[natemoo-re]

Adds the Bombshell CSS engine into experiments/css/ and adds @bomb.sh/css.
Walk a @bomb.sh/dom tree, snapshot it, and get computed styles per node with real multi-stylesheet aggregation and inline styles.

Rust workspace

CSS text ──▶ bombshell-css-compiler ──▶ typed IR (v2, postcard bytes)
              (vendored lexbor drives a ~800-line C shim that emits a flat
               event stream of byte spans; everything semantic is Rust:
               nesting expansion, condition parsing, canonicalization)
                         │
                         ▼
             bombshell-css-runtime ──▶ computed declarations
              (parcel_selectors matcher, cascade + inheritance,
               custom properties / var(), media/container/supports eval)
                         │
                         ▼
             bombshell-css-wasm ──▶ freestanding component,
              WIT world `bombshell:css@0.4.0`, zero imports

JS package (@bomb.sh/css)

import { createEngine, compile } from '@bomb.sh/css';

// Host many stylesheets; @layer and document order are handled natively.
const engine = createEngine();
const id = engine.addSheet(baseCss);
engine.addSheet(themeCss);
engine.removeSheet(id);

// Snapshot a DOM tree and styles it:
const nodes = [...root].map((node) => ({
  tag: node.localName,
  id: node.id || undefined,
  classes: (node.getAttribute('class') ?? '').split(/\s+/).filter(Boolean),
  state: stateFlags(node.states),            // focus/hover/active bits
  width, height,                             // for container/media queries
  style: node.getAttribute('style'),         // inline styles, real cascade slot
}));
const computed = engine.computeTree(nodes, parents, env);  // per-frame entry

• compile(css) → disposable Sheet (compiles + prepares; throws CompileError with .diagnostics when no IR; warnings-only compiles succeed). Sheet carries ir, diagnostics, lazily decoded version/rules
• Engine — multi-sheet host: addSheet/removeSheet/clear, compute/computeTree, diagnostics, disposable
• Free functions compute/computeTree/release, decodeIr(sheet|bytes), NO_PARENT
• src/wasm.js — the runtime embedded: brotli+Z85-encoded optimized module (219 KB → 96 KB source) that decodes and WebAssembly.compiles itself on import; regenerable via scripts/bundle-wasm.mjs
• loadCssComponent/loadCssComponentFromModule for hosts shipping their own artifact; the embedded artifact decodes via node:zlib (Node-like runtimes)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​cssparser@​0.37.0
	cargo/​parcel_selectors@​0.28.3
	cargo/​wit-bindgen@​0.62.0
	cargo/​serde@​1.0.229
	cargo/​cc@​1.5.1
	cargo/​postcard@​1.1.3
	cargo/​rustc-hash@​2.1.3

View full report