@bryan-thompson/inspector-assessment-client 1.25.1 → 1.25.5

package/lib/services/assessment/config/architecturePatterns.d.ts

@@ -0,0 +1,101 @@
+/**
+ * Architecture Pattern Configuration
+ *
+ * Pattern database for detecting server architecture characteristics including:
+ * - Database backends (Neo4j, MongoDB, PostgreSQL, etc.)
+ * - Transport modes (stdio, HTTP, SSE)
+ * - Network access requirements
+ *
+ * Created as part of Issue #57: Architecture detection and behavior inference modules
+ */
+/**
+ * Database backend types detected from patterns
+ */
+export type DatabaseBackend = "neo4j" | "mongodb" | "sqlite" | "postgresql" | "mysql" | "redis" | "dynamodb" | "firestore" | "supabase" | "cassandra" | "elasticsearch" | "unknown";
+/**
+ * Transport mode capabilities
+ */
+export type TransportMode = "stdio" | "http" | "sse";
+/**
+ * Server architecture classification
+ */
+export type ServerArchitectureType = "local" | "hybrid" | "remote";
+/**
+ * Database detection patterns.
+ * Each database has multiple patterns to catch various naming conventions.
+ */
+export declare const DATABASE_PATTERNS: Record<Exclude<DatabaseBackend, "unknown">, RegExp[]>;
+/**
+ * Transport detection patterns.
+ * Used to identify which transport modes a server supports.
+ */
+export declare const TRANSPORT_PATTERNS: Record<TransportMode, RegExp[]>;
+/**
+ * Network access indicators.
+ * Patterns that suggest the server requires network/internet access.
+ */
+export declare const NETWORK_INDICATORS: RegExp[];
+/**
+ * Local-only indicators.
+ * Patterns that suggest the server operates locally without network.
+ */
+export declare const LOCAL_ONLY_INDICATORS: RegExp[];
+/**
+ * External service detection patterns.
+ * Maps service names to URL/import patterns.
+ */
+export declare const EXTERNAL_SERVICE_PATTERNS: Record<string, RegExp[]>;
+/**
+ * Architecture pattern configuration interface.
+ * Allows customization of all pattern categories.
+ */
+export interface ArchitecturePatternConfig {
+    databases: Record<string, RegExp[]>;
+    transports: Record<string, RegExp[]>;
+    networkIndicators: RegExp[];
+    localOnlyIndicators: RegExp[];
+    externalServices: Record<string, RegExp[]>;
+}
+/**
+ * Get default architecture patterns configuration.
+ */
+export declare function getDefaultArchitecturePatterns(): ArchitecturePatternConfig;
+/**
+ * Detect database backends from text content.
+ * Searches for patterns in tool descriptions, source code, or package.json.
+ *
+ * @param content - Text content to search (description, source code, etc.)
+ * @returns Array of detected database backends with match evidence
+ */
+export declare function detectDatabasesFromContent(content: string): Array<{
+    backend: DatabaseBackend;
+    evidence: string;
+    confidence: "high" | "medium" | "low";
+}>;
+/**
+ * Detect transport modes from text content.
+ *
+ * @param content - Text content to search
+ * @returns Array of detected transport modes
+ */
+export declare function detectTransportsFromContent(content: string): TransportMode[];
+/**
+ * Check if content indicates network access requirements.
+ *
+ * @param content - Text content to search
+ * @returns Object with network access flag and matched indicators
+ */
+export declare function checkNetworkAccess(content: string): {
+    requiresNetwork: boolean;
+    indicators: string[];
+    localOnly: boolean;
+    localIndicators: string[];
+};
+/**
+ * Detect external services from content.
+ *
+ * @param content - Text content to search
+ * @returns Array of detected service names
+ */
+export declare function detectExternalServices(content: string): string[];
+//# sourceMappingURL=architecturePatterns.d.ts.map

package/lib/services/assessment/config/architecturePatterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"architecturePatterns.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/config/architecturePatterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;GAEG;AACH,MAAM,MAAM,eAAe,GACvB,OAAO,GACP,SAAS,GACT,QAAQ,GACR,YAAY,GACZ,OAAO,GACP,OAAO,GACP,UAAU,GACV,WAAW,GACX,UAAU,GACV,WAAW,GACX,eAAe,GACf,SAAS,CAAC;AAEd;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;AAErD;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,iBAAiB,EAAE,MAAM,CACpC,OAAO,CAAC,eAAe,EAAE,SAAS,CAAC,EACnC,MAAM,EAAE,CAiCT,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,CAyB9D,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,MAAM,EA6BtC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,EAmBzC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAW9D,CAAC;AAEF;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACrC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CAC5C;AAED;;GAEG;AACH,wBAAgB,8BAA8B,IAAI,yBAAyB,CAQ1E;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC;IACjE,OAAO,EAAE,eAAe,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;CACvC,CAAC,CA4BD;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,EAAE,CAa5E;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG;IACnD,eAAe,EAAE,OAAO,CAAC;IACzB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B,CAwBA;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAahE"}

package/lib/services/assessment/config/architecturePatterns.js

@@ -0,0 +1,248 @@
+/**
+ * Architecture Pattern Configuration
+ *
+ * Pattern database for detecting server architecture characteristics including:
+ * - Database backends (Neo4j, MongoDB, PostgreSQL, etc.)
+ * - Transport modes (stdio, HTTP, SSE)
+ * - Network access requirements
+ *
+ * Created as part of Issue #57: Architecture detection and behavior inference modules
+ */
+/**
+ * Database detection patterns.
+ * Each database has multiple patterns to catch various naming conventions.
+ */
+export const DATABASE_PATTERNS = {
+    neo4j: [
+        /\bneo4j\b/i,
+        /\bcypher\b/i,
+        /graph\s*database/i,
+        /neo4j:\/\//i,
+        /\bgraph\s*db\b/i,
+    ],
+    mongodb: [
+        /\bmongodb\b/i,
+        /\bmongoose\b/i,
+        /\bmongo\b/i,
+        /mongodb:\/\//i,
+        /mongodb\+srv:\/\//i,
+        /\bpymongo\b/i,
+    ],
+    sqlite: [/\bsqlite\b/i, /\bsqlite3\b/i, /\.sqlite\b/i, /\.db\b/i],
+    postgresql: [
+        /\bpostgres\b/i,
+        /\bpostgresql\b/i,
+        /\bpg\b/i,
+        /postgres:\/\//i,
+        /postgresql:\/\//i,
+        /\bpsycopg\b/i,
+    ],
+    mysql: [/\bmysql\b/i, /\bmariadb\b/i, /mysql:\/\//i, /mariadb:\/\//i],
+    redis: [/\bredis\b/i, /redis:\/\//i, /\bupstash\b/i],
+    dynamodb: [/\bdynamodb\b/i, /\bdynamo\b/i, /aws.*dynamo/i],
+    firestore: [/\bfirestore\b/i, /firebase.*firestore/i],
+    supabase: [/\bsupabase\b/i, /supabase\.co/i],
+    cassandra: [/\bcassandra\b/i, /\bscylla\b/i, /cql/i],
+    elasticsearch: [/\belasticsearch\b/i, /\belastic\b/i, /\bopensearch\b/i],
+};
+/**
+ * Transport detection patterns.
+ * Used to identify which transport modes a server supports.
+ */
+export const TRANSPORT_PATTERNS = {
+    stdio: [
+        /\bstdio\b/i,
+        /\bstdin\b/i,
+        /\bstdout\b/i,
+        /transport.*stdio/i,
+        /stdio.*transport/i,
+        /process\.stdin/i,
+        /process\.stdout/i,
+    ],
+    http: [
+        /\bhttp\s*transport\b/i,
+        /streamable-http/i,
+        /rest\s*api/i,
+        /\bhttp\s*server\b/i,
+        /express|fastify|koa|hono/i,
+        /app\.listen/i,
+    ],
+    sse: [
+        /\bsse\b/i,
+        /server-sent/i,
+        /event\s*stream/i,
+        /sse\s*transport/i,
+        /text\/event-stream/i,
+    ],
+};
+/**
+ * Network access indicators.
+ * Patterns that suggest the server requires network/internet access.
+ */
+export const NETWORK_INDICATORS = [
+    // URL patterns
+    /https?:\/\//i,
+    /wss?:\/\//i,
+    // API domain patterns
+    /api\.[a-z]+\./i,
+    /\.api\./i,
+    // HTTP client libraries
+    /\bfetch\s*\(/i,
+    /\baxios\b/i,
+    /\brequest\b/i,
+    /\bgot\b/i,
+    /\bnode-fetch\b/i,
+    /\bundici\b/i,
+    /\bhttpx\b/i,
+    /\brequests\b/i,
+    /\baiohttp\b/i,
+    // WebSocket patterns
+    /\bwebsocket\b/i,
+    /\bsocket\.io\b/i,
+    /\bws\b/i,
+    // Cloud service patterns
+    /aws-sdk/i,
+    /\bgoogle-cloud\b/i,
+    /azure/i,
+];
+/**
+ * Local-only indicators.
+ * Patterns that suggest the server operates locally without network.
+ */
+export const LOCAL_ONLY_INDICATORS = [
+    // File system operations
+    /\bfs\b/i,
+    /file\s*system/i,
+    /local\s*file/i,
+    /\.readFile/i,
+    /\.writeFile/i,
+    // SQLite (local database)
+    /\bsqlite\b/i,
+    // Local path patterns
+    /~\/|\/home\/|\/Users\//i,
+    // Local process execution
+    /child_process/i,
+    /subprocess/i,
+    /\bexec\b/i,
+    /\bspawn\b/i,
+];
+/**
+ * External service detection patterns.
+ * Maps service names to URL/import patterns.
+ */
+export const EXTERNAL_SERVICE_PATTERNS = {
+    github: [/github\.com/i, /api\.github/i, /\b@octokit\b/i, /\bgithub\b/i],
+    gitlab: [/gitlab\.com/i, /api\.gitlab/i, /\bgitlab\b/i],
+    aws: [/aws-sdk/i, /amazonaws\.com/i, /\baws\b/i],
+    gcp: [/google-cloud/i, /googleapis\.com/i, /\bgcp\b/i],
+    azure: [/azure/i, /microsoft\.com/i],
+    openai: [/openai\.com/i, /api\.openai/i, /\bopenai\b/i],
+    anthropic: [/anthropic\.com/i, /api\.anthropic/i, /\banthropic\b/i],
+    slack: [/slack\.com/i, /api\.slack/i, /\bslack\b/i],
+    discord: [/discord\.com/i, /discord\.gg/i, /\bdiscord\b/i],
+    stripe: [/stripe\.com/i, /api\.stripe/i, /\bstripe\b/i],
+};
+/**
+ * Get default architecture patterns configuration.
+ */
+export function getDefaultArchitecturePatterns() {
+    return {
+        databases: DATABASE_PATTERNS,
+        transports: TRANSPORT_PATTERNS,
+        networkIndicators: NETWORK_INDICATORS,
+        localOnlyIndicators: LOCAL_ONLY_INDICATORS,
+        externalServices: EXTERNAL_SERVICE_PATTERNS,
+    };
+}
+/**
+ * Detect database backends from text content.
+ * Searches for patterns in tool descriptions, source code, or package.json.
+ *
+ * @param content - Text content to search (description, source code, etc.)
+ * @returns Array of detected database backends with match evidence
+ */
+export function detectDatabasesFromContent(content) {
+    const results = [];
+    for (const [backend, patterns] of Object.entries(DATABASE_PATTERNS)) {
+        for (const pattern of patterns) {
+            const match = content.match(pattern);
+            if (match) {
+                // Determine confidence based on pattern specificity
+                const confidence = pattern.source.includes("://") || pattern.source.includes("\\b")
+                    ? "high"
+                    : "medium";
+                results.push({
+                    backend: backend,
+                    evidence: match[0],
+                    confidence,
+                });
+                break; // Only one match per backend
+            }
+        }
+    }
+    return results;
+}
+/**
+ * Detect transport modes from text content.
+ *
+ * @param content - Text content to search
+ * @returns Array of detected transport modes
+ */
+export function detectTransportsFromContent(content) {
+    const transports = new Set();
+    for (const [mode, patterns] of Object.entries(TRANSPORT_PATTERNS)) {
+        for (const pattern of patterns) {
+            if (pattern.test(content)) {
+                transports.add(mode);
+                break;
+            }
+        }
+    }
+    return Array.from(transports);
+}
+/**
+ * Check if content indicates network access requirements.
+ *
+ * @param content - Text content to search
+ * @returns Object with network access flag and matched indicators
+ */
+export function checkNetworkAccess(content) {
+    const networkMatches = [];
+    const localMatches = [];
+    for (const pattern of NETWORK_INDICATORS) {
+        const match = content.match(pattern);
+        if (match) {
+            networkMatches.push(match[0]);
+        }
+    }
+    for (const pattern of LOCAL_ONLY_INDICATORS) {
+        const match = content.match(pattern);
+        if (match) {
+            localMatches.push(match[0]);
+        }
+    }
+    return {
+        requiresNetwork: networkMatches.length > 0,
+        indicators: networkMatches,
+        localOnly: localMatches.length > 0 && networkMatches.length === 0,
+        localIndicators: localMatches,
+    };
+}
+/**
+ * Detect external services from content.
+ *
+ * @param content - Text content to search
+ * @returns Array of detected service names
+ */
+export function detectExternalServices(content) {
+    const services = new Set();
+    for (const [service, patterns] of Object.entries(EXTERNAL_SERVICE_PATTERNS)) {
+        for (const pattern of patterns) {
+            if (pattern.test(content)) {
+                services.add(service);
+                break;
+            }
+        }
+    }
+    return Array.from(services);
+}

package/lib/services/assessment/config/performanceConfig.d.ts

@@ -0,0 +1,122 @@
+/**
+ * Performance Configuration for Assessment Engine
+ *
+ * Centralizes performance-related magic numbers that were previously
+ * scattered across multiple modules. Supports JSON configuration files
+ * for runtime tuning via CLI flags.
+ *
+ * @see https://github.com/triepod-ai/inspector-assessment/issues/37
+ */
+import type { Logger } from "../lib/logger.js";
+/**
+ * Performance configuration for assessment execution.
+ * Controls batching, timeouts, concurrency, and resource limits.
+ */
+export interface PerformanceConfig {
+    /**
+     * Interval in milliseconds between progress batch flushes.
+     * Controls how often batched test results are emitted.
+     * @default 500
+     */
+    batchFlushIntervalMs: number;
+    /**
+     * Batch size for functionality assessment progress events.
+     * Smaller than security batch size because functionality tests are fewer.
+     * @default 5
+     */
+    functionalityBatchSize: number;
+    /**
+     * Batch size for security assessment progress events.
+     * @default 10
+     */
+    securityBatchSize: number;
+    /**
+     * Timeout for individual test scenario execution in milliseconds.
+     * Applied via Promise.race in TestScenarioEngine.
+     * @default 5000
+     */
+    testTimeoutMs: number;
+    /**
+     * Timeout for individual security payload tests in milliseconds.
+     * Fallback when not specified in assessment configuration.
+     * @default 5000
+     */
+    securityTestTimeoutMs: number;
+    /**
+     * Warning threshold for queue depth monitoring.
+     * Triggers warning when task queue exceeds this size.
+     *
+     * Derivation: Advanced security assessments can legitimately queue:
+     *   29 tools x 140 payloads (across 23 attack patterns) = 4,060 tasks
+     *
+     * Threshold of 10,000 provides ~146% headroom to accommodate larger
+     * tool sets while catching true runaway scenarios.
+     * @default 10000
+     */
+    queueWarningThreshold: number;
+    /**
+     * Maximum EventEmitter listeners to prevent Node.js warnings.
+     * Assessment operations require more listeners than Node's default (10).
+     * @default 50
+     */
+    eventEmitterMaxListeners: number;
+}
+/**
+ * Default performance configuration.
+ * These values preserve existing behavior across all modules.
+ */
+export declare const DEFAULT_PERFORMANCE_CONFIG: Readonly<Required<PerformanceConfig>>;
+/**
+ * Performance presets for common use cases.
+ */
+export declare const PERFORMANCE_PRESETS: {
+    /** Default configuration - balanced performance */
+    readonly default: Readonly<Required<PerformanceConfig>>;
+    /** Optimized for speed with larger batches */
+    readonly fast: Readonly<{
+        functionalityBatchSize: 10;
+        securityBatchSize: 20;
+        batchFlushIntervalMs: number;
+        testTimeoutMs: number;
+        securityTestTimeoutMs: number;
+        queueWarningThreshold: number;
+        eventEmitterMaxListeners: number;
+    }>;
+    /** Conservative settings for resource-constrained environments */
+    readonly resourceConstrained: Readonly<{
+        functionalityBatchSize: 3;
+        securityBatchSize: 5;
+        queueWarningThreshold: 5000;
+        batchFlushIntervalMs: number;
+        testTimeoutMs: number;
+        securityTestTimeoutMs: number;
+        eventEmitterMaxListeners: number;
+    }>;
+};
+/**
+ * Validate a partial performance config.
+ * Ensures values are within reasonable bounds.
+ *
+ * @param config - Partial config to validate
+ * @returns Array of validation error messages (empty if valid)
+ */
+export declare function validatePerformanceConfig(config: Partial<PerformanceConfig>): string[];
+/**
+ * Merge a partial config with defaults.
+ * User-provided values override defaults.
+ *
+ * @param partial - Partial config to merge
+ * @returns Complete config with defaults applied
+ */
+export declare function mergeWithDefaults(partial: Partial<PerformanceConfig>): Required<PerformanceConfig>;
+/**
+ * Load performance configuration from a JSON file.
+ * Partial configs are validated and merged with defaults.
+ *
+ * @param configPath - Path to JSON configuration file
+ * @param logger - Optional logger for diagnostic output
+ * @returns Complete configuration with defaults applied
+ * @throws Error if config file has validation errors
+ */
+export declare function loadPerformanceConfig(configPath?: string, logger?: Logger): Required<PerformanceConfig>;
+//# sourceMappingURL=performanceConfig.d.ts.map

package/lib/services/assessment/config/performanceConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"performanceConfig.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/config/performanceConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE5C;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAE7B;;;;OAIG;IACH,sBAAsB,EAAE,MAAM,CAAC;IAE/B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC;IAEtB;;;;OAIG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAE9B;;;;;;;;;;OAUG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAE9B;;;;OAIG;IACH,wBAAwB,EAAE,MAAM,CAAC;CAClC;AAED;;;GAGG;AACH,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CASzE,CAAC;AAEL;;GAEG;AACH,eAAO,MAAM,mBAAmB;IAC9B,mDAAmD;;IAGnD,8CAA8C;;;;8BAxExB,MAAM;uBAoBb,MAAM;+BAOE,MAAM;+BAaN,MAAM;kCAOH,MAAM;;IAgChC,kEAAkE;;;;;8BA/E5C,MAAM;uBAoBb,MAAM;+BAOE,MAAM;kCAoBH,MAAM;;CAuCxB,CAAC;AAEX;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,OAAO,CAAC,iBAAiB,CAAC,GACjC,MAAM,EAAE,CAwDV;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAClC,QAAQ,CAAC,iBAAiB,CAAC,CAsB7B;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,CAAC,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,MAAM,GACd,QAAQ,CAAC,iBAAiB,CAAC,CAyC7B"}

package/lib/services/assessment/config/performanceConfig.js

@@ -0,0 +1,154 @@
+/**
+ * Performance Configuration for Assessment Engine
+ *
+ * Centralizes performance-related magic numbers that were previously
+ * scattered across multiple modules. Supports JSON configuration files
+ * for runtime tuning via CLI flags.
+ *
+ * @see https://github.com/triepod-ai/inspector-assessment/issues/37
+ */
+import * as fs from "fs";
+/**
+ * Default performance configuration.
+ * These values preserve existing behavior across all modules.
+ */
+export const DEFAULT_PERFORMANCE_CONFIG = Object.freeze({
+    batchFlushIntervalMs: 500,
+    functionalityBatchSize: 5,
+    securityBatchSize: 10,
+    testTimeoutMs: 5000,
+    securityTestTimeoutMs: 5000,
+    queueWarningThreshold: 10000,
+    eventEmitterMaxListeners: 50,
+});
+/**
+ * Performance presets for common use cases.
+ */
+export const PERFORMANCE_PRESETS = {
+    /** Default configuration - balanced performance */
+    default: DEFAULT_PERFORMANCE_CONFIG,
+    /** Optimized for speed with larger batches */
+    fast: Object.freeze({
+        ...DEFAULT_PERFORMANCE_CONFIG,
+        functionalityBatchSize: 10,
+        securityBatchSize: 20,
+    }),
+    /** Conservative settings for resource-constrained environments */
+    resourceConstrained: Object.freeze({
+        ...DEFAULT_PERFORMANCE_CONFIG,
+        functionalityBatchSize: 3,
+        securityBatchSize: 5,
+        queueWarningThreshold: 5000,
+    }),
+};
+/**
+ * Validate a partial performance config.
+ * Ensures values are within reasonable bounds.
+ *
+ * @param config - Partial config to validate
+ * @returns Array of validation error messages (empty if valid)
+ */
+export function validatePerformanceConfig(config) {
+    const errors = [];
+    if (config.batchFlushIntervalMs !== undefined &&
+        (config.batchFlushIntervalMs < 50 || config.batchFlushIntervalMs > 10000)) {
+        errors.push("batchFlushIntervalMs must be between 50 and 10000");
+    }
+    if (config.functionalityBatchSize !== undefined &&
+        (config.functionalityBatchSize < 1 || config.functionalityBatchSize > 100)) {
+        errors.push("functionalityBatchSize must be between 1 and 100");
+    }
+    if (config.securityBatchSize !== undefined &&
+        (config.securityBatchSize < 1 || config.securityBatchSize > 100)) {
+        errors.push("securityBatchSize must be between 1 and 100");
+    }
+    if (config.testTimeoutMs !== undefined &&
+        (config.testTimeoutMs < 100 || config.testTimeoutMs > 300000)) {
+        errors.push("testTimeoutMs must be between 100 and 300000");
+    }
+    if (config.securityTestTimeoutMs !== undefined &&
+        (config.securityTestTimeoutMs < 100 ||
+            config.securityTestTimeoutMs > 300000)) {
+        errors.push("securityTestTimeoutMs must be between 100 and 300000");
+    }
+    if (config.queueWarningThreshold !== undefined &&
+        (config.queueWarningThreshold < 100 ||
+            config.queueWarningThreshold > 1000000)) {
+        errors.push("queueWarningThreshold must be between 100 and 1000000");
+    }
+    if (config.eventEmitterMaxListeners !== undefined &&
+        (config.eventEmitterMaxListeners < 10 ||
+            config.eventEmitterMaxListeners > 1000)) {
+        errors.push("eventEmitterMaxListeners must be between 10 and 1000");
+    }
+    return errors;
+}
+/**
+ * Merge a partial config with defaults.
+ * User-provided values override defaults.
+ *
+ * @param partial - Partial config to merge
+ * @returns Complete config with defaults applied
+ */
+export function mergeWithDefaults(partial) {
+    return {
+        batchFlushIntervalMs: partial.batchFlushIntervalMs ??
+            DEFAULT_PERFORMANCE_CONFIG.batchFlushIntervalMs,
+        functionalityBatchSize: partial.functionalityBatchSize ??
+            DEFAULT_PERFORMANCE_CONFIG.functionalityBatchSize,
+        securityBatchSize: partial.securityBatchSize ?? DEFAULT_PERFORMANCE_CONFIG.securityBatchSize,
+        testTimeoutMs: partial.testTimeoutMs ?? DEFAULT_PERFORMANCE_CONFIG.testTimeoutMs,
+        securityTestTimeoutMs: partial.securityTestTimeoutMs ??
+            DEFAULT_PERFORMANCE_CONFIG.securityTestTimeoutMs,
+        queueWarningThreshold: partial.queueWarningThreshold ??
+            DEFAULT_PERFORMANCE_CONFIG.queueWarningThreshold,
+        eventEmitterMaxListeners: partial.eventEmitterMaxListeners ??
+            DEFAULT_PERFORMANCE_CONFIG.eventEmitterMaxListeners,
+    };
+}
+/**
+ * Load performance configuration from a JSON file.
+ * Partial configs are validated and merged with defaults.
+ *
+ * @param configPath - Path to JSON configuration file
+ * @param logger - Optional logger for diagnostic output
+ * @returns Complete configuration with defaults applied
+ * @throws Error if config file has validation errors
+ */
+export function loadPerformanceConfig(configPath, logger) {
+    if (!configPath) {
+        return { ...DEFAULT_PERFORMANCE_CONFIG };
+    }
+    try {
+        const configContent = fs.readFileSync(configPath, "utf-8");
+        const userConfig = JSON.parse(configContent);
+        // Validate the config
+        const errors = validatePerformanceConfig(userConfig);
+        if (errors.length > 0) {
+            const errorMsg = `Invalid performance config: ${errors.join(", ")}`;
+            logger?.error(errorMsg, { configPath, errors });
+            throw new Error(errorMsg);
+        }
+        logger?.debug("Loaded performance config", { configPath, userConfig });
+        return mergeWithDefaults(userConfig);
+    }
+    catch (error) {
+        if (error instanceof SyntaxError) {
+            logger?.error("Invalid JSON in performance config file", {
+                configPath,
+                error: error.message,
+            });
+            throw new Error(`Invalid JSON in performance config: ${configPath}`);
+        }
+        // Re-throw validation errors
+        if (error instanceof Error && error.message.includes("Invalid")) {
+            throw error;
+        }
+        // File read errors - use defaults with warning
+        logger?.warn("Could not load performance config, using defaults", {
+            configPath,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return { ...DEFAULT_PERFORMANCE_CONFIG };
+    }
+}