efegokdemir · Oct 21, 2026 · Oct 21, 2026 · Oct 21, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -8,6 +8,8 @@ jobs:
   validate:
     strategy:
       matrix:
+        # Keep the required Node 20 branch-protection check while testing the
+        # supported Node 22 and 24 runtimes. The package engine floor remains 22.
         node: [20, 22, 24]
     runs-on: ubuntu-latest
     steps:
@@ -37,7 +39,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
         with:
-          node-version: 20
+          node-version: 24
           cache: npm
       - run: npm ci --ignore-scripts
       - run: npm run build

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,11 @@
 
 ## Unreleased
 
+- Add offline scope evidence for classic `products/update` and `orders/create` subscriptions in `shopify.app.toml`, with separate EVIDENCED, NOT EVIDENCED, and UNKNOWN results from Shopify Events.
+- Expose classic webhook evidence counts in human, JSON, SARIF, and GitHub Action outputs without including destinations or filter values.
+- Require Node.js 22 or newer for the CLI, test Node.js 22 and 24 in CI, and update GraphQL.js to 17.0.2. This drops Node.js 20 CLI support.
+- Correct the standalone GraphQL document support note and refresh the immutable Action example to the v0.3.0 commit.
+
 ## 0.3.0
 
 - Classify Admin, Storefront, Customer Account, and ambiguous GraphQL operations independently using nearby source context.

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -8,7 +8,7 @@ You retain copyright in your contributions. By submitting a contribution, you ag
 
 ## Development setup
 
-Use Node.js 20 or newer, then install the locked dependencies:
+Use Node.js 22 or newer, then install the locked dependencies:
 
 ```sh
 npm ci

diff --git a/README.md b/README.md
@@ -17,7 +17,7 @@ Shopify Scope Guard is an offline, deterministic, read-only static analyzer for
 
 Maintained by RexCode Digital Ltd.
 
-Part of the **RexCode Shopify developer tools** suite. Requires Node.js 20 or later for the CLI. [Releases](https://github.com/RexCode-Digital/shopify-scope-guard/releases) · [npm](https://www.npmjs.com/package/shopify-scope-guard) · [Marketplace](https://github.com/marketplace/actions/shopify-scope-guard)
+Part of the **RexCode Shopify developer tools** suite. The CLI requires Node.js 22 or later; the GitHub Action uses Node.js 24. [Releases](https://github.com/RexCode-Digital/shopify-scope-guard/releases) · [npm](https://www.npmjs.com/package/shopify-scope-guard) · [Marketplace](https://github.com/marketplace/actions/shopify-scope-guard)
 
 ## Quick start
 
@@ -119,7 +119,8 @@ The current evidence pack is intentionally focused on high-confidence Shopify AP
 | Unproven declarations | Declared scopes with no supported usage evidenced |
 | Unknown usage | Shopify-related code that cannot be safely mapped to supported evidence |
 | Admin GraphQL | Supported query and mutation operations matched against documented scope requirements |
-| Shopify app configuration | Required and optional scopes plus known 2026-10 Events topic requirements in `shopify.app*.toml` |
+| Classic webhooks | `products/update` and `orders/create` topic requirements in `[[webhooks.subscriptions]]` |
+| Shopify app configuration | Required and optional scopes plus versioned webhook and 2026-10 Events topic requirements in `shopify.app*.toml` |
 | SARIF | SARIF 2.1.0 output for code-scanning workflows |
 
 Current high-confidence evidence areas include products, collections, orders, customers, inventory, locations, billing fees, markets, themes, files, metaobjects, cart transforms, analytics annotations, reports, ShopifyQL, rollouts, and documented Events topic scopes.
@@ -134,7 +135,7 @@ Scope Guard deliberately separates evidence from certainty.
 - **NOT EVIDENCED** — no supported usage requiring the scope was evidenced. This does **not** prove that the scope is unused.
 - **UNKNOWN** — Shopify-related code could not be safely mapped to supported evidence. UNKNOWN is deliberately conservative and is never classified as unused.
 
-The bundled high-confidence evidence pack is versioned against Shopify API `2026-10`. Evidence is based on documented Shopify access-scope relationships and supported static patterns, not live store permissions.
+The bundled high-confidence evidence pack is versioned against Shopify API `2026-10`. For classic webhooks, EVIDENCED means that a required scope alternative is declared (including a documented write-to-read implication); an optional declaration is NOT EVIDENCED because merchants can decline it. Unmapped topics and unsupported webhook API versions remain UNKNOWN. Evidence is based on documented Shopify access-scope relationships and supported static patterns, not live store permissions.
 
 See the [evidence model](docs/evidence-model.md).
 
@@ -178,7 +179,7 @@ See the [CLI reference](docs/cli.md).
 
 ## Configuration
 
-Scope Guard reads Shopify app TOML configuration from the repository. It supports `[access_scopes]` `scopes` and `optional_scopes` values. For `[[events.subscription]]`, known topics are mapped only when `[events].api_version` is `2026-10`; unsupported topics and other Events API versions remain UNKNOWN. This checks the topic-level scope only and does not infer extra scopes required by individual triggers or custom queries. Query and filter text is never included in findings.
+Scope Guard reads Shopify app TOML configuration from the repository. It supports `[access_scopes]` `scopes` and `optional_scopes` values. Classic webhook `topics` are mapped only for the two entries in the offline registry and when `[webhooks].api_version` is `2026-10`; Shopify Events topics are mapped only when `[events].api_version` is `2026-10`. Unsupported topics and API versions remain UNKNOWN. These checks cover topic-level requirements only: they do not infer extra scopes from webhook payload filters or Events triggers and custom queries. Destinations, filters, and query text are never included in findings.
 
 The CLI supports:
 
@@ -189,7 +190,7 @@ Auto-discovery prefers `shopify.app.toml`, otherwise a single named root configu
 
 Local fragments, inline fragments, and aliases are supported. Admin, Storefront, and Customer Account operations are classified per GraphQL document when a nearby client signal is clear. Storefront operations stay outside Admin scope evidence; Customer Account and ambiguous operations are reported as UNKNOWN. Standalone `.graphql` documents without client context are UNKNOWN until their API surface can be established.
 
-GraphQL 16 is retained for Node 20 support. Dependabot PR #3 remains open: GraphQL 17.0.2 officially requires Node 22/24/25/26 and is incompatible with Node 20. The minimum Node version will not be raised to satisfy that update.
+This change raises the CLI minimum to Node.js 22; Node.js 20 is no longer supported. The GraphQL parser dependency is GraphQL.js 17.0.2, which supports Node.js 22 and 24.
 
 ## Security and privacy
 
@@ -261,10 +262,10 @@ MIT — see [LICENSE](LICENSE).
 
 ## Immutable SHA usage
 
-The Action example pins the reviewed v0.2.4 release commit. Verify the release reference with:
+The Action example pins the reviewed v0.3.0 release commit. Verify the release reference with:
 
 ```bash
-git fetch --tags origin && git rev-parse 'v0.2.4^{commit}'
+git fetch --tags origin && git rev-parse 'v0.3.0^{commit}'
 ```
 
-Published patch tags are retained; existing minor aliases are movable. A reviewed full commit SHA is the immutable execution reference.
+Published patch tags are retained; existing minor aliases are movable. A reviewed full commit SHA is the immutable execution reference. The webhook evidence described above is unreleased until a later version is published.
diff --git a/ROADMAP.md b/ROADMAP.md
@@ -2,7 +2,7 @@
 
 Priorities are evidence-led and may change as Shopify APIs evolve:
 
-- Expand verified Shopify scope coverage.
+- Expand verified Shopify scope coverage, including additional classic webhook topic mappings when official evidence and regression fixtures are available.
 - Add additional Admin API surfaces without mixing evidence confidence levels.
 - Improve alternative-scope modeling and API-version-aware evidence.
 - Reduce false positives and improve UNKNOWN handling.

diff --git a/action.yml b/action.yml
@@ -24,6 +24,9 @@ outputs:
   evidence-applicable: { description: Whether the evidence pack applies to the selected Admin GraphQL API version }
   missing-scope-count: { description: Missing or optional-required scope findings }
   redundant-scope-count: { description: Redundant scope findings }
+  webhook-evidenced-count: { description: Classic webhook topics with a required scope evidenced in app configuration }
+  webhook-not-evidenced-count: { description: Mapped classic webhook topics whose required scopes are missing or optional only }
+  webhook-unknown-count: { description: Classic webhook topics or API versions outside the offline evidence registry }
   report: { description: JSON report path }
 runs:
   using: node24
-Original file line number
+Diff line change
@@ Expand Up @@
     ## Development setup
-    Use Node.js 20 or newer, then install the locked dependencies:
+    Use Node.js 22 or newer, then install the locked dependencies:
     ```sh
     npm ci
@@ Expand Down @@