[Audit] Add deep redaction, cyclic-payload tests, and bounded traversal

[bamiebot-maker]

[Audit] Add deep redaction, cyclic-payload tests, and bounded traversal

Closes #147

Summary of Changes

This pull request addresses recursive secret redaction for nested arrays, circular objects, large strings, and key-case variations across telemetry and audit domains:

1. Cycle Detection & Serialization Safety:

   • Implemented seen = new WeakSet<object>() tracking in redact() in core/telemetry/telemetry.ts.
   • Circular object and array references are safely replaced with "[CIRCULAR]" instead of triggering unbounded recursion or stack overflows.
   • Guaranteed that all redacted objects remain serializable via JSON.stringify().

2. Bounded Traversal Depth:

   • Enforced MAX_REDACT_DEPTH = 16. Deeply nested structures exceeding the depth limit are marked with "[TRUNCATED_DEPTH]", preventing unbounded tree recursion.

3. Key-Case and Auth Variant Redaction:

   • Refined isSensitiveKey(key) to handle case variations and word boundaries (APIKEY, secret_seed, AUTH_TOKEN, passWord, Authorization, cookie, apiKey, privateKey), while safeguarding non-secret keys such as publicKey and normalKey.
   • Updated scrubSecrets and auditContext in core/audit/audit.ts to redact key-case variations and embedded bearer tokens.

4. Embedded Secrets & Large String Scrubbing:

   • Enhanced scrubString with regex scanning for embedded Stellar secret seeds (EMBEDDED_STELLAR_SECRET) and authorization tokens (EMBEDDED_BEARER_TOKEN).
   • Configured MAX_SCANNABLE_STRING_LENGTH (500,000 chars) with truncation fallback to bound memory while ensuring secret material is scrubbed.

5. In-Memory Telemetry Capture Sink:

   • Exported createCaptureSink() returning a TelemetryCaptureSink to easily inspect, filter, find, and clear emitted events during feature and boundary testing.

6. Comprehensive Test Suite:

   • Added unit and regression tests in core/telemetry/__tests__/telemetry.test.ts and core/audit/__tests__/audit.test.ts covering cyclic structures, depth limits, key-case permutations, large strings with embedded secrets, and capture sink operations.
   • Fixed MSW test profile block structure and typing in core/testing/.

Verification

• npx vitest run core/telemetry core/audit (All 34 tests passing)
• npm run verify:telemetry (All 11 instrumented operations verified)
• npm run verify:audit (9 sensitive actions, 9 domain-boundary emitters verified)

[drips-wave]

@bamiebot-maker Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[bamiebot-maker]

kindly review pr
@BigDella