feat: support emdash 0.28 - #16
Merged
Merged
Conversation
feat: support emdash 0.28 Migrate @dashcommerce/core and the starter from emdash 0.6.0 to 0.28.1. - Build the native ResolvedPlugin with definePlugin (single-arg RouteContext handlers) instead of adaptSandboxEntry, whose 0.28 form flattens the request and drops the body — breaking the Stripe webhook. - Update capabilities to the current vocabulary (network:request, content:read, content:write, media:read, users:read); bump the emdash peer range to >=0.28.0 <0.29.0. - Re-author the emdash patch for 0.28.1: plugin routes may return a raw Response (cookies, redirects, webhook 200s), and the raw request body is preserved so ctx.request.text() works for Stripe signature verification. - Wire a Cloudflare Worker entry (src/worker.ts) + Cron Trigger so plugin cron (abandoned-cart recovery, dunning, stock-lock sweeps) runs on Workers — emdash 0.19+ drives cron from a scheduled() handler.
Merged
cavewebs
added a commit
that referenced
this pull request
Sep 14, 2026
This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## @dashcommerce/core@0.2.0 ### Minor Changes - [#23](#23) [`ef8360b`](ef8360b) Thanks [@cavewebs](https://github.com/cavewebs)! - Upgrade to EmDash 0.37.0 with comprehensive auto-update safety system. **Breaking Change**: Minimum EmDash version is now `0.37.0` (peer dependency updated from `>=0.28.0 <0.29.0` to `>=0.37.0 <0.38.0`). This is a breaking change for consumers on EmDash 0.28-0.36. **EmDash 0.37 Upgrade**: - All EmDash dependencies upgraded from 0.28.x to 0.37.0 across the monorepo - Ported EmDash patch for request.clone().json() and Response passthrough to 0.37.0 structure - Fixed Node.js build by externalizing Cloudflare Workers runtime modules (`cloudflare:sockets`, etc.) that EmDash 0.37 imports conditionally **Auto-Update Safety System** (prevents silent breakage on future EmDash updates): 1. **Runtime Compatibility Check**: New `version-check.ts` module validates EmDash version at plugin initialization, providing clear error messages when version is incompatible 2. **Renovate Configuration**: Auto-merges EmDash patch/minor updates when CI passes; requires manual review for major versions 3. **CI Compatibility Matrix**: Tests DashCommerce against all supported EmDash versions in parallel **Supported EmDash Range**: This release supports `0.37.0 <= version < 0.38.0`. Future EmDash updates will be gated by CI and runtime compatibility checks. All typechecks, builds, and tests pass on EmDash 0.37.0. ### Patch Changes - [#16](#16) [`b865dd7`](b865dd7) Thanks [@cavewebs](https://github.com/cavewebs)! - Support EmDash 0.28. Migrate from emdash 0.6 to 0.28.1. The plugin now builds its native `ResolvedPlugin` via `definePlugin` with single-argument `RouteContext` handlers (emdash's native route shape) instead of `adaptSandboxEntry`, whose 0.28 form flattens the request and would break the Stripe webhook's raw-body signature check. Capability names are updated to the current vocabulary (`network:request`, `content:read`, `content:write`, `media:read`, `users:read`), and the emdash peer range is now `>=0.28.0 <0.29.0`. The bundled emdash patch is re-authored for 0.28.1: plugin route handlers may still return a raw `Response` (cookies, redirects, webhook 200s), and the raw request body is preserved so `ctx.request.text()` works for Stripe webhook signature verification. The starter adds a Cloudflare Worker entry (`src/worker.ts`) plus a Cron Trigger so plugin cron — abandoned-cart recovery, subscription dunning, and stock-lock sweeps — runs on Workers (emdash 0.19+ drives cron from a `scheduled()` handler, not request side effects). ## @dashcommerce/starter@0.3.1 ### Patch Changes - [#16](#16) [`b865dd7`](b865dd7) Thanks [@cavewebs](https://github.com/cavewebs)! - Support EmDash 0.28. Migrate from emdash 0.6 to 0.28.1. The plugin now builds its native `ResolvedPlugin` via `definePlugin` with single-argument `RouteContext` handlers (emdash's native route shape) instead of `adaptSandboxEntry`, whose 0.28 form flattens the request and would break the Stripe webhook's raw-body signature check. Capability names are updated to the current vocabulary (`network:request`, `content:read`, `content:write`, `media:read`, `users:read`), and the emdash peer range is now `>=0.28.0 <0.29.0`. The bundled emdash patch is re-authored for 0.28.1: plugin route handlers may still return a raw `Response` (cookies, redirects, webhook 200s), and the raw request body is preserved so `ctx.request.text()` works for Stripe webhook signature verification. The starter adds a Cloudflare Worker entry (`src/worker.ts`) plus a Cron Trigger so plugin cron — abandoned-cart recovery, subscription dunning, and stock-lock sweeps — runs on Workers (emdash 0.19+ drives cron from a `scheduled()` handler, not request side effects). - Updated dependencies [[`ef8360b`](ef8360b), [`b865dd7`](b865dd7)]: - @dashcommerce/core@0.2.0
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Upgrades DashCommerce from emdash 0.6.0 to 0.28.1 (22 minor versions) and
propagates the change across the plugin, starter template, and demo build.
Changes
@dashcommerce/coresandbox-entry.tsbuilds the plugin via nativedefinePlugin(single-argRouteContexthandlers) instead ofadaptSandboxEntry. In 0.28adaptSandboxEntryflattensrouteCtx.requestto{url,method,headers}with no body, which would break the Stripe webhook.
network:request,content:read,content:write,media:read,users:read).>=0.28.0 <0.29.0.emdash patch (
patches/emdash@0.28.1.patch)Response(apiSuccess wouldserialize it to
{}and dropSet-Cookie).ctx.requestis leftunguarded, so the Stripe webhook can read raw bytes for signature
verification.
Starter
src/worker.ts+wrangler.jsonctriggers.cronsso plugin cron(abandoned-cart recovery, dunning, stock-lock sweeps) runs on Cloudflare.
emdash-env.d.ts.Verification
tests pass.
entry.mjsbundlesemdash's
scheduled()handler with the cron trigger.Set-Cookieforwarding,and
ctx.inputbodies all confirmed.400 Invalid signature,confirming the raw body is read (no "body already read" crash).
Not covered here
The Cloudflare demo redeploy (
bun run cf:deploy) — build artifacts arecorrect, but it needs a live
wrangler deploy+ a check that the crontrigger fires.
this should now fix the #15 issue