docs(recipes): add audit compliance recipe

- Add audit compliance recipe in English and Indonesian
- Register the recipe in both locale sidebars

Author: NeaByteLab

docs/.vitepress/config.ts

@@ -248,7 +248,8 @@ export default withMermaid(
                   { text: 'Streaming Data', link: '/recipes/streaming-data' },
                   { text: 'Object Storage', link: '/recipes/object-storage' },
                   { text: 'Graceful Shutdown', link: '/recipes/graceful-shutdown' },
-                  { text: 'Production Deploy', link: '/recipes/production-deploy' }
+                  { text: 'Production Deploy', link: '/recipes/production-deploy' },
+                  { text: 'Audit Compliance', link: '/recipes/audit-compliance' }
                 ]
               }
             ]
@@ -438,7 +439,8 @@ export default withMermaid(
                   { text: 'Streaming Data', link: '/id/recipes/streaming-data' },
                   { text: 'Object Storage', link: '/id/recipes/object-storage' },
                   { text: 'Graceful Shutdown', link: '/id/recipes/graceful-shutdown' },
-                  { text: 'Production Deploy', link: '/id/recipes/production-deploy' }
+                  { text: 'Production Deploy', link: '/id/recipes/production-deploy' },
+                  { text: 'Audit Kepatuhan', link: '/id/recipes/audit-compliance' }
                 ]
               }
             ]

docs/id/recipes/audit-compliance.md

@@ -0,0 +1,159 @@
+---
+description: 'Ubah observability bus Deserve jadi jejak audit tingkat kepatuhan, lalu alirkan ke store milik sendiri, sebuah SIEM, atau sebuah WAF.'
+---
+
+# Audit Kepatuhan
+
+Kerja kepatuhan mengajukan satu pertanyaan sulit ke setiap server: apa yang terjadi, kapan, dan bisakah dibuktikan nanti. Deserve menjawabnya di sumber. Setiap kesalahan subsistem, setiap request yang selesai, dan setiap terminasi diri yang diblokir tiba di satu [observability bus](/id/middleware/observability/overview), terstruktur dan bercap waktu pada saat ia menyala.
+
+Pembingkaian ini penting, jadi layak dinyatakan terang. Deserve bukan [SIEM](https://csrc.nist.gov/glossary/term/security_information_and_event_management) dan tidak lebih tahan lama dari satu. Yang ia berikan adalah *input* SIEM paling rapi yang bisa diserahkan sebuah framework. Data yang meninggalkan bus lebih bersih dan lebih lengkap dari yang dipancarkan kebanyakan framework, karena ia membawa perilaku framework dan kesalahan aplikasi sekaligus, masing-masing di [kanal internal atau external](/id/middleware/observability/events) yang bersih sehingga jalur alert tidak pernah tenggelam dalam lalu lintas rutin. Penyimpanan tahan lama tetap tanggung jawab operator, tapi yang sampai ke penyimpanan itu berangkat jujur.
+
+## Apa yang Sudah Ditangkap Bus
+
+Satu listener [`router.on()`](/id/middleware/observability/overview) melihat seluruh permukaan, dan setiap event berbagi amplop `{ type, kind, metadata, timestamp }` yang sama. Jenis yang paling penting untuk jejak audit memetakan langsung ke hal yang diminta auditor:
+
+| Kebutuhan kepatuhan          | Event yang menjawabnya                                                             |
+| ---------------------------- | ---------------------------------------------------------------------------------- |
+| Siapa melakukan apa, kapan   | [`request:complete`](/id/middleware/observability/events#request) dengan `method`, `url`, `statusCode`, `durationMs`, dan `ip` opsional |
+| Event relevan-keamanan       | [`session:invalid`](/id/middleware/observability/events#middleware), [`csrf:rule-error`](/id/middleware/observability/events#middleware), [`process:error`](/id/middleware/observability/events#process) |
+| Kegagalan dan kesalahan      | [`request:error`](/id/middleware/observability/events#request), [`worker:crash`](/id/middleware/observability/events#worker), [`view:error`](/id/middleware/observability/events#view) |
+| Garis waktu yang dapat disusun | Setiap event membawa `timestamp` dalam milidetik epoch dan tiba terurut            |
+
+Tidak ada yang perlu dikabelkan di dalam handler. Kesalahan menyala sendiri, itulah sebabnya cookie yang dirusak atau `Deno.exit` yang diblokir muncul tanpa satu baris logging pun di rute. Daftar lengkapnya ada di [Referensi Event](/id/middleware/observability/events).
+
+## Listener Tingkat Kepatuhan
+
+Listener audit punya satu tugas: menangkap setiap event sebagai rekaman terstruktur dan menyerahkannya ke penyimpanan tahan lama. Menyaring berdasarkan `type` menjaga kesalahan framework di jalurnya sendiri sambil tetap merekam lalu lintas normal:
+
+```typescript twoslash
+import { Router } from '@neabyte/deserve'
+
+const router = new Router({
+  routesDir: './routes'
+})
+
+// Satu rekaman audit per event
+router.on((event) => {
+  const record = JSON.stringify({
+    at: event.timestamp,
+    channel: event.type,
+    kind: event.kind,
+    ...event.metadata
+  })
+  // Event internal memberi makan kanal kesalahan
+  if (event.type === 'internal') {
+    console.error(record)
+  } else {
+    console.log(record)
+  }
+})
+
+await router.serve(8000)
+```
+
+Tiap rekaman sudah JSON, sudah bercap waktu, dan sudah berlabel `channel`. Itu bentuk yang diharapkan setiap hilir di bawah, jadi listener yang sama memberi makan ketiga opsi tanpa perubahan.
+
+## Opsi 1 - Bangun Store Sendiri
+
+Sink tahan lama paling sederhana adalah yang dimiliki dari ujung ke ujung. Tambahkan tiap rekaman ke berkas tulis-saja, kirim ke object storage, atau sisipkan ke database. Sebuah penambah berkas menjaga log audit di disk dan di luar jalur request:
+
+```typescript twoslash
+import { Router } from '@neabyte/deserve'
+
+const router = new Router({
+  routesDir: './routes'
+})
+// ---cut---
+// Buka log audit sekali, tambah-saja
+const audit = await Deno.open('./audit.log', {
+  create: true,
+  append: true
+})
+const encoder = new TextEncoder()
+
+router.on(async (event) => {
+  const record = JSON.stringify({
+    at: event.timestamp,
+    ...event
+  })
+  // Tambah satu baris per event
+  await audit.write(encoder.encode(record + '\n'))
+})
+```
+
+Menulis ke disk butuh flag `--allow-write` yang dibatasi ke log, seperti dibahas di [Production Deploy](/id/recipes/production-deploy#mengunci-permission). Untuk retensi jangka panjang, kirim rekaman yang sama ke object storage tahan lama dengan pola di [Object Storage](/id/recipes/object-storage).
+
+## Opsi 2 - Alirkan ke SIEM
+
+Sebuah [SIEM](https://csrc.nist.gov/glossary/term/security_information_and_event_management) mengumpulkan event dari banyak sistem, mengorelasikannya, dan memunculkan alert. Kebanyakan menerima rekaman terstruktur lewat endpoint HTTP biasa, jadi listener audit meneruskan tiap rekaman dengan satu `fetch`:
+
+```typescript twoslash
+import { Router } from '@neabyte/deserve'
+
+const router = new Router({
+  routesDir: './routes'
+})
+// ---cut---
+const endpoint = 'https://http-inputs-acme.splunkcloud.com/services/collector/event'
+const token = Deno.env.get('SIEM_TOKEN') ?? ''
+
+router.on((event) => {
+  // Teruskan rekaman ke SIEM
+  void fetch(endpoint, {
+    method: 'POST',
+    headers: {
+      authorization: `Splunk ${token}`,
+      'content-type': 'application/json'
+    },
+    body: JSON.stringify({
+      event: {
+        ...event.metadata,
+        kind: event.kind
+      }
+    })
+  })
+})
+```
+
+Endpoint dan bentuk auth mengikuti vendor. Kolektor umum dengan API ingest HTTP publik mencakup [Splunk HTTP Event Collector](https://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector), [Datadog Logs Intake](https://docs.datadoghq.com/api/latest/logs/), [Elasticsearch Bulk API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-bulk), dan endpoint [OpenTelemetry OTLP/HTTP](https://opentelemetry.io/docs/specs/otel/protocol/exporter/) mana pun. `fetch` keluar butuh flag `--allow-net` dari [Production Deploy](/id/recipes/production-deploy#daftar-periksa-permission), dan panggilannya ditembakkan tanpa `await` supaya jalur request tetap cepat.
+
+## Opsi 3 - Beri Makan Loop Keputusan WAF
+
+Sebuah [Web Application Firewall](https://owasp.org/www-community/Web_Application_Firewall) memblokir lalu lintas buruk sebelum sampai ke aplikasi, dan bus memberinya sinyal untuk bertindak. Lonjakan event `request:error` dari satu `ip`, atau kesalahan `csrf:rule-error` berulang, persis pola yang diincar aturan WAF. Teruskan jenis yang relevan-keamanan ke API firewall untuk menggerakkan daftar blokir:
+
+```typescript twoslash
+import { Router } from '@neabyte/deserve'
+
+const router = new Router({
+  routesDir: './routes'
+})
+// ---cut---
+router.on((event) => {
+  // Hanya teruskan kesalahan relevan-keamanan
+  if (event.kind === 'csrf:rule-error' || event.kind === 'request:error') {
+    void fetch('https://waf.internal/signals', {
+      method: 'POST',
+      headers: {
+        'content-type': 'application/json'
+      },
+      body: JSON.stringify({
+        at: event.timestamp,
+        ...event.metadata
+      })
+    })
+  }
+})
+```
+
+Firewall terkelola membukanya lewat API masing-masing, seperti [aturan kustom WAF Cloudflare](https://developers.cloudflare.com/waf/custom-rules/) atau [API AWS WAF](https://docs.aws.amazon.com/waf/latest/APIReference/Welcome.html). Bus memasok bukti, WAF memegang putusan, dan keduanya tetap terpisah bersih.
+
+## Batas yang Jujur
+
+Menjaga klaim tetap lurus membuat resep ini tepercaya:
+
+- **Tidak tahan lama sendirian.** Tanpa listener terdaftar, emit jadi no-op, jadi kesalahan sebelum penyimpanan dikabelkan memang tidak terekam. Ketahanan tinggal di sink, bukan di bus.
+- **Upaya terbaik, dalam proses.** Event menyala real time di server, jadi crash keras antara emit dan tulis bisa menjatuhkan rekaman terakhir. [Process guard](/id/error-handling/defense-in-depth#lapis-5-process-guard) menjaga proses tetap hidup melewati sebagian besar kesalahan, yang mempersempit jendela itu tapi tidak menutupnya.
+- **Input, bukan analisis.** Bus menghasilkan rekaman bersih. Korelasi, retensi, dan alerting milik store, SIEM, atau WAF yang menerimanya.
+
+Yang dijamin Deserve adalah bagian yang biasanya gagal dibuat framework: data yang sampai ke penyimpanan itu terstruktur, bercap waktu di sumber, terpisah per kanal, dan lengkap di seluruh perilaku framework dan kesalahan aplikasi. Semua dapat diaudit karena semua memancar.
+

docs/recipes/audit-compliance.md

@@ -0,0 +1,158 @@
+---
+description: 'Turn the Deserve observability bus into a compliance-grade audit trail, then pipe it to your own store, a SIEM, or a WAF.'
+---
+
+# Audit Compliance
+
+Compliance work asks a hard question of every server: what happened, when, and can it be proven later. Deserve answers it at the source. Every subsystem fault, every finished request, and every blocked self-termination arrives on one [observability bus](/middleware/observability/overview), structured and timestamped the instant it fires.
+
+That framing matters, so it is worth stating plainly. Deserve is not a [SIEM](https://csrc.nist.gov/glossary/term/security_information_and_event_management) and is not more durable than one. What it is, is the best-behaved SIEM *input* a framework can hand over. The data leaving the bus is cleaner and more complete than most frameworks emit, because it carries framework behaviour and application faults alike, each on a clean [internal or external channel](/middleware/observability/events) so the alert path never drowns in routine traffic. Durable storage is still on the operator, but what reaches that storage starts honest.
+
+## What the Bus Already Captures
+
+A single [`router.on()`](/middleware/observability/overview) listener sees the whole surface, and every event shares the same `{ type, kind, metadata, timestamp }` envelope. The kinds that matter most for an audit trail map straight onto what auditors ask for:
+
+| Compliance need              | Events that answer it                                                              |
+| ---------------------------- | ---------------------------------------------------------------------------------- |
+| Who did what, when           | [`request:complete`](/middleware/observability/events#requests) with `method`, `url`, `statusCode`, `durationMs`, and optional `ip` |
+| Security-relevant events     | [`session:invalid`](/middleware/observability/events#middleware), [`csrf:rule-error`](/middleware/observability/events#middleware), [`process:error`](/middleware/observability/events#process) |
+| Failures and faults          | [`request:error`](/middleware/observability/events#requests), [`worker:crash`](/middleware/observability/events#workers), [`view:error`](/middleware/observability/events#views) |
+| Reconstructable timeline     | Every event carries a `timestamp` in epoch milliseconds and arrives in order       |
+
+Nothing here needs wiring inside handlers. The faults emit on their own, which is why a tampered cookie or a blocked `Deno.exit` shows up without a single line of logging in the route. The full list lives in the [Event Reference](/middleware/observability/events).
+
+## A Compliance-Grade Listener
+
+The audit listener has one job: capture every event as a structured record and hand it to durable storage. Filtering on `type` keeps framework faults on their own track while still recording normal traffic:
+
+```typescript twoslash
+import { Router } from '@neabyte/deserve'
+
+const router = new Router({
+  routesDir: './routes'
+})
+
+// One audit record per event
+router.on((event) => {
+  const record = JSON.stringify({
+    at: event.timestamp,
+    channel: event.type,
+    kind: event.kind,
+    ...event.metadata
+  })
+  // Internal events feed the fault channel
+  if (event.type === 'internal') {
+    console.error(record)
+  } else {
+    console.log(record)
+  }
+})
+
+await router.serve(8000)
+```
+
+Each record is already JSON, already timestamped, and already labelled by `channel`. That is the shape every downstream below expects, so the same listener feeds all three options without change.
+
+## Option 1 - Build Your Own Store
+
+The simplest durable sink is one owned end to end. Append each record to a write-only file, ship it to object storage, or insert it into a database. A file appender keeps the audit log on disk and out of the request path:
+
+```typescript twoslash
+import { Router } from '@neabyte/deserve'
+
+const router = new Router({
+  routesDir: './routes'
+})
+// ---cut---
+// Open the audit log once, append-only
+const audit = await Deno.open('./audit.log', {
+  create: true,
+  append: true
+})
+const encoder = new TextEncoder()
+
+router.on(async (event) => {
+  const record = JSON.stringify({
+    at: event.timestamp,
+    ...event
+  })
+  // Append one line per event
+  await audit.write(encoder.encode(record + '\n'))
+})
+```
+
+Writing to disk needs the `--allow-write` flag scoped to the log, as covered in [Production Deploy](/recipes/production-deploy#locking-permissions-down). For long-term retention, ship the same records to durable object storage with the pattern in [Object Storage](/recipes/object-storage).
+
+## Option 2 - Stream to a SIEM
+
+A [SIEM](https://csrc.nist.gov/glossary/term/security_information_and_event_management) collects events from many systems, correlates them, and raises alerts. Most accept structured records over a plain HTTP endpoint, so the audit listener forwards each record with a single `fetch`:
+
+```typescript twoslash
+import { Router } from '@neabyte/deserve'
+
+const router = new Router({
+  routesDir: './routes'
+})
+// ---cut---
+const endpoint = 'https://http-inputs-acme.splunkcloud.com/services/collector/event'
+const token = Deno.env.get('SIEM_TOKEN') ?? ''
+
+router.on((event) => {
+  // Forward the record to the SIEM
+  void fetch(endpoint, {
+    method: 'POST',
+    headers: {
+      authorization: `Splunk ${token}`,
+      'content-type': 'application/json'
+    },
+    body: JSON.stringify({
+      event: {
+        ...event.metadata,
+        kind: event.kind
+      }
+    })
+  })
+})
+```
+
+The endpoint and auth shape follow the vendor. Common collectors with public HTTP ingest APIs include [Splunk HTTP Event Collector](https://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector), [Datadog Logs Intake](https://docs.datadoghq.com/api/latest/logs/), [Elasticsearch Bulk API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-bulk), and any [OpenTelemetry OTLP/HTTP](https://opentelemetry.io/docs/specs/otel/protocol/exporter/) endpoint. Outbound `fetch` needs the `--allow-net` flag from [Production Deploy](/recipes/production-deploy#permission-checklist), and the call is fired without `await` so the request path stays fast.
+
+## Option 3 - Feed a WAF Decision Loop
+
+A [Web Application Firewall](https://owasp.org/www-community/Web_Application_Firewall) blocks bad traffic before it reaches the app, and the bus gives it signal to act on. A burst of `request:error` events from one `ip`, or repeated `csrf:rule-error` faults, is exactly the pattern a WAF rule wants. Forward the security-relevant kinds to the firewall's API to drive a block list:
+
+```typescript twoslash
+import { Router } from '@neabyte/deserve'
+
+const router = new Router({
+  routesDir: './routes'
+})
+// ---cut---
+router.on((event) => {
+  // Only forward security-relevant faults
+  if (event.kind === 'csrf:rule-error' || event.kind === 'request:error') {
+    void fetch('https://waf.internal/signals', {
+      method: 'POST',
+      headers: {
+        'content-type': 'application/json'
+      },
+      body: JSON.stringify({
+        at: event.timestamp,
+        ...event.metadata
+      })
+    })
+  }
+})
+```
+
+Managed firewalls expose this through their own APIs, such as [Cloudflare WAF custom rules](https://developers.cloudflare.com/waf/custom-rules/) or the [AWS WAF API](https://docs.aws.amazon.com/waf/latest/APIReference/Welcome.html). The bus supplies the evidence, the WAF owns the verdict, and the two stay cleanly separated.
+
+## Honest Limits
+
+Holding the claim straight keeps the recipe trustworthy:
+
+- **Not durable on its own.** With no listener registered, emitting is a no-op, so a fault before storage is wired is simply not recorded. Durability lives in the sink, not the bus.
+- **Best effort, in process.** Events fire in real time on the server, so a hard crash between emit and write can drop the last record. The [process guard](/error-handling/defense-in-depth#layer-5-process-guard) keeps the process alive through most faults, which narrows that window but does not close it.
+- **Input, not analysis.** The bus produces clean records. Correlation, retention, and alerting belong to whatever store, SIEM, or WAF receives them.
+
+What Deserve guarantees is the part frameworks usually get wrong: the data arriving at storage is structured, timestamped at the source, split by channel, and complete across framework behaviour and application faults. Everything is auditable because everything emits.