[{"data":1,"prerenderedAt":1497},["ShallowReactive",2],{"navigation_docs":3,"-logging-audit-schema":547,"-logging-audit-schema-surround":1492},[4,35,159,201,289,446,531],{"title":5,"path":6,"stem":7,"children":8,"page":34},"Getting Started","\u002Fgetting-started","1.getting-started",[9,14,19,24,29],{"title":10,"path":11,"stem":12,"icon":13},"Introduction","\u002Fgetting-started\u002Fintroduction","1.getting-started\u002F1.introduction","i-lucide-info",{"title":15,"path":16,"stem":17,"icon":18},"Installation","\u002Fgetting-started\u002Finstallation","1.getting-started\u002F2.installation","i-lucide-download",{"title":20,"path":21,"stem":22,"icon":23},"Quick Start","\u002Fgetting-started\u002Fquick-start","1.getting-started\u002F3.quick-start","i-lucide-zap",{"title":25,"path":26,"stem":27,"icon":28},"Agent Skills","\u002Fgetting-started\u002Fagent-skills","1.getting-started\u002F4.agent-skills","i-lucide-sparkles",{"title":30,"path":31,"stem":32,"icon":33},"vs Other Loggers","\u002Fgetting-started\u002Fvs-other-loggers","1.getting-started\u002F5.vs-other-loggers","i-lucide-scale",false,{"title":36,"path":37,"stem":38,"children":39,"page":34},"Logging","\u002Flogging","2.logging",[40,45,50,55,60,65,70,99,127],{"title":41,"path":42,"stem":43,"icon":44},"Overview","\u002Flogging\u002Foverview","2.logging\u002F0.overview","i-lucide-list",{"title":46,"path":47,"stem":48,"icon":49},"Simple Logging","\u002Flogging\u002Fsimple-logging","2.logging\u002F1.simple-logging","i-lucide-terminal",{"title":51,"path":52,"stem":53,"icon":54},"Wide Events","\u002Flogging\u002Fwide-events","2.logging\u002F2.wide-events","i-lucide-layers",{"title":56,"path":57,"stem":58,"icon":59},"Structured Errors","\u002Flogging\u002Fstructured-errors","2.logging\u002F3.structured-errors","i-lucide-shield-alert",{"title":61,"path":62,"stem":63,"icon":64},"Catalogs","\u002Flogging\u002Fcatalogs","2.logging\u002F4.catalogs","i-lucide-book-open",{"title":66,"path":67,"stem":68,"icon":69},"Client Logging","\u002Flogging\u002Fclient-logging","2.logging\u002F5.client-logging","i-lucide-monitor",{"title":71,"icon":72,"path":73,"stem":74,"children":75,"page":34},"AI SDK","i-simple-icons-vercel","\u002Flogging\u002Fai-sdk","2.logging\u002F6.ai-sdk",[76,79,84,89,94],{"title":41,"path":77,"stem":78,"icon":44},"\u002Flogging\u002Fai-sdk\u002Foverview","2.logging\u002F6.ai-sdk\u002F01.overview",{"title":80,"path":81,"stem":82,"icon":83},"Usage","\u002Flogging\u002Fai-sdk\u002Fusage","2.logging\u002F6.ai-sdk\u002F02.usage","i-lucide-code",{"title":85,"path":86,"stem":87,"icon":88},"Options","\u002Flogging\u002Fai-sdk\u002Foptions","2.logging\u002F6.ai-sdk\u002F03.options","i-lucide-sliders",{"title":90,"path":91,"stem":92,"icon":93},"Metadata","\u002Flogging\u002Fai-sdk\u002Fmetadata","2.logging\u002F6.ai-sdk\u002F04.metadata","i-lucide-database",{"title":95,"path":96,"stem":97,"icon":98},"Telemetry","\u002Flogging\u002Fai-sdk\u002Ftelemetry","2.logging\u002F6.ai-sdk\u002F05.telemetry","i-lucide-activity",{"title":100,"icon":101,"path":102,"stem":103,"children":104,"page":34},"Better Auth","i-simple-icons-betterauth","\u002Flogging\u002Fbetter-auth","2.logging\u002F7.better-auth",[105,108,113,118,122],{"title":41,"path":106,"stem":107,"icon":44},"\u002Flogging\u002Fbetter-auth\u002Foverview","2.logging\u002F7.better-auth\u002F01.overview",{"title":109,"path":110,"stem":111,"icon":112},"Identify User","\u002Flogging\u002Fbetter-auth\u002Fidentify-user","2.logging\u002F7.better-auth\u002F02.identify-user","i-lucide-user-check",{"title":114,"path":115,"stem":116,"icon":117},"Middleware","\u002Flogging\u002Fbetter-auth\u002Fmiddleware","2.logging\u002F7.better-auth\u002F03.middleware","i-lucide-shield",{"title":119,"path":120,"stem":121,"icon":69},"Client Sync","\u002Flogging\u002Fbetter-auth\u002Fclient-sync","2.logging\u002F7.better-auth\u002F04.client-sync",{"title":123,"path":124,"stem":125,"icon":126},"Performance","\u002Flogging\u002Fbetter-auth\u002Fperformance","2.logging\u002F7.better-auth\u002F05.performance","i-lucide-gauge",{"title":128,"icon":129,"path":130,"stem":131,"children":132,"page":34},"Audit Logs","i-lucide-shield-check","\u002Flogging\u002Faudit","2.logging\u002F8.audit",[133,136,141,146,151,155],{"title":41,"path":134,"stem":135,"icon":44},"\u002Flogging\u002Faudit\u002Foverview","2.logging\u002F8.audit\u002F01.overview",{"title":137,"path":138,"stem":139,"icon":140},"Schema","\u002Flogging\u002Faudit\u002Fschema","2.logging\u002F8.audit\u002F02.schema","i-lucide-file-text",{"title":142,"path":143,"stem":144,"icon":145},"Recording","\u002Flogging\u002Faudit\u002Frecording","2.logging\u002F8.audit\u002F03.recording","i-lucide-pen-line",{"title":147,"path":148,"stem":149,"icon":150},"Drains","\u002Flogging\u002Faudit\u002Fpipeline","2.logging\u002F8.audit\u002F04.pipeline","i-lucide-link",{"title":152,"path":153,"stem":154,"icon":129},"Compliance","\u002Flogging\u002Faudit\u002Fcompliance","2.logging\u002F8.audit\u002F05.compliance",{"title":156,"path":157,"stem":158,"icon":64},"Recipes","\u002Flogging\u002Faudit\u002Frecipes","2.logging\u002F8.audit\u002F06.recipes",{"title":160,"path":161,"stem":162,"children":163,"page":34},"Core Concepts","\u002Fcore-concepts","3.core-concepts",[164,169,174,179,184,188,191,196],{"title":165,"path":166,"stem":167,"icon":168},"Lifecycle","\u002Fcore-concepts\u002Flifecycle","3.core-concepts\u002F0.lifecycle","i-lucide-arrow-right-left",{"title":170,"path":171,"stem":172,"icon":173},"Configuration","\u002Fcore-concepts\u002Fconfiguration","3.core-concepts\u002F1.configuration","i-lucide-settings",{"title":175,"path":176,"stem":177,"icon":178},"Sampling","\u002Fcore-concepts\u002Fsampling","3.core-concepts\u002F2.sampling","i-lucide-filter",{"title":180,"path":181,"stem":182,"icon":183},"Typed Fields","\u002Fcore-concepts\u002Ftyped-fields","3.core-concepts\u002F3.typed-fields","i-simple-icons-typescript",{"title":185,"path":186,"stem":187,"icon":129},"Best Practices","\u002Fcore-concepts\u002Fbest-practices","3.core-concepts\u002F4.best-practices",{"title":123,"path":189,"stem":190,"icon":126},"\u002Fcore-concepts\u002Fperformance","3.core-concepts\u002F5.performance",{"title":192,"path":193,"stem":194,"icon":195},"Vite Plugin","\u002Fcore-concepts\u002Fvite-plugin","3.core-concepts\u002F6.vite-plugin","i-custom-vite",{"title":197,"path":198,"stem":199,"icon":200},"Auto-Redaction","\u002Fcore-concepts\u002Fredaction","3.core-concepts\u002F7.redaction","i-lucide-eye-off",{"title":202,"path":203,"stem":204,"children":205,"page":34},"Frameworks","\u002Fframeworks","4.frameworks",[206,210,215,220,225,230,235,240,245,250,255,260,265,270,274,279,284],{"title":41,"path":207,"stem":208,"icon":209},"\u002Fframeworks\u002Foverview","4.frameworks\u002F00.overview","i-lucide-layout-grid",{"title":211,"path":212,"stem":213,"icon":214},"Nuxt","\u002Fframeworks\u002Fnuxt","4.frameworks\u002F01.nuxt","i-simple-icons-nuxtdotjs",{"title":216,"path":217,"stem":218,"icon":219},"Next.js","\u002Fframeworks\u002Fnextjs","4.frameworks\u002F02.nextjs","i-simple-icons-nextdotjs",{"title":221,"path":222,"stem":223,"icon":224},"SvelteKit","\u002Fframeworks\u002Fsveltekit","4.frameworks\u002F03.sveltekit","i-simple-icons-svelte",{"title":226,"path":227,"stem":228,"icon":229},"Nitro","\u002Fframeworks\u002Fnitro","4.frameworks\u002F04.nitro","i-custom-nitro",{"title":231,"path":232,"stem":233,"icon":234},"TanStack Start","\u002Fframeworks\u002Ftanstack-start","4.frameworks\u002F05.tanstack-start","i-custom-tanstack",{"title":236,"path":237,"stem":238,"icon":239},"NestJS","\u002Fframeworks\u002Fnestjs","4.frameworks\u002F06.nestjs","i-simple-icons-nestjs",{"title":241,"path":242,"stem":243,"icon":244},"Express","\u002Fframeworks\u002Fexpress","4.frameworks\u002F07.express","i-simple-icons-express",{"title":246,"path":247,"stem":248,"icon":249},"Hono","\u002Fframeworks\u002Fhono","4.frameworks\u002F08.hono","i-simple-icons-hono",{"title":251,"path":252,"stem":253,"icon":254},"Fastify","\u002Fframeworks\u002Ffastify","4.frameworks\u002F09.fastify","i-simple-icons-fastify",{"title":256,"path":257,"stem":258,"icon":259},"Elysia","\u002Fframeworks\u002Felysia","4.frameworks\u002F10.elysia","i-custom-elysia",{"title":261,"path":262,"stem":263,"icon":264},"React Router","\u002Fframeworks\u002Freact-router","4.frameworks\u002F11.react-router","i-custom-reactrouter",{"title":266,"path":267,"stem":268,"icon":269},"Cloudflare Workers","\u002Fframeworks\u002Fcloudflare-workers","4.frameworks\u002F12.cloudflare-workers","i-simple-icons-cloudflare",{"title":271,"path":272,"stem":273,"icon":183},"Standalone","\u002Fframeworks\u002Fstandalone","4.frameworks\u002F13.standalone",{"title":275,"path":276,"stem":277,"icon":278},"Astro","\u002Fframeworks\u002Fastro","4.frameworks\u002F14.astro","i-simple-icons-astro",{"title":280,"path":281,"stem":282,"icon":283},"AWS Lambda","\u002Fframeworks\u002Faws-lambda","4.frameworks\u002F16.aws-lambda","i-custom-lambda",{"title":285,"path":286,"stem":287,"icon":288},"Custom Integration","\u002Fframeworks\u002Fcustom-integration","4.frameworks\u002F17.custom-integration","i-lucide-puzzle",{"title":290,"path":291,"stem":292,"children":293,"page":34},"Build on top","\u002Fbuild-on-top","5.build-on-top",[294,297,325,346,373,400,428],{"title":41,"path":295,"stem":296,"icon":54},"\u002Fbuild-on-top\u002Foverview","5.build-on-top\u002F0.overview",{"title":298,"path":299,"stem":300,"children":301,"page":34},"Observers","\u002Fbuild-on-top\u002Fobservers","5.build-on-top\u002Fobservers",[302,306,311,316,321],{"title":41,"path":303,"stem":304,"icon":305},"\u002Fbuild-on-top\u002Fobservers\u002Foverview","5.build-on-top\u002Fobservers\u002F1.overview","i-lucide-eye",{"title":307,"path":308,"stem":309,"icon":310},"Stream API","\u002Fbuild-on-top\u002Fobservers\u002Fin-process-stream","5.build-on-top\u002Fobservers\u002F2.in-process-stream","i-lucide-radio-tower",{"title":312,"path":313,"stem":314,"icon":315},"Stream server","\u002Fbuild-on-top\u002Fobservers\u002Fstream-server","5.build-on-top\u002Fobservers\u002F3.stream-server","i-lucide-radio",{"title":317,"path":318,"stem":319,"icon":320},"FS reader","\u002Fbuild-on-top\u002Fobservers\u002Ffs-reader","5.build-on-top\u002Fobservers\u002F4.fs-reader","i-lucide-folder-search",{"title":156,"path":322,"stem":323,"icon":324},"\u002Fbuild-on-top\u002Fobservers\u002Fconsumer-recipes","5.build-on-top\u002Fobservers\u002F5.consumer-recipes","i-lucide-chef-hat",{"title":326,"path":327,"stem":328,"children":329,"page":34},"Pipeline","\u002Fbuild-on-top\u002Fpipeline","5.build-on-top\u002Fpipeline",[330,334,338,342],{"title":41,"path":331,"stem":332,"icon":333},"\u002Fbuild-on-top\u002Fpipeline\u002Foverview","5.build-on-top\u002Fpipeline\u002F1.overview","i-lucide-workflow",{"title":335,"path":336,"stem":337,"icon":288},"Plugins","\u002Fbuild-on-top\u002Fpipeline\u002Fplugins","5.build-on-top\u002Fpipeline\u002F2.plugins",{"title":339,"path":340,"stem":341,"icon":28},"Custom enrichers","\u002Fbuild-on-top\u002Fpipeline\u002Fcustom-enrichers","5.build-on-top\u002Fpipeline\u002F3.custom-enrichers",{"title":343,"path":344,"stem":345,"icon":178},"Tail sampling","\u002Fbuild-on-top\u002Fpipeline\u002Ftail-sampling","5.build-on-top\u002Fpipeline\u002F4.tail-sampling",{"title":347,"path":348,"stem":349,"children":350,"page":34},"Scenarios","\u002Fbuild-on-top\u002Fscenarios","5.build-on-top\u002Fscenarios",[351,355,359,364,368],{"title":41,"path":352,"stem":353,"icon":354},"\u002Fbuild-on-top\u002Fscenarios\u002Foverview","5.build-on-top\u002Fscenarios\u002F0.overview","i-lucide-clipboard-list",{"title":356,"path":357,"stem":358,"icon":49},"Local debugging toolkit","\u002Fbuild-on-top\u002Fscenarios\u002Flocal-debugging-toolkit","5.build-on-top\u002Fscenarios\u002F1.local-debugging-toolkit",{"title":360,"path":361,"stem":362,"icon":363},"Tenant-aware logging","\u002Fbuild-on-top\u002Fscenarios\u002Ftenant-aware-logging","5.build-on-top\u002Fscenarios\u002F2.tenant-aware-logging","i-lucide-users",{"title":365,"path":366,"stem":367,"icon":129},"Compliance audit","\u002Fbuild-on-top\u002Fscenarios\u002Fcompliance-audit","5.build-on-top\u002Fscenarios\u002F3.compliance-audit",{"title":369,"path":370,"stem":371,"icon":372},"Cross-app error vocab","\u002Fbuild-on-top\u002Fscenarios\u002Fcross-app-error-vocab","5.build-on-top\u002Fscenarios\u002F4.cross-app-error-vocab","i-lucide-book",{"title":374,"path":375,"stem":376,"children":377,"page":34},"Shared packages","\u002Fbuild-on-top\u002Fshared","5.build-on-top\u002Fshared",[378,382,386,391,395],{"title":41,"path":379,"stem":380,"icon":381},"\u002Fbuild-on-top\u002Fshared\u002Foverview","5.build-on-top\u002Fshared\u002F1.overview","i-lucide-package",{"title":383,"path":384,"stem":385,"icon":381},"Catalogs as packages","\u002Fbuild-on-top\u002Fshared\u002Fcatalogs-as-packages","5.build-on-top\u002Fshared\u002F2.catalogs-as-packages",{"title":387,"path":388,"stem":389,"icon":390},"Drains as packages","\u002Fbuild-on-top\u002Fshared\u002Fdrains-as-packages","5.build-on-top\u002Fshared\u002F3.drains-as-packages","i-lucide-package-2",{"title":392,"path":393,"stem":394,"icon":28},"Enrichers as packages","\u002Fbuild-on-top\u002Fshared\u002Fenrichers-as-packages","5.build-on-top\u002Fshared\u002F4.enrichers-as-packages",{"title":396,"path":397,"stem":398,"icon":399},"Integration as package","\u002Fbuild-on-top\u002Fshared\u002Fintegration-as-package","5.build-on-top\u002Fshared\u002F5.integration-as-package","i-lucide-package-check",{"title":401,"path":402,"stem":403,"children":404,"page":34},"Sinks","\u002Fbuild-on-top\u002Fsinks","5.build-on-top\u002Fsinks",[405,409,414,418,423],{"title":41,"path":406,"stem":407,"icon":408},"\u002Fbuild-on-top\u002Fsinks\u002Foverview","5.build-on-top\u002Fsinks\u002F1.overview","i-lucide-arrow-up-from-line",{"title":410,"path":411,"stem":412,"icon":413},"Custom drains","\u002Fbuild-on-top\u002Fsinks\u002Fcustom-drains","5.build-on-top\u002Fsinks\u002F2.custom-drains","i-lucide-code-2",{"title":415,"path":416,"stem":417,"icon":333},"Drain pipeline","\u002Fbuild-on-top\u002Fsinks\u002Fdrain-pipeline","5.build-on-top\u002Fsinks\u002F3.drain-pipeline",{"title":419,"path":420,"stem":421,"icon":422},"Identity headers","\u002Fbuild-on-top\u002Fsinks\u002Fidentity-headers","5.build-on-top\u002Fsinks\u002F4.identity-headers","i-lucide-fingerprint",{"title":424,"path":425,"stem":426,"icon":427},"Fanout","\u002Fbuild-on-top\u002Fsinks\u002Ffanout-and-multi-drain","5.build-on-top\u002Fsinks\u002F5.fanout-and-multi-drain","i-lucide-share-2",{"title":429,"path":430,"stem":431,"children":432,"page":34},"Sources","\u002Fbuild-on-top\u002Fsources","5.build-on-top\u002Fsources",[433,437,441],{"title":41,"path":434,"stem":435,"icon":436},"\u002Fbuild-on-top\u002Fsources\u002Foverview","5.build-on-top\u002Fsources\u002F1.overview","i-lucide-arrow-down-to-line",{"title":438,"path":439,"stem":440,"icon":288},"Custom framework","\u002Fbuild-on-top\u002Fsources\u002Fcustom-framework","5.build-on-top\u002Fsources\u002F2.custom-framework",{"title":442,"path":443,"stem":444,"icon":445},"Middleware toolkit","\u002Fbuild-on-top\u002Fsources\u002Fmiddleware-toolkit","5.build-on-top\u002Fsources\u002F3.middleware-toolkit","i-lucide-wrench",{"title":447,"path":448,"stem":449,"children":450,"page":34},"Adapters","\u002Fadapters","6.adapters",[451,454,494,509],{"title":41,"path":452,"stem":453,"icon":44},"\u002Fadapters\u002Foverview","6.adapters\u002F01.overview",{"title":455,"path":456,"stem":457,"children":458,"page":34},"Cloud destinations","\u002Fadapters\u002Fcloud","6.adapters\u002F02.cloud",[459,464,469,474,479,484,489],{"title":460,"path":461,"stem":462,"icon":463},"Axiom","\u002Fadapters\u002Fcloud\u002Faxiom","6.adapters\u002F02.cloud\u002F01.axiom","i-custom-axiom",{"title":465,"path":466,"stem":467,"icon":468},"OTLP","\u002Fadapters\u002Fcloud\u002Fotlp","6.adapters\u002F02.cloud\u002F02.otlp","i-simple-icons-opentelemetry",{"title":470,"path":471,"stem":472,"icon":473},"PostHog","\u002Fadapters\u002Fcloud\u002Fposthog","6.adapters\u002F02.cloud\u002F03.posthog","i-simple-icons-posthog",{"title":475,"path":476,"stem":477,"icon":478},"Sentry","\u002Fadapters\u002Fcloud\u002Fsentry","6.adapters\u002F02.cloud\u002F04.sentry","i-simple-icons-sentry",{"title":480,"path":481,"stem":482,"icon":483},"Better Stack","\u002Fadapters\u002Fcloud\u002Fbetter-stack","6.adapters\u002F02.cloud\u002F05.better-stack","i-simple-icons-betterstack",{"title":485,"path":486,"stem":487,"icon":488},"Datadog","\u002Fadapters\u002Fcloud\u002Fdatadog","6.adapters\u002F02.cloud\u002F06.datadog","i-simple-icons-datadog",{"title":490,"path":491,"stem":492,"icon":493},"HyperDX","\u002Fadapters\u002Fcloud\u002Fhyperdx","6.adapters\u002F02.cloud\u002F07.hyperdx","i-custom-hyperdx",{"title":495,"path":496,"stem":497,"children":498,"page":34},"Self-hosted","\u002Fadapters\u002Fself-hosted","6.adapters\u002F03.self-hosted",[499,504],{"title":500,"path":501,"stem":502,"icon":503},"File System","\u002Fadapters\u002Fself-hosted\u002Ffs","6.adapters\u002F03.self-hosted\u002F01.fs","i-lucide-hard-drive",{"title":505,"path":506,"stem":507,"icon":508},"NuxtHub","\u002Fadapters\u002Fself-hosted\u002Fnuxthub","6.adapters\u002F03.self-hosted\u002F02.nuxthub","i-simple-icons-nuxt",{"title":510,"path":511,"stem":512,"children":513,"page":34},"Building blocks","\u002Fadapters\u002Fbuilding-blocks","6.adapters\u002F04.building-blocks",[514,517,522,526],{"title":326,"path":515,"stem":516,"icon":333},"\u002Fadapters\u002Fbuilding-blocks\u002Fpipeline","6.adapters\u002F04.building-blocks\u002F01.pipeline",{"title":518,"path":519,"stem":520,"icon":521},"HTTP","\u002Fadapters\u002Fbuilding-blocks\u002Fhttp","6.adapters\u002F04.building-blocks\u002F02.http","i-lucide-globe",{"title":523,"path":524,"stem":525,"icon":83},"Custom Adapters","\u002Fadapters\u002Fbuilding-blocks\u002Fcustom","6.adapters\u002F04.building-blocks\u002F03.custom",{"title":527,"path":528,"stem":529,"icon":530},"Toolkit","\u002Fadapters\u002Fbuilding-blocks\u002Ftoolkit","6.adapters\u002F04.building-blocks\u002F04.toolkit","i-lucide-blocks",{"title":532,"path":533,"stem":534,"children":535,"page":34},"Enrichers","\u002Fenrichers","7.enrichers",[536,539,543],{"title":41,"path":537,"stem":538,"icon":28},"\u002Fenrichers\u002Foverview","7.enrichers\u002F1.overview",{"title":540,"path":541,"stem":542,"icon":288},"Built-in","\u002Fenrichers\u002Fbuilt-in","7.enrichers\u002F2.built-in",{"title":544,"path":545,"stem":546,"icon":83},"Custom","\u002Fenrichers\u002Fcustom","7.enrichers\u002F3.custom",{"id":548,"title":549,"body":550,"description":1481,"extension":1482,"links":1483,"meta":1488,"navigation":1489,"path":138,"seo":1490,"stem":139,"__hash__":1491},"docs\u002F2.logging\u002F8.audit\u002F02.schema.md","Audit Schema",{"type":551,"value":552,"toc":1472},"minimark",[553,565,573,1046,1050,1088,1091,1203,1221,1225,1247,1322,1326,1372,1384,1388,1406,1409,1413,1455,1468],[554,555,556,560,561,564],"p",{},[557,558,559],"code",{},"event.audit"," is a typed field on every wide event. Downstream queries filter on ",[557,562,563],{},"audit IS NOT NULL"," to materialise an audit dataset out of regular logs.",[566,567,569,572],"h2",{"id":568},"auditfields-type",[557,570,571],{},"AuditFields"," type",[574,575,580],"pre",{"className":576,"code":577,"language":578,"meta":579,"style":579},"language-typescript shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","interface AuditFields {\n  action: string                          \u002F\u002F 'invoice.refund'\n  actor: {\n    type: 'user' | 'system' | 'api' | 'agent'\n    id: string\n    displayName?: string\n    email?: string\n    \u002F\u002F For type === 'agent', mirrors evlog\u002Fai fields:\n    model?: string\n    tools?: string[]\n    reason?: string\n    promptId?: string\n  }\n  target?: { type: string, id: string, [k: string]: unknown }\n  outcome: 'success' | 'failure' | 'denied'\n  reason?: string\n  changes?: { before?: unknown, after?: unknown }\n  causationId?: string                    \u002F\u002F ID of the action that caused this one\n  correlationId?: string                  \u002F\u002F Shared by every action in one operation\n  version?: number                        \u002F\u002F Defaults to 1\n  idempotencyKey?: string                 \u002F\u002F Auto-derived; safe retries across drains\n  context?: {                             \u002F\u002F Filled by auditEnricher\n    requestId?: string\n    traceId?: string\n    ip?: string\n    userAgent?: string\n    tenantId?: string\n  }\n  signature?: string                      \u002F\u002F Set by signed({ strategy: 'hmac' })\n  prevHash?: string                       \u002F\u002F Set by signed({ strategy: 'hash-chain' })\n  hash?: string\n}\n","typescript","",[557,581,582,599,616,626,673,684,695,705,711,721,735,745,755,761,812,845,855,883,896,909,923,936,949,959,969,979,989,999,1004,1017,1030,1040],{"__ignoreMap":579},[583,584,587,591,595],"span",{"class":585,"line":586},"line",1,[583,588,590],{"class":589},"spNyl","interface",[583,592,594],{"class":593},"sBMFI"," AuditFields",[583,596,598],{"class":597},"sMK4o"," {\n",[583,600,602,606,609,612],{"class":585,"line":601},2,[583,603,605],{"class":604},"swJcz","  action",[583,607,608],{"class":597},":",[583,610,611],{"class":593}," string",[583,613,615],{"class":614},"sHwdD","                          \u002F\u002F 'invoice.refund'\n",[583,617,619,622,624],{"class":585,"line":618},3,[583,620,621],{"class":604},"  actor",[583,623,608],{"class":597},[583,625,598],{"class":597},[583,627,629,632,634,637,641,644,647,649,652,654,656,658,661,663,665,667,670],{"class":585,"line":628},4,[583,630,631],{"class":604},"    type",[583,633,608],{"class":597},[583,635,636],{"class":597}," '",[583,638,640],{"class":639},"sfazB","user",[583,642,643],{"class":597},"'",[583,645,646],{"class":597}," |",[583,648,636],{"class":597},[583,650,651],{"class":639},"system",[583,653,643],{"class":597},[583,655,646],{"class":597},[583,657,636],{"class":597},[583,659,660],{"class":639},"api",[583,662,643],{"class":597},[583,664,646],{"class":597},[583,666,636],{"class":597},[583,668,669],{"class":639},"agent",[583,671,672],{"class":597},"'\n",[583,674,676,679,681],{"class":585,"line":675},5,[583,677,678],{"class":604},"    id",[583,680,608],{"class":597},[583,682,683],{"class":593}," string\n",[583,685,687,690,693],{"class":585,"line":686},6,[583,688,689],{"class":604},"    displayName",[583,691,692],{"class":597},"?:",[583,694,683],{"class":593},[583,696,698,701,703],{"class":585,"line":697},7,[583,699,700],{"class":604},"    email",[583,702,692],{"class":597},[583,704,683],{"class":593},[583,706,708],{"class":585,"line":707},8,[583,709,710],{"class":614},"    \u002F\u002F For type === 'agent', mirrors evlog\u002Fai fields:\n",[583,712,714,717,719],{"class":585,"line":713},9,[583,715,716],{"class":604},"    model",[583,718,692],{"class":597},[583,720,683],{"class":593},[583,722,724,727,729,731],{"class":585,"line":723},10,[583,725,726],{"class":604},"    tools",[583,728,692],{"class":597},[583,730,611],{"class":593},[583,732,734],{"class":733},"sTEyZ","[]\n",[583,736,738,741,743],{"class":585,"line":737},11,[583,739,740],{"class":604},"    reason",[583,742,692],{"class":597},[583,744,683],{"class":593},[583,746,748,751,753],{"class":585,"line":747},12,[583,749,750],{"class":604},"    promptId",[583,752,692],{"class":597},[583,754,683],{"class":593},[583,756,758],{"class":585,"line":757},13,[583,759,760],{"class":597},"  }\n",[583,762,764,767,769,772,774,776,778,781,784,786,788,790,793,797,799,801,804,806,809],{"class":585,"line":763},14,[583,765,766],{"class":604},"  target",[583,768,692],{"class":597},[583,770,771],{"class":597}," {",[583,773,572],{"class":604},[583,775,608],{"class":597},[583,777,611],{"class":593},[583,779,780],{"class":597},",",[583,782,783],{"class":604}," id",[583,785,608],{"class":597},[583,787,611],{"class":593},[583,789,780],{"class":597},[583,791,792],{"class":733}," [",[583,794,796],{"class":795},"sHdIc","k",[583,798,608],{"class":597},[583,800,611],{"class":593},[583,802,803],{"class":733},"]",[583,805,608],{"class":597},[583,807,808],{"class":593}," unknown",[583,810,811],{"class":597}," }\n",[583,813,815,818,820,822,825,827,829,831,834,836,838,840,843],{"class":585,"line":814},15,[583,816,817],{"class":604},"  outcome",[583,819,608],{"class":597},[583,821,636],{"class":597},[583,823,824],{"class":639},"success",[583,826,643],{"class":597},[583,828,646],{"class":597},[583,830,636],{"class":597},[583,832,833],{"class":639},"failure",[583,835,643],{"class":597},[583,837,646],{"class":597},[583,839,636],{"class":597},[583,841,842],{"class":639},"denied",[583,844,672],{"class":597},[583,846,848,851,853],{"class":585,"line":847},16,[583,849,850],{"class":604},"  reason",[583,852,692],{"class":597},[583,854,683],{"class":593},[583,856,858,861,863,865,868,870,872,874,877,879,881],{"class":585,"line":857},17,[583,859,860],{"class":604},"  changes",[583,862,692],{"class":597},[583,864,771],{"class":597},[583,866,867],{"class":604}," before",[583,869,692],{"class":597},[583,871,808],{"class":593},[583,873,780],{"class":597},[583,875,876],{"class":604}," after",[583,878,692],{"class":597},[583,880,808],{"class":593},[583,882,811],{"class":597},[583,884,886,889,891,893],{"class":585,"line":885},18,[583,887,888],{"class":604},"  causationId",[583,890,692],{"class":597},[583,892,611],{"class":593},[583,894,895],{"class":614},"                    \u002F\u002F ID of the action that caused this one\n",[583,897,899,902,904,906],{"class":585,"line":898},19,[583,900,901],{"class":604},"  correlationId",[583,903,692],{"class":597},[583,905,611],{"class":593},[583,907,908],{"class":614},"                  \u002F\u002F Shared by every action in one operation\n",[583,910,912,915,917,920],{"class":585,"line":911},20,[583,913,914],{"class":604},"  version",[583,916,692],{"class":597},[583,918,919],{"class":593}," number",[583,921,922],{"class":614},"                        \u002F\u002F Defaults to 1\n",[583,924,926,929,931,933],{"class":585,"line":925},21,[583,927,928],{"class":604},"  idempotencyKey",[583,930,692],{"class":597},[583,932,611],{"class":593},[583,934,935],{"class":614},"                 \u002F\u002F Auto-derived; safe retries across drains\n",[583,937,939,942,944,946],{"class":585,"line":938},22,[583,940,941],{"class":604},"  context",[583,943,692],{"class":597},[583,945,771],{"class":597},[583,947,948],{"class":614},"                             \u002F\u002F Filled by auditEnricher\n",[583,950,952,955,957],{"class":585,"line":951},23,[583,953,954],{"class":604},"    requestId",[583,956,692],{"class":597},[583,958,683],{"class":593},[583,960,962,965,967],{"class":585,"line":961},24,[583,963,964],{"class":604},"    traceId",[583,966,692],{"class":597},[583,968,683],{"class":593},[583,970,972,975,977],{"class":585,"line":971},25,[583,973,974],{"class":604},"    ip",[583,976,692],{"class":597},[583,978,683],{"class":593},[583,980,982,985,987],{"class":585,"line":981},26,[583,983,984],{"class":604},"    userAgent",[583,986,692],{"class":597},[583,988,683],{"class":593},[583,990,992,995,997],{"class":585,"line":991},27,[583,993,994],{"class":604},"    tenantId",[583,996,692],{"class":597},[583,998,683],{"class":593},[583,1000,1002],{"class":585,"line":1001},28,[583,1003,760],{"class":597},[583,1005,1007,1010,1012,1014],{"class":585,"line":1006},29,[583,1008,1009],{"class":604},"  signature",[583,1011,692],{"class":597},[583,1013,611],{"class":593},[583,1015,1016],{"class":614},"                      \u002F\u002F Set by signed({ strategy: 'hmac' })\n",[583,1018,1020,1023,1025,1027],{"class":585,"line":1019},30,[583,1021,1022],{"class":604},"  prevHash",[583,1024,692],{"class":597},[583,1026,611],{"class":593},[583,1028,1029],{"class":614},"                       \u002F\u002F Set by signed({ strategy: 'hash-chain' })\n",[583,1031,1033,1036,1038],{"class":585,"line":1032},31,[583,1034,1035],{"class":604},"  hash",[583,1037,692],{"class":597},[583,1039,683],{"class":593},[583,1041,1043],{"class":585,"line":1042},32,[583,1044,1045],{"class":597},"}\n",[566,1047,1049],{"id":1048},"action-naming","Action naming",[1051,1052,1053,1061,1062,1065,1066,1069,1070,1069,1073,1076,1077,1080,1081,1084,1085,1087],"tip",{},[1054,1055,1056,1057,1060],"strong",{},"Naming convention for ",[557,1058,1059],{},"action","."," Use ",[557,1063,1064],{},"noun.verb"," (",[557,1067,1068],{},"invoice.refund",", ",[557,1071,1072],{},"user.invite",[557,1074,1075],{},"apiKey.revoke","). Past tense if the action already happened (",[557,1078,1079],{},"invoice.refunded","), present tense if ",[557,1082,1083],{},"withAudit()"," will resolve the outcome. Keep a small fixed dictionary in one file — auditors and SIEM rules query on ",[557,1086,1059],{},", so a typo is a missing alert.",[554,1089,1090],{},"A single dictionary file makes alerting straightforward:",[574,1092,1095],{"className":576,"code":1093,"filename":1094,"language":578,"meta":579,"style":579},"export const AUDIT_ACTIONS = {\n  USER_INVITE: 'user.invite',\n  USER_REMOVE: 'user.remove',\n  USER_ROLE_CHANGE: 'user.role-change',\n  INVOICE_REFUND: 'invoice.refund',\n  API_KEY_REVOKE: 'apiKey.revoke',\n} as const\n","src\u002Faudit\u002Factions.ts",[557,1096,1097,1114,1130,1146,1162,1177,1192],{"__ignoreMap":579},[583,1098,1099,1103,1106,1109,1112],{"class":585,"line":586},[583,1100,1102],{"class":1101},"s7zQu","export",[583,1104,1105],{"class":589}," const",[583,1107,1108],{"class":733}," AUDIT_ACTIONS ",[583,1110,1111],{"class":597},"=",[583,1113,598],{"class":597},[583,1115,1116,1119,1121,1123,1125,1127],{"class":585,"line":601},[583,1117,1118],{"class":604},"  USER_INVITE",[583,1120,608],{"class":597},[583,1122,636],{"class":597},[583,1124,1072],{"class":639},[583,1126,643],{"class":597},[583,1128,1129],{"class":597},",\n",[583,1131,1132,1135,1137,1139,1142,1144],{"class":585,"line":618},[583,1133,1134],{"class":604},"  USER_REMOVE",[583,1136,608],{"class":597},[583,1138,636],{"class":597},[583,1140,1141],{"class":639},"user.remove",[583,1143,643],{"class":597},[583,1145,1129],{"class":597},[583,1147,1148,1151,1153,1155,1158,1160],{"class":585,"line":628},[583,1149,1150],{"class":604},"  USER_ROLE_CHANGE",[583,1152,608],{"class":597},[583,1154,636],{"class":597},[583,1156,1157],{"class":639},"user.role-change",[583,1159,643],{"class":597},[583,1161,1129],{"class":597},[583,1163,1164,1167,1169,1171,1173,1175],{"class":585,"line":675},[583,1165,1166],{"class":604},"  INVOICE_REFUND",[583,1168,608],{"class":597},[583,1170,636],{"class":597},[583,1172,1068],{"class":639},[583,1174,643],{"class":597},[583,1176,1129],{"class":597},[583,1178,1179,1182,1184,1186,1188,1190],{"class":585,"line":686},[583,1180,1181],{"class":604},"  API_KEY_REVOKE",[583,1183,608],{"class":597},[583,1185,636],{"class":597},[583,1187,1075],{"class":639},[583,1189,643],{"class":597},[583,1191,1129],{"class":597},[583,1193,1194,1197,1200],{"class":585,"line":697},[583,1195,1196],{"class":597},"}",[583,1198,1199],{"class":1101}," as",[583,1201,1202],{"class":589}," const\n",[1051,1204,1205,1206,1213,1214,1216,1217,1220],{},"For more than a handful of actions, prefer ",[1207,1208,1210],"a",{"href":1209},"\u002Flogging\u002Faudit\u002Frecording#defineauditcatalog",[557,1211,1212],{},"defineAuditCatalog"," over a plain object dictionary — same ",[557,1215,1064],{}," convention, but you get autocomplete on the action union and per-entry ",[557,1218,1219],{},"target"," type inference for free.",[566,1222,1224],{"id":1223},"actor-types","Actor types",[1226,1227,1228,1061,1231,1234,1235,1238,1239,1242,1243,1246],"warning",{},[1054,1229,1230],{},"Don't fake the actor.",[557,1232,1233],{},"actor.type: 'system'"," for cron jobs, queue workers, and background tasks; ",[557,1236,1237],{},"actor.type: 'api'"," for machine-to-machine calls authenticated by a token; ",[557,1240,1241],{},"actor.type: 'agent'"," for AI tool calls. Logging a synthetic ",[557,1244,1245],{},"'user'"," for system actions is the single fastest way to fail an audit review.",[1248,1249,1250,1265],"table",{},[1251,1252,1253],"thead",{},[1254,1255,1256,1262],"tr",{},[1257,1258,1259],"th",{},[557,1260,1261],{},"actor.type",[1257,1263,1264],{},"When to use",[1266,1267,1268,1278,1288,1298],"tbody",{},[1254,1269,1270,1275],{},[1271,1272,1273],"td",{},[557,1274,1245],{},[1271,1276,1277],{},"A human authenticated through your normal auth flow.",[1254,1279,1280,1285],{},[1271,1281,1282],{},[557,1283,1284],{},"'system'",[1271,1286,1287],{},"Cron jobs, queue workers, scheduled tasks, internal background processes.",[1254,1289,1290,1295],{},[1271,1291,1292],{},[557,1293,1294],{},"'api'",[1271,1296,1297],{},"Machine-to-machine calls from another service authenticated by a token.",[1254,1299,1300,1305],{},[1271,1301,1302],{},[557,1303,1304],{},"'agent'",[1271,1306,1307,1308,1311,1312,1069,1315,1069,1318,1321],{},"AI tool calls (combine with ",[557,1309,1310],{},"evlog\u002Fai"," fields like ",[557,1313,1314],{},"model",[557,1316,1317],{},"tools",[557,1319,1320],{},"promptId",").",[566,1323,1325],{"id":1324},"outcomes","Outcomes",[1248,1327,1328,1340],{},[1251,1329,1330],{},[1254,1331,1332,1337],{},[1257,1333,1334],{},[557,1335,1336],{},"outcome",[1257,1338,1339],{},"Meaning",[1266,1341,1342,1352,1362],{},[1254,1343,1344,1349],{},[1271,1345,1346],{},[557,1347,1348],{},"'success'",[1271,1350,1351],{},"The action completed as requested.",[1254,1353,1354,1359],{},[1271,1355,1356],{},[557,1357,1358],{},"'failure'",[1271,1360,1361],{},"The action was attempted but failed (downstream error, race condition, etc.).",[1254,1363,1364,1369],{},[1271,1365,1366],{},[557,1367,1368],{},"'denied'",[1271,1370,1371],{},"The action was rejected by an authorisation check.",[554,1373,1374,1376,1377,1379,1380,1321],{},[557,1375,1358],{}," and ",[557,1378,1368],{}," are different things — auditors care a lot about denied actions because they signal probing or misconfigured access controls. Always log denials (see ",[1207,1381,1383],{"href":1382},"\u002Flogging\u002Faudit\u002Frecording#deny","Recording Events",[566,1385,1387],{"id":1386},"idempotency","Idempotency",[554,1389,1390,1393,1394,1069,1396,1069,1399,1401,1402,1405],{},[557,1391,1392],{},"idempotencyKey"," is auto-derived from a hash of ",[557,1395,1059],{},[557,1397,1398],{},"actor.id",[557,1400,1219],{},", and a coarse timestamp. The result: even if your drain retries an audit insert across a network blip, the duplicate row collapses on ",[557,1403,1404],{},"ON CONFLICT DO NOTHING",". You don't have to think about it — it's filled in for you.",[554,1407,1408],{},"Use the field as the primary key in Postgres \u002F Bigtable \u002F DynamoDB so retries stay safe by construction.",[566,1410,1412],{"id":1411},"causation-and-correlation","Causation and correlation",[1248,1414,1415,1425],{},[1251,1416,1417],{},[1254,1418,1419,1422],{},[1257,1420,1421],{},"Field",[1257,1423,1424],{},"Use case",[1266,1426,1427,1441],{},[1254,1428,1429,1434],{},[1271,1430,1431],{},[557,1432,1433],{},"correlationId",[1271,1435,1436,1437,1440],{},"Shared by every audit event that belongs to the ",[1054,1438,1439],{},"same operation"," (e.g. one HTTP request that triggers a refund + an email + a webhook).",[1254,1442,1443,1448],{},[1271,1444,1445],{},[557,1446,1447],{},"causationId",[1271,1449,1450,1451,1454],{},"The id of the previous audit event that ",[1054,1452,1453],{},"caused"," this one. Useful for reconstructing chains of cascading actions.",[554,1456,1457,1458,1460,1461,1464,1465,1467],{},"Most teams set ",[557,1459,1433],{}," to ",[557,1462,1463],{},"requestId",". ",[557,1466,1447],{}," is opt-in and only worth filling when a single user action triggers many internal audit events.",[1469,1470,1471],"style",{},"html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sHdIc, html code.shiki .sHdIc{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#EEFFFF;--shiki-default-font-style:italic;--shiki-dark:#BABED8;--shiki-dark-font-style:italic}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}",{"title":579,"searchDepth":601,"depth":601,"links":1473},[1474,1476,1477,1478,1479,1480],{"id":568,"depth":601,"text":1475},"AuditFields type",{"id":1048,"depth":601,"text":1049},{"id":1223,"depth":601,"text":1224},{"id":1324,"depth":601,"text":1325},{"id":1386,"depth":601,"text":1387},{"id":1411,"depth":601,"text":1412},"The AuditFields type, action naming conventions, actor types, idempotency, and how the schema sits inside a regular wide event.","md",[1484,1487],{"label":41,"icon":44,"to":134,"color":1485,"variant":1486},"neutral","subtle",{"label":142,"icon":145,"to":143,"color":1485,"variant":1486},{},{"title":137,"icon":140},{"title":549,"description":1481},"gy1kpgQgCJ5-_0ppU0U_2a2vwc_fY_N0gnhdM_FTWZM",[1493,1495],{"title":41,"path":134,"stem":135,"description":1494,"icon":44,"children":-1},"First-class audit logs as a thin layer on top of evlog's wide events. Add tamper-evident audit trails to any app with one enricher, one drain wrapper, and one helper.",{"title":142,"path":143,"stem":144,"description":1496,"icon":145,"children":-1},"log.audit, log.audit.deny, standalone audit(), withAudit auto-instrumentation, defineAuditAction and defineAuditCatalog registries, and auditDiff change patches.",1778338247100]