@payware/mcp-server 1.3.2 → 1.3.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payware/mcp-server",
-  "version": "1.3.2",
+  "version": "1.3.3",
   "mcpName": "io.github.payware/mcp-server",
   "description": "Official MCP server for payware payment API integration",
   "main": "src/index.js",

package/src/isv/oauth2/get-token-info.js

@@ -76,18 +76,20 @@ Auth: Requires ISV JWT token`,
           text: `📋 **OAuth2 Token Information**
 
 🔑 **Token Details:**
-- **Access Token**: ${result.access_token}
-- **Token Type**: ${result.token_type}
+- **Access Token**: ${result.accessToken}
+- **Token Type**: ${result.tokenType}
 - **Status**: ${statusEmoji[result.status]} ${result.status}
 - **Description**: ${statusDescription[result.status]}
 - **Scope**: ${result.scope}
-- **Expires**: ${result.expires_in || 'Never (client_credentials tokens do not expire)'}
+- **Expires**: ${result.expiresIn == null ? 'No expiration date' : result.expiresIn === 0 ? 'Expired - rotate with POST /oauth2/tokens/{token}/rotate' : `${result.expiresIn} seconds (~${Math.floor(result.expiresIn / 86400)} days)`}
 
-${result.status === 'GRANTED' ?
+${result.status === 'GRANTED' && result.expiresIn === 0 ?
+  '⌛ **Token has expired - rotate it with POST /oauth2/tokens/{token}/rotate (no merchant consent needed)**' :
+  result.status === 'GRANTED' ?
   '✅ **Token is ready for use in API requests**' :
   result.status === 'PENDING' ?
     '⏳ **Token is pending - wait for merchant approval**' :
-    '❌ **Token is revoked - obtain a new token**'
+    '❌ **Token is revoked, and revocation is final.** Requesting a token again returns this same revoked token; the merchant must consent again through an AUTHORIZATION_ONLY invitation (payware_isv_create_invitation)'
 }
 
 📋 **Usage Notes:**

package/src/isv/oauth2/obtain-token.js

@@ -12,7 +12,10 @@ export const obtainTokenTool = {
 ISVs must be authorized by payware registered merchants to make requests on their behalf.
 This endpoint allows ISVs to request a token using the merchant's credentials.
 
-IMPORTANT: Access tokens do not expire and only one token is allowed per merchant.
+IMPORTANT: A token requested this way expires 180 days after the merchant grants authorization.
+expiresIn in the response gives the seconds remaining (null = no expiration date). Rotate it with
+POST /oauth2/tokens/{token}/rotate, before or after expiry - no merchant consent is needed.
+Requesting again for the same merchant returns the existing token rather than a second one.
 Store tokens securely using strong encryption.
 
 Endpoint: POST /oauth2/tokens
@@ -99,7 +102,7 @@ Auth: Requires ISV JWT token with aud: "https://payware.eu"`,
 - **Token Type**: ${result.tokenType}
 - **Status**: ${result.status}
 - **Scope**: ${result.scope}
-- **Expires**: ${result.expiresIn || 'Never (client_credentials tokens do not expire)'}
+- **Expires**: ${result.expiresIn == null ? 'No expiration date' : result.expiresIn === 0 ? 'Expired - rotate with POST /oauth2/tokens/{token}/rotate' : `${result.expiresIn} seconds (~${Math.floor(result.expiresIn / 86400)} days)`}
 
 📋 **Copy this token for next operations:**
 \`${result.accessToken}\`
@@ -110,7 +113,7 @@ Auth: Requires ISV JWT token with aud: "https://payware.eu"`,
 - Use this token in the "sub" claim of future JWT requests
 
 📋 **Next Steps:**
-1. Check token status: Use token \`${result.accessToken}\` with payware_oauth2_get_token_info
+1. Check token status: Use token \`${result.accessToken}\` with payware_authorization_oauth2_get_token_info
 2. Wait for merchant approval (status will change from PENDING to GRANTED)
 3. Use this token in JWT "sub" claim for API requests to merchant data
 4. Set JWT "aud" claim to the merchant's partnerId (${finalClientId}) for API calls`
@@ -191,7 +194,6 @@ ${JSON.stringify(errorDetails, null, 2)}
 - Verify merchant partnerId (clientId) is correct
 - Ensure merchant secret is properly base64 encoded
 - Check if merchant account is active
-- Confirm no existing token for this merchant
 - Verify ISV JWT token is properly signed for OAuth2 requests`
         }]
       };

package/src/isv/oauth2/token-helper.js

@@ -54,24 +54,30 @@ Use this when you need a token but aren't sure if one exists or what it is.`,
           text: `📋 **OAuth2 Token Management Help**
 
 🔑 **About OAuth2 Tokens:**
-- Only ONE token allowed per merchant
-- Tokens don't expire (client_credentials flow)
-- Token status: PENDING → GRANTED (after merchant approval)
+- Requesting a token again for the same merchant returns the existing one, not a second one
+- Tokens requested this way expire 180 days after the merchant grants authorization
+- Rotate with POST /oauth2/tokens/{token}/rotate - works on expired tokens too, no merchant consent needed
+- Token status: PENDING → GRANTED (after merchant approval); REVOKED is final
 
 🎯 **To get your token:**
 
-**Option 1: Try creating a token**
-Use: \`payware_oauth2_obtain_token\`
-- If successful: New token will be clearly displayed
+**Option 1: Request a token**
+Use: \`payware_authorization_oauth2_obtain_token\`
+- Returns a new PENDING token, or the existing token if this merchant already has one
 - On failure the server names the reason (e.g. client not found, client disabled)
 
 **Option 2: Check a known token**
-Use: \`payware_oauth2_get_token_info\` with your saved token
-- Shows current status (PENDING/GRANTED/REVOKED)
+Use: \`payware_authorization_oauth2_get_token_info\` with your saved token
+- Shows current status (PENDING/GRANTED/REVOKED) and expiry
 
-**Option 3: Create new token (if current is lost)**
-1. Contact merchant to revoke existing token
-2. Then use \`payware_oauth2_obtain_token\` to create new one
+**Option 3: If you lost the token**
+Nothing needs revoking - the token can be retrieved:
+- Request it again with Option 1, which returns the existing token, or
+- Call GET /oauth2/tokens, which lists every token issued to your ISV with its value and status
+
+⚠️ **Never ask the merchant to revoke a token to get a new one.** Revocation is final: requesting
+again afterwards returns the same REVOKED token, and the only way back is a fresh consent through an
+AUTHORIZATION_ONLY invitation (\`payware_isv_create_invitation\`). To replace a token value, rotate it.
 
 🔐 **Security:**
 - Always store tokens securely
@@ -94,25 +100,19 @@ Use: \`payware_oauth2_get_token_info\` with your saved token
           type: 'text',
           text: `⚠️ **Token Already Exists for This Merchant**
 
-🔍 **Your existing token is stored somewhere secure** (as per OAuth2 best practices, the server doesn't return existing tokens).
+🔍 **A token already exists for this merchant, and it can be retrieved.**
 
 📋 **To find your token:**
 
-**Option 1: Check your secure storage**
-- Look where you saved tokens before
-- Environment variables file
-- Secure configuration management
-- Password manager
+**Option 1: List your tokens**
+Call GET /oauth2/tokens - it lists every token issued to your ISV with its value and status.
 
 **Option 2: If you have the token value**
-Use: \`payware_oauth2_get_token_info\` with your token to check its status
-
-**Option 3: Create new token**
-1. Contact the merchant (Partner ID: ${process.env.PAYWARE_OAUTH_CLIENT_ID || 'not configured'})
-2. Ask them to revoke the existing token
-3. Then use \`payware_oauth2_obtain_token\` to create a new one
+Use: \`payware_authorization_oauth2_get_token_info\` with your token to check its status
 
-💡 **Tip:** Always keep a secure backup of your OAuth2 tokens!
+**Option 3: Need a different value?**
+Rotate it with POST /oauth2/tokens/{token}/rotate. Do not ask the merchant to revoke it - revocation
+is final, and requesting again afterwards returns the same REVOKED token.
 
 📋 **For immediate help:**
 Run this tool with action='help' for more detailed guidance.`
@@ -138,8 +138,8 @@ ${token}
 \`\`\`
 
 🔄 **Next Steps:**
-1. **SAVE THIS TOKEN** securely (you won't be able to retrieve it later)
-2. Check status: \`payware_oauth2_get_token_info\` with token: \`${token}\`
+1. **SAVE THIS TOKEN** securely (if you lose it, GET /oauth2/tokens lists it again)
+2. Check status: \`payware_authorization_oauth2_get_token_info\` with token: \`${token}\`
 3. Wait for merchant approval (status will change to GRANTED)
 4. Use token in API requests once GRANTED`
         }]

package/src/isv/poi/cancel-price.js

@@ -61,9 +61,14 @@ export const cancelPOIPriceTool = {
 
 **ISV Authentication:** Uses ISV JWT with merchant partner ID and OAuth2 token.
 **Endpoint:** DELETE /poi/{poiId}/price
-**Use Case:** Cancel a price that was set but customer didn't pay (e.g., order cancelled).
+**Use Case:** Cancel a price that was set but not yet scanned (e.g., order cancelled).
 
-The POI will return to IDLE state and be ready for a new price.
+The POI returns to IDLE and is ready for a new price.
+
+**Only before the scan.** The scan is the customer's bank processing the payment, so from then on a POI
+sale cannot be cancelled by the merchant or an ISV, on any plan: this answers 409
+ERR_POI_NO_PENDING_PAYMENT, and cancelling the transaction itself answers 409 ERR_ALREADY_PROCESSED. The
+sale completes or expires; the POI accepts the next price meanwhile.
 
 **Required:** POI ID, Merchant Partner ID, and OAuth2 token.`,
 

package/src/isv/poi/get-poi.js

@@ -115,8 +115,7 @@ export const getPOITool = {
       const statusEmoji = {
         'IDLE': '🟢',
         'READY': '🟡',
-        'BUSY': '🔴',
-        'DISABLED': '⚫'
+        'BUSY': '🔴'
       }[poi.status] || '⚪';
 
       return {
@@ -137,7 +136,7 @@ export const getPOITool = {
 - Linked vPOS: ${poi.linkedVposCount || 0} terminals
 
 **Current Session:**
-${poi.status !== 'IDLE' && poi.pendingAmount ? `- Amount: ${poi.pendingAmount} ${poi.pendingCurrency}
+${poi.status === 'READY' && poi.pendingAmount ? `- Amount: ${poi.pendingAmount} ${poi.pendingCurrency}
 - Expires: ${poi.sessionExpiresAt || 'N/A'}
 - Token: ${poi.sessionToken || 'N/A'}` : '- No active session'}
 

package/src/isv/poi/get-status.js

@@ -1,168 +1,194 @@
-import axios from 'axios';
-import { createJWTForPartner } from '../../core/auth/jwt-factory.js';
-import { getSandboxUrl, getProductionUrl, getPartnerIdSafe, getPrivateKeySafe } from '../../config/env.js';
-import { apiErrorResult } from '../../shared/api-errors.js';
-
-/**
- * Get POI status via ISV authentication
- * @param {Object} params - Parameters for status request
- * @returns {Object} POI status response
- */
-export async function getPOIStatus({ poiId, merchantPartnerId, oauth2Token, useSandbox = true }) {
-  if (!poiId) {
-    throw new Error('POI ID is required');
-  }
-
-  if (!merchantPartnerId) {
-    throw new Error('Merchant Partner ID is required for ISV operations');
-  }
-
-  if (!oauth2Token) {
-    throw new Error('OAuth2 token is required for ISV operations');
-  }
-
-  const isvPartnerId = getPartnerIdSafe();
-  const privateKey = getPrivateKeySafe(useSandbox);
-
-  const jwtData = await createJWTForPartner({
-    partnerId: isvPartnerId,
-    privateKey,
-    requestBody: null,
-    merchantId: merchantPartnerId,
-    oauth2Token
-  });
-
-  const headers = {
-    'Authorization': `Bearer ${jwtData.token}`,
-    'Content-Type': 'application/json',
-    'Api-Version': '1'
-  };
-
-  try {
-    const baseUrl = useSandbox ? getSandboxUrl() : getProductionUrl();
-    const response = await axios.get(`${baseUrl}/poi/${poiId}/status`, { headers });
-
-    return {
-      success: true,
-      status: response.data,
-      requestId: response.headers['x-request-id'],
-      timestamp: new Date().toISOString()
-    };
-  } catch (error) {
-    return apiErrorResult(error);
-  }
-}
-
-/**
- * Get POI status tool implementation for ISV
- */
-export const getPOIStatusTool = {
-  name: "payware_poi_get_status",
-  description: `Get current status of a POI including any pending payment.
-
-**ISV Authentication:** Uses ISV JWT with merchant partner ID and OAuth2 token.
-**Endpoint:** GET /poi/{poiId}/status
-**Use Case:** Check if a POI is idle, has a pending price, or is busy with a payment.
-
-**POI States:**
-- IDLE: Ready for new payment
-- READY: Price set, waiting for customer scan
-- BUSY: Payment in progress
-- DISABLED: Not accepting payments
-
-**Required:** POI ID, Merchant Partner ID, and OAuth2 token.`,
-
-  inputSchema: {
-    type: "object",
-    required: ["poiId", "merchantPartnerId", "oauth2Token"],
-    properties: {
-      poiId: {
-        type: "string",
-        description: "The POI identifier (format: pi + 8 alphanumeric chars, e.g., piABC12345)"
-      },
-      merchantPartnerId: {
-        type: "string",
-        description: "Partner ID of the target merchant (8 alphanumeric characters)"
-      },
-      oauth2Token: {
-        type: "string",
-        description: "OAuth2 access token obtained from the merchant"
-      },
-      useSandbox: {
-        type: "boolean",
-        description: "Use sandbox environment for testing",
-        default: true
-      }
-    }
-  },
-
-  async handler(args) {
-    const { poiId, merchantPartnerId, oauth2Token, useSandbox = true } = args;
-
-    if (!poiId) {
-      throw new Error("POI ID is required");
-    }
-
-    if (!merchantPartnerId) {
-      throw new Error("Merchant Partner ID is required");
-    }
-
-    if (!oauth2Token) {
-      throw new Error("OAuth2 token is required");
-    }
-
-    const result = await getPOIStatus({ poiId, merchantPartnerId, oauth2Token, useSandbox });
-
-    if (result.success) {
-      const status = result.status;
-      const statusEmoji = {
-        'IDLE': '🟢',
-        'READY': '🟡',
-        'BUSY': '🔴',
-        'DISABLED': '⚫'
-      }[status.status] || '⚪';
-
-      let pendingInfo = '';
-      if (status.status === 'READY' || status.status === 'BUSY') {
-        pendingInfo = `
-**Pending Payment:**
-- Amount: ${status.pendingAmount} ${status.pendingCurrency}
-- Expires: ${status.sessionExpiresAt || 'N/A'}${status.transactionId ? `\n- Transaction: ${status.transactionId}` : ''}`;
-      }
-
-      return {
-        content: [{
-          type: "text",
-          text: `${statusEmoji} **POI Status: ${status.status}**
-
-**POI ID:** ${status.poiId}
-**ISV -> Merchant:** ${getPartnerIdSafe()} -> ${merchantPartnerId}
-${pendingInfo}
-
-**Status Meaning:**
-${status.status === 'IDLE' ? '✅ POI is ready to accept a new price' : ''}${status.status === 'READY' ? '⏳ Price set, waiting for customer to scan' : ''}${status.status === 'BUSY' ? '🔄 Customer scanned, payment in progress' : ''}${status.status === 'DISABLED' ? '🚫 POI is disabled and cannot accept payments' : ''}
-
-**Request ID:** ${result.requestId || 'N/A'}
-**Timestamp:** ${result.timestamp}`
-        }]
-      };
-    } else {
-      return {
-        content: [{
-          type: "text",
-          text: `❌ **Failed to Get POI Status**
-
-**POI ID:** ${poiId}
-**Error:** ${result.error.message}
-**Status:** ${result.error.status || 'N/A'}
-
-**Common Issues:**
-- INVALID_POI_ID (400): POI ID format invalid (must be pi + 8 alphanumeric chars)
-- POI_NOT_FOUND (404): POI doesn't exist
-
-**Timestamp:** ${result.timestamp}`
-        }]
-      };
-    }
-  }
-};
+import axios from 'axios';
+import { createJWTForPartner } from '../../core/auth/jwt-factory.js';
+import { getSandboxUrl, getProductionUrl, getPartnerIdSafe, getPrivateKeySafe } from '../../config/env.js';
+import { apiErrorResult } from '../../shared/api-errors.js';
+
+/**
+ * Get POI status via ISV authentication
+ * @param {Object} params - Parameters for status request
+ * @returns {Object} POI status response
+ */
+export async function getPOIStatus({ poiId, sessionToken, merchantPartnerId, oauth2Token, useSandbox = true }) {
+  if (!poiId) {
+    throw new Error('POI ID is required');
+  }
+
+  if (!merchantPartnerId) {
+    throw new Error('Merchant Partner ID is required for ISV operations');
+  }
+
+  if (!oauth2Token) {
+    throw new Error('OAuth2 token is required for ISV operations');
+  }
+
+  const isvPartnerId = getPartnerIdSafe();
+  const privateKey = getPrivateKeySafe(useSandbox);
+
+  const jwtData = await createJWTForPartner({
+    partnerId: isvPartnerId,
+    privateKey,
+    requestBody: null,
+    merchantId: merchantPartnerId,
+    oauth2Token
+  });
+
+  const headers = {
+    'Authorization': `Bearer ${jwtData.token}`,
+    'Content-Type': 'application/json',
+    'Api-Version': '1'
+  };
+
+  try {
+    const baseUrl = useSandbox ? getSandboxUrl() : getProductionUrl();
+    // The session token pins one sale: with it the response also carries that session's
+    // transactionId and transactionStatus. A GET is signed without a body, so the query string is free.
+    const query = sessionToken ? `?sessionToken=${encodeURIComponent(sessionToken)}` : '';
+    const response = await axios.get(`${baseUrl}/poi/${poiId}/status${query}`, { headers });
+
+    return {
+      success: true,
+      status: response.data,
+      requestId: response.headers['x-request-id'],
+      timestamp: new Date().toISOString()
+    };
+  } catch (error) {
+    return apiErrorResult(error);
+  }
+}
+
+/**
+ * Get POI status tool implementation for ISV
+ */
+export const getPOIStatusTool = {
+  name: "payware_poi_get_status",
+  description: `Get the current status of a POI and the outcome of its sales.
+
+**ISV Authentication:** Uses ISV JWT with merchant partner ID and OAuth2 token.
+**Endpoint:** GET /poi/{poiId}/status[?sessionToken=...]
+**Use Case:** Follow a sale to its outcome - the backup to callbacks, and on Basic (no transaction
+endpoints) the only way when a callback is lost or there is no backend.
+
+**POI States:**
+- IDLE: no pending price and no sale running
+- READY: price set, waiting for a scan (wins over BUSY: the POI can take the next price while a sale runs)
+- BUSY: a customer scanned and the sale is running
+
+**Every response** carries lastTransactionId / lastTransactionStatus - the POI's most recent sale, running
+(ACTIVE) or finished (CONFIRMED, DECLINED, FAILED, CANCELLED, EXPIRED). Once the POI is back to IDLE,
+lastTransactionStatus is how the last sale ended.
+
+**With sessionToken** (from payware_poi_set_price) the response also carries transactionId /
+transactionStatus for exactly that sale - use it when the POI may be re-armed before the previous sale
+finishes. Poll every 2-3 seconds and stop at a final status; the read is rate limited.
+
+**Required:** POI ID, Merchant Partner ID, and OAuth2 token.`,
+
+  inputSchema: {
+    type: "object",
+    required: ["poiId", "merchantPartnerId", "oauth2Token"],
+    properties: {
+      poiId: {
+        type: "string",
+        description: "The POI identifier (format: pi + 8 alphanumeric chars, e.g., piABC12345)"
+      },
+      sessionToken: {
+        type: "string",
+        description: "Optional. The sessionToken returned by payware_poi_set_price; returns that sale's transaction and status"
+      },
+      merchantPartnerId: {
+        type: "string",
+        description: "Partner ID of the target merchant (8 alphanumeric characters)"
+      },
+      oauth2Token: {
+        type: "string",
+        description: "OAuth2 access token obtained from the merchant"
+      },
+      useSandbox: {
+        type: "boolean",
+        description: "Use sandbox environment for testing",
+        default: true
+      }
+    }
+  },
+
+  async handler(args) {
+    const { poiId, sessionToken, merchantPartnerId, oauth2Token, useSandbox = true } = args;
+
+    if (!poiId) {
+      throw new Error("POI ID is required");
+    }
+
+    if (!merchantPartnerId) {
+      throw new Error("Merchant Partner ID is required");
+    }
+
+    if (!oauth2Token) {
+      throw new Error("OAuth2 token is required");
+    }
+
+    const result = await getPOIStatus({ poiId, sessionToken, merchantPartnerId, oauth2Token, useSandbox });
+
+    if (result.success) {
+      const status = result.status;
+      const statusEmoji = {
+        'IDLE': '🟢',
+        'READY': '🟡',
+        'BUSY': '🔴'
+      }[status.status] || '⚪';
+      const meaning = {
+        'IDLE': status.lastTransactionId
+          ? `No sale running. The last sale ended ${status.lastTransactionStatus}.`
+          : 'No sale running, and the POI has not had a sale yet.',
+        'READY': 'Price set, waiting for a customer to scan.',
+        'BUSY': 'A customer scanned and the sale is running.'
+      }[status.status] || '';
+
+      const pendingInfo = status.status === 'READY' ? `
+**Pending Price:**
+- Amount: ${status.pendingAmount} ${status.pendingCurrency}
+- Session expires: ${status.sessionExpiresAt || 'N/A'}` : '';
+
+      const lastSale = status.lastTransactionId ? `
+**Last Sale:** ${status.lastTransactionId} - ${status.lastTransactionStatus}` : '';
+
+      const pinnedSale = sessionToken ? `
+**Sale for this session token:** ${status.transactionId
+          ? `${status.transactionId} - ${status.transactionStatus}`
+          : 'not scanned yet (or the token does not belong to this POI)'}` : '';
+
+      return {
+        content: [{
+          type: "text",
+          text: `${statusEmoji} **POI Status: ${status.status}**
+
+**POI ID:** ${status.poiId}
+**ISV -> Merchant:** ${getPartnerIdSafe()} -> ${merchantPartnerId}
+${pendingInfo}${lastSale}${pinnedSale}
+
+**Meaning:** ${meaning}
+
+**Request ID:** ${result.requestId || 'N/A'}
+**Timestamp:** ${result.timestamp}`
+        }]
+      };
+    } else {
+      return {
+        content: [{
+          type: "text",
+          text: `❌ **Failed to Get POI Status**
+
+**POI ID:** ${poiId}
+**Error:** ${result.error.message}
+**Status:** ${result.error.status || 'N/A'}
+
+**Common Issues:**
+- ERR_INVALID_POI_ID (400): POI ID format invalid (must be pi + 8 alphanumeric chars)
+- ERR_POI_NOT_FOUND (404): POI doesn't exist, or is disabled
+- ERR_SHOP_NOT_IN_SCOPE (403): the POI's shop is not assigned to you
+
+**Timestamp:** ${result.timestamp}`
+        }]
+      };
+    }
+  }
+};

package/src/isv/poi/list-pois.js

@@ -64,7 +64,7 @@ export const listPOIsTool = {
 **Endpoint:** GET /poi
 **Use Case:** Retrieve all physical payment points configured for a merchant.
 
-POI states: IDLE (ready), READY (price set), BUSY (payment in progress), DISABLED.
+POI states: IDLE (no price, no sale running), READY (price set, waiting for a scan), BUSY (scanned, sale running). A disabled POI is not a state: it shows isActive false.
 
 **Required:** Merchant Partner ID and OAuth2 token for ISV authentication.`,
 
@@ -106,13 +106,12 @@ POI states: IDLE (ready), READY (price set), BUSY (payment in progress), DISABLE
         const statusEmoji = {
           'IDLE': '🟢',
           'READY': '🟡',
-          'BUSY': '🔴',
-          'DISABLED': '⚫'
+          'BUSY': '🔴'
         }[poi.status] || '⚪';
 
         return `${statusEmoji} **${poi.name}** (${poi.poiId})
    Shop: ${poi.shopName || poi.shopCode}
-   Status: ${poi.status}${poi.pendingAmount && poi.pendingAmount !== '0.00' ? ` | Pending: ${poi.pendingAmount} ${poi.pendingCurrency}` : ''}`;
+   Status: ${poi.status}${poi.isActive === false ? ' (disabled)' : ''}${poi.pendingAmount && poi.pendingAmount !== '0.00' ? ` | Pending: ${poi.pendingAmount} ${poi.pendingCurrency}` : ''}`;
       }).join('\n\n');
 
       return {
@@ -127,8 +126,7 @@ ${poisList || 'No POIs found for this merchant.'}
 **Status Legend:**
 🟢 IDLE - Ready for new payment
 🟡 READY - Price set, waiting for customer
-🔴 BUSY - Payment in progress
-⚫ DISABLED - Not accepting payments
+🔴 BUSY - Scanned, sale running (payware_poi_get_status shows its outcome)
 
 **Request ID:** ${result.requestId || 'N/A'}
 **Timestamp:** ${result.timestamp}`