@kenz1117/dsh-ui-usage-billing 1.1.4 → 1.1.6

package/README.en.md

@@ -212,6 +212,16 @@ npm publish --access public
 
 The host discovers the browser side automatically via the `dsh.client` declaration (`platform: web`) and the `exports["./client"]` bundle in `package.json` — no registry registration needed.
 
+## 🔐 Permissions & Compatibility (DSH STORE)
+
+- **Permission level: high**: reads durable session logs (files), calls official multi-vendor / subscription / balance / pricing APIs (network), reads `apiKeyEnv` via the credentials seam (credentials), writes the ledger under `~/.dsh` (persistent state); **no** command execution / shell.
+- **Update channel: `user-reviewed`**: with file / network / credential capabilities, DSH STORE requires local manual confirmation on every install; review the repo, pinned commit, lifecycle scripts, and impact scope before installing.
+- **Compatibility**: this is the stable line (npm `stable`, 1.1.x), targeting DSH `0.1.0-rc.8` ~ `0.1.1-rc.2` (`dsh.compatibility` carries a SemVer range capped at `<0.1.2-0`, so 0.1.2-generation hosts are excluded); 0.1.2 hosts should use the preview line (npm `latest`, 1.0.x). The two-line mapping and monitoring mechanism are documented in [COMPATIBILITY.md](COMPATIBILITY.md). Node.js `^22.19.0 || >=24.0.0`.
+- **Lifecycle**: no `preinstall` / `install` / `postinstall` / `prepare` (ready on install).
+- **No impersonation**: adds only its own entry id `ui-usage-billing`; `@deepseek-ai/dsh-*` packages are `peerDependencies` only (no reinstall / replace / shadowing of official components); the package uses the third-party namespace `@kenz1117/*`.
+- **Build artifacts**: runtime files `lib/*` and `cordis.patch.yml` are committed at the pinned commit and declared in `files`.
+- **Source anchor**: sources are locked to a pinned commit on the GitHub default branch and traceable. DSH STORE automation re-reads the default-branch HEAD roughly every 8 hours as the new pinned commit and decides re-review by SemVer change.
+
 ## 🤖 Model Experience
 
 None. This plugin is a pure UI surface: it registers no tools, injects no system prompt, writes no model-visible events to the session log, and touches no session KV cache; usage statistics are aggregated by the server from existing session logs, whose content is owned by other packages.

package/README.md

@@ -235,7 +235,7 @@ npm publish --access public
 
 - **权限等级：high**：读取持久会话日志（文件）、访问多厂商官方 / 订阅 / 余额 / 定价 API（网络）、经凭据 seam 读取 `apiKeyEnv`（凭据）、写入 `~/.dsh` 账本（持久状态）；**不含**命令执行 / Shell。
 - **更新通道：`user-reviewed`**：本插件具备文件 / 网络 / 凭据能力，DSH STORE 采用每次安装需本机人工确认的通道；安装前请复核仓库、固定 Commit、生命周期脚本与影响范围。
-- **兼容范围**：DSH `0.1.0-rc.8` / `0.1.1-rc.1` / `0.1.1-rc.2` 声明为 `compatible`（见 `package.json` 的 `dsh.compatibility.dshReleases`）；Node.js `^22.19.0 || >=24.0.0`。
+- **兼容范围**：本线为稳定线（npm `stable`，1.1.x），适配 DSH `0.1.0-rc.8` ~ `0.1.1-rc.2`（`dsh.compatibility` 含 SemVer 区间 `<0.1.2-0` 封顶，0.1.2 系宿主会被区间排除）；0.1.2 系宿主请用预览线（npm `latest`，1.0.x）。双线对照与监控机制见 [COMPATIBILITY.md](COMPATIBILITY.md)。Node.js `^22.19.0 || >=24.0.0`。
 - **生命周期**：无 `preinstall` / `install` / `postinstall` / `prepare`（安装即用）。
 - **不冒用官方**：仅新增自有 entry id `ui-usage-billing`；对 `@deepseek-ai/dsh-*` 仅为 `peerDependencies` 依赖（不重复安装 / 不替换 / 不遮蔽官方组件），包名使用第三方命名空间 `@kenz1117/*`。
 - **打包产物**：运行文件 `lib/*` 与 `cordis.patch.yml` 已随固定 Commit 提交并声明在 `files`。