Ask it to do something, and it asks you to confirm first
The assistant can look things up right away. But when it's about to change something real — like creating a product — it always drafts the change and asks you to confirm before saving anything.
Merchant impact: A merchant can ask the assistant to draft a new product conversationally and still gets the same review step they'd get editing it by hand — the AI never silently writes to the live catalog.
Developer impact: Every tool is one of three kinds: read (runs immediately), confirm (drafts a change, requires explicit approval), or requires-client (needs the browser to do something, like open a picker). `loop.ts`, `executor.ts`, and `registry.ts` are cleanly separated, so adding a new capability is a new tool file plus one registry line.
Example: `product.create.v1` drafts a new product from the conversation and shows a summary card — name, price, category, vendor, image count, status — that only creates the real product on confirm.
A product the assistant creates is a real product, made the normal way
When the assistant creates or edits a product, it goes through the exact same process as editing it by hand in the dashboard — it's not a separate, lookalike shortcut that could behave differently.
Merchant impact: A product the assistant creates behaves identically to one created by hand in the dashboard, because it's the same underlying process, not a lookalike.
Developer impact: Every product tool runs through the same code the actual Products UI uses (`createStoreProduct`/`updateStoreProduct`, `payloadFromForm`) — one code path to maintain and test, not two that could silently diverge.
Example: `product.update.v1` diffs against a product's real current values before drafting a change, so the confirmation card only shows what's actually changing — not a full re-description of the entire product.
It never makes up a product image
When a product needs an image, the assistant opens your real media library — the same picker you'd use in the product editor — so you always choose a real image, instead of the AI guessing or inventing one.
Merchant impact: Product images stay real and correct — no risk of a broken or fabricated image URL landing on a live listing.
Developer impact: Media selection is a `requires-client` tool by design, not a read or confirm tool, since only the browser can actually open that picker.
Example: A merchant says "use our logo for this product," and the assistant opens the real picker instead of guessing a URL from context.
A real starting store, built from a short conversation
A quick chat about your store name, what you sell, and the look you're going for turns into a genuine creative brief, which then gets built into an actual starter store — not a generic template with your name swapped in.
Merchant impact: A new store gets a real, personalized starting point — not a generic template — and the result lands as a draft theme to review and publish, never live unreviewed.
Developer impact: A Planner call synthesizes onboarding answers into a detailed Design Brief (genuine creative reasoning, on Pro while budget remains, Flash once exhausted). A separate Builder call, always on Flash, executes that already-finalized brief into real theme sections — splitting creative judgment from mechanical code generation, and keeping the most token-heavy call off the expensive model on every run.
Example: A user can close the tab once generation starts and gets emailed when the store is ready; if they stay, they watch it finish live via server-sent events.
A real usage budget, not an open tab
AI usage is tracked against a real monthly allowance tied to your plan, refreshing every month — so it's a predictable part of what you're paying for, not a cost that can spiral unexpectedly.
Merchant impact: AI access is a real, gated part of a plan tier, not an unmetered cost center that could spiral unexpectedly.
Developer impact: `StoreAiUsage` tracks one document per user, per calendar month, lazily rolled to a fresh period on read — decoupled from the user's own billing cycle, since a yearly-paid plan still gets a monthly AI allowance. Nothing about usage is shown to the end user today; the Pro→Flash fallback is completely silent.
Example: A dev-only model override lets an internal reviewer force both Planner and Builder stages to the same model for a side-by-side quality comparison — the server independently re-checks it's actually a dev environment before ever honoring it, so a forged override in production is silently ignored.