Merchant removes the app from their store. We delete their merchant row and all dependent data (products, competitors, briefings) via cascade.

GDPR: Shopify asks us to permanently delete all data for a shop. Same as uninstall — full merchant + dependents deletion.

GDPR: A customer asked Shopify what data an app holds on them. We respond that we store no customer PII — only aggregate order counts.

GDPR: Delete all data for a specific customer. We have no customer-level data to delete — acknowledged with 200.

A billing subscription changed — activated, cancelled, or frozen. We update the merchant's plan and paywall status accordingly.

Fetch the merchant's full product catalogue so they can pick which SKUs to track during onboarding.

Orders from last 30 days. Calculates the average realized unit price per product after discounts are applied.

Orders from last 30 days. Calculates what % of order value is discounted and whether discounting is structural or promotional.

Orders from last 30 days. Counts how many had refunds — a proxy for product-market fit and quality issues.

Orders from last 30 days. Breaks down where orders came from: paid social, organic, email, direct.

Orders from last 30 days. Ratio of first-time buyers to returning customers.

Orders from last 30 days. Identifies the highest-revenue product among the merchant's confirmed matched SKUs.

Creates a recurring charge when a merchant upgrades. Verifies the charge status when Shopify redirects back after the merchant approves or declines.

Public HTTPS entry point. Terminates TLS, routes all traffic to the Remix container on port 3000. HTTP → 301 HTTPS redirect on port 80.

Long-running service that serves the Remix app. Always on — handles every merchant request, webhook, and OAuth flow. Pulls image from ECR on deploy.

On-demand task, not a service. Spun up per crawl job via ECS.RunTask() — runs the Python pipeline, writes the briefing, then exits. Cold start ~30s.

One-shot migration task. Runs db/schema.sql on deploy when schema changes are needed, then exits. Quiet the rest of the time.

The only persistent store. Holds all 5 app tables plus pg-boss job queue. Private subnet — no public access. Both ECS tasks connect via DATABASE_URL from Secrets Manager.

Docker image registry. GitHub Actions builds and pushes both images on every main branch deploy. ECS pulls the latest image tag when launching tasks.

Static site hosting for shelfplugin.com. Separate from the app — different repo, different deploy role. CloudFront sits in front for HTTPS + caching.

Runtime secret injection. ECS tasks declare secrets in their task definition — the execution role fetches them at container start and injects as env vars. Nothing hardcoded in images.

Four roles, each scoped to minimum permissions. Execution role fetches secrets + pulls ECR. Task role can trigger crawl ECS tasks. Deploy role can push images and update services.

Four SGs forming a layered perimeter. Internet hits ALB only. ALB → Remix only. Remix + Crawl → RDS only. Crawl has no inbound — outbound-only for web crawling.

Three log groups — one per ECS task. The Remix log is your production debugging surface: auth flows, webhook handler output, loader errors. Crawl log shows pipeline progress and Layer 4 output.

Captures every Claude API call from the crawl pipeline: full prompt + response, token counts, latency, merchant ID, model version. The dataset for evaluating prompt quality over time.

Push to main triggers the deploy workflow. Builds both Docker images, pushes to ECR, then updates the ECS service to pull the new image. Zero-downtime rolling deploy via ECS service update.

Route 53 hosts the shelfplugin.com zone. ACM wildcard cert covers both root and all subdomains. ALB does TLS termination — containers only see plain HTTP on port 3000.