growth: list DashCommerce on EmDash plugin registry (default discovery in 0.39)

[cavewebs]

Why now

EmDash 0.39.0 (23 Sep 2026) promoted the plugin registry from experimental to default discovery. Sites with a sandbox runner browse/install from https://registry.emdashcms.com (UI: plugins.emdashcms.com). Marketplace browse/install is hidden. DashCommerce is not listed there yet — npm-only discovery leaves us invisible to the primary install path.

This is the highest-leverage organic growth bet after EmDash peer compatibility (track on #28).

Goal

Publish a sandboxed DashCommerce release to the EmDash registry under a stable Atmosphere publisher handle (e.g. @…/dashcommerce), so admins can find and install it from Registry in the EmDash admin.

Docs: Plugin registry · Bundling and publishing (confirm exact publish path).

Checklist (do not execute without Timchosen confirmation where noted)

• Confirm Atmosphere publisher account / handle for emdashCommerce (credentials needed — ask Timchosen; do not invent or spend).
• Confirm package slug + public name (e.g. @handle/dashcommerce).
• Bundle as sandboxed plugin matching EmDash 0.39 capability/consent model; declare only the permissions we actually need.
• Peer/runtime: ship after @dashcommerce/core peers cover EmDash 0.39.x (feat(core): restore EmDash 0.38 compatibility #28 extended) so registry install does not immediately peer-fail.
• Verification: checksum + permissions; decide whether publisher requires build provenance.
• Smoke: install from Registry on a fresh EmDash 0.39 sandbox site (Cloudflare preferred); checkout + admin paths.
• README + dashcommerce.dev: point to Registry install as primary, npm/create as alternate.
• Optional later: paid themes/templates as separate registry packages (core stays MIT/OSS).

Out of scope for this issue

• Merging/publishing npm 0.2.1 (see feat(core): restore EmDash 0.38 compatibility #28 / chore: version packages #27).
• Railway demo redeploy (held until Timchosen asks).
• Spending money or launching paid products without confirmation.

Success

Searching Registry for “dashcommerce” (or the public name) shows our package; an admin can install with a clear consent dialog; demo still works.

[cavewebs]

CEO daily 25 Sep — registry first-mover check

Browsed plugins.emdashcms.com this morning. Listed plugins include Eventual, ai-search, audit-log, Forward Email, EmDash to Buffer, contact-form, Cloudflare Email Sending, marketplace-test. No commerce / shop / cart / Stripe plugin is listed. DashCommerce is still npm-only and invisible on the default EmDash 0.39 discovery path.

Publish path (from docs — not executed)

• Docs: Bundling and publishing (CLI: emdash-plugin login → validate → publish)
• Needs: valid emdash-plugin.jsonc (slug, publisher DID, license, author, security contact), Atmosphere account handle, sandboxed bundle ≤ RFC size caps (256 KB decompressed total)
• Native plugins stay on npm; registry is sandboxed-only — so listing DashCommerce means a sandboxed packaging track (or a thin sandboxed wrapper), not just widening peers on @dashcommerce/core
• Experimental registry: pin @emdash-cms/plugin-cli to an exact version

Sequencing (unchanged)

1. EmDash 0.39 peer on core (feat(core): restore EmDash 0.38 compatibility #28 extended) so installs don’t peer-fail
2. Atmosphere publisher handle + confirmation from Timchosen (no inventing credentials / no spend)
3. Sandbox capability consent set (minimal)
4. Publish + README primary install = Registry

Blocker for next step here: Atmosphere publisher handle/account Timchosen wants under (e.g. Bluesky/Atmosphere @handle), plus Cursor on-demand so the 0.39 compat work can run.

[cavewebs]

CEO daily — Mon 2026-09-28

Registry commerce still empty — plugins.emdashcms.com search “commerce” returns No plugins match that search. Homepage “Recently updated” shows translation/events/AI-search/forms/email plugins only; zero commerce/shop/cart/payment listings. First-mover window remains open.

Blocker unchanged: Atmosphere publisher credentials + sandboxed bundle still need Timchosen confirmation (no publish from this bot).

Peer dependency gate: published @dashcommerce/core@0.2.0 still peers emdash >=0.37 <0.38. EmDash latest is now 0.42.0 (27 Sep) with 1.0.1-rc.0 on npm this morning — registry install would peer-fail until #28 is extended past 0.38. See today’s scan on #28 (comment).

Concrete adoption idea (no spend): once peers cover current EmDash, publish the sandboxed package under a confirmed Atmosphere handle and make Registry the README primary install path (npm/create as alternate). Until then, keep prep notes here; do not invent credentials.