[efegokdemir]

What changed?

Adds separate offline evidence for classic products/update and orders/create webhook subscriptions at API version 2026-10. Mapped topics produce EVIDENCED or NOT EVIDENCED results; unknown topics, versions and malformed declarations remain UNKNOWN. Classic webhooks remain separate from Shopify Events.

Why?

The existing analyzer covered Admin GraphQL and Shopify Events but did not compare declared classic webhook topics with their documented scopes.

User-facing capabilities and implementation

Human, JSON, SARIF and Action outputs include the new evidence status and counts. SG-SCOPE-001 reports mapped missing scopes; SG-SCOPE-006 keeps unknown evidence visible. orders/create accepts the documented read_orders or read_marketplace_orders alternatives; write_marketplace_orders implies the corresponding read scope. Optional scopes are not treated as granted, and only documented write-implies-read relationships are applied.

Shopify source/evidence

• 2026-10 WebhookSubscriptionTopic reference
• Shopify Webhooks reference
• Manage access scopes

The evidence registry records the source and API version. Tests cover mapped scopes, alternatives, optional-scope ambiguity, unknown topics/versions, duplicate and multiple subscriptions, Events separation, config selection, redaction and Action/SARIF output.

Compatibility

The CLI minimum is now Node.js 22, CI covers Node.js 22/24, and the Action remains on Node.js 24. GraphQL is upgraded to 17.0.2; its Node engine is compatible with both supported runtimes. Package version stays 0.3.0. Proposed next version: 0.4.0.

Tests

On Node.js 22.23.3 and 24.22.0: npm ci --ignore-scripts, npm run build, npm test (102/102 each), npm run coverage (95.38% statements/lines, 84.00% branches, 100% functions), npm run lint, npm run typecheck, npm run package:smoke, npm run action:check, npm audit --omit=dev --audit-level=high (0 vulnerabilities), npm pack --dry-run, and git diff --check passed. Package dry-run hashes matched across both runtimes. Hosted GitHub Actions passed: Node.js 22/24 CI, CodeQL, Dependency Review, and Snyk. Scorecard has no PR-branch result; its workflow is configured for main pushes and weekly runs.

Security/privacy impact

Webhook destinations, filters and compliance values are not exposed. Unknown or unsupported evidence does not become a missing-scope claim. No credentials, telemetry, online scan dependency or Action write permission was added.

Limitations

The registry covers only the two mapped topics at 2026-10. Dynamic shop-specific Admin API subscriptions and protected customer-data approval are outside offline evidence.

Documentation impact

README, scope/evidence models, supported patterns, rule reference, limitations, changelog and roadmap were updated. The standalone GraphQL documentation now matches the implementation: without supported API-surface context it is UNKNOWN.

Release impact

Recommend 0.4.0 after review and hosted CI. The Node.js 22 minimum is a documented compatibility break. No version was bumped on this branch.

Review checklist

• Every new scope mapping links to official Shopify documentation.
• UNKNOWN remains distinct from NOT EVIDENCED.
• Local checks passed on Node.js 22 and 24.
• Hosted CI, CodeQL, Dependency Review, and Snyk passed on the pushed branch.