fix(product): update option values atomically with variants

[ryanngit]

Summary

What - Adds option_value_updates to product updates so option-value
additions and removals can run atomically with variant replacement.

Why - Variant updates only resolve values already linked to a product.
Callers that need a new value otherwise have to link it in a separate request,
which can leave partial state or lose concurrent updates.

How - Validates the ID-based value delta, locks affected product and option
rows in deterministic order, applies additions before variant replacement and
removals afterward in one Product Module transaction, and records guarded
compensation state for workflow rollback.

Testing - No Docker or containers used.

• Product integration: 10 suites passed; 255 tests passed; 1 skipped.
• Product workflow: 53 tests passed.
• Focused HTTP integration: 2 tests passed.
• Product update validators: 4 tests passed.
• Fresh no-cache workspace build: 71/71 tasks passed.
• HTTP type validation, Prettier, ESLint, changeset status, and
  git diff --check passed.

---

Examples

Not applicable; this extends the existing product update contract.

---

Checklist

• I have added a changeset for this PR
• The changes are covered by relevant tests
• I have verified the code works as intended locally
• I have linked the related issue or PR

---

Additional Context

Closes #16304.

Split from #16116 after maintainer review. That PR remains scoped to the
Loyalty plugin behavior related to #15742.

[changeset-bot]

🦋 Changeset detected

Latest commit: a071653

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 79 packages

Name	Type
@medusajs/core-flows	Patch
@medusajs/medusa	Patch
@medusajs/product	Patch
@medusajs/types	Patch
@medusajs/test-utils	Patch
integration-tests-http	Patch
@medusajs/loyalty-plugin	Patch
@medusajs/medusa-oas-cli	Patch
@medusajs/event-bus-redis	Patch
@medusajs/draft-order	Patch
@medusajs/framework	Patch
@medusajs/js-sdk	Patch
@medusajs/modules-sdk	Patch
@medusajs/orchestration	Patch
@medusajs/query	Patch
@medusajs/utils	Patch
@medusajs/workflows-sdk	Patch
@medusajs/admin-bundler	Patch
@medusajs/dashboard	Patch
@medusajs/analytics	Patch
@medusajs/api-key	Patch
@medusajs/auth	Patch
@medusajs/caching	Patch
@medusajs/cart	Patch
@medusajs/currency	Patch
@medusajs/customer	Patch
@medusajs/file	Patch
@medusajs/fulfillment	Patch
@medusajs/index	Patch
@medusajs/inventory	Patch
@medusajs/link-modules	Patch
@medusajs/locking	Patch
@medusajs/notification	Patch
@medusajs/order	Patch
@medusajs/payment	Patch
@medusajs/pricing	Patch
@medusajs/promotion	Patch
@medusajs/rbac	Patch
@medusajs/region	Patch
@medusajs/sales-channel	Patch
@medusajs/settings	Patch
@medusajs/stock-location	Patch
@medusajs/store	Patch
@medusajs/tax	Patch
@medusajs/translation	Patch
@medusajs/user	Patch
@medusajs/workflow-engine-inmemory	Patch
@medusajs/workflow-engine-redis	Patch
@medusajs/oas-github-ci	Patch
@medusajs/cache-inmemory	Patch
@medusajs/cache-redis	Patch
@medusajs/event-bus-local	Patch
@medusajs/analytics-local	Patch
@medusajs/analytics-posthog	Patch
@medusajs/auth-emailpass	Patch
@medusajs/auth-github	Patch
@medusajs/auth-google	Patch
@medusajs/caching-redis	Patch
@medusajs/file-local	Patch
@medusajs/file-s3	Patch
@medusajs/fulfillment-manual	Patch
@medusajs/locking-postgres	Patch
@medusajs/locking-redis	Patch
@medusajs/notification-local	Patch
@medusajs/notification-sendgrid	Patch
@medusajs/payment-stripe	Patch
@medusajs/http-types-generator	Patch
@medusajs/cli	Patch
@medusajs/deps	Patch
@medusajs/eslint-plugin	Patch
@medusajs/telemetry	Patch
@medusajs/admin-sdk	Patch
@medusajs/admin-shared	Patch
@medusajs/admin-vite-plugin	Patch
@medusajs/icons	Patch
@medusajs/toolbox	Patch
@medusajs/ui-preset	Patch
create-medusa-app	Patch
@medusajs/ui	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[medusa-os-bot]

Thanks for the contribution! A few items need to be addressed before this can move forward:

PR adds option_value_updates to the product update API for atomic option-value and variant updates in one request. The implementation includes row-level locking, optimistic concurrency control, and detailed compensation logic. Extensive test coverage is added. No security or performance issues found. Two convention issues need addressing: the changeset message format and a missing closing-keyword linked issue for the large contribution. Heads up: PR #16116 references #15742 and was opened earlier — the PR body clarifies they are intentional separate scopes, so this is informational only.

• Changeset message must follow the fix(package-name): description format. Current message lacks the required fix(...) prefix — e.g. fix(core-flows, medusa, product, types): update option values atomically with variants.
• Large contribution (8630+ lines, 11 files) has no closing-keyword linked issue. Add Fixes #N or Closes #N to the PR body so large changes are tracked against a scoped issue per CONTRIBUTING.md.

Triggered by: manual workflow dispatch

[medusa-os-bot]

Thanks for the contribution! A few items need to be addressed before this can move forward:

PR adds atomic option-value and variant updates to the product update API with deterministic row-level locking and compensation logic. The closing-keyword linked issue has been added (resolving the prior blocking point). One prior blocking point remains: the changeset message must follow the required format. No security, performance, or correctness issues found.

• Changeset message in .changeset/atomic-product-option-variant-update.md must follow the convention format, e.g. fix(core-flows, medusa, product, types): update option values atomically with variants.

Triggered by: PR description updated

[medusa-os-bot]

Thanks for the contribution! Initial automated review looks good.

Both previously raised blocking points are now resolved: the changeset message is correctly formatted and the PR body includes a closing-keyword link to issue #16304. The new option_value_updates field is properly validated by Zod, reflected in HTTP types and module DTOs, backed by row-level locking, and covered by HTTP integration, workflow, and module-service tests. No security, performance, or correctness issues found.

Triggered by: new commit pushed