chore(repo): Wave 1 v1.0.0 rollout — legit docs, SEO, Changesets release pipeline

[faraa2m]

Summary

Wave 1 of the v1.0.0 rollout. Adds the project-credibility surface and switches releases to Changesets so version bumps and CHANGELOG entries happen automatically on merge to main.

This PR is foundation only — no CLI behavior changes, no new flags, no breaking changes.

What's in here

Legitimacy docs

• CODE_OF_CONDUCT.md — Contributor Covenant 2.1, Private-Vulnerability-Reporting contact only (no email exposure).
• CONTRIBUTING.md — local dev setup, code style, honesty contract, how to add a model/provider, Changesets workflow.
• SECURITY.md — GitHub PVR only, supported versions, 90-day default coordinated-disclosure window.
• CHANGELOG.md — backfilled from git log; going forward managed by Changesets.

GitHub surface

• .github/copilot-instructions.md — consumed by gh copilot review. Encodes the no-comments rule, the load-bearing approximate: true honesty contract, Conventional Commits, and the empirical-mode-stays-off-in-Action invariant.
• .github/PULL_REQUEST_TEMPLATE.md — 8-box checklist (tests, lint, typecheck, README, Changesets entry, action-bundle rebuild, breaking-change, secrets).
• .github/ISSUE_TEMPLATE/{bug_report,feature_request,config}.yml — issue forms.
• .github/FUNDING.yml — github: [faraa2m].

README + SEO

• Root README rewrite: badges row, comparison table vs tokencost / tiktoken / gpt-tokenizer / promptfoo / gpt-token-counter-live, ASCII demo of CLI output, project-health checklist links. Findings section preserved verbatim.
• Per-package READMEs: prepended badges row.
• npm description + keywords extended across tokenometer (CLI), @tokenometer/core, @tokenometer/action. Root description: "Tokenometer — LLM cost calculator, token counter, and CI cost-guardrail Action for Claude, GPT-4o, Gemini."
• .github/repo-metadata.md — staged gh repo edit commands for description + topics (apply post-merge).

Marketplace prep (no publish)

• .github/release-notes-v1.0.0.md — draft.
• .github/awesome-list-prs/ — 5 PR-body templates (awesome-llm-apps, awesome-actions, awesome-prompt-engineering, awesome-ai-tools, awesome-llmops).

Changesets release pipeline (auto-bump + auto-CHANGELOG)

• .changeset/config.json — tokenometer and @tokenometer/core are version-fixed (bumping one bumps both); @tokenometer/web and @tokenometer/action ignored from npm publish.
• .changeset/README.md — contributor-facing usage.
• .changeset/legit-docs-and-seo.md — first changeset entry, scoped to this PR (minor bump).
• .github/workflows/release.yml — switched to changesets/action@v1. Pushes to main either open/update a "Version Packages" PR (when changesets accumulate) or publish (when that PR merges). Manual workflow_dispatch retained with a dry-run input.

Phase I (Wave 4) will extend this workflow with VS Code Marketplace publish, Open VSX publish, post-publish smoke test, and Vercel deploy hook.

Why now

• Adoption push needs the project to look like a real OSS project, not a weekend hack. Code-of-Conduct, Security policy, Contributing guide are table stakes for the awesome-list and Marketplace audiences.
• Switching to Changesets early so every subsequent Wave PR adds its own changeset — the CHANGELOG writes itself by v1.0.0.
• .github/copilot-instructions.md lets gh copilot review enforce the project's rules on incoming PRs without humans re-explaining them.

Test plan

• npm run lint clean
• npm run typecheck clean
• npm test — 48/48 pass across 6 test files
• npm run build clean
• Verify gh copilot review reads .github/copilot-instructions.md against this diff (manual; happy path)
• After merge: confirm CI green on main, confirm Changesets workflow ran (should open a Version Packages PR consuming .changeset/legit-docs-and-seo.md, OR no-op if you'd rather hold the version bump for Wave 2)
• After merge: apply gh repo edit commands from .github/repo-metadata.md (description + topics) — these can't ride in the PR
• After merge: enable Private Vulnerability Reporting in repo Settings → Code security → Reporting

Out of scope (later waves)

• Marketplace publish + first GitHub Release (waits for Wave 2/3 features so v1.0.0 is meaningful).
• Awesome-list PR submissions (templates only here; submission is manual after Marketplace publish).
• VS Code extension, Claude Code skill, vision-token cost, Mistral/Cohere providers, --latency flag, playground showcase pages, full Phase I unified release pipeline.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
tokenometer	Ready	Preview, Comment	May 10, 2026 2:25am