refactor(primitives): move skeleton to primitives

[egdev6]

Summary

• Moves Skeleton from the atoms tier to the primitives tier.
• Updates the public barrel export so Skeleton resolves from components/primitives/skeleton.
• Extends package consumption verification to assert root ESM/CJS exports for Skeleton and other core components.
• Adds targeted pnpm security overrides for vulnerable transitive dev-tooling packages so pnpm audit --audit-level high passes again.

Closes #302

Review scope

• Primary files/areas:
  • src/components/primitives/skeleton/*
  • src/index.ts
  • scripts/verify-package-consumption.mjs
  • package.json
  • pnpm-lock.yaml
• Out of scope:
  • Visual redesign of Skeleton
  • Token changes
  • New component behavior
  • Direct dependency upgrades beyond the targeted transitive security overrides listed in pnpm.overrides
• Review workload: medium; one focused component-tier refactor plus a small follow-up dependency-audit fix.

Type of change

• New component
• Existing component update/refactor
• Bug fix
• Accessibility
• Design tokens
• Storybook/docs
• Infrastructure/tooling
• NPM/dependencies

Workflow gates

• Linked issue is present with Closes #NNN or maintainer approved an exception.
• Linked issue has label status:approved before implementation starts.
• Linked issue assignee was checked before work started; if it was assigned to someone else, explicit reassignment permission is documented.
• Work was started through the Project flow: assignee set, Project status In progress, branch/worktree recorded.
• PR title follows Conventional Commit format: <type>(<optional scope>): <description>.
• Commits follow the same commitlint-enforced format.
• Diff is focused; unrelated work is called out in Review scope.
• MCP/runtime artifacts are absent: .playwright-mcp, page-*.png, page-*.jpeg, *.md.playwright-output.

Component evidence (required for component changes)

• Validated component spec is linked or quoted in the issue.
• Accessibility contract from the spec was implemented or deviations are explained below.
• Follows the 6-file pattern: types.ts, use*.ts, Component.tsx, Component.test.tsx, Component.stories.tsx, index.ts.
• CVA variants live in types.ts; JSX component has no state, CVA calls, or business logic.
• Public props with runtime defaults have matching @default JSDoc in types.ts (node scripts/verify-prop-default-docs.mjs).
• Uses design tokens from theme.css; no hardcoded colors or arbitrary color utilities.
• Storybook covers default, variants, documented states, edge cases, and dark mode when visually different.
• Component audit result is PASS or accepted PASS WITH WARNINGS.
• Visual review result is included when visuals changed.

The component implementation was moved without behavior or visual changes; no new visual review capture was needed.

Accessibility evidence

• Role/name semantics verified with Testing Library queries or equivalent.
• Keyboard-only behavior verified: Tab / Shift+Tab, Enter / Space, Arrow keys, Escape, Home / End / typeahead where applicable.
• Focus lifecycle verified: initial focus, roving/active descendant, focus restore, trap/portal behavior where applicable.
• Disabled, required, invalid/error, loading, and empty states expose the expected semantics where applicable.
• Reduced motion behavior is respected where motion changed.
• Screen reader or axe/manual evidence is included below when applicable.

Existing Skeleton tests moved with the component and still pass; no interactive behavior changed.

Validation evidence

• TypeScript: pnpm run build ✅
• Unit tests: pnpm run test ✅ — 41 files, 910 tests passed.
• Build/package: pnpm run build ✅; pnpm run verify:package ✅ — React 18 and React 19 consumers verified; ESM/CJS root exports include Button, Divider, Skeleton, and Spacer.
• Storybook or visual check: Storybook stories moved with the component; no visual behavior changed.
• Accessibility check: Existing component tests pass; no a11y behavior changed.
• Security/dependency check: pnpm audit --audit-level high ✅ — no high vulnerabilities remain; only 1 low and 3 moderate vulnerabilities remain below the CI threshold.

Screenshots or recordings

N/A — no visual behavior changed.

Notes for reviewer

• Refactor commit: ea372ae2 refactor(primitives): move skeleton to primitives.
• Dependency-audit fix commit: db28a905 fix(deps): resolve high audit findings.
• Bounded review receipts: review-9f58a8a40189973a for the Skeleton move and review-7ccf787a3ff52df4 for the dependency-audit fix.
• The remote branch was bootstrapped at origin/main first so the native pre-push gate could validate an update instead of an unsupported first-push create.

[Copilot]

Pull request overview

This PR refactors the component catalog by moving Skeleton from the atoms tier to the primitives tier, updating root exports and package-consumption verification to ensure Skeleton remains consumable via both ESM and CJS entrypoints.

Changes:

• Move Skeleton implementation/tests/stories into src/components/primitives/skeleton.
• Update src/index.ts root barrel exports so Skeleton is exported from the primitives tier (including its public types).
• Extend scripts/verify-package-consumption.mjs to assert Skeleton root exports and type imports for both React 18 and React 19 consumers.

Reviewed changes

Copilot reviewed 4 out of 10 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/index.ts	Moves the root export for Skeleton from atoms to primitives and re-exports its types.
src/components/primitives/skeleton/Skeleton.tsx	Adds the primitives-tier Skeleton component wrapper using the hook.
src/components/primitives/skeleton/useSkeleton.ts	Adds the primitives-tier hook computing classes and aria-hidden behavior.
src/components/primitives/skeleton/types.ts	Adds CVA variants + public prop/types for primitives-tier Skeleton.
src/components/primitives/skeleton/Skeleton.test.tsx	Adds/moves tests validating hook defaults and component a11y/prop forwarding.
src/components/primitives/skeleton/Skeleton.stories.tsx	Updates Storybook taxonomy to Primitives/Skeleton.
src/components/primitives/skeleton/index.ts	Adds primitives-tier barrel exports for Skeleton and its types.
scripts/verify-package-consumption.mjs	Extends consumer smoke tests to validate Skeleton root ESM/CJS exports and typing.
package.json	Adds pnpm overrides affecting resolved dependency versions.
pnpm-lock.yaml	Updates lockfile overrides and resolved versions to reflect the new pnpm overrides.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.