regula-wasi 3.2.2 → 3.2.4

package/README.md

@@ -79,6 +79,9 @@ const result = await runRegula('./main.tf', {
   include: ['./custom-rules/'],
   only: ['FG_R00229'],       // Only run specific rules
   exclude: ['FG_R00100'],    // Exclude specific rules
+  noBuiltIns: false,         // Disable built-in rules (use only custom rules)
+  noIgnore: false,           // Disable .gitignore filtering
+  varFiles: ['./prod.tfvars'], // Terraform variable files
 });
 
 // Check for failures
@@ -88,6 +91,18 @@ if (result.summary.rule_results.FAIL > 0) {
 }
 ```
 
+#### API Options
+
+| Option | Type | Description |
+|--------|------|-------------|
+| `inputType` | string | Input type: `auto`, `tf`, `tf-plan`, `cfn`, `k8s`, `arm` |
+| `include` | string[] | Additional rego rule files/directories to include |
+| `only` | string[] | Only run these specific rule IDs |
+| `exclude` | string[] | Exclude these specific rule IDs |
+| `noBuiltIns` | boolean | Disable built-in rules (use only custom rules from `include`) |
+| `noIgnore` | boolean | Disable .gitignore filtering |
+| `varFiles` | string[] | Terraform variable files (.tfvars) to use |
+
 ### Prebuilt Binary
 
 Download from [Releases](https://github.com/nonfx/regula/releases) for your platform.

package/cli.js

@@ -10,6 +10,9 @@ const __dirname = dirname(__filename);
 
 const args = process.argv.slice(2);
 
+// Note: preopens "/" is required because regula needs to read IaC files from
+// any path the user specifies (including absolute paths like /home/user/terraform/).
+// This is expected behavior for a CLI tool that processes user-specified file paths.
 const wasi = new WASI({
   version: "preview1",
   args: ["regula", ...args],

package/index.d.ts

@@ -0,0 +1,94 @@
+export interface RegulaOptions {
+  /** Input type: auto, tf, tf-plan, cfn, k8s, arm */
+  inputType?: "auto" | "tf" | "tf-plan" | "cfn" | "k8s" | "arm";
+  /** Additional rego rule files/directories to include */
+  include?: string | string[];
+  /** Only run these specific rule IDs */
+  only?: string | string[];
+  /** Exclude these specific rule IDs */
+  exclude?: string | string[];
+  /** Disable built-in rules (use only custom rules from include) */
+  noBuiltIns?: boolean;
+  /** Disable .gitignore filtering */
+  noIgnore?: boolean;
+  /** Terraform variable files (.tfvars) to use */
+  varFiles?: string | string[];
+}
+
+export interface SourceLocation {
+  path: string;
+  line: number;
+  column: number;
+}
+
+export interface RuleResult {
+  controls: string[];
+  families: string[];
+  filepath: string;
+  input_type: string;
+  provider: string;
+  resource_id: string;
+  resource_type: string;
+  resource_tags: Record<string, unknown>;
+  rule_description: string;
+  rule_id: string;
+  rule_message: string;
+  rule_name: string;
+  rule_raw_result: boolean;
+  rule_remediation_doc?: string;
+  rule_result: "PASS" | "FAIL" | "WAIVED";
+  rule_severity: "Unknown" | "Informational" | "Low" | "Medium" | "High" | "Critical";
+  rule_summary: string;
+  source_location?: SourceLocation[];
+  active_waivers?: string[];
+}
+
+export interface RegulaResult {
+  rule_results: RuleResult[];
+  summary: {
+    filepaths: string[];
+    rule_results: {
+      PASS: number;
+      FAIL: number;
+      WAIVED: number;
+    };
+    severities: {
+      Unknown: number;
+      Informational: number;
+      Low: number;
+      Medium: number;
+      High: number;
+      Critical: number;
+    };
+  };
+}
+
+/**
+ * Run regula on the specified path(s) and return parsed JSON results.
+ * @param paths - Path(s) to IaC files or directories
+ * @param options - Optional configuration
+ * @returns Parsed regula output with rule_results and summary
+ */
+export function runRegula(
+  paths: string | string[],
+  options?: RegulaOptions
+): Promise<RegulaResult>;
+
+/**
+ * Validate IaC files and return rule results.
+ * Alias for runRegula().
+ * @param paths - Path(s) to IaC files or directories
+ * @param options - Optional configuration
+ * @returns Object with rule_results and summary
+ */
+export function validate(
+  paths: string | string[],
+  options?: RegulaOptions
+): Promise<RegulaResult>;
+
+declare const _default: {
+  runRegula: typeof runRegula;
+  validate: typeof validate;
+};
+
+export default _default;

package/index.js

@@ -6,19 +6,22 @@ const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 
 /**
- * Run regula on the specified path(s)
+ * Run regula on the specified path(s) and return parsed JSON results.
  * @param {string|string[]} paths - Path(s) to IaC files or directories
  * @param {Object} options - Optional configuration
  * @param {string} options.inputType - Input type: auto, tf, tf-plan, cfn, k8s, arm
- * @param {string} options.format - Output format: json, text, table, sarif, junit, tap
  * @param {string[]} options.include - Additional rego files to include
  * @param {string[]} options.only - Only run specific rules
  * @param {string[]} options.exclude - Exclude specific rules
- * @returns {Promise<Object>} - Regula output
+ * @param {boolean} options.noBuiltIns - Disable built-in rules (use only custom rules from include)
+ * @param {boolean} options.noIgnore - Disable .gitignore filtering
+ * @param {string[]} options.varFiles - Terraform variable files to use
+ * @returns {Promise<Object>} - Parsed regula output with rule_results and summary
  */
 export async function runRegula(paths, options = {}) {
   const pathArray = Array.isArray(paths) ? paths : [paths];
 
+  // Always use JSON format for programmatic parsing
   const args = ["run", "--format", "json"];
 
   if (options.inputType) {
@@ -46,6 +49,21 @@ export async function runRegula(paths, options = {}) {
     }
   }
 
+  if (options.noBuiltIns) {
+    args.push("--no-built-ins");
+  }
+
+  if (options.noIgnore) {
+    args.push("--no-ignore");
+  }
+
+  if (options.varFiles) {
+    const varFiles = Array.isArray(options.varFiles) ? options.varFiles : [options.varFiles];
+    for (const varFile of varFiles) {
+      args.push("--var-file", varFile);
+    }
+  }
+
   args.push(...pathArray);
 
   return new Promise((resolve, reject) => {
@@ -71,7 +89,8 @@ export async function runRegula(paths, options = {}) {
 }
 
 /**
- * Validate IaC files and return rule results
+ * Validate IaC files and return rule results.
+ * Alias for runRegula().
  * @param {string|string[]} paths - Path(s) to IaC files or directories
  * @param {Object} options - Optional configuration
  * @returns {Promise<Object>} - Object with rule_results and summary

package/package.json

@@ -1,9 +1,10 @@
 {
   "name": "regula-wasi",
-  "version": "3.2.2",
+  "version": "3.2.4",
   "description": "Infrastructure as Code security and compliance evaluation tool (WASI build). Fork of fugue/regula with security patches.",
   "type": "module",
   "main": "index.js",
+  "types": "index.d.ts",
   "bin": {
     "regula": "cli.js"
   },
@@ -15,6 +16,7 @@
   },
   "files": [
     "index.js",
+    "index.d.ts",
     "cli.js",
     "regula.wasm",
     "README.md",