Skip to main content
Version: Current

AuditFinding

@rotorsoft/act-root

@rotorsoft/act-root / act/src / AuditFinding

Type Alias: AuditFinding

AuditFinding = { category: "schema"; event_id: number; name: string; reason: "unknown_event_name" | "schema_validation_failed"; stream: string; zod_error?: unknown; } | { category: "close-candidate"; idle_days?: number; last_event_at: string; reason: "terminal" | "idle"; restart_supported: boolean; stream: string; } | { category: "restart-candidate"; count: number; snaps: number; stream: string; } | { category: "deprecated-load"; current_version: string; name: string; top_streams: object[]; total: number; } | { category: "reaction-health"; reason: string; retry: number; status: "blocked" | "near-block" | "stuck-backoff"; stream: string; } | { category: "snapshot-drift"; events_since_snap: number; snap_at?: number; stream: string; } | { category: "routing-health"; lane?: string; reason: "unknown-lane" | "unrouted"; stream: string; } | { category: "correlation-gaps"; event_id: number; reason: "orphan-parent" | "missing-correlation"; stream: string; } | { category: "clock-anomalies"; event_id: number; reason: "future-created" | "out-of-order"; stream: string; } | { category: "unreadable-events"; error: unknown; event_id: number; reason: "pii_decrypt_failed"; stream: string; }

Defined in: libs/act/src/types/audit.ts:86

Discriminated union of audit findings. Each shape carries enough context for the operator to act on the finding directly — stream name, event id, suggested remediation hints.

Union Members​

Type Literal​

{ category: "schema"; event_id: number; name: string; reason: "unknown_event_name" | "schema_validation_failed"; stream: string; zod_error?: unknown; }

Type Literal​

{ category: "close-candidate"; idle_days?: number; last_event_at: string; reason: "terminal" | "idle"; restart_supported: boolean; stream: string; }

category​

category: "close-candidate"

idle_days?​

optional idle_days?: number

last_event_at​

last_event_at: string

reason​

reason: "terminal" | "idle"

restart_supported​

restart_supported: boolean

True when the state has a snapshot patch (close({restart: true}) would work).

stream​

stream: string

Type Literal​

{ category: "restart-candidate"; count: number; snaps: number; stream: string; }

Type Literal​

{ category: "deprecated-load"; current_version: string; name: string; top_streams: object[]; total: number; }

Type Literal​

{ category: "reaction-health"; reason: string; retry: number; status: "blocked" | "near-block" | "stuck-backoff"; stream: string; }

Type Literal​

{ category: "snapshot-drift"; events_since_snap: number; snap_at?: number; stream: string; }

Type Literal​

{ category: "routing-health"; lane?: string; reason: "unknown-lane" | "unrouted"; stream: string; }

Type Literal​

{ category: "correlation-gaps"; event_id: number; reason: "orphan-parent" | "missing-correlation"; stream: string; }

Type Literal​

{ category: "clock-anomalies"; event_id: number; reason: "future-created" | "out-of-order"; stream: string; }

Type Literal​

{ category: "unreadable-events"; error: unknown; event_id: number; reason: "pii_decrypt_failed"; stream: string; }

category​

category: "unreadable-events"

An event the store could not hand back at all — currently only a pii payload the configured key cannot decrypt (corrupt ciphertext, bit-rot, a partial restore, or a rotation that outran a stream's correlate checkpoint).

Every other finding describes an event the audit could read. This one names the row that stopped it being read, which the failing read alone does not give: the scan aborts, nothing reports the stream, and blocked_streams() is empty because nothing is blocked.

error​

error: unknown

The underlying adapter error, for operators who log it.

event_id​

event_id: number

reason​

reason: "pii_decrypt_failed"

stream​

stream: string