@merittdev/horus 0.18.0 → 0.19.1

package/README.md

@@ -6,7 +6,7 @@
 
 **Understand what happened.**
 
-Open-source incident investigation. Horus connects Elasticsearch, Sentry, Grafana, MongoDB, Postgres, Redis (incl. BullMQ queues), Axiom logs, and source intelligence into deterministic reports — installable today.
+Open-source incident investigation. Horus connects Elasticsearch, Sentry, Grafana, MongoDB, Postgres, Redis (incl. BullMQ queues), Axiom logs, Shopify Admin, and source intelligence into deterministic reports — installable today.
 
 CLI-only. Read-only against production systems. Horus never writes to your infrastructure.
 
@@ -129,6 +129,7 @@ Installable today. More connectors and AI providers are in progress.
 - Grafana metrics
 - MongoDB / Postgres / Redis state
 - BullMQ queue evidence
+- Shopify Admin (GraphQL — queries you supply)
 - Source intelligence (code graph)
 - Timeline generation
 - Evidence correlation
@@ -160,6 +161,7 @@ Horus is organized in four layers:
 - **MongoDB / Postgres** — application/operational state
 - **Grafana** — metrics via its datasource proxy
 - **Redis / BullMQ** — cache & queue runtime state
+- **Shopify Admin** — application state via GraphQL queries you supply at investigation time (`--shopify-query`) or declare in config; the connector embeds none. Read-only, Client-Credentials auth.
 - **Git** — change history, ownership signals
 
 **Investigation** (deterministic)

package/dist/index.cjs

@@ -3057,7 +3057,7 @@ var init_version = __esm({
   "../../packages/core/src/version.ts"() {
     "use strict";
     init_cjs_shims();
-    HORUS_VERSION = true ? "0.18.0" : "dev";
+    HORUS_VERSION = true ? "0.19.1" : "dev";
     PINNED_SOURCE_VERSION = "2.1.0";
   }
 });
@@ -10183,7 +10183,7 @@ var require_jiti = __commonJS({
         }, pathe_M_eThtNZ_dirname = function(e3) {
           const t4 = pathe_M_eThtNZ_normalizeWindowsPath(e3).replace(/\/$/, "").split("/").slice(0, -1);
           return 1 === t4.length && Je3.test(t4[0]) && (t4[0] += "/"), t4.join("/") || (isAbsolute2(e3) ? "/" : ".");
-        }, basename5 = function(e3, t4) {
+        }, basename6 = function(e3, t4) {
           const i4 = pathe_M_eThtNZ_normalizeWindowsPath(e3).split("/");
           let n5 = "";
           for (let e4 = i4.length - 1; e4 >= 0; e4--) {
@@ -10904,7 +10904,7 @@ Default "index" lookups for the main are deprecated for ES modules.`, "Deprecati
           if (!e3.opts.fsCache || !t4.filename) return i4();
           const n5 = ` /* v${Ti}-${utils_hash(t4.source, 16)} */
 `;
-          let a3 = `${basename5(pathe_M_eThtNZ_dirname(t4.filename))}-${(function(e4) {
+          let a3 = `${basename6(pathe_M_eThtNZ_dirname(t4.filename))}-${(function(e4) {
             const t5 = e4.split(Wt2).pop();
             if (!t5) return;
             const i5 = t5.lastIndexOf(".");
@@ -10950,7 +10950,7 @@ Default "index" lookups for the main are deprecated for ES modules.`, "Deprecati
           return i4.startsWith("#!") && (i4 = "// " + i4), i4;
         }
         function eval_evalModule(t4, i4, n5 = {}) {
-          const a3 = n5.id || (n5.filename ? basename5(n5.filename) : `_jitiEval.${n5.ext || (n5.async ? "mjs" : "js")}`), c5 = n5.filename || jitiResolve(t4, a3, { async: n5.async }), l3 = n5.ext || extname(c5), y6 = n5.cache || t4.parentCache || {}, E3 = /\.[cm]?tsx?$/.test(l3), w5 = ".mjs" === l3 || ".js" === l3 && "module" === (function(e3) {
+          const a3 = n5.id || (n5.filename ? basename6(n5.filename) : `_jitiEval.${n5.ext || (n5.async ? "mjs" : "js")}`), c5 = n5.filename || jitiResolve(t4, a3, { async: n5.async }), l3 = n5.ext || extname(c5), y6 = n5.cache || t4.parentCache || {}, E3 = /\.[cm]?tsx?$/.test(l3), w5 = ".mjs" === l3 || ".js" === l3 && "module" === (function(e3) {
             for (; e3 && "." !== e3 && "/" !== e3; ) {
               e3 = pathe_M_eThtNZ_join(e3, "..");
               try {
@@ -10998,7 +10998,7 @@ Default "index" lookups for the main are deprecated for ES modules.`, "Deprecati
                     (0, $e3.mkdirSync)(n7, { recursive: true });
                   } catch {
                   }
-                  const a5 = pathe_M_eThtNZ_join(n7, `${basename5(i8, extname(i8))}-${Date.now()}-${Math.random().toString(36).slice(2)}.mjs`);
+                  const a5 = pathe_M_eThtNZ_join(n7, `${basename6(i8, extname(i8))}-${Date.now()}-${Math.random().toString(36).slice(2)}.mjs`);
                   return (0, $e3.writeFileSync)(a5, t6), a5;
                 })(l4, n6), debug(t5, "[esm]", "[tempfile]", c7), a4(pathToFileURL2(c7))), E4 = y7 ? a4(y7).catch((e3) => {
                   if ("ENAMETOOLONG" !== e3?.code) throw e3;
@@ -11807,6 +11807,18 @@ function resolveEnvironment(config2, opts) {
       ...url !== void 0 ? { url } : {}
     };
   }
+  if (c4.shopify !== void 0) {
+    const sh = c4.shopify;
+    const accessId = sh.accessId ?? process.env[sh.accessIdEnv ?? "SHOPIFY_ACCESS_ID"];
+    const secret = sh.secret ?? process.env[sh.secretEnv ?? "SHOPIFY_SECRET"];
+    resolved.shopify = {
+      store: sh.store,
+      ...sh.apiVersion !== void 0 ? { apiVersion: sh.apiVersion } : {},
+      ...accessId !== void 0 ? { accessId } : {},
+      ...secret !== void 0 ? { secret } : {},
+      ...sh.queries !== void 0 ? { queries: sh.queries } : {}
+    };
+  }
   if (c4.grafana !== void 0) {
     const g4 = c4.grafana;
     resolved.grafana = {
@@ -12126,6 +12138,49 @@ var init_config = __esm({
         /** Env var holding the base URL. Defaults to "AXIOM_URL". */
         urlEnv: external_exports.string().optional()
       }).optional(),
+      /**
+       * Shopify Admin connector — a first-class evidence source for the investigation
+       * engine. The connector embeds NO queries: the GraphQL document is supplied by the
+       * caller at investigation time (`--shopify-query`) and/or declared here as named
+       * default queries that `horus watch` (which has no agent to pass a flag) runs each
+       * cycle. Auth is a read-only Client-Credentials grant: `accessId` is the app
+       * `client_id` (readable), `secret` is the `client_secret` (encrypted at rest).
+       */
+      shopify: external_exports.object({
+        /** Store subdomain, e.g. "my-store" — `.myshopify.com` is added automatically (a full domain is also accepted). */
+        store: external_exports.string(),
+        /** Admin API version segment, e.g. "2025-10". Defaults when omitted. */
+        apiVersion: external_exports.string().optional(),
+        /** App client_id (Client-Credentials grant). Takes priority over accessIdEnv. */
+        accessId: external_exports.string().optional(),
+        /** Env var holding the client_id. Defaults to "SHOPIFY_ACCESS_ID". */
+        accessIdEnv: external_exports.string().optional(),
+        /** App client_secret (encrypted at rest). Takes priority over secretEnv. */
+        secret: external_exports.string().optional(),
+        /** Env var holding the client_secret. Defaults to "SHOPIFY_SECRET". */
+        secretEnv: external_exports.string().optional(),
+        /**
+         * Default named GraphQL queries run when no `--shopify-query` is supplied at
+         * invocation (notably by `horus watch`). Each result set becomes Evidence. The
+         * query text is authored by the operator, executed verbatim — never built in code.
+         */
+        queries: external_exports.array(
+          external_exports.object({
+            /** Label for provenance + the evidence title. */
+            name: external_exports.string(),
+            /** Verbatim Admin GraphQL query document (read-only). */
+            query: external_exports.string(),
+            /** Static variables merged under any engine-bound window variables. */
+            variables: external_exports.record(external_exports.unknown()).optional(),
+            /** EvidenceKind to map results onto (constrained to the existing union). */
+            kind: external_exports.enum(["state", "log", "metric"]).default("state"),
+            /** Base relevance seed (0–1) before hint-term weighting. */
+            relevance: external_exports.number().min(0).max(1).optional(),
+            /** Inject the investigation window as `$from`/`$to` variables when declared. */
+            bindWindow: external_exports.boolean().optional()
+          })
+        ).optional()
+      }).optional(),
       grafana: external_exports.object({
         dashboard: external_exports.string().optional(),
         /** Multiple dashboard UIDs to fetch. Takes precedence over `dashboard` when set. */
@@ -12235,7 +12290,8 @@ var init_config = __esm({
       sentry: ["authToken"],
       axiom: ["token"],
       grafana: ["username", "password"],
-      redis: ["url"]
+      redis: ["url"],
+      shopify: ["secret"]
     };
     CONFIG_EXAMPLES = {
       "(root)": 'add `database: { url: "postgresql://..." }` and at least one project',
@@ -21009,7 +21065,7 @@ var require_execute_operation = __commonJS({
       return client.topology;
     }
     var BASE_BACKOFF_MS = 100;
-    var MAX_BACKOFF_MS = 1e4;
+    var MAX_BACKOFF_MS2 = 1e4;
     async function executeOperationWithRetries(operation, { topology, timeoutContext, session, readPreference }) {
       let selector;
       if (operation.hasAspect(operation_1.Aspect.MUST_SELECT_SAME_SERVER)) {
@@ -21084,7 +21140,7 @@ var require_execute_operation = __commonJS({
             session.unpin({ force: true });
           }
           if (operationError.hasErrorLabel(error_1.MongoErrorLabel.SystemOverloadedError)) {
-            const backoffMS = Math.random() * Math.min(MAX_BACKOFF_MS, BASE_BACKOFF_MS * 2 ** attempt);
+            const backoffMS = Math.random() * Math.min(MAX_BACKOFF_MS2, BASE_BACKOFF_MS * 2 ** attempt);
             if (timeoutContext.csotEnabled() && backoffMS > timeoutContext.remainingTimeMS) {
               throw error3;
             }
@@ -75147,6 +75203,301 @@ function shortTs3(iso) {
   return `${iso.slice(5, 10)} ${iso.slice(11, 16)}`;
 }
 
+// ../../packages/connectors/src/shopify/client.ts
+init_cjs_shims();
+var REQUEST_TIMEOUT_MS3 = 8e3;
+var DEFAULT_API_VERSION = "2025-10";
+var TOKEN_REFRESH_MARGIN_S = 120;
+var MAX_RETRIES = 2;
+var MAX_BACKOFF_MS = 5e3;
+function normalizeStore(raw) {
+  const s5 = raw.trim().replace(/^https?:\/\//i, "").replace(/\/+$/, "");
+  return s5.includes(".") ? s5 : `${s5}.myshopify.com`;
+}
+function normalizeApiVersion(raw) {
+  const v4 = (raw ?? "").trim();
+  return /^20\d{2}-\d{2}$/.test(v4) ? v4 : DEFAULT_API_VERSION;
+}
+function isThrottled(result) {
+  return (result.errors ?? []).some(
+    (e) => e.extensions?.code === "THROTTLED"
+  );
+}
+var ShopifyAdminClient = class {
+  store;
+  apiVersion;
+  baseUrl;
+  accessId;
+  secret;
+  token = null;
+  tokenExpiresAtMs = 0;
+  constructor(opts) {
+    this.store = normalizeStore(opts.store);
+    this.apiVersion = normalizeApiVersion(opts.apiVersion);
+    this.baseUrl = (opts.baseUrl ?? `https://${this.store}`).replace(/\/$/, "");
+    this.accessId = opts.accessId;
+    this.secret = opts.secret;
+  }
+  /**
+   * Resolve a valid Admin API token. With an `accessId`, runs the Client-Credentials
+   * grant and caches the result until (expiry - margin); without one, returns `secret`
+   * as a direct token. Throws on a failed grant.
+   */
+  async ensureToken() {
+    if (this.accessId === void 0 || this.accessId === "") return this.secret;
+    if (this.token !== null && Date.now() < this.tokenExpiresAtMs) return this.token;
+    const res = await fetch(`${this.baseUrl}/admin/oauth/access_token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
+      body: new URLSearchParams({
+        client_id: this.accessId,
+        client_secret: this.secret,
+        grant_type: "client_credentials"
+      }),
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS3)
+    });
+    if (!res.ok) {
+      const text2 = await res.text().catch(() => "");
+      throw new Error(`Shopify token exchange -> ${res.status}: ${text2.slice(0, 200)}`);
+    }
+    const json2 = await res.json();
+    if (!json2.access_token) {
+      throw new Error("Shopify token exchange returned no access_token");
+    }
+    this.token = json2.access_token;
+    const ttl = typeof json2.expires_in === "number" ? json2.expires_in : 86400;
+    this.tokenExpiresAtMs = Date.now() + Math.max(0, ttl - TOKEN_REFRESH_MARGIN_S) * 1e3;
+    return this.token;
+  }
+  /** Drop any cached token so the next request re-runs the grant (used after a 401). */
+  invalidateToken() {
+    this.token = null;
+    this.tokenExpiresAtMs = 0;
+  }
+  /**
+   * Run a GraphQL document verbatim against the Admin API and return the parsed result.
+   * Retries HTTP 429 / GraphQL THROTTLED with bounded backoff; refreshes the token once
+   * on 401. Throws on a non-retryable HTTP error.
+   */
+  async graphql(query, variables) {
+    const url = `${this.baseUrl}/admin/api/${this.apiVersion}/graphql.json`;
+    let httpRetries = 0;
+    let throttleRetries = 0;
+    let refreshedOn401 = false;
+    for (; ; ) {
+      const token = await this.ensureToken();
+      const res = await fetch(url, {
+        method: "POST",
+        headers: {
+          "X-Shopify-Access-Token": token,
+          "Content-Type": "application/json",
+          Accept: "application/json"
+        },
+        body: JSON.stringify({ query, variables: variables ?? {} }),
+        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS3)
+      });
+      if (res.status === 401 && !refreshedOn401) {
+        refreshedOn401 = true;
+        this.invalidateToken();
+        continue;
+      }
+      if (res.status === 429 && httpRetries < MAX_RETRIES) {
+        httpRetries += 1;
+        await sleep(retryAfterMs(res, httpRetries));
+        continue;
+      }
+      if (!res.ok) {
+        const text2 = await res.text().catch(() => "");
+        throw new Error(`Shopify GraphQL -> ${res.status}: ${text2.slice(0, 200)}`);
+      }
+      const result = await res.json();
+      if (isThrottled(result) && throttleRetries < MAX_RETRIES) {
+        throttleRetries += 1;
+        await sleep(throttleBackoffMs(result, throttleRetries));
+        continue;
+      }
+      return result;
+    }
+  }
+  /**
+   * Liveness probe: run a minimal `{ shop { name } }` query — the connector's ONLY owned
+   * query, used purely for health / connect-time validation, NEVER for evidence. It
+   * validates both the auth (the CC grant or the static token, resolved inside `graphql`)
+   * AND that the token can actually read — so a bad/expired static token is caught here
+   * rather than silently reported as "reachable". Never throws.
+   */
+  async health() {
+    try {
+      const result = await this.graphql("{ shop { name } }");
+      if (result.errors !== void 0 && result.errors.length > 0) {
+        return { ok: false, detail: result.errors[0].message };
+      }
+      return { ok: true, detail: `shopify reachable (${this.store})` };
+    } catch (err2) {
+      return { ok: false, detail: err2.message };
+    }
+  }
+};
+function retryAfterMs(res, attempt) {
+  const header = res.headers.get("retry-after");
+  const secs = header !== null ? Number(header) : NaN;
+  const ms = Number.isFinite(secs) ? secs * 1e3 : 500 * 2 ** (attempt - 1);
+  return Math.min(Math.max(0, ms), MAX_BACKOFF_MS);
+}
+function throttleBackoffMs(result, attempt) {
+  const cost = result.extensions?.cost;
+  const requested = cost?.requestedQueryCost ?? 0;
+  const rate = cost?.throttleStatus?.restoreRate ?? 0;
+  const ms = requested > 0 && rate > 0 ? requested / rate * 1e3 : 500 * 2 ** (attempt - 1);
+  return Math.min(Math.max(0, ms), MAX_BACKOFF_MS);
+}
+function sleep(ms) {
+  return new Promise((resolve13) => setTimeout(resolve13, ms));
+}
+
+// ../../packages/connectors/src/shopify/provider.ts
+init_cjs_shims();
+init_src();
+var KIND_TO_SOURCE = {
+  state: "state",
+  log: "logs",
+  metric: "metrics"
+};
+var ShopifyProvider = class {
+  constructor(client, opts) {
+    this.client = client;
+    this.opts = opts;
+  }
+  client;
+  opts;
+  id = "shopify";
+  kind = "state";
+  /**
+   * Run each supplied (or, as a fallback, config-declared) query verbatim and return one
+   * record per success. The investigation window is injected as `$from`/`$to` variables for
+   * queries that opt in (`bindWindow`); `hintTerms` are NOT used to rewrite the query — only
+   * to weight relevance later. Best-effort: a failing query is dropped (returns nothing for
+   * that query) so one bad document never aborts the investigation. Never throws.
+   */
+  async collect(opts = {}) {
+    const specs = opts.queries !== void 0 && opts.queries.length > 0 ? opts.queries : this.opts.queries ?? [];
+    if (specs.length === 0) return [];
+    const to = opts.to ?? (/* @__PURE__ */ new Date()).toISOString();
+    const from = opts.from;
+    const records = await Promise.all(
+      specs.map(async (q2) => {
+        try {
+          const result = await this.client.graphql(q2.query, bindWindowVars(q2, from, to));
+          const rec = { name: q2.name, kind: q2.kind, data: result.data, timestamp: to };
+          if (q2.relevance !== void 0) rec.relevance = q2.relevance;
+          if (result.errors !== void 0 && result.errors.length > 0) {
+            rec.errors = result.errors.map((e) => ({ message: e.message }));
+          }
+          if (result.extensions?.cost !== void 0) rec.cost = result.extensions.cost;
+          return rec;
+        } catch {
+          return null;
+        }
+      })
+    );
+    return records.filter((r) => r !== null);
+  }
+  /** Synthesize one Evidence per record. Preserves per-query provenance. */
+  toEvidence(records, hintTerms, collectedAt) {
+    return records.map((rec, i3) => this.recordToEvidence(rec, hintTerms, collectedAt, i3));
+  }
+  /**
+   * One-shot evidence query: collect + convert. Degrades to [] on any failure so a flaky
+   * Shopify never aborts an investigation.
+   */
+  async queryEvidence(opts = {}) {
+    try {
+      const hintTerms = opts.hintTerms ?? [];
+      const records = await this.collect({
+        ...opts.from !== void 0 ? { from: opts.from } : {},
+        ...opts.to !== void 0 ? { to: opts.to } : {},
+        ...opts.queries !== void 0 ? { queries: opts.queries } : {},
+        hintTerms
+      });
+      return this.toEvidence(records, hintTerms, opts.collectedAt ?? (/* @__PURE__ */ new Date()).toISOString());
+    } catch {
+      return [];
+    }
+  }
+  async health() {
+    return this.client.health();
+  }
+  recordToEvidence(rec, hintTerms, collectedAt, index2) {
+    const payload = {
+      source: "shopify",
+      shop: this.opts.store,
+      queryName: rec.name,
+      data: rec.data
+    };
+    if (rec.cost !== void 0) payload["cost"] = rec.cost;
+    if (rec.errors !== void 0) payload["errors"] = rec.errors;
+    const ev = {
+      id: `ev_shopify_${index2}`,
+      source: KIND_TO_SOURCE[rec.kind],
+      kind: rec.kind,
+      title: buildTitle3(rec, this.opts.store),
+      relevance: computeRelevance3(rec, hintTerms),
+      payload,
+      links: {},
+      provenance: { query: `shopify ${this.opts.store} ${rec.name}`, collectedAt }
+    };
+    if (rec.timestamp !== void 0) ev.timestamp = rec.timestamp;
+    return ev;
+  }
+};
+function bindWindowVars(q2, from, to) {
+  const base2 = q2.variables ?? {};
+  if (q2.bindWindow !== true) return { ...base2 };
+  const window2 = {};
+  if (from !== void 0) window2["from"] = from;
+  if (to !== void 0) window2["to"] = to;
+  return { ...base2, ...window2 };
+}
+function buildTitle3(rec, store) {
+  const ts = rec.timestamp ? ` \xB7 ${shortTs4(rec.timestamp)}` : "";
+  return redactSecrets(`Shopify ${store} ${rec.name}: ${summarize2(rec)}${ts}`).slice(0, 220);
+}
+function summarize2(rec) {
+  if (rec.errors !== void 0 && rec.errors.length > 0) return `error: ${rec.errors[0].message}`;
+  const count = countResults(rec.data);
+  if (count !== null) return `${count} result${count === 1 ? "" : "s"}`;
+  return "ok";
+}
+function countResults(data) {
+  if (data === null || typeof data !== "object") return null;
+  let total = 0;
+  let found = false;
+  for (const value of Object.values(data)) {
+    if (value !== null && typeof value === "object") {
+      const conn = value;
+      if (Array.isArray(conn["edges"])) {
+        total += conn["edges"].length;
+        found = true;
+      } else if (Array.isArray(conn["nodes"])) {
+        total += conn["nodes"].length;
+        found = true;
+      }
+    }
+  }
+  return found ? total : null;
+}
+function computeRelevance3(rec, hintTerms) {
+  let score = rec.relevance ?? 0.6;
+  const hay = JSON.stringify(rec.data ?? {}).toLowerCase();
+  const domainTerms = hintTerms.filter((t2) => t2.length > 2);
+  if (domainTerms.some((t2) => hay.includes(t2.toLowerCase()))) score += 0.2;
+  return Math.min(0.95, Math.max(0.5, score));
+}
+function shortTs4(iso) {
+  if (!iso || iso.length < 16) return iso || "\u2014";
+  return `${iso.slice(5, 10)} ${iso.slice(11, 16)}`;
+}
+
 // ../../packages/connectors/src/bullmq/client.ts
 init_cjs_shims();
 var import_ioredis = __toESM(require_built3(), 1);
@@ -75823,6 +76174,22 @@ function axiomForEnv(renv) {
     { dataset: a2.dataset }
   );
 }
+function shopifyForEnv(renv) {
+  const s5 = renv.connectors.shopify;
+  if (!s5 || !s5.store || !s5.secret) return null;
+  return new ShopifyProvider(
+    new ShopifyAdminClient({
+      store: s5.store,
+      secret: s5.secret,
+      ...s5.accessId !== void 0 ? { accessId: s5.accessId } : {},
+      ...s5.apiVersion !== void 0 ? { apiVersion: s5.apiVersion } : {}
+    }),
+    {
+      store: s5.store,
+      ...s5.queries !== void 0 ? { queries: s5.queries } : {}
+    }
+  );
+}
 function codeForRepo(config2, repoName) {
   const renv = resolveEnvironment(config2, { project: repoName });
   const c4 = codeForEnv(renv);
@@ -76130,6 +76497,9 @@ async function redisServerStatus(renv) {
   return { reachable, authFailed, databases };
 }
 
+// ../../packages/connectors/src/shopify/index.ts
+init_cjs_shims();
+
 // ../../packages/cli/src/commands/update.ts
 var execFileAsync = (0, import_node_util3.promisify)(import_node_child_process5.execFile);
 async function ensureBackendPinned(write) {
@@ -92491,6 +92861,32 @@ async function checkEnv(renv, deps) {
       `    ${mark("pending")} ${import_picocolors6.default.bold("Axiom")}           ${import_picocolors6.default.dim("not configured")}`
     );
   }
+  const shopifyCfg = renv.connectors.shopify;
+  if (shopifyCfg) {
+    const label = shopifyCfg.store ?? "(no store)";
+    const shopify = (deps?.shopifyFactory ?? shopifyForEnv)(renv);
+    if (shopify) {
+      const h3 = await shopify.health();
+      if (!h3.ok) {
+        console.log(
+          `    ${mark(false)} ${import_picocolors6.default.bold("Shopify")}        ${import_picocolors6.default.dim(`unreachable \xB7 ${label}`)}`
+        );
+        allOk = false;
+      } else {
+        console.log(
+          `    ${mark(true)} ${import_picocolors6.default.bold("Shopify")}         ${import_picocolors6.default.dim(`reachable \xB7 ${label}`)}`
+        );
+      }
+    } else {
+      console.log(
+        `    ${mark(false)} ${import_picocolors6.default.bold("Shopify")}        ${import_picocolors6.default.dim(`configured (${label}) but client secret not set`)}`
+      );
+    }
+  } else {
+    console.log(
+      `    ${mark("pending")} ${import_picocolors6.default.bold("Shopify")}         ${import_picocolors6.default.dim("not configured")}`
+    );
+  }
   const redisCfg = renv.connectors.redis;
   if (redisCfg?.url) {
     const server = redisServerLabel(redisCfg.url);
@@ -95758,7 +96154,7 @@ function buildRuntimeSourceStatus(evidence2, connectors) {
   const metricsConfigured = !!connectors.grafana;
   const metricsFailed = metricsConfigured && !connectors.metricsCollected;
   const stateCount = evidence2.filter((e) => e.source === "state").length;
-  const stateConfigured = !!(connectors.redis || connectors.mongodb || connectors.postgres);
+  const stateConfigured = !!(connectors.redis || connectors.mongodb || connectors.postgres || connectors.shopify);
   const queueConfigured = connectors.queue ?? evidence2.some((e) => e.source === "queue");
   const queueCount = evidence2.filter((e) => e.kind === "queue-state").length;
   return {
@@ -98311,6 +98707,29 @@ async function investigate(input, deps) {
       ownershipEstimate = null;
     }
   }
+  let shopifyCollected = false;
+  if (deps.shopify) {
+    try {
+      const from = logWindowFrom(input.logsSince ?? input.since);
+      const to = (/* @__PURE__ */ new Date()).toISOString();
+      const shopifySeedBase = top ? top.filePath.split("/").pop() ?? "" : "";
+      const shopifyTerms = top ? [.../* @__PURE__ */ new Set([...tokenize(hint), ...tokenize(top.name), ...tokenize(shopifySeedBase)])] : [...new Set(tokenize(hint))];
+      const records = await deps.shopify.collect({
+        from,
+        to,
+        hintTerms: shopifyTerms,
+        ...input.shopifyQueries !== void 0 ? { queries: input.shopifyQueries } : {}
+      });
+      shopifyCollected = true;
+      const collectedAt2 = (/* @__PURE__ */ new Date()).toISOString();
+      for (const ev of deps.shopify.toEvidence(records, shopifyTerms, collectedAt2)) {
+        ev.id = globalThis.crypto.randomUUID();
+        evidence2.push(ev);
+      }
+    } catch {
+      shopifyCollected = false;
+    }
+  }
   normalizeEvidence(evidence2, { service: input.service, environment: input.environment });
   const graph = buildGraph(evidence2);
   const timeline = buildTimeline(evidence2);
@@ -98961,6 +99380,10 @@ async function investigate(input, deps) {
     // collection ran (distinguishes "no matching rows" from "collection failed").
     axiom: deps.axiom != null,
     axiomCollected,
+    // Shopify is configured iff a provider was built (auth present); shopifyCollected
+    // tracks whether its query collection ran (vs "no queries supplied / failed").
+    shopify: deps.shopify != null,
+    shopifyCollected,
     metricsCollected,
     metricsFailureReason,
     logsCollected,
@@ -98974,6 +99397,8 @@ async function investigate(input, deps) {
     sentryCollected,
     axiom: deps.axiom != null,
     axiomCollected,
+    shopify: deps.shopify != null,
+    shopifyCollected,
     grafana: deps.metrics != null,
     queue: deps.queue != null,
     metricsCollected,
@@ -117240,6 +117665,8 @@ function formatAge2(ms) {
 // ../../packages/cli/src/commands/investigate.ts
 init_cjs_shims();
 var import_picocolors17 = __toESM(require_picocolors(), 1);
+var import_node_fs21 = require("fs");
+var import_node_path23 = require("path");
 init_src();
 
 // ../../packages/cli/src/lib/cloud/investigation-sync.ts
@@ -118124,6 +118551,7 @@ async function buildInvestigationContext(renv, opts) {
   const postgres2 = postgresForEnv(renv);
   const sentry = sentryForEnv(renv);
   const axiom = axiomForEnv(renv);
+  const shopify = shopifyForEnv(renv);
   const queue = queueForEnv(renv);
   const redisState = redisStateForEnv(renv);
   const metrics = metricsForEnv(renv);
@@ -118141,6 +118569,7 @@ async function buildInvestigationContext(renv, opts) {
     postgres: postgres2,
     sentry,
     axiom,
+    shopify,
     queue,
     redisState,
     metrics,
@@ -118173,7 +118602,10 @@ async function runOneInvestigation(input, ctx, opts = {}) {
       ...input.scope !== void 0 ? { scope: input.scope } : {},
       ...input.since !== void 0 ? { since: input.since } : {},
       ...input.logsSince !== void 0 ? { logsSince: input.logsSince } : {},
-      ...(input.service ?? ctx.service) !== void 0 ? { service: input.service ?? ctx.service } : {}
+      ...(input.service ?? ctx.service) !== void 0 ? { service: input.service ?? ctx.service } : {},
+      // Invocation-time Shopify queries override the connector's config defaults; when
+      // omitted the provider falls back to `connectors.shopify.queries` (e.g. under watch).
+      ...input.shopifyQueries !== void 0 ? { shopifyQueries: input.shopifyQueries } : {}
     },
     {
       code: ctx.code,
@@ -118186,6 +118618,7 @@ async function runOneInvestigation(input, ctx, opts = {}) {
       postgres: ctx.postgres,
       sentry: ctx.sentry,
       axiom: ctx.axiom,
+      shopify: ctx.shopify,
       queue: ctx.queue,
       redisState: ctx.redisState,
       metrics: ctx.metrics,
@@ -118197,6 +118630,7 @@ async function runOneInvestigation(input, ctx, opts = {}) {
         postgres: !!renv.connectors.postgres?.url,
         sentry: !!renv.connectors.sentry,
         axiom: !!renv.connectors.axiom,
+        shopify: !!renv.connectors.shopify,
         redis: !!renv.connectors.redis?.url,
         queue: !!ctx.queue
       },
@@ -118236,6 +118670,46 @@ function withDeadline(p5, ms) {
 }
 
 // ../../packages/cli/src/commands/investigate.ts
+function resolveShopifyQueries(values2, variablesRaw) {
+  if (values2 === void 0 || values2.length === 0) return [];
+  const variables = parseShopifyVariables(variablesRaw);
+  let stdinCache = null;
+  return values2.map((raw, i3) => {
+    const value = raw.trim();
+    let query;
+    let name2 = `q${i3 + 1}`;
+    if (value === "-") {
+      stdinCache ??= (0, import_node_fs21.readFileSync)(0, "utf8");
+      query = stdinCache;
+      name2 = "stdin";
+    } else if (value.startsWith("@")) {
+      const path = value.slice(1);
+      query = (0, import_node_fs21.readFileSync)(path, "utf8");
+      name2 = (0, import_node_path23.basename)(path).replace(/\.[^.]+$/, "") || name2;
+    } else {
+      query = raw;
+    }
+    const spec = { name: name2, query, kind: "state" };
+    if (variables !== void 0) spec.variables = variables;
+    if (/\$(from|to)\b/.test(query)) spec.bindWindow = true;
+    return spec;
+  });
+}
+function parseShopifyVariables(raw) {
+  if (raw === void 0 || raw.trim() === "") return void 0;
+  const trimmed = raw.trim();
+  const text2 = trimmed.startsWith("@") ? (0, import_node_fs21.readFileSync)(trimmed.slice(1), "utf8") : raw;
+  let parsed;
+  try {
+    parsed = JSON.parse(text2);
+  } catch {
+    throw new Error("--shopify-variables is not valid JSON");
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error("--shopify-variables must be a JSON object");
+  }
+  return parsed;
+}
 function extractEvidenceExcerpt(e) {
   if (!e.payload || typeof e.payload !== "object") return void 0;
   const p5 = e.payload;
@@ -118343,6 +118817,13 @@ function classifyAIFailure(firstError) {
 async function runInvestigate(hint, opts) {
   try {
     const config2 = await loadConfig(opts.config, { name: opts.name });
+    let shopifyQueries;
+    try {
+      shopifyQueries = resolveShopifyQueries(opts.shopifyQuery, opts.shopifyVariables);
+    } catch (err2) {
+      console.error(import_picocolors17.default.red(`--shopify-query: ${err2.message}`));
+      return 1;
+    }
     const projectName = opts.project ?? opts.repo;
     let renv;
     try {
@@ -118379,7 +118860,8 @@ async function runInvestigate(hint, opts) {
           hint,
           ...opts.scope !== void 0 ? { scope: opts.scope } : {},
           ...opts.since !== void 0 ? { since: opts.since } : {},
-          ...opts.logsSince !== void 0 ? { logsSince: opts.logsSince } : {}
+          ...opts.logsSince !== void 0 ? { logsSince: opts.logsSince } : {},
+          ...shopifyQueries.length > 0 ? { shopifyQueries } : {}
         },
         ctx,
         { timeoutMs: timeoutSec * 1e3 }
@@ -119621,8 +120103,8 @@ async function runOwner(query, opts) {
 
 // ../../packages/cli/src/commands/postmortem.ts
 init_cjs_shims();
-var import_node_fs21 = require("fs");
-var import_node_path23 = require("path");
+var import_node_fs22 = require("fs");
+var import_node_path24 = require("path");
 var import_picocolors30 = __toESM(require_picocolors(), 1);
 async function runPostmortem(id, opts) {
   const log = opts.write ?? ((line2) => console.log(line2));
@@ -119733,14 +120215,14 @@ _AI summary unavailable: ${validationErrors?.[0] ?? "provider error"}_
       }
     }
     if (opts.output) {
-      const outputPath = (0, import_node_path23.resolve)(opts.output);
-      if ((0, import_node_fs21.existsSync)(outputPath) && !opts.force) {
+      const outputPath = (0, import_node_path24.resolve)(opts.output);
+      if ((0, import_node_fs22.existsSync)(outputPath) && !opts.force) {
         log(import_picocolors30.default.red("\u2717") + " " + outputPath + " already exists");
         log(import_picocolors30.default.dim("  pass --force to overwrite"));
         return 1;
       }
       try {
-        (0, import_node_fs21.writeFileSync)(outputPath, content, "utf8");
+        (0, import_node_fs22.writeFileSync)(outputPath, content, "utf8");
       } catch (err2) {
         log(import_picocolors30.default.red("\u2717 Could not write " + outputPath + ": ") + err2.message);
         return 1;
@@ -122145,13 +122627,13 @@ async function runState(opts) {
 // ../../packages/cli/src/commands/init.ts
 init_cjs_shims();
 var import_picocolors39 = __toESM(require_picocolors(), 1);
-var import_node_path24 = require("path");
+var import_node_path25 = require("path");
 init_src();
 async function runInit(opts) {
   try {
     const cwd = process.cwd();
-    const root = opts.path ? (0, import_node_path24.resolve)(opts.path) : findRepoRoot(cwd) ?? cwd;
-    const name2 = opts.name ?? (0, import_node_path24.basename)(root);
+    const root = opts.path ? (0, import_node_path25.resolve)(opts.path) : findRepoRoot(cwd) ?? cwd;
+    const name2 = opts.name ?? (0, import_node_path25.basename)(root);
     const envName = opts.env ?? "production";
     const repo = { name: name2, path: root };
     if (opts.source) repo["source"] = { hostUrl: opts.source };
@@ -122803,7 +123285,7 @@ function parseDbSpec(spec) {
   }
   return { db, roles };
 }
-var SUPPORTED = ["elasticsearch", "mongodb", "postgres", "sentry", "axiom", "grafana", "redis"];
+var SUPPORTED = ["elasticsearch", "mongodb", "postgres", "sentry", "axiom", "shopify", "grafana", "redis"];
 async function runConnect(type, opts) {
   if (type === "ai") {
     return runConnectAi({
@@ -122826,6 +123308,15 @@ async function runConnect(type, opts) {
     const root = findRepoRoot(cwd) ?? cwd;
     const configPath = discoverLocalConfig(cwd) ?? localConfigPath(root);
     const filled = await fillInteractive(connectorType, opts);
+    if (missingRequired(connectorType, filled)) {
+      console.error(
+        import_picocolors44.default.red(`Missing required field(s) for ${connectorType} \u2014 nothing saved.`) + import_picocolors44.default.dim(
+          `
+  Re-run ${import_picocolors44.default.bold(`horus connect ${connectorType}`)} and fill every prompt, or pass them as flags (e.g. --secret for the token).`
+        )
+      );
+      return 1;
+    }
     let patch;
     switch (connectorType) {
       case "elasticsearch":
@@ -122843,6 +123334,9 @@ async function runConnect(type, opts) {
       case "axiom":
         patch = buildAxiomPatch(filled);
         break;
+      case "shopify":
+        patch = buildShopifyPatch(filled);
+        break;
       case "grafana":
         patch = buildGrafanaPatch(filled);
         break;
@@ -122993,6 +123487,21 @@ ${import_picocolors44.default.bold(`Connect ${type}`)} ${import_picocolors44.def
       }
       break;
     }
+    case "shopify": {
+      filled.store = filled.store ?? await ask("Store name (subdomain only, e.g. acme-store)", "my-store");
+      filled.apiVersion = filled.apiVersion ?? await ask("API version", "2025-10");
+      if (filled.secret === void 0) {
+        const method = await askShopifyAuthMethod();
+        if (method === "client-credentials") {
+          filled.accessId = filled.accessId ?? await askRequiredText("Access id (client_id)");
+          filled.secret = await askPassword("Client secret", true) || void 0;
+        } else {
+          filled.accessId = void 0;
+          filled.secret = await askPassword("Admin API access token (e.g. shpat_\u2026)", true) || void 0;
+        }
+      }
+      break;
+    }
     case "grafana":
       filled.url = filled.url ?? await ask("URL", "https://grafana.example.com");
       filled.username = filled.username ?? (await ask("Username", "", false) || void 0);
@@ -123052,6 +123561,8 @@ function missingRequired(type, opts) {
       return !opts.org || !opts.project || !opts.authToken;
     case "axiom":
       return !opts.dataset || !opts.token;
+    case "shopify":
+      return !opts.store || !opts.secret;
     case "grafana":
       return !opts.url;
     case "redis":
@@ -123074,17 +123585,25 @@ function ask(label, placeholder = "", required2 = true) {
     });
   });
 }
-function askPassword(label) {
+function askPassword(label, required2 = false) {
   return new Promise((resolve13) => {
     const stdin = process.stdin;
     if (typeof stdin.setRawMode === "function") {
-      process.stdout.write(`  ${label}${import_picocolors44.default.dim(" [optional]")}: `);
+      const suffix = required2 ? "" : import_picocolors44.default.dim(" [optional]");
+      process.stdout.write(`  ${label}${suffix}: `);
       stdin.setRawMode(true);
       stdin.resume();
       let value = "";
       const onData = (chunk) => {
         const char2 = chunk.toString();
         if (char2 === "\r" || char2 === "\n") {
+          if (required2 && value === "") {
+            process.stdout.write(`
+${import_picocolors44.default.yellow("  Required \u2014 please enter a value.")}
+`);
+            process.stdout.write(`  ${label}: `);
+            return;
+          }
           stdin.setRawMode(false);
           stdin.pause();
           stdin.removeListener("data", onData);
@@ -123108,6 +123627,24 @@ function askPassword(label) {
     }
   });
 }
+async function askRequiredText(label) {
+  for (; ; ) {
+    const v4 = (await ask(label, "", false)).trim();
+    if (v4) return v4;
+    console.log(import_picocolors44.default.yellow("  Required \u2014 please enter a value."));
+  }
+}
+async function askShopifyAuthMethod() {
+  console.log(`  ${import_picocolors44.default.bold("Auth method")}`);
+  console.log(`    ${import_picocolors44.default.bold("1)")} Static Admin API access token   ${import_picocolors44.default.dim("\u2014 a Custom App shpat_\u2026 token")}`);
+  console.log(`    ${import_picocolors44.default.bold("2)")} Client-Credentials app          ${import_picocolors44.default.dim("\u2014 client id + secret, exchanged for a token")}`);
+  for (; ; ) {
+    const a2 = (await ask("Choose", "1")).trim();
+    if (a2 === "1") return "static";
+    if (a2 === "2") return "client-credentials";
+    console.log(import_picocolors44.default.yellow("  Enter 1 or 2."));
+  }
+}
 function buildEsPatch(opts) {
   if (!opts.indexPattern && !opts.indexPatterns?.length) {
     throw new Error("Index pattern is required for elasticsearch");
@@ -123157,6 +123694,14 @@ function buildAxiomPatch(opts) {
   if (opts.url && opts.url.replace(/\/$/, "") !== "https://api.axiom.co") patch["url"] = opts.url;
   return patch;
 }
+function buildShopifyPatch(opts) {
+  if (!opts.store) throw new Error("Store is required for shopify");
+  const patch = { store: opts.store };
+  if (opts.apiVersion) patch["apiVersion"] = opts.apiVersion;
+  if (opts.accessId) patch["accessId"] = opts.accessId;
+  if (opts.secret) patch["secret"] = opts.secret;
+  return patch;
+}
 function buildGrafanaPatch(opts) {
   const patch = {};
   if (opts.url) patch["url"] = opts.url;
@@ -123303,6 +123848,18 @@ async function probe(type, opts) {
         });
         return client.health();
       }
+      case "shopify": {
+        if (!opts.store || !opts.secret) {
+          return { ok: true, detail: "skipped (missing store/secret)" };
+        }
+        const client = new ShopifyAdminClient({
+          store: opts.store,
+          secret: opts.secret,
+          ...opts.accessId ? { accessId: opts.accessId } : {},
+          ...opts.apiVersion ? { apiVersion: opts.apiVersion } : {}
+        });
+        return client.health();
+      }
       case "grafana": {
         if (!opts.url) return { ok: true, detail: "skipped (no URL)" };
         const headers = { "Content-Type": "application/json" };
@@ -123355,6 +123912,11 @@ function printSummary(type, opts) {
   if (opts.org) lines.push(`  org:            ${opts.org}`);
   if (opts.project) lines.push(`  project:        ${opts.project}`);
   if (opts.dataset) lines.push(`  dataset:        ${opts.dataset}`);
+  if (opts.store) lines.push(`  store:          ${opts.store}`);
+  if (opts.apiVersion) lines.push(`  api-version:    ${opts.apiVersion}`);
+  if (opts.accessId) lines.push(`  access-id:      ${opts.accessId}`);
+  if (opts.secret)
+    lines.push(`  secret:         ${"\u2022".repeat(Math.min(opts.secret.length, 8))}`);
   if (opts.authToken)
     lines.push(`  auth-token:     ${"\u2022".repeat(Math.min(opts.authToken.length, 8))}`);
   if (opts.token)
@@ -123750,13 +124312,13 @@ async function runNotify(sub, opts) {
 
 // ../../packages/cli/src/commands/secrets.ts
 init_cjs_shims();
-var import_node_fs22 = require("fs");
+var import_node_fs23 = require("fs");
 var import_picocolors46 = __toESM(require_picocolors(), 1);
 init_src();
 function locate2(cwd = process.cwd()) {
   const root = findRepoRoot(cwd) ?? cwd;
   const configPath = discoverLocalConfig(cwd) ?? localConfigPath(root);
-  return { root, configPath, exists: (0, import_node_fs22.existsSync)(configPath) };
+  return { root, configPath, exists: (0, import_node_fs23.existsSync)(configPath) };
 }
 function countStoredSecrets(root) {
   const stored = readLocalSecrets(root).connectors;
@@ -123894,19 +124456,19 @@ export HORUS_SECRET_KEY=${key.toString("base64")}
 // ../../packages/cli/src/commands/stop.ts
 init_cjs_shims();
 var import_node_child_process10 = require("child_process");
-var import_node_fs23 = require("fs");
+var import_node_fs24 = require("fs");
 var import_node_util6 = require("util");
-var import_node_path25 = require("path");
+var import_node_path26 = require("path");
 var import_picocolors47 = __toESM(require_picocolors(), 1);
 init_src();
 var execFileAsync3 = (0, import_node_util6.promisify)(import_node_child_process10.execFile);
-var unlinkAsync = (0, import_node_util6.promisify)(import_node_fs23.unlink);
+var unlinkAsync = (0, import_node_util6.promisify)(import_node_fs24.unlink);
 var SPAWNED_HOST_FILE2 = "spawned-host.json";
 var START_TIME_TOLERANCE_S = 60;
 var STOP_WAIT_MS = 5e3;
 var STOP_KILL_WAIT_MS = 3e3;
 var STOP_POLL_MS = 200;
-var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+var sleep2 = (ms) => new Promise((r) => setTimeout(r, ms));
 async function runStop(opts) {
   try {
     if (opts.all) {
@@ -124042,11 +124604,11 @@ function isOwnHostProcess(pid, port, root, args2) {
   if (hostArgvRegex(port).test(args2)) return true;
   if (!hostArgvAnyPortRegex().test(args2)) return false;
   const rec = readSourceHostPid(root);
-  return rec !== null && rec.pid === pid && Number.isFinite(rec.port) && rec.port === port && !!rec.repoPath && (0, import_node_path25.resolve)(rec.repoPath) === (0, import_node_path25.resolve)(root);
+  return rec !== null && rec.pid === pid && Number.isFinite(rec.port) && rec.port === port && !!rec.repoPath && (0, import_node_path26.resolve)(rec.repoPath) === (0, import_node_path26.resolve)(root);
 }
 async function cleanupSpawnedRecord(root) {
   try {
-    await unlinkAsync((0, import_node_path25.join)(root, HORUS_DIR, SPAWNED_HOST_FILE2));
+    await unlinkAsync((0, import_node_path26.join)(root, HORUS_DIR, SPAWNED_HOST_FILE2));
   } catch {
   }
 }
@@ -124150,7 +124712,7 @@ async function terminatePid(pid) {
     }
     const deadline = Date.now() + waitMs;
     while (Date.now() < deadline) {
-      await sleep(STOP_POLL_MS);
+      await sleep2(STOP_POLL_MS);
       if (await getProcessInfo(pid) === null) return true;
     }
   }
@@ -124470,6 +125032,29 @@ var CONNECTOR_CHECKS = {
       };
     }
   },
+  // Shopify (Admin GraphQL — application state evidence)
+  shopify: {
+    label: "Shopify",
+    absentNext: "add connectors.shopify to an environment for Shopify Admin state evidence",
+    check: (s5, ctx) => {
+      const secretSet = s5.secret || process.env[s5.secretEnv ?? "SHOPIFY_SECRET"];
+      if (!secretSet) {
+        return {
+          label: "Shopify",
+          status: "warn",
+          detail: `${ctx} \u2014 client secret not set`,
+          next: "set shopify.secret or shopify.secretEnv (default SHOPIFY_SECRET), or run horus connect shopify"
+        };
+      }
+      const queryCount = s5.queries?.length ?? 0;
+      const queryNote = queryCount > 0 ? ` (${queryCount} default quer${queryCount === 1 ? "y" : "ies"})` : " (no default queries \u2014 supply --shopify-query at investigate time)";
+      return {
+        label: "Shopify",
+        status: "pass",
+        detail: `${ctx} \u2014 ${s5.store}${queryNote} [runtime ingestion pending]`
+      };
+    }
+  },
   // Redis / BullMQ (queue + cache/state)
   redis: {
     label: "Redis",
@@ -124752,8 +125337,8 @@ async function runProvidersDoctorCommand(opts) {
 
 // ../../packages/cli/src/commands/generate-config.ts
 init_cjs_shims();
-var import_node_fs24 = require("fs");
-var import_node_path26 = require("path");
+var import_node_fs25 = require("fs");
+var import_node_path27 = require("path");
 var import_picocolors51 = __toESM(require_picocolors(), 1);
 init_src();
 function configTemplate(name2, repoPath) {
@@ -124775,6 +125360,16 @@ function configTemplate(name2, repoPath) {
         // elasticsearch: { indexPattern: '${name2}-prod-*' },
         // mongodb: { database: '${name2}' },
         // grafana: {},
+        // shopify: {
+        //   store: '${name2}',   // subdomain only \u2014 .myshopify.com is added automatically
+        //   apiVersion: '2025-10',
+        //   // accessId + secret set by \`horus connect shopify\` (secret encrypted at rest).
+        //   // Default queries run by \`horus watch\`; \`horus investigate --shopify-query\` overrides.
+        //   queries: [
+        //     { name: 'recent-orders', kind: 'state', bindWindow: true,
+        //       query: 'query($from:DateTime){ orders(first:20, query:"updated_at:>=$from"){ edges{ node{ id name displayFinancialStatus } } } }' },
+        //   ],
+        // },
       },
     }],
   }],
@@ -124803,17 +125398,17 @@ async function runGenerateConfig(opts) {
   const defaults2 = localConfigPath2 != null ? projectDefaults(localConfigPath2) : null;
   const hasLocalConfig = defaults2 != null;
   const defaultOut = hasLocalConfig ? "horus.config.example.js" : "horus.config.js";
-  const outPath = (0, import_node_path26.resolve)(cwd, opts.out ?? defaultOut);
+  const outPath = (0, import_node_path27.resolve)(cwd, opts.out ?? defaultOut);
   const name2 = opts.name ?? defaults2?.name ?? "my-project";
   const repoPath = opts.repo ?? defaults2?.repoPath ?? `/path/to/${name2}`;
-  if ((0, import_node_fs24.existsSync)(outPath) && !opts.force) {
+  if ((0, import_node_fs25.existsSync)(outPath) && !opts.force) {
     log(`${import_picocolors51.default.red("\u2717")} ${outPath} already exists`);
     log(import_picocolors51.default.dim("  pass --force to overwrite"));
     return 1;
   }
   try {
-    (0, import_node_fs24.mkdirSync)((0, import_node_path26.dirname)(outPath), { recursive: true });
-    (0, import_node_fs24.writeFileSync)(outPath, configTemplate(name2, repoPath), "utf8");
+    (0, import_node_fs25.mkdirSync)((0, import_node_path27.dirname)(outPath), { recursive: true });
+    (0, import_node_fs25.writeFileSync)(outPath, configTemplate(name2, repoPath), "utf8");
   } catch (err2) {
     log(`${import_picocolors51.default.red("\u2717")} Could not write ${outPath}: ${err2.message}`);
     return 1;
@@ -124975,6 +125570,7 @@ async function runReadiness(opts) {
     let anyPostgres = false;
     let anySentry = false;
     let anyAxiom = false;
+    let anyShopify = false;
     let anyRedis = false;
     for (const project of globalConfig2.projects) {
       for (const repo of project.repositories) {
@@ -124988,6 +125584,7 @@ async function runReadiness(opts) {
         if (c4.postgres) anyPostgres = true;
         if (c4.sentry) anySentry = true;
         if (c4.axiom) anyAxiom = true;
+        if (c4.shopify) anyShopify = true;
         if (c4.redis) anyRedis = true;
       }
     }
@@ -125054,6 +125651,15 @@ async function runReadiness(opts) {
         next: "run `horus connect axiom`"
       }
     );
+    checks.push(
+      anyShopify ? { label: "Shopify", status: "pass", blocking: false, detail: "configured" } : {
+        label: "Shopify",
+        status: "warn",
+        blocking: false,
+        detail: "not configured \u2014 no Shopify Admin state evidence",
+        next: "run `horus connect shopify`"
+      }
+    );
     checks.push(
       anyRedis ? { label: "Redis", status: "pass", blocking: false, detail: "configured" } : {
         label: "Redis",
@@ -125124,8 +125730,8 @@ async function runReadiness(opts) {
 
 // ../../packages/cli/src/commands/skill.ts
 init_cjs_shims();
-var import_node_fs25 = require("fs");
-var import_node_path27 = require("path");
+var import_node_fs26 = require("fs");
+var import_node_path28 = require("path");
 var import_node_os10 = require("os");
 var import_promises3 = require("readline/promises");
 var import_picocolors53 = __toESM(require_picocolors(), 1);
@@ -125135,22 +125741,22 @@ function isValidTarget(target) {
 }
 function getLegacyClaudeSkillPath(opts) {
   const base2 = opts.global ? (0, import_node_os10.homedir)() : opts.cwd ?? process.cwd();
-  return (0, import_node_path27.join)(base2, ".claude", "skills", "horus.md");
+  return (0, import_node_path28.join)(base2, ".claude", "skills", "horus.md");
 }
 function getSkillInstallPath(target, opts) {
   const base2 = opts.global ? (0, import_node_os10.homedir)() : opts.cwd ?? process.cwd();
   switch (target) {
     case "claude":
-      return (0, import_node_path27.join)(base2, ".claude", "skills", "horus", "SKILL.md");
+      return (0, import_node_path28.join)(base2, ".claude", "skills", "horus", "SKILL.md");
     case "gemini":
-      return opts.global ? (0, import_node_path27.join)(base2, ".gemini", "GEMINI.md") : (0, import_node_path27.join)(base2, "GEMINI.md");
+      return opts.global ? (0, import_node_path28.join)(base2, ".gemini", "GEMINI.md") : (0, import_node_path28.join)(base2, "GEMINI.md");
     case "cursor":
-      return opts.global ? (0, import_node_path27.join)(base2, ".cursorrules") : (0, import_node_path27.join)(base2, ".cursor", "rules", "horus.mdc");
+      return opts.global ? (0, import_node_path28.join)(base2, ".cursorrules") : (0, import_node_path28.join)(base2, ".cursor", "rules", "horus.mdc");
     case "codex":
-      return opts.global ? (0, import_node_path27.join)(base2, ".codex", "AGENTS.md") : (0, import_node_path27.join)(base2, "AGENTS.md");
+      return opts.global ? (0, import_node_path28.join)(base2, ".codex", "AGENTS.md") : (0, import_node_path28.join)(base2, "AGENTS.md");
     case "generic":
     default:
-      return (0, import_node_path27.join)(base2, ".horus", "skills", `horus-${target}.md`);
+      return (0, import_node_path28.join)(base2, ".horus", "skills", `horus-${target}.md`);
   }
 }
 var BASE_SKILL = `# Horus Grounded Investigation Skill
@@ -125475,7 +126081,7 @@ async function runSkillInstall(target, opts) {
   const content = generateSkillContent(target);
   if (target === "claude") {
     const legacyPath = getLegacyClaudeSkillPath({ global: opts.global, cwd: opts.cwd });
-    if ((0, import_node_fs25.existsSync)(legacyPath)) {
+    if ((0, import_node_fs26.existsSync)(legacyPath)) {
       if (!opts.force) {
         const confirmed = await (opts.confirm ?? confirm)(
           `Found old flat skill file at ${legacyPath}. Replace it with the new directory layout?`
@@ -125487,7 +126093,7 @@ async function runSkillInstall(target, opts) {
         }
       }
       try {
-        (0, import_node_fs25.rmSync)(legacyPath);
+        (0, import_node_fs26.rmSync)(legacyPath);
         log(`${import_picocolors53.default.yellow("!")} Replaced old flat skill file: ${legacyPath}`);
       } catch (err2) {
         log(`${import_picocolors53.default.red("\u2717")} Could not remove legacy skill file ${legacyPath}: ${err2.message}`);
@@ -125495,14 +126101,14 @@ async function runSkillInstall(target, opts) {
       }
     }
   }
-  if ((0, import_node_fs25.existsSync)(outPath) && !opts.force) {
+  if ((0, import_node_fs26.existsSync)(outPath) && !opts.force) {
     log(`${import_picocolors53.default.red("\u2717")} ${outPath} already exists`);
     log(import_picocolors53.default.dim("  pass --force to overwrite"));
     return 1;
   }
   try {
-    (0, import_node_fs25.mkdirSync)((0, import_node_path27.dirname)(outPath), { recursive: true });
-    (0, import_node_fs25.writeFileSync)(outPath, content, "utf8");
+    (0, import_node_fs26.mkdirSync)((0, import_node_path28.dirname)(outPath), { recursive: true });
+    (0, import_node_fs26.writeFileSync)(outPath, content, "utf8");
   } catch (err2) {
     log(`${import_picocolors53.default.red("\u2717")} Could not write ${outPath}: ${err2.message}`);
     return 1;
@@ -125547,7 +126153,7 @@ async function runSkillPath(target, opts) {
 // ../../packages/cli/src/commands/login.ts
 init_cjs_shims();
 var import_picocolors54 = __toESM(require_picocolors(), 1);
-var sleep2 = (ms) => new Promise((resolve13) => setTimeout(resolve13, ms));
+var sleep3 = (ms) => new Promise((resolve13) => setTimeout(resolve13, ms));
 async function loginWithToken(apiBaseUrl, token) {
   const client = new CloudClient(apiBaseUrl, token);
   try {
@@ -125602,7 +126208,7 @@ async function loginWithBrowser(apiBaseUrl) {
   const deadline = Date.now() + session.expiresIn * 1e3;
   let intervalMs = Math.max(session.interval, 1) * 1e3;
   while (Date.now() < deadline) {
-    await sleep2(intervalMs);
+    await sleep3(intervalMs);
     let poll;
     try {
       poll = await client.pollCliSession(session.deviceCode);
@@ -126243,7 +126849,7 @@ function installCommandTelemetry(program2) {
 // ../../packages/cli/src/commands/eval.ts
 init_cjs_shims();
 var import_promises5 = require("fs/promises");
-var import_node_path28 = require("path");
+var import_node_path29 = require("path");
 var import_picocolors58 = __toESM(require_picocolors(), 1);
 init_src();
 function resolveProject2(config2, repo) {
@@ -126294,7 +126900,7 @@ async function runEvalBuild(opts) {
     const project = resolveProject2(config2, opts.repo);
     if (!project) return 1;
     const version3 = opts.version ?? CORPUS_VERSION;
-    const outDir = opts.out ? (0, import_node_path28.isAbsolute)(opts.out) ? opts.out : (0, import_node_path28.resolve)(process.cwd(), opts.out) : (0, import_node_path28.join)(process.cwd(), ".horus", "eval");
+    const outDir = opts.out ? (0, import_node_path29.isAbsolute)(opts.out) ? opts.out : (0, import_node_path29.resolve)(process.cwd(), opts.out) : (0, import_node_path29.join)(process.cwd(), ".horus", "eval");
     const { db, sql: sql2 } = await openDb(config2.database.url);
     try {
       const labels = await listOutcomeLabels(db, {
@@ -126310,8 +126916,8 @@ async function runEvalBuild(opts) {
       const build = buildCorpus(labels, resolveReport);
       const artifact = serializeCorpus(build, version3);
       await (0, import_promises5.mkdir)(outDir, { recursive: true });
-      const corpusPath = (0, import_node_path28.join)(outDir, artifact.filename);
-      const manifestPath = (0, import_node_path28.join)(outDir, `corpus-${version3}.manifest.json`);
+      const corpusPath = (0, import_node_path29.join)(outDir, artifact.filename);
+      const manifestPath = (0, import_node_path29.join)(outDir, `corpus-${version3}.manifest.json`);
       const manifest = { ...artifact.manifest, generatedAt: (/* @__PURE__ */ new Date()).toISOString(), project };
       await (0, import_promises5.writeFile)(corpusPath, artifact.jsonl, "utf8");
       await (0, import_promises5.writeFile)(manifestPath, JSON.stringify(manifest, null, 2) + "\n", "utf8");
@@ -126412,11 +127018,11 @@ async function runEvalBaseline(opts) {
 // ../../packages/cli/src/commands/train.ts
 init_cjs_shims();
 var import_promises6 = require("fs/promises");
-var import_node_path29 = require("path");
+var import_node_path30 = require("path");
 var import_node_os11 = require("os");
 var import_picocolors59 = __toESM(require_picocolors(), 1);
 init_src();
-var RERANKER_MODEL_PATH = (0, import_node_path29.join)((0, import_node_os11.homedir)(), ".horus", "reranker.json");
+var RERANKER_MODEL_PATH = (0, import_node_path30.join)((0, import_node_os11.homedir)(), ".horus", "reranker.json");
 function candidatesFromReport(blob) {
   if (blob === null || typeof blob !== "object") return null;
   const causes = blob.suspectedCauses;
@@ -126505,7 +127111,7 @@ async function runTrain(opts) {
     return 0;
   }
   try {
-    await (0, import_promises6.mkdir)((0, import_node_path29.join)((0, import_node_os11.homedir)(), ".horus"), { recursive: true });
+    await (0, import_promises6.mkdir)((0, import_node_path30.join)((0, import_node_os11.homedir)(), ".horus"), { recursive: true });
     const { ok: _ok, ...model } = result;
     void _ok;
     await (0, import_promises6.writeFile)(RERANKER_MODEL_PATH, JSON.stringify(model, null, 2) + "\n", "utf8");
@@ -126573,8 +127179,8 @@ Examples:
     process.exitCode = await runReadiness({ config: opts.config, ai: opts.ai, aiModel: opts.aiModel });
   });
   program2.command("connect <type>").description(
-    "Add or update a connector (elasticsearch / mongodb / postgres / sentry / axiom / grafana / redis / ai) in .horus/config.json"
-  ).option("--env <name>", "target environment (default: first environment in config)").option("--provider <name>", "AI provider for `connect ai` (anthropic / claude / codex / gemini)").option("--api-key <key>", "Anthropic API key for `connect ai`").option("--model <id>", "default model for `connect ai`").option("--url <url>", "connector URL or connection string (Redis with auth: redis://:password@host:6379)").option("--username <user>", "username (elasticsearch / grafana)").option("--password <pass>", "password (elasticsearch / grafana; for Redis embed in --url)").option("--index-pattern <pattern>", "Elasticsearch index pattern (required for elasticsearch)").option("--service <name>", "service name scope for log queries").option("--database <name>", "database name (required for mongodb)").option("--collections <list>", "comma-separated collection allowlist (mongodb)").option("--schema <name>", "schema to introspect (postgres; default public)").option("--tables <list>", "comma-separated table allowlist (postgres)").option("--auth-token <token>", "Sentry API auth token (required for sentry)").option("--org <slug>", "Sentry org slug (required for sentry)").option("--project <slug>", "Sentry project slug (required for sentry)").option("--token <token>", "Axiom API token (required for axiom)").option("--dataset <name>", "Axiom dataset to query (required for axiom)").option("--dashboard <uid>", "default dashboard uid (grafana)").option(
+    "Add or update a connector (elasticsearch / mongodb / postgres / sentry / axiom / shopify / grafana / redis / ai) in .horus/config.json"
+  ).option("--env <name>", "target environment (default: first environment in config)").option("--provider <name>", "AI provider for `connect ai` (anthropic / claude / codex / gemini)").option("--api-key <key>", "Anthropic API key for `connect ai`").option("--model <id>", "default model for `connect ai`").option("--url <url>", "connector URL or connection string (Redis with auth: redis://:password@host:6379)").option("--username <user>", "username (elasticsearch / grafana)").option("--password <pass>", "password (elasticsearch / grafana; for Redis embed in --url)").option("--index-pattern <pattern>", "Elasticsearch index pattern (required for elasticsearch)").option("--service <name>", "service name scope for log queries").option("--database <name>", "database name (required for mongodb)").option("--collections <list>", "comma-separated collection allowlist (mongodb)").option("--schema <name>", "schema to introspect (postgres; default public)").option("--tables <list>", "comma-separated table allowlist (postgres)").option("--auth-token <token>", "Sentry API auth token (required for sentry)").option("--org <slug>", "Sentry org slug (required for sentry)").option("--project <slug>", "Sentry project slug (required for sentry)").option("--token <token>", "Axiom API token (required for axiom)").option("--dataset <name>", "Axiom dataset to query (required for axiom)").option("--store <name>", "Shopify store subdomain, e.g. my-store \u2014 .myshopify.com is added automatically (required for shopify)").option("--api-version <ver>", "Shopify Admin API version, e.g. 2025-10 (shopify; defaults to a recent version)").option("--access-id <id>", "Shopify app client_id \u2014 omit for a static Admin API token (shopify)").option("--secret <secret>", "Shopify client_secret, or a static Admin API access token \u2014 encrypted at rest (required for shopify)").option("--dashboard <uid>", "default dashboard uid (grafana)").option(
     "--db <spec>",
     "redis logical DB as db:role1,role2 (e.g. 0:cache,state or 1:bullmq,queues); repeatable",
     (val, acc) => {
@@ -126600,6 +127206,10 @@ Examples:
         project: opts.project,
         token: opts.token,
         dataset: opts.dataset,
+        store: opts.store,
+        apiVersion: opts.apiVersion,
+        accessId: opts.accessId,
+        secret: opts.secret,
         dashboard: opts.dashboard,
         db: opts.db,
         bullmqPrefix: opts.bullmqPrefix,
@@ -126779,7 +127389,15 @@ score, a confidence, or a verdict. It ships OFF; once trained, enable with:
       });
     }
   );
-  program2.command("investigate <hint>").description("Run a deterministic investigation for an incident hint").option("-c, --config <path>", "path to horus.config.ts").option("--name <name>", "registered project name (resolves via the registry)").option("--project <name>", "project name to scope to").option("--env <name>", "environment name (e.g. production)").option("--repo <name>", "repository/project to scope to (alias for --project)").option("--scope <path>", "resolve the seed only from symbols under this path (e.g. packages/core) \u2014 useful in monorepos").option("--since <ref>", "git ref/range for change-impact (e.g. HEAD~5)").option("--logs-since <dur>", "runtime-log window as a duration (e.g. 30d, 24h); independent of --since").option("--timeout <sec>", "overall investigation deadline in seconds (default 120)").option(
+  program2.command("investigate <hint>").description("Run a deterministic investigation for an incident hint").option("-c, --config <path>", "path to horus.config.ts").option("--name <name>", "registered project name (resolves via the registry)").option("--project <name>", "project name to scope to").option("--env <name>", "environment name (e.g. production)").option("--repo <name>", "repository/project to scope to (alias for --project)").option("--scope <path>", "resolve the seed only from symbols under this path (e.g. packages/core) \u2014 useful in monorepos").option("--since <ref>", "git ref/range for change-impact (e.g. HEAD~5)").option("--logs-since <dur>", "runtime-log window as a duration (e.g. 30d, 24h); independent of --since").option(
+    "--shopify-query <q>",
+    "Shopify Admin GraphQL query to run as evidence: @file, - (stdin), or a raw string; repeatable",
+    (val, acc) => {
+      acc.push(val);
+      return acc;
+    },
+    []
+  ).option("--shopify-variables <json>", "variables (@file or inline JSON object) applied to every --shopify-query").option("--timeout <sec>", "overall investigation deadline in seconds (default 120)").option(
     "--service <name>",
     "service name to scope runtime logs, e.g. leadcall-api-prod"
   ).option("--json", "output JSON (alias for --format json)").option("--format <fmt>", "output format: text | markdown | json", "text").option("--ai", "enrich report with AI narrative (requires ANTHROPIC_API_KEY; falls back to deterministic on failure)").option("--ai-model <model>", "AI model for --ai (default: claude-opus-4-8)").action(
@@ -126793,6 +127411,8 @@ score, a confidence, or a verdict. It ships OFF; once trained, enable with:
         scope: opts.scope,
         since: opts.since,
         logsSince: opts.logsSince,
+        ...opts.shopifyQuery !== void 0 ? { shopifyQuery: opts.shopifyQuery } : {},
+        ...opts.shopifyVariables !== void 0 ? { shopifyVariables: opts.shopifyVariables } : {},
         timeout: opts.timeout,
         service: opts.service,
         json: opts.json,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@merittdev/horus",
-  "version": "0.18.0",
+  "version": "0.19.1",
   "description": "Local-first, source-aware production-incident investigation engine",
   "type": "module",
   "bin": {