getdoorman 1.0.0

package/src/rules/performance/index.js

@@ -0,0 +1,3455 @@
+const JS_EXTENSIONS = ['.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs'];
+function isSourceFile(f) { return JS_EXTENSIONS.some(ext => f.endsWith(ext)); }
+
+const rules = [
+  // PERF-001: SELECT * usage
+  {
+    id: 'PERF-001',
+    category: 'performance',
+    severity: 'medium',
+    confidence: 'likely',
+    title: 'SELECT * in database query',
+    check({ files }) {
+      const findings = [];
+      for (const [filepath, content] of files) {
+        if (!isSourceFile(filepath)) continue;
+        const lines = content.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/SELECT\s+\*/i) && !lines[i].match(/COUNT\s*\(\s*\*/i)) {
+            findings.push({
+              ruleId: 'PERF-001', category: 'performance', severity: 'medium',
+              title: 'SELECT * fetches all columns — specify only needed columns',
+              file: filepath, line: i + 1, fix: null,
+            });
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-002: No pagination on list endpoints
+  {
+    id: 'PERF-002',
+    category: 'performance',
+    severity: 'high',
+    confidence: 'likely',
+    title: 'No Pagination on API Endpoint',
+    check({ files }) {
+      const findings = [];
+      for (const [filepath, content] of files) {
+        if (!isSourceFile(filepath)) continue;
+        // Look for findMany/find/select without take/limit
+        if (content.match(/\.findMany\s*\(\s*\)/) ||
+            content.match(/\.find\s*\(\s*\{\s*\}\s*\)/) ||
+            content.match(/\.find\s*\(\s*\)/)) {
+          if (!content.includes('take:') && !content.includes('limit') && !content.includes('pagination')) {
+            findings.push({
+              ruleId: 'PERF-002', category: 'performance', severity: 'high',
+              title: 'Database query returns all rows without pagination',
+              description: 'Add pagination (limit/offset or cursor-based) to prevent loading entire tables.',
+              file: filepath, fix: null,
+            });
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-003: Synchronous file operations
+  {
+    id: 'PERF-003',
+    category: 'performance',
+    severity: 'medium',
+    confidence: 'likely',
+    title: 'Synchronous File I/O',
+    check({ files }) {
+      const findings = [];
+      const syncOps = ['readFileSync', 'writeFileSync', 'existsSync', 'mkdirSync', 'readdirSync', 'statSync'];
+      for (const [filepath, content] of files) {
+        if (!isSourceFile(filepath)) continue;
+        // Skip config files and CLI tools where sync is fine
+        if (filepath.includes('config') || filepath.includes('bin/') || filepath.includes('scripts/')) continue;
+
+        const lines = content.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          for (const op of syncOps) {
+            if (lines[i].includes(op) && !lines[i].trim().startsWith('//')) {
+              findings.push({
+                ruleId: 'PERF-003', category: 'performance', severity: 'medium',
+                title: `Sync file operation (${op}) blocks the event loop`,
+                description: 'Use async alternatives (readFile, writeFile, etc.) in request handlers.',
+                file: filepath, line: i + 1, fix: null,
+              });
+              break;
+            }
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-004: No caching for API responses
+  {
+    id: 'PERF-004',
+    category: 'performance',
+    severity: 'medium',
+    confidence: 'likely',
+    title: 'No Response Caching',
+    check({ files, stack }) {
+      const findings = [];
+      if (stack.runtime !== 'node') return findings;
+
+      const hasCaching = Object.keys({ ...stack.dependencies, ...stack.devDependencies }).some(dep =>
+        ['redis', 'ioredis', 'node-cache', 'lru-cache', 'keyv', '@upstash/redis'].includes(dep)
+      );
+
+      if (!hasCaching) {
+        const hasApiRoutes = [...files.keys()].some(f => f.includes('/api/') || f.includes('routes'));
+        if (hasApiRoutes) {
+          findings.push({
+            ruleId: 'PERF-004', category: 'performance', severity: 'medium',
+            title: 'No caching library detected for API responses',
+            description: 'Add caching (Redis, LRU cache, etc.) to reduce database load and improve response times.',
+            fix: null,
+          });
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-005: Large bundle / no code splitting
+  {
+    id: 'PERF-005',
+    category: 'performance',
+    severity: 'medium',
+    confidence: 'likely',
+    title: 'No Code Splitting / Lazy Loading',
+    check({ files, stack }) {
+      const findings = [];
+      if (!['nextjs', 'react', 'vue', 'sveltekit'].includes(stack.framework)) return findings;
+
+      const hasLazyLoad = [...files.values()].some(content =>
+        content.includes('React.lazy') ||
+        content.includes('dynamic(') ||
+        content.includes('defineAsyncComponent') ||
+        content.includes('import(')
+      );
+
+      if (!hasLazyLoad) {
+        findings.push({
+          ruleId: 'PERF-005', category: 'performance', severity: 'medium',
+          title: 'No lazy loading / code splitting detected',
+          description: 'Large apps should split code into chunks. Use dynamic imports or React.lazy() for routes.',
+          fix: null,
+        });
+      }
+      return findings;
+    },
+  },
+
+  // PERF-006: No image optimization
+  {
+    id: 'PERF-006',
+    category: 'performance',
+    severity: 'low',
+    confidence: 'suggestion',
+    title: 'Unoptimized Images',
+    check({ files, stack }) {
+      const findings = [];
+      if (stack.framework !== 'nextjs' && stack.framework !== 'react') return findings;
+
+      let usesImgTag = false;
+      let usesNextImage = false;
+
+      for (const [filepath, content] of files) {
+        if (!filepath.match(/\.(jsx|tsx)$/)) continue;
+        if (content.includes('<img ')) usesImgTag = true;
+        if (content.includes('next/image') || content.includes('<Image')) usesNextImage = true;
+      }
+
+      if (usesImgTag && !usesNextImage && stack.framework === 'nextjs') {
+        findings.push({
+          ruleId: 'PERF-006', category: 'performance', severity: 'low',
+          title: 'Using <img> instead of Next.js <Image> component',
+          description: 'The Next.js Image component auto-optimizes images (WebP, lazy loading, sizing).',
+          fix: null,
+        });
+      }
+      return findings;
+    },
+  },
+
+  // PERF-007: No database connection pooling
+  {
+    id: 'PERF-007',
+    category: 'performance',
+    severity: 'high',
+    confidence: 'likely',
+    title: 'No Database Connection Pooling',
+    check({ files, stack }) {
+      const findings = [];
+      if (stack.orm === 'prisma') return findings; // Prisma handles pooling
+
+      for (const [filepath, content] of files) {
+        if (!isSourceFile(filepath)) continue;
+        // Creating new connections per request
+        if (content.match(/new\s+(?:Client|Pool|Connection)\s*\(/) &&
+            (filepath.includes('api/') || filepath.includes('route') || filepath.includes('handler'))) {
+          findings.push({
+            ruleId: 'PERF-007', category: 'performance', severity: 'high',
+            title: 'Database connection created per-request instead of using a pool',
+            description: 'Create a shared connection pool instead of new connections per request.',
+            file: filepath, fix: null,
+          });
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-LOAD-001: No load testing framework detected
+  {
+    id: 'PERF-LOAD-001',
+    category: 'performance',
+    severity: 'medium',
+    confidence: 'likely',
+    title: 'No Load Testing Framework Detected',
+    check({ files, stack }) {
+      const findings = [];
+      const allDeps = { ...stack.dependencies, ...stack.devDependencies };
+      const loadTestLibs = ['k6', 'artillery', 'locust', 'gatling', 'jmeter', 'autocannon', 'loadtest', 'vegeta', 'wrk'];
+      const hasLoadTestDep = loadTestLibs.some(lib => lib in allDeps);
+
+      if (!hasLoadTestDep) {
+        const loadTestConfigs = ['k6.js', 'k6.config.js', 'artillery.yml', 'artillery.yaml', 'artillery.json', 'locustfile.py'];
+        const hasLoadTestConfig = [...files.keys()].some(f => loadTestConfigs.some(cfg => f.endsWith(cfg)));
+
+        if (!hasLoadTestConfig) {
+          // Only flag if the project has a server
+          const hasServer = [...files.values()].some(content =>
+            content.includes('.listen(') || content.includes('createServer')
+          );
+          if (hasServer) {
+            findings.push({
+              ruleId: 'PERF-LOAD-001', category: 'performance', severity: 'medium',
+              title: 'No load testing framework detected',
+              description: 'Add a load testing tool (k6, artillery, autocannon, etc.) to validate performance under realistic traffic.',
+              fix: null,
+            });
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-LOAD-002: No stress test scripts
+  {
+    id: 'PERF-LOAD-002',
+    category: 'performance',
+    severity: 'medium',
+    confidence: 'likely',
+    title: 'No Stress Test Scripts',
+    check({ files, stack }) {
+      const findings = [];
+      const scripts = stack.scripts || {};
+      const stressKeywords = ['load', 'stress', 'perf', 'benchmark'];
+      const hasStressScript = Object.keys(scripts).some(name =>
+        stressKeywords.some(kw => name.toLowerCase().includes(kw))
+      );
+
+      if (!hasStressScript) {
+        const hasStressFile = [...files.keys()].some(f => {
+          const lower = f.toLowerCase();
+          return stressKeywords.some(kw =>
+            (lower.includes('test') || lower.includes('spec')) &&
+            (lower.includes(kw) || lower.includes('performance'))
+          );
+        });
+
+        if (!hasStressFile) {
+          const hasServer = [...files.values()].some(content =>
+            content.includes('.listen(') || content.includes('createServer')
+          );
+          if (hasServer) {
+            findings.push({
+              ruleId: 'PERF-LOAD-002', category: 'performance', severity: 'medium',
+              title: 'No stress/load test scripts found',
+              description: 'Add npm scripts (e.g. "test:load", "test:stress") and test files for load and performance testing.',
+              fix: null,
+            });
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-LOAD-003: No connection pool limits
+  {
+    id: 'PERF-LOAD-003',
+    category: 'performance',
+    severity: 'high',
+    confidence: 'likely',
+    title: 'No Connection Pool Limits',
+    check({ files }) {
+      const findings = [];
+      for (const [filepath, content] of files) {
+        if (!isSourceFile(filepath)) continue;
+        const lines = content.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          const line = lines[i];
+          if (line.match(/createPool\s*\(/) || line.match(/createConnection\s*\(/)) {
+            // Scan a window around the call for pool limit settings
+            const windowStart = Math.max(0, i - 2);
+            const windowEnd = Math.min(lines.length - 1, i + 15);
+            const window = lines.slice(windowStart, windowEnd + 1).join('\n');
+            const hasLimits = /\b(max|connectionLimit|pool\.max|maxConnections|poolSize)\b/.test(window);
+            if (!hasLimits) {
+              findings.push({
+                ruleId: 'PERF-LOAD-003', category: 'performance', severity: 'high',
+                title: 'Database pool/connection created without max connection limits',
+                description: 'Set max/connectionLimit/pool.max to prevent unbounded connections under load.',
+                file: filepath, line: i + 1, fix: null,
+              });
+            }
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-LOAD-004: No request timeout configured
+  {
+    id: 'PERF-LOAD-004',
+    category: 'performance',
+    severity: 'high',
+    confidence: 'likely',
+    title: 'No Request Timeout Configured',
+    check({ files }) {
+      const findings = [];
+      for (const [filepath, content] of files) {
+        if (!isSourceFile(filepath)) continue;
+        if (content.includes('.listen(') || content.includes('createServer')) {
+          const hasTimeout = content.includes('server.timeout') ||
+            content.includes('requestTimeout') ||
+            content.includes('timeout(') ||
+            content.includes('connect-timeout') ||
+            content.includes('express-timeout') ||
+            content.includes('setTimeout(') && content.includes('server');
+          if (!hasTimeout) {
+            findings.push({
+              ruleId: 'PERF-LOAD-004', category: 'performance', severity: 'high',
+              title: 'Server has no request timeout configured',
+              description: 'Set server.timeout or use timeout middleware to prevent slow requests from exhausting resources.',
+              file: filepath, fix: null,
+            });
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-LOAD-005: No rate limiting under load
+  {
+    id: 'PERF-LOAD-005',
+    category: 'performance',
+    severity: 'medium',
+    confidence: 'likely',
+    title: 'No Rate Limiting Under Load',
+    check({ files, stack }) {
+      const findings = [];
+      const allDeps = { ...stack.dependencies, ...stack.devDependencies };
+      const rateLimitLibs = [
+        'express-rate-limit', 'rate-limiter-flexible', 'koa-ratelimit',
+        'fastify-rate-limit', '@fastify/rate-limit', 'express-slow-down',
+        'bottleneck', 'p-throttle', 'limiter',
+      ];
+      const hasRateLimitDep = rateLimitLibs.some(lib => lib in allDeps);
+
+      if (!hasRateLimitDep) {
+        const hasRateLimitCode = [...files.values()].some(content =>
+          content.includes('rateLimit') || content.includes('rate-limit') ||
+          content.includes('rateLimiter') || content.includes('throttle')
+        );
+        if (!hasRateLimitCode) {
+          const hasApiRoutes = [...files.entries()].some(([f, c]) =>
+            (f.includes('/api/') || f.includes('route')) && isSourceFile(f)
+          );
+          if (hasApiRoutes) {
+            findings.push({
+              ruleId: 'PERF-LOAD-005', category: 'performance', severity: 'medium',
+              title: 'No rate limiting detected on API routes',
+              description: 'Add rate limiting (express-rate-limit, rate-limiter-flexible, etc.) to protect against abuse and overload.',
+              fix: null,
+            });
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-LOAD-006: No graceful shutdown
+  {
+    id: 'PERF-LOAD-006',
+    category: 'performance',
+    severity: 'high',
+    confidence: 'likely',
+    title: 'No Graceful Shutdown',
+    check({ files }) {
+      const findings = [];
+      for (const [filepath, content] of files) {
+        if (!isSourceFile(filepath)) continue;
+        if (content.includes('.listen(') || content.includes('createServer')) {
+          const hasGracefulShutdown =
+            content.includes("'SIGTERM'") || content.includes('"SIGTERM"') ||
+            content.includes("'SIGINT'") || content.includes('"SIGINT"') ||
+            content.includes('graceful') || content.includes('shutdown');
+          if (!hasGracefulShutdown) {
+            findings.push({
+              ruleId: 'PERF-LOAD-006', category: 'performance', severity: 'high',
+              title: 'Server has no graceful shutdown handling',
+              description: 'Handle SIGTERM/SIGINT to close connections gracefully and avoid dropped requests during deploys.',
+              file: filepath, fix: null,
+            });
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-LOAD-007: No health check endpoint
+  {
+    id: 'PERF-LOAD-007',
+    category: 'performance',
+    severity: 'medium',
+    confidence: 'likely',
+    title: 'No Health Check Endpoint',
+    check({ files }) {
+      const findings = [];
+      const hasHealthEndpoint = [...files.values()].some(content =>
+        content.includes('/health') || content.includes('/healthz') ||
+        content.includes('/readiness') || content.includes('/liveness') ||
+        content.includes('/ready') || content.includes('/alive')
+      );
+
+      if (!hasHealthEndpoint) {
+        const hasServer = [...files.entries()].some(([f, c]) =>
+          isSourceFile(f) && (c.includes('.listen(') || c.includes('createServer'))
+        );
+        if (hasServer) {
+          findings.push({
+            ruleId: 'PERF-LOAD-007', category: 'performance', severity: 'medium',
+            title: 'No health check endpoint detected',
+            description: 'Add /health or /healthz endpoint for load balancer and orchestrator readiness checks.',
+            fix: null,
+          });
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-LOAD-008: Unbounded concurrent connections
+  {
+    id: 'PERF-LOAD-008',
+    category: 'performance',
+    severity: 'high',
+    confidence: 'likely',
+    title: 'Unbounded Concurrent Connections',
+    check({ files }) {
+      const findings = [];
+      for (const [filepath, content] of files) {
+        if (!isSourceFile(filepath)) continue;
+        if (content.includes('.listen(') || content.includes('createServer')) {
+          const hasBounds = content.includes('maxConnections') ||
+            content.includes('maxHeadersCount') ||
+            content.includes('maxRequestsPerSocket') ||
+            content.includes('maxSockets');
+          if (!hasBounds) {
+            findings.push({
+              ruleId: 'PERF-LOAD-008', category: 'performance', severity: 'high',
+              title: 'Server allows unbounded concurrent connections',
+              description: 'Set server.maxConnections or maxHeadersCount to prevent resource exhaustion under heavy load.',
+              file: filepath, fix: null,
+            });
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-LOAD-009: No memory leak detection
+  {
+    id: 'PERF-LOAD-009',
+    category: 'performance',
+    severity: 'medium',
+    confidence: 'definite',
+    title: 'No Memory Leak Detection',
+    check({ files, stack }) {
+      const findings = [];
+      const allDeps = { ...stack.dependencies, ...stack.devDependencies };
+      const memLibs = ['heapdump', 'v8-profiler', 'clinic', 'memwatch', 'node-memwatch', '@airbnb/node-memwatch'];
+      const hasMemLib = memLibs.some(lib => lib in allDeps);
+
+      if (!hasMemLib) {
+        const hasMemMonitoring = [...files.values()].some(content =>
+          content.includes('--max-old-space-size') ||
+          content.includes('memoryUsage') ||
+          content.includes('heapdump') ||
+          content.includes('v8.getHeapStatistics') ||
+          content.includes('process.memoryUsage')
+        );
+        if (!hasMemMonitoring) {
+          const hasServer = [...files.values()].some(content =>
+            content.includes('.listen(') || content.includes('createServer')
+          );
+          if (hasServer) {
+            findings.push({
+              ruleId: 'PERF-LOAD-009', category: 'performance', severity: 'medium',
+              title: 'No memory leak detection or monitoring found',
+              description: 'Add --max-old-space-size, process.memoryUsage() monitoring, or heapdump for memory leak detection.',
+              fix: null,
+            });
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-LOAD-010: No horizontal scaling support
+  {
+    id: 'PERF-LOAD-010',
+    category: 'performance',
+    severity: 'medium',
+    confidence: 'likely',
+    title: 'No Horizontal Scaling Support',
+    check({ files, stack }) {
+      const findings = [];
+      const allDeps = { ...stack.dependencies, ...stack.devDependencies };
+
+      // Check for in-memory session stores without external backing
+      const hasExternalSessionStore = ['connect-redis', 'connect-mongo', 'connect-pg-simple',
+        'express-mysql-session', '@fastify/session', 'ioredis', 'redis'].some(lib => lib in allDeps);
+
+      const usesInMemorySession = [...files.values()].some(content =>
+        (content.includes('express-session') || content.includes('session(')) &&
+        !content.includes('RedisStore') && !content.includes('MongoStore') &&
+        !content.includes('PgStore') && !content.includes('store:') && !content.includes('store :')
+      );
+
+      const usesLocalFs = [...files.values()].some(content =>
+        (content.includes('multer') || content.includes('upload')) &&
+        content.includes('diskStorage') &&
+        !content.includes('s3') && !content.includes('S3') &&
+        !content.includes('gcs') && !content.includes('cloudinary') &&
+        !content.includes('azure')
+      );
+
+      if ((usesInMemorySession && !hasExternalSessionStore) || usesLocalFs) {
+        findings.push({
+          ruleId: 'PERF-LOAD-010', category: 'performance', severity: 'medium',
+          title: 'Application uses in-memory state or local filesystem that prevents horizontal scaling',
+          description: 'Use Redis or an external store for sessions, and cloud storage (S3, GCS) for file uploads to enable horizontal scaling.',
+          fix: null,
+        });
+      }
+      return findings;
+    },
+  },
+
+  // PERF-DB-001: N+1 query pattern
+  {
+    id: 'PERF-DB-001',
+    category: 'performance',
+    severity: 'high',
+    confidence: 'definite',
+    title: 'N+1 Query Pattern',
+    check({ files }) {
+      const findings = [];
+      for (const [filepath, content] of files) {
+        if (!isSourceFile(filepath)) continue;
+        const lines = content.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/for\s*\(|\.forEach\s*\(|\.map\s*\(/)) {
+            const block = lines.slice(i, Math.min(i + 8, lines.length)).join('\n');
+            if (block.match(/await\s+\w+\.(findOne|findById|findUnique|find|get|fetch|query)\s*\(/)) {
+              findings.push({ ruleId: 'PERF-DB-001', category: 'performance', severity: 'high',
+                title: 'Possible N+1 query: database call inside a loop',
+                description: 'Each loop iteration triggers a separate DB query. Use findMany with IN, include/eager loading, or batch loading (DataLoader).',
+                file: filepath, line: i + 1, fix: null });
+            }
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-DB-002: LIKE with leading wildcard
+  {
+    id: 'PERF-DB-002',
+    category: 'performance',
+    severity: 'medium',
+    confidence: 'likely',
+    title: "LIKE '%...' Leading Wildcard Prevents Index Use",
+    check({ files }) {
+      const findings = [];
+      for (const [filepath, content] of files) {
+        if (!isSourceFile(filepath)) continue;
+        const lines = content.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/LIKE\s+['"`]%/i)) {
+            findings.push({ ruleId: 'PERF-DB-002', category: 'performance', severity: 'medium',
+              title: "LIKE '%...' leading wildcard causes full table scan",
+              description: 'Leading wildcards prevent index use. Consider full-text search (PostgreSQL tsvector, MySQL FULLTEXT) instead.',
+              file: filepath, line: i + 1, fix: null });
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-DB-003: ORDER BY RAND()
+  {
+    id: 'PERF-DB-003',
+    category: 'performance',
+    severity: 'high',
+    confidence: 'likely',
+    title: 'ORDER BY RAND() Full Table Scan',
+    check({ files }) {
+      const findings = [];
+      for (const [filepath, content] of files) {
+        if (!isSourceFile(filepath)) continue;
+        const lines = content.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/ORDER\s+BY\s+(?:RAND|RANDOM)\s*\(\)/i)) {
+            findings.push({ ruleId: 'PERF-DB-003', category: 'performance', severity: 'high',
+              title: 'ORDER BY RAND() requires full table scan and sort',
+              description: 'This is O(n log n) on every query. Use offset-based random selection or pre-computed random columns.',
+              file: filepath, line: i + 1, fix: null });
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-DB-004: SELECT without WHERE on large tables
+  {
+    id: 'PERF-DB-004',
+    category: 'performance',
+    severity: 'high',
+    confidence: 'likely',
+    title: 'Unbounded Table Scan',
+    check({ files }) {
+      const findings = [];
+      for (const [filepath, content] of files) {
+        if (!isSourceFile(filepath)) continue;
+        const lines = content.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/\bDELETE\s+FROM\b|\bUPDATE\s+\w+\s+SET\b/i)) {
+            if (!lines[i].match(/WHERE/i)) {
+              const nextLines = lines.slice(i, i + 3).join(' ');
+              if (!nextLines.match(/WHERE/i)) {
+                findings.push({ ruleId: 'PERF-DB-004', category: 'performance', severity: 'high',
+                  title: 'DELETE/UPDATE without WHERE clause — full table operation',
+                  description: 'This will affect every row. Add a WHERE clause to scope the operation.',
+                  file: filepath, line: i + 1, fix: null });
+              }
+            }
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-DB-005: Prisma findMany without pagination
+  {
+    id: 'PERF-DB-005',
+    category: 'performance',
+    severity: 'high',
+    confidence: 'likely',
+    title: 'ORM findMany Without Pagination',
+    check({ files }) {
+      const findings = [];
+      for (const [filepath, content] of files) {
+        if (!isSourceFile(filepath)) continue;
+        const lines = content.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/\.findMany\s*\(\s*\{/) || lines[i].match(/\.findMany\s*\(\s*\)/)) {
+            const block = lines.slice(i, Math.min(i + 10, lines.length)).join('\n');
+            if (!block.match(/\b(take|skip|limit|offset|pagination|page)\b/)) {
+              findings.push({ ruleId: 'PERF-DB-005', category: 'performance', severity: 'high',
+                title: 'findMany without take/skip — returns all rows',
+                description: 'Add take/skip for pagination to prevent loading entire tables into memory.',
+                file: filepath, line: i + 1, fix: null });
+            }
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-DB-006: Mongoose find without limit
+  {
+    id: 'PERF-DB-006',
+    category: 'performance',
+    severity: 'medium',
+    confidence: 'likely',
+    title: 'Mongoose Query Without Limit',
+    check({ files }) {
+      const findings = [];
+      for (const [filepath, content] of files) {
+        if (!isSourceFile(filepath)) continue;
+        const lines = content.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/\.\s*find\s*\(\s*\{/) && !lines[i].match(/findOne|findById/)) {
+            const block = lines.slice(i, Math.min(i + 5, lines.length)).join('\n');
+            if (!block.match(/\.limit\s*\(/) && !block.match(/\.skip\s*\(/)) {
+              findings.push({ ruleId: 'PERF-DB-006', category: 'performance', severity: 'medium',
+                title: 'Mongoose .find() without .limit() — unbounded result set',
+                description: 'Chain .limit(n) to prevent loading all documents. Use cursor-based pagination for large collections.',
+                file: filepath, line: i + 1, fix: null });
+            }
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-DB-007: No database query timeout
+  {
+    id: 'PERF-DB-007',
+    category: 'performance',
+    severity: 'high',
+    confidence: 'likely',
+    title: 'No Database Query Timeout',
+    check({ files, stack }) {
+      const findings = [];
+      if (!stack.database) return findings;
+      const hasQueryTimeout = [...files.values()].some(c =>
+        c.includes('statement_timeout') || c.includes('query_timeout') ||
+        c.includes('queryTimeout') || c.includes('connectionTimeoutMillis') ||
+        c.includes('connectTimeout') || c.includes('lock_timeout')
+      );
+      if (!hasQueryTimeout) {
+        findings.push({ ruleId: 'PERF-DB-007', category: 'performance', severity: 'high',
+          title: 'No database query timeout configured',
+          description: 'Long-running queries block connections and can exhaust the pool. Set statement_timeout (PostgreSQL) or queryTimeout (MySQL/MongoDB).',
+          fix: null });
+      }
+      return findings;
+    },
+  },
+
+  // PERF-DB-008: Selecting all fields with Prisma
+  {
+    id: 'PERF-DB-008',
+    category: 'performance',
+    severity: 'low',
+    confidence: 'suggestion',
+    title: 'ORM Query Without Field Selection',
+    check({ files }) {
+      const findings = [];
+      for (const [filepath, content] of files) {
+        if (!isSourceFile(filepath)) continue;
+        const lines = content.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/\.findFirst\s*\(\s*\{/) || lines[i].match(/\.findUnique\s*\(\s*\{/)) {
+            const block = lines.slice(i, Math.min(i + 10, lines.length)).join('\n');
+            if (!block.match(/\bselect\s*:/) && !block.match(/\binclude\s*:/)) {
+              findings.push({ ruleId: 'PERF-DB-008', category: 'performance', severity: 'low',
+                title: 'Prisma query without select — fetching all fields',
+                description: 'Use select: { field1: true } to fetch only the columns you need, reducing data transfer.',
+                file: filepath, line: i + 1, fix: null });
+            }
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-CACHE-001: No Cache-Control headers
+  {
+    id: 'PERF-CACHE-001',
+    category: 'performance',
+    severity: 'medium',
+    confidence: 'likely',
+    title: 'No Cache-Control Headers on API Responses',
+    check({ files }) {
+      const findings = [];
+      for (const [filepath, content] of files) {
+        if (!isSourceFile(filepath)) continue;
+        if (!filepath.includes('api/') && !filepath.includes('route')) continue;
+        if (content.includes('res.json(') || content.includes('res.send(')) {
+          if (!content.includes('Cache-Control') && !content.includes('cache-control') &&
+              !content.includes('setHeader') && !content.includes('cache')) {
+            findings.push({ ruleId: 'PERF-CACHE-001', category: 'performance', severity: 'medium',
+              title: 'API route sends responses without Cache-Control headers',
+              description: 'Add Cache-Control headers to allow browsers and CDNs to cache responses. Use max-age for public data, no-store for private.',
+              file: filepath, fix: null });
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-CACHE-002: No CDN for static assets
+  {
+    id: 'PERF-CACHE-002',
+    category: 'performance',
+    severity: 'medium',
+    confidence: 'likely',
+    title: 'No CDN for Static Assets',
+    check({ files, stack }) {
+      const findings = [];
+      const hasCDN = [...files.values()].some(c =>
+        c.includes('cloudfront') || c.includes('cloudflare') || c.includes('fastly') ||
+        c.includes('cdn.') || c.includes('NEXT_PUBLIC_CDN') || c.includes('assetPrefix') ||
+        c.includes('vercel') || c.includes('netlify')
+      );
+      if (!hasCDN) {
+        const hasStaticAssets = [...files.keys()].some(f =>
+          f.includes('/public/') || f.includes('/static/') || f.includes('/assets/')
+        );
+        if (hasStaticAssets) {
+          findings.push({ ruleId: 'PERF-CACHE-002', category: 'performance', severity: 'medium',
+            title: 'No CDN detected for static assets',
+            description: 'Serve static assets through a CDN (Cloudflare, CloudFront, Vercel, Netlify) to reduce latency and origin load.',
+            fix: null });
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-CACHE-003: Memoization missing for expensive function
+  {
+    id: 'PERF-CACHE-003',
+    category: 'performance',
+    severity: 'medium',
+    confidence: 'likely',
+    title: 'Expensive Computation Not Memoized',
+    check({ files }) {
+      const findings = [];
+      for (const [filepath, content] of files) {
+        if (!isSourceFile(filepath)) continue;
+        const lines = content.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/for\s*\(.*\bof\b|\bforEach\b|\bmap\b/)) {
+            const block = lines.slice(i, Math.min(i + 5, lines.length)).join('\n');
+            if (block.match(/JSON\.parse|JSON\.stringify|bcrypt|crypto\.|Buffer\.from/)) {
+              findings.push({ ruleId: 'PERF-CACHE-003', category: 'performance', severity: 'medium',
+                title: 'Expensive operation (JSON/crypto/Buffer) called in loop without caching',
+                description: 'Cache the result outside the loop or use memoization to avoid redundant expensive operations.',
+                file: filepath, line: i + 1, fix: null });
+            }
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-CACHE-004: Infinite cache TTL
+  {
+    id: 'PERF-CACHE-004',
+    category: 'performance',
+    severity: 'low',
+    confidence: 'suggestion',
+    title: 'Cache Without TTL',
+    check({ files }) {
+      const findings = [];
+      for (const [filepath, content] of files) {
+        if (!isSourceFile(filepath)) continue;
+        if (content.includes('redis') || content.includes('cache')) {
+          if (content.match(/\.set\s*\(/) && !content.match(/\bEX\b|\bPX\b|\bttl\b|\bexpire\b|\bTTL\b/i)) {
+            findings.push({ ruleId: 'PERF-CACHE-004', category: 'performance', severity: 'low',
+              title: 'Cache set without TTL/expiry — data may never be invalidated',
+              description: 'Always set a TTL on cached data to prevent stale data and unbounded memory growth.',
+              file: filepath, fix: null });
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-FE-001: No gzip/brotli compression middleware
+  {
+    id: 'PERF-FE-001',
+    category: 'performance',
+    severity: 'high',
+    confidence: 'likely',
+    title: 'No Response Compression Middleware',
+    check({ files, stack }) {
+      const findings = [];
+      if (!['express', 'fastify', 'koa', 'hono'].includes(stack.framework)) return findings;
+      const allDeps = { ...stack.dependencies, ...stack.devDependencies };
+      const hasCompression = 'compression' in allDeps || '@fastify/compress' in allDeps ||
+        'koa-compress' in allDeps || 'shrink-ray' in allDeps;
+      const hasCompressCode = [...files.values()].some(c =>
+        c.includes('compression') || c.includes('compress') || c.includes('brotli')
+      );
+      if (!hasCompression && !hasCompressCode) {
+        findings.push({ ruleId: 'PERF-FE-001', category: 'performance', severity: 'high',
+          title: 'No gzip/brotli compression middleware detected',
+          description: 'Add compression middleware to reduce response sizes by 60-80%. Install the `compression` package for Express.',
+          fix: null });
+      }
+      return findings;
+    },
+  },
+
+  // PERF-FE-002: Importing all of lodash
+  {
+    id: 'PERF-FE-002',
+    category: 'performance',
+    severity: 'medium',
+    confidence: 'likely',
+    title: 'Full Lodash Import',
+    check({ files }) {
+      const findings = [];
+      for (const [filepath, content] of files) {
+        if (!isSourceFile(filepath)) continue;
+        const lines = content.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/(?:import|require)\s*(?:\*\s+as\s+_|_\s*=\s*require)\s*(?:from\s*)?['"]lodash['"]/)) {
+            findings.push({ ruleId: 'PERF-FE-002', category: 'performance', severity: 'medium',
+              title: 'Importing entire lodash adds ~70KB to bundle',
+              description: "Import individual functions: import debounce from 'lodash/debounce' or use lodash-es for tree shaking.",
+              file: filepath, line: i + 1, fix: null });
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-FE-003: No debounce on search input
+  {
+    id: 'PERF-FE-003',
+    category: 'performance',
+    severity: 'medium',
+    confidence: 'likely',
+    title: 'Missing Debounce on Input Handler',
+    check({ files }) {
+      const findings = [];
+      for (const [filepath, content] of files) {
+        if (!filepath.match(/\.(jsx|tsx)$/)) continue;
+        if (content.match(/onChange\s*=|onInput\s*=/) && content.match(/fetch\s*\(|axios\.|api\./)) {
+          if (!content.includes('debounce') && !content.includes('useDebounce')) {
+            findings.push({ ruleId: 'PERF-FE-003', category: 'performance', severity: 'medium',
+              title: 'API call on input change without debounce',
+              description: 'Without debouncing, every keystroke fires an API call. Use debounce(fn, 300) to limit calls.',
+              file: filepath, fix: null });
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-FE-004: No virtual scrolling for long lists
+  {
+    id: 'PERF-FE-004',
+    category: 'performance',
+    severity: 'medium',
+    confidence: 'likely',
+    title: 'No Virtual Scrolling for Large Lists',
+    check({ files, stack }) {
+      const findings = [];
+      if (!['react', 'nextjs', 'vue'].includes(stack.framework)) return findings;
+      const allDeps = { ...stack.dependencies, ...stack.devDependencies };
+      const hasVirtual = 'react-window' in allDeps || 'react-virtual' in allDeps ||
+        'react-virtualized' in allDeps || '@tanstack/react-virtual' in allDeps ||
+        'vue-virtual-scroller' in allDeps;
+      if (!hasVirtual) {
+        const hasLongList = [...files.values()].some(c =>
+          c.match(/\.map\s*\(.*=>\s*(?:<|\()/s) && (c.includes('items') || c.includes('list') || c.includes('rows'))
+        );
+        if (hasLongList) {
+          findings.push({ ruleId: 'PERF-FE-004', category: 'performance', severity: 'medium',
+            title: 'No virtual scrolling library detected — long lists will render all DOM nodes',
+            description: 'Use react-window or @tanstack/react-virtual for lists that may exceed 100 items.',
+            fix: null });
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-FE-005: Render-blocking scripts
+  {
+    id: 'PERF-FE-005',
+    category: 'performance',
+    severity: 'medium',
+    confidence: 'likely',
+    title: 'Render-Blocking Scripts',
+    check({ files }) {
+      const findings = [];
+      for (const [filepath, content] of files) {
+        if (!filepath.match(/\.(html|jsx|tsx)$/)) continue;
+        const lines = content.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/<script\s+src=/i) && !lines[i].match(/async|defer/i)) {
+            findings.push({ ruleId: 'PERF-FE-005', category: 'performance', severity: 'medium',
+              title: '<script src> without async or defer blocks page rendering',
+              description: 'Add defer (for non-critical scripts) or async to prevent blocking HTML parsing.',
+              file: filepath, line: i + 1, fix: null });
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-API-001: Sequential awaits that could be parallel
+  {
+    id: 'PERF-API-001',
+    category: 'performance',
+    severity: 'medium',
+    confidence: 'likely',
+    title: 'Sequential Awaits Should Be Parallel',
+    check({ files }) {
+      const findings = [];
+      for (const [filepath, content] of files) {
+        if (!isSourceFile(filepath)) continue;
+        const lines = content.split('\n');
+        for (let i = 0; i < lines.length - 1; i++) {
+          if (lines[i].match(/^\s*(?:const|let)\s+\w+\s*=\s*await\s+/) &&
+              lines[i + 1].match(/^\s*(?:const|let)\s+\w+\s*=\s*await\s+/)) {
+            const a = lines[i].match(/await\s+(\w+)/)?.[1];
+            const b = lines[i + 1].match(/await\s+(\w+)/)?.[1];
+            if (a && b && a !== b) {
+              findings.push({ ruleId: 'PERF-API-001', category: 'performance', severity: 'medium',
+                title: 'Sequential awaits could be parallelized with Promise.all()',
+                description: `Replace sequential awaits with const [a, b] = await Promise.all([...]) to run independent operations in parallel.`,
+                file: filepath, line: i + 1, fix: null });
+            }
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-API-002: Large file loaded into memory
+  {
+    id: 'PERF-API-002',
+    category: 'performance',
+    severity: 'high',
+    confidence: 'likely',
+    title: 'File Read Into Memory Instead of Streamed',
+    check({ files }) {
+      const findings = [];
+      for (const [filepath, content] of files) {
+        if (!isSourceFile(filepath)) continue;
+        const lines = content.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/fs\.readFile(?:Sync)?\s*\(/) &&
+              (lines[i].includes('res.send') || content.substring(content.indexOf(lines[i])).match(/res\.(?:send|json|download)\s*\(/))) {
+            findings.push({ ruleId: 'PERF-API-002', category: 'performance', severity: 'high',
+              title: 'Reading entire file into memory before sending response',
+              description: 'Use fs.createReadStream() and pipe to response to avoid loading large files into memory.',
+              file: filepath, line: i + 1, fix: null });
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-API-003: Synchronous crypto in request handler
+  {
+    id: 'PERF-API-003',
+    category: 'performance',
+    severity: 'high',
+    confidence: 'likely',
+    title: 'Synchronous Crypto in Request Handler',
+    check({ files }) {
+      const findings = [];
+      for (const [filepath, content] of files) {
+        if (!isSourceFile(filepath)) continue;
+        if (!filepath.includes('api/') && !filepath.includes('route') && !filepath.includes('handler')) continue;
+        const lines = content.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/crypto\.(?:pbkdf2Sync|scryptSync|generateKeyPairSync|createCipheriv)/)) {
+            findings.push({ ruleId: 'PERF-API-003', category: 'performance', severity: 'high',
+              title: 'Synchronous crypto operation blocks event loop in request handler',
+              description: 'Use async variants (pbkdf2, scrypt) or run in a worker thread to avoid blocking.',
+              file: filepath, line: i + 1, fix: null });
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-API-004: No body size limit
+  {
+    id: 'PERF-API-004',
+    category: 'performance',
+    severity: 'high',
+    confidence: 'likely',
+    title: 'No Request Body Size Limit',
+    check({ files, stack }) {
+      const findings = [];
+      if (!['express', 'fastify', 'koa'].includes(stack.framework)) return findings;
+      const hasBodyLimit = [...files.values()].some(c =>
+        c.match(/limit\s*:\s*['"`]\d+[kmg]b?['"`]/i) ||
+        c.includes('bodyLimit') || c.includes('requestBodySize') ||
+        c.match(/express\.json\s*\(\s*\{[^}]*limit/)
+      );
+      if (!hasBodyLimit) {
+        findings.push({ ruleId: 'PERF-API-004', category: 'performance', severity: 'high',
+          title: 'No request body size limit configured',
+          description: 'Without a limit, large payloads can exhaust memory. Set limit in bodyParser/express.json({ limit: "1mb" }).',
+          fix: null });
+      }
+      return findings;
+    },
+  },
+
+  // PERF-MEM-001: Event listeners without cleanup
+  {
+    id: 'PERF-MEM-001',
+    category: 'performance',
+    severity: 'medium',
+    confidence: 'likely',
+    title: 'Event Listeners Added Without Cleanup',
+    check({ files }) {
+      const findings = [];
+      for (const [filepath, content] of files) {
+        if (!isSourceFile(filepath)) continue;
+        const addCount = (content.match(/addEventListener\s*\(/g) || []).length;
+        const removeCount = (content.match(/removeEventListener\s*\(/g) || []).length;
+        if (addCount > removeCount + 1) {
+          findings.push({ ruleId: 'PERF-MEM-001', category: 'performance', severity: 'medium',
+            title: `${addCount} addEventListener calls but only ${removeCount} removeEventListener — potential memory leak`,
+            description: 'Always pair addEventListener with removeEventListener in cleanup (useEffect return, componentWillUnmount, etc.).',
+            file: filepath, fix: null });
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-MEM-002: setInterval without clearInterval
+  {
+    id: 'PERF-MEM-002',
+    category: 'performance',
+    severity: 'medium',
+    confidence: 'likely',
+    title: 'setInterval Without clearInterval',
+    check({ files }) {
+      const findings = [];
+      for (const [filepath, content] of files) {
+        if (!isSourceFile(filepath)) continue;
+        const setCount = (content.match(/\bsetInterval\s*\(/g) || []).length;
+        const clearCount = (content.match(/\bclearInterval\s*\(/g) || []).length;
+        if (setCount > clearCount) {
+          findings.push({ ruleId: 'PERF-MEM-002', category: 'performance', severity: 'medium',
+            title: 'setInterval without corresponding clearInterval — memory/CPU leak',
+            description: 'Store the interval ID and call clearInterval() in cleanup to prevent accumulation.',
+            file: filepath, fix: null });
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-MEM-003: String concatenation in loop
+  {
+    id: 'PERF-MEM-003',
+    category: 'performance',
+    severity: 'low',
+    confidence: 'suggestion',
+    title: 'String Concatenation in Loop',
+    check({ files }) {
+      const findings = [];
+      for (const [filepath, content] of files) {
+        if (!isSourceFile(filepath)) continue;
+        const lines = content.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/for\s*\(|while\s*\(/)) {
+            const block = lines.slice(i, Math.min(i + 10, lines.length)).join('\n');
+            if (block.match(/\w+\s*\+=\s*['"`]|str\s*\+=|html\s*\+=|result\s*\+=/)) {
+              findings.push({ ruleId: 'PERF-MEM-003', category: 'performance', severity: 'low',
+                title: 'String concatenation in loop — use array.join() instead',
+                description: 'Each += creates a new string object. Collect parts in an array and use .join("") at the end.',
+                file: filepath, line: i + 1, fix: null });
+            }
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-MEM-004: Growing array in module scope
+  {
+    id: 'PERF-MEM-004',
+    category: 'performance',
+    severity: 'medium',
+    confidence: 'likely',
+    title: 'Unbounded Array in Module Scope',
+    check({ files }) {
+      const findings = [];
+      for (const [filepath, content] of files) {
+        if (!isSourceFile(filepath)) continue;
+        const lines = content.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/^(?:const|let|var)\s+\w+\s*=\s*\[\s*\]/)) {
+            const varName = lines[i].match(/(?:const|let|var)\s+(\w+)/)?.[1];
+            if (varName && content.includes(`${varName}.push(`) && !content.includes(`${varName}.splice`) && !content.includes(`${varName}.shift`)) {
+              findings.push({ ruleId: 'PERF-MEM-004', category: 'performance', severity: 'medium',
+                title: `Module-level array "${varName}" grows unbounded — memory leak risk`,
+                description: 'Arrays at module scope persist for the process lifetime. Add a max size or use a circular buffer.',
+                file: filepath, line: i + 1, fix: null });
+            }
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-ASYNC-001: CPU-intensive work in main thread
+  {
+    id: 'PERF-ASYNC-001',
+    category: 'performance',
+    severity: 'high',
+    confidence: 'likely',
+    title: 'CPU-Intensive Work in Main Thread',
+    check({ files, stack }) {
+      const findings = [];
+      if (stack.runtime !== 'node') return findings;
+      for (const [filepath, content] of files) {
+        if (!isSourceFile(filepath)) continue;
+        if (filepath.includes('worker')) continue;
+        const lines = content.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/JSON\.parse\s*\(|JSON\.stringify\s*\(/) &&
+              (filepath.includes('api/') || filepath.includes('route') || filepath.includes('handler'))) {
+            const line = lines[i];
+            if (line.match(/JSON\.(parse|stringify)\s*\(\s*(?:req\.|body|data|payload|response)/)) {
+              const nextLines = lines.slice(i, Math.min(i + 3, lines.length)).join('');
+              if (nextLines.match(/JSON\.(parse|stringify)\s*\(/) && !content.includes('worker_threads')) {
+                findings.push({ ruleId: 'PERF-ASYNC-001', category: 'performance', severity: 'high',
+                  title: 'Large JSON parsing in request handler blocks event loop',
+                  description: 'Move large JSON parsing/stringification to worker_threads to keep the event loop free.',
+                  file: filepath, line: i + 1, fix: null });
+                break;
+              }
+            }
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-ASYNC-002: Promise.all missing for parallel operations
+  {
+    id: 'PERF-ASYNC-002',
+    category: 'performance',
+    severity: 'medium',
+    confidence: 'likely',
+    title: 'Array.map with async Without Promise.all',
+    check({ files }) {
+      const findings = [];
+      for (const [filepath, content] of files) {
+        if (!isSourceFile(filepath)) continue;
+        const lines = content.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/\.map\s*\(\s*async/) && !lines[i].includes('Promise.all')) {
+            const context = lines.slice(Math.max(0, i - 2), i + 2).join('\n');
+            if (!context.includes('Promise.all') && !context.includes('Promise.allSettled')) {
+              findings.push({ ruleId: 'PERF-ASYNC-002', category: 'performance', severity: 'medium',
+                title: '.map(async ...) without Promise.all — promises not awaited',
+                description: 'Wrap with await Promise.all(items.map(async item => ...)) to actually await all operations.',
+                file: filepath, line: i + 1, fix: null });
+            }
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-MON-001: No APM or performance monitoring
+  {
+    id: 'PERF-MON-001',
+    category: 'performance',
+    severity: 'medium',
+    confidence: 'likely',
+    title: 'No Application Performance Monitoring',
+    check({ files, stack }) {
+      const findings = [];
+      if (stack.runtime !== 'node') return findings;
+      const allDeps = { ...stack.dependencies, ...stack.devDependencies };
+      const apmLibs = ['newrelic', 'dd-trace', 'elastic-apm-node', '@opentelemetry/sdk-node',
+        'prom-client', '@sentry/node', 'applicationinsights', 'clinic'];
+      if (!apmLibs.some(lib => lib in allDeps)) {
+        const hasServer = [...files.values()].some(c => c.includes('.listen(') || c.includes('createServer'));
+        if (hasServer) {
+          findings.push({ ruleId: 'PERF-MON-001', category: 'performance', severity: 'medium',
+            title: 'No APM or performance monitoring library detected',
+            description: 'Add APM (Datadog, New Relic, OpenTelemetry) to track response times, throughput, and performance regressions in production.',
+            fix: null });
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-MON-002: No slow query logging
+  {
+    id: 'PERF-MON-002',
+    category: 'performance',
+    severity: 'medium',
+    confidence: 'likely',
+    title: 'No Slow Query Logging',
+    check({ files, stack }) {
+      const findings = [];
+      const hasSlowQueryLog = [...files.values()].some(c =>
+        c.includes('slow') && (c.includes('query') || c.includes('log')) ||
+        c.includes('log_min_duration') || c.includes('slowQuery') || c.includes('slow_query')
+      );
+      if (!hasSlowQueryLog && stack.database) {
+        findings.push({ ruleId: 'PERF-MON-002', category: 'performance', severity: 'medium',
+          title: 'No slow query logging configured',
+          description: 'Enable slow query logging to identify performance bottlenecks. Use log_min_duration_statement in PostgreSQL or slow_query_log in MySQL.',
+          fix: null });
+      }
+      return findings;
+    },
+  },
+
+  // PERF-MON-003: No response time tracking
+  {
+    id: 'PERF-MON-003',
+    category: 'performance',
+    severity: 'low',
+    confidence: 'suggestion',
+    title: 'No Response Time Tracking',
+    check({ files, stack }) {
+      const findings = [];
+      if (stack.runtime !== 'node') return findings;
+      const hasResponseTime = [...files.values()].some(c =>
+        c.includes('response-time') || c.includes('responseTime') ||
+        c.includes('x-response-time') || c.includes('X-Response-Time') ||
+        c.includes('performance.now') || c.includes('process.hrtime')
+      );
+      const hasServer = [...files.values()].some(c => c.includes('.listen('));
+      if (!hasResponseTime && hasServer) {
+        findings.push({ ruleId: 'PERF-MON-003', category: 'performance', severity: 'low',
+          title: 'No response time tracking on API routes',
+          description: 'Add response-time middleware or log process.hrtime() to track and alert on slow endpoints.',
+          fix: null });
+      }
+      return findings;
+    },
+  },
+
+  // PERF-DB-009: Mongoose populate without field selection
+  { id: 'PERF-DB-009', category: 'performance', severity: 'medium', confidence: 'likely', title: 'Mongoose populate Without Field Selection',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!isSourceFile(fp)) continue;
+        const lines = c.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/\.populate\s*\(\s*['"`]\w+['"`]\s*\)/) && !lines[i].match(/select|fields/)) {
+            findings.push({ ruleId: 'PERF-DB-009', category: 'performance', severity: 'medium',
+              title: 'Mongoose .populate() without field selection fetches entire documents',
+              description: 'Use .populate("field", "name email") to select only needed fields from related documents.', file: fp, line: i + 1, fix: null });
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-DB-010: Aggregate without $match first
+  { id: 'PERF-DB-010', category: 'performance', severity: 'high', confidence: 'likely', title: 'Aggregation Pipeline Without Early $match',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!isSourceFile(fp)) continue;
+        const lines = c.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/\.aggregate\s*\(\s*\[/)) {
+            const block = lines.slice(i, Math.min(i + 5, lines.length)).join('\n');
+            if (block.match(/\$group|\$sort|\$unwind/) && !block.match(/\$match/)) {
+              findings.push({ ruleId: 'PERF-DB-010', category: 'performance', severity: 'high',
+                title: 'MongoDB aggregation pipeline without $match — processing all documents',
+                description: 'Add $match as the first stage to filter documents before expensive $group/$sort/$unwind operations.', file: fp, line: i + 1, fix: null });
+            }
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-DB-011: Using findAll in Sequelize without where
+  { id: 'PERF-DB-011', category: 'performance', severity: 'high', confidence: 'likely', title: 'Sequelize findAll Without Where Clause',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!isSourceFile(fp)) continue;
+        const lines = c.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/\.findAll\s*\(\s*\{/) || lines[i].match(/\.findAll\s*\(\s*\)/)) {
+            const block = lines.slice(i, Math.min(i + 8, lines.length)).join('\n');
+            if (!block.match(/where:|limit:|order:/) && fp.includes('api/') || fp.includes('route')) {
+              findings.push({ ruleId: 'PERF-DB-011', category: 'performance', severity: 'high',
+                title: 'Sequelize findAll without where/limit in API handler',
+                description: 'Add where and limit clauses to avoid returning entire tables. Use pagination for list endpoints.', file: fp, line: i + 1, fix: null });
+            }
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-DB-012: COUNT on non-indexed column
+  { id: 'PERF-DB-012', category: 'performance', severity: 'medium', confidence: 'likely', title: 'COUNT Without Indexed Column',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!isSourceFile(fp)) continue;
+        const lines = c.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/SELECT\s+COUNT\s*\(\s*(?![\*])\w+\s*\)/i) && !lines[i].match(/COUNT\s*\(\s*\*\s*\)/i)) {
+            findings.push({ ruleId: 'PERF-DB-012', category: 'performance', severity: 'medium',
+              title: 'COUNT(column) on potentially unindexed column — use COUNT(*) or add index',
+              description: 'COUNT(*) is optimized by most databases. For COUNT(column), ensure the column is indexed.', file: fp, line: i + 1, fix: null });
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-DB-013: Raw SQL in hot path without prepared statement
+  { id: 'PERF-DB-013', category: 'performance', severity: 'medium', confidence: 'likely', title: 'Raw SQL Without Prepared Statement',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!isSourceFile(fp)) continue;
+        const lines = c.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/db\.query\s*\(\s*`|pool\.query\s*\(\s*`/) && lines[i].match(/\$\{/)) {
+            findings.push({ ruleId: 'PERF-DB-013', category: 'performance', severity: 'medium',
+              title: 'Raw SQL with template literal interpolation — no query plan reuse',
+              description: 'Use parameterized queries ($1, $2) instead of template literals. Parameterized queries allow the DB to cache execution plans.', file: fp, line: i + 1, fix: null });
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-CACHE-005: No service worker for offline
+  { id: 'PERF-CACHE-005', category: 'performance', severity: 'low', confidence: 'suggestion', title: 'No Service Worker',
+    check({ files, stack }) {
+      const findings = [];
+      if (!['react', 'nextjs', 'vue', 'sveltekit'].includes(stack.framework)) return findings;
+      const hasSW = [...files.keys()].some(f => f.includes('service-worker') || f.includes('sw.js') || f.includes('workbox'));
+      const allDeps = { ...stack.dependencies, ...stack.devDependencies };
+      const hasWorkbox = 'workbox-webpack-plugin' in allDeps || 'vite-plugin-pwa' in allDeps;
+      if (!hasSW && !hasWorkbox) {
+        findings.push({ ruleId: 'PERF-CACHE-005', category: 'performance', severity: 'low',
+          title: 'No service worker for offline support or asset caching',
+          description: 'A service worker can cache static assets and API responses, dramatically improving repeat load times. Use Workbox for easy setup.', fix: null });
+      }
+      return findings;
+    },
+  },
+
+  // PERF-FE-006: moment.js import
+  { id: 'PERF-FE-006', category: 'performance', severity: 'medium', confidence: 'likely', title: 'moment.js Adds 67KB+ to Bundle',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!isSourceFile(fp)) continue;
+        if (c.match(/(?:import|require)\s*(?:\w+\s*=\s*require\s*\()?['"`]moment['"`]/)) {
+          findings.push({ ruleId: 'PERF-FE-006', category: 'performance', severity: 'medium',
+            title: "moment.js import adds 67KB+ to bundle — use date-fns or dayjs instead",
+            description: 'date-fns is tree-shakeable and adds only the functions you use. dayjs is 2KB. Both are API-compatible alternatives.', file: fp, fix: null });
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-FE-007: No preconnect for critical third-party origins
+  { id: 'PERF-FE-007', category: 'performance', severity: 'low', confidence: 'suggestion', title: 'No Resource Hints for Third-Party Origins',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!fp.match(/\.(html)$/) && !fp.match(/_document\.(jsx|tsx)$/)) continue;
+        const hasThirdParty = c.match(/fonts\.googleapis|cdnjs\.cloudflare|unpkg\.com|cdn\.jsdelivr/);
+        const hasHints = c.match(/rel=["'](?:preconnect|dns-prefetch)["']/);
+        if (hasThirdParty && !hasHints) {
+          findings.push({ ruleId: 'PERF-FE-007', category: 'performance', severity: 'low',
+            title: 'Third-party origins without <link rel="preconnect"> hints',
+            description: 'Add <link rel="preconnect" href="https://fonts.googleapis.com"> to establish connections early and reduce latency by 100-200ms.', file: fp, fix: null });
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-FE-008: font-display not set
+  { id: 'PERF-FE-008', category: 'performance', severity: 'medium', confidence: 'likely', title: 'Web Font Without font-display',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!fp.match(/\.(css|scss|sass)$/)) continue;
+        if (c.includes('@font-face') && !c.includes('font-display')) {
+          findings.push({ ruleId: 'PERF-FE-008', category: 'performance', severity: 'medium',
+            title: '@font-face without font-display — invisible text during font load (FOIT)',
+            description: 'Add font-display: swap to show fallback text immediately. Prevents invisible text while fonts load.', file: fp, fix: null });
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-API-005: No HTTP compression Accept-Encoding
+  { id: 'PERF-API-005', category: 'performance', severity: 'medium', confidence: 'likely', title: 'API Responses Not Compressed',
+    check({ files, stack }) {
+      const findings = [];
+      if (!['express', 'koa', 'fastify'].includes(stack.framework)) return findings;
+      const allDeps = { ...stack.dependencies, ...stack.devDependencies };
+      const hasCompression = 'compression' in allDeps || '@fastify/compress' in allDeps || 'koa-compress' in allDeps;
+      if (!hasCompression && ![...files.values()].some(c => c.includes('compression') || c.includes('brotli'))) {
+        findings.push({ ruleId: 'PERF-API-005', category: 'performance', severity: 'medium',
+          title: 'No response compression configured — sending uncompressed API responses',
+          description: 'Add compression middleware. JSON responses typically compress 70-85%, dramatically reducing bandwidth and improving mobile performance.', fix: null });
+      }
+      return findings;
+    },
+  },
+
+  // PERF-API-006: Returning full objects when partial needed
+  { id: 'PERF-API-006', category: 'performance', severity: 'low', confidence: 'suggestion', title: 'API Returns Full Objects Without Field Filtering',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!isSourceFile(fp)) continue;
+        if (!(fp.includes('api/') || fp.includes('route'))) continue;
+        if (c.match(/res\.json\s*\(\s*\w+\s*\)/) && !c.match(/fields|select|pick|omit|projection/)) {
+          if (c.match(/findMany|findAll|find\s*\(\s*\{/)) {
+            findings.push({ ruleId: 'PERF-API-006', category: 'performance', severity: 'low',
+              title: 'API returns full DB records without field filtering',
+              description: 'Return only fields the client needs. Large objects waste bandwidth and expose unnecessary data.', file: fp, fix: null });
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-API-007: No request timeout on outbound HTTP calls
+  { id: 'PERF-API-007', category: 'performance', severity: 'high', confidence: 'likely', title: 'Outbound HTTP Calls Without Timeout',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!isSourceFile(fp)) continue;
+        const lines = c.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/\bfetch\s*\(\s*['"`]https?:\/\//) && !lines[i].match(/signal|timeout/)) {
+            const block = lines.slice(i, Math.min(i + 5, lines.length)).join('\n');
+            if (!block.match(/signal|AbortController|timeout/)) {
+              findings.push({ ruleId: 'PERF-API-007', category: 'performance', severity: 'high',
+                title: 'fetch() without timeout — can hang indefinitely if remote server is slow',
+                description: 'Use AbortController with setTimeout: const controller = new AbortController(); setTimeout(() => controller.abort(), 5000);', file: fp, line: i + 1, fix: null });
+            }
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-MEM-005: Regex compiled inside loop
+  { id: 'PERF-MEM-005', category: 'performance', severity: 'medium', confidence: 'likely', title: 'RegExp Compiled Inside Loop',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!isSourceFile(fp)) continue;
+        const lines = c.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/for\s*\(|\.forEach\s*\(|\.map\s*\(|\.filter\s*\(/)) {
+            const block = lines.slice(i, Math.min(i + 8, lines.length)).join('\n');
+            if (block.match(/new\s+RegExp\s*\(/)) {
+              findings.push({ ruleId: 'PERF-MEM-005', category: 'performance', severity: 'medium',
+                title: 'new RegExp() constructed inside loop — should be compiled once outside',
+                description: 'Move RegExp construction outside the loop. const re = new RegExp(...); then use re inside the loop.', file: fp, line: i + 1, fix: null });
+            }
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-MEM-006: Large base64 in memory
+  { id: 'PERF-MEM-006', category: 'performance', severity: 'medium', confidence: 'likely', title: 'Base64 Encoding Binary Data in Memory',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!isSourceFile(fp)) continue;
+        if (c.match(/\.toString\s*\(\s*['"`]base64['"`]\s*\)/) && (fp.includes('api/') || fp.includes('route'))) {
+          findings.push({ ruleId: 'PERF-MEM-006', category: 'performance', severity: 'medium',
+            title: 'Converting binary data to base64 in request handler — increases memory usage 33%',
+            description: 'Stream binary data directly instead of base64-encoding it in memory. Use streaming for file uploads/downloads.', file: fp, fix: null });
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-ASYNC-003: No concurrency limit on parallel ops
+  { id: 'PERF-ASYNC-003', category: 'performance', severity: 'high', confidence: 'likely', title: 'No Concurrency Limit on Parallel Operations',
+    check({ files, stack }) {
+      const findings = [];
+      const allDeps = { ...stack.dependencies, ...stack.devDependencies };
+      for (const [fp, c] of files) {
+        if (!isSourceFile(fp)) continue;
+        if (c.match(/Promise\.all\s*\(\s*\w+\.map/) && !c.match(/pLimit|p-limit|bottleneck|throat|concurrency/)) {
+          if ((c.match(/Promise\.all/g) || []).length > 1) {
+            findings.push({ ruleId: 'PERF-ASYNC-003', category: 'performance', severity: 'high',
+              title: 'Promise.all on unbounded array — can overwhelm database/API with concurrent requests',
+              description: 'Use p-limit to cap concurrency: const limit = pLimit(10); await Promise.all(items.map(item => limit(() => process(item))))', file: fp, fix: null });
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-ASYNC-004: Synchronous require in async function
+  { id: 'PERF-ASYNC-004', category: 'performance', severity: 'medium', confidence: 'likely', title: 'Dynamic require() in Hot Path',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!isSourceFile(fp)) continue;
+        const lines = c.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/\brequire\s*\(/) && (fp.includes('api/') || fp.includes('route') || fp.includes('handler'))) {
+            const fnCtx = lines.slice(Math.max(0, i - 20), i).join('\n');
+            if (fnCtx.match(/async\s+function|=\s*async\s*\(|router\.\w+/)) {
+              findings.push({ ruleId: 'PERF-ASYNC-004', category: 'performance', severity: 'medium',
+                title: 'require() called inside async function/route handler — synchronous disk I/O on every request',
+                description: 'Move require() to the top of the file. Dynamic requires in route handlers block the event loop on first call.', file: fp, line: i + 1, fix: null });
+              break;
+            }
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-MON-004: No distributed tracing
+  { id: 'PERF-MON-004', category: 'performance', severity: 'medium', confidence: 'likely', title: 'No Distributed Tracing',
+    check({ files, stack }) {
+      const findings = [];
+      if (stack.runtime !== 'node') return findings;
+      const allDeps = { ...stack.dependencies, ...stack.devDependencies };
+      const hasTracing = '@opentelemetry/sdk-node' in allDeps || '@opentelemetry/api' in allDeps ||
+        'dd-trace' in allDeps || 'jaeger-client' in allDeps || 'zipkin' in allDeps;
+      if (!hasTracing && [...files.values()].some(c => c.match(/fetch\(|axios\.|got\(/))) {
+        findings.push({ ruleId: 'PERF-MON-004', category: 'performance', severity: 'medium',
+          title: 'No distributed tracing configured',
+          description: 'Add OpenTelemetry to trace requests across services. Without tracing, finding slow operations in distributed systems is extremely difficult.', fix: null });
+      }
+      return findings;
+    },
+  },
+
+  // PERF-MON-005: No performance budget
+  { id: 'PERF-MON-005', category: 'performance', severity: 'low', confidence: 'suggestion', title: 'No Performance Budget',
+    check({ files, stack }) {
+      const findings = [];
+      const allDeps = { ...stack.dependencies, ...stack.devDependencies };
+      const hasBudget = 'bundlesize' in allDeps || 'size-limit' in allDeps ||
+        [...files.keys()].some(f => f.includes('lighthouserc') || f.includes('budget'));
+      if (!hasBudget && [...files.keys()].some(f => f.match(/\.(jsx|tsx)$/))) {
+        findings.push({ ruleId: 'PERF-MON-005', category: 'performance', severity: 'low',
+          title: 'No performance budget (Lighthouse CI, size-limit) configured',
+          description: 'Add size-limit or Lighthouse CI to fail builds when bundle size or performance scores regress.', fix: null });
+      }
+      return findings;
+    },
+  },
+
+  // PERF-LOAD-011: No queue for background jobs
+  { id: 'PERF-LOAD-011', category: 'performance', severity: 'high', confidence: 'likely', title: 'No Job Queue for Background Processing',
+    check({ files, stack }) {
+      const findings = [];
+      if (stack.runtime !== 'node') return findings;
+      const allDeps = { ...stack.dependencies, ...stack.devDependencies };
+      const hasQueue = ['bull', 'bullmq', '@bull-board/api', 'bee-queue', 'agenda', 'kue', 'pg-boss'].some(d => d in allDeps);
+      const hasHeavyWork = [...files.values()].some(c =>
+        c.match(/sendEmail|sendMail|generatePDF|processImage|resize|compress|export/i)
+      );
+      if (!hasQueue && hasHeavyWork) {
+        findings.push({ ruleId: 'PERF-LOAD-011', category: 'performance', severity: 'high',
+          title: 'Heavy operations (email/PDF/image) processed synchronously in request handler',
+          description: 'Use a job queue (BullMQ, Agenda) to process heavy operations asynchronously. Respond immediately and process in background.', fix: null });
+      }
+      return findings;
+    },
+  },
+
+  // PERF-LOAD-012: In-memory session with no external store
+  { id: 'PERF-LOAD-012', category: 'performance', severity: 'high', confidence: 'likely', title: 'In-Memory Session Store',
+    check({ files, stack }) {
+      const findings = [];
+      const allDeps = { ...stack.dependencies, ...stack.devDependencies };
+      const hasSession = 'express-session' in allDeps;
+      const hasExternalStore = ['connect-redis', 'connect-mongo', 'connect-pg-simple'].some(d => d in allDeps);
+      if (hasSession && !hasExternalStore) {
+        findings.push({ ruleId: 'PERF-LOAD-012', category: 'performance', severity: 'high',
+          title: 'express-session using in-memory store — sessions lost on restart, not scalable',
+          description: 'Use connect-redis or connect-pg-simple to store sessions externally. In-memory sessions prevent horizontal scaling and are lost on restart.', fix: null });
+      }
+      return findings;
+    },
+  },
+
+  // PERF-DB-014: Missing composite index for common query patterns
+  { id: 'PERF-DB-014', category: 'performance', severity: 'medium', confidence: 'likely', title: 'No Composite Index for Multi-Column Queries',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!isSourceFile(fp)) continue;
+        const lines = c.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/WHERE\s+\w+\s*=.*AND\s+\w+\s*=/i)) {
+            const nearbySchema = c.match(/index|Index|INDEX/);
+            if (!nearbySchema) {
+              findings.push({ ruleId: 'PERF-DB-014', category: 'performance', severity: 'medium', title: 'Multi-column WHERE clause without composite index', description: 'Create a composite index for the columns used together in WHERE clauses. ORDER: put equality columns first, then range columns.', file: fp, line: i + 1, fix: null });
+            }
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-DB-015: Full text search on LIKE
+  { id: 'PERF-DB-015', category: 'performance', severity: 'high', confidence: 'likely', title: 'Full Text Search Using LIKE — Use FTS Index',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!isSourceFile(fp)) continue;
+        const lines = c.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/LIKE\s+['"]%.*%['"]/i)) {
+            findings.push({ ruleId: 'PERF-DB-015', category: 'performance', severity: 'high', title: 'Full text search using LIKE %term% — full table scan, use FTS index', description: 'Use PostgreSQL full-text search (tsvector/tsquery), MySQL FULLTEXT index, or Elasticsearch. LIKE %term% cannot use indexes.', file: fp, line: i + 1, fix: null });
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-CACHE-006: No cache warming strategy
+  { id: 'PERF-CACHE-006', category: 'performance', severity: 'low', confidence: 'suggestion', title: 'No Cache Warming Strategy',
+    check({ files, stack }) {
+      const findings = [];
+      const allDeps = { ...stack.dependencies, ...stack.devDependencies };
+      const hasCache = ['redis', 'ioredis', 'memcached', 'node-cache'].some(d => d in allDeps);
+      const hasWarm = [...files.values()].some(c => c.match(/warm.*cache|cache.*warm|preload|prefill|prewarm/i));
+      if (hasCache && !hasWarm) {
+        findings.push({ ruleId: 'PERF-CACHE-006', category: 'performance', severity: 'low', title: 'Cache configured without warming strategy — cold start causes latency spikes', description: 'Pre-populate cache on startup or after deploy. Cold caches cause latency spikes after deployments and cache flushes.', fix: null });
+      }
+      return findings;
+    },
+  },
+
+  // PERF-CACHE-007: Cache key not namespaced
+  { id: 'PERF-CACHE-007', category: 'performance', severity: 'medium', confidence: 'likely', title: 'Cache Keys Not Namespaced',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!isSourceFile(fp)) continue;
+        const lines = c.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/redis\.set\(['"](?!app:|api:|user:|session:)\w{1,20}['"]/i) || lines[i].match(/cache\.set\(['"](?!app:|api:|user:|session:)\w{1,20}['"]/i)) {
+            findings.push({ ruleId: 'PERF-CACHE-007', category: 'performance', severity: 'medium', title: 'Cache key without namespace prefix — key collisions between services', description: "Prefix cache keys with service/version: 'user:v2:123'. Unnamespaced keys collide between microservices and versions.", file: fp, line: i + 1, fix: null });
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-API-008: Returning full objects in list endpoints
+  { id: 'PERF-API-008', category: 'performance', severity: 'medium', confidence: 'likely', title: 'List Endpoint Returns Full Objects',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!isSourceFile(fp)) continue;
+        const lines = c.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/router\.get\(['"]\/\w+s['"]/i)) {
+            const handler = lines.slice(i, i + 20).join('\n');
+            if (handler.match(/find\(\)|findAll\(\)|findMany\(\)/) && !handler.match(/select|attributes|projection/)) {
+              findings.push({ ruleId: 'PERF-API-008', category: 'performance', severity: 'medium', title: 'List endpoint returns full objects — consider field projection', description: 'Return only the fields needed by the UI. List APIs with full objects transfer 10-100x more data than necessary.', file: fp, line: i + 1, fix: null });
+            }
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-API-009: No HTTP/2 push or server-sent events for real-time
+  { id: 'PERF-API-009', category: 'performance', severity: 'low', confidence: 'suggestion', title: 'Polling Instead of Server-Sent Events',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!isSourceFile(fp)) continue;
+        const lines = c.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/setInterval\s*\(.*fetch|polling.*interval|poll.*\d+000/i)) {
+            findings.push({ ruleId: 'PERF-API-009', category: 'performance', severity: 'low', title: 'Client polling detected — use Server-Sent Events or WebSocket', description: 'Replace frequent polling with SSE (EventSource) or WebSocket. Polling wastes bandwidth; SSE/WebSocket only send data when it changes.', file: fp, line: i + 1, fix: null });
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-FE-009: No lazy loading for images
+  { id: 'PERF-FE-009', category: 'performance', severity: 'medium', confidence: 'likely', title: 'Images Without Lazy Loading',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!fp.match(/\.(html|jsx|tsx|vue)$/)) continue;
+        const lines = c.split('\n');
+        let imgCount = 0, lazyCount = 0;
+        for (const line of lines) {
+          if (line.match(/<img\s/i)) { imgCount++; if (line.match(/loading=["']lazy|lazy/i)) lazyCount++; }
+        }
+        if (imgCount > 3 && lazyCount === 0) {
+          findings.push({ ruleId: 'PERF-FE-009', category: 'performance', severity: 'medium', title: `${imgCount} images without loading="lazy" — all loaded on page load`, description: 'Add loading="lazy" to images below the fold. Lazy loading reduces initial page weight and speeds first contentful paint.', file: fp, fix: null });
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-FE-010: Large unoptimized SVG files inline
+  { id: 'PERF-FE-010', category: 'performance', severity: 'low', confidence: 'suggestion', title: 'Large Inline SVG Without Optimization',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!fp.endsWith('.svg') && !fp.match(/\.(jsx|tsx|vue|html)$/)) continue;
+        const svgSize = (c.match(/<svg/gi) || []).length;
+        const hasOptimizer = c.match(/svgo|@svgr\/webpack|svgr/i);
+        if (fp.endsWith('.svg') && c.length > 10000 && !hasOptimizer) {
+          findings.push({ ruleId: 'PERF-FE-010', category: 'performance', severity: 'low', title: `SVG file ${Math.round(c.length / 1024)}KB — run through SVGO optimizer`, description: 'Run SVGs through SVGO. Unoptimized SVGs often contain redundant metadata that SVGO removes, reducing size 50-80%.', file: fp, fix: null });
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-FE-011: No resource hints for critical third-party domains
+  { id: 'PERF-FE-011', category: 'performance', severity: 'medium', confidence: 'likely', title: 'No Resource Hints for Critical Resources',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!fp.match(/\.(html|jsx|tsx)$/) && !fp.match(/document\.(tsx|jsx|js)/)) continue;
+        const hasThirdParty = c.match(/fonts\.googleapis\.com|cdn\.|cdnjs\.|unpkg\.|jsdelivr\./i);
+        const hasPreconnect = c.match(/rel=["']preconnect|rel=["']dns-prefetch/i);
+        if (hasThirdParty && !hasPreconnect) {
+          findings.push({ ruleId: 'PERF-FE-011', category: 'performance', severity: 'medium', title: 'Third-party resources without preconnect hints — DNS lookup delays first render', description: 'Add <link rel="preconnect" href="https://fonts.googleapis.com">. Preconnect eliminates DNS + TCP + TLS handshake time for critical third-party resources.', file: fp, fix: null });
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-MEM-007: Buffer.concat in loop
+  { id: 'PERF-MEM-007', category: 'performance', severity: 'medium', confidence: 'likely', title: 'Buffer.concat or Array.concat in Loop',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!isSourceFile(fp)) continue;
+        const lines = c.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/for\s*\(|while\s*\(|forEach|\.map\s*\(/)) {
+            const block = lines.slice(i, i + 10).join('\n');
+            if (block.match(/Buffer\.concat|\.concat\(/)) {
+              findings.push({ ruleId: 'PERF-MEM-007', category: 'performance', severity: 'medium', title: 'Buffer.concat or Array.concat inside loop — O(n²) memory allocations', description: 'Collect items in array, concat once outside loop: Buffer.concat(chunks). Concat inside loops reallocates the entire buffer each iteration.', file: fp, line: i + 1, fix: null });
+            }
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-MEM-008: Large object stored in session
+  { id: 'PERF-MEM-008', category: 'performance', severity: 'medium', confidence: 'likely', title: 'Large Object Stored in Session',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!isSourceFile(fp)) continue;
+        const lines = c.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/req\.session\.\w+\s*=/) && !lines[i].match(/req\.session\.userId|req\.session\.id|req\.session\.token/)) {
+            findings.push({ ruleId: 'PERF-MEM-008', category: 'performance', severity: 'medium', title: 'Large object stored in session — bloats session storage, slows serialization', description: 'Store only user ID in session; fetch full data as needed. Large session objects increase Redis memory usage and serialization time.', file: fp, line: i + 1, fix: null });
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-ASYNC-005: Not using worker threads for CPU-bound tasks
+  { id: 'PERF-ASYNC-005', category: 'performance', severity: 'medium', confidence: 'likely', title: 'CPU-Intensive Code Without Worker Threads',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!isSourceFile(fp)) continue;
+        const lines = c.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/imagemagick|sharp\.\w+|ffmpeg|pdf.*generate|xlsx.*create|csv.*parse/i) && !lines[i].match(/worker_threads|Worker\(|workerPool/i)) {
+            findings.push({ ruleId: 'PERF-ASYNC-005', category: 'performance', severity: 'medium', title: 'CPU-intensive operation (image/PDF/CSV) in main thread — blocks event loop', description: 'Offload to worker_threads or a job queue (Bull, BullMQ). CPU work in the main thread blocks all concurrent HTTP requests.', file: fp, line: i + 1, fix: null });
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-ASYNC-006: No request batching for GraphQL
+  { id: 'PERF-ASYNC-006', category: 'performance', severity: 'medium', confidence: 'definite', title: 'GraphQL Without DataLoader (N+1)',
+    check({ files, stack }) {
+      const findings = [];
+      const allDeps = { ...stack.dependencies, ...stack.devDependencies };
+      const hasGraphQL = 'graphql' in allDeps || '@apollo/server' in allDeps || 'apollo-server' in allDeps;
+      const hasDataLoader = 'dataloader' in allDeps;
+      if (hasGraphQL && !hasDataLoader) {
+        findings.push({ ruleId: 'PERF-ASYNC-006', category: 'performance', severity: 'medium', title: 'GraphQL without DataLoader — N+1 query problem in resolvers', description: 'Use DataLoader for batching and caching database calls in GraphQL resolvers. Without it, each resolved field may trigger a separate DB query.', fix: null });
+      }
+      return findings;
+    },
+  },
+
+  // PERF-MON-006: No performance benchmarks
+  { id: 'PERF-MON-006', category: 'performance', severity: 'low', confidence: 'suggestion', title: 'No Performance Benchmarks in CI',
+    check({ files }) {
+      const findings = [];
+      const hasBench = [...files.values()].some(c => c.match(/benchmark|bench\b|autocannon|k6|artillery|wrk|ab\s+-n/i)) || [...files.keys()].some(f => f.match(/bench|perf/i));
+      if (!hasBench) {
+        findings.push({ ruleId: 'PERF-MON-006', category: 'performance', severity: 'low', title: 'No performance benchmarks — regressions not automatically detected', description: 'Add benchmarks with autocannon or k6. CI benchmarks catch performance regressions before they reach production.', fix: null });
+      }
+      return findings;
+    },
+  },
+
+  // PERF-MON-007: No database slow query log
+  { id: 'PERF-MON-007', category: 'performance', severity: 'medium', confidence: 'likely', title: 'No Database Slow Query Monitoring',
+    check({ files }) {
+      const findings = [];
+      const allCode = [...files.values()].join('\n');
+      const hasSlowQuery = allCode.match(/slow.*query|query.*time|slowQueryThreshold|mongoose.*debug|sequelize.*logging|knex.*debug/i);
+      if (!hasSlowQuery) {
+        findings.push({ ruleId: 'PERF-MON-007', category: 'performance', severity: 'medium', title: 'No slow query logging configured — slow queries go undetected', description: 'Enable slow query logs: mongoose.set("debug", true), or configure slow_query_log in MySQL/PostgreSQL. Slow queries are the most common performance bottleneck.', fix: null });
+      }
+      return findings;
+    },
+  },
+
+  // PERF-MON-008: No Core Web Vitals monitoring
+  { id: 'PERF-MON-008', category: 'performance', severity: 'medium', confidence: 'likely', title: 'No Core Web Vitals Monitoring',
+    check({ files, stack }) {
+      const findings = [];
+      const allDeps = { ...stack.dependencies, ...stack.devDependencies };
+      const hasFrontend = [...files.keys()].some(f => f.match(/\.(jsx|tsx|vue|svelte)$/));
+      const hasCWV = 'web-vitals' in allDeps || [...files.values()].some(c => c.match(/web-vitals|getCLS|getLCP|getFID|getFCP|getTTFB/i));
+      if (hasFrontend && !hasCWV) {
+        findings.push({ ruleId: 'PERF-MON-008', category: 'performance', severity: 'medium', title: 'No Core Web Vitals monitoring — LCP, CLS, FID not tracked', description: 'Add web-vitals library and report to your analytics. Core Web Vitals (LCP <2.5s, CLS <0.1, FID <100ms) directly affect Google search ranking.', fix: null });
+      }
+      return findings;
+    },
+  },
+
+  // PERF-LOAD-013: No queue for background jobs
+  { id: 'PERF-LOAD-013', category: 'performance', severity: 'high', confidence: 'likely', title: 'Long Operations Executed Synchronously in Request',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!isSourceFile(fp)) continue;
+        const lines = c.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/app\.(post|put|patch)\s*\(['"]/i)) {
+            const handler = lines.slice(i, i + 30).join('\n');
+            if (handler.match(/sendEmail|sharp\.|pdf.*generate|resize|convert|render.*template/i) && !handler.match(/queue|bull|bee-queue|kue|agenda/i)) {
+              findings.push({ ruleId: 'PERF-LOAD-013', category: 'performance', severity: 'high', title: 'Long-running operation (email/PDF/image) in request handler — delays response', description: 'Queue slow operations with Bull or BullMQ. Return 202 Accepted and process asynchronously. Synchronous processing blocks the response and wastes connections.', file: fp, line: i + 1, fix: null });
+            }
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-LOAD-014: WebSocket without heartbeat
+  { id: 'PERF-LOAD-014', category: 'performance', severity: 'medium', confidence: 'likely', title: 'WebSocket Without Heartbeat/Ping',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!isSourceFile(fp)) continue;
+        if (c.match(/new WebSocket|WebSocketServer|io\.on\('connection'\)/i)) {
+          if (!c.match(/ping|pong|heartbeat|keepAlive|pingInterval/i)) {
+            findings.push({ ruleId: 'PERF-LOAD-014', category: 'performance', severity: 'medium', title: 'WebSocket without ping/pong heartbeat — dead connections accumulate', description: 'Implement ping/pong heartbeats (pingInterval: 30000). Without them, dead connections are not detected and accumulate, exhausting server capacity.', file: fp, fix: null });
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-DB-016: Using ORM without eager loading (lazy loaded N+1)
+  { id: 'PERF-DB-016', category: 'performance', severity: 'high', confidence: 'likely', title: 'ORM Without Eager Loading Configured',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!isSourceFile(fp)) continue;
+        const lines = c.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/\.findAll\(\)|\.findMany\(\)|\.find\(\)/i)) {
+            if (!lines[i].match(/include|populate|eager|join|with/i)) {
+              const handlerLines = lines.slice(i + 1, i + 15).join('\n');
+              if (handlerLines.match(/await.*\.get|await.*\.\w+\(\)|for.*of.*result/i)) {
+                findings.push({ ruleId: 'PERF-DB-016', category: 'performance', severity: 'high', title: 'ORM query without include/populate — N+1 queries on related records', description: 'Use include/populate to eagerly load relations: findMany({ include: { posts: true } }). Lazy loading N relations = N+1 queries.', file: fp, line: i + 1, fix: null });
+              }
+            }
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-DB-017: Synchronous Sequelize operation
+  { id: 'PERF-DB-017', category: 'performance', severity: 'high', confidence: 'likely', title: 'Missing await on ORM Operation',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!isSourceFile(fp)) continue;
+        const lines = c.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/User\.\w+\(|Post\.\w+\(|Product\.\w+\(/) && !lines[i].match(/await |\.then\(|return /i)) {
+            if (lines[i].match(/\.findAll|\.findOne|\.create|\.update|\.destroy|\.findByPk/i)) {
+              findings.push({ ruleId: 'PERF-DB-017', category: 'performance', severity: 'high', title: 'ORM method called without await — returns Promise, not data', description: 'Add await before ORM calls. Without await, you get a Promise object, not the actual data, causing undefined errors downstream.', file: fp, line: i + 1, fix: null });
+            }
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-CACHE-008: No stale-while-revalidate pattern
+  { id: 'PERF-CACHE-008', category: 'performance', severity: 'low', confidence: 'suggestion', title: 'Cache Without Stale-While-Revalidate',
+    check({ files }) {
+      const findings = [];
+      const hasCache = [...files.values()].some(c => c.match(/redis|cache|memcached/i));
+      const hasSWR = [...files.values()].some(c => c.match(/stale-while-revalidate|swr\b|staleWhileRevalidate|cache.*revalidate/i));
+      if (hasCache && !hasSWR) {
+        findings.push({ ruleId: 'PERF-CACHE-008', category: 'performance', severity: 'low', title: 'Cache without stale-while-revalidate — cache misses cause latency spikes', description: 'Implement stale-while-revalidate: serve stale data immediately, refresh in background. Eliminates cache miss latency while keeping data fresh.', fix: null });
+      }
+      return findings;
+    },
+  },
+
+  // PERF-FE-012: Third-party scripts blocking render
+  { id: 'PERF-FE-012', category: 'performance', severity: 'high', confidence: 'likely', title: 'Third-Party Scripts Without async/defer',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!fp.match(/\.(html)$/)) continue;
+        const lines = c.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/<script[^>]+src=["']https?:\/\//i) && !lines[i].match(/async|defer/i)) {
+            findings.push({ ruleId: 'PERF-FE-012', category: 'performance', severity: 'high', title: 'Third-party script without async/defer — blocks HTML parsing', description: 'Add async or defer attribute. Synchronous third-party scripts (analytics, ads) block page rendering and inflate Time to Interactive.', file: fp, line: i + 1, fix: null });
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-FE-013: No browser caching for static assets
+  { id: 'PERF-FE-013', category: 'performance', severity: 'medium', confidence: 'likely', title: 'Static Assets Without Long-Term Caching',
+    check({ files }) {
+      const findings = [];
+      const hasCacheHeaders = [...files.values()].some(c => c.match(/Cache-Control.*max-age|immutable|public.*max-age|stale-while-revalidate/i));
+      const hasStaticFiles = [...files.values()].some(c => c.match(/express\.static|serve-static|static.*middleware/i));
+      if (hasStaticFiles && !hasCacheHeaders) {
+        findings.push({ ruleId: 'PERF-FE-013', category: 'performance', severity: 'medium', title: 'Static file serving without Cache-Control max-age headers', description: 'Set Cache-Control: public, max-age=31536000, immutable for hashed assets. Content-hashed filenames allow permanent caching.', fix: null });
+      }
+      return findings;
+    },
+  },
+
+  // PERF-API-010: Synchronous crypto operations
+  { id: 'PERF-API-010', category: 'performance', severity: 'medium', confidence: 'likely', title: 'Synchronous bcrypt/Crypto in Request Handler',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!isSourceFile(fp)) continue;
+        const lines = c.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/bcrypt\.hashSync|bcrypt\.compareSync|pbkdf2Sync|scryptSync/)) {
+            findings.push({ ruleId: 'PERF-API-010', category: 'performance', severity: 'medium', title: 'Synchronous bcrypt/crypto in request handler — blocks event loop', description: 'Use async: await bcrypt.hash(password, 10). bcryptSync blocks the Node.js event loop for 50-300ms, stalling all concurrent requests.', file: fp, line: i + 1, fix: null });
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-API-011: No response caching for GET endpoints
+  { id: 'PERF-API-011', category: 'performance', severity: 'medium', confidence: 'likely', title: 'GET Endpoints Without Response Caching',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!isSourceFile(fp)) continue;
+        const lines = c.split('\n');
+        let getCount = 0, cacheCount = 0;
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/router\.get|app\.get/i)) getCount++;
+          if (lines[i].match(/Cache-Control|cache\.set|redis\.set|apicache|cache-manager/i)) cacheCount++;
+        }
+        if (getCount > 5 && cacheCount === 0) {
+          findings.push({ ruleId: 'PERF-API-011', category: 'performance', severity: 'medium', title: `${getCount} GET routes with no response caching — repeated identical queries hit database`, description: 'Cache GET responses: res.set("Cache-Control", "public, max-age=60"). Even 60-second caching dramatically reduces database load.', file: fp, fix: null });
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-MEM-009: No object pooling for frequently created objects
+  { id: 'PERF-MEM-009', category: 'performance', severity: 'low', confidence: 'suggestion', title: 'No Object Pooling for High-Frequency Objects',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!isSourceFile(fp)) continue;
+        const lines = c.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/new\s+(?:Buffer|Uint8Array|ArrayBuffer)\s*\(\d+\)/) && !lines[i].match(/\/\//)) {
+            const nearby = lines.slice(Math.max(0, i - 3), i + 3).join('\n');
+            if (nearby.match(/forEach|map\s*\(|for\s*\(/)) {
+              findings.push({ ruleId: 'PERF-MEM-009', category: 'performance', severity: 'low', title: 'New Buffer/TypedArray allocated in loop — consider object pooling', description: 'Pre-allocate buffers and reuse them. Creating new Buffers/ArrayBuffers in tight loops causes GC pressure.', file: fp, line: i + 1, fix: null });
+            }
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-ASYNC-007: Blocking the event loop with complex array operations
+  { id: 'PERF-ASYNC-007', category: 'performance', severity: 'medium', confidence: 'likely', title: 'Large Array Operations Blocking Event Loop',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!isSourceFile(fp)) continue;
+        const lines = c.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/\.sort\(|\.filter\(.*\.map\(|\.reduce\(/)) {
+            const block = lines.slice(Math.max(0, i - 3), i + 3).join('\n');
+            if (block.match(/\.length\s*>\s*(?:1000|10000|100000)|items\s*=|records\s*=|results\s*=/)) {
+              findings.push({ ruleId: 'PERF-ASYNC-007', category: 'performance', severity: 'medium', title: 'Large array transformation without chunking — may block event loop', description: 'For arrays >10k items, chunk processing: split into batches with setImmediate() between chunks. Large synchronous operations starve the event loop.', file: fp, line: i + 1, fix: null });
+            }
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-DB-018: No read replica for heavy read workloads
+  { id: 'PERF-DB-018', category: 'performance', severity: 'medium', confidence: 'likely', title: 'No Read Replica for Heavy Read Workloads',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!isSourceFile(fp)) continue;
+        const lines = c.split('\n');
+        let readCount = 0, readReplicaUsed = false;
+        for (const line of lines) {
+          if (line.match(/\.find\(|\.findAll\(|\.findMany\(|SELECT/i)) readCount++;
+          if (line.match(/readReplica|read_replica|replicaUrl|slaveDb|readDb|slave/i)) readReplicaUsed = true;
+        }
+        if (readCount > 20 && !readReplicaUsed) {
+          findings.push({ ruleId: 'PERF-DB-018', category: 'performance', severity: 'medium', title: `${readCount} read queries without read replica — all reads hit primary database`, description: 'Route read queries to a read replica. Heavy read traffic on the primary database competes with writes and increases write latency.', file: fp, fix: null });
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-CACHE-009: Repeated identical API calls without deduplication
+  { id: 'PERF-CACHE-009', category: 'performance', severity: 'medium', confidence: 'likely', title: 'No Request Deduplication for Concurrent Identical Requests',
+    check({ files, stack }) {
+      const findings = [];
+      const allDeps = { ...stack.dependencies, ...stack.devDependencies };
+      const hasDedup = ['dataloader', 'p-memoize', 'async-memoize', 'memoize-one'].some(d => d in allDeps);
+      const hasExternalCalls = [...files.values()].some(c => c.match(/axios\.|fetch\(|got\./i));
+      if (hasExternalCalls && !hasDedup) {
+        findings.push({ ruleId: 'PERF-CACHE-009', category: 'performance', severity: 'medium', title: 'No request deduplication for concurrent identical API calls', description: 'Use DataLoader or p-memoize to deduplicate concurrent identical requests. Without deduplication, 100 concurrent users trigger 100 identical external API calls.', fix: null });
+      }
+      return findings;
+    },
+  },
+
+  // PERF-FE-014: No CSS purging for large CSS frameworks
+  { id: 'PERF-FE-014', category: 'performance', severity: 'medium', confidence: 'likely', title: 'CSS Framework Without Purging Unused Styles',
+    check({ files, stack }) {
+      const findings = [];
+      const allDeps = { ...stack.dependencies, ...stack.devDependencies };
+      const hasLargeCSS = ['bootstrap', 'material-ui', '@mui/material', 'antd', 'bulma', 'foundation-sites'].some(d => d in allDeps);
+      const hasPurge = [...files.values()].some(c => c.match(/purge|purgecss|content.*tailwind|JIT|usedExports/i));
+      if (hasLargeCSS && !hasPurge) {
+        findings.push({ ruleId: 'PERF-FE-014', category: 'performance', severity: 'medium', title: 'CSS framework imported without unused CSS purging', description: 'Configure PurgeCSS or tree-shaking. Full Bootstrap/Material-UI is 200-400KB. With purging, only used components are included.', fix: null });
+      }
+      return findings;
+    },
+  },
+
+  // PERF-API-012: Synchronous email sending in request
+  { id: 'PERF-API-012', category: 'performance', severity: 'high', confidence: 'likely', title: 'Synchronous Email Sending in HTTP Request',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!isSourceFile(fp)) continue;
+        const lines = c.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/await.*sendMail|await.*sendEmail|await.*mailer\./i)) {
+            const context = lines.slice(Math.max(0, i - 10), i).join('\n');
+            if (context.match(/router\.|app\.(post|put|patch)|exports\.handler/i)) {
+              findings.push({ ruleId: 'PERF-API-012', category: 'performance', severity: 'high', title: 'Email sent synchronously in HTTP handler — adds 200-3000ms to response time', description: 'Queue emails: emailQueue.add({ to, subject, body }). Return 202 Accepted immediately. Synchronous email sending holds HTTP connections and delays responses.', file: fp, line: i + 1, fix: null });
+            }
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-MON-009: No alerting on high latency
+  { id: 'PERF-MON-009', category: 'performance', severity: 'medium', confidence: 'likely', title: 'No Latency SLA Alerting',
+    check({ files }) {
+      const findings = [];
+      const allCode = [...files.values()].join('\n');
+      const hasAlert = allCode.match(/latency.*alert|p99.*alert|response.*time.*threshold|sla.*alert|duration.*alarm/i);
+      const hasMetrics = allCode.match(/prom-client|datadog|cloudwatch|newrelic/i);
+      if (hasMetrics && !hasAlert) {
+        findings.push({ ruleId: 'PERF-MON-009', category: 'performance', severity: 'medium', title: 'Metrics configured without latency SLA alerting', description: 'Alert on P99 response time > 500ms. Without latency alerts, gradual performance degradation goes undetected until users complain.', fix: null });
+      }
+      return findings;
+    },
+  },
+
+  // PERF-LOAD-015: No pagination default limit
+  { id: 'PERF-LOAD-015', category: 'performance', severity: 'high', confidence: 'likely', title: 'List API Without Maximum Page Size Limit',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!isSourceFile(fp)) continue;
+        const lines = c.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/limit.*req\.query|req\.query.*limit/i)) {
+            const nearby = lines.slice(i, i + 5).join('\n');
+            if (!nearby.match(/Math\.min|maxLimit|MAX_LIMIT|> \d+|Math\.max/)) {
+              findings.push({ ruleId: 'PERF-LOAD-015', category: 'performance', severity: 'high', title: 'Pagination limit from user query without maximum cap', description: 'Cap limit: const limit = Math.min(parseInt(req.query.limit) || 20, 100). Without a max, users can request limit=100000 and load millions of rows.', file: fp, line: i + 1, fix: null });
+            }
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-ASYNC-008: forEach with async/await (not parallelized)
+  { id: 'PERF-ASYNC-008', category: 'performance', severity: 'medium', confidence: 'likely', title: 'async/await Inside forEach (Sequential, Not Parallel)',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!isSourceFile(fp)) continue;
+        const lines = c.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/\.forEach\s*\(\s*async/)) {
+            findings.push({ ruleId: 'PERF-ASYNC-008', category: 'performance', severity: 'medium', title: 'async/await inside forEach — awaits are not waited, use Promise.all with map instead', description: 'Replace: await Promise.all(items.map(async item => { ... })). forEach ignores returned promises; items process without awaiting completion.', file: fp, line: i + 1, fix: null });
+          }
+        }
+      }
+      return findings;
+    },
+  },
+
+  // PERF-MEM-010: No streaming for large file uploads
+  { id: 'PERF-MEM-010', category: 'performance', severity: 'high', confidence: 'likely', title: 'File Uploads Buffered in Memory',
+    check({ files, stack }) {
+      const findings = [];
+      const allDeps = { ...stack.dependencies, ...stack.devDependencies };
+      const hasUpload = ['multer', 'formidable', 'multiparty', 'busboy'].some(d => d in allDeps);
+      const hasStreaming = [...files.values()].some(c => c.match(/pipe\(|createWriteStream|\.stream\(|S3.*upload.*stream/i));
+      if (hasUpload && !hasStreaming) {
+        findings.push({ ruleId: 'PERF-MEM-010', category: 'performance', severity: 'high', title: 'File upload handler without streaming to storage — entire file loaded into memory', description: 'Stream uploads directly to S3/disk: req.pipe(s3Stream). Buffering large files in memory causes OOM errors and limits upload size.', fix: null });
+      }
+      return findings;
+    },
+  },
+
+  // PERF-DB-019: Missing index on created_at for time-range queries
+  { id: 'PERF-DB-019', category: 'performance', severity: 'medium', confidence: 'likely', title: 'No Index on Timestamp for Time-Range Queries',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!fp.match(/migration|schema/i) || !isSourceFile(fp)) continue;
+        if (c.match(/created_at|updatedAt|createdAt|timestamp/i) && !c.match(/\.index\('created_at'\)|index.*created_at|INDEX.*created_at/i)) {
+          findings.push({ ruleId: 'PERF-DB-019', category: 'performance', severity: 'medium', title: 'Timestamp column without index — date range queries do full table scan', description: 'Add index: table.index("created_at"). Time-range queries (last 7 days) require full scans without an index on the timestamp column.', file: fp, fix: null });
+        }
+      }
+      return findings;
+    },
+  },
+  // PERF-CACHE-010: Redis KEYS command in production
+  { id: 'PERF-CACHE-010', category: 'performance', severity: 'critical', confidence: 'definite', title: 'Redis KEYS Command Used in Production',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!isSourceFile(fp)) continue;
+        const lines = c.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/\.keys\s*\(['"`][\*?]/)) {
+            findings.push({ ruleId: 'PERF-CACHE-010', category: 'performance', severity: 'critical', title: 'Redis KEYS * command blocks entire Redis for potentially seconds', description: 'Use SCAN instead of KEYS. SCAN is non-blocking and iterates in small batches. KEYS blocks Redis server-wide until complete.', file: fp, line: i + 1, fix: null });
+          }
+        }
+      }
+      return findings;
+    },
+  },
+  // PERF-FE-015: No image dimensions specified
+  { id: 'PERF-FE-015', category: 'performance', severity: 'medium', confidence: 'likely', title: 'Images Without Width/Height Attributes (CLS)',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!fp.match(/\.(html)$/)) continue;
+        const lines = c.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/<img\s/i) && !lines[i].match(/width=|height=|style=["'][^"']*width/i)) {
+            findings.push({ ruleId: 'PERF-FE-015', category: 'performance', severity: 'medium', title: 'Image without width/height attributes — causes Cumulative Layout Shift', description: 'Add width and height attributes matching the image dimensions. Without them, the browser cannot reserve space, causing layout shift as images load.', file: fp, line: i + 1, fix: null });
+          }
+        }
+      }
+      return findings;
+    },
+  },
+  // PERF-API-013: No HTTP caching headers on API responses
+  { id: 'PERF-API-013', category: 'performance', severity: 'medium', confidence: 'likely', title: 'API Responses Without Cache-Control Headers',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!isSourceFile(fp)) continue;
+        const lines = c.split('\n');
+        let getRoutes = 0, cacheControl = 0;
+        for (const l of lines) {
+          if (l.match(/router\.get\(|app\.get\(/i)) getRoutes++;
+          if (l.match(/Cache-Control|cache-control/i)) cacheControl++;
+        }
+        if (getRoutes > 3 && cacheControl === 0) {
+          findings.push({ ruleId: 'PERF-API-013', category: 'performance', severity: 'medium', title: `${getRoutes} GET routes without Cache-Control headers`, description: 'Set Cache-Control: public, max-age=60 on read-only endpoints. Without caching headers, every client request hits your server even for identical data.', file: fp, fix: null });
+        }
+      }
+      return findings;
+    },
+  },
+  // PERF-LOAD-016: No WebSocket connection limit
+  { id: 'PERF-LOAD-016', category: 'performance', severity: 'medium', confidence: 'likely', title: 'No WebSocket Connection Limit',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!isSourceFile(fp)) continue;
+        if (c.match(/WebSocketServer|io\.on\('connection'\)|wss\.on\('connection'\)/i)) {
+          if (!c.match(/maxConnections|connection.*limit|wss\.clients\.size|io\.engine\.clientsCount/i)) {
+            findings.push({ ruleId: 'PERF-LOAD-016', category: 'performance', severity: 'medium', title: 'WebSocket server without connection limit — resource exhaustion under load', description: 'Add connection limits: if (wss.clients.size >= MAX_CONNECTIONS) socket.close(). Unlimited WebSocket connections exhaust file descriptors and memory.', file: fp, fix: null });
+          }
+        }
+      }
+      return findings;
+    },
+  },
+  // PERF-MEM-011: Template compiled on every request
+  { id: 'PERF-MEM-011', category: 'performance', severity: 'medium', confidence: 'likely', title: 'Template Compiled on Every Request',
+    check({ files }) {
+      const findings = [];
+      for (const [fp, c] of files) {
+        if (!isSourceFile(fp)) continue;
+        const lines = c.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+          if (lines[i].match(/Handlebars\.compile|Mustache\.render|ejs\.render|nunjucks\.renderString/i)) {
+            const context = lines.slice(Math.max(0, i - 5), i).join('\n');
+            if (context.match(/router\.|app\.(get|post)|handler|req,\s*res/)) {
+              findings.push({ ruleId: 'PERF-MEM-011', category: 'performance', severity: 'medium', title: 'Template compiled inside request handler — recompile on every request', description: 'Compile templates at startup and cache: const tmpl = Handlebars.compile(templateString). Template compilation is expensive; cache the compiled function.', file: fp, line: i + 1, fix: null });
+            }
+          }
+        }
+      }
+      return findings;
+    },
+  },
+];
+
+export default rules;
+
+// PERF-112: React missing key prop in list
+rules.push({
+  id: 'PERF-112', category: 'performance', severity: 'medium', confidence: 'likely', title: 'React list rendered without key prop',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!fp.match(/\.(jsx|tsx)$/)) continue;
+      const lines = c.split('\n');
+      for (let i = 0; i < lines.length; i++) {
+        if (/^\s*(\/\/|\/\*|\*)/.test(lines[i])) continue;
+        if (/\.map\s*\([^)]*=>\s*[(<]/.test(lines[i]) && !/key\s*=/.test(lines[i])) {
+          const ctx = lines.slice(i, Math.min(lines.length, i + 4)).join('\n');
+          if (!/key\s*=/.test(ctx)) findings.push({ ruleId: 'PERF-112', category: 'performance', severity: 'medium', title: '.map() rendering without key prop — React reconciliation degraded', description: 'React needs stable keys on list items to reconcile efficiently. Missing keys cause unnecessary DOM re-renders.', file: fp, line: i + 1, fix: null });
+        }
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-113: Heavy computation in React render
+rules.push({
+  id: 'PERF-113', category: 'performance', severity: 'high', confidence: 'likely', title: 'Expensive computation in React component body',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!fp.match(/\.(jsx|tsx)$/)) continue;
+      const lines = c.split('\n');
+      for (let i = 0; i < lines.length; i++) {
+        if (/^\s*(\/\/|\/\*|\*)/.test(lines[i])) continue;
+        if (/\.sort\s*\(|\.filter\s*\(|\.reduce\s*\(/.test(lines[i]) && !/useMemo|useCallback/.test(lines[i])) {
+          const ctx = lines.slice(Math.max(0, i - 8), i).join('\n');
+          if (/return\s*\(|function.*Component|const\s+\w+\s*=\s*\(/.test(ctx) && !/useMemo|useCallback/.test(ctx)) {
+            findings.push({ ruleId: 'PERF-113', category: 'performance', severity: 'high', title: 'Sort/filter/reduce inside render — runs on every render cycle', description: 'Move expensive array operations outside render or wrap with useMemo to prevent recalculation on every render.', file: fp, line: i + 1, fix: null });
+          }
+        }
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-114: Regex recompiled in loop
+rules.push({
+  id: 'PERF-114', category: 'performance', severity: 'medium', confidence: 'likely', title: 'new RegExp() inside loop — recompiled on every iteration',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      const lines = c.split('\n');
+      let loopDepth = 0;
+      for (let i = 0; i < lines.length; i++) {
+        if (/^\s*(\/\/|\/\*|\*)/.test(lines[i])) continue;
+        if (/\b(?:for|while)\s*\(/.test(lines[i])) loopDepth++;
+        if (/^\s*\}/.test(lines[i]) && loopDepth > 0) loopDepth--;
+        if (loopDepth > 0 && /new\s+RegExp\s*\(/.test(lines[i])) {
+          findings.push({ ruleId: 'PERF-114', category: 'performance', severity: 'medium', title: 'RegExp created inside loop — hoist outside for reuse', description: 'Creating RegExp inside loops recompiles the regex each iteration. Move the RegExp declaration outside the loop.', file: fp, line: i + 1, fix: null });
+        }
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-115: String concatenation in loop
+rules.push({
+  id: 'PERF-115', category: 'performance', severity: 'medium', confidence: 'likely', title: 'String += in loop — use array.join() instead',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      const lines = c.split('\n');
+      let loopDepth = 0;
+      for (let i = 0; i < lines.length; i++) {
+        if (/^\s*(\/\/|\/\*|\*)/.test(lines[i])) continue;
+        if (/\b(?:for|while)\s*\(/.test(lines[i])) loopDepth++;
+        if (/^\s*\}/.test(lines[i]) && loopDepth > 0) loopDepth--;
+        if (loopDepth > 0 && /\w+\s*\+=\s*['"`]/.test(lines[i])) {
+          findings.push({ ruleId: 'PERF-115', category: 'performance', severity: 'medium', title: 'String += concatenation in loop — O(n²) allocations', description: 'String concatenation in loops creates a new string each iteration. Use array.push() then join("") at the end.', file: fp, line: i + 1, fix: null });
+        }
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-116: Recursive function without memoization
+rules.push({
+  id: 'PERF-116', category: 'performance', severity: 'medium', confidence: 'likely', title: 'Recursive function without memoization — exponential complexity risk',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      const lines = c.split('\n');
+      for (let i = 0; i < lines.length; i++) {
+        if (/^\s*(\/\/|\/\*|\*)/.test(lines[i])) continue;
+        const fnMatch = lines[i].match(/function\s+(\w+)\s*\(/);
+        if (fnMatch) {
+          const fnName = fnMatch[1];
+          const body = lines.slice(i, Math.min(lines.length, i + 25)).join('\n');
+          const recCalls = (body.match(new RegExp(`\\b${fnName}\\s*\\(`, 'g')) || []).length;
+          if (recCalls >= 2 && !/cache|memo|Map\s*\(|memoize/.test(body)) {
+            findings.push({ ruleId: 'PERF-116', category: 'performance', severity: 'medium', title: `Recursive '${fnName}' with multiple calls — add memoization`, description: 'Functions with multiple recursive calls have exponential time complexity. Add a Map cache: if (cache.has(n)) return cache.get(n).', file: fp, line: i + 1, fix: null });
+          }
+        }
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-117: DB connection created per request
+rules.push({
+  id: 'PERF-117', category: 'performance', severity: 'high', confidence: 'likely', title: 'Database connection created per-request without pooling',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      const lines = c.split('\n');
+      for (let i = 0; i < lines.length; i++) {
+        if (/^\s*(\/\/|\/\*|\*)/.test(lines[i])) continue;
+        if (/new\s+(?:Pool|Client|MongoClient|mysql\.createConnection|Sequelize)\s*\(/.test(lines[i])) {
+          const ctx = lines.slice(Math.max(0, i - 5), i).join('\n');
+          if (/router\.|app\.(get|post|put|delete)|handler|async\s*\(req/.test(ctx)) {
+            findings.push({ ruleId: 'PERF-117', category: 'performance', severity: 'high', title: 'DB connection opened inside request handler — no pooling', description: 'Creating a new DB connection per request causes connection overhead and can exhaust DB connection limits. Initialize a pool at startup.', file: fp, line: i + 1, fix: null });
+          }
+        }
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-118: Sequential awaits on independent operations
+rules.push({
+  id: 'PERF-118', category: 'performance', severity: 'medium', confidence: 'likely', title: 'Sequential awaits on independent operations — use Promise.all()',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      const lines = c.split('\n');
+      for (let i = 0; i < lines.length - 2; i++) {
+        if (/^\s*(\/\/|\/\*|\*)/.test(lines[i])) continue;
+        if (/^\s*(?:const|let)\s+\w+\s*=\s*await\s+/.test(lines[i]) &&
+            /^\s*(?:const|let)\s+\w+\s*=\s*await\s+/.test(lines[i + 1])) {
+          const var1 = (lines[i].match(/(?:const|let)\s+(\w+)/) || [])[1];
+          if (var1 && !lines[i + 1].includes(var1)) {
+            findings.push({ ruleId: 'PERF-118', category: 'performance', severity: 'medium', title: 'Sequential independent awaits — use Promise.all() for parallelism', description: 'Independent async operations awaited sequentially add their latencies. Use const [a, b] = await Promise.all([op1, op2]) instead.', file: fp, line: i + 1, fix: null });
+          }
+        }
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-119: Event listeners without cleanup
+rules.push({
+  id: 'PERF-119', category: 'performance', severity: 'high', confidence: 'likely', title: 'Multiple event listeners added without corresponding removal',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      const adds = (c.match(/addEventListener|\.on\s*\(/g) || []).length;
+      const removes = (c.match(/removeEventListener|\.off\s*\(|\.removeListener\s*\(/g) || []).length;
+      if (adds > 2 && removes === 0) {
+        findings.push({ ruleId: 'PERF-119', category: 'performance', severity: 'high', title: `${adds} event listeners with no removal — memory leak risk`, description: 'Event listeners accumulate if not removed. Add removeEventListener in cleanup, componentWillUnmount, or useEffect return.', file: fp, fix: null });
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-120: Heavy library not lazily loaded
+rules.push({
+  id: 'PERF-120', category: 'performance', severity: 'medium', confidence: 'likely', title: 'Large dependency imported statically — consider dynamic import()',
+  check({ files }) {
+    const findings = [];
+    const heavyLibs = /^import\s+.*from\s+['"](?:lodash|moment|rxjs|pdf-lib|puppeteer|chart\.js|three|@tensorflow)['"]/im;
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      const lines = c.split('\n');
+      for (let i = 0; i < lines.length; i++) {
+        if (/^\s*(\/\/|\/\*|\*)/.test(lines[i])) continue;
+        if (heavyLibs.test(lines[i])) {
+          findings.push({ ruleId: 'PERF-120', category: 'performance', severity: 'medium', title: 'Heavy library imported statically — consider lazy loading with import()', description: 'Large libraries increase initial bundle/startup time. Use dynamic import() for libraries not needed on every request.', file: fp, line: i + 1, fix: null });
+        }
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-121: Unthrottled scroll/resize handler
+rules.push({
+  id: 'PERF-121', category: 'performance', severity: 'medium', confidence: 'likely', title: 'Scroll/resize event without debounce or throttle',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      const lines = c.split('\n');
+      for (let i = 0; i < lines.length; i++) {
+        if (/^\s*(\/\/|\/\*|\*)/.test(lines[i])) continue;
+        if (/addEventListener\s*\(\s*['"](?:resize|scroll|mousemove)['"]/.test(lines[i])) {
+          const ctx = lines.slice(Math.max(0, i - 3), Math.min(lines.length, i + 8)).join('\n');
+          if (!/debounce|throttle|requestAnimationFrame/.test(ctx)) {
+            findings.push({ ruleId: 'PERF-121', category: 'performance', severity: 'medium', title: 'Resize/scroll handler without throttle — fires at 60+ fps', description: 'Scroll and resize events fire very frequently. Wrap handlers with debounce() or throttle() to limit execution.', file: fp, line: i + 1, fix: null });
+          }
+        }
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-122: Synchronous crypto in request handler
+rules.push({
+  id: 'PERF-122', category: 'performance', severity: 'high', confidence: 'likely', title: 'Synchronous crypto operation blocks Node.js event loop',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      const lines = c.split('\n');
+      for (let i = 0; i < lines.length; i++) {
+        if (/^\s*(\/\/|\/\*|\*)/.test(lines[i])) continue;
+        if (/bcrypt\.hashSync|bcrypt\.compareSync|crypto\.pbkdf2Sync|scryptSync/.test(lines[i])) {
+          const ctx = lines.slice(Math.max(0, i - 8), i).join('\n');
+          if (/router\.|app\.(get|post|put|delete)|handler|async\s*\(req/.test(ctx)) {
+            findings.push({ ruleId: 'PERF-122', category: 'performance', severity: 'high', title: 'bcryptSync/pbkdf2Sync in request handler blocks all other requests', description: 'Synchronous crypto operations block Node.js event loop. Use async variants: bcrypt.hash(), crypto.pbkdf2(), crypto.scrypt().', file: fp, line: i + 1, fix: null });
+          }
+        }
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-123: JSON.parse in tight loop
+rules.push({
+  id: 'PERF-123', category: 'performance', severity: 'medium', confidence: 'likely', title: 'JSON.parse() inside loop — expensive deserialization per iteration',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      const lines = c.split('\n');
+      let loopDepth = 0;
+      for (let i = 0; i < lines.length; i++) {
+        if (/^\s*(\/\/|\/\*|\*)/.test(lines[i])) continue;
+        if (/\b(?:for|while)\s*\(/.test(lines[i])) loopDepth++;
+        if (/^\s*\}/.test(lines[i]) && loopDepth > 0) loopDepth--;
+        if (loopDepth > 0 && /JSON\.parse\s*\(/.test(lines[i])) {
+          findings.push({ ruleId: 'PERF-123', category: 'performance', severity: 'medium', title: 'JSON.parse() inside loop — parse once and cache', description: 'JSON.parse is CPU-intensive. If parsing the same data repeatedly, parse once and reuse the result.', file: fp, line: i + 1, fix: null });
+        }
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-124: Missing pagination on data fetching
+rules.push({
+  id: 'PERF-124', category: 'performance', severity: 'medium', confidence: 'likely', title: 'Data fetch without explicit limit — could return unbounded results',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      const lines = c.split('\n');
+      for (let i = 0; i < lines.length; i++) {
+        if (/^\s*(\/\/|\/\*|\*)/.test(lines[i])) continue;
+        if (/\.find\s*\(\s*\{|\.findAll\s*\(\s*\{/.test(lines[i])) {
+          const ctx = lines.slice(i, Math.min(lines.length, i + 6)).join('\n');
+          if (!/limit|take|pageSize|LIMIT|skip|offset/.test(ctx)) {
+            findings.push({ ruleId: 'PERF-124', category: 'performance', severity: 'medium', title: 'DB find() without limit — may return full table', description: 'Queries without a LIMIT can return millions of rows as data grows. Always specify take/limit for list queries.', file: fp, line: i + 1, fix: null });
+          }
+        }
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-125: Object spread in hot loop
+rules.push({
+  id: 'PERF-125', category: 'performance', severity: 'low', confidence: 'suggestion', title: 'Object spread inside tight loop — excessive allocations',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      const lines = c.split('\n');
+      let loopDepth = 0;
+      for (let i = 0; i < lines.length; i++) {
+        if (/^\s*(\/\/|\/\*|\*)/.test(lines[i])) continue;
+        if (/\b(?:for|while)\s*\(/.test(lines[i])) loopDepth++;
+        if (/^\s*\}/.test(lines[i]) && loopDepth > 0) loopDepth--;
+        if (loopDepth > 0 && /\{\s*\.\.\.\w+/.test(lines[i])) {
+          findings.push({ ruleId: 'PERF-125', category: 'performance', severity: 'low', title: 'Object spread in loop — allocates new object each iteration', description: 'Object spread {...obj} in tight loops creates many short-lived objects, increasing GC pressure. Consider mutating in-place if the object is not shared.', file: fp, line: i + 1, fix: null });
+        }
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-126 through PERF-155: Additional performance rules
+
+// PERF-126: Missing database index for frequent query pattern
+rules.push({
+  id: 'PERF-126', category: 'performance', severity: 'high', confidence: 'likely', title: 'Frequent query on field without explicit index',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      const lines = c.split('\n');
+      for (let i = 0; i < lines.length; i++) {
+        if (/^\s*(\/\/|\/\*|\*)/.test(lines[i])) continue;
+        if (/where\s*:\s*\{.*(?:email|username|slug|handle)\s*:/i.test(lines[i])) {
+          if (!/@@index|createIndex|index:\s*true|@Index/i.test(c)) {
+            findings.push({ ruleId: 'PERF-126', category: 'performance', severity: 'high', title: 'Query by email/username/slug without index — full table scan', description: 'Frequently queried fields like email, username, and slug should have database indexes to avoid sequential scans.', file: fp, line: i + 1, fix: null });
+          }
+        }
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-127: Unbuffered large file read
+rules.push({
+  id: 'PERF-127', category: 'performance', severity: 'medium', confidence: 'likely', title: 'Large file read into memory with readFileSync',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      const lines = c.split('\n');
+      for (let i = 0; i < lines.length; i++) {
+        if (/^\s*(\/\/|\/\*|\*)/.test(lines[i])) continue;
+        if (/fs\.readFileSync\s*\(/.test(lines[i])) {
+          const ctx = lines.slice(Math.max(0, i - 5), i).join('\n');
+          if (/router\.|app\.(get|post)|handler|async\s*\(req/.test(ctx)) {
+            findings.push({ ruleId: 'PERF-127', category: 'performance', severity: 'medium', title: 'readFileSync in request handler — blocks event loop and loads entire file into memory', description: 'Use fs.createReadStream() to pipe large files to the response, or fs.readFile() for async reads.', file: fp, line: i + 1, fix: null });
+          }
+        }
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-128: Unoptimized image without lazy loading
+rules.push({
+  id: 'PERF-128', category: 'performance', severity: 'medium', confidence: 'likely', title: 'Image tag without loading="lazy"',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!fp.match(/\.(jsx|tsx|html)$/)) continue;
+      const lines = c.split('\n');
+      for (let i = 0; i < lines.length; i++) {
+        if (/^\s*(\/\/|\/\*|\*)/.test(lines[i])) continue;
+        if (/<img\b/.test(lines[i]) && !/loading\s*=|priority|eager/i.test(lines[i])) {
+          const ctx = lines.slice(i, Math.min(lines.length, i + 3)).join(' ');
+          if (!/loading\s*=/.test(ctx)) {
+            findings.push({ ruleId: 'PERF-128', category: 'performance', severity: 'medium', title: '<img> without loading="lazy" — images loaded even when off-screen', description: 'Add loading="lazy" to below-fold images to defer loading until they\'re near the viewport, reducing initial page load time.', file: fp, line: i + 1, fix: null });
+          }
+        }
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-129: Missing cache-control headers
+rules.push({
+  id: 'PERF-129', category: 'performance', severity: 'medium', confidence: 'likely', title: 'Static file served without Cache-Control header',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      if (!c.match(/express\.static|sendFile|res\.send.*\.js|res\.send.*\.css/i)) continue;
+      if (!c.match(/Cache-Control|cacheControl|maxAge|cache-control/i)) {
+        findings.push({ ruleId: 'PERF-129', category: 'performance', severity: 'medium', title: 'Static assets without Cache-Control header — no browser caching', description: 'Set Cache-Control: max-age=31536000, immutable for versioned static assets to enable browser caching and reduce repeated downloads.', file: fp, fix: null });
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-130: Multiple React context consumers causing re-renders
+rules.push({
+  id: 'PERF-130', category: 'performance', severity: 'medium', confidence: 'likely', title: 'Component consuming multiple contexts — may re-render unnecessarily',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!fp.match(/\.(jsx|tsx)$/)) continue;
+      const contextConsumers = (c.match(/useContext\s*\(/g) || []).length;
+      if (contextConsumers > 3) {
+        findings.push({ ruleId: 'PERF-130', category: 'performance', severity: 'medium', title: `Component uses ${contextConsumers} contexts — any context change triggers re-render`, description: 'Consuming many contexts makes a component re-render when any context value changes. Split contexts by update frequency or use memo selectors.', file: fp, fix: null });
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-131: Inefficient Array.includes in hot loop
+rules.push({
+  id: 'PERF-131', category: 'performance', severity: 'low', confidence: 'suggestion', title: 'Array.includes() in tight loop — use Set for O(1) lookup',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      const lines = c.split('\n');
+      let loopDepth = 0;
+      for (let i = 0; i < lines.length; i++) {
+        if (/^\s*(\/\/|\/\*|\*)/.test(lines[i])) continue;
+        if (/\b(?:for|while)\s*\(/.test(lines[i])) loopDepth++;
+        if (/^\s*\}/.test(lines[i]) && loopDepth > 0) loopDepth--;
+        if (loopDepth > 0 && /\w+\s*\.\s*includes\s*\(/.test(lines[i]) && !/String\s*\.\s*prototype|typeof/.test(lines[i])) {
+          findings.push({ ruleId: 'PERF-131', category: 'performance', severity: 'low', title: 'Array.includes() inside loop — O(n) per iteration, use Set for O(1)', description: 'Array.includes() is O(n). For repeated lookups, create a Set once and use Set.has() which is O(1).', file: fp, line: i + 1, fix: null });
+        }
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-132: Inefficient object key enumeration in loop
+rules.push({
+  id: 'PERF-132', category: 'performance', severity: 'low', confidence: 'suggestion', title: 'Object.keys()/values()/entries() in tight loop',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      const lines = c.split('\n');
+      let loopDepth = 0;
+      for (let i = 0; i < lines.length; i++) {
+        if (/^\s*(\/\/|\/\*|\*)/.test(lines[i])) continue;
+        if (/\b(?:for|while)\s*\(/.test(lines[i])) loopDepth++;
+        if (/^\s*\}/.test(lines[i]) && loopDepth > 0) loopDepth--;
+        if (loopDepth > 0 && /Object\.(?:keys|values|entries)\s*\(/.test(lines[i])) {
+          findings.push({ ruleId: 'PERF-132', category: 'performance', severity: 'low', title: 'Object.keys/values/entries() inside loop — allocates new array each iteration', description: 'Calling Object.keys/values/entries() inside a loop creates a new array each time. Cache the result outside the loop.', file: fp, line: i + 1, fix: null });
+        }
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-133: Promise.all not used for independent operations
+rules.push({
+  id: 'PERF-133', category: 'performance', severity: 'medium', confidence: 'likely', title: 'Three or more sequential awaits — consider Promise.all',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      const lines = c.split('\n');
+      for (let i = 0; i < lines.length - 3; i++) {
+        if (/^\s*(\/\/|\/\*|\*)/.test(lines[i])) continue;
+        const isAwait1 = /^\s*(?:const|let)\s+\w+\s*=\s*await\s+/.test(lines[i]);
+        const isAwait2 = /^\s*(?:const|let)\s+\w+\s*=\s*await\s+/.test(lines[i + 1]);
+        const isAwait3 = /^\s*(?:const|let)\s+\w+\s*=\s*await\s+/.test(lines[i + 2]);
+        if (isAwait1 && isAwait2 && isAwait3) {
+          findings.push({ ruleId: 'PERF-133', category: 'performance', severity: 'medium', title: '3+ sequential awaits — use Promise.all() if operations are independent', description: 'Three or more sequential await statements add their latencies. Check if they can run concurrently: const [a, b, c] = await Promise.all([p1, p2, p3]).', file: fp, line: i + 1, fix: null });
+          i += 2;
+        }
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-134: fetch without timeout in critical path
+rules.push({
+  id: 'PERF-134', category: 'performance', severity: 'medium', confidence: 'likely', title: 'fetch() without AbortController timeout',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      const lines = c.split('\n');
+      for (let i = 0; i < lines.length; i++) {
+        if (/^\s*(\/\/|\/\*|\*)/.test(lines[i])) continue;
+        if (/\bfetch\s*\(/.test(lines[i]) && !/AbortController|signal:|timeout:/i.test(lines[i])) {
+          const ctx = lines.slice(Math.max(0, i - 2), Math.min(lines.length, i + 5)).join('\n');
+          if (!/AbortController|signal:|timeout:/i.test(ctx)) {
+            findings.push({ ruleId: 'PERF-134', category: 'performance', severity: 'medium', title: 'fetch() without timeout — hangs indefinitely on slow responses', description: 'Use AbortController with setTimeout to set request timeouts: const controller = new AbortController(); fetch(url, { signal: controller.signal }).', file: fp, line: i + 1, fix: null });
+          }
+        }
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-135: Missing indexes on foreign keys
+rules.push({
+  id: 'PERF-135', category: 'performance', severity: 'high', confidence: 'likely', title: 'Foreign key field without database index',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      if (!/prisma|sequelize|typeorm/i.test(fp) && !/prisma|sequelize|typeorm/i.test(c)) continue;
+      const lines = c.split('\n');
+      for (let i = 0; i < lines.length; i++) {
+        if (/^\s*(\/\/|\/\*|\*)/.test(lines[i])) continue;
+        if (/\w+Id\s*Int|foreignKey\s*:|references\s*:/i.test(lines[i])) {
+          const ctx = lines.slice(Math.max(0, i - 3), Math.min(lines.length, i + 5)).join('\n');
+          if (!/index|@Index|@@index/i.test(ctx)) {
+            findings.push({ ruleId: 'PERF-135', category: 'performance', severity: 'high', title: 'Foreign key field without index — JOIN queries cause full table scans', description: 'Foreign key columns used in JOINs and WHERE clauses should always have database indexes to prevent table scans.', file: fp, line: i + 1, fix: null });
+          }
+        }
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-136 through PERF-162: More performance rules
+
+// PERF-136: Missing pagination cursor
+rules.push({
+  id: 'PERF-136', category: 'performance', severity: 'medium', confidence: 'likely', title: 'Offset-based pagination — use cursor-based for large datasets',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      const lines = c.split('\n');
+      for (let i = 0; i < lines.length; i++) {
+        if (/^\s*(\/\/|\/\*|\*)/.test(lines[i])) continue;
+        if (/\bskip\s*:\s*\w+\s*\*\s*\w+|\bOFFSET\s+\w+\s*\*/.test(lines[i])) {
+          findings.push({ ruleId: 'PERF-136', category: 'performance', severity: 'medium', title: 'Offset pagination (OFFSET × page) gets slower on large tables', description: 'Offset pagination scans all skipped rows. For large tables, use cursor-based pagination: WHERE id > lastCursorId ORDER BY id LIMIT n.', file: fp, line: i + 1, fix: null });
+        }
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-137: Unnecessary await on non-async function
+rules.push({
+  id: 'PERF-137', category: 'performance', severity: 'low', confidence: 'suggestion', title: 'await used on non-promise value — unnecessary micro-task',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      const lines = c.split('\n');
+      for (let i = 0; i < lines.length; i++) {
+        if (/^\s*(\/\/|\/\*|\*)/.test(lines[i])) continue;
+        // Detect await on JSON.parse, Array methods, simple math
+        if (/await\s+(?:JSON\.parse|JSON\.stringify|parseInt|parseFloat|Math\.|Array\.from|Object\.keys)\s*\(/.test(lines[i])) {
+          findings.push({ ruleId: 'PERF-137', category: 'performance', severity: 'low', title: 'await on synchronous function — unnecessary event loop tick', description: 'Awaiting non-promise values is harmless but adds an unnecessary microtask tick. Remove await from synchronous operations.', file: fp, line: i + 1, fix: null });
+        }
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-138: Multiple DOM queries for same element
+rules.push({
+  id: 'PERF-138', category: 'performance', severity: 'low', confidence: 'suggestion', title: 'Same DOM element queried multiple times — cache the reference',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      const domQueries = c.match(/document\.(?:getElementById|querySelector|getElementsByClassName)\s*\(['"][^'"]+['"]\)/g) || [];
+      const queryMap = {};
+      for (const q of domQueries) {
+        queryMap[q] = (queryMap[q] || 0) + 1;
+      }
+      for (const [query, count] of Object.entries(queryMap)) {
+        if (count > 2) {
+          findings.push({ ruleId: 'PERF-138', category: 'performance', severity: 'low', title: `DOM query "${query.slice(0, 50)}" called ${count} times — cache in a variable`, description: 'DOM queries are expensive. Store the result in a variable and reuse it: const el = document.getElementById("id").', file: fp, fix: null });
+        }
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-139: Too many setState calls
+rules.push({
+  id: 'PERF-139', category: 'performance', severity: 'medium', confidence: 'likely', title: 'Multiple setState calls in same function — batch updates',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!fp.match(/\.(jsx|tsx)$/)) continue;
+      const lines = c.split('\n');
+      for (let i = 0; i < lines.length; i++) {
+        if (/^\s*(\/\/|\/\*|\*)/.test(lines[i])) continue;
+        if (/function\s+\w+|=>\s*\{/.test(lines[i])) {
+          const block = lines.slice(i, Math.min(lines.length, i + 20)).join('\n');
+          const setCount = (block.match(/setState\s*\(|set[A-Z]\w+\s*\(/g) || []).length;
+          if (setCount >= 4) {
+            findings.push({ ruleId: 'PERF-139', category: 'performance', severity: 'medium', title: `${setCount} setState calls in handler — causes ${setCount} re-renders`, description: 'Multiple setState calls in React 17- cause multiple re-renders. Batch them into a single setState or use useReducer for complex state updates.', file: fp, line: i + 1, fix: null });
+          }
+        }
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-140: Missing gzip for static file serving
+rules.push({
+  id: 'PERF-140', category: 'performance', severity: 'medium', confidence: 'likely', title: 'Express serving large static files without compression',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      if (/express\.static\s*\(/.test(c) && !/compression|gzip|brotli|zlib/i.test(c)) {
+        findings.push({ ruleId: 'PERF-140', category: 'performance', severity: 'medium', title: 'express.static without compression middleware — uncompressed static assets', description: 'Add compression middleware before express.static: app.use(require("compression")()); Gzip reduces text asset sizes by 60-80%.', file: fp, fix: null });
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-141: Using Array.find then Array.indexOf
+rules.push({
+  id: 'PERF-141', category: 'performance', severity: 'low', confidence: 'suggestion', title: 'Array.find() followed by Array.indexOf() — two passes over same array',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      const lines = c.split('\n');
+      for (let i = 0; i < lines.length - 3; i++) {
+        if (/\.find\s*\(/.test(lines[i])) {
+          const next = lines.slice(i + 1, Math.min(lines.length, i + 4)).join('\n');
+          if (/\.indexOf\s*\(|\.findIndex\s*\(/.test(next)) {
+            findings.push({ ruleId: 'PERF-141', category: 'performance', severity: 'low', title: '.find() then .indexOf()/.findIndex() — use findIndex() for both lookup and index', description: 'Use findIndex() to get both the match result and its index in a single pass.', file: fp, line: i + 1, fix: null });
+          }
+        }
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-142: Missing HTTP/2 support
+rules.push({
+  id: 'PERF-142', category: 'performance', severity: 'low', confidence: 'suggestion', title: 'HTTPS server not using HTTP/2',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      if (/https\.createServer\s*\(|spdy\.createServer/i.test(c) && !/http2|http\/2|spdy|h2/i.test(c)) {
+        findings.push({ ruleId: 'PERF-142', category: 'performance', severity: 'low', title: 'HTTPS server without HTTP/2 — missing multiplexing and header compression', description: 'HTTP/2 provides multiplexing (no head-of-line blocking), header compression, and server push. Use http2.createSecureServer() or a reverse proxy like nginx with HTTP/2.', file: fp, fix: null });
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-143: Logging inside tight loop
+rules.push({
+  id: 'PERF-143', category: 'performance', severity: 'medium', confidence: 'likely', title: 'console.log() inside loop — excessive I/O in hot path',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      const lines = c.split('\n');
+      let loopDepth = 0;
+      for (let i = 0; i < lines.length; i++) {
+        if (/^\s*(\/\/|\/\*|\*)/.test(lines[i])) continue;
+        if (/\b(?:for|while)\s*\(/.test(lines[i])) loopDepth++;
+        if (/^\s*\}/.test(lines[i]) && loopDepth > 0) loopDepth--;
+        if (loopDepth > 0 && /console\.\w+\s*\(|logger\.\w+\s*\(/.test(lines[i])) {
+          findings.push({ ruleId: 'PERF-143', category: 'performance', severity: 'medium', title: 'Logging inside loop — synchronous I/O on every iteration', description: 'Console/logger calls inside loops create excessive I/O. Collect items and log once after the loop, or use a sampling strategy.', file: fp, line: i + 1, fix: null });
+        }
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-144: Blocking DNS lookup in request handler
+rules.push({
+  id: 'PERF-144', category: 'performance', severity: 'high', confidence: 'likely', title: 'Synchronous DNS lookup in request handler',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      const lines = c.split('\n');
+      for (let i = 0; i < lines.length; i++) {
+        if (/dns\.lookupSync\s*\(/.test(lines[i])) findings.push({ ruleId: 'PERF-144', category: 'performance', severity: 'high', title: 'Synchronous DNS lookup blocks the event loop', description: 'Use dns.lookup() with a callback or dns.promises.lookup() for non-blocking DNS resolution.', file: fp, line: i + 1, fix: null });
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-145: Missing database connection pooling (pg)
+rules.push({
+  id: 'PERF-145', category: 'performance', severity: 'high', confidence: 'likely', title: 'pg.Client used instead of pg.Pool — no connection pooling',
+  check({ files, stack }) {
+    if (!stack.dependencies?.['pg']) return [];
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      if (/new\s+Client\s*\(/.test(c) && !/new\s+Pool\s*\(/.test(c)) findings.push({ ruleId: 'PERF-145', category: 'performance', severity: 'high', title: 'Using pg.Client without Pool — creates new DB connection per query', description: 'Use pg.Pool to reuse database connections and avoid connection overhead on every request.', file: fp, fix: null });
+    }
+    return findings;
+  },
+});
+
+// PERF-146: Large JSON payload without streaming
+rules.push({
+  id: 'PERF-146', category: 'performance', severity: 'medium', confidence: 'likely', title: 'JSON.stringify on potentially large object without streaming',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      const lines = c.split('\n');
+      for (let i = 0; i < lines.length; i++) {
+        if (/res\.json\s*\(\s*await\s+\w+\.find\s*\(\s*\)/.test(lines[i])) findings.push({ ruleId: 'PERF-146', category: 'performance', severity: 'medium', title: 'Sending unbounded find() result as JSON — may return large payload', description: 'Add .limit() to database queries before sending as JSON response to prevent memory issues.', file: fp, line: i + 1, fix: null });
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-147: Unnecessary full document update ($set vs full replace)
+rules.push({
+  id: 'PERF-147', category: 'performance', severity: 'medium', confidence: 'likely', title: 'MongoDB full document replacement instead of $set update',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      const lines = c.split('\n');
+      for (let i = 0; i < lines.length; i++) {
+        if (/\.(?:update|updateOne|updateMany)\s*\([^,]+,\s*(?:req\.|body\.|data\.|obj\.)/.test(lines[i]) && !/\$set/.test(lines[i])) findings.push({ ruleId: 'PERF-147', category: 'performance', severity: 'medium', title: 'MongoDB update without $set — replaces entire document', description: 'Use { $set: { field: value } } for partial updates to avoid replacing the full document.', file: fp, line: i + 1, fix: null });
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-148: Unused middleware registered on all routes
+rules.push({
+  id: 'PERF-148', category: 'performance', severity: 'low', confidence: 'suggestion', title: 'Heavy middleware applied to all routes globally',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      if (/app\.use\s*\(\s*(?:multer|sharp|imagemin|pdf)/i.test(c)) findings.push({ ruleId: 'PERF-148', category: 'performance', severity: 'low', title: 'Heavy processing middleware applied globally via app.use()', description: 'Apply resource-intensive middleware only to specific routes that require it.', file: fp, fix: null });
+    }
+    return findings;
+  },
+});
+
+// PERF-149: Synchronous file stat in hot path
+rules.push({
+  id: 'PERF-149', category: 'performance', severity: 'high', confidence: 'likely', title: 'fs.statSync/existsSync in request handler — blocks event loop',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      const lines = c.split('\n');
+      for (let i = 0; i < lines.length; i++) {
+        if (/fs\.(?:statSync|existsSync|accessSync|lstatSync)\s*\(/.test(lines[i])) findings.push({ ruleId: 'PERF-149', category: 'performance', severity: 'high', title: 'Synchronous filesystem operation blocks the event loop', description: 'Use fs.promises.stat(), fs.promises.access() or the callback-based equivalents.', file: fp, line: i + 1, fix: null });
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-150: String split + join in loop instead of replace
+rules.push({
+  id: 'PERF-150', category: 'performance', severity: 'low', confidence: 'suggestion', title: 'String.split().join() in loop — use String.replace() with /g flag',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      const lines = c.split('\n');
+      for (let i = 0; i < lines.length; i++) {
+        if (/\.split\s*\([^)]+\)\.join\s*\(/.test(lines[i]) && /for\s*\(|\.map\s*\(|\.forEach\s*\(/.test(lines[Math.max(0,i-3)] + lines[i])) findings.push({ ruleId: 'PERF-150', category: 'performance', severity: 'low', title: 'split().join() pattern in loop — use replace(/pattern/g) instead', description: 'String.replace() with a global flag is more efficient than split().join() for string replacement.', file: fp, line: i + 1, fix: null });
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-151: Awaiting in forEach callback
+rules.push({
+  id: 'PERF-151', category: 'performance', severity: 'high', confidence: 'likely', title: 'await inside Array.forEach — async not awaited properly',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      const lines = c.split('\n');
+      for (let i = 0; i < lines.length; i++) {
+        if (/\.forEach\s*\(\s*async\s+/.test(lines[i])) findings.push({ ruleId: 'PERF-151', category: 'performance', severity: 'high', title: 'async callback in forEach — async operations not awaited', description: 'Use for...of with await or Promise.all(array.map(async () => {...})) to properly await async operations.', file: fp, line: i + 1, fix: null });
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-152: Recursive function without memoization
+rules.push({
+  id: 'PERF-152', category: 'performance', severity: 'medium', confidence: 'likely', title: 'Recursive function called without memoization',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      const lines = c.split('\n');
+      for (let i = 0; i < lines.length; i++) {
+        const m = lines[i].match(/^(?:function|const)\s+(\w+)\s*(?:=\s*(?:function|\(.*\)\s*=>)|\()/);
+        if (m) {
+          const fname = m[1];
+          const body = lines.slice(i, Math.min(lines.length, i + 30)).join('\n');
+          if (new RegExp(`\\b${fname}\\s*\\(`).test(body.substring(fname.length + 5)) && !/memo|cache|memoize|Map|Set/.test(body)) {
+            findings.push({ ruleId: 'PERF-152', category: 'performance', severity: 'medium', title: `Recursive function '${fname}' without memoization — may cause redundant computation`, description: 'Add memoization for recursive functions with overlapping subproblems to avoid exponential complexity.', file: fp, line: i + 1, fix: null });
+          }
+        }
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-153: Mongoose lean() not used for read-only queries
+rules.push({
+  id: 'PERF-153', category: 'performance', severity: 'medium', confidence: 'likely', title: 'Mongoose query without .lean() for read-only operation',
+  check({ files, stack }) {
+    if (!stack.dependencies?.['mongoose']) return [];
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      const lines = c.split('\n');
+      for (let i = 0; i < lines.length; i++) {
+        if (/\.find\s*\([^)]*\)\s*$/.test(lines[i]) && !/\.lean\s*\(/.test(lines[i]) && !/save|update|remove/.test(lines.slice(i, i+5).join(''))) {
+          findings.push({ ruleId: 'PERF-153', category: 'performance', severity: 'medium', title: 'Mongoose .find() without .lean() — returns full Mongoose documents', description: 'Add .lean() to read-only Mongoose queries to return plain JS objects and improve query performance.', file: fp, line: i + 1, fix: null });
+        }
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-154: Creating Buffer with new Buffer() (deprecated/slow)
+rules.push({
+  id: 'PERF-154', category: 'performance', severity: 'medium', confidence: 'likely', title: 'new Buffer() deprecated — use Buffer.from/alloc/allocUnsafe',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      const lines = c.split('\n');
+      for (let i = 0; i < lines.length; i++) {
+        if (/new\s+Buffer\s*\(/.test(lines[i])) findings.push({ ruleId: 'PERF-154', category: 'performance', severity: 'medium', title: 'new Buffer() is deprecated and insecure — use Buffer.from() or Buffer.alloc()', description: 'Replace new Buffer() with Buffer.from(data), Buffer.alloc(size), or Buffer.allocUnsafe(size).', file: fp, line: i + 1, fix: null });
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-155: Unindexed text search in MongoDB
+rules.push({
+  id: 'PERF-155', category: 'performance', severity: 'high', confidence: 'likely', title: 'MongoDB $regex query without text index — full collection scan',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      const lines = c.split('\n');
+      for (let i = 0; i < lines.length; i++) {
+        if (/\$regex/.test(lines[i]) && /find\s*\(|findOne\s*\(/.test(lines[Math.max(0,i-2)] + lines[i])) findings.push({ ruleId: 'PERF-155', category: 'performance', severity: 'high', title: 'MongoDB $regex without text index causes full collection scan', description: 'Create a text index and use $text search for text searching, or add an index on the field.', file: fp, line: i + 1, fix: null });
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-156: Express response not ended causing memory leak
+rules.push({
+  id: 'PERF-156', category: 'performance', severity: 'high', confidence: 'likely', title: 'Express route handler may not send response in all code paths',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      const lines = c.split('\n');
+      for (let i = 0; i < lines.length; i++) {
+        if (/(?:router|app)\.(?:get|post|put|delete)\s*\([^,]+,\s*(?:async\s+)?\(?(?:req|request)\s*,\s*(?:res|response)\)?/.test(lines[i])) {
+          const body = lines.slice(i, Math.min(lines.length, i + 30)).join('\n');
+          if (!/res\.(?:send|json|end|redirect|render|status|download|sendFile)/.test(body)) {
+            findings.push({ ruleId: 'PERF-156', category: 'performance', severity: 'high', title: 'Route handler may not send a response — request will hang', description: 'Ensure all code paths in route handlers call res.send(), res.json(), res.end(), or next().', file: fp, line: i + 1, fix: null });
+          }
+        }
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-157: useCallback/useMemo missing dependency array
+rules.push({
+  id: 'PERF-157', category: 'performance', severity: 'medium', confidence: 'likely', title: 'useCallback or useMemo without dependency array',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp) || !fp.match(/\.[jt]sx?$/)) continue;
+      const lines = c.split('\n');
+      for (let i = 0; i < lines.length; i++) {
+        if (/(?:useCallback|useMemo)\s*\(\s*(?:async\s+)?\(/.test(lines[i])) {
+          const block = lines.slice(i, Math.min(lines.length, i + 8)).join('\n');
+          if (!/\[\s*(?:\w|,|\s)*\]\s*\)/.test(block)) findings.push({ ruleId: 'PERF-157', category: 'performance', severity: 'medium', title: 'useCallback/useMemo without dependency array — recreated every render', description: 'Add a dependency array as the second argument to useCallback/useMemo.', file: fp, line: i + 1, fix: null });
+        }
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-158: Large bundle — importing entire lodash
+rules.push({
+  id: 'PERF-158', category: 'performance', severity: 'medium', confidence: 'likely', title: 'Importing entire lodash library — increases bundle size',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      if (/require\s*\(\s*['"]lodash['"]\s*\)|from\s+['"]lodash['"]/.test(c) && !/from\s+['"]lodash\//.test(c)) findings.push({ ruleId: 'PERF-158', category: 'performance', severity: 'medium', title: 'Importing all of lodash — use lodash/{function} for tree shaking', description: 'Import individual lodash functions: import debounce from "lodash/debounce" to reduce bundle size.', file: fp, fix: null });
+    }
+    return findings;
+  },
+});
+
+// PERF-159: Too many watchers in Mongoose schema
+rules.push({
+  id: 'PERF-159', category: 'performance', severity: 'medium', confidence: 'likely', title: 'Multiple Mongoose pre/post hooks on same operation',
+  check({ files, stack }) {
+    if (!stack.dependencies?.['mongoose']) return [];
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      const matches = c.match(/\.pre\s*\(\s*['"]save['"]/g) || [];
+      if (matches.length > 3) findings.push({ ruleId: 'PERF-159', category: 'performance', severity: 'medium', title: `${matches.length} Mongoose pre('save') hooks — consolidate for performance`, description: 'Multiple pre-save hooks increase save latency. Consolidate into a single hook where possible.', file: fp, fix: null });
+    }
+    return findings;
+  },
+});
+
+// PERF-160: Missing HTTP response caching headers
+rules.push({
+  id: 'PERF-160', category: 'performance', severity: 'low', confidence: 'suggestion', title: 'Static API endpoint without Cache-Control header',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      const lines = c.split('\n');
+      for (let i = 0; i < lines.length; i++) {
+        if (/(?:router|app)\.get\s*\(\s*['"`][^'"`]*(?:\/list|\/all|\/config|\/settings)['"` ]/.test(lines[i])) {
+          const block = lines.slice(i, Math.min(lines.length, i + 15)).join('\n');
+          if (!/Cache-Control|cache-control|setHeader.*cache|etag/i.test(block)) findings.push({ ruleId: 'PERF-160', category: 'performance', severity: 'low', title: 'GET endpoint without Cache-Control header — responses not cached', description: 'Add Cache-Control headers to static/list endpoints to enable browser and proxy caching.', file: fp, line: i + 1, fix: null });
+        }
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-161: Multiple render cycles from state updates in React
+rules.push({
+  id: 'PERF-161', category: 'performance', severity: 'medium', confidence: 'likely', title: 'Sequential useState calls causing multiple re-renders',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp) || !fp.match(/\.[jt]sx?$/)) continue;
+      const lines = c.split('\n');
+      for (let i = 0; i < lines.length; i++) {
+        const setter = lines[i].match(/\bset([A-Z]\w+)\s*\(/);
+        if (setter && i + 1 < lines.length) {
+          const nextSetter = lines[i+1].match(/\bset([A-Z]\w+)\s*\(/);
+          if (nextSetter && setter[1] !== nextSetter[1]) {
+            findings.push({ ruleId: 'PERF-161', category: 'performance', severity: 'medium', title: 'Consecutive setState calls — consider combining into a single useReducer', description: 'Multiple sequential state updates cause multiple re-renders. Use useReducer or batch updates.', file: fp, line: i + 1, fix: null });
+          }
+        }
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-162: Heavy computation in component render without worker
+rules.push({
+  id: 'PERF-162', category: 'performance', severity: 'medium', confidence: 'likely', title: 'Cryptographic or heavy computation in React render — blocks UI',
+  check({ files }) {
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp) || !fp.match(/\.[jt]sx?$/)) continue;
+      if (/(?:crypto\.subtle|pbkdf2|scrypt|argon2|bcrypt)/.test(c) && /return\s*\(|React\.createElement/.test(c)) {
+        findings.push({ ruleId: 'PERF-162', category: 'performance', severity: 'medium', title: 'Heavy cryptographic computation in React component — moves it to a Web Worker', description: 'Offload CPU-intensive operations to a Web Worker to prevent blocking the main thread.', file: fp, fix: null });
+      }
+    }
+    return findings;
+  },
+});
+
+// PERF-163: Prisma N+1 without include
+rules.push({
+  id: 'PERF-163', category: 'performance', severity: 'high', confidence: 'definite', title: 'Prisma query inside loop without include — N+1 query pattern',
+  check({ files, stack }) {
+    if (!stack.dependencies?.['@prisma/client']) return [];
+    const findings = [];
+    for (const [fp, c] of files) {
+      if (!isSourceFile(fp)) continue;
+      const lines = c.split('\n');
+      let inLoop = false;
+      for (let i = 0; i < lines.length; i++) {
+        if (/for\s*\(|\.map\s*\(|\.forEach\s*\(/.test(lines[i])) inLoop = true;
+        if (inLoop && /prisma\.\w+\.findUnique\s*\(|prisma\.\w+\.findFirst\s*\(/.test(lines[i])) {
+          findings.push({ ruleId: 'PERF-163', category: 'performance', severity: 'high', title: 'Prisma findUnique/findFirst inside loop — N+1 queries', description: 'Use prisma.findMany with where: { id: { in: ids } } or include related data with include option.', file: fp, line: i + 1, fix: null });
+        }
+        if (/^\s*\}/.test(lines[i])) inLoop = false;
+      }
+    }
+    return findings;
+  },
+});