Implement native rules

README.md

@@ -50,9 +50,9 @@ if (result.kind !== "valid") {
 > 
 > The `string.pattern` rule supports regular expressions with CEL's standard [RE2 syntax](https://github.com/google/re2/wiki/syntax). 
 > 
-> Protovalidate translates RE2 to ECMAScript's regular expressions. This works except for some RE2 flags, but it cannot support RE2's most important property: Execution in linear time, which guards against [ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS).
+> Protovalidate evaluates patterns with [@bufbuild/re2](https://www.npmjs.com/package/@bufbuild/re2), an RE2-compatible engine that executes in linear time, guarding against [ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS).
 >
-> If you need full support for RE2, you can bring your own RE2 implementation:
+> If you prefer a different engine, you can bring your own RE2 implementation:
 > 
 > ```ts
 > const validator = createValidator({

packages/protovalidate-bench/README.md

@@ -9,10 +9,13 @@ so that runtime cost can be tracked across changes and compared cross-language.
 With turborepo:
 
 ```shell
-npx turbo run bench -- [regex] --dir <dir>
+npx turbo run bench --filter=@bufbuild/protovalidate-bench -- [regex]
 ```
 
-With npm (make sure to generate proto and build dependencies first):
+This command will rebuild the `protovalidate` package and run the benchmarks. This is preferred to make sure
+the latest changes are reflected in the results.
+
+You can also run the benchmarks directly from the `protovalidate-bench` package:
 
 ```shell
 npm run bench

packages/protovalidate-bench/src/bench.ts

@@ -15,7 +15,10 @@
 import * as console from "node:console";
 import { writeFileSync } from "node:fs";
 import { parseArgs } from "node:util";
-import { createValidator } from "@bufbuild/protovalidate";
+import {
+  createValidator,
+  type ValidatorOptions,
+} from "@bufbuild/protovalidate";
 import { Bench, type Task } from "tinybench";
 import { cases } from "./cases.js";
 
@@ -62,7 +65,10 @@ if (tests.length == 0) {
 }
 
 const bench = new Bench({ name: "protovalidate benchmarks", time: 100 });
-const validator = createValidator();
+const disableNative = process.env.DISABLE_NATIVE_RULES;
+const opts: ValidatorOptions =
+  disableNative !== undefined ? { disableNativeRules: true } : {};
+const validator = createValidator(opts);
 for (const test of tests) {
   bench.add(test.name, () => {
     validator.validate(test.schema, test.fixture);

packages/protovalidate-testing/src/executor.ts

@@ -38,7 +38,13 @@ if (!request.fdset) {
   throw new Error(`Empty request field "fdset"`);
 }
 const registry = createFileRegistry(request.fdset);
-const validator = createValidator({ registry });
+// Set PROTOVALIDATE_DISABLE_NATIVE_RULES=1 to run the conformance suite
+// against the pure-CEL path, proving equivalence with the (default-on)
+// native rules.
+const validator = createValidator({
+  registry,
+  disableNativeRules: process.env.PROTOVALIDATE_DISABLE_NATIVE_RULES === "1",
+});
 const response = create(TestConformanceResponseSchema);
 for (const [name, any] of Object.entries(request.cases)) {
   const testResult = create(TestResultSchema);

packages/protovalidate/package.json

@@ -20,7 +20,7 @@
     "postfetch-proto": "license-header proto",
     "generate": "buf generate",
     "postgenerate": "license-header src/gen",
-    "test": "npx tsx --test ./src/*.test.ts",
+    "test": "npx tsx --test ./src/*.test.ts ./src/**/*.test.ts",
     "prebuild": "rm -rf ./dist/*",
     "build": "npm run build:cjs && npm run build:esm",
     "build:cjs": "tsc --project tsconfig.json --module commonjs --verbatimModuleSyntax false --moduleResolution node10 --outDir ./dist/cjs && echo >./dist/cjs/package.json '{\"type\":\"commonjs\"}'",
@@ -42,7 +42,8 @@
     }
   },
   "dependencies": {
-    "@bufbuild/cel": "0.4.0"
+    "@bufbuild/cel": "0.4.0",
+    "@bufbuild/re2": "^0.6.0"
   },
   "peerDependencies": {
     "@bufbuild/protobuf": "^2.8.0"

packages/protovalidate/src/native/bool.test.ts

@@ -0,0 +1,47 @@
+// Copyright 2024-2026 Buf Technologies, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import { suite, test } from "node:test";
+import { create } from "@bufbuild/protobuf";
+import { compile, diff } from "./testing.js";
+
+void suite("native bool rules", () => {
+  void suite("bool.const", () => {
+    const schema = compile(
+      `message M {
+        bool b = 1 [(buf.validate.field).bool.const = true];
+      }`,
+    );
+    void test("matches: valid", () => {
+      diff(schema, create(schema, { b: true }));
+    });
+    void test("mismatches: invalid", () => {
+      diff(schema, create(schema, { b: false }));
+    });
+  });
+
+  void suite("BoolValue wrapper", () => {
+    const schema = compile(
+      `message M {
+        google.protobuf.BoolValue b = 1 [(buf.validate.field).bool.const = true];
+      }`,
+    );
+    void test("inner value matches: valid", () => {
+      diff(schema, create(schema, { b: true }));
+    });
+    void test("inner value mismatches: invalid", () => {
+      diff(schema, create(schema, { b: false }));
+    });
+  });
+});

packages/protovalidate/src/native/bool.ts

@@ -0,0 +1,78 @@
+// Copyright 2024-2026 Buf Technologies, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import { isFieldSet } from "@bufbuild/protobuf";
+import type {
+  Path,
+  PathBuilder,
+  ScalarValue,
+} from "@bufbuild/protobuf/reflect";
+import type { Cursor } from "../cursor.js";
+import type { Eval } from "../eval.js";
+import {
+  type BoolRules,
+  BoolRulesSchema,
+} from "../gen/buf/validate/validate_pb.js";
+import type { ScalarNativeResult } from "./dispatcher.js";
+
+/**
+ * Native evaluator for `bool.const`.
+ *
+ * Bool only supports the `const` rule. Anything else on a BoolRules instance
+ * falls through to CEL via the dispatcher.
+ */
+class EvalNativeBoolRules implements Eval<ScalarValue> {
+  constructor(
+    private readonly forMapKey: boolean,
+    private readonly constVal: boolean,
+    private readonly rulePath: Path,
+  ) {}
+
+  eval(val: ScalarValue, cursor: Cursor): void {
+    if (val !== this.constVal) {
+      cursor.violate(
+        `must equal ${this.constVal}`,
+        "bool.const",
+        this.rulePath,
+        this.forMapKey,
+      );
+    }
+  }
+
+  prune(): boolean {
+    return false;
+  }
+}
+
+/**
+ * Try to build a native evaluator for BoolRules. Returns `undefined` if no
+ * native handler applies (no const set, or unknown extensions present).
+ */
+export function tryBuildNativeBoolRules(
+  rules: BoolRules,
+  rulePath: PathBuilder,
+  forMapKey: boolean,
+): ScalarNativeResult | undefined {
+  if (rules.$unknown && rules.$unknown.length > 0) {
+    return undefined;
+  }
+  if (!isFieldSet(rules, BoolRulesSchema.field.const)) {
+    return undefined;
+  }
+  const path = rulePath.clone().field(BoolRulesSchema.field.const).toPath();
+  return {
+    eval: new EvalNativeBoolRules(forMapKey, rules.const, path),
+    handledFields: new Set([BoolRulesSchema.field.const]),
+  };
+}