[{"data":1,"prerenderedAt":1427},["ShallowReactive",2],{"navigation_docs":3,"-use-cases-audit-schema":464,"-use-cases-audit-schema-surround":1422},[4,30,80,245,379,434],{"title":5,"path":6,"stem":7,"children":8,"page":29},"Start","\u002Fstart","1.start",[9,14,19,24],{"title":10,"path":11,"stem":12,"icon":13},"Introduction","\u002Fstart\u002Fintroduction","1.start\u002F1.introduction","i-lucide-info",{"title":15,"path":16,"stem":17,"icon":18},"Why start with evlog","\u002Fstart\u002Fwhy-evlog","1.start\u002F2.why-evlog","i-lucide-rocket",{"title":20,"path":21,"stem":22,"icon":23},"Installation","\u002Fstart\u002Finstallation","1.start\u002F3.installation","i-lucide-download",{"title":25,"path":26,"stem":27,"icon":28},"Quick Start","\u002Fstart\u002Fquick-start","1.start\u002F4.quick-start","i-lucide-zap",false,{"title":31,"path":32,"stem":33,"children":34,"page":29},"Learn","\u002Flearn","2.learn",[35,40,45,50,55,60,65,70,75],{"title":36,"path":37,"stem":38,"icon":39},"Overview","\u002Flearn\u002Foverview","2.learn\u002F0.overview","i-lucide-list",{"title":41,"path":42,"stem":43,"icon":44},"Simple Logging","\u002Flearn\u002Fsimple-logging","2.learn\u002F1.simple-logging","i-lucide-terminal",{"title":46,"path":47,"stem":48,"icon":49},"Wide Events","\u002Flearn\u002Fwide-events","2.learn\u002F2.wide-events","i-lucide-layers",{"title":51,"path":52,"stem":53,"icon":54},"Structured Errors","\u002Flearn\u002Fstructured-errors","2.learn\u002F3.structured-errors","i-lucide-shield-alert",{"title":56,"path":57,"stem":58,"icon":59},"Lifecycle","\u002Flearn\u002Flifecycle","2.learn\u002F4.lifecycle","i-lucide-arrow-right-left",{"title":61,"path":62,"stem":63,"icon":64},"Sampling","\u002Flearn\u002Fsampling","2.learn\u002F5.sampling","i-lucide-filter",{"title":66,"path":67,"stem":68,"icon":69},"Auto-Redaction","\u002Flearn\u002Fredaction","2.learn\u002F6.redaction","i-lucide-eye-off",{"title":71,"path":72,"stem":73,"icon":74},"Typed Fields","\u002Flearn\u002Ftyped-fields","2.learn\u002F7.typed-fields","i-simple-icons-typescript",{"title":76,"path":77,"stem":78,"icon":79},"Catalogs","\u002Flearn\u002Fcatalogs","2.learn\u002F8.catalogs","i-lucide-book-open",{"title":81,"path":82,"stem":83,"children":84,"page":29},"Integrate","\u002Fintegrate","3.integrate",[85,89,157],{"title":36,"path":86,"stem":87,"icon":88},"\u002Fintegrate\u002Foverview","3.integrate\u002F0.overview","i-lucide-plug",{"title":90,"path":91,"stem":92,"children":93,"page":29},"Adapters","\u002Fintegrate\u002Fadapters","3.integrate\u002Fadapters",[94,97,137],{"title":36,"path":95,"stem":96,"icon":39},"\u002Fintegrate\u002Fadapters\u002Foverview","3.integrate\u002Fadapters\u002F01.overview",{"title":98,"path":99,"stem":100,"children":101,"page":29},"Cloud","\u002Fintegrate\u002Fadapters\u002Fcloud","3.integrate\u002Fadapters\u002Fcloud",[102,107,112,117,122,127,132],{"title":103,"path":104,"stem":105,"icon":106},"Axiom","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Faxiom","3.integrate\u002Fadapters\u002Fcloud\u002F01.axiom","i-custom-axiom",{"title":108,"path":109,"stem":110,"icon":111},"OTLP","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fotlp","3.integrate\u002Fadapters\u002Fcloud\u002F02.otlp","i-simple-icons-opentelemetry",{"title":113,"path":114,"stem":115,"icon":116},"PostHog","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fposthog","3.integrate\u002Fadapters\u002Fcloud\u002F03.posthog","i-simple-icons-posthog",{"title":118,"path":119,"stem":120,"icon":121},"Sentry","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fsentry","3.integrate\u002Fadapters\u002Fcloud\u002F04.sentry","i-simple-icons-sentry",{"title":123,"path":124,"stem":125,"icon":126},"Better Stack","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fbetter-stack","3.integrate\u002Fadapters\u002Fcloud\u002F05.better-stack","i-simple-icons-betterstack",{"title":128,"path":129,"stem":130,"icon":131},"Datadog","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fdatadog","3.integrate\u002Fadapters\u002Fcloud\u002F06.datadog","i-simple-icons-datadog",{"title":133,"path":134,"stem":135,"icon":136},"HyperDX","\u002Fintegrate\u002Fadapters\u002Fcloud\u002Fhyperdx","3.integrate\u002Fadapters\u002Fcloud\u002F07.hyperdx","i-custom-hyperdx",{"title":138,"path":139,"stem":140,"children":141,"page":29},"Self-Hosted","\u002Fintegrate\u002Fadapters\u002Fself-hosted","3.integrate\u002Fadapters\u002Fself-hosted",[142,147,152],{"title":143,"path":144,"stem":145,"icon":146},"File System","\u002Fintegrate\u002Fadapters\u002Fself-hosted\u002Ffs","3.integrate\u002Fadapters\u002Fself-hosted\u002F01.fs","i-lucide-hard-drive",{"title":148,"path":149,"stem":150,"icon":151},"NuxtHub","\u002Fintegrate\u002Fadapters\u002Fself-hosted\u002Fnuxthub","3.integrate\u002Fadapters\u002Fself-hosted\u002F02.nuxthub","i-simple-icons-nuxt",{"title":153,"path":154,"stem":155,"icon":156},"Memory","\u002Fintegrate\u002Fadapters\u002Fself-hosted\u002Fmemory","3.integrate\u002Fadapters\u002Fself-hosted\u002F03.memory","i-lucide-cpu",{"title":158,"path":159,"stem":160,"children":161,"page":29},"Frameworks","\u002Fintegrate\u002Fframeworks","3.integrate\u002Fframeworks",[162,166,171,176,181,186,191,196,201,206,211,216,221,226,230,235,240],{"title":36,"path":163,"stem":164,"icon":165},"\u002Fintegrate\u002Fframeworks\u002Foverview","3.integrate\u002Fframeworks\u002F00.overview","i-lucide-layout-grid",{"title":167,"path":168,"stem":169,"icon":170},"Nuxt","\u002Fintegrate\u002Fframeworks\u002Fnuxt","3.integrate\u002Fframeworks\u002F01.nuxt","i-simple-icons-nuxtdotjs",{"title":172,"path":173,"stem":174,"icon":175},"Next.js","\u002Fintegrate\u002Fframeworks\u002Fnextjs","3.integrate\u002Fframeworks\u002F02.nextjs","i-simple-icons-nextdotjs",{"title":177,"path":178,"stem":179,"icon":180},"SvelteKit","\u002Fintegrate\u002Fframeworks\u002Fsveltekit","3.integrate\u002Fframeworks\u002F03.sveltekit","i-simple-icons-svelte",{"title":182,"path":183,"stem":184,"icon":185},"Nitro","\u002Fintegrate\u002Fframeworks\u002Fnitro","3.integrate\u002Fframeworks\u002F04.nitro","i-custom-nitro",{"title":187,"path":188,"stem":189,"icon":190},"TanStack Start","\u002Fintegrate\u002Fframeworks\u002Ftanstack-start","3.integrate\u002Fframeworks\u002F05.tanstack-start","i-custom-tanstack",{"title":192,"path":193,"stem":194,"icon":195},"NestJS","\u002Fintegrate\u002Fframeworks\u002Fnestjs","3.integrate\u002Fframeworks\u002F06.nestjs","i-simple-icons-nestjs",{"title":197,"path":198,"stem":199,"icon":200},"Express","\u002Fintegrate\u002Fframeworks\u002Fexpress","3.integrate\u002Fframeworks\u002F07.express","i-simple-icons-express",{"title":202,"path":203,"stem":204,"icon":205},"Hono","\u002Fintegrate\u002Fframeworks\u002Fhono","3.integrate\u002Fframeworks\u002F08.hono","i-simple-icons-hono",{"title":207,"path":208,"stem":209,"icon":210},"Fastify","\u002Fintegrate\u002Fframeworks\u002Ffastify","3.integrate\u002Fframeworks\u002F09.fastify","i-simple-icons-fastify",{"title":212,"path":213,"stem":214,"icon":215},"Elysia","\u002Fintegrate\u002Fframeworks\u002Felysia","3.integrate\u002Fframeworks\u002F10.elysia","i-custom-elysia",{"title":217,"path":218,"stem":219,"icon":220},"React Router","\u002Fintegrate\u002Fframeworks\u002Freact-router","3.integrate\u002Fframeworks\u002F11.react-router","i-custom-reactrouter",{"title":222,"path":223,"stem":224,"icon":225},"Cloudflare Workers","\u002Fintegrate\u002Fframeworks\u002Fcloudflare-workers","3.integrate\u002Fframeworks\u002F12.cloudflare-workers","i-simple-icons-cloudflare",{"title":227,"path":228,"stem":229,"icon":74},"Standalone","\u002Fintegrate\u002Fframeworks\u002Fstandalone","3.integrate\u002Fframeworks\u002F13.standalone",{"title":231,"path":232,"stem":233,"icon":234},"Astro","\u002Fintegrate\u002Fframeworks\u002Fastro","3.integrate\u002Fframeworks\u002F14.astro","i-simple-icons-astro",{"title":236,"path":237,"stem":238,"icon":239},"oRPC","\u002Fintegrate\u002Fframeworks\u002Forpc","3.integrate\u002Fframeworks\u002F15.orpc","i-lucide-network",{"title":241,"path":242,"stem":243,"icon":244},"AWS Lambda","\u002Fintegrate\u002Fframeworks\u002Faws-lambda","3.integrate\u002Fframeworks\u002F16.aws-lambda","i-custom-lambda",{"title":246,"path":247,"stem":248,"children":249,"page":29},"Use Cases","\u002Fuse-cases","4.use-cases",[250,254,259,288,316,348,369,374],{"title":36,"path":251,"stem":252,"icon":253},"\u002Fuse-cases\u002Foverview","4.use-cases\u002F0.overview","i-lucide-list-checks",{"title":255,"path":256,"stem":257,"icon":258},"Client Logging","\u002Fuse-cases\u002Fclient-logging","4.use-cases\u002F1.client-logging","i-lucide-monitor",{"title":260,"icon":261,"path":262,"stem":263,"children":264,"page":29},"AI SDK","i-simple-icons-vercel","\u002Fuse-cases\u002Fai-sdk","4.use-cases\u002F2.ai-sdk",[265,268,273,278,283],{"title":36,"path":266,"stem":267,"icon":39},"\u002Fuse-cases\u002Fai-sdk\u002Foverview","4.use-cases\u002F2.ai-sdk\u002F01.overview",{"title":269,"path":270,"stem":271,"icon":272},"Usage","\u002Fuse-cases\u002Fai-sdk\u002Fusage","4.use-cases\u002F2.ai-sdk\u002F02.usage","i-lucide-code",{"title":274,"path":275,"stem":276,"icon":277},"Options","\u002Fuse-cases\u002Fai-sdk\u002Foptions","4.use-cases\u002F2.ai-sdk\u002F03.options","i-lucide-sliders",{"title":279,"path":280,"stem":281,"icon":282},"Metadata","\u002Fuse-cases\u002Fai-sdk\u002Fmetadata","4.use-cases\u002F2.ai-sdk\u002F04.metadata","i-lucide-database",{"title":284,"path":285,"stem":286,"icon":287},"Telemetry","\u002Fuse-cases\u002Fai-sdk\u002Ftelemetry","4.use-cases\u002F2.ai-sdk\u002F05.telemetry","i-lucide-activity",{"title":289,"icon":290,"path":291,"stem":292,"children":293,"page":29},"Better Auth","i-simple-icons-betterauth","\u002Fuse-cases\u002Fbetter-auth","4.use-cases\u002F3.better-auth",[294,297,302,307,311],{"title":36,"path":295,"stem":296,"icon":39},"\u002Fuse-cases\u002Fbetter-auth\u002Foverview","4.use-cases\u002F3.better-auth\u002F01.overview",{"title":298,"path":299,"stem":300,"icon":301},"Identify User","\u002Fuse-cases\u002Fbetter-auth\u002Fidentify-user","4.use-cases\u002F3.better-auth\u002F02.identify-user","i-lucide-user-check",{"title":303,"path":304,"stem":305,"icon":306},"Middleware","\u002Fuse-cases\u002Fbetter-auth\u002Fmiddleware","4.use-cases\u002F3.better-auth\u002F03.middleware","i-lucide-shield",{"title":308,"path":309,"stem":310,"icon":258},"Client Sync","\u002Fuse-cases\u002Fbetter-auth\u002Fclient-sync","4.use-cases\u002F3.better-auth\u002F04.client-sync",{"title":312,"path":313,"stem":314,"icon":315},"Performance","\u002Fuse-cases\u002Fbetter-auth\u002Fperformance","4.use-cases\u002F3.better-auth\u002F05.performance","i-lucide-gauge",{"title":317,"icon":318,"path":319,"stem":320,"children":321,"page":29},"Audit Logs","i-lucide-shield-check","\u002Fuse-cases\u002Faudit","4.use-cases\u002F4.audit",[322,325,330,335,340,344],{"title":36,"path":323,"stem":324,"icon":39},"\u002Fuse-cases\u002Faudit\u002Foverview","4.use-cases\u002F4.audit\u002F01.overview",{"title":326,"path":327,"stem":328,"icon":329},"Schema","\u002Fuse-cases\u002Faudit\u002Fschema","4.use-cases\u002F4.audit\u002F02.schema","i-lucide-file-text",{"title":331,"path":332,"stem":333,"icon":334},"Recording","\u002Fuse-cases\u002Faudit\u002Frecording","4.use-cases\u002F4.audit\u002F03.recording","i-lucide-pen-line",{"title":336,"path":337,"stem":338,"icon":339},"Drains","\u002Fuse-cases\u002Faudit\u002Fpipeline","4.use-cases\u002F4.audit\u002F04.pipeline","i-lucide-link",{"title":341,"path":342,"stem":343,"icon":318},"Compliance","\u002Fuse-cases\u002Faudit\u002Fcompliance","4.use-cases\u002F4.audit\u002F05.compliance",{"title":345,"path":346,"stem":347,"icon":79},"Recipes","\u002Fuse-cases\u002Faudit\u002Frecipes","4.use-cases\u002F4.audit\u002F06.recipes",{"title":284,"icon":315,"path":349,"stem":350,"children":351,"page":29},"\u002Fuse-cases\u002Ftelemetry","4.use-cases\u002F4.telemetry",[352,355,360,365],{"title":36,"path":353,"stem":354,"icon":39},"\u002Fuse-cases\u002Ftelemetry\u002Foverview","4.use-cases\u002F4.telemetry\u002F01.overview",{"title":356,"path":357,"stem":358,"icon":359},"Setup","\u002Fuse-cases\u002Ftelemetry\u002Fsetup","4.use-cases\u002F4.telemetry\u002F02.setup","i-lucide-wrench",{"title":361,"path":362,"stem":363,"icon":364},"Ingest","\u002Fuse-cases\u002Ftelemetry\u002Fingest","4.use-cases\u002F4.telemetry\u002F03.ingest","i-lucide-server",{"title":366,"path":367,"stem":368,"icon":79},"Reference","\u002Fuse-cases\u002Ftelemetry\u002Freference","4.use-cases\u002F4.telemetry\u002F04.reference",{"title":370,"path":371,"stem":372,"icon":373},"Enrichers","\u002Fuse-cases\u002Fenrichers","4.use-cases\u002F5.enrichers","i-lucide-sparkles",{"title":375,"path":376,"stem":377,"icon":378},"eve","\u002Fuse-cases\u002Feve","4.use-cases\u002F5.eve","i-custom-eve",{"title":380,"path":381,"stem":382,"children":383,"page":29},"Extend","\u002Fextend","5.extend",[384,388,393,398,403,407,411,415,419,424,429],{"title":36,"path":385,"stem":386,"icon":387},"\u002Fextend\u002Foverview","5.extend\u002F0.overview","i-lucide-blocks",{"title":389,"path":390,"stem":391,"icon":392},"Stream","\u002Fextend\u002Fstream","5.extend\u002F1.stream","i-lucide-radio-tower",{"title":394,"path":395,"stem":396,"icon":397},"Custom framework","\u002Fextend\u002Fcustom-framework","5.extend\u002F10.custom-framework","i-lucide-puzzle",{"title":399,"path":400,"stem":401,"icon":402},"FS reader","\u002Fextend\u002Ffs-reader","5.extend\u002F2.fs-reader","i-lucide-folder-search",{"title":345,"path":404,"stem":405,"icon":406},"\u002Fextend\u002Fconsumer-recipes","5.extend\u002F3.consumer-recipes","i-lucide-chef-hat",{"title":408,"path":409,"stem":410,"icon":387},"Plugins","\u002Fextend\u002Fplugins","5.extend\u002F4.plugins",{"title":412,"path":413,"stem":414,"icon":373},"Custom enrichers","\u002Fextend\u002Fcustom-enrichers","5.extend\u002F5.custom-enrichers",{"title":416,"path":417,"stem":418,"icon":64},"Tail sampling","\u002Fextend\u002Ftail-sampling","5.extend\u002F6.tail-sampling",{"title":420,"path":421,"stem":422,"icon":423},"Identity headers","\u002Fextend\u002Fidentity-headers","5.extend\u002F7.identity-headers","i-lucide-fingerprint",{"title":425,"path":426,"stem":427,"icon":428},"Custom drains","\u002Fextend\u002Fcustom-drains","5.extend\u002F8.custom-drains","i-lucide-share-2",{"title":430,"path":431,"stem":432,"icon":433},"Drain pipeline","\u002Fextend\u002Fdrain-pipeline","5.extend\u002F9.drain-pipeline","i-lucide-workflow",{"title":366,"path":435,"stem":436,"children":437,"page":29},"\u002Freference","6.reference",[438,443,446,451,455,460],{"title":439,"path":440,"stem":441,"icon":442},"Configuration","\u002Freference\u002Fconfiguration","6.reference\u002F1.configuration","i-lucide-settings",{"title":312,"path":444,"stem":445,"icon":315},"\u002Freference\u002Fperformance","6.reference\u002F2.performance",{"title":447,"path":448,"stem":449,"icon":450},"Vite Plugin","\u002Freference\u002Fvite-plugin","6.reference\u002F3.vite-plugin","i-custom-vite",{"title":452,"path":453,"stem":454,"icon":318},"Best Practices","\u002Freference\u002Fbest-practices","6.reference\u002F4.best-practices",{"title":456,"path":457,"stem":458,"icon":459},"vs Other Loggers","\u002Freference\u002Fvs-other-loggers","6.reference\u002F5.vs-other-loggers","i-lucide-scale",{"title":461,"path":462,"stem":463,"icon":373},"Agent Skills","\u002Freference\u002Fagent-skills","6.reference\u002F6.agent-skills",{"id":465,"title":466,"body":467,"description":1411,"extension":1412,"links":1413,"meta":1418,"navigation":1419,"path":327,"seo":1420,"stem":328,"__hash__":1421},"docs\u002F4.use-cases\u002F4.audit\u002F02.schema.md","Audit Schema",{"type":468,"value":469,"toc":1402},"minimark",[470,482,490,976,980,1018,1021,1133,1151,1155,1177,1252,1256,1302,1314,1318,1336,1339,1343,1385,1398],[471,472,473,477,478,481],"p",{},[474,475,476],"code",{},"event.audit"," is a typed field on every wide event. Downstream queries filter on ",[474,479,480],{},"audit IS NOT NULL"," to materialise an audit dataset out of regular logs.",[483,484,486,489],"h2",{"id":485},"auditfields-type",[474,487,488],{},"AuditFields"," type",[491,492,497],"pre",{"className":493,"code":494,"language":495,"meta":496,"style":496},"language-typescript shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","interface AuditFields {\n  action: string                          \u002F\u002F 'invoice.refund'\n  actor: {\n    type: 'user' | 'system' | 'api' | 'agent'\n    id: string\n    displayName?: string\n    email?: string\n    \u002F\u002F For type === 'agent', mirrors evlog\u002Fai fields:\n    model?: string\n    tools?: string[]\n    reason?: string\n    promptId?: string\n  }\n  target?: { type: string, id: string, [k: string]: unknown }\n  outcome: 'success' | 'failure' | 'denied'\n  reason?: string\n  changes?: { before?: unknown, after?: unknown, patch?: AuditPatchOp[] }\n  causationId?: string                    \u002F\u002F ID of the action that caused this one\n  correlationId?: string                  \u002F\u002F Shared by every action in one operation\n  version?: number                        \u002F\u002F Defaults to 1\n  idempotencyKey?: string                 \u002F\u002F Auto-derived; safe retries across drains\n  context?: {                             \u002F\u002F Filled by auditEnricher\n    requestId?: string\n    traceId?: string\n    ip?: string\n    userAgent?: string\n    tenantId?: string\n  }\n  signature?: string                      \u002F\u002F Set by signed({ strategy: 'hmac' })\n  prevHash?: string                       \u002F\u002F Set by signed({ strategy: 'hash-chain' })\n  hash?: string\n}\n","typescript","",[474,498,499,516,533,543,590,601,612,622,628,638,652,662,672,678,729,762,772,814,827,840,854,867,880,890,900,910,920,930,935,948,961,971],{"__ignoreMap":496},[500,501,504,508,512],"span",{"class":502,"line":503},"line",1,[500,505,507],{"class":506},"spNyl","interface",[500,509,511],{"class":510},"sBMFI"," AuditFields",[500,513,515],{"class":514},"sMK4o"," {\n",[500,517,519,523,526,529],{"class":502,"line":518},2,[500,520,522],{"class":521},"swJcz","  action",[500,524,525],{"class":514},":",[500,527,528],{"class":510}," string",[500,530,532],{"class":531},"sHwdD","                          \u002F\u002F 'invoice.refund'\n",[500,534,536,539,541],{"class":502,"line":535},3,[500,537,538],{"class":521},"  actor",[500,540,525],{"class":514},[500,542,515],{"class":514},[500,544,546,549,551,554,558,561,564,566,569,571,573,575,578,580,582,584,587],{"class":502,"line":545},4,[500,547,548],{"class":521},"    type",[500,550,525],{"class":514},[500,552,553],{"class":514}," '",[500,555,557],{"class":556},"sfazB","user",[500,559,560],{"class":514},"'",[500,562,563],{"class":514}," |",[500,565,553],{"class":514},[500,567,568],{"class":556},"system",[500,570,560],{"class":514},[500,572,563],{"class":514},[500,574,553],{"class":514},[500,576,577],{"class":556},"api",[500,579,560],{"class":514},[500,581,563],{"class":514},[500,583,553],{"class":514},[500,585,586],{"class":556},"agent",[500,588,589],{"class":514},"'\n",[500,591,593,596,598],{"class":502,"line":592},5,[500,594,595],{"class":521},"    id",[500,597,525],{"class":514},[500,599,600],{"class":510}," string\n",[500,602,604,607,610],{"class":502,"line":603},6,[500,605,606],{"class":521},"    displayName",[500,608,609],{"class":514},"?:",[500,611,600],{"class":510},[500,613,615,618,620],{"class":502,"line":614},7,[500,616,617],{"class":521},"    email",[500,619,609],{"class":514},[500,621,600],{"class":510},[500,623,625],{"class":502,"line":624},8,[500,626,627],{"class":531},"    \u002F\u002F For type === 'agent', mirrors evlog\u002Fai fields:\n",[500,629,631,634,636],{"class":502,"line":630},9,[500,632,633],{"class":521},"    model",[500,635,609],{"class":514},[500,637,600],{"class":510},[500,639,641,644,646,648],{"class":502,"line":640},10,[500,642,643],{"class":521},"    tools",[500,645,609],{"class":514},[500,647,528],{"class":510},[500,649,651],{"class":650},"sTEyZ","[]\n",[500,653,655,658,660],{"class":502,"line":654},11,[500,656,657],{"class":521},"    reason",[500,659,609],{"class":514},[500,661,600],{"class":510},[500,663,665,668,670],{"class":502,"line":664},12,[500,666,667],{"class":521},"    promptId",[500,669,609],{"class":514},[500,671,600],{"class":510},[500,673,675],{"class":502,"line":674},13,[500,676,677],{"class":514},"  }\n",[500,679,681,684,686,689,691,693,695,698,701,703,705,707,710,714,716,718,721,723,726],{"class":502,"line":680},14,[500,682,683],{"class":521},"  target",[500,685,609],{"class":514},[500,687,688],{"class":514}," {",[500,690,489],{"class":521},[500,692,525],{"class":514},[500,694,528],{"class":510},[500,696,697],{"class":514},",",[500,699,700],{"class":521}," id",[500,702,525],{"class":514},[500,704,528],{"class":510},[500,706,697],{"class":514},[500,708,709],{"class":650}," [",[500,711,713],{"class":712},"sHdIc","k",[500,715,525],{"class":514},[500,717,528],{"class":510},[500,719,720],{"class":650},"]",[500,722,525],{"class":514},[500,724,725],{"class":510}," unknown",[500,727,728],{"class":514}," }\n",[500,730,732,735,737,739,742,744,746,748,751,753,755,757,760],{"class":502,"line":731},15,[500,733,734],{"class":521},"  outcome",[500,736,525],{"class":514},[500,738,553],{"class":514},[500,740,741],{"class":556},"success",[500,743,560],{"class":514},[500,745,563],{"class":514},[500,747,553],{"class":514},[500,749,750],{"class":556},"failure",[500,752,560],{"class":514},[500,754,563],{"class":514},[500,756,553],{"class":514},[500,758,759],{"class":556},"denied",[500,761,589],{"class":514},[500,763,765,768,770],{"class":502,"line":764},16,[500,766,767],{"class":521},"  reason",[500,769,609],{"class":514},[500,771,600],{"class":510},[500,773,775,778,780,782,785,787,789,791,794,796,798,800,803,805,808,811],{"class":502,"line":774},17,[500,776,777],{"class":521},"  changes",[500,779,609],{"class":514},[500,781,688],{"class":514},[500,783,784],{"class":521}," before",[500,786,609],{"class":514},[500,788,725],{"class":510},[500,790,697],{"class":514},[500,792,793],{"class":521}," after",[500,795,609],{"class":514},[500,797,725],{"class":510},[500,799,697],{"class":514},[500,801,802],{"class":521}," patch",[500,804,609],{"class":514},[500,806,807],{"class":510}," AuditPatchOp",[500,809,810],{"class":650},"[] ",[500,812,813],{"class":514},"}\n",[500,815,817,820,822,824],{"class":502,"line":816},18,[500,818,819],{"class":521},"  causationId",[500,821,609],{"class":514},[500,823,528],{"class":510},[500,825,826],{"class":531},"                    \u002F\u002F ID of the action that caused this one\n",[500,828,830,833,835,837],{"class":502,"line":829},19,[500,831,832],{"class":521},"  correlationId",[500,834,609],{"class":514},[500,836,528],{"class":510},[500,838,839],{"class":531},"                  \u002F\u002F Shared by every action in one operation\n",[500,841,843,846,848,851],{"class":502,"line":842},20,[500,844,845],{"class":521},"  version",[500,847,609],{"class":514},[500,849,850],{"class":510}," number",[500,852,853],{"class":531},"                        \u002F\u002F Defaults to 1\n",[500,855,857,860,862,864],{"class":502,"line":856},21,[500,858,859],{"class":521},"  idempotencyKey",[500,861,609],{"class":514},[500,863,528],{"class":510},[500,865,866],{"class":531},"                 \u002F\u002F Auto-derived; safe retries across drains\n",[500,868,870,873,875,877],{"class":502,"line":869},22,[500,871,872],{"class":521},"  context",[500,874,609],{"class":514},[500,876,688],{"class":514},[500,878,879],{"class":531},"                             \u002F\u002F Filled by auditEnricher\n",[500,881,883,886,888],{"class":502,"line":882},23,[500,884,885],{"class":521},"    requestId",[500,887,609],{"class":514},[500,889,600],{"class":510},[500,891,893,896,898],{"class":502,"line":892},24,[500,894,895],{"class":521},"    traceId",[500,897,609],{"class":514},[500,899,600],{"class":510},[500,901,903,906,908],{"class":502,"line":902},25,[500,904,905],{"class":521},"    ip",[500,907,609],{"class":514},[500,909,600],{"class":510},[500,911,913,916,918],{"class":502,"line":912},26,[500,914,915],{"class":521},"    userAgent",[500,917,609],{"class":514},[500,919,600],{"class":510},[500,921,923,926,928],{"class":502,"line":922},27,[500,924,925],{"class":521},"    tenantId",[500,927,609],{"class":514},[500,929,600],{"class":510},[500,931,933],{"class":502,"line":932},28,[500,934,677],{"class":514},[500,936,938,941,943,945],{"class":502,"line":937},29,[500,939,940],{"class":521},"  signature",[500,942,609],{"class":514},[500,944,528],{"class":510},[500,946,947],{"class":531},"                      \u002F\u002F Set by signed({ strategy: 'hmac' })\n",[500,949,951,954,956,958],{"class":502,"line":950},30,[500,952,953],{"class":521},"  prevHash",[500,955,609],{"class":514},[500,957,528],{"class":510},[500,959,960],{"class":531},"                       \u002F\u002F Set by signed({ strategy: 'hash-chain' })\n",[500,962,964,967,969],{"class":502,"line":963},31,[500,965,966],{"class":521},"  hash",[500,968,609],{"class":514},[500,970,600],{"class":510},[500,972,974],{"class":502,"line":973},32,[500,975,813],{"class":514},[483,977,979],{"id":978},"action-naming","Action naming",[981,982,983,991,992,995,996,999,1000,999,1003,1006,1007,1010,1011,1014,1015,1017],"tip",{},[984,985,986,987,990],"strong",{},"Naming convention for ",[474,988,989],{},"action","."," Use ",[474,993,994],{},"noun.verb"," (",[474,997,998],{},"invoice.refund",", ",[474,1001,1002],{},"user.invite",[474,1004,1005],{},"apiKey.revoke","). Past tense if the action already happened (",[474,1008,1009],{},"invoice.refunded","), present tense if ",[474,1012,1013],{},"withAudit()"," will resolve the outcome. Keep a small fixed dictionary in one file — auditors and SIEM rules query on ",[474,1016,989],{},", so a typo is a missing alert.",[471,1019,1020],{},"A single dictionary file makes alerting straightforward:",[491,1022,1025],{"className":493,"code":1023,"filename":1024,"language":495,"meta":496,"style":496},"export const AUDIT_ACTIONS = {\n  USER_INVITE: 'user.invite',\n  USER_REMOVE: 'user.remove',\n  USER_ROLE_CHANGE: 'user.role-change',\n  INVOICE_REFUND: 'invoice.refund',\n  API_KEY_REVOKE: 'apiKey.revoke',\n} as const\n","src\u002Faudit\u002Factions.ts",[474,1026,1027,1044,1060,1076,1092,1107,1122],{"__ignoreMap":496},[500,1028,1029,1033,1036,1039,1042],{"class":502,"line":503},[500,1030,1032],{"class":1031},"s7zQu","export",[500,1034,1035],{"class":506}," const",[500,1037,1038],{"class":650}," AUDIT_ACTIONS ",[500,1040,1041],{"class":514},"=",[500,1043,515],{"class":514},[500,1045,1046,1049,1051,1053,1055,1057],{"class":502,"line":518},[500,1047,1048],{"class":521},"  USER_INVITE",[500,1050,525],{"class":514},[500,1052,553],{"class":514},[500,1054,1002],{"class":556},[500,1056,560],{"class":514},[500,1058,1059],{"class":514},",\n",[500,1061,1062,1065,1067,1069,1072,1074],{"class":502,"line":535},[500,1063,1064],{"class":521},"  USER_REMOVE",[500,1066,525],{"class":514},[500,1068,553],{"class":514},[500,1070,1071],{"class":556},"user.remove",[500,1073,560],{"class":514},[500,1075,1059],{"class":514},[500,1077,1078,1081,1083,1085,1088,1090],{"class":502,"line":545},[500,1079,1080],{"class":521},"  USER_ROLE_CHANGE",[500,1082,525],{"class":514},[500,1084,553],{"class":514},[500,1086,1087],{"class":556},"user.role-change",[500,1089,560],{"class":514},[500,1091,1059],{"class":514},[500,1093,1094,1097,1099,1101,1103,1105],{"class":502,"line":592},[500,1095,1096],{"class":521},"  INVOICE_REFUND",[500,1098,525],{"class":514},[500,1100,553],{"class":514},[500,1102,998],{"class":556},[500,1104,560],{"class":514},[500,1106,1059],{"class":514},[500,1108,1109,1112,1114,1116,1118,1120],{"class":502,"line":603},[500,1110,1111],{"class":521},"  API_KEY_REVOKE",[500,1113,525],{"class":514},[500,1115,553],{"class":514},[500,1117,1005],{"class":556},[500,1119,560],{"class":514},[500,1121,1059],{"class":514},[500,1123,1124,1127,1130],{"class":502,"line":614},[500,1125,1126],{"class":514},"}",[500,1128,1129],{"class":1031}," as",[500,1131,1132],{"class":506}," const\n",[981,1134,1135,1136,1143,1144,1146,1147,1150],{},"For more than a handful of actions, prefer ",[1137,1138,1140],"a",{"href":1139},"\u002Fuse-cases\u002Faudit\u002Frecording#defineauditcatalog",[474,1141,1142],{},"defineAuditCatalog"," over a plain object dictionary — same ",[474,1145,994],{}," convention, but you get autocomplete on the action union and per-entry ",[474,1148,1149],{},"target"," type inference for free.",[483,1152,1154],{"id":1153},"actor-types","Actor types",[1156,1157,1158,991,1161,1164,1165,1168,1169,1172,1173,1176],"warning",{},[984,1159,1160],{},"Don't fake the actor.",[474,1162,1163],{},"actor.type: 'system'"," for cron jobs, queue workers, and background tasks; ",[474,1166,1167],{},"actor.type: 'api'"," for machine-to-machine calls authenticated by a token; ",[474,1170,1171],{},"actor.type: 'agent'"," for AI tool calls. Logging a synthetic ",[474,1174,1175],{},"'user'"," for system actions is the single fastest way to fail an audit review.",[1178,1179,1180,1195],"table",{},[1181,1182,1183],"thead",{},[1184,1185,1186,1192],"tr",{},[1187,1188,1189],"th",{},[474,1190,1191],{},"actor.type",[1187,1193,1194],{},"When to use",[1196,1197,1198,1208,1218,1228],"tbody",{},[1184,1199,1200,1205],{},[1201,1202,1203],"td",{},[474,1204,1175],{},[1201,1206,1207],{},"A human authenticated through your normal auth flow.",[1184,1209,1210,1215],{},[1201,1211,1212],{},[474,1213,1214],{},"'system'",[1201,1216,1217],{},"Cron jobs, queue workers, scheduled tasks, internal background processes.",[1184,1219,1220,1225],{},[1201,1221,1222],{},[474,1223,1224],{},"'api'",[1201,1226,1227],{},"Machine-to-machine calls from another service authenticated by a token.",[1184,1229,1230,1235],{},[1201,1231,1232],{},[474,1233,1234],{},"'agent'",[1201,1236,1237,1238,1241,1242,999,1245,999,1248,1251],{},"AI tool calls (combine with ",[474,1239,1240],{},"evlog\u002Fai"," fields like ",[474,1243,1244],{},"model",[474,1246,1247],{},"tools",[474,1249,1250],{},"promptId",").",[483,1253,1255],{"id":1254},"outcomes","Outcomes",[1178,1257,1258,1270],{},[1181,1259,1260],{},[1184,1261,1262,1267],{},[1187,1263,1264],{},[474,1265,1266],{},"outcome",[1187,1268,1269],{},"Meaning",[1196,1271,1272,1282,1292],{},[1184,1273,1274,1279],{},[1201,1275,1276],{},[474,1277,1278],{},"'success'",[1201,1280,1281],{},"The action completed as requested.",[1184,1283,1284,1289],{},[1201,1285,1286],{},[474,1287,1288],{},"'failure'",[1201,1290,1291],{},"The action was attempted but failed (downstream error, race condition, etc.).",[1184,1293,1294,1299],{},[1201,1295,1296],{},[474,1297,1298],{},"'denied'",[1201,1300,1301],{},"The action was rejected by an authorisation check.",[471,1303,1304,1306,1307,1309,1310,1251],{},[474,1305,1288],{}," and ",[474,1308,1298],{}," are different things — auditors care a lot about denied actions because they signal probing or misconfigured access controls. Always log denials (see ",[1137,1311,1313],{"href":1312},"\u002Fuse-cases\u002Faudit\u002Frecording#deny","Recording Events",[483,1315,1317],{"id":1316},"idempotency","Idempotency",[471,1319,1320,1323,1324,999,1326,999,1329,1331,1332,1335],{},[474,1321,1322],{},"idempotencyKey"," is auto-derived from a hash of ",[474,1325,989],{},[474,1327,1328],{},"actor.id",[474,1330,1149],{},", and a coarse timestamp. The result: even if your drain retries an audit insert across a network blip, the duplicate row collapses on ",[474,1333,1334],{},"ON CONFLICT DO NOTHING",". You don't have to think about it — it's filled in for you.",[471,1337,1338],{},"Use the field as the primary key in Postgres \u002F Bigtable \u002F DynamoDB so retries stay safe by construction.",[483,1340,1342],{"id":1341},"causation-and-correlation","Causation and correlation",[1178,1344,1345,1355],{},[1181,1346,1347],{},[1184,1348,1349,1352],{},[1187,1350,1351],{},"Field",[1187,1353,1354],{},"Use case",[1196,1356,1357,1371],{},[1184,1358,1359,1364],{},[1201,1360,1361],{},[474,1362,1363],{},"correlationId",[1201,1365,1366,1367,1370],{},"Shared by every audit event that belongs to the ",[984,1368,1369],{},"same operation"," (e.g. one HTTP request that triggers a refund + an email + a webhook).",[1184,1372,1373,1378],{},[1201,1374,1375],{},[474,1376,1377],{},"causationId",[1201,1379,1380,1381,1384],{},"The id of the previous audit event that ",[984,1382,1383],{},"caused"," this one. Useful for reconstructing chains of cascading actions.",[471,1386,1387,1388,1390,1391,1394,1395,1397],{},"Most teams set ",[474,1389,1363],{}," to ",[474,1392,1393],{},"requestId",". ",[474,1396,1377],{}," is opt-in and only worth filling when a single user action triggers many internal audit events.",[1399,1400,1401],"style",{},"html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sHdIc, html code.shiki .sHdIc{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#EEFFFF;--shiki-default-font-style:italic;--shiki-dark:#BABED8;--shiki-dark-font-style:italic}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}",{"title":496,"searchDepth":518,"depth":518,"links":1403},[1404,1406,1407,1408,1409,1410],{"id":485,"depth":518,"text":1405},"AuditFields type",{"id":978,"depth":518,"text":979},{"id":1153,"depth":518,"text":1154},{"id":1254,"depth":518,"text":1255},{"id":1316,"depth":518,"text":1317},{"id":1341,"depth":518,"text":1342},"The AuditFields type, action naming conventions, actor types, idempotency, and how the schema sits inside a regular wide event.","md",[1414,1417],{"label":36,"icon":39,"to":323,"color":1415,"variant":1416},"neutral","subtle",{"label":331,"icon":334,"to":332,"color":1415,"variant":1416},{},{"title":326,"icon":329},{"title":466,"description":1411},"xLFPc01MyOsrinD5AKEXfW6O9LpLNMkwbiP9mad_O5o",[1423,1425],{"title":36,"path":323,"stem":324,"description":1424,"icon":39,"children":-1},"First-class audit logs as a thin layer on top of evlog's wide events. Add tamper-evident audit trails to any app with one enricher, one drain wrapper, and one helper.",{"title":331,"path":332,"stem":333,"description":1426,"icon":334,"children":-1},"log.audit, log.audit.deny, standalone audit(), withAudit auto-instrumentation, defineAuditAction and defineAuditCatalog registries, and auditDiff change patches.",1784204019520]