feat: initial implementation

[b2m9]

Summary by cubic

Initial release of @b2m9/anyall, a headless TypeScript library to build, validate, and evaluate serializable any‑of‑all (DNF) filters over declared record fields. Adds a small API to parse JSON or UI rows, then compile fast predicates to filter in‑memory data.

• New Features

  • createFilter() returns { fromRows, parse, compile, filter } for end‑to‑end use.
  • Robust validation with clear issues; throws AnyallConfigError and AnyallExpressionError when misused.
  • Supports equals, contains, starts-with, ends-with, one-of, empty, plus not.
  • Field registry supports accessors and per‑field normalize, and snapshots these callables during registration to prevent runtime mutation.
  • Canonical JSON expression shape and strict parsing (strings treated as JSON).
  • ESM‑only, Node.js 22+, zero runtime dependencies; docs in README and AGENTS.md; comprehensive tests.

• Dependencies

  • Adds CI (.github/workflows/ci.yml) running on Node 22/24/26 with voidzero-dev/setup-vp@v1; avoids duplicate installs by disabling auto‑install and running vp install once.
  • Uses vite-plus (vp) for build/test and a pnpm workspace/lockfile with minimumReleaseAge supply‑chain cooldown.
  • Adds CLAUDE.md portable include pointing to AGENTS.md for agent guidance.

^{Written for commit 5407888. Summary will update on new commits.}

[cubic-dev-ai]

2 issues found across 28 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/validation.ts">

<violation number="1" location="src/validation.ts:88">
P1: Large expressions can allocate canonical arrays and run validation for every group/predicate without a limit, enabling memory/CPU exhaustion through `parse` or asserted `compile` input. Add documented cardinality caps before materializing `any` and `all`, returning a structured validation issue once exceeded.</violation>

<violation number="2" location="src/validation.ts:255">
P1: Unbounded token arrays and strings let untrusted expressions force arbitrary allocation and normalizer work. Enforce token-count and needle-length limits before iterating or normalizing values, with a structured validation failure.</violation>
</file>

<sub>Tip: cubic can generate docs of your entire codebase and keep them up to date. Try it here.

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: Unbounded token arrays and strings let untrusted expressions force arbitrary allocation and normalizer work. Enforce token-count and needle-length limits before iterating or normalizing values, with a structured validation failure.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/validation.ts, line 255:

<comment>Unbounded token arrays and strings let untrusted expressions force arbitrary allocation and normalizer work. Enforce token-count and needle-length limits before iterating or normalizing values, with a structured validation failure.</comment>

<file context>
@@ -0,0 +1,323 @@
+
+  let valid = true;
+  const tokens: string[] = [];
+  for (const [index, token] of input.value.entries()) {
+    if (typeof token !== "string") {
+      addIssue(context, "invalid-value", [...valuePath, index], "one-of tokens must be strings");
</file context>

[b2m9]

I don't want to use arbitrary package-wide thresholds. It seems to be a valid threat model but I don't want to impose this on every consumer. If real consumers run into this issue, I might rethink my stance.

[b2m9]

@cubic-dev-ai I don't want to use arbitrary package-wide thresholds. It seems to be a valid threat model but I don't want to impose this on every consumer. If real consumers run into this issue, I might rethink my stance.

[cubic-dev-ai]

P1: Large expressions can allocate canonical arrays and run validation for every group/predicate without a limit, enabling memory/CPU exhaustion through parse or asserted compile input. Add documented cardinality caps before materializing any and all, returning a structured validation issue once exceeded.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/validation.ts, line 88:

<comment>Large expressions can allocate canonical arrays and run validation for every group/predicate without a limit, enabling memory/CPU exhaustion through `parse` or asserted `compile` input. Add documented cardinality caps before materializing `any` and `all`, returning a structured validation issue once exceeded.</comment>

<file context>
@@ -0,0 +1,323 @@
+    any = [];
+  } else {
+    // Array.from both visits holes and refuses an input subclass's species.
+    any = Array.from(anyInput, (group, index) => validateGroup(group, ["any", index], context));
+  }
+
</file context>

[b2m9]

Same threat model as previous issue. Still no action taken.

[b2m9]

@cubic-dev-ai Same threat model as previous issue. Still no action taken.

[cubic-dev-ai]

No issues found across 28 files

<sub>Tip: cubic can generate docs of your entire codebase and keep them up to date. Try it here.

Re-trigger cubic</sub>