# Changelog

All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [1.0.0] — 2026-05-02

### Added

- **Recurring mutations** — `wfp_suspend_recurring`, `wfp_resume_recurring`, `wfp_delete_recurring` now wrap regularApi `SUSPEND` / `RESUME` / `REMOVE` using the correct `merchantPassword` auth model instead of main-API HMAC signing.
- **6 prompts** — `financial-report`, `daily-monitoring`, `reconciliation`, `subscription-overview`, `find-transaction`, `revenue-comparison`, adapted to the published `wfp_*` tool names and multi-merchant setups.
- **Instrument analytics** — `wfp_list_active_instruments` and `wfp_instrument_transactions` add prefix-based analytics for `WFP-SOC-*` and `WFP-BTN-*` flows with TOON-safe structured output.

### Changed

- **`wfp_get_transaction_list` / `wfp_check_status` now surface richer v2 fields in lean mode** — `products`, `clientName`, `clientEmail`, `clientPhone`, `clientComment`, `prroLink`, `prroNumber`, plus settlement/base-currency metadata where useful.
- **`wfp_get_regular_status` lean projection fixed** — recurring responses now keep `status` and `nextPaymentDate` instead of being projected through payment-status fields that did not match regularApi responses.
- **Tool registry now covers 21 tools with writes enabled, 15 in read-only mode, plus 6 prompts.**

## [0.2.0] — 2026-04-29

Major UX upgrade. Same WayForPay coverage, but read tools now emit TOON
output, projections cut response size, and discovery + health tools let
foreign coding agents introspect the server without trial-and-error.

### Added

- **`wfp_summarize_transactions`** — aggregates TRANSACTION_LIST into a single small response: total count, total amounts by currency, status breakdown, payment-system breakdown, per-day counts. Never returns rows, so the response stays ~1–2KB regardless of merchant volume. Use this FIRST for any "how many / what's the revenue" question — it removes the context-window risk that the raw list has on busy merchants.
- **`wfp_search_transactions`** — filter the TRANSACTION_LIST window by status / amount range / payment system / orderReference substring / email substring / cardPan substring, then paginate. REQUIRES at least one filter parameter; refuses an unfiltered call to prevent accidental row dumps.
- **Guardrails on `wfp_get_transaction_list`** — default page size lowered to 20 (down from 50). Refuses `verbose: true` when `limit > 20` with a message pointing to summarize/search. Adds a `hint` field on responses when `total > 100` and `verbose` is off, nudging the model toward the safer alternatives.
- **TOON output by default** for the `text` channel of every read tool
  (~40% fewer tokens than JSON). `structuredContent` stays JSON-friendly so
  programmatic downstream consumers are unaffected.
- **`format: "toon" | "json"`** parameter on every tool — escape hatch back
  to JSON.
- **`verbose: true`** parameter on `wfp_get_merchant_info`, `wfp_get_balance`,
  `wfp_get_transaction_list`, `wfp_check_status`, `wfp_get_regular_status` —
  returns all fields instead of the lean projection.
- **Pagination** on `wfp_get_transaction_list` via `limit` / `offset`. WFP
  returns the full window in one response; this slices it client-side so
  the LLM doesn't drown in 200+ rows. Default page size 50, max 500.
- **Lean projections** drop ~20 noisy WFP metadata fields per row by default.
  Defined per-endpoint in `src/projections.ts`.
- **`confirm: z.literal(true)`** required on `wfp_create_invoice`,
  `wfp_refund_payment`, `wfp_settle_payment`. Refuses without explicit
  acknowledgement, mirroring the pattern that prevented several DNS-side
  accidents in `ukraine-com-ua-mcp`.
- **`wfp_health`** zero-arg tool. Times a `getMerchantInfo` round-trip and
  returns `{ok, signature_valid, latency_ms, version, merchant_alias,
  merchant_account}`. Use before starting a multi-step revenue report or
  payment workflow.
- **`wfp_capabilities`** discovery tool. Introspects the registered tool set
  and returns each tool with metadata flags (`destructive`, `has_pagination`,
  `has_format`, `has_verbose`, `input_keys`). Foreign coding agents (Cursor /
  Cline / Continue) should call this first.
- **Typed errors**: `WfpError` and `WfpAuthError` distinguish auth failures
  from generic API failures. The MCP server's `fail()` helper surfaces
  `{transactionType, status, apiError, kind}` instead of an opaque string.
- **Unit tests** — 37 across 5 files. Cover signature determinism, date
  validation, 31-day window, request bodies, signature verification round
  trip, server tool registry, capabilities output, dry-run safety.
- **Standalone dependencies** — `package.json` now declares its own
  `@modelcontextprotocol/sdk`, `zod`, `@toon-format/toon`. Drops the
  `vendor.ts` shim that pointed at the playwright workspace.
- **`docs/api-endpoints.md`** — WayForPay endpoint reference (transactionType
  catalog, regularApi requestType list, mms PHP endpoints, status legend).

### Changed

- `src/index.ts` exports `buildServer(config)` (test-friendly factory).
- All read tools route through `safeHandle()` with structured `fail()` on
  errors instead of throwing raw strings.
- Lint config (Biome 1.9.4) now enforces shared style with `ukraine-com-ua-mcp`.

### Removed

- `src/vendor.ts` (replaced by direct package imports).

## [0.1.0] — 2026-04-13

Initial WayForPay MCP. 12 tools (9 read + 3 write), multi-merchant config
via `WFP_MERCHANTS_JSON`, HMAC-MD5 signing helpers, webhook acknowledgement
builder.