BREAKING: Make module ESM only

[fb55]

• Set type: module, update tsconfig to es2022/nodenext
• Output to dist/ instead of lib/, remove dual CJS/ESM build
• Simplify exports to ESM-only
• Migrate Jest to Vitest
• Bump all deps to latest majors (boolbase ^2, css-select ^7, css-what ^8, domelementtype ^3, domhandler ^6, domutils ^4)
• Import isTag from domhandler (no longer re-exported by domutils)
• Use _compileUnsafe instead of removed _compileToken from css-select
• Remove re-export of removed aliases/filters/pseudos from css-select
• Add engines >= 20.19.0
• Add publish workflow (npm + JSR), SECURITY.md

BREAKING CHANGE: This package is now ESM-only.

[Copilot]

Pull request overview

This PR migrates the package to an ESM-only distribution, modernizes the TypeScript build output (to dist/ with nodenext), upgrades major dependencies, and switches the test runner from Jest to Vitest while updating CI/publish automation accordingly.

Changes:

• Convert build/packaging to ESM-only (type: module, exports updated, dist/ output, remove dual CJS/ESM build).
• Upgrade selector/DOM dependency majors and adjust code to updated APIs (domhandler isTag, css-select _compileUnsafe, etc.).
• Migrate tests and CI from Jest to Vitest; add publish workflow + SECURITY.md.

Reviewed changes

Copilot reviewed 11 out of 14 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tsconfig.json	Switch TS output/targets to ESM (es2022, nodenext) and emit to dist/.
package.json	Mark package ESM-only, simplify exports, update scripts to Vitest, bump major deps, add Node engine.
src/index.ts	Update css-select compilation API and isTag usage; introduce adapter passed to prepareContext.
src/index.spec.ts	Update test imports for ESM (.js specifiers) and Vitest.
src/helpers.spec.ts	Update test runner imports and ESM .js specifier.
test/tools/sizzle-testinit.ts	Update htmlparser2 API usage and isTag import; migrate assertions to Vitest.
test/sizzle.spec.ts	Migrate to Vitest, update htmlparser2 API, and swap to domhandler isTag.
test/advanced-selectors.spec.ts	Migrate to Vitest and update ESM import path for select.
.github/workflows/nodejs-test.yml	Run Vitest instead of Jest; update Node matrix.
.github/workflows/publish.yml	Add tag-based publish workflow for npm + JSR with generated jsr.json.
SECURITY.md	Add security reporting policy document.
.gitignore	Ignore dist/ output and generated jsr.json.
biome.json	Bump Biome schema reference.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cubic-dev-ai]

2 issues found across 15 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="tsconfig.json">

<violation number="1" location="tsconfig.json:3">
P3: Removing the explicit `lib` option now defaults the build to `lib.es2022.full.d.ts`, which pulls the DOM and WebWorker globals into scope for `src`. The previous `lib: ["ES2015.Core"]` deliberately excluded DOM, and the sibling `tsconfig.eslint.json` still pins `lib: ["ES2023"]` (no DOM). Because this library ships for Node (ESM-only, engines >=20.19.0), DOM globals aren't available at runtime, so code that accidentally references `window`/`document`/`setTimeout` will now type-check in the build and fail only when executed. Restore a DOM-free lib matching the new target.</violation>
</file>

<file name="biome.json">

<violation number="1" location="biome.json:2">
P3: The build now outputs to `dist/` (tsconfig `outDir: "dist"`), but `biome.json` `files.includes` still ignores `!lib`, the previous output directory, and has no `!dist` entry. `dist/` is only skipped today because it is gitignored and `vcs.useIgnoreFile` is enabled. Update the ignore list to `!dist` so the config matches the new output layout.</violation>
</file>

<sub>Tip: cubic can generate docs of your entire codebase and keep them up to date. Try it here.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

P3: Removing the explicit lib option now defaults the build to lib.es2022.full.d.ts, which pulls the DOM and WebWorker globals into scope for src. The previous lib: ["ES2015.Core"] deliberately excluded DOM, and the sibling tsconfig.eslint.json still pins lib: ["ES2023"] (no DOM). Because this library ships for Node (ESM-only, engines >=20.19.0), DOM globals aren't available at runtime, so code that accidentally references window/document/setTimeout will now type-check in the build and fail only when executed. Restore a DOM-free lib matching the new target.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At tsconfig.json, line 3:

<comment>Removing the explicit `lib` option now defaults the build to `lib.es2022.full.d.ts`, which pulls the DOM and WebWorker globals into scope for `src`. The previous `lib: ["ES2015.Core"]` deliberately excluded DOM, and the sibling `tsconfig.eslint.json` still pins `lib: ["ES2023"]` (no DOM). Because this library ships for Node (ESM-only, engines >=20.19.0), DOM globals aren't available at runtime, so code that accidentally references `window`/`document`/`setTimeout` will now type-check in the build and fail only when executed. Restore a DOM-free lib matching the new target.</comment>

<file context>
@@ -1,18 +1,15 @@
-        "target": "es5",
-        "module": "commonjs",
-        "lib": ["ES2015.Core"],
+        "target": "es2022",
+        "module": "nodenext",
+        "moduleResolution": "nodenext",
</file context>

Suggested change

	"target": "es2022",
	"lib": ["ES2022"],
	"target": "es2022",

[cubic-dev-ai]

P3: The build now outputs to dist/ (tsconfig outDir: "dist"), but biome.json files.includes still ignores !lib, the previous output directory, and has no !dist entry. dist/ is only skipped today because it is gitignored and vcs.useIgnoreFile is enabled. Update the ignore list to !dist so the config matches the new output layout.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At biome.json, line 2:

<comment>The build now outputs to `dist/` (tsconfig `outDir: "dist"`), but `biome.json` `files.includes` still ignores `!lib`, the previous output directory, and has no `!dist` entry. `dist/` is only skipped today because it is gitignored and `vcs.useIgnoreFile` is enabled. Update the ignore list to `!dist` so the config matches the new output layout.</comment>

<file context>
@@ -1,5 +1,5 @@
 {
-    "$schema": "https://biomejs.dev/schemas/2.4.4/schema.json",
+    "$schema": "https://biomejs.dev/schemas/2.4.8/schema.json",
     "vcs": {
         "enabled": true,
</file context>