@aws/cloudformation-validate 1.9.0-beta → 1.10.0

package/bindings_wasm.d.ts

@@ -358,6 +358,53 @@ export interface ReferenceEdge {
     conditionContext?: string;
 }
 
+/**
+ * A single validation finding in the public report shape: the targeted entity is
+ * carried as a nested `entity` struct and the source location is flattened into
+ * individual line/column fields. The enrichment fields - `documentation_url`,
+ * `rule_description`, `phase`, and `context` - are carried only when a report is
+ * projected at the `DETAILED` detail level; the `STANDARD` detail level leaves them
+ * `None`, so they are omitted from serialization.
+ */
+export interface Diagnostic {
+    /**
+     * Identifier of the rule that produced this finding; its leading letter encodes the severity.
+     */
+    ruleId: string;
+    severity: Severity;
+    message: string;
+    /**
+     * Where the rule came from, such as a provider schema, the built-in engine, or a user-supplied rule.
+     */
+    source: RuleOrigin;
+    /**
+     * The named template entity this finding targets - a resource, parameter, output, mapping, condition, or template rule - if any.
+     */
+    entity?: Entity;
+    /**
+     * Path to the offending property within the resource, such as \'Properties.Name\'.
+     */
+    propertyPath?: string;
+    suggestedFix?: string;
+    category?: string;
+    /**
+     * Line in the source template where the finding begins (1-based).
+     */
+    startLine?: number;
+    startColumn?: number;
+    endLine?: number;
+    endColumn?: number;
+    relatedResources?: RelatedResource[];
+    /**
+     * Condition name to boolean assignment under which this finding applies, when it depends on template conditions.
+     */
+    conditionScenario?: Record<string, boolean>;
+    documentationUrl?: string;
+    ruleDescription?: string;
+    phase?: Phase;
+    context?: ViolationContext;
+}
+
 /**
  * A template Parameter\'s declaration: its type, constraints (allowed values/pattern,
  * length and value bounds), default, and description.
@@ -626,6 +673,41 @@ export interface RelatedResource {
     message: string;
 }
 
+/**
+ * Configuration for a composite engine that evaluates the built-in rules with
+ * one engine and caller-supplied external rules with another.
+ *
+ * The built-in rules are always evaluated, so this config only carries the
+ * external rules layered on top plus the shared schema configuration. Custom
+ * rules can be supplied in all three formats: Rego rules are evaluated by the
+ * external engine, while CEL custom rules and Guard rules are evaluated by the
+ * engine that owns the built-ins. It has no field for engine-native built-in
+ * custom rules because the composite fixes which engine owns the built-ins.
+ */
+export interface CompositeEngineConfig {
+    /**
+     * Custom Rego rules layered on top of the built-in rules.
+     */
+    regoRules?: ExternalRuleSource[];
+    /**
+     * Custom CEL rules layered on top of the built-in rules. They are evaluated
+     * by the same engine that owns the built-ins, since CEL custom rules are a
+     * CEL-engine feature.
+     */
+    celRules?: ExternalRuleSource[];
+    /**
+     * Guard DSL rules as raw source text, layered on top of the built-in rules.
+     */
+    guardRules?: ExternalRuleSource[];
+    /**
+     * Optional schema validator configuration. A standalone engine derives its
+     * schema-aware rule metadata from this config. Language APIs also use it to
+     * construct the schema validator bundled with the engine, so both components
+     * observe the same additional schemas.
+     */
+    schemaValidatorConfig?: SchemaValidatorConfig;
+}
+
 /**
  * Configuration for constructing a [`SchemaValidator`] with optional overlay
  * schemas. Bindings and the CLI use this to build the validator separately from
@@ -645,19 +727,7 @@ export interface SchemaValidatorConfig {
 export type DetailLevel = 'STANDARD' | 'DETAILED';
 
 /**
- * Detailed validation result: like the standard report but with per-diagnostic context and enrichment.
- */
-export interface DetailedReport {
-    filePath: string;
-    status: ReportStatus;
-    version: string;
-    metadata: ReportMetadata;
-    performance: PerformanceMetrics;
-    diagnostics: DetailedDiagnostic[];
-}
-
-/**
- * Extra detail about a specific violation, present only in the detailed report.
+ * Extra detail about a specific violation, present only at the `DETAILED` detail level.
  */
 export interface ViolationContext {
     /**
@@ -788,19 +858,7 @@ export interface ResolutionSource {
 /**
  * Selects which validation engine evaluates rules.
  */
-export type EngineType = 'REGO' | 'CEL';
-
-/**
- * Standard validation result: the report plus flattened diagnostics.
- */
-export interface StandardReport {
-    filePath: string;
-    status: ReportStatus;
-    version: string;
-    metadata: ReportMetadata;
-    performance: PerformanceMetrics;
-    diagnostics: StandardDiagnostic[];
-}
+export type EngineType = 'REGO' | 'CEL' | 'COMPOSITE';
 
 /**
  * Suppress a rule for a specific logical resource ID. An absent `rule_id`
@@ -885,6 +943,20 @@ export interface Entity {
     resourceType?: string;
 }
 
+/**
+ * The serializable validation result: report metadata, performance metrics, and
+ * the flattened diagnostics. The per-diagnostic enrichment fields are present only
+ * when the report is projected at the `DETAILED` detail level.
+ */
+export interface ValidationReport {
+    filePath: string;
+    status: ReportStatus;
+    version: string;
+    metadata: ReportMetadata;
+    performance: PerformanceMetrics;
+    diagnostics: Diagnostic[];
+}
+
 /**
  * The template resource a diagnostic is attributed to, when it targets one.
  */
@@ -965,86 +1037,6 @@ export interface PseudoParameterOverrides {
  */
 export type RuleOrigin = 'SCHEMA' | 'CFN_LINT' | 'ENGINE' | 'CUSTOM' | 'GUARD';
 
-/**
- *r" A single validation finding with its source location flattened into individual fields.
- */
-export interface StandardDiagnostic {
-    /**
-     * Identifier of the rule that produced this finding; its leading letter encodes the severity.
-     */
-    ruleId: string;
-    severity: Severity;
-    message: string;
-    /**
-     * Where the rule came from, such as a provider schema, the built-in engine, or a user-supplied rule.
-     */
-    source: RuleOrigin;
-    /**
-     * The named template entity this finding targets - a resource, parameter, output, mapping, condition, or template rule - if any.
-     */
-    entity?: Entity;
-    /**
-     * Path to the offending property within the resource, such as \'Properties.Name\'.
-     */
-    propertyPath?: string;
-    suggestedFix?: string;
-    category?: string;
-    /**
-     * Line in the source template where the finding begins (1-based).
-     */
-    startLine?: number;
-    startColumn?: number;
-    endLine?: number;
-    endColumn?: number;
-    relatedResources?: RelatedResource[];
-    /**
-     * Condition name to boolean assignment under which this finding applies, when it depends on template conditions.
-     */
-    conditionScenario?: Record<string, boolean>;
-}
-
-/**
- *r" A validation finding with additional context and enrichment beyond the standard finding.
- */
-export interface DetailedDiagnostic {
-    /**
-     * Identifier of the rule that produced this finding; its leading letter encodes the severity.
-     */
-    ruleId: string;
-    severity: Severity;
-    message: string;
-    /**
-     * Where the rule came from, such as a provider schema, the built-in engine, or a user-supplied rule.
-     */
-    source: RuleOrigin;
-    /**
-     * The named template entity this finding targets - a resource, parameter, output, mapping, condition, or template rule - if any.
-     */
-    entity?: Entity;
-    /**
-     * Path to the offending property within the resource, such as \'Properties.Name\'.
-     */
-    propertyPath?: string;
-    suggestedFix?: string;
-    category?: string;
-    /**
-     * Line in the source template where the finding begins (1-based).
-     */
-    startLine?: number;
-    startColumn?: number;
-    endLine?: number;
-    endColumn?: number;
-    relatedResources?: RelatedResource[];
-    /**
-     * Condition name to boolean assignment under which this finding applies, when it depends on template conditions.
-     */
-    conditionScenario?: Record<string, boolean>;
-    documentationUrl?: string;
-    ruleDescription?: string;
-    phase?: Phase;
-    context?: ViolationContext;
-}
-
 export interface EngineConfig {
     /**
      * Engine-native custom rules (Rego or CEL depending on engine).
@@ -1116,6 +1108,7 @@ export interface Summary {
 export interface ValidateConfig {
     include?: RuleFilterConfig;
     exclude?: RuleFilterConfig;
+    detailLevel?: DetailLevel;
     severityLevel?: Severity;
     parameterOverrides?: Record<string, string>;
     pseudoParameterOverrides?: PseudoParameterOverrides;
@@ -1124,7 +1117,7 @@ export interface ValidateConfig {
 }
 
 export interface WasmSchemaValidationResult {
-    diagnostics: StandardDiagnostic[];
+    diagnostics: Diagnostic[];
     metric: PhaseMetric;
 }
 
@@ -1136,8 +1129,18 @@ export class WasmCelEngine {
     engineName(): string;
     listRules(): any;
     constructor(config: EngineConfig);
-    validateDetailed(template: Uint8Array, options: ValidateConfig, file_path: string): any;
-    validateStandard(template: Uint8Array, options: ValidateConfig, file_path: string): any;
+    validateAwsCliCommand(request: any): any;
+    validateTemplate(template: Uint8Array, options: ValidateConfig, file_path: string): any;
+}
+
+export class WasmCompositeEngine {
+    free(): void;
+    [Symbol.dispose](): void;
+    engineName(): string;
+    listRules(): any;
+    constructor(config: CompositeEngineConfig);
+    validateAwsCliCommand(request: any): any;
+    validateTemplate(template: Uint8Array, options: ValidateConfig, file_path: string): any;
 }
 
 export class WasmRegoEngine {
@@ -1146,8 +1149,8 @@ export class WasmRegoEngine {
     engineName(): string;
     listRules(): any;
     constructor(config: EngineConfig);
-    validateDetailed(template: Uint8Array, options: ValidateConfig, file_path: string): any;
-    validateStandard(template: Uint8Array, options: ValidateConfig, file_path: string): any;
+    validateAwsCliCommand(request: any): any;
+    validateTemplate(template: Uint8Array, options: ValidateConfig, file_path: string): any;
 }
 
 export class WasmSchemaValidator {

package/bindings_wasm.js

@@ -48,18 +48,92 @@ class WasmCelEngine {
         WasmCelEngineFinalization.register(this, this.__wbg_ptr, this);
         return this;
     }
+    /**
+     * @param {any} request
+     * @returns {any}
+     */
+    validateAwsCliCommand(request) {
+        const ret = wasm.wasmcelengine_validateAwsCliCommand(this.__wbg_ptr, request);
+        if (ret[2]) {
+            throw takeFromExternrefTable0(ret[1]);
+        }
+        return takeFromExternrefTable0(ret[0]);
+    }
     /**
      * @param {Uint8Array} template
      * @param {ValidateConfig} options
      * @param {string} file_path
      * @returns {any}
      */
-    validateDetailed(template, options, file_path) {
+    validateTemplate(template, options, file_path) {
         const ptr0 = passArray8ToWasm0(template, wasm.__wbindgen_malloc);
         const len0 = WASM_VECTOR_LEN;
         const ptr1 = passStringToWasm0(file_path, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
         const len1 = WASM_VECTOR_LEN;
-        const ret = wasm.wasmcelengine_validateDetailed(this.__wbg_ptr, ptr0, len0, options, ptr1, len1);
+        const ret = wasm.wasmcelengine_validateTemplate(this.__wbg_ptr, ptr0, len0, options, ptr1, len1);
+        if (ret[2]) {
+            throw takeFromExternrefTable0(ret[1]);
+        }
+        return takeFromExternrefTable0(ret[0]);
+    }
+}
+if (Symbol.dispose) WasmCelEngine.prototype[Symbol.dispose] = WasmCelEngine.prototype.free;
+exports.WasmCelEngine = WasmCelEngine;
+
+class WasmCompositeEngine {
+    __destroy_into_raw() {
+        const ptr = this.__wbg_ptr;
+        this.__wbg_ptr = 0;
+        WasmCompositeEngineFinalization.unregister(this);
+        return ptr;
+    }
+    free() {
+        const ptr = this.__destroy_into_raw();
+        wasm.__wbg_wasmcompositeengine_free(ptr, 0);
+    }
+    /**
+     * @returns {string}
+     */
+    engineName() {
+        let deferred1_0;
+        let deferred1_1;
+        try {
+            const ret = wasm.wasmcompositeengine_engineName(this.__wbg_ptr);
+            deferred1_0 = ret[0];
+            deferred1_1 = ret[1];
+            return getStringFromWasm0(ret[0], ret[1]);
+        } finally {
+            wasm.__wbindgen_free(deferred1_0, deferred1_1, 1);
+        }
+    }
+    /**
+     * @returns {any}
+     */
+    listRules() {
+        const ret = wasm.wasmcompositeengine_listRules(this.__wbg_ptr);
+        if (ret[2]) {
+            throw takeFromExternrefTable0(ret[1]);
+        }
+        return takeFromExternrefTable0(ret[0]);
+    }
+    /**
+     * @param {CompositeEngineConfig} config
+     */
+    constructor(config) {
+        const ret = wasm.wasmcompositeengine_new(config);
+        if (ret[2]) {
+            throw takeFromExternrefTable0(ret[1]);
+        }
+        this.__wbg_ptr = ret[0];
+        WasmCompositeEngineFinalization.register(this, this.__wbg_ptr, this);
+        return this;
+    }
+    /**
+     * @param {any} request
+     * @returns {any}
+     */
+    validateAwsCliCommand(request) {
+        const ret = wasm.wasmcompositeengine_validateAwsCliCommand(this.__wbg_ptr, request);
         if (ret[2]) {
             throw takeFromExternrefTable0(ret[1]);
         }
@@ -71,20 +145,20 @@ class WasmCelEngine {
      * @param {string} file_path
      * @returns {any}
      */
-    validateStandard(template, options, file_path) {
+    validateTemplate(template, options, file_path) {
         const ptr0 = passArray8ToWasm0(template, wasm.__wbindgen_malloc);
         const len0 = WASM_VECTOR_LEN;
         const ptr1 = passStringToWasm0(file_path, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
         const len1 = WASM_VECTOR_LEN;
-        const ret = wasm.wasmcelengine_validateStandard(this.__wbg_ptr, ptr0, len0, options, ptr1, len1);
+        const ret = wasm.wasmcompositeengine_validateTemplate(this.__wbg_ptr, ptr0, len0, options, ptr1, len1);
         if (ret[2]) {
             throw takeFromExternrefTable0(ret[1]);
         }
         return takeFromExternrefTable0(ret[0]);
     }
 }
-if (Symbol.dispose) WasmCelEngine.prototype[Symbol.dispose] = WasmCelEngine.prototype.free;
-exports.WasmCelEngine = WasmCelEngine;
+if (Symbol.dispose) WasmCompositeEngine.prototype[Symbol.dispose] = WasmCompositeEngine.prototype.free;
+exports.WasmCompositeEngine = WasmCompositeEngine;
 
 class WasmRegoEngine {
     __destroy_into_raw() {
@@ -135,17 +209,11 @@ class WasmRegoEngine {
         return this;
     }
     /**
-     * @param {Uint8Array} template
-     * @param {ValidateConfig} options
-     * @param {string} file_path
+     * @param {any} request
      * @returns {any}
      */
-    validateDetailed(template, options, file_path) {
-        const ptr0 = passArray8ToWasm0(template, wasm.__wbindgen_malloc);
-        const len0 = WASM_VECTOR_LEN;
-        const ptr1 = passStringToWasm0(file_path, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
-        const len1 = WASM_VECTOR_LEN;
-        const ret = wasm.wasmregoengine_validateDetailed(this.__wbg_ptr, ptr0, len0, options, ptr1, len1);
+    validateAwsCliCommand(request) {
+        const ret = wasm.wasmregoengine_validateAwsCliCommand(this.__wbg_ptr, request);
         if (ret[2]) {
             throw takeFromExternrefTable0(ret[1]);
         }
@@ -157,12 +225,12 @@ class WasmRegoEngine {
      * @param {string} file_path
      * @returns {any}
      */
-    validateStandard(template, options, file_path) {
+    validateTemplate(template, options, file_path) {
         const ptr0 = passArray8ToWasm0(template, wasm.__wbindgen_malloc);
         const len0 = WASM_VECTOR_LEN;
         const ptr1 = passStringToWasm0(file_path, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
         const len1 = WASM_VECTOR_LEN;
-        const ret = wasm.wasmregoengine_validateStandard(this.__wbg_ptr, ptr0, len0, options, ptr1, len1);
+        const ret = wasm.wasmregoengine_validateTemplate(this.__wbg_ptr, ptr0, len0, options, ptr1, len1);
         if (ret[2]) {
             throw takeFromExternrefTable0(ret[1]);
         }
@@ -401,6 +469,12 @@ function __wbg_get_imports() {
             getDataViewMemory0().setInt32(arg0 + 4 * 1, len1, true);
             getDataViewMemory0().setInt32(arg0 + 4 * 0, ptr1, true);
         },
+        __wbg___wbindgen_bigint_get_as_i64_d968e41184ae354f: function (arg0, arg1) {
+            const v = arg1;
+            const ret = typeof v === 'bigint' ? v : undefined;
+            getDataViewMemory0().setBigInt64(arg0 + 8 * 1, isLikeNone(ret) ? BigInt(0) : ret, true);
+            getDataViewMemory0().setInt32(arg0 + 4 * 0, !isLikeNone(ret), true);
+        },
         __wbg___wbindgen_boolean_get_fa956cfa2d1bd751: function (arg0) {
             const v = arg0;
             const ret = typeof v === 'boolean' ? v : undefined;
@@ -417,6 +491,10 @@ function __wbg_get_imports() {
             const ret = arg0 in arg1;
             return ret;
         },
+        __wbg___wbindgen_is_bigint_2f76dc55065b4273: function (arg0) {
+            const ret = typeof arg0 === 'bigint';
+            return ret;
+        },
         __wbg___wbindgen_is_function_1ff95bcc5517c252: function (arg0) {
             const ret = typeof arg0 === 'function';
             return ret;
@@ -434,6 +512,10 @@ function __wbg_get_imports() {
             const ret = arg0 === undefined;
             return ret;
         },
+        __wbg___wbindgen_jsval_eq_e659fcf7b0e32763: function (arg0, arg1) {
+            const ret = arg0 === arg1;
+            return ret;
+        },
         __wbg___wbindgen_jsval_loose_eq_db4c3b15f63fc170: function (arg0, arg1) {
             const ret = arg0 == arg1;
             return ret;
@@ -485,6 +567,10 @@ function __wbg_get_imports() {
                 globalThis.crypto.getRandomValues(getArrayU8FromWasm0(arg0, arg1));
             }, arguments);
         },
+        __wbg_getTime_d6f070c088c9b5ed: function (arg0) {
+            const ret = arg0.getTime();
+            return ret;
+        },
         __wbg_get_507a50627bffa49b: function (arg0, arg1) {
             const ret = arg0[arg1 >>> 0];
             return ret;
@@ -513,6 +599,16 @@ function __wbg_get_imports() {
             const ret = result;
             return ret;
         },
+        __wbg_instanceof_Map_e5b5e3db98422fcc: function (arg0) {
+            let result;
+            try {
+                result = arg0 instanceof Map;
+            } catch (_) {
+                result = false;
+            }
+            const ret = result;
+            return ret;
+        },
         __wbg_instanceof_Uint8Array_309b927aaf7a3fc7: function (arg0) {
             let result;
             try {
@@ -543,6 +639,10 @@ function __wbg_get_imports() {
             const ret = arg0.length;
             return ret;
         },
+        __wbg_new_0_3da9e97f24fc69be: function () {
+            const ret = new Date();
+            return ret;
+        },
         __wbg_new_227d7c05414eb861: function () {
             const ret = new Error();
             return ret;
@@ -661,6 +761,10 @@ const WasmCelEngineFinalization =
     typeof FinalizationRegistry === 'undefined'
         ? { register: () => {}, unregister: () => {} }
         : new FinalizationRegistry((ptr) => wasm.__wbg_wasmcelengine_free(ptr, 1));
+const WasmCompositeEngineFinalization =
+    typeof FinalizationRegistry === 'undefined'
+        ? { register: () => {}, unregister: () => {} }
+        : new FinalizationRegistry((ptr) => wasm.__wbg_wasmcompositeengine_free(ptr, 1));
 const WasmRegoEngineFinalization =
     typeof FinalizationRegistry === 'undefined'
         ? { register: () => {}, unregister: () => {} }

package/bindings_wasm_bg.wasm.d.ts

@@ -2,6 +2,7 @@
 /* eslint-disable */
 export const memory: WebAssembly.Memory;
 export const __wbg_wasmcelengine_free: (a: number, b: number) => void;
+export const __wbg_wasmcompositeengine_free: (a: number, b: number) => void;
 export const __wbg_wasmregoengine_free: (a: number, b: number) => void;
 export const __wbg_wasmschemavalidator_free: (a: number, b: number) => void;
 export const __wbg_wasmsemanticmodel_free: (a: number, b: number) => void;
@@ -10,7 +11,8 @@ export const version: () => [number, number];
 export const wasmcelengine_engineName: (a: number) => [number, number];
 export const wasmcelengine_listRules: (a: number) => [number, number, number];
 export const wasmcelengine_new: (a: any) => [number, number, number];
-export const wasmcelengine_validateDetailed: (
+export const wasmcelengine_validateAwsCliCommand: (a: number, b: any) => [number, number, number];
+export const wasmcelengine_validateTemplate: (
     a: number,
     b: number,
     c: number,
@@ -18,7 +20,11 @@ export const wasmcelengine_validateDetailed: (
     e: number,
     f: number,
 ) => [number, number, number];
-export const wasmcelengine_validateStandard: (
+export const wasmcompositeengine_engineName: (a: number) => [number, number];
+export const wasmcompositeengine_listRules: (a: number) => [number, number, number];
+export const wasmcompositeengine_new: (a: any) => [number, number, number];
+export const wasmcompositeengine_validateAwsCliCommand: (a: number, b: any) => [number, number, number];
+export const wasmcompositeengine_validateTemplate: (
     a: number,
     b: number,
     c: number,
@@ -29,15 +35,8 @@ export const wasmcelengine_validateStandard: (
 export const wasmregoengine_engineName: (a: number) => [number, number];
 export const wasmregoengine_listRules: (a: number) => [number, number, number];
 export const wasmregoengine_new: (a: any) => [number, number, number];
-export const wasmregoengine_validateDetailed: (
-    a: number,
-    b: number,
-    c: number,
-    d: any,
-    e: number,
-    f: number,
-) => [number, number, number];
-export const wasmregoengine_validateStandard: (
+export const wasmregoengine_validateAwsCliCommand: (a: number, b: any) => [number, number, number];
+export const wasmregoengine_validateTemplate: (
     a: number,
     b: number,
     c: number,