### Added
- **Virtual Delivery System:** When purchasing items that exceed inventory capacity, overflow items are automatically sent to a pending delivery queue instead of being lost.
- SQLite-based delivery storage (`deliveries.db`) with transaction safety to prevent race conditions and duplication exploits.
- FIFO (First-In-First-Out) claiming with per-material tracking.
- Automatic database-first claiming approach prevents item duplication on logout/crash.
- Configurable settings: `delivery.enabled`, `delivery.auto-claim-on-login`, `delivery.max-pending-per-player`.

- **Market GUI Integration:** Access deliveries directly from the market interface.
- Ender Chest button in slot 51 displays pending item count badge.
- Full deliveries panel with material breakdown and claim buttons.
- Left-click to claim all of a material, right-click to claim one stack.
- "Claim All" button (slot 49) for bulk claiming with progress feedback.

- **Delivery Commands:** Console and command-block support for delivery system.
- `/market delivery list` - View pending deliveries with formatted output.
- `/market delivery claim <material> [amount]` - Claim specific items.
- `/market delivery claim-all` - Claim all pending deliveries.
- `/market delivery gui` - Open market GUI directly to deliveries panel.

- **Web API Endpoints:** Full delivery system integration for web dashboard.
- `GET /api/deliveries` - List pending deliveries (returns `{enabled, deliveries, total}`).
- `POST /api/deliveries/claim` - Claim deliveries (body: `{material?, amount?}` for specific or all).
- Updated `/docs` endpoint with delivery API documentation.

- **Enhanced Configuration Documentation:** Comprehensive inline comments in `config.yml` explaining delivery system settings with pros/cons and recommendations (200+ lines of documentation).

### Fixed
- **Critical:** Fixed buy loop bug where purchasing 64 items would only deliver 1 on 1.20.1 servers. Buy logic now properly calculates overflow and sends all excess items to delivery in a single operation.

### Security
- **Race Condition Protection:** Atomic transactions in `addPending()` with `conn.autoCommit=false` prevent concurrent purchases from exceeding `max-pending-per-player` limit.
- **Duplication Prevention:** Database-first approach in `claimMaterial()` removes items from database before giving to player, preventing logout duplication exploits.
- **Transaction Safety:** All delivery database operations wrapped in explicit try-catch with rollback to prevent data corruption on errors.

### Technical
- `DeliveryManager` class (426 lines) handles all delivery operations with SQLite backend.
- Per-player delivery limits with atomic transaction checks.
- Inventory capacity calculation accounts for partial stacks and empty slots.
- Delivery system fully integrated into existing buy/sell flow in `MarketCommand` and `WebServer`.

### Upgrade Notes
- **Database:** New `deliveries.db` created automatically on first launch with delivery system enabled.
- **Config:** Three new keys added with defaults (see `config.yml` for full documentation):
- `delivery.enabled: true` - Enable/disable delivery system.
- `delivery.auto-claim-on-login: false` - Automatically attempt to claim deliveries on player join.
- `delivery.max-pending-per-player: 100000` - Maximum items that can be pending per player.
- **No Breaking Changes:** Existing functionality unchanged. Delivery system activates only when inventory is full during purchase.
- **Migration:** Update from 1.3.1 is seamless. No data migration required.

### Acknowledgments
- Continued thanks to ChunkCraft server for detailed bug reporting and testing feedback throughout v1.4.0 development!

## [1.3.0] - 2025-09-26
### Security / Hardening
- Removed all reflective private field access (`getDeclaredField` / `setAccessible`). Added explicit getters and helper methods.
- Migrated web session auth to `Authorization: Bearer <session>` header after initial load; SPA auto-migrates and strips `?session=` from URL history.
- Added hashed API token support via `web.api.token-hashes` (SHA-256 lowercase hex). Legacy plain `web.api.tokens` still accepted but deprecated (one-time warning when both present).
- Updated `SECURITY.md` to reflect mitigations.

### Developer / Internal
- Added utility methods in `WebServer` for token validation and constant-time hash comparison.

### Upgrade Notes
1. After updating, players' existing web links still work. On first load the UI migrates the token to a header and removes it from the address bar.
2. For API integrations using read-only tokens, you may begin migrating to hashed tokens:
- Generate hash: `echo -n "YourTokenValue" | sha256sum` (Linux/macOS) or use PowerShell `"YourTokenValue" | Out-File -NoNewline t.txt; certutil -hashfile t.txt SHA256 | Select-String -NotMatch "hash"; Remove-Item t.txt`.
- Place resulting 64-char hex in `web.api.token-hashes` list.
- Remove the clear token from `web.api.tokens` after deployment to drop the deprecation warning.
3. No config keys were removed; all changes are backward compatible.

## [1.2.0] - 2025-09-25
### Added
- Custom Web UI override (`web.custom.*`): external `index.html` & static assets, auto-export starter file, optional reload bypass.
- Admin commands: `/endex webui export`, `/endex webui reload` for managing exported UI.
- Unified web market view with advanced filters (category, price bounds, trend, sort fields & direction) and collapsible persistent filter panel.
- Category auto-population & improved watchlist/group toggles.

### Changed
- Removed legacy Addons tab and `/api/addons` usage; addons now integrate as items or custom routes.
- Simplified live update flow (single item stream via WS/SSE/polling).
- Refactored layout (two-row search + filters) for clarity and responsiveness.
- Copy tasks marked untracked to prevent Gradle state errors with transient DB journal files.

### Fixed
- UI tab reversion issue resolved by removing tab abstraction.
- Async misuse (`await` in sync render) eliminated; stabilized frontend rendering.
- Ensured Vault economy deductions occur on main thread; corrected SELL handling logic.

### Removed
- Addons navigation UI and related frontend logic.

### Documentation
- Added `docs/CUSTOM_WEBUI.md` and updated config with `web.custom.*` keys.

### Compatibility
- Built against Paper API 1.20.1; expected to operate on 1.21.x.

### Upgrade Notes
- If you relied on Addons tab navigation, migrate to item-based representation or custom web routes.
- Enable `web.custom.enabled` to customize UI; restart to export default scaffold.

## [1.1.0] - 2025-08-29
### Added
- Web UI item icons served from resource packs with `/icon/{material}` endpoint (public, ETag caching)
- Resource pack extraction/usage via `web.icons.*` with support for both `item/items` and `block/blocks` folders
- Aliases for tricky materials (e.g., PUMPKIN, CACTUS) to reduce 404s across pack variations
- Addons tab in the UI and `/api/addons` endpoint (auth required)
- Developer HTTP API documentation (`docs/API.md`) and reverse proxy guide (`docs/REVERSE_PROXY.md`)

### Changed
- Improved client error fallback for missing icons (initials badge)
- More informative server logs (actual paths tried for missing icons when `logging.verbose=true`)

### Fixed
- Kotlin string interpolation in logs and headers (no longer prints `$vars` literally)
- Javalin route syntax for path params (now uses `/icon/{material}`)

### Compatibility
- Built against Paper API 1.20.1; expected to work on newer Paper versions

### Highlights
- HTTP API reference: see `docs/API.md`
- Reverse proxy examples (HTTPS): `docs/REVERSE_PROXY.md`
- Config keys for icons and addons: `docs/CONFIG.md`