[cowboyd]

What does this PR do?

Introduce @bomb.sh/dom, an independently maintained in-memory DOM for interactive applications such as terminal UIs. It provides explicit, independent documents without installing process globals or requiring a browser.

• Implement a shared node hierarchy with validated mutations, ownership, adoption, cloning, namespaces, and protected collections.
• Add event propagation and cancellation, MutationObserver, and separate connected-document invalidation for external renderers.
• Add focus management, host keyboard dispatch, input/textarea selection, and live document ranges.
• Implement tested subsets of autonomous custom elements, templates, shadow roots, and slots, with opt-in HTML parsing.
• Include strict TypeScript declarations, ESM exports, provenance, standards differences, and a capability matrix.

This is the core layer of the stack. Framework integrations, their dependencies, demos, and acceptance tests are in the next layer.

Scope and limitations

This establishes a tested DOM subset, not full DOM or Web Components conformance. Remaining work includes additional Range/Selection APIs, selectors, and broader custom-element and shadow-tree coverage.

Terminal rendering, layout, input decoding, and output scheduling remain consumer responsibilities.

Validation

Validated independently with the framework packages absent:

• pnpm install --frozen-lockfile --ignore-scripts succeeded.
• pnpm test: 227 tests passed, including 216 DOM tests and 11 existing workspace tests. The DOM tests include 20 unchanged upstream WPT cases.
• Core TypeScript checking and ESM/declaration build passed.
• pnpm format:check passed.
• pnpm lint passed with 78 existing workspace warnings.

Type of change

• Bug fix
• Feature
• Refactor (no behavior change)
• Documentation
• Performance improvement
• Tests
• Chore (dependencies, CI, tooling)

Checklist

• All tests pass (pnpm test)
• Files are formatted (pnpm format)
• I have added/updated tests for my changes (if applicable)
• I have added a changeset

AI-generated code disclosure

• This PR includes AI-generated code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​parse5@​8.0.1

View full report