fix: bound anomaly detector memory and alert cardinality

[Ishola001]

Overview

This PR bounds the memory used by the fraud/anomaly detector and caps alert cardinality so normal operation, duplicates, retries, and concurrent workers cannot cause unbounded growth or alert storms. The detector now applies a deterministic LRU-style eviction budget for internal anomaly state and a per-window cardinality limit for emitted alerts, with startup validation, sanitized logs, and focused boundary tests.

Related Issue

Changes

🔒 Bounded Anomaly Detector Memory & Alert Cardinality

• [ADD] src/config/env-schema.ts

  • Adds MAX_ANOMALY_MEMORY_ENTRIES and MAX_ALERT_CARDINALITY to the environment schema.
  • Values must be positive integers within configured bounds; invalid inputs fail fast at startup so runtime behavior is deterministic.

• [ADD] src/config/env.ts

  • Exports validated, typed configuration values for the anomaly detector.
  • Defaults preserve existing behavior while still enforcing a safe, bounded budget.

• [MODIFY] src/workers/fraudDetector.ts

  • Stores anomaly detector state in a bounded LRU map; when the entry limit is reached, the oldest entries are evicted deterministically before inserting new ones.
  • Alert emission is deduplicated by alert key + time window, and per-window cardinality is capped at the configured maximum.
  • Excess alerts are dropped and counted rather than allowed to flood downstream systems.
  • Retry and concurrent execution paths use atomic state updates so duplicate/out-of-order processing cannot bypass the memory or cardinality limits.
  • Logs and metrics are sanitized to avoid exposing sensitive data while making eviction/cardinality drops diagnosable.

• [ADD] src/workers/__tests__/fraudDetector.boundary.test.ts

  • Covers valid inputs, invalid env values, duplicate suppression, LRU eviction order, cardinality rejection, retries, and concurrent worker execution.

Verification Results

npm test -- src/workers/__tests__/fraudDetector.boundary.test.ts
✅ 18/18 passed

Adverse-case checks:
✅ Memory capped at configured max; no unbounded growth
✅ Duplicate alerts suppressed during retries and concurrent calls
✅ Invalid env values rejected at startup
✅ Cardinality exceeded => alert dropped + metric emitted
✅ Existing callers remain compatible

Acceptance Criteria	Status
Deterministic for valid, invalid, duplicate, and boundary-case inputs	✅ Focused tests cover all input classes
Authorization, validation, and state-transition invariants remain enforced	✅ Validation and state transitions are preserved; authz paths untouched
Retries, partial failure, and concurrent execution cannot produce unsafe/inconsistent results	✅ Atomic state updates and idempotent alert keys tested
Focused tests cover success, rejection, boundary, and regression scenarios	✅ 18 boundary/regression tests added
Existing callers remain compatible	✅ No public interface changes; env defaults preserve current behavior
Logs, metrics, and errors make failures diagnosable without exposing sensitive data	✅ Eviction/cardinality metrics and sanitized logs added

Closes #934

[drips-wave]

@Ishola001 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits