"th",{},"Sink",[941,945,946],{},"Retention mechanism",[948,949,950,963,974,982],"tbody",{},[938,951,952,956],{},[953,954,955],"td",{},"FS",[953,957,958,959,962],{},"Combine ",[581,960,961],{},"createFsDrain({ maxFiles })"," with a daily compactor.",[938,964,965,968],{},[953,966,967],{},"Postgres",[953,969,970,971,806],{},"Schedule ",[581,972,973],{},"DELETE FROM audit_events WHERE timestamp \u003C now() - interval '7 years'",[938,975,976,979],{},[953,977,978],{},"Axiom \u002F Datadog \u002F Loki",[953,980,981],{},"Set the dataset retention policy in the platform.",[938,983,984,987],{},[953,985,986],{},"S3 Object Lock",[953,988,989],{},"Configure lifecycle rules + Object Lock retention period.",[553,991,992],{},"Document the chosen window in your security policy. Auditors care about the written rule, not the enforcing component.",[566,994,996],{"id":995},"common-pitfalls","Common Pitfalls",[998,999,1000,1013,1036,1042,1061,1075],"ul",{},[902,1001,1002,1005,1006,700,1009,1012],{},[557,1003,1004],{},"Logging only successes."," Auditors care most about denials. Always pair ",[581,1007,1008],{},"log.audit()",[581,1010,1011],{},"log.audit.deny()"," on the negative branch of every authorisation check.",[902,1014,1015,1021,1022,1025,1026,1028,1029,867,1031,867,1033,1035],{},[557,1016,1017,1018,806],{},"Leaking PII through ",[581,1019,1020],{},"changes"," ",[581,1023,1024],{},"auditDiff()"," runs through your ",[581,1027,727],{},", but only if the field paths are listed. Add ",[581,1030,866],{},[581,1032,870],{},[581,1034,873],{},", etc. once globally so you never have to think about it again.",[902,1037,1038,1041],{},[557,1039,1040],{},"Treating audits as observability."," Don't sample, downsample, or summarise audit events. Force-keep is on by default — don't disable it.",[902,1043,1044,1021,1051,1053,1054,859,1057,1060],{},[557,1045,1046,1047,1050],{},"Conflating ",[581,1048,1049],{},"actor.id"," with the session id.",[581,1052,1049],{}," is the stable user id (or system identity). Correlate sessions via ",[581,1055,1056],{},"context.requestId",[581,1058,1059],{},"context.traceId",", never via the actor.",[902,1062,1063,1066,1067,1070,1071,1074],{},[557,1064,1065],{},"Forgetting standalone jobs."," Cron tasks, queue workers, and CLIs trigger audit-worthy actions too. Use ",[581,1068,1069],{},"audit()"," (no request) or ",[581,1072,1073],{},"withAudit()"," to keep coverage parity with your HTTP routes.",[902,1076,1077,1084],{},[557,1078,1079,1080,1083],{},"Skipping ",[581,1081,1082],{},"await: true"," on the audit drain."," Without it, audits are fire-and-forget — a crash between the event being emitted and the drain flushing means the action happened but no audit row exists.",[1086,1087,1088],"style",{},"html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sfNiH, html code.shiki .sfNiH{--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}",{"title":579,"searchDepth":598,"depth":598,"links":1090},[1091,1092,1093,1094,1095],{"id":568,"depth":598,"text":569},{"id":720,"depth":598,"text":721},{"id":893,"depth":598,"text":894},{"id":926,"depth":598,"text":927},{"id":995,"depth":598,"text":996},"Integrity, redact presets, GDPR vs append-only, retention windows, and the most common pitfalls when shipping audit logs to production.","md",[1099,1102],{"label":716,"icon":150,"to":148,"color":1100,"variant":1101},"neutral","subtle",{"label":156,"icon":64,"to":157,"color":1100,"variant":1101},{},{"title":152,"icon":129},{"title":152,"description":1096},"IyXFlsbKUUw38ViWHOK2P3nf1U68neZdA_NJqFNoilA",[1108,1110],{"title":147,"path":148,"stem":149,"description":1109,"icon":150,"children":-1},"auditEnricher to auto-fill request context, auditOnly to route audits to a dedicated sink, and signed for tamper-evident HMAC or hash-chain integrity.",{"title":156,"path":157,"stem":158,"description":1111,"icon":64,"children":-1},"File system, Axiom, and Postgres recipes for audit logs, plus mockAudit for tests and the full API reference.",1778338247579]