From ea372ae2ba48b596b85021be4db6f45a2984d822 Mon Sep 17 00:00:00 2001
From: egdev6 <egdev6@gmail.com>
Date: Wed, 22 Jul 2026 20:56:55 +0200
Subject: [PATCH 1/2] refactor(primitives): move skeleton to primitives

---
 scripts/verify-package-consumption.mjs        | 39 +++++++++++++++++--
 .../skeleton/Skeleton.stories.tsx             |  3 +-
 .../skeleton/Skeleton.test.tsx                |  0
 .../skeleton/Skeleton.tsx                     |  0
 .../{atoms => primitives}/skeleton/index.ts   |  0
 .../{atoms => primitives}/skeleton/types.ts   |  0
 .../skeleton/useSkeleton.ts                   |  0
 src/index.ts                                  |  3 +-
 8 files changed, 39 insertions(+), 6 deletions(-)
 rename src/components/{atoms => primitives}/skeleton/Skeleton.stories.tsx (93%)
 rename src/components/{atoms => primitives}/skeleton/Skeleton.test.tsx (100%)
 rename src/components/{atoms => primitives}/skeleton/Skeleton.tsx (100%)
 rename src/components/{atoms => primitives}/skeleton/index.ts (100%)
 rename src/components/{atoms => primitives}/skeleton/types.ts (100%)
 rename src/components/{atoms => primitives}/skeleton/useSkeleton.ts (100%)

diff --git a/scripts/verify-package-consumption.mjs b/scripts/verify-package-consumption.mjs
index 3b6acba6..a24a8dfa 100644
--- a/scripts/verify-package-consumption.mjs
+++ b/scripts/verify-package-consumption.mjs
@@ -4,7 +4,7 @@ import { createRequire } from 'node:module';
 import { tmpdir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { Button, Divider, Spacer } from '@stack-and-flow/design-system';
+import { Button, Divider, Skeleton, Spacer } from '@stack-and-flow/design-system';
 
 const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 const loadCjs = createRequire(import.meta.url);
@@ -23,6 +23,10 @@ if (typeof Spacer !== 'function') {
   throw new TypeError(`Expected ESM Spacer export to be a function, received ${typeof Spacer}`);
 }
 
+if (typeof Skeleton !== 'function') {
+  throw new TypeError(`Expected ESM Skeleton export to be a function, received ${typeof Skeleton}`);
+}
+
 if (typeof cjsExports.Button !== 'function') {
   throw new TypeError(`Expected CJS Button export to be a function, received ${typeof cjsExports.Button}`);
 }
@@ -35,6 +39,10 @@ if (typeof cjsExports.Spacer !== 'function') {
   throw new TypeError(`Expected CJS Spacer export to be a function, received ${typeof cjsExports.Spacer}`);
 }
 
+if (typeof cjsExports.Skeleton !== 'function') {
+  throw new TypeError(`Expected CJS Skeleton export to be a function, received ${typeof cjsExports.Skeleton}`);
+}
+
 const cssPath = resolve(packageRoot, 'dist/design-system.css');
 if (stylesPath !== cssPath) {
   throw new Error(`Expected styles subpath to resolve to ${cssPath}, received ${stylesPath}`);
@@ -140,10 +148,13 @@ try {
 import type {
   DividerColor,
   DividerProps,
+  SkeletonProps,
+  SkeletonRounded,
+  SkeletonSize,
   SpacerProps,
   SpacerScale
 } from '@stack-and-flow/design-system';
-import { Button, Divider, Popover, Select, Spacer } from '@stack-and-flow/design-system';
+import { Button, Divider, Popover, Select, Skeleton, Spacer } from '@stack-and-flow/design-system';
 
 const buttonProps: ComponentProps<typeof Button> = {
   text: 'Save',
@@ -165,6 +176,17 @@ const spacerProps: ComponentProps<typeof Spacer> = {
 };
 const explicitSpacerProps: SpacerProps = spacerProps;
 
+const skeletonSize: SkeletonSize = 'title';
+const skeletonRounded: SkeletonRounded = 'lg';
+const skeletonProps: ComponentProps<typeof Skeleton> = {
+  size: skeletonSize,
+  rounded: skeletonRounded,
+  ariaHidden: false,
+  role: 'status',
+  'aria-label': 'Loading profile'
+};
+const explicitSkeletonProps: SkeletonProps = skeletonProps;
+
 const selectProps: ComponentProps<typeof Select> = {
   ariaLabel: 'Framework',
   options: [{ key: 'react', label: 'React' }]
@@ -173,6 +195,7 @@ const selectProps: ComponentProps<typeof Select> = {
 const button = <Button {...buttonProps} />;
 const divider = <Divider {...dividerProps} />;
 const spacer = <Spacer {...spacerProps} />;
+const skeleton = <Skeleton {...skeletonProps} />;
 const select = <Select {...selectProps} />;
 const popover = (
   <Popover>
@@ -186,6 +209,8 @@ void divider;
 void explicitDividerProps;
 void spacer;
 void explicitSpacerProps;
+void skeleton;
+void explicitSkeletonProps;
 void select;
 void popover;
 `
@@ -194,7 +219,7 @@ void popover;
     writeFileSync(
       resolve(consumerDir, 'smoke.mjs'),
       `import { createRequire } from 'node:module';
-import { Button, Divider, Spacer } from '@stack-and-flow/design-system';
+import { Button, Divider, Skeleton, Spacer } from '@stack-and-flow/design-system';
 
 const require = createRequire(import.meta.url);
 const cjsExports = require('@stack-and-flow/design-system');
@@ -209,6 +234,9 @@ if (typeof Divider !== 'function') {
 if (typeof Spacer !== 'function') {
   throw new TypeError('Expected ESM Spacer export to be a function');
 }
+if (typeof Skeleton !== 'function') {
+  throw new TypeError('Expected ESM Skeleton export to be a function');
+}
 if (typeof cjsExports.Button !== 'function') {
   throw new TypeError('Expected CJS Button export to be a function');
 }
@@ -218,6 +246,9 @@ if (typeof cjsExports.Divider !== 'function') {
 if (typeof cjsExports.Spacer !== 'function') {
   throw new TypeError('Expected CJS Spacer export to be a function');
 }
+if (typeof cjsExports.Skeleton !== 'function') {
+  throw new TypeError('Expected CJS Skeleton export to be a function');
+}
 if (!stylesPath.endsWith('dist/design-system.css')) {
   throw new Error(\`Expected styles subpath to resolve to dist/design-system.css, received \${stylesPath}\`);
 }
@@ -240,5 +271,5 @@ if (!stylesPath.endsWith('dist/design-system.css')) {
 }
 
 console.log(
-  'Package consumption verified: ESM/CJS root Button, Divider, and Spacer imports, styles subpath, and React 18/19 consumers are available.'
+  'Package consumption verified: ESM/CJS root Button, Divider, Skeleton, and Spacer imports, styles subpath, and React 18/19 consumers are available.'
 );
diff --git a/src/components/atoms/skeleton/Skeleton.stories.tsx b/src/components/primitives/skeleton/Skeleton.stories.tsx
similarity index 93%
rename from src/components/atoms/skeleton/Skeleton.stories.tsx
rename to src/components/primitives/skeleton/Skeleton.stories.tsx
index 8f502e8c..16eb1292 100644
--- a/src/components/atoms/skeleton/Skeleton.stories.tsx
+++ b/src/components/primitives/skeleton/Skeleton.stories.tsx
@@ -18,7 +18,7 @@ const swatchClass = 'flex flex-col gap-2';
  * Skeleton instances to preview the shape of loading content without hardcoding dimensions.
  */
 const meta: Meta<typeof Skeleton> = {
-  title: 'Atoms/Skeleton',
+  title: 'Primitives/Skeleton',
   component: Skeleton,
   parameters: {
     docs: {
@@ -31,6 +31,7 @@ export default meta;
 
 type Story = StoryObj<typeof Skeleton>;
 
+/** Demonstrates the default text placeholder footprint and medium radius used by the component defaults. */
 export const Default: Story = {
   render: () => (
     <div className={frameClass}>
diff --git a/src/components/atoms/skeleton/Skeleton.test.tsx b/src/components/primitives/skeleton/Skeleton.test.tsx
similarity index 100%
rename from src/components/atoms/skeleton/Skeleton.test.tsx
rename to src/components/primitives/skeleton/Skeleton.test.tsx
diff --git a/src/components/atoms/skeleton/Skeleton.tsx b/src/components/primitives/skeleton/Skeleton.tsx
similarity index 100%
rename from src/components/atoms/skeleton/Skeleton.tsx
rename to src/components/primitives/skeleton/Skeleton.tsx
diff --git a/src/components/atoms/skeleton/index.ts b/src/components/primitives/skeleton/index.ts
similarity index 100%
rename from src/components/atoms/skeleton/index.ts
rename to src/components/primitives/skeleton/index.ts
diff --git a/src/components/atoms/skeleton/types.ts b/src/components/primitives/skeleton/types.ts
similarity index 100%
rename from src/components/atoms/skeleton/types.ts
rename to src/components/primitives/skeleton/types.ts
diff --git a/src/components/atoms/skeleton/useSkeleton.ts b/src/components/primitives/skeleton/useSkeleton.ts
similarity index 100%
rename from src/components/atoms/skeleton/useSkeleton.ts
rename to src/components/primitives/skeleton/useSkeleton.ts
diff --git a/src/index.ts b/src/index.ts
index c95a0a2a..b5ef4e02 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -20,7 +20,6 @@ export { LottieAnimation } from './components/atoms/lottie-animation';
 export { Popover } from './components/atoms/popover';
 export { Progress } from './components/atoms/progress';
 export { Select } from './components/atoms/select';
-export { Skeleton } from './components/atoms/skeleton';
 export { Slider } from './components/atoms/slider';
 export { Switch } from './components/atoms/switch';
 export { Table } from './components/atoms/table';
@@ -53,5 +52,7 @@ export { ToastProvider, toast } from './components/organisms/toast';
 // ─── Primitives ──────────────────────────────────────────────────────────────
 export { Divider } from './components/primitives/divider';
 export type * from './components/primitives/divider/types';
+export { Skeleton } from './components/primitives/skeleton';
+export type * from './components/primitives/skeleton/types';
 export { Spacer } from './components/primitives/spacer';
 export type * from './components/primitives/spacer/types';

From db28a90550fd4064790073177e6baa36c7a504d2 Mon Sep 17 00:00:00 2001
From: egdev6 <egdev6@gmail.com>
Date: Fri, 24 Jul 2026 15:42:59 +0200
Subject: [PATCH 2/2] fix(deps): resolve high audit findings

---
 package.json   |  5 +++++
 pnpm-lock.yaml | 45 +++++++++++++++++++++++++--------------------
 2 files changed, 30 insertions(+), 20 deletions(-)

diff --git a/package.json b/package.json
index 648886d9..c273c709 100644
--- a/package.json
+++ b/package.json
@@ -107,7 +107,12 @@
   },
   "pnpm": {
     "overrides": {
+      "axios@>=1.15.2 <1.18.0": "1.18.0",
+      "brace-expansion@<1.1.16": "1.1.16",
+      "brace-expansion@>=2.0.0 <2.1.2": "2.1.2",
+      "fast-uri@>=3.0.0 <=3.1.3": "3.1.4",
       "form-data": "4.0.6",
+      "js-yaml@>=3.0.0 <3.15.0": "3.15.0",
       "undici": "7.28.0",
       "ws": "8.21.0"
     }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index ce8300df..221ff1ce 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -5,7 +5,12 @@ settings:
   excludeLinksFromLockfile: false
 
 overrides:
+  axios@>=1.15.2 <1.18.0: 1.18.0
+  brace-expansion@<1.1.16: 1.1.16
+  brace-expansion@>=2.0.0 <2.1.2: 2.1.2
+  fast-uri@>=3.0.0 <=3.1.3: 3.1.4
   form-data: 4.0.6
+  js-yaml@>=3.0.0 <3.15.0: 3.15.0
   undici: 7.28.0
   ws: 8.21.0
 
@@ -2237,8 +2242,8 @@ packages:
     peerDependencies:
       playwright: '>1.0.0'
 
-  axios@1.16.1:
-    resolution: {integrity: sha512-caYkukvroVPO8KrzuJEb50Hm07KwfBZPEC3VeFHTsqWHvKTsy54hjJz9BS/cdaypROE2rH6xvm9mHX4fgWkr3A==}
+  axios@1.18.0:
+    resolution: {integrity: sha512-E32NzpYKp++W7XRe52rHiXV2ehxmh3wbdgO7MHeFM+vqxLBYHzt0ElkiImtOBxtOmyp0yoC8C6uESVV84Y2/hw==}
 
   babel-jest@30.4.1:
     resolution: {integrity: sha512-fATAbM8piYxkiXQp3RBXmZHxZVNJZAVXXfyeyCN2Tida3+qJ8ea9UxhiJ2y4fLO90ZImKt6k9FlcH2+rLkJGhw==}
@@ -2280,11 +2285,11 @@ packages:
   bidi-js@1.0.3:
     resolution: {integrity: sha512-RKshQI1R3YQ+n9YJz2QQ147P66ELpa1FQEg20Dk8oW9t2KgLbpDLLp9aGZ7y8WHSshDknG0bknqGw5/tyCs5tw==}
 
-  brace-expansion@1.1.14:
-    resolution: {integrity: sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==}
+  brace-expansion@1.1.16:
+    resolution: {integrity: sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==}
 
-  brace-expansion@2.1.0:
-    resolution: {integrity: sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==}
+  brace-expansion@2.1.2:
+    resolution: {integrity: sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==}
 
   browser-assert@1.2.1:
     resolution: {integrity: sha512-nfulgvOR6S4gt9UKCeGJOuSGBPGiFT6oQ/2UBnvTY/5aQ1PnksW72fhZkM30DzoRRv2WpwZf1vHHEr3mtuXIWQ==}
@@ -2729,8 +2734,8 @@ packages:
   fast-json-stable-stringify@2.1.0:
     resolution: {integrity: sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==}
 
-  fast-uri@3.1.3:
-    resolution: {integrity: sha512-i70LwGWUduXqzicKXWshooq+sWL1K3WUU5rKZNG/0i3a1OSoX3HqhH5WbWwTmqWfor4urUakGPiRQcleRZTwOg==}
+  fast-uri@3.1.4:
+    resolution: {integrity: sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==}
 
   fb-watchman@2.0.2:
     resolution: {integrity: sha512-p5161BqbuCaSnB8jIbzQHOlpgsPmK5rJVDfDKO91Axs5NC1uu3HRQm6wt9cd9/+GtQQIO53JdGXXoyDpTAsgYA==}
@@ -3244,8 +3249,8 @@ packages:
   js-tokens@4.0.0:
     resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
 
-  js-yaml@3.14.2:
-    resolution: {integrity: sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==}
+  js-yaml@3.15.0:
+    resolution: {integrity: sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==}
     hasBin: true
 
   js-yaml@4.3.0:
@@ -5016,7 +5021,7 @@ snapshots:
       camelcase: 5.3.1
       find-up: 4.1.0
       get-package-type: 0.1.0
-      js-yaml: 3.14.2
+      js-yaml: 3.15.0
       resolve-from: 5.0.0
 
   '@istanbuljs/schema@0.1.6': {}
@@ -6413,7 +6418,7 @@ snapshots:
   ajv@8.20.0:
     dependencies:
       fast-deep-equal: 3.1.3
-      fast-uri: 3.1.3
+      fast-uri: 3.1.4
       json-schema-traverse: 1.0.0
       require-from-string: 2.0.2
 
@@ -6504,7 +6509,7 @@ snapshots:
       picocolors: 1.1.1
       playwright: 1.61.1
 
-  axios@1.16.1:
+  axios@1.18.0:
     dependencies:
       follow-redirects: 1.16.0
       form-data: 4.0.6
@@ -6578,12 +6583,12 @@ snapshots:
     dependencies:
       require-from-string: 2.0.2
 
-  brace-expansion@1.1.14:
+  brace-expansion@1.1.16:
     dependencies:
       balanced-match: 1.0.2
       concat-map: 0.0.1
 
-  brace-expansion@2.1.0:
+  brace-expansion@2.1.2:
     dependencies:
       balanced-match: 1.0.2
 
@@ -7007,7 +7012,7 @@ snapshots:
 
   fast-json-stable-stringify@2.1.0: {}
 
-  fast-uri@3.1.3: {}
+  fast-uri@3.1.4: {}
 
   fb-watchman@2.0.2:
     dependencies:
@@ -7737,7 +7742,7 @@ snapshots:
 
   js-tokens@4.0.0: {}
 
-  js-yaml@3.14.2:
+  js-yaml@3.15.0:
     dependencies:
       argparse: 1.0.10
       esprima: 4.0.1
@@ -7974,11 +7979,11 @@ snapshots:
 
   minimatch@3.1.5:
     dependencies:
-      brace-expansion: 1.1.14
+      brace-expansion: 1.1.16
 
   minimatch@9.0.9:
     dependencies:
-      brace-expansion: 2.1.0
+      brace-expansion: 2.1.2
 
   minimist@1.2.8: {}
 
@@ -8726,7 +8731,7 @@ snapshots:
 
   wait-on@7.2.0:
     dependencies:
-      axios: 1.16.1
+      axios: 1.18.0
       joi: 17.13.3
       lodash: 4.18.1
       minimist: 1.2.8