chore: align template with DSH 0.2.2-alpha.3

README.md

@@ -2,7 +2,7 @@
 
 English | [中文](README.zh.md)
 
-A self-contained standalone repository template for an ESM Cordis plugin targeting DeepSeek Harness 0.2.1-rc.2. Every source file, compiler setting, test fixture, contributor instruction, skill, and build helper used by the repository lives below this root. A DSH host is a runtime consumer of the finished package, not a development input.
+A self-contained standalone repository template for an ESM Cordis plugin targeting DeepSeek Harness 0.2.2-alpha.3. Every source file, compiler setting, test fixture, contributor instruction, skill, and build helper used by the repository lives below this root. A DSH host is a runtime consumer of the finished package, not a development input.
 
 ## Documentation map
 
@@ -59,7 +59,7 @@ A self-contained standalone repository template for an ESM Cordis plugin targeti
 [docs/dsh-plugin-contracts.md](docs/dsh-plugin-contracts.md) owns the full contract. The orientation points are:
 
 - A function plugin exports `name`, `inject`, `Config`, and `apply` as one ESM namespace and has no default export.
-- `engines.node` is `>=24.0.0`; `engines.dsh` declares the supported DSH range; `dsh.manifestVersion` and `dsh.bundle.patch` describe the public bundle layer.
+- `engines.node` is `>=24.9.0`; `engines.dsh` declares the supported DSH range; `dsh.manifestVersion` and `dsh.bundle.patch` describe the public bundle layer.
 - Display metadata reaches Plugin Manager through the exported `./locale/*.json` and `./icon` resources. This template stores their physical files under `src/assets/` and lists them in `files`.
 - `@deepseek-ai/cordis` and `@deepseek-ai/schemastery` are host-supplied peers, duplicated in `devDependencies` for local checks. See [dependencies](docs/dsh-plugin-contracts.md#dependencies).
 - A browser face declares `dsh.client` and exports its built bundle at `./client`.

README.zh.md

@@ -2,7 +2,7 @@
 
 [English](README.md) | 中文
 
-面向 DeepSeek Harness 0.2.1-rc.2 的 ESM Cordis 插件自包含独立仓库模板。仓库用到的每个源文件、编译器配置、测试夹具、贡献说明、skill 和构建辅助都位于本目录以下。DSH 宿主是成品包的运行时消费者，不是源码或构建输入。
+面向 DeepSeek Harness 0.2.2-alpha.3 的 ESM Cordis 插件自包含独立仓库模板。仓库用到的每个源文件、编译器配置、测试夹具、贡献说明、skill 和构建辅助都位于本目录以下。DSH 宿主是成品包的运行时消费者，不是源码或构建输入。
 
 ## 文档地图
 
@@ -59,7 +59,7 @@
 完整契约由 [docs/dsh-plugin-contracts.md](docs/dsh-plugin-contracts.md) 拥有。以下是方向性要点：
 
 - 函数插件以同一个 ESM 命名空间导出 `name`、`inject`、`Config` 和 `apply`，不提供 default export。
-- `engines.node` 为 `>=24.0.0`；`engines.dsh` 声明支持的 DSH 范围；`dsh.manifestVersion` 与 `dsh.bundle.patch` 描述公开的 bundle 层。
+- `engines.node` 为 `>=24.9.0`；`engines.dsh` 声明支持的 DSH 范围；`dsh.manifestVersion` 与 `dsh.bundle.patch` 描述公开的 bundle 层。
 - Plugin Manager 通过导出的 `./locale/*.json` 与 `./icon` 读取展示元数据。本模板把物理文件放在 `src/assets/` 并列入 `files`。
 - `@deepseek-ai/cordis` 与 `@deepseek-ai/schemastery` 是宿主提供的 peer，同时在 `devDependencies` 中供本地检查；详见 [dependencies](docs/dsh-plugin-contracts.md#dependencies)。
 - 有浏览器面的包声明 `dsh.client`，并在 `./client` 导出构建后的 bundle。

docs/dsh-plugin-contracts.md

@@ -1,6 +1,6 @@
 # Standalone DSH Plugin Contracts
 
-This reference ships with the template so planning, implementation, testing, and distribution use only guidance stored below the repository root. It targets the DeepSeek Harness 0.2.1-rc.2 plugin contract.
+This reference ships with the template so planning, implementation, testing, and distribution use only guidance stored below the repository root. It targets the DeepSeek Harness 0.2.2-alpha.3 plugin contract.
 
 ## Repository boundary
 
@@ -26,7 +26,7 @@ The public manifest fields this template uses are:
 - `dsh.bundle.patch`: one patch file path or an ordered list applied as one bundle layer.
 - `dsh.client`: browser module declaration with `platform: 'web'`, optional `inject` package-name edges, optional `immediately`, and optional `external` exact module requests.
 
-Installation and profile startup evaluate the requirement before importing the plugin. A mismatch is refused unless the profile stores an exact-version exemption for that package version and runtime version. Prereleases participate in range matching, so use an explicit prerelease range such as `>=0.2.1-rc.2 <0.3.0` when the package targets this release line.
+Installation and profile startup evaluate the requirement before importing the plugin. A mismatch is refused unless the profile stores an exact-version exemption for that package version and runtime version. Prereleases participate in range matching, so use an explicit prerelease range such as `>=0.2.2-0 <0.3.0` when the package targets this release line.
 
 ## Dependencies
 
@@ -36,7 +36,7 @@ Classify every package by who supplies it:
 - **Dependency:** a library the plugin owns and ships with.
 - **Development dependency:** tooling used only for lint, tests, or builds.
 
-This template uses `@deepseek-ai/cordis` and `@deepseek-ai/schemastery` as peers and development dependencies, and `@deepseek-ai/cordis-plugin-loader` as a development dependency. Keep every consumed `@deepseek-ai/dsh-*` service as a peer with a reachable development copy. Do not use unscoped `cordis`, `schemastery`, or `@cordisjs/plugin-loader` in a 0.2.1 plugin. Do not use `link:` or `file:` specs, and do not bundle a host runtime.
+This template uses `@deepseek-ai/cordis` and `@deepseek-ai/schemastery` as peers and development dependencies, and `@deepseek-ai/cordis-plugin-loader` as a development dependency. Keep every consumed `@deepseek-ai/dsh-*` service as a peer with a reachable development copy. Do not use unscoped `cordis`, `schemastery`, or `@cordisjs/plugin-loader` in a 0.2.2 plugin. Do not use `link:` or `file:` specs, and do not bundle a host runtime.
 
 ## Display metadata and icon
 

package.json

@@ -14,8 +14,8 @@
     "access": "public"
   },
   "engines": {
-    "node": ">=24.0.0",
-    "dsh": ">=0.2.1-rc.2 <0.3.0"
+    "node": ">=24.9.0",
+    "dsh": ">=0.2.2-0 <0.3.0"
   },
   "type": "module",
   "packageManager": "pnpm@11.28.5",
@@ -60,13 +60,13 @@
     "patch:host": "bash scripts/patch.sh"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "~4.0.5",
-    "@deepseek-ai/schemastery": "~3.18.5"
+    "@deepseek-ai/cordis": "4.0.6-alpha.2",
+    "@deepseek-ai/schemastery": "3.18.6-alpha.2"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "~4.0.5",
-    "@deepseek-ai/cordis-plugin-loader": "~1.0.6",
-    "@deepseek-ai/schemastery": "~3.18.5",
+    "@deepseek-ai/cordis": "4.0.6-alpha.2",
+    "@deepseek-ai/cordis-plugin-loader": "1.0.7-alpha.2",
+    "@deepseek-ai/schemastery": "3.18.6-alpha.2",
     "@tsconfig/node24": "^24.0.5",
     "@types/node": "^24.0.0",
     "oxfmt": "0.73.0",

pnpm-workspace.yaml

@@ -3,13 +3,13 @@ packages:
 
 autoInstallPeers: false
 
-# DSH 0.2.1-rc.2 vendors these exact @deepseek-ai packages, which were published
+# DSH 0.2.2-alpha.3 vendors these exact @deepseek-ai packages, which were published
 # inside the supply-chain policy window. Re-review these pins when bumping DSH.
 minimumReleaseAgeExclude:
-  - '@deepseek-ai/cordis@4.0.5'
-  - '@deepseek-ai/cordis-plugin-loader@1.0.6'
-  - '@deepseek-ai/cosmokit@1.8.6'
-  - '@deepseek-ai/schemastery@3.18.5'
+  - '@deepseek-ai/cordis@4.0.6-alpha.2'
+  - '@deepseek-ai/cordis-plugin-loader@1.0.7-alpha.2'
+  - '@deepseek-ai/cosmokit@1.8.7-alpha.2'
+  - '@deepseek-ai/schemastery@3.18.6-alpha.2'
 
 # Runtime and declaration builds run explicitly in CI and before packing; no
 # install-time prepare hook is required.