[{"data":1,"prerenderedAt":1322},["ShallowReactive",2],{"navigation_docs":3,"-logging-audit-schema":388,"-logging-audit-schema-surround":1317},[4,35,155,197,285,372],{"title":5,"path":6,"stem":7,"children":8,"page":34},"Getting Started","\u002Fgetting-started","1.getting-started",[9,14,19,24,29],{"title":10,"path":11,"stem":12,"icon":13},"Introduction","\u002Fgetting-started\u002Fintroduction","1.getting-started\u002F1.introduction","i-lucide-info",{"title":15,"path":16,"stem":17,"icon":18},"Installation","\u002Fgetting-started\u002Finstallation","1.getting-started\u002F2.installation","i-lucide-download",{"title":20,"path":21,"stem":22,"icon":23},"Quick Start","\u002Fgetting-started\u002Fquick-start","1.getting-started\u002F3.quick-start","i-lucide-zap",{"title":25,"path":26,"stem":27,"icon":28},"Agent Skills","\u002Fgetting-started\u002Fagent-skills","1.getting-started\u002F4.agent-skills","i-lucide-sparkles",{"title":30,"path":31,"stem":32,"icon":33},"vs Other Loggers","\u002Fgetting-started\u002Fvs-other-loggers","1.getting-started\u002F5.vs-other-loggers","i-lucide-scale",false,{"title":36,"path":37,"stem":38,"children":39,"page":34},"Logging","\u002Flogging","2.logging",[40,45,50,55,60,65,94,122],{"title":41,"path":42,"stem":43,"icon":44},"Overview","\u002Flogging\u002Foverview","2.logging\u002F0.overview","i-lucide-list",{"title":46,"path":47,"stem":48,"icon":49},"Simple Logging","\u002Flogging\u002Fsimple-logging","2.logging\u002F1.simple-logging","i-lucide-terminal",{"title":51,"path":52,"stem":53,"icon":54},"Wide Events","\u002Flogging\u002Fwide-events","2.logging\u002F2.wide-events","i-lucide-layers",{"title":56,"path":57,"stem":58,"icon":59},"Structured Errors","\u002Flogging\u002Fstructured-errors","2.logging\u002F3.structured-errors","i-lucide-shield-alert",{"title":61,"path":62,"stem":63,"icon":64},"Client Logging","\u002Flogging\u002Fclient-logging","2.logging\u002F4.client-logging","i-lucide-monitor",{"title":66,"icon":67,"path":68,"stem":69,"children":70,"page":34},"AI SDK","i-simple-icons-vercel","\u002Flogging\u002Fai-sdk","2.logging\u002F5.ai-sdk",[71,74,79,84,89],{"title":41,"path":72,"stem":73,"icon":44},"\u002Flogging\u002Fai-sdk\u002Foverview","2.logging\u002F5.ai-sdk\u002F01.overview",{"title":75,"path":76,"stem":77,"icon":78},"Usage","\u002Flogging\u002Fai-sdk\u002Fusage","2.logging\u002F5.ai-sdk\u002F02.usage","i-lucide-code",{"title":80,"path":81,"stem":82,"icon":83},"Options","\u002Flogging\u002Fai-sdk\u002Foptions","2.logging\u002F5.ai-sdk\u002F03.options","i-lucide-sliders",{"title":85,"path":86,"stem":87,"icon":88},"Metadata","\u002Flogging\u002Fai-sdk\u002Fmetadata","2.logging\u002F5.ai-sdk\u002F04.metadata","i-lucide-database",{"title":90,"path":91,"stem":92,"icon":93},"Telemetry","\u002Flogging\u002Fai-sdk\u002Ftelemetry","2.logging\u002F5.ai-sdk\u002F05.telemetry","i-lucide-activity",{"title":95,"icon":96,"path":97,"stem":98,"children":99,"page":34},"Better Auth","i-simple-icons-betterauth","\u002Flogging\u002Fbetter-auth","2.logging\u002F6.better-auth",[100,103,108,113,117],{"title":41,"path":101,"stem":102,"icon":44},"\u002Flogging\u002Fbetter-auth\u002Foverview","2.logging\u002F6.better-auth\u002F01.overview",{"title":104,"path":105,"stem":106,"icon":107},"Identify User","\u002Flogging\u002Fbetter-auth\u002Fidentify-user","2.logging\u002F6.better-auth\u002F02.identify-user","i-lucide-user-check",{"title":109,"path":110,"stem":111,"icon":112},"Middleware","\u002Flogging\u002Fbetter-auth\u002Fmiddleware","2.logging\u002F6.better-auth\u002F03.middleware","i-lucide-shield",{"title":114,"path":115,"stem":116,"icon":64},"Client Sync","\u002Flogging\u002Fbetter-auth\u002Fclient-sync","2.logging\u002F6.better-auth\u002F04.client-sync",{"title":118,"path":119,"stem":120,"icon":121},"Performance","\u002Flogging\u002Fbetter-auth\u002Fperformance","2.logging\u002F6.better-auth\u002F05.performance","i-lucide-gauge",{"title":123,"icon":124,"path":125,"stem":126,"children":127,"page":34},"Audit Logs","i-lucide-shield-check","\u002Flogging\u002Faudit","2.logging\u002F7.audit",[128,131,136,141,146,150],{"title":41,"path":129,"stem":130,"icon":44},"\u002Flogging\u002Faudit\u002Foverview","2.logging\u002F7.audit\u002F01.overview",{"title":132,"path":133,"stem":134,"icon":135},"Schema","\u002Flogging\u002Faudit\u002Fschema","2.logging\u002F7.audit\u002F02.schema","i-lucide-file-text",{"title":137,"path":138,"stem":139,"icon":140},"Recording","\u002Flogging\u002Faudit\u002Frecording","2.logging\u002F7.audit\u002F03.recording","i-lucide-pen-line",{"title":142,"path":143,"stem":144,"icon":145},"Drains","\u002Flogging\u002Faudit\u002Fpipeline","2.logging\u002F7.audit\u002F04.pipeline","i-lucide-link",{"title":147,"path":148,"stem":149,"icon":124},"Compliance","\u002Flogging\u002Faudit\u002Fcompliance","2.logging\u002F7.audit\u002F05.compliance",{"title":151,"path":152,"stem":153,"icon":154},"Recipes","\u002Flogging\u002Faudit\u002Frecipes","2.logging\u002F7.audit\u002F06.recipes","i-lucide-book-open",{"title":156,"path":157,"stem":158,"children":159,"page":34},"Core Concepts","\u002Fcore-concepts","3.core-concepts",[160,165,170,175,180,184,187,192],{"title":161,"path":162,"stem":163,"icon":164},"Lifecycle","\u002Fcore-concepts\u002Flifecycle","3.core-concepts\u002F0.lifecycle","i-lucide-arrow-right-left",{"title":166,"path":167,"stem":168,"icon":169},"Configuration","\u002Fcore-concepts\u002Fconfiguration","3.core-concepts\u002F1.configuration","i-lucide-settings",{"title":171,"path":172,"stem":173,"icon":174},"Sampling","\u002Fcore-concepts\u002Fsampling","3.core-concepts\u002F2.sampling","i-lucide-filter",{"title":176,"path":177,"stem":178,"icon":179},"Typed Fields","\u002Fcore-concepts\u002Ftyped-fields","3.core-concepts\u002F3.typed-fields","i-simple-icons-typescript",{"title":181,"path":182,"stem":183,"icon":124},"Best Practices","\u002Fcore-concepts\u002Fbest-practices","3.core-concepts\u002F4.best-practices",{"title":118,"path":185,"stem":186,"icon":121},"\u002Fcore-concepts\u002Fperformance","3.core-concepts\u002F5.performance",{"title":188,"path":189,"stem":190,"icon":191},"Vite Plugin","\u002Fcore-concepts\u002Fvite-plugin","3.core-concepts\u002F6.vite-plugin","i-custom-vite",{"title":193,"path":194,"stem":195,"icon":196},"Auto-Redaction","\u002Fcore-concepts\u002Fredaction","3.core-concepts\u002F7.redaction","i-lucide-eye-off",{"title":198,"path":199,"stem":200,"children":201,"page":34},"Frameworks","\u002Fframeworks","4.frameworks",[202,206,211,216,221,226,231,236,241,246,251,256,261,266,270,275,280],{"title":41,"path":203,"stem":204,"icon":205},"\u002Fframeworks\u002Foverview","4.frameworks\u002F00.overview","i-lucide-layout-grid",{"title":207,"path":208,"stem":209,"icon":210},"Nuxt","\u002Fframeworks\u002Fnuxt","4.frameworks\u002F01.nuxt","i-simple-icons-nuxtdotjs",{"title":212,"path":213,"stem":214,"icon":215},"Next.js","\u002Fframeworks\u002Fnextjs","4.frameworks\u002F02.nextjs","i-simple-icons-nextdotjs",{"title":217,"path":218,"stem":219,"icon":220},"SvelteKit","\u002Fframeworks\u002Fsveltekit","4.frameworks\u002F03.sveltekit","i-simple-icons-svelte",{"title":222,"path":223,"stem":224,"icon":225},"Nitro","\u002Fframeworks\u002Fnitro","4.frameworks\u002F04.nitro","i-custom-nitro",{"title":227,"path":228,"stem":229,"icon":230},"TanStack Start","\u002Fframeworks\u002Ftanstack-start","4.frameworks\u002F05.tanstack-start","i-custom-tanstack",{"title":232,"path":233,"stem":234,"icon":235},"NestJS","\u002Fframeworks\u002Fnestjs","4.frameworks\u002F06.nestjs","i-simple-icons-nestjs",{"title":237,"path":238,"stem":239,"icon":240},"Express","\u002Fframeworks\u002Fexpress","4.frameworks\u002F07.express","i-simple-icons-express",{"title":242,"path":243,"stem":244,"icon":245},"Hono","\u002Fframeworks\u002Fhono","4.frameworks\u002F08.hono","i-simple-icons-hono",{"title":247,"path":248,"stem":249,"icon":250},"Fastify","\u002Fframeworks\u002Ffastify","4.frameworks\u002F09.fastify","i-simple-icons-fastify",{"title":252,"path":253,"stem":254,"icon":255},"Elysia","\u002Fframeworks\u002Felysia","4.frameworks\u002F10.elysia","i-custom-elysia",{"title":257,"path":258,"stem":259,"icon":260},"React Router","\u002Fframeworks\u002Freact-router","4.frameworks\u002F11.react-router","i-custom-reactrouter",{"title":262,"path":263,"stem":264,"icon":265},"Cloudflare Workers","\u002Fframeworks\u002Fcloudflare-workers","4.frameworks\u002F12.cloudflare-workers","i-simple-icons-cloudflare",{"title":267,"path":268,"stem":269,"icon":179},"Standalone","\u002Fframeworks\u002Fstandalone","4.frameworks\u002F13.standalone",{"title":271,"path":272,"stem":273,"icon":274},"Astro","\u002Fframeworks\u002Fastro","4.frameworks\u002F14.astro","i-simple-icons-astro",{"title":276,"path":277,"stem":278,"icon":279},"AWS Lambda","\u002Fframeworks\u002Faws-lambda","4.frameworks\u002F16.aws-lambda","i-custom-lambda",{"title":281,"path":282,"stem":283,"icon":284},"Custom Integration","\u002Fframeworks\u002Fcustom-integration","4.frameworks\u002F17.custom-integration","i-lucide-puzzle",{"title":286,"path":287,"stem":288,"children":289,"page":34},"Adapters","\u002Fadapters","6.adapters",[290,293,333,348],{"title":41,"path":291,"stem":292,"icon":44},"\u002Fadapters\u002Foverview","6.adapters\u002F01.overview",{"title":294,"path":295,"stem":296,"children":297,"page":34},"Cloud destinations","\u002Fadapters\u002Fcloud","6.adapters\u002F02.cloud",[298,303,308,313,318,323,328],{"title":299,"path":300,"stem":301,"icon":302},"Axiom","\u002Fadapters\u002Fcloud\u002Faxiom","6.adapters\u002F02.cloud\u002F01.axiom","i-custom-axiom",{"title":304,"path":305,"stem":306,"icon":307},"OTLP","\u002Fadapters\u002Fcloud\u002Fotlp","6.adapters\u002F02.cloud\u002F02.otlp","i-simple-icons-opentelemetry",{"title":309,"path":310,"stem":311,"icon":312},"PostHog","\u002Fadapters\u002Fcloud\u002Fposthog","6.adapters\u002F02.cloud\u002F03.posthog","i-simple-icons-posthog",{"title":314,"path":315,"stem":316,"icon":317},"Sentry","\u002Fadapters\u002Fcloud\u002Fsentry","6.adapters\u002F02.cloud\u002F04.sentry","i-simple-icons-sentry",{"title":319,"path":320,"stem":321,"icon":322},"Better Stack","\u002Fadapters\u002Fcloud\u002Fbetter-stack","6.adapters\u002F02.cloud\u002F05.better-stack","i-simple-icons-betterstack",{"title":324,"path":325,"stem":326,"icon":327},"Datadog","\u002Fadapters\u002Fcloud\u002Fdatadog","6.adapters\u002F02.cloud\u002F06.datadog","i-simple-icons-datadog",{"title":329,"path":330,"stem":331,"icon":332},"HyperDX","\u002Fadapters\u002Fcloud\u002Fhyperdx","6.adapters\u002F02.cloud\u002F07.hyperdx","i-custom-hyperdx",{"title":334,"path":335,"stem":336,"children":337,"page":34},"Self-hosted","\u002Fadapters\u002Fself-hosted","6.adapters\u002F03.self-hosted",[338,343],{"title":339,"path":340,"stem":341,"icon":342},"File System","\u002Fadapters\u002Fself-hosted\u002Ffs","6.adapters\u002F03.self-hosted\u002F01.fs","i-lucide-hard-drive",{"title":344,"path":345,"stem":346,"icon":347},"NuxtHub","\u002Fadapters\u002Fself-hosted\u002Fnuxthub","6.adapters\u002F03.self-hosted\u002F02.nuxthub","i-simple-icons-nuxt",{"title":349,"path":350,"stem":351,"children":352,"page":34},"Building blocks","\u002Fadapters\u002Fbuilding-blocks","6.adapters\u002F04.building-blocks",[353,358,363,367],{"title":354,"path":355,"stem":356,"icon":357},"Pipeline","\u002Fadapters\u002Fbuilding-blocks\u002Fpipeline","6.adapters\u002F04.building-blocks\u002F01.pipeline","i-lucide-workflow",{"title":359,"path":360,"stem":361,"icon":362},"HTTP","\u002Fadapters\u002Fbuilding-blocks\u002Fhttp","6.adapters\u002F04.building-blocks\u002F02.http","i-lucide-globe",{"title":364,"path":365,"stem":366,"icon":78},"Custom Adapters","\u002Fadapters\u002Fbuilding-blocks\u002Fcustom","6.adapters\u002F04.building-blocks\u002F03.custom",{"title":368,"path":369,"stem":370,"icon":371},"Toolkit","\u002Fadapters\u002Fbuilding-blocks\u002Ftoolkit","6.adapters\u002F04.building-blocks\u002F04.toolkit","i-lucide-blocks",{"title":373,"path":374,"stem":375,"children":376,"page":34},"Enrichers","\u002Fenrichers","7.enrichers",[377,380,384],{"title":41,"path":378,"stem":379,"icon":28},"\u002Fenrichers\u002Foverview","7.enrichers\u002F1.overview",{"title":381,"path":382,"stem":383,"icon":284},"Built-in","\u002Fenrichers\u002Fbuilt-in","7.enrichers\u002F2.built-in",{"title":385,"path":386,"stem":387,"icon":78},"Custom","\u002Fenrichers\u002Fcustom","7.enrichers\u002F3.custom",{"id":389,"title":390,"body":391,"description":1306,"extension":1307,"links":1308,"meta":1313,"navigation":1314,"path":133,"seo":1315,"stem":134,"__hash__":1316},"docs\u002F2.logging\u002F7.audit\u002F02.schema.md","Audit Schema",{"type":392,"value":393,"toc":1297},"minimark",[394,406,414,887,891,929,932,1044,1048,1070,1145,1149,1195,1208,1212,1231,1234,1238,1280,1293],[395,396,397,401,402,405],"p",{},[398,399,400],"code",{},"event.audit"," is a typed field on every wide event. Downstream queries filter on ",[398,403,404],{},"audit IS NOT NULL"," to materialise an audit dataset out of regular logs.",[407,408,410,413],"h2",{"id":409},"auditfields-type",[398,411,412],{},"AuditFields"," type",[415,416,421],"pre",{"className":417,"code":418,"language":419,"meta":420,"style":420},"language-typescript shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","interface AuditFields {\n  action: string                          \u002F\u002F 'invoice.refund'\n  actor: {\n    type: 'user' | 'system' | 'api' | 'agent'\n    id: string\n    displayName?: string\n    email?: string\n    \u002F\u002F For type === 'agent', mirrors evlog\u002Fai fields:\n    model?: string\n    tools?: string[]\n    reason?: string\n    promptId?: string\n  }\n  target?: { type: string, id: string, [k: string]: unknown }\n  outcome: 'success' | 'failure' | 'denied'\n  reason?: string\n  changes?: { before?: unknown, after?: unknown }\n  causationId?: string                    \u002F\u002F ID of the action that caused this one\n  correlationId?: string                  \u002F\u002F Shared by every action in one operation\n  version?: number                        \u002F\u002F Defaults to 1\n  idempotencyKey?: string                 \u002F\u002F Auto-derived; safe retries across drains\n  context?: {                             \u002F\u002F Filled by auditEnricher\n    requestId?: string\n    traceId?: string\n    ip?: string\n    userAgent?: string\n    tenantId?: string\n  }\n  signature?: string                      \u002F\u002F Set by signed({ strategy: 'hmac' })\n  prevHash?: string                       \u002F\u002F Set by signed({ strategy: 'hash-chain' })\n  hash?: string\n}\n","typescript","",[398,422,423,440,457,467,514,525,536,546,552,562,576,586,596,602,653,686,696,724,737,750,764,777,790,800,810,820,830,840,845,858,871,881],{"__ignoreMap":420},[424,425,428,432,436],"span",{"class":426,"line":427},"line",1,[424,429,431],{"class":430},"spNyl","interface",[424,433,435],{"class":434},"sBMFI"," AuditFields",[424,437,439],{"class":438},"sMK4o"," {\n",[424,441,443,447,450,453],{"class":426,"line":442},2,[424,444,446],{"class":445},"swJcz","  action",[424,448,449],{"class":438},":",[424,451,452],{"class":434}," string",[424,454,456],{"class":455},"sHwdD","                          \u002F\u002F 'invoice.refund'\n",[424,458,460,463,465],{"class":426,"line":459},3,[424,461,462],{"class":445},"  actor",[424,464,449],{"class":438},[424,466,439],{"class":438},[424,468,470,473,475,478,482,485,488,490,493,495,497,499,502,504,506,508,511],{"class":426,"line":469},4,[424,471,472],{"class":445},"    type",[424,474,449],{"class":438},[424,476,477],{"class":438}," '",[424,479,481],{"class":480},"sfazB","user",[424,483,484],{"class":438},"'",[424,486,487],{"class":438}," |",[424,489,477],{"class":438},[424,491,492],{"class":480},"system",[424,494,484],{"class":438},[424,496,487],{"class":438},[424,498,477],{"class":438},[424,500,501],{"class":480},"api",[424,503,484],{"class":438},[424,505,487],{"class":438},[424,507,477],{"class":438},[424,509,510],{"class":480},"agent",[424,512,513],{"class":438},"'\n",[424,515,517,520,522],{"class":426,"line":516},5,[424,518,519],{"class":445},"    id",[424,521,449],{"class":438},[424,523,524],{"class":434}," string\n",[424,526,528,531,534],{"class":426,"line":527},6,[424,529,530],{"class":445},"    displayName",[424,532,533],{"class":438},"?:",[424,535,524],{"class":434},[424,537,539,542,544],{"class":426,"line":538},7,[424,540,541],{"class":445},"    email",[424,543,533],{"class":438},[424,545,524],{"class":434},[424,547,549],{"class":426,"line":548},8,[424,550,551],{"class":455},"    \u002F\u002F For type === 'agent', mirrors evlog\u002Fai fields:\n",[424,553,555,558,560],{"class":426,"line":554},9,[424,556,557],{"class":445},"    model",[424,559,533],{"class":438},[424,561,524],{"class":434},[424,563,565,568,570,572],{"class":426,"line":564},10,[424,566,567],{"class":445},"    tools",[424,569,533],{"class":438},[424,571,452],{"class":434},[424,573,575],{"class":574},"sTEyZ","[]\n",[424,577,579,582,584],{"class":426,"line":578},11,[424,580,581],{"class":445},"    reason",[424,583,533],{"class":438},[424,585,524],{"class":434},[424,587,589,592,594],{"class":426,"line":588},12,[424,590,591],{"class":445},"    promptId",[424,593,533],{"class":438},[424,595,524],{"class":434},[424,597,599],{"class":426,"line":598},13,[424,600,601],{"class":438},"  }\n",[424,603,605,608,610,613,615,617,619,622,625,627,629,631,634,638,640,642,645,647,650],{"class":426,"line":604},14,[424,606,607],{"class":445},"  target",[424,609,533],{"class":438},[424,611,612],{"class":438}," {",[424,614,413],{"class":445},[424,616,449],{"class":438},[424,618,452],{"class":434},[424,620,621],{"class":438},",",[424,623,624],{"class":445}," id",[424,626,449],{"class":438},[424,628,452],{"class":434},[424,630,621],{"class":438},[424,632,633],{"class":574}," [",[424,635,637],{"class":636},"sHdIc","k",[424,639,449],{"class":438},[424,641,452],{"class":434},[424,643,644],{"class":574},"]",[424,646,449],{"class":438},[424,648,649],{"class":434}," unknown",[424,651,652],{"class":438}," }\n",[424,654,656,659,661,663,666,668,670,672,675,677,679,681,684],{"class":426,"line":655},15,[424,657,658],{"class":445},"  outcome",[424,660,449],{"class":438},[424,662,477],{"class":438},[424,664,665],{"class":480},"success",[424,667,484],{"class":438},[424,669,487],{"class":438},[424,671,477],{"class":438},[424,673,674],{"class":480},"failure",[424,676,484],{"class":438},[424,678,487],{"class":438},[424,680,477],{"class":438},[424,682,683],{"class":480},"denied",[424,685,513],{"class":438},[424,687,689,692,694],{"class":426,"line":688},16,[424,690,691],{"class":445},"  reason",[424,693,533],{"class":438},[424,695,524],{"class":434},[424,697,699,702,704,706,709,711,713,715,718,720,722],{"class":426,"line":698},17,[424,700,701],{"class":445},"  changes",[424,703,533],{"class":438},[424,705,612],{"class":438},[424,707,708],{"class":445}," before",[424,710,533],{"class":438},[424,712,649],{"class":434},[424,714,621],{"class":438},[424,716,717],{"class":445}," after",[424,719,533],{"class":438},[424,721,649],{"class":434},[424,723,652],{"class":438},[424,725,727,730,732,734],{"class":426,"line":726},18,[424,728,729],{"class":445},"  causationId",[424,731,533],{"class":438},[424,733,452],{"class":434},[424,735,736],{"class":455},"                    \u002F\u002F ID of the action that caused this one\n",[424,738,740,743,745,747],{"class":426,"line":739},19,[424,741,742],{"class":445},"  correlationId",[424,744,533],{"class":438},[424,746,452],{"class":434},[424,748,749],{"class":455},"                  \u002F\u002F Shared by every action in one operation\n",[424,751,753,756,758,761],{"class":426,"line":752},20,[424,754,755],{"class":445},"  version",[424,757,533],{"class":438},[424,759,760],{"class":434}," number",[424,762,763],{"class":455},"                        \u002F\u002F Defaults to 1\n",[424,765,767,770,772,774],{"class":426,"line":766},21,[424,768,769],{"class":445},"  idempotencyKey",[424,771,533],{"class":438},[424,773,452],{"class":434},[424,775,776],{"class":455},"                 \u002F\u002F Auto-derived; safe retries across drains\n",[424,778,780,783,785,787],{"class":426,"line":779},22,[424,781,782],{"class":445},"  context",[424,784,533],{"class":438},[424,786,612],{"class":438},[424,788,789],{"class":455},"                             \u002F\u002F Filled by auditEnricher\n",[424,791,793,796,798],{"class":426,"line":792},23,[424,794,795],{"class":445},"    requestId",[424,797,533],{"class":438},[424,799,524],{"class":434},[424,801,803,806,808],{"class":426,"line":802},24,[424,804,805],{"class":445},"    traceId",[424,807,533],{"class":438},[424,809,524],{"class":434},[424,811,813,816,818],{"class":426,"line":812},25,[424,814,815],{"class":445},"    ip",[424,817,533],{"class":438},[424,819,524],{"class":434},[424,821,823,826,828],{"class":426,"line":822},26,[424,824,825],{"class":445},"    userAgent",[424,827,533],{"class":438},[424,829,524],{"class":434},[424,831,833,836,838],{"class":426,"line":832},27,[424,834,835],{"class":445},"    tenantId",[424,837,533],{"class":438},[424,839,524],{"class":434},[424,841,843],{"class":426,"line":842},28,[424,844,601],{"class":438},[424,846,848,851,853,855],{"class":426,"line":847},29,[424,849,850],{"class":445},"  signature",[424,852,533],{"class":438},[424,854,452],{"class":434},[424,856,857],{"class":455},"                      \u002F\u002F Set by signed({ strategy: 'hmac' })\n",[424,859,861,864,866,868],{"class":426,"line":860},30,[424,862,863],{"class":445},"  prevHash",[424,865,533],{"class":438},[424,867,452],{"class":434},[424,869,870],{"class":455},"                       \u002F\u002F Set by signed({ strategy: 'hash-chain' })\n",[424,872,874,877,879],{"class":426,"line":873},31,[424,875,876],{"class":445},"  hash",[424,878,533],{"class":438},[424,880,524],{"class":434},[424,882,884],{"class":426,"line":883},32,[424,885,886],{"class":438},"}\n",[407,888,890],{"id":889},"action-naming","Action naming",[892,893,894,902,903,906,907,910,911,910,914,917,918,921,922,925,926,928],"tip",{},[895,896,897,898,901],"strong",{},"Naming convention for ",[398,899,900],{},"action","."," Use ",[398,904,905],{},"noun.verb"," (",[398,908,909],{},"invoice.refund",", ",[398,912,913],{},"user.invite",[398,915,916],{},"apiKey.revoke","). Past tense if the action already happened (",[398,919,920],{},"invoice.refunded","), present tense if ",[398,923,924],{},"withAudit()"," will resolve the outcome. Keep a small fixed dictionary in one file — auditors and SIEM rules query on ",[398,927,900],{},", so a typo is a missing alert.",[395,930,931],{},"A single dictionary file makes alerting straightforward:",[415,933,936],{"className":417,"code":934,"filename":935,"language":419,"meta":420,"style":420},"export const AUDIT_ACTIONS = {\n  USER_INVITE: 'user.invite',\n  USER_REMOVE: 'user.remove',\n  USER_ROLE_CHANGE: 'user.role-change',\n  INVOICE_REFUND: 'invoice.refund',\n  API_KEY_REVOKE: 'apiKey.revoke',\n} as const\n","src\u002Faudit\u002Factions.ts",[398,937,938,955,971,987,1003,1018,1033],{"__ignoreMap":420},[424,939,940,944,947,950,953],{"class":426,"line":427},[424,941,943],{"class":942},"s7zQu","export",[424,945,946],{"class":430}," const",[424,948,949],{"class":574}," AUDIT_ACTIONS ",[424,951,952],{"class":438},"=",[424,954,439],{"class":438},[424,956,957,960,962,964,966,968],{"class":426,"line":442},[424,958,959],{"class":445},"  USER_INVITE",[424,961,449],{"class":438},[424,963,477],{"class":438},[424,965,913],{"class":480},[424,967,484],{"class":438},[424,969,970],{"class":438},",\n",[424,972,973,976,978,980,983,985],{"class":426,"line":459},[424,974,975],{"class":445},"  USER_REMOVE",[424,977,449],{"class":438},[424,979,477],{"class":438},[424,981,982],{"class":480},"user.remove",[424,984,484],{"class":438},[424,986,970],{"class":438},[424,988,989,992,994,996,999,1001],{"class":426,"line":469},[424,990,991],{"class":445},"  USER_ROLE_CHANGE",[424,993,449],{"class":438},[424,995,477],{"class":438},[424,997,998],{"class":480},"user.role-change",[424,1000,484],{"class":438},[424,1002,970],{"class":438},[424,1004,1005,1008,1010,1012,1014,1016],{"class":426,"line":516},[424,1006,1007],{"class":445},"  INVOICE_REFUND",[424,1009,449],{"class":438},[424,1011,477],{"class":438},[424,1013,909],{"class":480},[424,1015,484],{"class":438},[424,1017,970],{"class":438},[424,1019,1020,1023,1025,1027,1029,1031],{"class":426,"line":527},[424,1021,1022],{"class":445},"  API_KEY_REVOKE",[424,1024,449],{"class":438},[424,1026,477],{"class":438},[424,1028,916],{"class":480},[424,1030,484],{"class":438},[424,1032,970],{"class":438},[424,1034,1035,1038,1041],{"class":426,"line":538},[424,1036,1037],{"class":438},"}",[424,1039,1040],{"class":942}," as",[424,1042,1043],{"class":430}," const\n",[407,1045,1047],{"id":1046},"actor-types","Actor types",[1049,1050,1051,902,1054,1057,1058,1061,1062,1065,1066,1069],"warning",{},[895,1052,1053],{},"Don't fake the actor.",[398,1055,1056],{},"actor.type: 'system'"," for cron jobs, queue workers, and background tasks; ",[398,1059,1060],{},"actor.type: 'api'"," for machine-to-machine calls authenticated by a token; ",[398,1063,1064],{},"actor.type: 'agent'"," for AI tool calls. Logging a synthetic ",[398,1067,1068],{},"'user'"," for system actions is the single fastest way to fail an audit review.",[1071,1072,1073,1088],"table",{},[1074,1075,1076],"thead",{},[1077,1078,1079,1085],"tr",{},[1080,1081,1082],"th",{},[398,1083,1084],{},"actor.type",[1080,1086,1087],{},"When to use",[1089,1090,1091,1101,1111,1121],"tbody",{},[1077,1092,1093,1098],{},[1094,1095,1096],"td",{},[398,1097,1068],{},[1094,1099,1100],{},"A human authenticated through your normal auth flow.",[1077,1102,1103,1108],{},[1094,1104,1105],{},[398,1106,1107],{},"'system'",[1094,1109,1110],{},"Cron jobs, queue workers, scheduled tasks, internal background processes.",[1077,1112,1113,1118],{},[1094,1114,1115],{},[398,1116,1117],{},"'api'",[1094,1119,1120],{},"Machine-to-machine calls from another service authenticated by a token.",[1077,1122,1123,1128],{},[1094,1124,1125],{},[398,1126,1127],{},"'agent'",[1094,1129,1130,1131,1134,1135,910,1138,910,1141,1144],{},"AI tool calls (combine with ",[398,1132,1133],{},"evlog\u002Fai"," fields like ",[398,1136,1137],{},"model",[398,1139,1140],{},"tools",[398,1142,1143],{},"promptId",").",[407,1146,1148],{"id":1147},"outcomes","Outcomes",[1071,1150,1151,1163],{},[1074,1152,1153],{},[1077,1154,1155,1160],{},[1080,1156,1157],{},[398,1158,1159],{},"outcome",[1080,1161,1162],{},"Meaning",[1089,1164,1165,1175,1185],{},[1077,1166,1167,1172],{},[1094,1168,1169],{},[398,1170,1171],{},"'success'",[1094,1173,1174],{},"The action completed as requested.",[1077,1176,1177,1182],{},[1094,1178,1179],{},[398,1180,1181],{},"'failure'",[1094,1183,1184],{},"The action was attempted but failed (downstream error, race condition, etc.).",[1077,1186,1187,1192],{},[1094,1188,1189],{},[398,1190,1191],{},"'denied'",[1094,1193,1194],{},"The action was rejected by an authorisation check.",[395,1196,1197,1199,1200,1202,1203,1144],{},[398,1198,1181],{}," and ",[398,1201,1191],{}," are different things — auditors care a lot about denied actions because they signal probing or misconfigured access controls. Always log denials (see ",[1204,1205,1207],"a",{"href":1206},"\u002Flogging\u002Faudit\u002Frecording#deny","Recording Events",[407,1209,1211],{"id":1210},"idempotency","Idempotency",[395,1213,1214,1217,1218,910,1220,910,1223,1226,1227,1230],{},[398,1215,1216],{},"idempotencyKey"," is auto-derived from a hash of ",[398,1219,900],{},[398,1221,1222],{},"actor.id",[398,1224,1225],{},"target",", and a coarse timestamp. The result: even if your drain retries an audit insert across a network blip, the duplicate row collapses on ",[398,1228,1229],{},"ON CONFLICT DO NOTHING",". You don't have to think about it — it's filled in for you.",[395,1232,1233],{},"Use the field as the primary key in Postgres \u002F Bigtable \u002F DynamoDB so retries stay safe by construction.",[407,1235,1237],{"id":1236},"causation-and-correlation","Causation and correlation",[1071,1239,1240,1250],{},[1074,1241,1242],{},[1077,1243,1244,1247],{},[1080,1245,1246],{},"Field",[1080,1248,1249],{},"Use case",[1089,1251,1252,1266],{},[1077,1253,1254,1259],{},[1094,1255,1256],{},[398,1257,1258],{},"correlationId",[1094,1260,1261,1262,1265],{},"Shared by every audit event that belongs to the ",[895,1263,1264],{},"same operation"," (e.g. one HTTP request that triggers a refund + an email + a webhook).",[1077,1267,1268,1273],{},[1094,1269,1270],{},[398,1271,1272],{},"causationId",[1094,1274,1275,1276,1279],{},"The id of the previous audit event that ",[895,1277,1278],{},"caused"," this one. Useful for reconstructing chains of cascading actions.",[395,1281,1282,1283,1285,1286,1289,1290,1292],{},"Most teams set ",[398,1284,1258],{}," to ",[398,1287,1288],{},"requestId",". ",[398,1291,1272],{}," is opt-in and only worth filling when a single user action triggers many internal audit events.",[1294,1295,1296],"style",{},"html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sHdIc, html code.shiki .sHdIc{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#EEFFFF;--shiki-default-font-style:italic;--shiki-dark:#BABED8;--shiki-dark-font-style:italic}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}",{"title":420,"searchDepth":442,"depth":442,"links":1298},[1299,1301,1302,1303,1304,1305],{"id":409,"depth":442,"text":1300},"AuditFields type",{"id":889,"depth":442,"text":890},{"id":1046,"depth":442,"text":1047},{"id":1147,"depth":442,"text":1148},{"id":1210,"depth":442,"text":1211},{"id":1236,"depth":442,"text":1237},"The AuditFields type, action naming conventions, actor types, idempotency, and how the schema sits inside a regular wide event.","md",[1309,1312],{"label":41,"icon":44,"to":129,"color":1310,"variant":1311},"neutral","subtle",{"label":137,"icon":140,"to":138,"color":1310,"variant":1311},{},{"title":132,"icon":135},{"title":390,"description":1306},"3wBfz4tad0MdHDsUj4pmnEX2Z7zzLUdoAhZuZGtj4qY",[1318,1320],{"title":41,"path":129,"stem":130,"description":1319,"icon":44,"children":-1},"First-class audit logs as a thin layer on top of evlog's wide events. Add tamper-evident audit trails to any app with one enricher, one drain wrapper, and one helper.",{"title":137,"path":138,"stem":139,"description":1321,"icon":140,"children":-1},"log.audit, log.audit.deny, standalone audit(), withAudit auto-instrumentation, defineAuditAction registries, and auditDiff change patches.",1777924948799]