feat(core): restore EmDash 0.38 compatibility

[cavewebs]

Summary

Widens @dashcommerce/core peer dependency range to restore day-one compatibility with EmDash 0.38.x while keeping 0.37.x installs unbroken. EmDash 0.38.0 was released 2026-09-15 ~05:30Z; the existing peer constraint >=0.37.0 <0.38.0 caused new installs to fail peer checks.

Changes

Peer & dev dependency updates

• packages/core/package.json: Widen emdash peer to >=0.37.0 <0.39.0
• packages/core/package.json: Upgrade dev dependencies to emdash@^0.38.0 and @emdash-cms/admin@^0.38.0
• packages/starter/package.json: Upgrade emdash@^0.38.0 and @emdash-cms/cloudflare@^0.38.0
• patches/emdash@0.38.0.patch: New patch preserving DashCommerce's raw Response handling and request cloning fixes

CI compatibility fixes

• package.json: Register both emdash@0.37.0 and emdash@0.38.0 patches for dual-version support
• packages/starter/.emdash/migrations.json: Revert to 0.37.0 baseline (was incorrectly updated to 0.38.0 with 0.38-only migrations 075-077)
• patches/README.md: Document dual-version patch support
• .github/workflows/ci.yml: Downgrade packages/core devDeps in compatibility matrix (build was failing because core's ^0.38.0 devDep caused bun to resolve 0.38 which imports 0.38-only modules from downgraded 0.37 admin package)

Changeset

Added patch changeset documenting EmDash 0.38 compatibility and plugin-author considerations.

EmDash 0.38.0 release notes scan

Changes that may affect DashCommerce

1. Entry edit locks (#2919)

   • New lock per content entry; admin takes lock on open, holds for 7 minutes with 2-minute renewal
   • Scripts/API/CLI updating/publishing content while editor has entry open → 409 ENTRY_LOCKED
   • Response includes error.details with userId, userName, acquiredAt, expiresAt
   • Bypass: pass overrideLock: true in request body or ?overrideLock=true on DELETE
   • DashCommerce impact: Any code that programmatically updates EmDash content entries (product metadata sync, order notes via API) will need lock handling or docs
   • Migration: 075_entry_edit_locks (auto-applies on default runtime migration mode)

2. ctx.storage.<collection>.updateIf() (#2169)

   • Atomic conditional updates for plugin storage: updateIf(id, { where, set?, delta? })
   • Returns { applied: true, data } or { applied: false }
   • PostgreSQL serialization failures expose retryable: true
   • DashCommerce opportunity: Current inventory decrements are likely read-modify-write; switching to updateIf with where: { stock: { gte: quantity } } and delta: { stock: -quantity } would prevent race conditions on concurrent checkouts. Not included in this PR; safe to adopt in follow-up when we confirm benefit vs. risk.

3. SEO <EmDashHead> overlay (#1963)

   • <EmDashHead> now auto-applies entry SEO panel values (title, description, image, canonical, noindex) on server-rendered pages fetched via getEmDashEntry()
   • DashCommerce impact: Likely transparent unless DashCommerce overrides SEO manually via getSeoMeta() — no known conflicts

4. Collection group setting (#3062)

   • Collections sharing a group render as one collapsible folder in admin sidebar
   • DashCommerce impact: None (cosmetic admin change)

5. Portable Text tables (#2934)

   • Enhanced table support with merge/split, column widths, keyboard navigation
   • portableTextToProsemirror() now returns real table nodes
   • DashCommerce impact: None unless custom ProseMirror schemas consume that output

6. Other notable fixes

   • Visual editing on list pages now works (#2970)
   • Non-translatable field publishing propagates to other translations (#3090)
   • Plugin HTTP SSRF validation tightened (#3050)

Testing

• ✅ Typecheck: bun run typecheck passes on all packages (0.37 and 0.38)
• ✅ Tests: All 85 tests pass (inventory, webhooks, cart, money, tokens, etc.)
• ✅ Build: packages/core builds successfully with 0.37.0 and 0.38.0
• ✅ CI Simulation: Frozen lockfile → downgrade → typecheck → build all pass on 0.37.0

CI failure investigation

The initial CI run failed on the EmDash Compatibility (0.37.0) matrix job. Root causes:

1. Missing 0.37 patch registration: package.json only registered emdash@0.38.0 patch. When CI downgraded to 0.37, bun couldn't apply the required fixes. Fixed: registered both patches.

2. 0.38-only migrations in starter: packages/starter/.emdash/migrations.json was accidentally updated to 0.38.0 with migrations 075-077 that don't exist in 0.37. Fixed: reverted to 0.37.0 baseline.

3. Core devDeps not downgraded: CI downgraded root and starter, but packages/core still had emdash@^0.38.0 devDep. Bun resolved 0.38.0 for builds, which tried to import portable-text-table from downgraded @emdash-cms/admin@0.37.0 (doesn't exist). Fixed: CI now downgrades core devDeps too.

Build error was:

Could not load @emdash-cms/admin@0.37.0/dist/portable-text-table
(imported by emdash@0.38.0/dist/menus-*.mjs)

Follow-up opportunities (not in this PR)

1. Atomic inventory with updateIf: Consider replacing read-modify-write stock decrements with ctx.storage.products.updateIf(id, { where: { stock: { gte: qty } }, delta: { stock: -qty } }) to prevent overselling during concurrent checkouts. Requires testing to ensure it doesn't break existing fulfillment flows.

2. Entry lock handling: Document or implement overrideLock for any DashCommerce workflows that update content entries programmatically (admin sync, bulk imports). Low urgency unless those workflows exist.

3. Lock overrides for order notes: If DashCommerce writes order notes/status to EmDash content entries via API, those may now encounter locks. Defer until confirmed needed.

Release notes

This is a patch bump for @dashcommerce/core (0.2.0 → 0.2.1 after merge + publish). Consumers on EmDash 0.37.x are unaffected; 0.38.x installs now pass peer checks. Manual migration projects should run emdash migrate before deploying to apply migration 075_entry_edit_locks.

---

Ready for review. Timchosen should review before publish. Do not merge open PR #27 (Version Packages bot) until this is approved and merged.