[{"data":1,"prerenderedAt":1414},["ShallowReactive",2],{"navigation_docs":3,"-use-cases-audit-schema":451,"-use-cases-audit-schema-surround":1409},[4,30,80,245,365,420],{"title":5,"path":6,"stem":7,"children":8,"page":29},"Start","\u002Fstart","1.start",[9,14,19,24],{"title":10,"path":11,"stem":12,"icon":13},"Introduction","\u002Fstart\u002Fintroduction","1.start\u002F1.introduction","i-lucide-info",{"title":15,"path":16,"stem":17,"icon":18},"Why start with evlog","\u002Fstart\u002Fwhy-evlog","1.start\u002F2.why-evlog","i-lucide-rocket",{"title":20,"path":21,"stem":22,"icon":23},"Installation","\u002Fstart\u002Finstallation","1.start\u002F3.installation","i-lucide-download",{"title":25,"path":26,"stem":27,"icon":28},"Quick Start","\u002Fstart\u002Fquick-start","1.start\u002F4.quick-start","i-lucide-zap",false,{"title":31,"path":32,"stem":33,"children":34,"page":29},"Learn","\u002Flearn","2.learn",[35,40,45,50,55,60,65,70,75],{"title":36,"path":37,"stem":38,"icon":39},"Overview","\u002Flearn\u002Foverview","2.learn\u002F0.overview","i-lucide-list",{"title":41,"path":42,"stem":43,"icon":44},"Simple Logging","\u002Flearn\u002Fsimple-logging","2.learn\u002F1.simple-logging","i-lucide-terminal",{"title":46,"path":47,"stem":48,"icon":49},"Wide Events","\u002Flearn\u002Fwide-events","2.learn\u002F2.wide-events","i-lucide-layers",{"title":51,"path":52,"stem":53,"icon":54},"Structured Errors","\u002Flearn\u002Fstructured-errors","2.learn\u002F3.structured-errors","i-lucide-shield-alert",{"title":56,"path":57,"stem":58,"icon":59},"Lifecycle","\u002Flearn\u002Flifecycle","2.learn\u002F4.lifecycle","i-lucide-arrow-right-left",{"title":61,"path":62,"stem":63,"icon":64},"Sampling","\u002Flearn\u002Fsampling","2.learn\u002F5.sampling","i-lucide-filter",{"title":66,"path":67,"stem":68,"icon":69},"Auto-Redaction","\u002Flearn\u002Fredaction","2.learn\u002F6.redaction","i-lucide-eye-off",{"title":71,"path":72,"stem":73,"icon":74},"Typed Fields","\u002Flearn\u002Ftyped-fields","2.learn\u002F7.typed-fields","i-simple-icons-typescript",{"title":76,"path":77,"stem":78,"icon":79},"Catalogs","\u002Flearn\u002Fcatalogs","2.learn\u002F8.catalogs","i-lucide-book-open",{"title":81,"path":82,"stem":83,"children":84,"page":29},"Integrate","\u002Fintegrate","3.integrate",[85,89,157],{"title":36,"path":86,"stem":87,"icon":88},"\u002Fintegrate\u002Foverview","3.integrate\u002F0.overview","i-lucide-plug",{"title":90,"path":91,"stem":92,"children":93,"page":29},"Adapters","\u002Fintegrate\u002Fadapters","3.integrate\u002Fadapters",[94,97,137],{"title":36,"path":95,"stem":96,"icon":39},"\u002Fintegrate\u002Fadapters\u002Foverview","3.integrate\u002Fadapters\u002F01.overview",{"title":98,"path":99,"stem":100,"children":101,"page":29},"Cloud","\u002Fintegrate\u002Fadapters\u002Fcloud","3.integrate\u002Fadapters\u002Fcloud",[102,107,112,117,122,127,132],{"title":103,"path":104,"stem":105,"icon":106},"Axiom","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Faxiom","3.integrate\u002Fadapters\u002Fcloud\u002F01.axiom","i-custom-axiom",{"title":108,"path":109,"stem":110,"icon":111},"OTLP","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fotlp","3.integrate\u002Fadapters\u002Fcloud\u002F02.otlp","i-simple-icons-opentelemetry",{"title":113,"path":114,"stem":115,"icon":116},"PostHog","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fposthog","3.integrate\u002Fadapters\u002Fcloud\u002F03.posthog","i-simple-icons-posthog",{"title":118,"path":119,"stem":120,"icon":121},"Sentry","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fsentry","3.integrate\u002Fadapters\u002Fcloud\u002F04.sentry","i-simple-icons-sentry",{"title":123,"path":124,"stem":125,"icon":126},"Better Stack","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fbetter-stack","3.integrate\u002Fadapters\u002Fcloud\u002F05.better-stack","i-simple-icons-betterstack",{"title":128,"path":129,"stem":130,"icon":131},"Datadog","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fdatadog","3.integrate\u002Fadapters\u002Fcloud\u002F06.datadog","i-simple-icons-datadog",{"title":133,"path":134,"stem":135,"icon":136},"HyperDX","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fhyperdx","3.integrate\u002Fadapters\u002Fcloud\u002F07.hyperdx","i-custom-hyperdx",{"title":138,"path":139,"stem":140,"children":141,"page":29},"Self-Hosted","\u002Fintegrate\u002Fadapters\u002Fself-hosted","3.integrate\u002Fadapters\u002Fself-hosted",[142,147,152],{"title":143,"path":144,"stem":145,"icon":146},"File System","\u002Fintegrate\u002Fadapters\u002Fself-hosted\u002Ffs","3.integrate\u002Fadapters\u002Fself-hosted\u002F01.fs","i-lucide-hard-drive",{"title":148,"path":149,"stem":150,"icon":151},"NuxtHub","\u002Fintegrate\u002Fadapters\u002Fself-hosted\u002Fnuxthub","3.integrate\u002Fadapters\u002Fself-hosted\u002F02.nuxthub","i-simple-icons-nuxt",{"title":153,"path":154,"stem":155,"icon":156},"Memory","\u002Fintegrate\u002Fadapters\u002Fself-hosted\u002Fmemory","3.integrate\u002Fadapters\u002Fself-hosted\u002F03.memory","i-lucide-cpu",{"title":158,"path":159,"stem":160,"children":161,"page":29},"Frameworks","\u002Fintegrate\u002Fframeworks","3.integrate\u002Fframeworks",[162,166,171,176,181,186,191,196,201,206,211,216,221,226,230,235,240],{"title":36,"path":163,"stem":164,"icon":165},"\u002Fintegrate\u002Fframeworks\u002Foverview","3.integrate\u002Fframeworks\u002F00.overview","i-lucide-layout-grid",{"title":167,"path":168,"stem":169,"icon":170},"Nuxt","\u002Fintegrate\u002Fframeworks\u002Fnuxt","3.integrate\u002Fframeworks\u002F01.nuxt","i-simple-icons-nuxtdotjs",{"title":172,"path":173,"stem":174,"icon":175},"Next.js","\u002Fintegrate\u002Fframeworks\u002Fnextjs","3.integrate\u002Fframeworks\u002F02.nextjs","i-simple-icons-nextdotjs",{"title":177,"path":178,"stem":179,"icon":180},"SvelteKit","\u002Fintegrate\u002Fframeworks\u002Fsveltekit","3.integrate\u002Fframeworks\u002F03.sveltekit","i-simple-icons-svelte",{"title":182,"path":183,"stem":184,"icon":185},"Nitro","\u002Fintegrate\u002Fframeworks\u002Fnitro","3.integrate\u002Fframeworks\u002F04.nitro","i-custom-nitro",{"title":187,"path":188,"stem":189,"icon":190},"TanStack Start","\u002Fintegrate\u002Fframeworks\u002Ftanstack-start","3.integrate\u002Fframeworks\u002F05.tanstack-start","i-custom-tanstack",{"title":192,"path":193,"stem":194,"icon":195},"NestJS","\u002Fintegrate\u002Fframeworks\u002Fnestjs","3.integrate\u002Fframeworks\u002F06.nestjs","i-simple-icons-nestjs",{"title":197,"path":198,"stem":199,"icon":200},"Express","\u002Fintegrate\u002Fframeworks\u002Fexpress","3.integrate\u002Fframeworks\u002F07.express","i-simple-icons-express",{"title":202,"path":203,"stem":204,"icon":205},"Hono","\u002Fintegrate\u002Fframeworks\u002Fhono","3.integrate\u002Fframeworks\u002F08.hono","i-simple-icons-hono",{"title":207,"path":208,"stem":209,"icon":210},"Fastify","\u002Fintegrate\u002Fframeworks\u002Ffastify","3.integrate\u002Fframeworks\u002F09.fastify","i-simple-icons-fastify",{"title":212,"path":213,"stem":214,"icon":215},"Elysia","\u002Fintegrate\u002Fframeworks\u002Felysia","3.integrate\u002Fframeworks\u002F10.elysia","i-custom-elysia",{"title":217,"path":218,"stem":219,"icon":220},"React Router","\u002Fintegrate\u002Fframeworks\u002Freact-router","3.integrate\u002Fframeworks\u002F11.react-router","i-custom-reactrouter",{"title":222,"path":223,"stem":224,"icon":225},"Cloudflare Workers","\u002Fintegrate\u002Fframeworks\u002Fcloudflare-workers","3.integrate\u002Fframeworks\u002F12.cloudflare-workers","i-simple-icons-cloudflare",{"title":227,"path":228,"stem":229,"icon":74},"Standalone","\u002Fintegrate\u002Fframeworks\u002Fstandalone","3.integrate\u002Fframeworks\u002F13.standalone",{"title":231,"path":232,"stem":233,"icon":234},"Astro","\u002Fintegrate\u002Fframeworks\u002Fastro","3.integrate\u002Fframeworks\u002F14.astro","i-simple-icons-astro",{"title":236,"path":237,"stem":238,"icon":239},"oRPC","\u002Fintegrate\u002Fframeworks\u002Forpc","3.integrate\u002Fframeworks\u002F15.orpc","i-lucide-network",{"title":241,"path":242,"stem":243,"icon":244},"AWS Lambda","\u002Fintegrate\u002Fframeworks\u002Faws-lambda","3.integrate\u002Fframeworks\u002F16.aws-lambda","i-custom-lambda",{"title":246,"path":247,"stem":248,"children":249,"page":29},"Use Cases","\u002Fuse-cases","4.use-cases",[250,254,259,288,316,348,353,358],{"title":36,"path":251,"stem":252,"icon":253},"\u002Fuse-cases\u002Foverview","4.use-cases\u002F0.overview","i-lucide-list-checks",{"title":255,"path":256,"stem":257,"icon":258},"Client Logging","\u002Fuse-cases\u002Fclient-logging","4.use-cases\u002F1.client-logging","i-lucide-monitor",{"title":260,"icon":261,"path":262,"stem":263,"children":264,"page":29},"AI SDK","i-simple-icons-vercel","\u002Fuse-cases\u002Fai-sdk","4.use-cases\u002F2.ai-sdk",[265,268,273,278,283],{"title":36,"path":266,"stem":267,"icon":39},"\u002Fuse-cases\u002Fai-sdk\u002Foverview","4.use-cases\u002F2.ai-sdk\u002F01.overview",{"title":269,"path":270,"stem":271,"icon":272},"Usage","\u002Fuse-cases\u002Fai-sdk\u002Fusage","4.use-cases\u002F2.ai-sdk\u002F02.usage","i-lucide-code",{"title":274,"path":275,"stem":276,"icon":277},"Options","\u002Fuse-cases\u002Fai-sdk\u002Foptions","4.use-cases\u002F2.ai-sdk\u002F03.options","i-lucide-sliders",{"title":279,"path":280,"stem":281,"icon":282},"Metadata","\u002Fuse-cases\u002Fai-sdk\u002Fmetadata","4.use-cases\u002F2.ai-sdk\u002F04.metadata","i-lucide-database",{"title":284,"path":285,"stem":286,"icon":287},"Telemetry","\u002Fuse-cases\u002Fai-sdk\u002Ftelemetry","4.use-cases\u002F2.ai-sdk\u002F05.telemetry","i-lucide-activity",{"title":289,"icon":290,"path":291,"stem":292,"children":293,"page":29},"Better Auth","i-simple-icons-betterauth","\u002Fuse-cases\u002Fbetter-auth","4.use-cases\u002F3.better-auth",[294,297,302,307,311],{"title":36,"path":295,"stem":296,"icon":39},"\u002Fuse-cases\u002Fbetter-auth\u002Foverview","4.use-cases\u002F3.better-auth\u002F01.overview",{"title":298,"path":299,"stem":300,"icon":301},"Identify User","\u002Fuse-cases\u002Fbetter-auth\u002Fidentify-user","4.use-cases\u002F3.better-auth\u002F02.identify-user","i-lucide-user-check",{"title":303,"path":304,"stem":305,"icon":306},"Middleware","\u002Fuse-cases\u002Fbetter-auth\u002Fmiddleware","4.use-cases\u002F3.better-auth\u002F03.middleware","i-lucide-shield",{"title":308,"path":309,"stem":310,"icon":258},"Client Sync","\u002Fuse-cases\u002Fbetter-auth\u002Fclient-sync","4.use-cases\u002F3.better-auth\u002F04.client-sync",{"title":312,"path":313,"stem":314,"icon":315},"Performance","\u002Fuse-cases\u002Fbetter-auth\u002Fperformance","4.use-cases\u002F3.better-auth\u002F05.performance","i-lucide-gauge",{"title":317,"icon":318,"path":319,"stem":320,"children":321,"page":29},"Audit Logs","i-lucide-shield-check","\u002Fuse-cases\u002Faudit","4.use-cases\u002F4.audit",[322,325,330,335,340,344],{"title":36,"path":323,"stem":324,"icon":39},"\u002Fuse-cases\u002Faudit\u002Foverview","4.use-cases\u002F4.audit\u002F01.overview",{"title":326,"path":327,"stem":328,"icon":329},"Schema","\u002Fuse-cases\u002Faudit\u002Fschema","4.use-cases\u002F4.audit\u002F02.schema","i-lucide-file-text",{"title":331,"path":332,"stem":333,"icon":334},"Recording","\u002Fuse-cases\u002Faudit\u002Frecording","4.use-cases\u002F4.audit\u002F03.recording","i-lucide-pen-line",{"title":336,"path":337,"stem":338,"icon":339},"Drains","\u002Fuse-cases\u002Faudit\u002Fpipeline","4.use-cases\u002F4.audit\u002F04.pipeline","i-lucide-link",{"title":341,"path":342,"stem":343,"icon":318},"Compliance","\u002Fuse-cases\u002Faudit\u002Fcompliance","4.use-cases\u002F4.audit\u002F05.compliance",{"title":345,"path":346,"stem":347,"icon":79},"Recipes","\u002Fuse-cases\u002Faudit\u002Frecipes","4.use-cases\u002F4.audit\u002F06.recipes",{"title":349,"path":350,"stem":351,"icon":352},"Enrichers","\u002Fuse-cases\u002Fenrichers","4.use-cases\u002F5.enrichers","i-lucide-sparkles",{"title":354,"path":355,"stem":356,"icon":357},"eve","\u002Fuse-cases\u002Feve","4.use-cases\u002F5.eve","i-custom-eve",{"title":284,"path":359,"stem":360,"children":361,"page":29},"\u002Fuse-cases\u002Ftelemetry","4.use-cases\u002F6.telemetry",[362],{"title":284,"path":363,"stem":364,"icon":315},"\u002Fuse-cases\u002Ftelemetry\u002Foverview","4.use-cases\u002F6.telemetry\u002F01.overview",{"title":366,"path":367,"stem":368,"children":369,"page":29},"Extend","\u002Fextend","5.extend",[370,374,379,384,389,393,397,401,405,410,415],{"title":36,"path":371,"stem":372,"icon":373},"\u002Fextend\u002Foverview","5.extend\u002F0.overview","i-lucide-blocks",{"title":375,"path":376,"stem":377,"icon":378},"Stream","\u002Fextend\u002Fstream","5.extend\u002F1.stream","i-lucide-radio-tower",{"title":380,"path":381,"stem":382,"icon":383},"Custom framework","\u002Fextend\u002Fcustom-framework","5.extend\u002F10.custom-framework","i-lucide-puzzle",{"title":385,"path":386,"stem":387,"icon":388},"FS reader","\u002Fextend\u002Ffs-reader","5.extend\u002F2.fs-reader","i-lucide-folder-search",{"title":345,"path":390,"stem":391,"icon":392},"\u002Fextend\u002Fconsumer-recipes","5.extend\u002F3.consumer-recipes","i-lucide-chef-hat",{"title":394,"path":395,"stem":396,"icon":373},"Plugins","\u002Fextend\u002Fplugins","5.extend\u002F4.plugins",{"title":398,"path":399,"stem":400,"icon":352},"Custom enrichers","\u002Fextend\u002Fcustom-enrichers","5.extend\u002F5.custom-enrichers",{"title":402,"path":403,"stem":404,"icon":64},"Tail sampling","\u002Fextend\u002Ftail-sampling","5.extend\u002F6.tail-sampling",{"title":406,"path":407,"stem":408,"icon":409},"Identity headers","\u002Fextend\u002Fidentity-headers","5.extend\u002F7.identity-headers","i-lucide-fingerprint",{"title":411,"path":412,"stem":413,"icon":414},"Custom drains","\u002Fextend\u002Fcustom-drains","5.extend\u002F8.custom-drains","i-lucide-share-2",{"title":416,"path":417,"stem":418,"icon":419},"Drain pipeline","\u002Fextend\u002Fdrain-pipeline","5.extend\u002F9.drain-pipeline","i-lucide-workflow",{"title":421,"path":422,"stem":423,"children":424,"page":29},"Reference","\u002Freference","6.reference",[425,430,433,438,442,447],{"title":426,"path":427,"stem":428,"icon":429},"Configuration","\u002Freference\u002Fconfiguration","6.reference\u002F1.configuration","i-lucide-settings",{"title":312,"path":431,"stem":432,"icon":315},"\u002Freference\u002Fperformance","6.reference\u002F2.performance",{"title":434,"path":435,"stem":436,"icon":437},"Vite Plugin","\u002Freference\u002Fvite-plugin","6.reference\u002F3.vite-plugin","i-custom-vite",{"title":439,"path":440,"stem":441,"icon":318},"Best Practices","\u002Freference\u002Fbest-practices","6.reference\u002F4.best-practices",{"title":443,"path":444,"stem":445,"icon":446},"vs Other Loggers","\u002Freference\u002Fvs-other-loggers","6.reference\u002F5.vs-other-loggers","i-lucide-scale",{"title":448,"path":449,"stem":450,"icon":352},"Agent Skills","\u002Freference\u002Fagent-skills","6.reference\u002F6.agent-skills",{"id":452,"title":453,"body":454,"description":1398,"extension":1399,"links":1400,"meta":1405,"navigation":1406,"path":327,"seo":1407,"stem":328,"__hash__":1408},"docs\u002F4.use-cases\u002F4.audit\u002F02.schema.md","Audit Schema",{"type":455,"value":456,"toc":1389},"minimark",[457,469,477,963,967,1005,1008,1120,1138,1142,1164,1239,1243,1289,1301,1305,1323,1326,1330,1372,1385],[458,459,460,464,465,468],"p",{},[461,462,463],"code",{},"event.audit"," is a typed field on every wide event. Downstream queries filter on ",[461,466,467],{},"audit IS NOT NULL"," to materialise an audit dataset out of regular logs.",[470,471,473,476],"h2",{"id":472},"auditfields-type",[461,474,475],{},"AuditFields"," type",[478,479,484],"pre",{"className":480,"code":481,"language":482,"meta":483,"style":483},"language-typescript shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","interface AuditFields {\n  action: string                          \u002F\u002F 'invoice.refund'\n  actor: {\n    type: 'user' | 'system' | 'api' | 'agent'\n    id: string\n    displayName?: string\n    email?: string\n    \u002F\u002F For type === 'agent', mirrors evlog\u002Fai fields:\n    model?: string\n    tools?: string[]\n    reason?: string\n    promptId?: string\n  }\n  target?: { type: string, id: string, [k: string]: unknown }\n  outcome: 'success' | 'failure' | 'denied'\n  reason?: string\n  changes?: { before?: unknown, after?: unknown, patch?: AuditPatchOp[] }\n  causationId?: string                    \u002F\u002F ID of the action that caused this one\n  correlationId?: string                  \u002F\u002F Shared by every action in one operation\n  version?: number                        \u002F\u002F Defaults to 1\n  idempotencyKey?: string                 \u002F\u002F Auto-derived; safe retries across drains\n  context?: {                             \u002F\u002F Filled by auditEnricher\n    requestId?: string\n    traceId?: string\n    ip?: string\n    userAgent?: string\n    tenantId?: string\n  }\n  signature?: string                      \u002F\u002F Set by signed({ strategy: 'hmac' })\n  prevHash?: string                       \u002F\u002F Set by signed({ strategy: 'hash-chain' })\n  hash?: string\n}\n","typescript","",[461,485,486,503,520,530,577,588,599,609,615,625,639,649,659,665,716,749,759,801,814,827,841,854,867,877,887,897,907,917,922,935,948,958],{"__ignoreMap":483},[487,488,491,495,499],"span",{"class":489,"line":490},"line",1,[487,492,494],{"class":493},"spNyl","interface",[487,496,498],{"class":497},"sBMFI"," AuditFields",[487,500,502],{"class":501},"sMK4o"," {\n",[487,504,506,510,513,516],{"class":489,"line":505},2,[487,507,509],{"class":508},"swJcz","  action",[487,511,512],{"class":501},":",[487,514,515],{"class":497}," string",[487,517,519],{"class":518},"sHwdD","                          \u002F\u002F 'invoice.refund'\n",[487,521,523,526,528],{"class":489,"line":522},3,[487,524,525],{"class":508},"  actor",[487,527,512],{"class":501},[487,529,502],{"class":501},[487,531,533,536,538,541,545,548,551,553,556,558,560,562,565,567,569,571,574],{"class":489,"line":532},4,[487,534,535],{"class":508},"    type",[487,537,512],{"class":501},[487,539,540],{"class":501}," '",[487,542,544],{"class":543},"sfazB","user",[487,546,547],{"class":501},"'",[487,549,550],{"class":501}," |",[487,552,540],{"class":501},[487,554,555],{"class":543},"system",[487,557,547],{"class":501},[487,559,550],{"class":501},[487,561,540],{"class":501},[487,563,564],{"class":543},"api",[487,566,547],{"class":501},[487,568,550],{"class":501},[487,570,540],{"class":501},[487,572,573],{"class":543},"agent",[487,575,576],{"class":501},"'\n",[487,578,580,583,585],{"class":489,"line":579},5,[487,581,582],{"class":508},"    id",[487,584,512],{"class":501},[487,586,587],{"class":497}," string\n",[487,589,591,594,597],{"class":489,"line":590},6,[487,592,593],{"class":508},"    displayName",[487,595,596],{"class":501},"?:",[487,598,587],{"class":497},[487,600,602,605,607],{"class":489,"line":601},7,[487,603,604],{"class":508},"    email",[487,606,596],{"class":501},[487,608,587],{"class":497},[487,610,612],{"class":489,"line":611},8,[487,613,614],{"class":518},"    \u002F\u002F For type === 'agent', mirrors evlog\u002Fai fields:\n",[487,616,618,621,623],{"class":489,"line":617},9,[487,619,620],{"class":508},"    model",[487,622,596],{"class":501},[487,624,587],{"class":497},[487,626,628,631,633,635],{"class":489,"line":627},10,[487,629,630],{"class":508},"    tools",[487,632,596],{"class":501},[487,634,515],{"class":497},[487,636,638],{"class":637},"sTEyZ","[]\n",[487,640,642,645,647],{"class":489,"line":641},11,[487,643,644],{"class":508},"    reason",[487,646,596],{"class":501},[487,648,587],{"class":497},[487,650,652,655,657],{"class":489,"line":651},12,[487,653,654],{"class":508},"    promptId",[487,656,596],{"class":501},[487,658,587],{"class":497},[487,660,662],{"class":489,"line":661},13,[487,663,664],{"class":501},"  }\n",[487,666,668,671,673,676,678,680,682,685,688,690,692,694,697,701,703,705,708,710,713],{"class":489,"line":667},14,[487,669,670],{"class":508},"  target",[487,672,596],{"class":501},[487,674,675],{"class":501}," {",[487,677,476],{"class":508},[487,679,512],{"class":501},[487,681,515],{"class":497},[487,683,684],{"class":501},",",[487,686,687],{"class":508}," id",[487,689,512],{"class":501},[487,691,515],{"class":497},[487,693,684],{"class":501},[487,695,696],{"class":637}," [",[487,698,700],{"class":699},"sHdIc","k",[487,702,512],{"class":501},[487,704,515],{"class":497},[487,706,707],{"class":637},"]",[487,709,512],{"class":501},[487,711,712],{"class":497}," unknown",[487,714,715],{"class":501}," }\n",[487,717,719,722,724,726,729,731,733,735,738,740,742,744,747],{"class":489,"line":718},15,[487,720,721],{"class":508},"  outcome",[487,723,512],{"class":501},[487,725,540],{"class":501},[487,727,728],{"class":543},"success",[487,730,547],{"class":501},[487,732,550],{"class":501},[487,734,540],{"class":501},[487,736,737],{"class":543},"failure",[487,739,547],{"class":501},[487,741,550],{"class":501},[487,743,540],{"class":501},[487,745,746],{"class":543},"denied",[487,748,576],{"class":501},[487,750,752,755,757],{"class":489,"line":751},16,[487,753,754],{"class":508},"  reason",[487,756,596],{"class":501},[487,758,587],{"class":497},[487,760,762,765,767,769,772,774,776,778,781,783,785,787,790,792,795,798],{"class":489,"line":761},17,[487,763,764],{"class":508},"  changes",[487,766,596],{"class":501},[487,768,675],{"class":501},[487,770,771],{"class":508}," before",[487,773,596],{"class":501},[487,775,712],{"class":497},[487,777,684],{"class":501},[487,779,780],{"class":508}," after",[487,782,596],{"class":501},[487,784,712],{"class":497},[487,786,684],{"class":501},[487,788,789],{"class":508}," patch",[487,791,596],{"class":501},[487,793,794],{"class":497}," AuditPatchOp",[487,796,797],{"class":637},"[] ",[487,799,800],{"class":501},"}\n",[487,802,804,807,809,811],{"class":489,"line":803},18,[487,805,806],{"class":508},"  causationId",[487,808,596],{"class":501},[487,810,515],{"class":497},[487,812,813],{"class":518},"                    \u002F\u002F ID of the action that caused this one\n",[487,815,817,820,822,824],{"class":489,"line":816},19,[487,818,819],{"class":508},"  correlationId",[487,821,596],{"class":501},[487,823,515],{"class":497},[487,825,826],{"class":518},"                  \u002F\u002F Shared by every action in one operation\n",[487,828,830,833,835,838],{"class":489,"line":829},20,[487,831,832],{"class":508},"  version",[487,834,596],{"class":501},[487,836,837],{"class":497}," number",[487,839,840],{"class":518},"                        \u002F\u002F Defaults to 1\n",[487,842,844,847,849,851],{"class":489,"line":843},21,[487,845,846],{"class":508},"  idempotencyKey",[487,848,596],{"class":501},[487,850,515],{"class":497},[487,852,853],{"class":518},"                 \u002F\u002F Auto-derived; safe retries across drains\n",[487,855,857,860,862,864],{"class":489,"line":856},22,[487,858,859],{"class":508},"  context",[487,861,596],{"class":501},[487,863,675],{"class":501},[487,865,866],{"class":518},"                             \u002F\u002F Filled by auditEnricher\n",[487,868,870,873,875],{"class":489,"line":869},23,[487,871,872],{"class":508},"    requestId",[487,874,596],{"class":501},[487,876,587],{"class":497},[487,878,880,883,885],{"class":489,"line":879},24,[487,881,882],{"class":508},"    traceId",[487,884,596],{"class":501},[487,886,587],{"class":497},[487,888,890,893,895],{"class":489,"line":889},25,[487,891,892],{"class":508},"    ip",[487,894,596],{"class":501},[487,896,587],{"class":497},[487,898,900,903,905],{"class":489,"line":899},26,[487,901,902],{"class":508},"    userAgent",[487,904,596],{"class":501},[487,906,587],{"class":497},[487,908,910,913,915],{"class":489,"line":909},27,[487,911,912],{"class":508},"    tenantId",[487,914,596],{"class":501},[487,916,587],{"class":497},[487,918,920],{"class":489,"line":919},28,[487,921,664],{"class":501},[487,923,925,928,930,932],{"class":489,"line":924},29,[487,926,927],{"class":508},"  signature",[487,929,596],{"class":501},[487,931,515],{"class":497},[487,933,934],{"class":518},"                      \u002F\u002F Set by signed({ strategy: 'hmac' })\n",[487,936,938,941,943,945],{"class":489,"line":937},30,[487,939,940],{"class":508},"  prevHash",[487,942,596],{"class":501},[487,944,515],{"class":497},[487,946,947],{"class":518},"                       \u002F\u002F Set by signed({ strategy: 'hash-chain' })\n",[487,949,951,954,956],{"class":489,"line":950},31,[487,952,953],{"class":508},"  hash",[487,955,596],{"class":501},[487,957,587],{"class":497},[487,959,961],{"class":489,"line":960},32,[487,962,800],{"class":501},[470,964,966],{"id":965},"action-naming","Action naming",[968,969,970,978,979,982,983,986,987,986,990,993,994,997,998,1001,1002,1004],"tip",{},[971,972,973,974,977],"strong",{},"Naming convention for ",[461,975,976],{},"action","."," Use ",[461,980,981],{},"noun.verb"," (",[461,984,985],{},"invoice.refund",", ",[461,988,989],{},"user.invite",[461,991,992],{},"apiKey.revoke","). Past tense if the action already happened (",[461,995,996],{},"invoice.refunded","), present tense if ",[461,999,1000],{},"withAudit()"," will resolve the outcome. Keep a small fixed dictionary in one file — auditors and SIEM rules query on ",[461,1003,976],{},", so a typo is a missing alert.",[458,1006,1007],{},"A single dictionary file makes alerting straightforward:",[478,1009,1012],{"className":480,"code":1010,"filename":1011,"language":482,"meta":483,"style":483},"export const AUDIT_ACTIONS = {\n  USER_INVITE: 'user.invite',\n  USER_REMOVE: 'user.remove',\n  USER_ROLE_CHANGE: 'user.role-change',\n  INVOICE_REFUND: 'invoice.refund',\n  API_KEY_REVOKE: 'apiKey.revoke',\n} as const\n","src\u002Faudit\u002Factions.ts",[461,1013,1014,1031,1047,1063,1079,1094,1109],{"__ignoreMap":483},[487,1015,1016,1020,1023,1026,1029],{"class":489,"line":490},[487,1017,1019],{"class":1018},"s7zQu","export",[487,1021,1022],{"class":493}," const",[487,1024,1025],{"class":637}," AUDIT_ACTIONS ",[487,1027,1028],{"class":501},"=",[487,1030,502],{"class":501},[487,1032,1033,1036,1038,1040,1042,1044],{"class":489,"line":505},[487,1034,1035],{"class":508},"  USER_INVITE",[487,1037,512],{"class":501},[487,1039,540],{"class":501},[487,1041,989],{"class":543},[487,1043,547],{"class":501},[487,1045,1046],{"class":501},",\n",[487,1048,1049,1052,1054,1056,1059,1061],{"class":489,"line":522},[487,1050,1051],{"class":508},"  USER_REMOVE",[487,1053,512],{"class":501},[487,1055,540],{"class":501},[487,1057,1058],{"class":543},"user.remove",[487,1060,547],{"class":501},[487,1062,1046],{"class":501},[487,1064,1065,1068,1070,1072,1075,1077],{"class":489,"line":532},[487,1066,1067],{"class":508},"  USER_ROLE_CHANGE",[487,1069,512],{"class":501},[487,1071,540],{"class":501},[487,1073,1074],{"class":543},"user.role-change",[487,1076,547],{"class":501},[487,1078,1046],{"class":501},[487,1080,1081,1084,1086,1088,1090,1092],{"class":489,"line":579},[487,1082,1083],{"class":508},"  INVOICE_REFUND",[487,1085,512],{"class":501},[487,1087,540],{"class":501},[487,1089,985],{"class":543},[487,1091,547],{"class":501},[487,1093,1046],{"class":501},[487,1095,1096,1099,1101,1103,1105,1107],{"class":489,"line":590},[487,1097,1098],{"class":508},"  API_KEY_REVOKE",[487,1100,512],{"class":501},[487,1102,540],{"class":501},[487,1104,992],{"class":543},[487,1106,547],{"class":501},[487,1108,1046],{"class":501},[487,1110,1111,1114,1117],{"class":489,"line":601},[487,1112,1113],{"class":501},"}",[487,1115,1116],{"class":1018}," as",[487,1118,1119],{"class":493}," const\n",[968,1121,1122,1123,1130,1131,1133,1134,1137],{},"For more than a handful of actions, prefer ",[1124,1125,1127],"a",{"href":1126},"\u002Fuse-cases\u002Faudit\u002Frecording#defineauditcatalog",[461,1128,1129],{},"defineAuditCatalog"," over a plain object dictionary — same ",[461,1132,981],{}," convention, but you get autocomplete on the action union and per-entry ",[461,1135,1136],{},"target"," type inference for free.",[470,1139,1141],{"id":1140},"actor-types","Actor types",[1143,1144,1145,978,1148,1151,1152,1155,1156,1159,1160,1163],"warning",{},[971,1146,1147],{},"Don't fake the actor.",[461,1149,1150],{},"actor.type: 'system'"," for cron jobs, queue workers, and background tasks; ",[461,1153,1154],{},"actor.type: 'api'"," for machine-to-machine calls authenticated by a token; ",[461,1157,1158],{},"actor.type: 'agent'"," for AI tool calls. Logging a synthetic ",[461,1161,1162],{},"'user'"," for system actions is the single fastest way to fail an audit review.",[1165,1166,1167,1182],"table",{},[1168,1169,1170],"thead",{},[1171,1172,1173,1179],"tr",{},[1174,1175,1176],"th",{},[461,1177,1178],{},"actor.type",[1174,1180,1181],{},"When to use",[1183,1184,1185,1195,1205,1215],"tbody",{},[1171,1186,1187,1192],{},[1188,1189,1190],"td",{},[461,1191,1162],{},[1188,1193,1194],{},"A human authenticated through your normal auth flow.",[1171,1196,1197,1202],{},[1188,1198,1199],{},[461,1200,1201],{},"'system'",[1188,1203,1204],{},"Cron jobs, queue workers, scheduled tasks, internal background processes.",[1171,1206,1207,1212],{},[1188,1208,1209],{},[461,1210,1211],{},"'api'",[1188,1213,1214],{},"Machine-to-machine calls from another service authenticated by a token.",[1171,1216,1217,1222],{},[1188,1218,1219],{},[461,1220,1221],{},"'agent'",[1188,1223,1224,1225,1228,1229,986,1232,986,1235,1238],{},"AI tool calls (combine with ",[461,1226,1227],{},"evlog\u002Fai"," fields like ",[461,1230,1231],{},"model",[461,1233,1234],{},"tools",[461,1236,1237],{},"promptId",").",[470,1240,1242],{"id":1241},"outcomes","Outcomes",[1165,1244,1245,1257],{},[1168,1246,1247],{},[1171,1248,1249,1254],{},[1174,1250,1251],{},[461,1252,1253],{},"outcome",[1174,1255,1256],{},"Meaning",[1183,1258,1259,1269,1279],{},[1171,1260,1261,1266],{},[1188,1262,1263],{},[461,1264,1265],{},"'success'",[1188,1267,1268],{},"The action completed as requested.",[1171,1270,1271,1276],{},[1188,1272,1273],{},[461,1274,1275],{},"'failure'",[1188,1277,1278],{},"The action was attempted but failed (downstream error, race condition, etc.).",[1171,1280,1281,1286],{},[1188,1282,1283],{},[461,1284,1285],{},"'denied'",[1188,1287,1288],{},"The action was rejected by an authorisation check.",[458,1290,1291,1293,1294,1296,1297,1238],{},[461,1292,1275],{}," and ",[461,1295,1285],{}," are different things — auditors care a lot about denied actions because they signal probing or misconfigured access controls. Always log denials (see ",[1124,1298,1300],{"href":1299},"\u002Fuse-cases\u002Faudit\u002Frecording#deny","Recording Events",[470,1302,1304],{"id":1303},"idempotency","Idempotency",[458,1306,1307,1310,1311,986,1313,986,1316,1318,1319,1322],{},[461,1308,1309],{},"idempotencyKey"," is auto-derived from a hash of ",[461,1312,976],{},[461,1314,1315],{},"actor.id",[461,1317,1136],{},", and a coarse timestamp. The result: even if your drain retries an audit insert across a network blip, the duplicate row collapses on ",[461,1320,1321],{},"ON CONFLICT DO NOTHING",". You don't have to think about it — it's filled in for you.",[458,1324,1325],{},"Use the field as the primary key in Postgres \u002F Bigtable \u002F DynamoDB so retries stay safe by construction.",[470,1327,1329],{"id":1328},"causation-and-correlation","Causation and correlation",[1165,1331,1332,1342],{},[1168,1333,1334],{},[1171,1335,1336,1339],{},[1174,1337,1338],{},"Field",[1174,1340,1341],{},"Use case",[1183,1343,1344,1358],{},[1171,1345,1346,1351],{},[1188,1347,1348],{},[461,1349,1350],{},"correlationId",[1188,1352,1353,1354,1357],{},"Shared by every audit event that belongs to the ",[971,1355,1356],{},"same operation"," (e.g. one HTTP request that triggers a refund + an email + a webhook).",[1171,1359,1360,1365],{},[1188,1361,1362],{},[461,1363,1364],{},"causationId",[1188,1366,1367,1368,1371],{},"The id of the previous audit event that ",[971,1369,1370],{},"caused"," this one. Useful for reconstructing chains of cascading actions.",[458,1373,1374,1375,1377,1378,1381,1382,1384],{},"Most teams set ",[461,1376,1350],{}," to ",[461,1379,1380],{},"requestId",". ",[461,1383,1364],{}," is opt-in and only worth filling when a single user action triggers many internal audit events.",[1386,1387,1388],"style",{},"html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sHdIc, html code.shiki .sHdIc{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#EEFFFF;--shiki-default-font-style:italic;--shiki-dark:#BABED8;--shiki-dark-font-style:italic}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}",{"title":483,"searchDepth":505,"depth":505,"links":1390},[1391,1393,1394,1395,1396,1397],{"id":472,"depth":505,"text":1392},"AuditFields type",{"id":965,"depth":505,"text":966},{"id":1140,"depth":505,"text":1141},{"id":1241,"depth":505,"text":1242},{"id":1303,"depth":505,"text":1304},{"id":1328,"depth":505,"text":1329},"The AuditFields type, action naming conventions, actor types, idempotency, and how the schema sits inside a regular wide event.","md",[1401,1404],{"label":36,"icon":39,"to":323,"color":1402,"variant":1403},"neutral","subtle",{"label":331,"icon":334,"to":332,"color":1402,"variant":1403},{},{"title":326,"icon":329},{"title":453,"description":1398},"xLFPc01MyOsrinD5AKEXfW6O9LpLNMkwbiP9mad_O5o",[1410,1412],{"title":36,"path":323,"stem":324,"description":1411,"icon":39,"children":-1},"First-class audit logs as a thin layer on top of evlog's wide events. Add tamper-evident audit trails to any app with one enricher, one drain wrapper, and one helper.",{"title":331,"path":332,"stem":333,"description":1413,"icon":334,"children":-1},"log.audit, log.audit.deny, standalone audit(), withAudit auto-instrumentation, defineAuditAction and defineAuditCatalog registries, and auditDiff change patches.",1784142036916]