Confirmations and safe writes

A destructive annotation is a warning to the client; it is not the authorization boundary. Eekaam separately enforces OAuth scopes, tenant isolation and confirmation tokens.

Preview then confirm

Consequential tools have a matching preview_* tool. The preview validates the planned operation without applying it and returns a human-readable summary or diff plus a confirmation token.

1. Call the preview with the exact intended arguments.
2. Show its summary to the merchant.
3. Wait for explicit approval.
4. Call the write tool with the same arguments and confirmation_token.

Tokens expire after five minutes, are single-use, and are bound to the store, installation, action and normalized arguments. Changing the target or payload requires a new preview. A consumed token cannot be replayed.

Theme writes

Read a theme file first and pass its sha256 as if_match. This prevents overwriting an edit made after the read. Writes to an unpublished theme return a preview URL and are not visible to shoppers. Writes to the live theme create a backup and require confirmation.

Always report the returned live value. Do not tell a merchant a draft-theme change is live.

Open-world operations

Media upload operations can contact caller-supplied URLs or return an object-storage upload destination. They are marked with the MCP open-world hint. Clients should surface the destination and avoid sending secrets in files or URLs.