@qijenchen/design-system 0.1.0-beta.13 → 0.1.0-beta.130

package/ds-canonical/hooks/check_consumer_code_quality.sh

@@ -0,0 +1,173 @@
+#!/usr/bin/env bash
+# Provider-neutral, standalone consumer source gate. This is intentionally independent of the
+# DS-author post_edit_dispatcher/lib tree so it can ship in the immutable fork corpus and replay in
+# hooks-off CI. Native Claude/Codex events are only accelerators; exit 2 is also asserted directly.
+
+set -uo pipefail
+source "$(dirname "$0")/_log-fire.sh" 2>/dev/null && log_hook_fire
+source "$(dirname "$0")/lib/_provider_paths.sh" 2>/dev/null || {
+  printf 'GOVERNANCE_INTEGRITY: consumer quality project resolver unavailable\n' >&2
+  exit 70
+}
+source "$(dirname "$0")/lib/_hook_integrity.sh" 2>/dev/null || {
+  printf 'GOVERNANCE_INTEGRITY: hook integrity helper unavailable\n' >&2
+  exit 70
+}
+
+governance_hook_load_input
+governance_hook_require_commands grep head perl python3 tr wc
+EVENT=$(printf '%s' "$INPUT" | jq -r '.hook_event_name // .event // ""' 2>/dev/null) \
+  || governance_hook_integrity_fail 'consumer quality event extraction failed'
+FILE_PATH=$(printf '%s' "$INPUT" | jq -r '.tool_input.file_path // .file_path // .path // ""' 2>/dev/null) \
+  || governance_hook_integrity_fail 'consumer quality path extraction failed'
+
+[ "$EVENT" != "PostToolUse" ] && exit 0
+printf '%s' "$FILE_PATH" | grep -Eq '(^|/)apps/[^/]+/src/.*\.[cm]?[jt]sx?$' || exit 0
+FILE_PATH=$(governance_hook_project_file_path "$FILE_PATH" 2>/dev/null) \
+  || governance_hook_integrity_fail 'consumer quality target escapes the project or crosses a symlink'
+if [ -L "$FILE_PATH" ] || [ ! -f "$FILE_PATH" ] || [ ! -r "$FILE_PATH" ]; then
+  governance_hook_integrity_fail 'consumer quality target is unavailable or unsafe'
+fi
+
+# Remove comments before structural signatures. Escape markers are checked against the original.
+BODY=$(perl -0777 -pe 's{\{/\*.*?\*/\}}{}gs; s{/\*.*?\*/}{}gs; s{^[ \t]*//.*$}{}gm' "$FILE_PATH" 2>/dev/null) \
+  || governance_hook_integrity_fail 'consumer quality target could not be parsed'
+VIOLATIONS=""
+add_violation() { VIOLATIONS="${VIOLATIONS}\n- $1"; }
+has_rationale() {
+  local marker="$1"
+  grep -Eq "${marker}:[[:space:]]*.{8,}" "$FILE_PATH" 2>/dev/null
+}
+
+# The deny-list stays in the runner-authenticated corpus. The fork builder mechanically rewrites
+# this canonical source path to references/utility-registry.json; neither role may rediscover a
+# mutable consumer installation or a hook-relative fallback after the trust boundary is crossed.
+CORPUS_ROOT=$(governance_corpus_root 2>/dev/null) \
+  || governance_hook_integrity_fail 'consumer quality corpus root could not be resolved'
+PROJECT_ROOT=$(governance_project_root 2>/dev/null) \
+  || governance_hook_integrity_fail 'consumer quality project root could not be resolved'
+REGISTRY="$CORPUS_ROOT/packages/design-system/src/tokens/utility-registry.json"
+if [ -L "$REGISTRY" ] || [ ! -f "$REGISTRY" ] || [ ! -r "$REGISTRY" ]; then
+  governance_hook_integrity_fail "consumer quality canonical utility registry is unavailable or unsafe:${REGISTRY}"
+fi
+CANONICAL_REGISTRY_OWNER='packages/design-system'"/src/tokens/utility-registry.json"
+SHADCN_ALIASES=$(jq -er --arg owner "$CANONICAL_REGISTRY_OWNER" '
+  select(
+    type == "object"
+    and .schemaVersion == 1
+    and ._meta.owner == $owner
+    and (._meta.provider_view_policy | type == "string" and length > 0)
+  )
+  | .shadcn_alias.block.color_alias
+  | arrays
+  | if length > 0 and (unique | length) == length
+    then .[]
+    else error("empty or duplicate alias registry")
+    end
+' "$REGISTRY" 2>/dev/null) || {
+  governance_hook_integrity_fail 'consumer quality canonical alias registry is invalid'
+}
+while IFS= read -r ALIAS; do
+  printf '%s' "$ALIAS" | grep -Eq '^[a-z][a-z0-9-]*$' || {
+    governance_hook_integrity_fail 'consumer quality canonical alias registry is unsafe'
+  }
+  if grep -Eq "(^|[^A-Za-z0-9_-])${ALIAS}([^A-Za-z0-9_-]|$)" <<<"$BODY"; then
+    add_violation "shadcn compatibility alias ${ALIAS}; consume the direct design-system semantic token"
+  fi
+done <<< "$SHADCN_ALIASES"
+
+# TypeScript escape hatch requires a concrete rationale on the same or immediately preceding line.
+ANY_HITS=$(perl -ne '
+  BEGIN { our $prev = 0; our $hit_count = 0 }
+  my $allow = /any-allow:\s*.{8,}/; next if /^\s*(\/\/|\*|\/\*)/;
+  if (!$prev && !$allow && (/(:\s*any\b|\bas\s+any\b|<any>|\bany\[\]|Record<[^,]+,\s*any>)/)) {
+    print "$.:$_";
+    $hit_count++;
+    exit 0 if $hit_count >= 5;
+  }
+  $prev = $allow;
+' "$FILE_PATH" 2>/dev/null) || governance_hook_integrity_fail 'consumer quality any parser failed'
+[ -n "$ANY_HITS" ] && add_violation "TypeScript any without // any-allow: <specific rationale>: ${ANY_HITS//$'\n'/ | }"
+
+if printf '%s' "$FILE_PATH" | grep -qE '\.tsx$'; then
+  LINES=$(wc -l < "$FILE_PATH" | tr -d ' ') \
+    || governance_hook_integrity_fail 'consumer quality line counter failed'
+  FILE_HEAD=$(sed -n '1,20p' "$FILE_PATH")
+  if [ "${LINES:-0}" -gt 800 ] && ! grep -Eq 'code-quality-allow:[[:space:]]*file-size[[:space:]]+.{8,}' <<<"$FILE_HEAD"; then
+    add_violation "tsx file has ${LINES} lines (>800) without a reasoned file-size exception"
+  fi
+fi
+
+FLAT=$(printf '%s' "$BODY" | tr '\n' ' ')
+
+OVERLAY=$(printf '%s' "$BODY" | perl -0777 -ne 'print "hit" if /<div\b[^>]*className="(?=[^"]*px-\[var\(--layout-space-loose\)\])(?=[^"]*border-(?:b|t))(?=[^"]*border-divider)[^"]*"/s') \
+  || governance_hook_integrity_fail 'consumer quality overlay parser failed'
+if [ -n "$OVERLAY" ] && ! has_rationale 'overlay-handcraft-allow'; then
+  add_violation 'hand-crafted overlay chrome; consume Popover/Dialog/Sheet/Surface header/body/footer primitives'
+fi
+
+RAW_ROW=$(printf '%s' "$BODY" | perl -0777 -ne 'print "hit" if /<div\b[^>]*className="(?=[^"]*\bflex\b)(?=[^"]*\bgap-[12]\b)(?=[^"]*px-\[var\(--layout-space-loose\)\])(?=[^"]*hover:bg-neutral-hover)(?=[^"]*rounded)[^"]*"/s') \
+  || governance_hook_integrity_fail 'consumer quality row parser failed'
+if [ -n "$RAW_ROW" ] && ! has_rationale 'menu-item-handcraft-allow'; then
+  add_violation 'hand-crafted MenuItem-like row; consume the DS row/menu primitive'
+fi
+
+if grep -q 'h-\[var(--chrome-header-height)\]' <<<"$FLAT" \
+  && grep -q 'border-b' <<<"$FLAT" \
+  && grep -q 'border-divider' <<<"$FLAT" \
+  && ! has_rationale '@chrome-header-handcraft-allow'; then
+  add_violation 'hand-crafted chrome header; consume ChromeHeader'
+fi
+
+if grep -Eq 'layout="primary-header"|layout=\{('\''|")primary-header('\''|")\}' <<<"$BODY"; then
+  PRIMARY=""
+  if ! grep -qE 'globalHeader[[:space:]]*=' <<<"$BODY"; then
+    PRIMARY="${PRIMARY}\n- AppShell primary-header layout requires globalHeader"
+  fi
+  if grep -Eq '<SidebarHeader([^A-Za-z]|$)' <<<"$BODY" && ! grep -qE 'useSidebar|isMobile' <<<"$BODY"; then
+    PRIMARY="${PRIMARY}\n- primary-header layout must not duplicate an unguarded SidebarHeader"
+  fi
+  if grep -Eq '<SidebarFooter([^A-Za-z]|$)' <<<"$BODY"; then
+    PRIMARY="${PRIMARY}\n- primary-header account entry belongs in the global/sheet header, not SidebarFooter"
+  fi
+  if [ -n "$PRIMARY" ] && ! has_rationale '@app-shell-primary-header-allow'; then VIOLATIONS="${VIOLATIONS}${PRIMARY}"; fi
+fi
+
+# 帳號入口 duplicate(2026-07-30 WM F9 layer 3;app-shell.spec.md「帳號入口放置 SSOT」:帳號入口只能出現一次)。
+# 上段攔「宣告 primary-header + SidebarFooter」;本段補 mode 字面不在檔內的 dual-entry 缺口(WM 錨例 =
+# apps/work/src/App.tsx pre-fix 1a26bd1^:SidebarHeader 右上 avatar 帳號選單與 SidebarFooter user 區並存):
+#   header 帳號簽名 = SidebarHeader block 內 <AccountMenu> OR(<DropdownMenuTrigger> + <Avatar>/<ItemAvatar>
+#   + account/logout 語彙);footer user 簽名 = SidebarFooter block 內 <Avatar>/<ItemAvatar>/<AccountMenu>。
+# 零誤判 bound(M23 R9 零誤判簽名 precedent;DS apps/template/src + WM 全 corpus 實測 0 hit、錨例 fire):
+#   - workspace switcher in header(trigger+avatar、無 account/logout 語彙)不中 — 語彙 conjunction;
+#   - mobile Sheet 鏡像(header AccountMenu、footer 無 user 區,app-shell.spec.md Responsive 子句)不中;
+#   - 多 mode demo 檔(primary-header + primary-sidebar 字面並存)skip → 跨 story 誤攔防護,歸 product-ui-audit;
+#   - BODY 已 strip 註解(WM 修復檔 SidebarHeader 註解即含「帳號入口」字樣);local 同名元件不中和 —
+#     duplicate 語義違規與 primitive 來源無關。
+ACCOUNT_DUP=$(printf '%s' "$BODY" | python3 -c '
+import re, sys
+content = sys.stdin.read()
+account = re.compile(r"[Aa]ccount|[Ll]og\s?-?[Oo]ut|LogOut|[Ss]ign\s?-?[Oo]ut|SignOut|登出|個人資料|帳號")
+headers = re.findall(r"<SidebarHeader\b[^>]*>.*?</SidebarHeader>", content, re.DOTALL)
+footers = re.findall(r"<SidebarFooter\b[^>]*>.*?</SidebarFooter>", content, re.DOTALL)
+header_account = any(
+    re.search(r"<AccountMenu\b", b)
+    or (re.search(r"<DropdownMenuTrigger\b", b)
+        and re.search(r"<(Avatar|ItemAvatar)\b", b)
+        and account.search(b))
+    for b in headers)
+footer_user = any(re.search(r"<(Avatar|ItemAvatar|AccountMenu)\b", b) for b in footers)
+multi_mode = ("primary-header" in content) and ("primary-sidebar" in content)
+if header_account and footer_user and not multi_mode:
+    print("DUP")
+' 2>/dev/null) \
+  || governance_hook_integrity_fail 'consumer quality account-entry scanner failed'
+if [ "$ACCOUNT_DUP" = "DUP" ] && ! has_rationale '@account-entry-allow'; then
+  add_violation 'duplicate account entry: SidebarHeader account menu + SidebarFooter user area coexist; app-shell.spec.md 帳號入口只能出現一次(primary-sidebar → SidebarFooter / primary-header → globalHeader 右);escape @account-entry-allow: <rationale>'
+fi
+
+if [ -n "$VIOLATIONS" ]; then
+  printf 'GOV-CONSUMER-QUALITY-001:%b\nFile:%s\n' "$VIOLATIONS" "$FILE_PATH" >&2
+  exit 2
+fi
+exit 0

package/ds-canonical/hooks/check_datatable_invariants.sh

@@ -1,25 +1,90 @@
 #!/bin/bash
-# DataTable unified invariant hook(2026-05-08 cluster B consolidation)
+# check_datatable_invariants.sh — DataTable invariants multi-rule
 #
-# Merges 3 DataTable hooks(原各檔已 retire,合併入此):
-#   B.1 row drag getRowId(原 check_data_table_row_drag_get_row_id,P2 stderr)
-#   B.2 column size NUMBER → meta.width(原 check_data_table_size_num_to_meta_width,P2 stderr)
-#   B.3 filter↔sort sibling sync reminder(原 check_data_table_sort_parallel,P2 reminder)
-#
-# Why merge:皆 DataTable-family invariant,共用 INPUT parsing + tsx filter pattern。
-# 散裝是 M17 SSOT 違反 + Anthropic ≤ 15 hook best-practice 偏離。
-#
-# 全 3 sub-rules 都是 P2 stderr-only(原檔皆 exit 0),所以本 hook 統一 exit 0。
-# 同時掛 PreToolUse + PostToolUse OK(reminder 性質,雙 event fire 不 break 任何流程,
-# 但本實作 settings.json 只 register PreToolUse 避免 fire 重複)。
+# 2026-06-11 prune merge:r2 = 原 check_data_table_size_num_to_meta_width.sh
+# (TanStack size:number → meta.width wrap,M23(c) anchor;規則逐字搬入)。
+# 原檔 → packages/design-system/ds-canonical/hooks/retired/2026-06-11-prune-merge/
 
 source "$(dirname "$0")/_log-fire.sh" 2>/dev/null && log_hook_fire
 
 set -uo pipefail
 
+_HOOK_CONTEXT_EVENT="PreToolUse"
+_HOOK_CAPTURE_DIR=$(mktemp -d "${TMPDIR:-/tmp}/check-datatable-invariants.XXXXXX") || {
+  printf '🚨 GOVERNANCE_INTEGRITY: DATATABLE INVARIANTS FAILURE: output capture unavailable\n' >&2
+  exit 70
+}
+_HOOK_STDOUT_CAPTURE="$_HOOK_CAPTURE_DIR/stdout"
+_HOOK_STDERR_CAPTURE="$_HOOK_CAPTURE_DIR/stderr"
+exec 3>&1 4>&2
+exec >"$_HOOK_STDOUT_CAPTURE" 2>"$_HOOK_STDERR_CAPTURE"
+
+_finalize_hook_output() {
+  _hook_rc=$?
+  trap - EXIT
+  exec 1>&3 2>&4
+  _hook_stdout=$(cat "$_HOOK_STDOUT_CAPTURE" 2>/dev/null || true)
+  _hook_stderr=$(cat "$_HOOK_STDERR_CAPTURE" 2>/dev/null || true)
+  rm -rf -- "$_HOOK_CAPTURE_DIR" 2>/dev/null || true
+
+  case "$_hook_rc" in
+    0)
+      if [ -n "$_hook_stderr" ]; then
+        printf '🚨 GOVERNANCE_INTEGRITY: DATATABLE INVARIANTS FAILURE: rc0 child output included raw stderr\n' >&2
+        exit 70
+      fi
+      [ -z "$_hook_stdout" ] && exit 0
+      _encoded_warning=$(jq -cn \
+        --arg event "$_HOOK_CONTEXT_EVENT" \
+        --arg message "$_hook_stdout" \
+        '{governanceContext:{hookEventName:$event,message:$message}}') || {
+        printf '🚨 GOVERNANCE_INTEGRITY: DATATABLE INVARIANTS FAILURE: warning envelope encoding failed\n' >&2
+        exit 70
+      }
+      printf '%s\n' "$_encoded_warning"
+      exit 0
+      ;;
+    2)
+      if [ -z "$_hook_stdout" ] && [ -n "$_hook_stderr" ] \
+        && ! grep -qF 'GOVERNANCE_INTEGRITY:' <<<"$_hook_stderr"; then
+        printf '%s\n' "$_hook_stderr" >&2
+        exit 2
+      fi
+      printf '🚨 GOVERNANCE_INTEGRITY: DATATABLE INVARIANTS FAILURE: rc2 必須是 stderr-only nonempty policy blocker\n' >&2
+      exit 70
+      ;;
+    70)
+      if [ -z "$_hook_stdout" ] && [ -n "$_hook_stderr" ] \
+        && grep -qF 'GOVERNANCE_INTEGRITY:' <<<"$_hook_stderr"; then
+        printf '%s\n' "$_hook_stderr" >&2
+      else
+        printf '🚨 GOVERNANCE_INTEGRITY: DATATABLE INVARIANTS FAILURE: rc70 必須是 stderr-only marker\n' >&2
+      fi
+      exit 70
+      ;;
+    *)
+      printf '🚨 GOVERNANCE_INTEGRITY: DATATABLE INVARIANTS FAILURE: undefined exit code %s\n' "$_hook_rc" >&2
+      exit 70
+      ;;
+  esac
+}
+trap _finalize_hook_output EXIT
+
+INPUT=$(cat 2>/dev/null) || {
+  printf '🚨 GOVERNANCE_INTEGRITY: DATATABLE INVARIANTS FAILURE: 無法讀取 canonical input\n' >&2
+  exit 70
+}
+if ! printf '%s' "$INPUT" | jq -e 'type == "object"' >/dev/null 2>&1; then
+  printf '🚨 GOVERNANCE_INTEGRITY: DATATABLE INVARIANTS FAILURE: invalid input envelope\n' >&2
+  exit 70
+fi
+
+r1_datatable_invariants() {
+set -uo pipefail
+
 INPUT=$(cat)
-TOOL=$(echo "$INPUT" | jq -r '.tool_name // ""')
-FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // ""')
+TOOL=$(jq -r '.tool_name // ""' <<<"$INPUT")
+FILE_PATH=$(jq -r '.tool_input.file_path // ""' <<<"$INPUT")
 
 case "$TOOL" in
   Edit|Write|MultiEdit) ;;
@@ -31,20 +96,20 @@ case "$FILE_PATH" in
   *) exit 0 ;;
 esac
 
-NEW_CONTENT=$(echo "$INPUT" | jq -r '.tool_input.content // .tool_input.new_string // ""')
+NEW_CONTENT=$(jq -r '.tool_input.content // .tool_input.new_string // ""' <<<"$INPUT")
 
-# ── B.1 row drag getRowId(P2 stderr)─────────────────────────────────────────
+# ── B.1 row drag getRowId(P2 context)────────────────────────────────────────
 # Skip DataTable internal source(本身 implement enableRowDrag)
 case "$FILE_PATH" in
   */data-table.tsx|*/data-table.spec.md) ;; # skip B.1 + B.2 internal
   *)
-    if echo "$NEW_CONTENT" | grep -q "enableRowDrag"; then
+    if grep -q "enableRowDrag" <<<"$NEW_CONTENT"; then
       EXISTING=""
       [ -f "$FILE_PATH" ] && EXISTING=$(cat "$FILE_PATH" 2>/dev/null || echo "")
       COMBINED="$EXISTING
 $NEW_CONTENT"
-      if ! echo "$COMBINED" | grep -q "getRowId"; then
-        cat >&2 <<EOF
+      if ! grep -q "getRowId" <<<"$COMBINED"; then
+        cat <<EOF
 
 ┄┄┄ B.1 check_datatable_invariants — row drag getRowId WARN ┄┄┄
 
@@ -58,14 +123,14 @@ EOF
     ;;
 esac
 
-# ── B.2 column size NUMBER → meta.width(P2 stderr)────────────────────────────
+# ── B.2 column size NUMBER → meta.width(P2 context)───────────────────────────
 case "$FILE_PATH" in
   */data-table.tsx|*/cell-registry.tsx|*/column-types.ts) ;; # skip DS internal
   *)
-    if echo "$NEW_CONTENT" | grep -qE "accessor[Key]?|createColumnHelper"; then
-      HITS=$(echo "$NEW_CONTENT" | grep -nE "size:\s*[0-9]+" | grep -v "size:\s*['\"]" || true)
+    if grep -qE "accessor[Key]?|createColumnHelper" <<<"$NEW_CONTENT"; then
+      HITS=$(grep -nE "size:\s*[0-9]+" <<<"$NEW_CONTENT" | grep -v "size:\s*['\"]" || true)
       if [ -n "$HITS" ]; then
-        cat >&2 <<EOF
+        cat <<EOF
 
 ┄┄┄ B.2 check_datatable_invariants — column size NUMBER WARN ┄┄┄
 
@@ -78,7 +143,7 @@ DS canonical 走 \`meta.width\`(2026-05-06 v14.3,M23 命名衝突修)。
   after:  { accessorKey: 'name', meta: { type: 'string', width: 240 } }
 
 命中 lines:
-$(echo "$HITS" | sed 's/^/  /')
+$(printf '%s\n' "$HITS" | sed 's/^/  /')
 
 詳 data-table.spec.md「六之二、Column 寬度 API」。
 
@@ -89,24 +154,27 @@ EOF
 esac
 
 # ── B.3 filter↔sort sibling sync reminder(P2 reminder)────────────────────────
+# 2026-07-14 拆檔對齊:filter row/group renderer 移居 data-table-filter-group.tsx(@internal),
+# row-layout 類 sync 關注點跟著搬 → 兩檔皆觸發 filter 側 reminder(M7 hook regex 對齊 file layout)。
 case "$FILE_PATH" in
-  *data-table-filter-panel.tsx)
-    cat >&2 <<EOF
+  *data-table-filter-panel.tsx|*data-table-filter-group.tsx)
+    cat <<EOF
 
 ┄┄┄ B.3 check_datatable_invariants — sibling sync reminder ┄┄┄
 
-[P2] 動到 filter panel → 是否需要對應修 data-table-sort-manager.tsx?
+[P2] 動到 filter panel(或其 row/group renderer)→ 是否需要對應修 data-table-sort-manager.tsx?
 Self-check:row gap / row layout / row meta button / chrome corner action /
 empty state 行為 / CTA button variant — sort row 是否同步?
 
 EOF
     ;;
   *data-table-sort-manager.tsx)
-    cat >&2 <<EOF
+    cat <<EOF
 
 ┄┄┄ B.3 check_datatable_invariants — sibling sync reminder ┄┄┄
 
-[P2] 動到 sort manager → 是否需要對應修 data-table-filter-panel.tsx?
+[P2] 動到 sort manager → 是否需要對應修 data-table-filter-panel.tsx(row renderer 在
+data-table-filter-group.tsx)?
 Self-check:row gap / row layout / row meta button / chrome corner action /
 empty state 行為 / CTA button variant — filter row 是否同步?
 
@@ -115,3 +183,79 @@ EOF
 esac
 
 exit 0
+}
+
+r2_size_num_to_meta_width() {
+set -uo pipefail
+INPUT=$(cat 2>/dev/null || echo "{}")
+TOOL=$(jq -r '.tool_name // ""' <<<"$INPUT" 2>/dev/null)
+FILE_PATH=$(jq -r '.tool_input.file_path // ""' <<<"$INPUT" 2>/dev/null)
+EVENT=$(jq -r '.hook_event_name // ""' <<<"$INPUT" 2>/dev/null)
+NEW=$(jq -r '.tool_input.content // .tool_input.new_string // ""' <<<"$INPUT" 2>/dev/null)
+
+[ "$EVENT" != "PreToolUse" ] && exit 0
+case "$TOOL" in Edit|Write|MultiEdit) ;; *) exit 0 ;; esac
+case "$FILE_PATH" in *.tsx|*.ts) ;; *) exit 0 ;; esac
+case "$FILE_PATH" in *.stories.tsx|*.test.*) exit 0 ;; esac
+
+# DataTable 上下文:column 定義 OR DataTable import OR ColumnDef 型別
+HAS_DATATABLE_CTX=0
+if grep -qE '(ColumnDef|columns:|DataTable|@tanstack/react-table)' <<<"$NEW"; then
+  HAS_DATATABLE_CTX=1
+fi
+
+[ "$HAS_DATATABLE_CTX" = "0" ] && exit 0
+
+# Detect raw size: <number> in column def(TanStack 用法)
+RAW_SIZE_HITS=$(grep -cE '\bsize:\s*[0-9]+' <<<"$NEW" 2>/dev/null)
+RAW_SIZE_HITS=${RAW_SIZE_HITS:-0}
+
+[ "$RAW_SIZE_HITS" -eq 0 ] && exit 0
+
+# 若同時用 meta: { width 也 OK(混用允許 transition)
+if grep -qE 'meta:\s*\{[^}]*width' <<<"$NEW"; then
+  # mixed — let it pass(transition state)
+  exit 0
+fi
+
+REL=${FILE_PATH#*/my-project/}
+
+cat <<EOF
+⚠️ M23(c) framework prop namespace conflict — DataTable column \`size: <number>\`
+
+📁 File: $REL
+🔍 偵測:$RAW_SIZE_HITS 個 \`size: <number>\` (TanStack px API)在 ColumnDef 上下文,但無 \`meta: { width: 'sm'|'md'|'lg' }\` DS density-aware variant。
+
+M23(c)要求:
+  - TanStack \`size\` prop = px 數字(framework spec)
+  - DS \`size\` prop = density variant 'sm'|'md'|'lg'(DS spec)
+  - 同名不同義 → wrap-and-rename:DataTable column 用 \`meta.width: 'sm'|'md'|'lg'\`,DS internal 再 map 成 TanStack \`size\` px
+
+修法:
+  // ❌ Avoid
+  { accessorKey: 'name', size: 280 }
+
+  // ✅ Use DS density-aware
+  { accessorKey: 'name', meta: { width: 'md' } }
+
+對應 canonical:meta-patterns.md M23(c) + components/DataTable/data-table.spec.md「Column width SSOT」。
+EOF
+
+exit 0
+}
+
+for _rule in r1_datatable_invariants r2_size_num_to_meta_width; do
+  printf '%s' "$INPUT" | "$_rule"
+  _rc=$?
+  case "$_rc" in
+    0) ;;
+    2) exit 2 ;;
+    70) exit 70 ;;
+    *)
+      printf '🚨 GOVERNANCE_INTEGRITY: DATATABLE INVARIANTS FAILURE: rule %s 回傳未定義 exit code %s\n' \
+        "$_rule" "$_rc" >&2
+      exit 70
+      ;;
+  esac
+done
+exit 0

package/ds-canonical/hooks/check_dim_count_drift.sh

@@ -2,7 +2,8 @@
 set -uo pipefail
 # PreToolUse Edit/Write: enforce audit dim count SSOT integrity.
 #
-# SSOT: `.claude/skills/design-system-audit/SKILL.md` `## The N audit dimensions` 段。
+# SSOT: `packages/design-system/ds-canonical/skills/design-system-audit/SKILL.md`
+# `## The N audit dimensions` 段。
 # 任何 chain it 的 skill / spec / rule / hook 禁 hardcode 具體 dim 數字
 # (e.g. `46 dim` / `53 dim` / `53-dim` / `53 audit dimensions`)— 用「全 dim」/
 # 「Group A-P」/「per design-system-audit SSOT」表達。
@@ -34,7 +35,7 @@ esac
 
 # Only check files that potentially chain audit dim list
 case "$FILE_PATH" in
-  */deep-audit-cross-codex/*|*/rules/meta-patterns.md|*/CLAUDE.md|*/skills/*/SKILL.md|*/skills/*/references/*) ;;
+  */deep-audit-cross-codex/*|*/rules/meta-patterns.md|*/AGENTS.md|*/CLAUDE.md|*/skills/*/SKILL.md|*/skills/*/references/*) ;;
   *) exit 0 ;;
 esac
 
@@ -44,25 +45,25 @@ NEW_CONTENT=$(echo "$INPUT" | jq -r '
   ([.tool_input.edits[]? | .new_string] | join("\n"))
 ' 2>/dev/null || echo "")
 
-[ -z "${NEW_CONTENT//[[:space:]]/}" ] && exit 0
+grep -q '[^[:space:]]' <<<"$NEW_CONTENT" || exit 0
 
 # Detect hardcoded numeric dim count
 # Patterns: "53 dim" / "53-dim" / "53 audit dim" / "53 audit dimensions" / "46 dim" / "46-dim"
 # Exclude legitimate uses: "N dim" / "全 dim" / "<N>" placeholder / "1 dim" thru "9 dim" (could be reasonable refs)
-HARDCODE_HITS=$(echo "$NEW_CONTENT" | grep -oE '\b[1-9][0-9]+[ -]?(dim|audit dim|audit dimension)' | sort -u || true)
+HARDCODE_HITS=$(echo "$NEW_CONTENT" | grep -oE '\b[1-9][0-9]+[ -]?(dim|audit dim|audit dimension)|[0-9]+ ?維 ?(audit|sweep|dim)|[0-9]+ ?維度' | sort -u || true)
 
 # Allow if line contains "SSOT" / "禁" / "forbidden" / "example" / "anti-pattern" — these are invariant doc references
-ALLOWED_LINES=$(echo "$NEW_CONTENT" | grep -nE '\b[1-9][0-9]+[ -]?(dim|audit dim|audit dimension)' 2>/dev/null | grep -E '(SSOT|禁|forbidden|example|anti-pattern|invariant|hardcode)' || true)
+ALLOWED_LINES=$(echo "$NEW_CONTENT" | grep -nE '\b[1-9][0-9]+[ -]?(dim|audit dim|audit dimension)|[0-9]+ ?維 ?(audit|sweep|dim)|[0-9]+ ?維度' 2>/dev/null | grep -E '(SSOT|禁|forbidden|example|anti-pattern|invariant|hardcode)' || true)
 
 if [ -n "$HARDCODE_HITS" ]; then
   # Filter out allowed lines (invariant doc context)
-  VIOLATION_LINES=$(echo "$NEW_CONTENT" | grep -nE '\b[1-9][0-9]+[ -]?(dim|audit dim|audit dimension)' 2>/dev/null | grep -vE '(SSOT|禁|forbidden|example|anti-pattern|invariant|hardcode)' || true)
+  VIOLATION_LINES=$(echo "$NEW_CONTENT" | grep -nE '\b[1-9][0-9]+[ -]?(dim|audit dim|audit dimension)|[0-9]+ ?維 ?(audit|sweep|dim)|[0-9]+ ?維度' 2>/dev/null | grep -vE '(SSOT|禁|forbidden|example|anti-pattern|invariant|hardcode)' || true)
 
   if [ -n "$VIOLATION_LINES" ]; then
     printf '⚠️ AUDIT DIM COUNT DRIFT(P1 soft):\n' >&2
     printf '   File: %s\n' "$FILE_PATH" >&2
     printf '   偵測到 hardcoded audit dim count:\n%s\n' "$VIOLATION_LINES" >&2
-    printf '\n  SSOT: `.claude/skills/design-system-audit/SKILL.md` `## The N audit dimensions`\n' >&2
+    printf '\n  SSOT: `packages/design-system/ds-canonical/skills/design-system-audit/SKILL.md` `## The N audit dimensions`\n' >&2
     printf '  修法: 改用「全 dim」/「Group A-P」/「per design-system-audit SSOT」表達\n' >&2
     printf '       而非寫死「53 dim / 46 dim」等具體數字。\n' >&2
     printf '  Why: chain skill 自動繼承 SSOT 變動,避免 design-system-audit 升 54 dim 時下游漂移。\n' >&2