Confirmations and handoffs

Three things behave the same way on every Marka tool: destructive actions confirm once, anything that needs your own browser comes back as a link, and every refusal says what to do next.

Confirm once

publish_listing, pause_listing, remove_listing, cancel_order, delete_account, manage_subscription (cancel or refund) and the other destructive tools do nothing the first time. They answer CONFIRMATION_REQUIRED with a confirmToken and a sentence saying what will happen:

{
  "code": "CONFIRMATION_REQUIRED",
  "message": "This will make the listing visible to buyers.",
  "confirmToken": "mct_..."
}

Tell the user what will happen, then call the same tool again with the same arguments plus the token. A token works once, for ten minutes, for exactly those arguments, and only for the same user and client. Change an argument and you need a new token.

One-click links: /go/<id>

Paying, connecting eBay, Shopify, Stripe or Easyship, and signing in again all happen in the user's own browser. The tool returns a link ending in /go/<id> instead of a raw provider address:

• The link works once and expires after 15 minutes.
• It only works for the account that asked for it. Opened while signed in to another account, it refuses and says why; opened signed out, it asks to sign in first and then continues.
• A reconsent link takes the user to the consent screen to grant the tier a tool needed.

Hand the link to the user and wait. Do not open it yourself.

Denials

Every refusal has the same shape: code, message, and, when another tool fixes the problem, next.

Operators

After restoring a database from backup, follow the checklist in docs/restore-runbook.md in the Marka repository. Tool calls are audited with a hash of the arguments, never the arguments, and pruned after 90 days.