From bd77238411b78bf945a05c5803e220afcbfd1006 Mon Sep 17 00:00:00 2001
From: Edwin Tantawi <edwintantawi.dev@gmail.com>
Date: Fri, 11 Sep 2026 20:30:17 +0700
Subject: [PATCH 01/17] ci(workflows): add checks for pull requests and main

---
 .github/workflows/ci.yml | 115 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 115 insertions(+)
 create mode 100644 .github/workflows/ci.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..9b576b4
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,115 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions: {} # each job declares only the permissions it needs
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  # Superseded pull request runs are safe to drop; main runs always finish.
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  check:
+    name: Check
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read # to check out repo (actions/checkout)
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+      - name: Set up Vite+ and install dependencies
+        uses: voidzero-dev/setup-vp@v1.19.0
+        with:
+          cache: true
+      - name: Format, lint and type check
+        run: vp check
+
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read # to check out repo (actions/checkout)
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+      - name: Set up Vite+ and install dependencies
+        uses: voidzero-dev/setup-vp@v1.19.0
+        with:
+          cache: true
+      - name: Run tests
+        run: vp test run --coverage
+
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read # to check out repo (actions/checkout)
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+      - name: Set up Vite+ and install dependencies
+        uses: voidzero-dev/setup-vp@v1.19.0
+        with:
+          cache: true
+      - name: Build packages
+        run: vp run build
+
+  commit:
+    name: Commit message
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read # to check out repo (actions/checkout)
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+      - name: Set up Vite+ and install dependencies
+        uses: voidzero-dev/setup-vp@v1.19.0
+        with:
+          cache: true
+      - name: Lint pull request title
+        env:
+          # Pull requests are squash merged, so the title becomes the commit
+          # subject on main and has to satisfy the same commitlint rules.
+          # Read through the environment, never interpolated into the script.
+          PR_TITLE: ${{ github.event.pull_request.title }}
+        run: printf '%s' "$PR_TITLE" | vp run commitlint
+
+  changeset:
+    name: Changeset
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read # to check out repo (actions/checkout)
+    steps:
+      - name: Check out repo
+        uses: actions/checkout@v7.0.1
+        with:
+          fetch-depth: 0 # changeset status diffs against the base branch
+          persist-credentials: false
+      - name: Set up Vite+ and install dependencies
+        uses: voidzero-dev/setup-vp@v1.19.0
+        with:
+          cache: true
+      - name: Check for a changeset
+        env:
+          BASE_REF: ${{ github.base_ref }}
+        run: vp run changeset status --since="origin/$BASE_REF"

From fcce38dad2fc8ba90c2c22c112fba0188364f380 Mon Sep 17 00:00:00 2001
From: Edwin Tantawi <edwintantawi.dev@gmail.com>
Date: Fri, 11 Sep 2026 20:30:20 +0700
Subject: [PATCH 02/17] docs(community): add contributing, conduct and security
 policies

---
 CODE_OF_CONDUCT.md | 136 +++++++++++++++++++++++++++++++++++++++++++++
 CONTRIBUTING.md    | 120 +++++++++++++++++++++++++++++++++++++++
 SECURITY.md        |  58 +++++++++++++++++++
 3 files changed, 314 insertions(+)
 create mode 100644 CODE_OF_CONDUCT.md
 create mode 100644 CONTRIBUTING.md
 create mode 100644 SECURITY.md

diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
new file mode 100644
index 0000000..1e9441d
--- /dev/null
+++ b/CODE_OF_CONDUCT.md
@@ -0,0 +1,136 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, caste, color, religion, or sexual
+identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+- Demonstrating empathy and kindness toward other people
+- Being respectful of differing opinions, viewpoints, and experiences
+- Giving and gracefully accepting constructive feedback
+- Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+- Focusing on what is best not just for us as individuals, but for the overall
+  community
+
+Examples of unacceptable behavior include:
+
+- The use of sexualized language or imagery, and sexual attention or advances of
+  any kind
+- Trolling, insulting or derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others' private information, such as a physical or email address,
+  without their explicit permission
+- Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official e-mail address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement by opening a
+[private report](https://github.com/devsantara/batik/security/advisories/new) on
+this repository. It is the private channel GitHub gives us, and it is visible
+only to the maintainers — you do not need to be reporting a security issue to
+use it.
+
+All complaints will be reviewed and investigated promptly and fairly. All
+community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+If the behavior also violates
+[GitHub's Acceptable Use Policies](https://docs.github.com/site-policy/acceptable-use-policies/github-acceptable-use-policies),
+you can additionally report it to GitHub at
+https://github.com/contact/report-abuse.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series of
+actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or permanent
+ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior, harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within the
+community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.1, available at
+https://www.contributor-covenant.org/version/2/1/code_of_conduct.html.
+
+Community Impact Guidelines were inspired by
+[Mozilla's code of conduct enforcement ladder](https://github.com/mozilla/diversity).
+
+[homepage]: https://www.contributor-covenant.org
+
+For answers to common questions about this code of conduct, see the FAQ at
+https://www.contributor-covenant.org/faq. Translations are available at
+https://www.contributor-covenant.org/translations.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..1a26766
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,120 @@
+# Contributing to Batik
+
+Thanks for taking the time to contribute.
+
+Batik is a pnpm workspace built on [Vite+](https://viteplus.dev), which wraps the
+runtime, the package manager, and the frontend toolchain behind a single `vp`
+CLI. You do not need to install Node.js or pnpm yourself — `vp` downloads the
+versions pinned in `package.json` under `devEngines`.
+
+## Setup
+
+Install `vp` once, globally:
+
+```bash
+# macOS / Linux
+curl -fsSL https://vite.plus | bash
+
+# Windows
+irm https://vite.plus/ps1 | iex
+```
+
+Then clone and install:
+
+```bash
+git clone git@github.com:devsantara/batik.git
+cd batik
+vp install
+```
+
+`vp install` runs the `prepare` script, which installs the Git hooks in
+`.vite-hooks/`. Those hooks format and lint staged files on commit and validate
+your commit message, so the first `vp install` is not optional.
+
+Run `vp install` again after every pull — the dependency catalog in
+`pnpm-workspace.yaml` moves with it.
+
+## Working on a change
+
+| Command          | What it does                                    |
+| ---------------- | ----------------------------------------------- |
+| `vp check`       | Format, lint and type check the whole workspace |
+| `vp check --fix` | The same, writing the fixes it can apply        |
+| `vp test`        | Run the test suite in watch mode                |
+| `vp test run`    | Run the test suite once                         |
+| `vp run build`   | Build every package                             |
+
+Run `vp check` and `vp test run` before opening a pull request. CI runs exactly
+these commands, so a clean local run means a green PR.
+
+`vp <name>` is a built-in command and `vp run <name>` is a `package.json` script
+or a `vite.config.ts` task. They are not interchangeable: `vp check` is the
+built-in checker, `vp run check` is the script. When in doubt, `vp help` and
+`vp <command> --help` list what is available.
+
+If setup, runtime, or package-manager behavior looks wrong, run `vp env doctor`
+and include its output when you ask for help.
+
+## Commit messages
+
+Commits follow [Conventional Commits](https://www.conventionalcommits.org) and
+are enforced by commitlint through the `commit-msg` hook. A **scope is
+required**, and the header is capped at 72 characters:
+
+```
+feat(tokens): add a neutral color scale
+fix(react): forward ref on Button
+docs(readme): document the token naming rules
+```
+
+The full rule set lives in `commitlint.config.ts`. To read it as JSON:
+
+```bash
+vp run commitlint --print-config json
+```
+
+To validate a message before you use it (exit code `0` means valid):
+
+```bash
+printf '%s' "feat(tokens): add a neutral color scale" | vp run commitlint
+```
+
+If the hook rejects your commit, fix the rules named in brackets — for example
+`[subject-case]` — and try again. **Never use `git commit --no-verify`.**
+
+Pull requests are squash merged, so the **pull request title becomes the commit
+subject on `main`** and has to pass the same rules. CI checks it for you.
+
+## Changesets
+
+Every change that affects a published package needs a changeset. It is what
+decides the next version number and writes the changelog entry:
+
+```bash
+vp run changeset
+```
+
+Pick the affected packages, pick `patch` / `minor` / `major`, and describe the
+change in a sentence a consumer of the package would understand. Commit the
+generated file in `.changeset/` alongside your code.
+
+Changes that ship nothing to npm — CI config, repo docs, tooling — do not need
+one.
+
+Releases are automated: once a pull request with changesets lands on `main`, a
+bot opens a "version packages" pull request. Merging that one publishes to npm.
+Maintainers handle this; you do not need to.
+
+## Pull requests
+
+- Branch off `main`.
+- Keep the pull request focused on one thing. Several small pull requests land
+  faster than one large one.
+- Fill in the pull request template.
+- Open an issue first for anything large or architectural, so you do not spend
+  time on an approach that will not be merged.
+
+## Code of Conduct
+
+This project ships a [Code of Conduct](./CODE_OF_CONDUCT.md). By participating,
+you agree to uphold it.
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..1fa7f9e
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,58 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+**Please do not report security vulnerabilities through public issues, pull
+requests, or discussions.**
+
+Report them privately through GitHub instead:
+
+> [**Open a private security advisory**](https://github.com/devsantara/batik/security/advisories/new)
+
+Only the maintainers can see a report filed this way, and it gives us a private
+place to work with you on a fix before anything becomes public.
+
+If you cannot use that form for any reason, open a regular issue saying only
+that you have a security report to make — no details — and a maintainer will
+reach out.
+
+## What to include
+
+The more of this you can give us, the faster we can confirm and fix it:
+
+- The affected package and version
+- The type of issue and where it is in the source
+- Step-by-step instructions to reproduce it, ideally a minimal repository
+- A proof of concept, if you have one
+- What an attacker could do with it
+
+## What to expect
+
+- **Within 72 hours** — we acknowledge the report.
+- **Within 7 days** — we confirm whether it is a vulnerability and tell you what
+  we plan to do.
+- **Then** — we keep you updated as we work on the fix, and credit you in the
+  advisory when it publishes, unless you would rather stay anonymous.
+
+We ask that you give us a reasonable window to ship a fix before disclosing
+publicly. We will not take legal action against anyone who reports in good faith
+and follows this policy.
+
+## Supported versions
+
+Batik is pre-1.0. Only the latest published version of each package receives
+security fixes. Older versions are not patched — please upgrade.
+
+## How releases are secured
+
+- Packages publish from GitHub Actions with
+  [npm trusted publishing](https://docs.npmjs.com/trusted-publishers) (OIDC). No
+  long-lived npm tokens exist in this repository.
+- The publish job runs in a protected `npm` environment that requires a
+  maintainer to approve each release.
+- Release workflows check out with `persist-credentials: false` and every job
+  declares the narrowest permissions it needs.
+- Third-party actions are pinned to exact versions.
+- Dependency updates wait out a minimum release age before they can be installed
+  (`minimumReleaseAge` in `pnpm-workspace.yaml`), which blunts the window for a
+  compromised upstream release.

From 2b00428388bf1079a9615b42972bab69487c0685 Mon Sep 17 00:00:00 2001
From: Edwin Tantawi <edwintantawi.dev@gmail.com>
Date: Fri, 11 Sep 2026 20:30:23 +0700
Subject: [PATCH 03/17] chore(github): add issue forms, pull request and
 codeowners templates

---
 .github/CODEOWNERS                         |  4 ++
 .github/ISSUE_TEMPLATE/bug_report.yml      | 77 ++++++++++++++++++++++
 .github/ISSUE_TEMPLATE/config.yml          | 11 ++++
 .github/ISSUE_TEMPLATE/feature_request.yml | 55 ++++++++++++++++
 .github/PULL_REQUEST_TEMPLATE.md           | 40 +++++++++++
 5 files changed, 187 insertions(+)
 create mode 100644 .github/CODEOWNERS
 create mode 100644 .github/ISSUE_TEMPLATE/bug_report.yml
 create mode 100644 .github/ISSUE_TEMPLATE/config.yml
 create mode 100644 .github/ISSUE_TEMPLATE/feature_request.yml
 create mode 100644 .github/PULL_REQUEST_TEMPLATE.md

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..40412ce
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,4 @@
+# Review is requested from these owners on every pull request.
+# https://docs.github.com/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+
+* @edwintantawi
diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
new file mode 100644
index 0000000..3a08a82
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -0,0 +1,77 @@
+name: Bug report
+description: Something in Batik does not work the way it is documented
+labels: ['bug', 'triage']
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for the report. A minimal reproduction is the single most useful
+        thing you can give us — it usually turns a week of back and forth into
+        an afternoon.
+
+  - type: checkboxes
+    id: preflight
+    attributes:
+      label: Before you start
+      options:
+        - label: I searched the existing issues and this has not been reported yet.
+          required: true
+        - label: I am on the latest version of the affected package.
+          required: true
+
+  - type: input
+    id: package
+    attributes:
+      label: Affected package and version
+      placeholder: '@devsantara/batik-tokens@0.2.1'
+    validations:
+      required: true
+
+  - type: textarea
+    id: description
+    attributes:
+      label: What happened
+      description: What you saw, and what you expected instead.
+    validations:
+      required: true
+
+  - type: input
+    id: reproduction
+    attributes:
+      label: Reproduction
+      description: >-
+        A link to a minimal repository or a StackBlitz that shows the bug.
+        Issues without one may be closed without investigation.
+      placeholder: https://github.com/your-name/batik-bug
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        1. Install the package
+        2. Render `<Button />`
+        3. See the token fall back to the wrong value
+    validations:
+      required: true
+
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: >-
+        Paste the output of `vp env doctor`, plus your OS, browser and bundler
+        if they are relevant.
+      render: shell
+    validations:
+      required: true
+
+  - type: textarea
+    id: context
+    attributes:
+      label: Anything else
+      description: Logs, screenshots, or a guess at the cause.
+    validations:
+      required: false
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
new file mode 100644
index 0000000..73a0176
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -0,0 +1,11 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Question or half-formed idea
+    url: https://github.com/devsantara/batik/discussions
+    about: Ask how to use Batik, or float an idea before it becomes a proposal.
+  - name: Security vulnerability
+    url: https://github.com/devsantara/batik/security/advisories/new
+    about: Report privately. Please do not open a public issue for this.
+  - name: Devsantara
+    url: https://www.devsantara.com
+    about: Everything else we build.
diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml
new file mode 100644
index 0000000..a6a11d2
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/feature_request.yml
@@ -0,0 +1,55 @@
+name: Feature request
+description: Suggest a component, token, or API for Batik
+labels: ['enhancement', 'triage']
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Batik is a design system, so additions carry a long support tail. Tell
+        us about the problem first — it often has a cheaper solution than the
+        one that brought you here.
+
+  - type: checkboxes
+    id: preflight
+    attributes:
+      label: Before you start
+      options:
+        - label: I searched the existing issues and this has not been proposed yet.
+          required: true
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: The problem
+      description: >-
+        What are you trying to build, and where does Batik get in the way today?
+      placeholder: >-
+        I need a dense table row, and the spacing tokens only go down to `md`.
+    validations:
+      required: true
+
+  - type: textarea
+    id: solution
+    attributes:
+      label: What you would like
+      description: The API, token, or component you have in mind. Sketch it out.
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: What you tried instead
+      description: >-
+        Workarounds you have already used, and why they are not good enough.
+    validations:
+      required: false
+
+  - type: textarea
+    id: context
+    attributes:
+      label: Anything else
+      description: >-
+        Prior art from other design systems, links, screenshots.
+    validations:
+      required: false
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
new file mode 100644
index 0000000..fd431b3
--- /dev/null
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -0,0 +1,40 @@
+<!--
+  The title of this pull request becomes the commit subject on main, so it has
+  to pass commitlint: `type(scope): subject`, lowercase, no trailing period,
+  72 characters or fewer. For example: `feat(tokens): add a neutral color scale`
+-->
+
+## What this changes
+
+<!-- What the reader gets that they did not have before. One or two sentences. -->
+
+## Why
+
+<!--
+  The problem behind the change. Link the issue it closes:
+  Closes #123
+-->
+
+## How to check it
+
+<!--
+  How a reviewer confirms this works. Steps, a screenshot, or the test that
+  now covers it.
+-->
+
+## Checklist
+
+- [ ] `vp check` passes
+- [ ] `vp test run` passes
+- [ ] I added a changeset (`vp run changeset`), or this ships nothing to npm
+- [ ] I updated the docs and types affected by this change
+- [ ] Breaking changes are called out below
+
+## Breaking changes
+
+<!--
+  Delete this section if there are none. Otherwise: what breaks, and what a
+  consumer has to do about it.
+-->
+
+None.

From 42a3dd538aa1dc5e9f972c006669ba761c7d88f1 Mon Sep 17 00:00:00 2001
From: Edwin Tantawi <edwintantawi.dev@gmail.com>
Date: Fri, 11 Sep 2026 20:30:26 +0700
Subject: [PATCH 04/17] chore(renovate): automate dependency updates

---
 .github/renovate.json5 | 68 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 68 insertions(+)
 create mode 100644 .github/renovate.json5

diff --git a/.github/renovate.json5 b/.github/renovate.json5
new file mode 100644
index 0000000..8cd8776
--- /dev/null
+++ b/.github/renovate.json5
@@ -0,0 +1,68 @@
+{
+  $schema: 'https://docs.renovatebot.com/renovate-schema.json',
+  extends: [
+    'config:recommended',
+    ':semanticCommits',
+    ':semanticCommitScope(deps)',
+    ':dependencyDashboard',
+    'group:monorepos',
+    'group:recommended',
+    'replacements:all',
+    'workarounds:all',
+  ],
+
+  timezone: 'Asia/Jakarta',
+  schedule: ['before 9am on monday'],
+  labels: ['dependencies'],
+
+  // Commitlint requires `type(scope): subject`, lowercase, at most 72
+  // characters. Dropping Renovate's default "dependency " prefix from the topic
+  // keeps titles inside that budget for most packages; grouping does the rest.
+  commitMessageTopic: '{{depName}}',
+
+  // Wait out fresh releases before touching them. This has to stay at or above
+  // `minimumReleaseAge` in pnpm-workspace.yaml, or Renovate will open pull
+  // requests that `vp install` then refuses to resolve.
+  minimumReleaseAge: '3 days',
+  internalChecksFilter: 'strict',
+
+  lockFileMaintenance: {
+    enabled: true,
+    schedule: ['before 9am on the first day of the month'],
+  },
+
+  osvVulnerabilityAlerts: true,
+  vulnerabilityAlerts: {
+    // Known vulnerabilities do not wait.
+    minimumReleaseAge: null,
+    schedule: ['at any time'],
+    labels: ['dependencies', 'security'],
+  },
+
+  packageRules: [
+    {
+      // vite-plus, the vite alias and the platform binaries are one release
+      // train. Splitting them across pull requests produces a workspace that
+      // does not install.
+      matchPackageNames: ['vite-plus', 'vite', 'vitest', '@voidzero-dev/**', '@vitest/**'],
+      groupName: 'vite+ toolchain',
+    },
+    {
+      matchPackageNames: ['@commitlint/**'],
+      groupName: 'commitlint',
+    },
+    {
+      matchPackageNames: ['@changesets/**'],
+      groupName: 'changesets',
+    },
+    {
+      matchManagers: ['github-actions'],
+      groupName: 'github actions',
+    },
+    {
+      // Majors land on their own so the changelog gets read.
+      matchUpdateTypes: ['major'],
+      dependencyDashboardApproval: true,
+    },
+  ],
+}

From d5792cec3588329fcfac151ee8ff27e1eded6a84 Mon Sep 17 00:00:00 2001
From: Edwin Tantawi <edwintantawi.dev@gmail.com>
Date: Fri, 11 Sep 2026 20:30:29 +0700
Subject: [PATCH 05/17] docs(readme): describe status, packages and
 contributing

---
 README.md | 41 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)

diff --git a/README.md b/README.md
index 87e41ed..9bc4c3e 100644
--- a/README.md
+++ b/README.md
@@ -6,6 +6,47 @@
   <h1>devsantara/batik</h1>
   <p>Token-first design system for StyleX.</p>
   <a href="https://github.com/devsantara"><img alt="Made by Devsantara" src="https://img.shields.io/badge/Made_By-Devsantara-0F172A.svg?style=for-the-badge&labelColor=000000"></a>
+  <a href="https://github.com/devsantara/batik/actions/workflows/ci.yml"><img alt="CI" src="https://img.shields.io/github/actions/workflow/status/devsantara/batik/ci.yml?branch=main&style=for-the-badge&labelColor=000000"></a>
   <a href="./LICENSE"><img alt="MIT License" src="https://img.shields.io/github/license/devsantara/batik?style=for-the-badge&labelColor=000000"></a>
   <a href="https://github.com/devsantara/batik/graphs/contributors"><img alt="contributors" src="https://img.shields.io/github/contributors/devsantara/batik?style=for-the-badge&labelColor=000000"></a>
 </div>
+
+## Status
+
+Batik is in early development. **Nothing is published to npm yet**, so there is
+no install command to give you. The repository is public so the design work
+happens in the open — watch it or open a discussion if you want to follow along.
+
+## What it is
+
+Batik treats design tokens as the interface. Instead of shipping components that
+happen to be themeable, it defines the token layer first — color, spacing,
+typography, elevation — and builds everything else on top of it, compiled by
+[StyleX](https://stylexjs.com) into static CSS with no runtime cost.
+
+## Packages
+
+This is a pnpm workspace. Packages live in `packages/` and publish under the
+`@devsantara` scope.
+
+| Package              | Version | Description |
+| -------------------- | ------- | ----------- |
+| _None published yet_ |         |             |
+
+## Documentation
+
+Coming with the first release.
+
+## Contributing
+
+Bug reports, ideas and pull requests are welcome.
+[CONTRIBUTING.md](./CONTRIBUTING.md) covers the setup, the commands, the commit
+convention and how changesets work here. Everyone taking part is expected to
+follow the [Code of Conduct](./CODE_OF_CONDUCT.md).
+
+Found a security problem? Do not open an issue —
+[SECURITY.md](./SECURITY.md) explains how to report it privately.
+
+## License
+
+[MIT](./LICENSE) © [Devsantara](https://www.devsantara.com)

From b75f90823473266865a849501c58be28ed57249c Mon Sep 17 00:00:00 2001
From: Edwin Tantawi <edwintantawi.dev@gmail.com>
Date: Fri, 11 Sep 2026 20:33:59 +0700
Subject: [PATCH 06/17] fix(workflows): build recursively so an empty workspace
 plans

---
 .github/workflows/ci.yml      | 5 ++++-
 .github/workflows/release.yml | 5 ++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9b576b4..471e2c8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -66,7 +66,10 @@ jobs:
         with:
           cache: true
       - name: Build packages
-        run: vp run build
+        # `-r` rather than the root `build` script: the script's own
+        # nested `vp run -r build` cannot plan a workspace that has no
+        # package defining `build` yet.
+        run: vp run -r build
 
   commit:
     name: Commit message
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 241a24b..16895f4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -77,7 +77,10 @@ jobs:
         with:
           cache: false # avoid cache poisoning in release jobs
       - name: Build packages
-        run: vp run build
+        # `-r` rather than the root `build` script: the script's own
+        # nested `vp run -r build` cannot plan a workspace that has no
+        # package defining `build` yet.
+        run: vp run -r build
       - name: Pack packages
         id: pack
         uses: changesets/action/pack@v2.1.2

From b20a4d01ab5f1d905e0500808521e5f60b10f3b9 Mon Sep 17 00:00:00 2001
From: Edwin Tantawi <edwintantawi.dev@gmail.com>
Date: Fri, 11 Sep 2026 20:46:05 +0700
Subject: [PATCH 07/17] docs(security): drop the supported versions section

---
 SECURITY.md | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/SECURITY.md b/SECURITY.md
index 1fa7f9e..b8698d7 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -38,11 +38,6 @@ We ask that you give us a reasonable window to ship a fix before disclosing
 publicly. We will not take legal action against anyone who reports in good faith
 and follows this policy.
 
-## Supported versions
-
-Batik is pre-1.0. Only the latest published version of each package receives
-security fixes. Older versions are not patched — please upgrade.
-
 ## How releases are secured
 
 - Packages publish from GitHub Actions with

From 96c5f87800500b58a3abda27a6f8ddde9271c16a Mon Sep 17 00:00:00 2001
From: Edwin Tantawi <edwintantawi.dev@gmail.com>
Date: Fri, 11 Sep 2026 21:01:28 +0700
Subject: [PATCH 08/17] docs(readme): replace status sections with a
 development notice

Drop the Status, What it is, Packages and Documentation sections along
with the CI badge, and state the pre-1.0 caveat in a single GitHub alert
instead. Point the license credit at the GitHub profile.
---
 README.md | 32 +++++---------------------------
 1 file changed, 5 insertions(+), 27 deletions(-)

diff --git a/README.md b/README.md
index 9bc4c3e..f66987a 100644
--- a/README.md
+++ b/README.md
@@ -6,36 +6,14 @@
   <h1>devsantara/batik</h1>
   <p>Token-first design system for StyleX.</p>
   <a href="https://github.com/devsantara"><img alt="Made by Devsantara" src="https://img.shields.io/badge/Made_By-Devsantara-0F172A.svg?style=for-the-badge&labelColor=000000"></a>
-  <a href="https://github.com/devsantara/batik/actions/workflows/ci.yml"><img alt="CI" src="https://img.shields.io/github/actions/workflow/status/devsantara/batik/ci.yml?branch=main&style=for-the-badge&labelColor=000000"></a>
   <a href="./LICENSE"><img alt="MIT License" src="https://img.shields.io/github/license/devsantara/batik?style=for-the-badge&labelColor=000000"></a>
   <a href="https://github.com/devsantara/batik/graphs/contributors"><img alt="contributors" src="https://img.shields.io/github/contributors/devsantara/batik?style=for-the-badge&labelColor=000000"></a>
 </div>
 
-## Status
-
-Batik is in early development. **Nothing is published to npm yet**, so there is
-no install command to give you. The repository is public so the design work
-happens in the open — watch it or open a discussion if you want to follow along.
-
-## What it is
-
-Batik treats design tokens as the interface. Instead of shipping components that
-happen to be themeable, it defines the token layer first — color, spacing,
-typography, elevation — and builds everything else on top of it, compiled by
-[StyleX](https://stylexjs.com) into static CSS with no runtime cost.
-
-## Packages
-
-This is a pnpm workspace. Packages live in `packages/` and publish under the
-`@devsantara` scope.
-
-| Package              | Version | Description |
-| -------------------- | ------- | ----------- |
-| _None published yet_ |         |             |
-
-## Documentation
-
-Coming with the first release.
+> [!WARNING]
+> Batik is in early development and not ready for production use. Nothing is
+> published to npm yet, and the API is not stable. Breaking changes can land
+> in any release before 1.0.
 
 ## Contributing
 
@@ -49,4 +27,4 @@ Found a security problem? Do not open an issue —
 
 ## License
 
-[MIT](./LICENSE) © [Devsantara](https://www.devsantara.com)
+[MIT](./LICENSE) © [Devsantara](https://github.com/devsantara)

From b03b03314946fd83d9a5a442ec7982a1c1dbbc81 Mon Sep 17 00:00:00 2001
From: Edwin Tantawi <edwintantawi.dev@gmail.com>
Date: Fri, 11 Sep 2026 21:01:31 +0700
Subject: [PATCH 09/17] docs(github): point devsantara link at the github
 profile

---
 .github/ISSUE_TEMPLATE/config.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
index 73a0176..c6aba37 100644
--- a/.github/ISSUE_TEMPLATE/config.yml
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -7,5 +7,5 @@ contact_links:
     url: https://github.com/devsantara/batik/security/advisories/new
     about: Report privately. Please do not open a public issue for this.
   - name: Devsantara
-    url: https://www.devsantara.com
+    url: https://github.com/devsantara
     about: Everything else we build.

From 88c79eac3273841513a5848c2175641bd2df7829 Mon Sep 17 00:00:00 2001
From: Edwin Tantawi <edwintantawi.dev@gmail.com>
Date: Fri, 11 Sep 2026 21:06:01 +0700
Subject: [PATCH 10/17] ci(workflows): run only on pull requests, drop build
 and changeset

The main ruleset required a Build check that no longer reports, so its
required status checks are now Check and Test.
---
 .github/workflows/ci.yml | 50 +---------------------------------------
 1 file changed, 1 insertion(+), 49 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 471e2c8..98b24cc 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,16 +2,12 @@ name: CI
 
 on:
   pull_request:
-  push:
-    branches:
-      - main
 
 permissions: {} # each job declares only the permissions it needs
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
-  # Superseded pull request runs are safe to drop; main runs always finish.
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  cancel-in-progress: true
 
 jobs:
   check:
@@ -50,30 +46,8 @@ jobs:
       - name: Run tests
         run: vp test run --coverage
 
-  build:
-    name: Build
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    permissions:
-      contents: read # to check out repo (actions/checkout)
-    steps:
-      - name: Check out repo
-        uses: actions/checkout@v7.0.1
-        with:
-          persist-credentials: false
-      - name: Set up Vite+ and install dependencies
-        uses: voidzero-dev/setup-vp@v1.19.0
-        with:
-          cache: true
-      - name: Build packages
-        # `-r` rather than the root `build` script: the script's own
-        # nested `vp run -r build` cannot plan a workspace that has no
-        # package defining `build` yet.
-        run: vp run -r build
-
   commit:
     name: Commit message
-    if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     timeout-minutes: 20
     permissions:
@@ -94,25 +68,3 @@ jobs:
           # Read through the environment, never interpolated into the script.
           PR_TITLE: ${{ github.event.pull_request.title }}
         run: printf '%s' "$PR_TITLE" | vp run commitlint
-
-  changeset:
-    name: Changeset
-    if: github.event_name == 'pull_request'
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    permissions:
-      contents: read # to check out repo (actions/checkout)
-    steps:
-      - name: Check out repo
-        uses: actions/checkout@v7.0.1
-        with:
-          fetch-depth: 0 # changeset status diffs against the base branch
-          persist-credentials: false
-      - name: Set up Vite+ and install dependencies
-        uses: voidzero-dev/setup-vp@v1.19.0
-        with:
-          cache: true
-      - name: Check for a changeset
-        env:
-          BASE_REF: ${{ github.base_ref }}
-        run: vp run changeset status --since="origin/$BASE_REF"

From 30657a204d0ec5450fedc223cd47e9ae5029cc95 Mon Sep 17 00:00:00 2001
From: Edwin Tantawi <edwintantawi.dev@gmail.com>
Date: Sat, 12 Sep 2026 02:03:28 +0700
Subject: [PATCH 11/17] chore(scripts): drop scripts that duplicate vp
 built-ins

---
 package.json | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/package.json b/package.json
index c9fc513..cbbc9c3 100644
--- a/package.json
+++ b/package.json
@@ -20,13 +20,6 @@
   "type": "module",
   "scripts": {
     "prepare": "vp config",
-    "build": "vp run -r build",
-    "dev": "vp run -r dev",
-    "start": "vp run -r start",
-    "format": "vp fmt",
-    "format:check": "vp fmt --check",
-    "lint": "vp lint",
-    "lint:fix": "vp lint --fix",
     "check": "vp check",
     "check:fix": "vp check --fix",
     "test": "vp test",

From b74afc374846480ef3cc9f39e2eb01ee8c65464f Mon Sep 17 00:00:00 2001
From: Edwin Tantawi <edwintantawi.dev@gmail.com>
Date: Sat, 12 Sep 2026 02:03:45 +0700
Subject: [PATCH 12/17] docs(contributing): rewrite the contributing guide from
 scratch

Cover every way to contribute, not just code: questions, bug reports,
feature requests, first contributions, setup, commit rules, changesets,
review expectations and releases.
---
 CONTRIBUTING.md | 359 ++++++++++++++++++++++++++++++++++++++----------
 1 file changed, 287 insertions(+), 72 deletions(-)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 1a26766..04810aa 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,120 +1,335 @@
 # Contributing to Batik
 
-Thanks for taking the time to contribute.
+First off, thank you. Batik is a token-first design system for
+[StyleX](https://stylexjs.com), and it gets better every time someone reports a
+rough edge, asks a sharp question, or sends a fix.
+
+This guide explains how the project works so your time goes into the
+contribution itself instead of guessing at process. None of it is meant to
+gatekeep. If something here is unclear or gets in your way, that is a bug in
+this document, and we would like to hear about it.
+
+> [!NOTE]
+> Batik is in early development. The API is not stable, nothing is on npm yet,
+> and large parts of the design are still moving. Open an issue before you
+> start on anything bigger than a small fix, so your work does not collide with
+> changes already underway.
+
+## Contents
+
+- [Ways to contribute](#ways-to-contribute)
+- [Asking questions](#asking-questions)
+- [Reporting bugs](#reporting-bugs)
+- [Suggesting features](#suggesting-features)
+- [Reporting security issues](#reporting-security-issues)
+- [Your first contribution](#your-first-contribution)
+- [Development setup](#development-setup)
+- [Making a change](#making-a-change)
+- [Commit messages](#commit-messages)
+- [Changesets](#changesets)
+- [Opening a pull request](#opening-a-pull-request)
+- [Code review](#code-review)
+- [Releases](#releases)
+- [Code of Conduct](#code-of-conduct)
+- [License](#license)
 
-Batik is a pnpm workspace built on [Vite+](https://viteplus.dev), which wraps the
-runtime, the package manager, and the frontend toolchain behind a single `vp`
-CLI. You do not need to install Node.js or pnpm yourself — `vp` downloads the
-versions pinned in `package.json` under `devEngines`.
+## Ways to contribute
 
-## Setup
+Code is only one way to help. All of these count:
 
-Install `vp` once, globally:
+- **Report bugs** with a reproduction someone else can run.
+- **Propose ideas** for tokens, primitives, or APIs, and argue for them.
+- **Improve documentation**: fix a typo, clarify a paragraph, add an example
+  that would have saved you an hour.
+- **Review pull requests.** A second pair of eyes, even with no merge rights,
+  catches real problems.
+- **Answer questions** in [Discussions][discussions].
+- **Try Batik** in a real project and tell us where it hurt.
 
-```bash
-# macOS / Linux
-curl -fsSL https://vite.plus | bash
+## Asking questions
 
-# Windows
-irm https://vite.plus/ps1 | iex
-```
+Use [GitHub Discussions][discussions] for questions, "how do I…", and
+half-formed ideas. The issue tracker is for bugs and concrete proposals, and
+keeping it that way lets maintainers act on it quickly.
+
+Before you ask, search existing discussions and issues. Someone may have
+already asked.
+
+## Reporting bugs
+
+Search [open and closed issues][issues] first. If you find a match, add a 👍
+reaction or new information to it instead of opening a duplicate. "+1" comments
+notify everyone watching and do not help anyone fix the problem.
+
+If nothing matches, [open a bug report][new-issue]. A good report has:
+
+- **A minimal reproduction.** A small repository or a StackBlitz link is best.
+  A bug we can reproduce is a bug we can fix. A bug we cannot reproduce
+  usually stalls.
+- **Expected versus actual behavior**, stated plainly.
+- **Versions** of Batik, StyleX, Node.js, your bundler, and your OS.
+- **Error output** pasted as text, not screenshots.
+
+## Suggesting features
+
+[Open a feature request][new-issue] and lead with the problem, not the
+solution. "I can't express X without Y" gives us far more to work with than
+"add option Z". Describe what you tried, why it fell short, and who else is
+likely to run into the same thing.
+
+Not every good idea fits Batik. A design system stays useful by staying
+coherent, so a "no" or "not yet" is a statement about scope, not about the
+quality of your idea.
+
+## Reporting security issues
 
-Then clone and install:
+**Do not report security vulnerabilities in public issues, discussions, or pull
+requests.** Follow [SECURITY.md](./SECURITY.md) to report them privately
+through a GitHub security advisory.
+
+## Your first contribution
+
+New to open source, or new to this project? Welcome. Some ways in:
+
+- Look for issues labelled
+  [`good first issue`][good-first-issue]. They are scoped to be approachable
+  without deep knowledge of the codebase.
+- Look for [`help wanted`][help-wanted] issues, which the maintainers want
+  done but have not gotten to.
+- Documentation fixes are always a good first pull request.
+
+Comment on an issue before you start working on it, so two people do not solve
+the same problem in parallel. If an issue has been claimed but has seen no
+activity for a couple of weeks, ask whether it is still in progress.
+
+Never contributed to a project on GitHub before?
+[How to Contribute to Open Source](https://opensource.guide/how-to-contribute/)
+and
+[First Contributions](https://github.com/firstcontributions/first-contributions)
+walk through forking, branching, and opening a pull request.
+
+## Development setup
+
+### Prerequisites
+
+Batik uses [Vite+](https://viteplus.dev), a unified toolchain that wraps
+Node.js, pnpm, Vite, Vitest, Oxlint, and Oxfmt behind one CLI called `vp`.
+[Install Vite+](https://viteplus.dev/guide/#install-vp) first. It downloads the
+exact Node.js and pnpm versions this repository pins, so you do not need to
+install or manage them yourself.
+
+### Get the code
+
+[Fork the repository](https://github.com/devsantara/batik/fork), then:
 
 ```bash
-git clone git@github.com:devsantara/batik.git
+git clone https://github.com/<your-username>/batik.git
 cd batik
+git remote add upstream https://github.com/devsantara/batik.git
 vp install
 ```
 
-`vp install` runs the `prepare` script, which installs the Git hooks in
-`.vite-hooks/`. Those hooks format and lint staged files on commit and validate
-your commit message, so the first `vp install` is not optional.
+`vp install` installs dependencies and sets up the Git hooks that format staged
+files and lint commit messages. Run it again whenever you pull new changes.
+
+### Project layout
 
-Run `vp install` again after every pull — the dependency catalog in
-`pnpm-workspace.yaml` moves with it.
+This is a pnpm workspace:
 
-## Working on a change
+| Path          | What lives there                                   |
+| ------------- | -------------------------------------------------- |
+| `packages/*`  | Published libraries                                |
+| `apps/*`      | Documentation, playgrounds, and other private apps |
+| `.changeset/` | Pending release notes                              |
+| `.github/`    | CI workflows, issue and pull request templates     |
 
-| Command          | What it does                                    |
-| ---------------- | ----------------------------------------------- |
-| `vp check`       | Format, lint and type check the whole workspace |
-| `vp check --fix` | The same, writing the fixes it can apply        |
-| `vp test`        | Run the test suite in watch mode                |
-| `vp test run`    | Run the test suite once                         |
-| `vp run build`   | Build every package                             |
+### Commands
 
-Run `vp check` and `vp test run` before opening a pull request. CI runs exactly
-these commands, so a clean local run means a green PR.
+| Command                  | What it does                                |
+| ------------------------ | ------------------------------------------- |
+| `vp check`               | Format, lint, and type check the whole repo |
+| `vp check --fix`         | Same, and apply every automatic fix it can  |
+| `vp test`                | Run the test suite                          |
+| `vp test watch`          | Run the test suite in watch mode            |
+| `vp test run --coverage` | Run the test suite once and report coverage |
+| `vp run changeset`       | Write a changeset for your change           |
 
-`vp <name>` is a built-in command and `vp run <name>` is a `package.json` script
-or a `vite.config.ts` task. They are not interchangeable: `vp check` is the
-built-in checker, `vp run check` is the script. When in doubt, `vp help` and
-`vp <command> --help` list what is available.
+`vp <name>` runs a built-in Vite+ command. `vp run <name>` runs a script from
+`package.json`. When in doubt, `vp help` lists everything.
 
-If setup, runtime, or package-manager behavior looks wrong, run `vp env doctor`
-and include its output when you ask for help.
+If your environment misbehaves, run `vp env doctor` and include its output
+when you ask for help.
+
+## Making a change
+
+1. **Sync with upstream** and branch off `main`:
+
+   ```bash
+   git switch main
+   git pull upstream main
+   vp install
+   git switch -c fix/token-contrast
+   ```
+
+2. **Keep it focused.** One pull request should do one thing. A bug fix, a
+   refactor, and a formatting sweep are three pull requests. Small pull
+   requests get reviewed faster and are easier to revert.
+
+3. **Add tests.** A bug fix comes with a test that fails without it. A feature
+   comes with tests that pin down its behavior. If something is hard to test,
+   say so in the pull request, and we will work it out together.
+
+4. **Update the docs** that your change affects, including types and JSDoc on
+   public APIs.
+
+5. **Run the checks** before you push:
+
+   ```bash
+   vp check
+   vp test
+   ```
+
+   CI runs the same commands, so a clean local run means a green pull request.
+
+### Code style
+
+Formatting and linting are automated. Oxfmt and Oxlint run on staged files
+when you commit and again in CI, so do not spend review time arguing about
+style by hand. Beyond what the tools enforce:
+
+- Match the style of the code around you.
+- Prefer clear names over comments. Use comments to explain _why_, not _what_.
+- Do not add a dependency without discussing it in an issue first. Every
+  dependency becomes something our users install too.
 
 ## Commit messages
 
-Commits follow [Conventional Commits](https://www.conventionalcommits.org) and
-are enforced by commitlint through the `commit-msg` hook. A **scope is
-required**, and the header is capped at 72 characters:
+Commit messages follow
+[Conventional Commits](https://www.conventionalcommits.org), with a required
+scope:
 
-```
-feat(tokens): add a neutral color scale
-fix(react): forward ref on Button
-docs(readme): document the token naming rules
+```text
+<type>(<scope>): <subject>
+
+[optional body]
+
+[optional footer]
 ```
 
-The full rule set lives in `commitlint.config.ts`. To read it as JSON:
+For example:
 
-```bash
-vp run commitlint --print-config json
+```text
+feat(tokens): add a neutral color scale
+fix(theme): keep dark mode overrides when nesting themes
+docs(readme): clarify the install steps
 ```
 
-To validate a message before you use it (exit code `0` means valid):
+- **Types:** `feat`, `fix`, `docs`, `style`, `refactor`, `perf`, `test`,
+  `build`, `ci`, `chore`, `revert`.
+- **Scope:** the area you touched, such as a package or a subsystem.
+- **Subject:** imperative mood ("add", not "added"), lowercase, no trailing
+  period, and a header of 72 characters at most.
+
+The full rule set lives in [`commitlint.config.ts`](./commitlint.config.ts),
+and a `commit-msg` hook enforces it. To check a message up front (exit code `0`
+means it passes):
 
 ```bash
 printf '%s' "feat(tokens): add a neutral color scale" | vp run commitlint
 ```
 
-If the hook rejects your commit, fix the rules named in brackets — for example
-`[subject-case]` — and try again. **Never use `git commit --no-verify`.**
+If the hook rejects a commit, the rule names in brackets, such as
+`[subject-case]`, tell you what to fix. Please do not bypass the hook with
+`--no-verify`.
 
-Pull requests are squash merged, so the **pull request title becomes the commit
-subject on `main`** and has to pass the same rules. CI checks it for you.
+Inside your branch, commit however you like. Pull requests are squash merged,
+so the **pull request title** becomes the final commit on `main` and has to
+pass the same rules. CI checks it.
 
 ## Changesets
 
-Every change that affects a published package needs a changeset. It is what
-decides the next version number and writes the changelog entry:
+Batik uses [Changesets](https://github.com/changesets/changesets) to version
+packages and write the changelog. If your change affects a published package,
+add a changeset:
 
 ```bash
 vp run changeset
 ```
 
-Pick the affected packages, pick `patch` / `minor` / `major`, and describe the
-change in a sentence a consumer of the package would understand. Commit the
-generated file in `.changeset/` alongside your code.
-
-Changes that ship nothing to npm — CI config, repo docs, tooling — do not need
-one.
+Pick the affected packages and the kind of version bump, then write one or two
+sentences **for the people who use Batik**, not for the people who build it.
+"Fix focus rings disappearing in high contrast mode" is useful in a changelog.
+"Refactor ring util" is not. Commit the generated file in `.changeset/` with
+the rest of your change.
+
+Choosing the bump:
+
+| Bump    | When                                                    |
+| ------- | ------------------------------------------------------- |
+| `major` | Consumers must change their code to upgrade             |
+| `minor` | New functionality that is backwards compatible          |
+| `patch` | Bug fixes and changes that do not affect the public API |
+
+Changes that ship nothing to npm, such as docs, CI, or tests, do not need a
+changeset.
+
+## Opening a pull request
+
+1. Push your branch to your fork and
+   [open a pull request](https://github.com/devsantara/batik/compare) against
+   `main`.
+2. Give it a title that passes commitlint (see
+   [Commit messages](#commit-messages)).
+3. Fill in the pull request template. Explain what changes and why, and
+   link the issue it resolves with `Closes #123`.
+4. Call out breaking changes explicitly, along with what consumers need to do.
+5. Tick **Allow edits from maintainers**, so we can push small fixes without a
+   round trip.
+
+Open a **draft** pull request if you want early feedback on a direction before
+you polish it.
+
+## Code review
+
+Every pull request needs approval from a maintainer before it merges.
+
+- **What we look at:** whether the change fits Batik's direction, whether it is
+  correct and tested, and whether the public API it adds is one we want to
+  support for years.
+- **Response time:** Batik is maintained by a small team, so a first response
+  can take a few days. If a week goes by with no reply, a polite ping on the
+  pull request is welcome.
+- **Feedback is about the code, not about you.** Reviewers explain the reason
+  behind a request. If you disagree, say so. Discussion is part of review, and
+  reviewers get things wrong too.
+- **Addressing feedback:** push new commits instead of force pushing, so
+  reviewers can see what changed since their last pass. Everything is squashed
+  on merge anyway.
+
+Sometimes a pull request does not get merged, because the scope changed or the
+approach does not fit. When that happens we will explain why. Opening an issue
+before large work is the best way to avoid it.
+
+## Releases
+
+Maintainers handle releases. When changes with changesets land on `main`, a
+bot opens a release pull request that bumps versions and updates the
+changelog. Merging that pull request publishes to npm. You do not need to do
+anything beyond including a changeset.
 
-Releases are automated: once a pull request with changesets lands on `main`, a
-bot opens a "version packages" pull request. Merging that one publishes to npm.
-Maintainers handle this; you do not need to.
+## Code of Conduct
 
-## Pull requests
+Everyone taking part in this project is expected to follow the
+[Code of Conduct](./CODE_OF_CONDUCT.md). Please report unacceptable behavior as
+it describes.
 
-- Branch off `main`.
-- Keep the pull request focused on one thing. Several small pull requests land
-  faster than one large one.
-- Fill in the pull request template.
-- Open an issue first for anything large or architectural, so you do not spend
-  time on an approach that will not be merged.
+## License
 
-## Code of Conduct
+By contributing to Batik, you agree that your contributions are licensed under
+the [MIT License](./LICENSE) that covers the project.
 
-This project ships a [Code of Conduct](./CODE_OF_CONDUCT.md). By participating,
-you agree to uphold it.
+[discussions]: https://github.com/devsantara/batik/discussions
+[issues]: https://github.com/devsantara/batik/issues?q=is%3Aissue
+[new-issue]: https://github.com/devsantara/batik/issues/new/choose
+[good-first-issue]: https://github.com/devsantara/batik/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22
+[help-wanted]: https://github.com/devsantara/batik/issues?q=is%3Aissue+is%3Aopen+label%3A%22help+wanted%22

From 8dd81d2f17daff7c5788b44872d4f92fcb98e24e Mon Sep 17 00:00:00 2001
From: Edwin Tantawi <edwintantawi.dev@gmail.com>
Date: Sat, 12 Sep 2026 02:07:26 +0700
Subject: [PATCH 13/17] docs(github): remove the pull request template

Drop .github/PULL_REQUEST_TEMPLATE.md and the contributing guide's references to it.
---
 .github/PULL_REQUEST_TEMPLATE.md | 40 --------------------------------
 CONTRIBUTING.md                  |  6 ++---
 2 files changed, 3 insertions(+), 43 deletions(-)
 delete mode 100644 .github/PULL_REQUEST_TEMPLATE.md

diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
deleted file mode 100644
index fd431b3..0000000
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ /dev/null
@@ -1,40 +0,0 @@
-<!--
-  The title of this pull request becomes the commit subject on main, so it has
-  to pass commitlint: `type(scope): subject`, lowercase, no trailing period,
-  72 characters or fewer. For example: `feat(tokens): add a neutral color scale`
--->
-
-## What this changes
-
-<!-- What the reader gets that they did not have before. One or two sentences. -->
-
-## Why
-
-<!--
-  The problem behind the change. Link the issue it closes:
-  Closes #123
--->
-
-## How to check it
-
-<!--
-  How a reviewer confirms this works. Steps, a screenshot, or the test that
-  now covers it.
--->
-
-## Checklist
-
-- [ ] `vp check` passes
-- [ ] `vp test run` passes
-- [ ] I added a changeset (`vp run changeset`), or this ships nothing to npm
-- [ ] I updated the docs and types affected by this change
-- [ ] Breaking changes are called out below
-
-## Breaking changes
-
-<!--
-  Delete this section if there are none. Otherwise: what breaks, and what a
-  consumer has to do about it.
--->
-
-None.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 04810aa..e390701 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -141,7 +141,7 @@ This is a pnpm workspace:
 | `packages/*`  | Published libraries                                |
 | `apps/*`      | Documentation, playgrounds, and other private apps |
 | `.changeset/` | Pending release notes                              |
-| `.github/`    | CI workflows, issue and pull request templates     |
+| `.github/`    | CI workflows and issue templates                   |
 
 ### Commands
 
@@ -280,8 +280,8 @@ changeset.
    `main`.
 2. Give it a title that passes commitlint (see
    [Commit messages](#commit-messages)).
-3. Fill in the pull request template. Explain what changes and why, and
-   link the issue it resolves with `Closes #123`.
+3. In the description, explain what changes and why, and link the issue it
+   resolves with `Closes #123`.
 4. Call out breaking changes explicitly, along with what consumers need to do.
 5. Tick **Allow edits from maintainers**, so we can push small fixes without a
    round trip.

From 99326c1ead62963b8c29830cff04c4714739607a Mon Sep 17 00:00:00 2001
From: Edwin Tantawi <edwintantawi.dev@gmail.com>
Date: Sat, 12 Sep 2026 02:24:02 +0700
Subject: [PATCH 14/17] docs(github): tighten the issue templates

- Fix the Contributing Guidelines link, which 404ed without blob/main
- Ask bug reporters for Batik, React, StyleX and bundler versions instead
  of `vp env doctor`, which users of the package do not have
- Use the @batik/ namespace in placeholders and widen both template
  descriptions beyond documented behavior and new components
- Ask for a StyleX-ready reproduction and soften the closing warning
- Add a documentation check to the feature request preflight
- Drop the Devsantara contact link from the issue chooser
---
 .github/ISSUE_TEMPLATE/bug_report.yml      | 24 ++++++++++++++--------
 .github/ISSUE_TEMPLATE/config.yml          |  3 ---
 .github/ISSUE_TEMPLATE/feature_request.yml |  7 +++++--
 3 files changed, 20 insertions(+), 14 deletions(-)

diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
index 3a08a82..d32fffa 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.yml
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -1,5 +1,5 @@
 name: Bug report
-description: Something in Batik does not work the way it is documented
+description: Something in Batik is broken or behaves unexpectedly
 labels: ['bug', 'triage']
 body:
   - type: markdown
@@ -13,17 +13,18 @@ body:
     id: preflight
     attributes:
       label: Before you start
+      description: By submitting this issue, you agree to follow our [Contributing Guidelines](https://github.com/devsantara/batik/blob/main/CONTRIBUTING.md).
       options:
-        - label: I searched the existing issues and this has not been reported yet.
+        - label: I searched the existing issues or PRs and this has not been reported yet.
           required: true
-        - label: I am on the latest version of the affected package.
+        - label: I can reproduce this on the latest published version of the affected package.
           required: true
 
   - type: input
     id: package
     attributes:
       label: Affected package and version
-      placeholder: '@devsantara/batik-tokens@0.2.1'
+      placeholder: '@batik/<package>@<version>'
     validations:
       required: true
 
@@ -40,8 +41,9 @@ body:
     attributes:
       label: Reproduction
       description: >-
-        A link to a minimal repository or a StackBlitz that shows the bug.
-        Issues without one may be closed without investigation.
+        A link to a minimal repository or a StackBlitz that shows the bug,
+        with the StyleX compiler plugin set up for your bundler. We may close
+        issues we cannot reproduce.
       placeholder: https://github.com/your-name/batik-bug
     validations:
       required: true
@@ -62,9 +64,13 @@ body:
     attributes:
       label: Environment
       description: >-
-        Paste the output of `vp env doctor`, plus your OS, browser and bundler
-        if they are relevant.
-      render: shell
+        Versions of Batik packages, React, and @stylexjs/stylex, your bundler
+        and StyleX plugin, and the browser if relevant.
+      placeholder: |
+        @batik/<package> <version>
+        react 19.1.0, @stylexjs/stylex 0.x
+        Vite 7 + @stylexjs/unplugin, Chrome 140
+      render: text
     validations:
       required: true
 
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
index c6aba37..025ed15 100644
--- a/.github/ISSUE_TEMPLATE/config.yml
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -6,6 +6,3 @@ contact_links:
   - name: Security vulnerability
     url: https://github.com/devsantara/batik/security/advisories/new
     about: Report privately. Please do not open a public issue for this.
-  - name: Devsantara
-    url: https://github.com/devsantara
-    about: Everything else we build.
diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml
index a6a11d2..3dc07f3 100644
--- a/.github/ISSUE_TEMPLATE/feature_request.yml
+++ b/.github/ISSUE_TEMPLATE/feature_request.yml
@@ -1,5 +1,5 @@
 name: Feature request
-description: Suggest a component, token, or API for Batik
+description: Suggest a new feature or an improvement to Batik
 labels: ['enhancement', 'triage']
 body:
   - type: markdown
@@ -13,8 +13,11 @@ body:
     id: preflight
     attributes:
       label: Before you start
+      description: By submitting this issue, you agree to follow our [Contributing Guidelines](https://github.com/devsantara/batik/blob/main/CONTRIBUTING.md).
       options:
-        - label: I searched the existing issues and this has not been proposed yet.
+        - label: I read the documentation and this is not already possible.
+          required: true
+        - label: I searched the existing issues or PRs and this has not been proposed yet.
           required: true
 
   - type: textarea

From f5c321fb3d7cd541e00210c76ff7e4a2e7069148 Mon Sep 17 00:00:00 2001
From: Edwin Tantawi <edwintantawi.dev@gmail.com>
Date: Sat, 12 Sep 2026 02:28:50 +0700
Subject: [PATCH 15/17] chore(github): remove codeowners and renovate config

---
 .github/CODEOWNERS     |  4 ---
 .github/renovate.json5 | 68 ------------------------------------------
 2 files changed, 72 deletions(-)
 delete mode 100644 .github/CODEOWNERS
 delete mode 100644 .github/renovate.json5

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
deleted file mode 100644
index 40412ce..0000000
--- a/.github/CODEOWNERS
+++ /dev/null
@@ -1,4 +0,0 @@
-# Review is requested from these owners on every pull request.
-# https://docs.github.com/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
-
-* @edwintantawi
diff --git a/.github/renovate.json5 b/.github/renovate.json5
deleted file mode 100644
index 8cd8776..0000000
--- a/.github/renovate.json5
+++ /dev/null
@@ -1,68 +0,0 @@
-{
-  $schema: 'https://docs.renovatebot.com/renovate-schema.json',
-  extends: [
-    'config:recommended',
-    ':semanticCommits',
-    ':semanticCommitScope(deps)',
-    ':dependencyDashboard',
-    'group:monorepos',
-    'group:recommended',
-    'replacements:all',
-    'workarounds:all',
-  ],
-
-  timezone: 'Asia/Jakarta',
-  schedule: ['before 9am on monday'],
-  labels: ['dependencies'],
-
-  // Commitlint requires `type(scope): subject`, lowercase, at most 72
-  // characters. Dropping Renovate's default "dependency " prefix from the topic
-  // keeps titles inside that budget for most packages; grouping does the rest.
-  commitMessageTopic: '{{depName}}',
-
-  // Wait out fresh releases before touching them. This has to stay at or above
-  // `minimumReleaseAge` in pnpm-workspace.yaml, or Renovate will open pull
-  // requests that `vp install` then refuses to resolve.
-  minimumReleaseAge: '3 days',
-  internalChecksFilter: 'strict',
-
-  lockFileMaintenance: {
-    enabled: true,
-    schedule: ['before 9am on the first day of the month'],
-  },
-
-  osvVulnerabilityAlerts: true,
-  vulnerabilityAlerts: {
-    // Known vulnerabilities do not wait.
-    minimumReleaseAge: null,
-    schedule: ['at any time'],
-    labels: ['dependencies', 'security'],
-  },
-
-  packageRules: [
-    {
-      // vite-plus, the vite alias and the platform binaries are one release
-      // train. Splitting them across pull requests produces a workspace that
-      // does not install.
-      matchPackageNames: ['vite-plus', 'vite', 'vitest', '@voidzero-dev/**', '@vitest/**'],
-      groupName: 'vite+ toolchain',
-    },
-    {
-      matchPackageNames: ['@commitlint/**'],
-      groupName: 'commitlint',
-    },
-    {
-      matchPackageNames: ['@changesets/**'],
-      groupName: 'changesets',
-    },
-    {
-      matchManagers: ['github-actions'],
-      groupName: 'github actions',
-    },
-    {
-      // Majors land on their own so the changelog gets read.
-      matchUpdateTypes: ['major'],
-      dependencyDashboardApproval: true,
-    },
-  ],
-}

From 134d1137a7d31ae16349e84f7171f91d5680bd69 Mon Sep 17 00:00:00 2001
From: Edwin Tantawi <edwintantawi.dev@gmail.com>
Date: Sat, 12 Sep 2026 02:38:58 +0700
Subject: [PATCH 16/17] docs(code-of-conduct): adopt contributor covenant 3.0

Report violations through GitHub private reports, and name the
maintainers as the Community Moderators.
---
 CODE_OF_CONDUCT.md | 276 +++++++++++++++++++++++++--------------------
 1 file changed, 155 insertions(+), 121 deletions(-)

diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
index 1e9441d..a53ab1b 100644
--- a/CODE_OF_CONDUCT.md
+++ b/CODE_OF_CONDUCT.md
@@ -1,136 +1,170 @@
-# Contributor Covenant Code of Conduct
+# Contributor Covenant 3.0 Code of Conduct
 
 ## Our Pledge
 
-We as members, contributors, and leaders pledge to make participation in our
-community a harassment-free experience for everyone, regardless of age, body
-size, visible or invisible disability, ethnicity, sex characteristics, gender
-identity and expression, level of experience, education, socio-economic status,
-nationality, personal appearance, race, caste, color, religion, or sexual
-identity and orientation.
-
-We pledge to act and interact in ways that contribute to an open, welcoming,
-diverse, inclusive, and healthy community.
-
-## Our Standards
-
-Examples of behavior that contributes to a positive environment for our
-community include:
-
-- Demonstrating empathy and kindness toward other people
-- Being respectful of differing opinions, viewpoints, and experiences
-- Giving and gracefully accepting constructive feedback
-- Accepting responsibility and apologizing to those affected by our mistakes,
-  and learning from the experience
-- Focusing on what is best not just for us as individuals, but for the overall
-  community
-
-Examples of unacceptable behavior include:
-
-- The use of sexualized language or imagery, and sexual attention or advances of
-  any kind
-- Trolling, insulting or derogatory comments, and personal or political attacks
-- Public or private harassment
-- Publishing others' private information, such as a physical or email address,
-  without their explicit permission
-- Other conduct which could reasonably be considered inappropriate in a
-  professional setting
-
-## Enforcement Responsibilities
-
-Community leaders are responsible for clarifying and enforcing our standards of
-acceptable behavior and will take appropriate and fair corrective action in
-response to any behavior that they deem inappropriate, threatening, offensive,
-or harmful.
-
-Community leaders have the right and responsibility to remove, edit, or reject
-comments, commits, code, wiki edits, issues, and other contributions that are
-not aligned to this Code of Conduct, and will communicate reasons for moderation
-decisions when appropriate.
-
-## Scope
-
-This Code of Conduct applies within all community spaces, and also applies when
-an individual is officially representing the community in public spaces.
-Examples of representing our community include using an official e-mail address,
-posting via an official social media account, or acting as an appointed
-representative at an online or offline event.
-
-## Enforcement
-
-Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported to the community leaders responsible for enforcement by opening a
+We pledge to make our community welcoming, safe, and equitable for all.
+
+We are committed to fostering an environment that respects and promotes the
+dignity, rights, and contributions of all individuals, regardless of
+characteristics including race, ethnicity, caste, color, age, physical
+characteristics, neurodiversity, disability, sex or gender, gender identity or
+expression, sexual orientation, language, philosophy or religion, national or
+social origin, socio-economic position, level of education, or other status.
+The same privileges of participation are extended to everyone who participates
+in good faith and in accordance with this Covenant.
+
+## Encouraged Behaviors
+
+While acknowledging differences in social norms, we all strive to meet our
+community's expectations for positive behavior. We also understand that our
+words and actions may be interpreted differently than we intend based on
+culture, background, or native language.
+
+With these considerations in mind, we agree to behave mindfully toward each
+other and act in ways that center our shared values, including:
+
+1. Respecting the **purpose of our community**, our activities, and our ways of
+   gathering.
+2. Engaging **kindly and honestly** with others.
+3. Respecting **different viewpoints** and experiences.
+4. **Taking responsibility** for our actions and contributions.
+5. Gracefully giving and accepting **constructive feedback**.
+6. Committing to **repairing harm** when it occurs.
+7. Behaving in other ways that promote and sustain the **well-being of our
+   community**.
+
+## Restricted Behaviors
+
+We agree to restrict the following behaviors in our community. Instances,
+threats, and promotion of these behaviors are violations of this Code of
+Conduct.
+
+1. **Harassment.** Violating explicitly expressed boundaries or engaging in
+   unnecessary personal attention after any clear request to stop.
+2. **Character attacks.** Making insulting, demeaning, or pejorative comments
+   directed at a community member or group of people.
+3. **Stereotyping or discrimination.** Characterizing anyone’s personality or
+   behavior on the basis of immutable identities or traits.
+4. **Sexualization.** Behaving in a way that would generally be considered
+   inappropriately intimate in the context or purpose of the community.
+5. **Violating confidentiality**. Sharing or acting on someone's personal or
+   private information without their permission.
+6. **Endangerment.** Causing, encouraging, or threatening violence or other harm
+   toward any person or group.
+7. Behaving in other ways that **threaten the well-being** of our community.
+
+### Other Restrictions
+
+1. **Misleading identity.** Impersonating someone else for any reason, or
+   pretending to be someone else to evade enforcement actions.
+2. **Failing to credit sources.** Not properly crediting the sources of content
+   you contribute.
+3. **Promotional materials**. Sharing marketing or other commercial content in a
+   way that is outside the norms of the community.
+4. **Irresponsible communication.** Failing to responsibly present content which
+   includes, links or describes any other restricted behaviors.
+
+## Reporting an Issue
+
+Tensions can occur between community members even when they are trying their
+best to collaborate. Not every conflict represents a code of conduct violation,
+and this Code of Conduct reinforces encouraged behaviors and norms that can help
+avoid conflicts and minimize harm.
+
+When an incident does occur, it is important to report it promptly. To report a
+possible violation, open a
 [private report](https://github.com/devsantara/batik/security/advisories/new) on
 this repository. It is the private channel GitHub gives us, and it is visible
 only to the maintainers — you do not need to be reporting a security issue to
-use it.
-
-All complaints will be reviewed and investigated promptly and fairly. All
-community leaders are obligated to respect the privacy and security of the
-reporter of any incident.
-
-If the behavior also violates
+use it. If the behavior also violates
 [GitHub's Acceptable Use Policies](https://docs.github.com/site-policy/acceptable-use-policies/github-acceptable-use-policies),
 you can additionally report it to GitHub at
 https://github.com/contact/report-abuse.
 
-## Enforcement Guidelines
+Community Moderators take reports of violations seriously and will make every
+effort to respond in a timely manner. They will investigate all reports of code
+of conduct violations, reviewing messages, logs, and recordings, or interviewing
+witnesses and other participants. Community Moderators will keep investigation
+and enforcement actions as transparent as possible while prioritizing safety
+and confidentiality. In order to honor these values, enforcement actions are
+carried out in private with the involved parties, but communicating to the whole
+community may be part of a mutually agreed upon resolution.
+
+## Addressing and Repairing Harm
+
+The maintainers of this repository act as its Community Moderators. If an
+investigation by the Community Moderators finds that this Code of Conduct has
+been violated, the following enforcement ladder may be used to determine how
+best to repair harm, based on the incident's impact on the individuals involved
+and the community as a whole. Depending on the severity of a violation, lower
+rungs on the ladder may be skipped.
+
+1. Warning
+   1. Event: A violation involving a single incident or series of incidents.
+   2. Consequence: A private, written warning from the Community Moderators.
+   3. Repair: Examples of repair include a private written apology,
+      acknowledgement of responsibility, and seeking clarification on
+      expectations.
+2. Temporarily Limited Activities
+   1. Event: A repeated incidence of a violation that previously resulted in a
+      warning, or the first incidence of a more serious violation.
+   2. Consequence: A private, written warning with a time-limited cooldown
+      period designed to underscore the seriousness of the situation and give
+      the community members involved time to process the incident. The cooldown
+      period may be limited to particular communication channels or
+      interactions with particular community members.
+   3. Repair: Examples of repair may include making an apology, using the
+      cooldown period to reflect on actions and impact, and being thoughtful
+      about re-entering community spaces after the period is over.
+3. Temporary Suspension
+   1. Event: A pattern of repeated violation which the Community Moderators have
+      tried to address with warnings, or a single serious violation.
+   2. Consequence: A private written warning with conditions for return from
+      suspension. In general, temporary suspensions give the person being
+      suspended time to reflect upon their behavior and possible corrective
+      actions.
+   3. Repair: Examples of repair include respecting the spirit of the
+      suspension, meeting the specified conditions for return, and being
+      thoughtful about how to reintegrate with the community when the
+      suspension is lifted.
+4. Permanent Ban
+   1. Event: A pattern of repeated code of conduct violations that other steps
+      on the ladder have failed to resolve, or a violation so serious that the
+      Community Moderators determine there is no way to keep the community safe
+      with this person as a member.
+   2. Consequence: Access to all community spaces, tools, and communication
+      channels is removed. In general, permanent bans should be rarely used,
+      should have strong reasoning behind them, and should only be resorted to
+      if working through other remedies has failed to change the behavior.
+   3. Repair: There is no possible repair in cases of this severity.
+
+This enforcement ladder is intended as a guideline. It does not limit the
+ability of Community Moderators to use their discretion and judgment, in keeping
+with the best interests of our community.
 
-Community leaders will follow these Community Impact Guidelines in determining
-the consequences for any action they deem in violation of this Code of Conduct:
-
-### 1. Correction
-
-**Community Impact**: Use of inappropriate language or other behavior deemed
-unprofessional or unwelcome in the community.
-
-**Consequence**: A private, written warning from community leaders, providing
-clarity around the nature of the violation and an explanation of why the
-behavior was inappropriate. A public apology may be requested.
-
-### 2. Warning
-
-**Community Impact**: A violation through a single incident or series of
-actions.
-
-**Consequence**: A warning with consequences for continued behavior. No
-interaction with the people involved, including unsolicited interaction with
-those enforcing the Code of Conduct, for a specified period of time. This
-includes avoiding interactions in community spaces as well as external channels
-like social media. Violating these terms may lead to a temporary or permanent
-ban.
-
-### 3. Temporary Ban
-
-**Community Impact**: A serious violation of community standards, including
-sustained inappropriate behavior.
-
-**Consequence**: A temporary ban from any sort of interaction or public
-communication with the community for a specified period of time. No public or
-private interaction with the people involved, including unsolicited interaction
-with those enforcing the Code of Conduct, is allowed during this period.
-Violating these terms may lead to a permanent ban.
-
-### 4. Permanent Ban
-
-**Community Impact**: Demonstrating a pattern of violation of community
-standards, including sustained inappropriate behavior, harassment of an
-individual, or aggression toward or disparagement of classes of individuals.
+## Scope
 
-**Consequence**: A permanent ban from any sort of public interaction within the
-community.
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public or other
+spaces. Examples of representing our community include using an official email
+address, posting via an official social media account, or acting as an
+appointed representative at an online or offline event.
 
 ## Attribution
 
-This Code of Conduct is adapted from the [Contributor Covenant][homepage],
-version 2.1, available at
-https://www.contributor-covenant.org/version/2/1/code_of_conduct.html.
-
-Community Impact Guidelines were inspired by
-[Mozilla's code of conduct enforcement ladder](https://github.com/mozilla/diversity).
-
-[homepage]: https://www.contributor-covenant.org
-
-For answers to common questions about this code of conduct, see the FAQ at
-https://www.contributor-covenant.org/faq. Translations are available at
-https://www.contributor-covenant.org/translations.
+This Code of Conduct is adapted from the Contributor Covenant, version 3.0,
+permanently available at
+[https://www.contributor-covenant.org/version/3/0/](https://www.contributor-covenant.org/version/3/0/).
+
+Contributor Covenant is stewarded by the Organization for Ethical Source and
+licensed under CC BY-SA 4.0. To view a copy of this license, visit
+[https://creativecommons.org/licenses/by-sa/4.0/](https://creativecommons.org/licenses/by-sa/4.0/)
+
+For answers to common questions about Contributor Covenant, see the FAQ at
+[https://www.contributor-covenant.org/faq](https://www.contributor-covenant.org/faq).
+Translations are provided at
+[https://www.contributor-covenant.org/translations](https://www.contributor-covenant.org/translations).
+Additional enforcement and community guideline resources can be found at
+[https://www.contributor-covenant.org/resources](https://www.contributor-covenant.org/resources).
+The enforcement ladder was inspired by the work of
+[Mozilla’s code of conduct team](https://github.com/mozilla/inclusion).

From 10b5c53e2777bc4e2c72dd9ad7284879fbebbcd2 Mon Sep 17 00:00:00 2001
From: Edwin Tantawi <edwintantawi.dev@gmail.com>
Date: Sat, 12 Sep 2026 03:01:53 +0700
Subject: [PATCH 17/17] ci(release): run the pack task before packing packages

---
 .github/workflows/release.yml | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 16895f4..95f65ca 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -77,10 +77,7 @@ jobs:
         with:
           cache: false # avoid cache poisoning in release jobs
       - name: Build packages
-        # `-r` rather than the root `build` script: the script's own
-        # nested `vp run -r build` cannot plan a workspace that has no
-        # package defining `build` yet.
-        run: vp run -r build
+        run: vp run -r pack
       - name: Pack packages
         id: pack
         uses: changesets/action/pack@v2.1.2