paygate-mcp 3.6.0 → 3.8.0

package/dist/server.d.ts

@@ -159,6 +159,10 @@ export declare class PayGateServer {
     private handleGetDeadLetters;
     private handleClearDeadLetters;
     private handleWebhookStats;
+    private handleListWebhookFilters;
+    private handleCreateWebhookFilter;
+    private handleUpdateWebhookFilter;
+    private handleDeleteWebhookFilter;
     private handleAudit;
     private handleAuditExport;
     private handleAuditStats;
@@ -189,6 +193,10 @@ export declare class PayGateServer {
      * (setAcl, setExpiry, setQuota, setTags, setIpAllowlist, setSpendingLimit).
      * Fire-and-forget: errors logged, never thrown.
      */
+    /**
+     * Route admin webhook events through the WebhookRouter (for filter rules) or direct emitter.
+     */
+    private emitWebhookAdmin;
     private syncKeyMutation;
     private readBody;
     stop(): Promise<void>;

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,EAAE,aAAa,EAAkB,mBAAmB,EAAkB,MAAM,SAAS,CAAC;AAS7F,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC9B,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAE7C,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,EAAE,cAAc,EAAqD,MAAM,WAAW,CAAC;AAC9F,OAAO,EAAE,WAAW,EAAmB,MAAM,SAAS,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAS,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAEtC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,eAAe,EAA6B,MAAM,cAAc,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,aAAa,EAAqB,MAAM,UAAU,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAK3C,yCAAyC;AACzC,KAAK,YAAY,GAAG,QAAQ,GAAG,YAAY,CAAC;AAa5C,qBAAa,aAAa;IACxB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAAC;IACpC,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAC1C,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;IACvC,oEAAoE;IACpE,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,OAAO,CAAC,aAAa,CAAqC;IAC1D,wDAAwD;IACxD,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,CAAQ;IAC5C,oDAAoD;IACpD,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,2BAA2B;IAC3B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,0CAA0C;IAC1C,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,8CAA8C;IAC9C,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACnC,mCAAmC;IACnC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,4CAA4C;IAC5C,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,gCAAgC;IAChC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,yEAAyE;IACzE,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI,CAAQ;IAC5C,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,qDAAqD;IACrD,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,yCAAyC;IACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsB;IAChD,gEAAgE;IAChE,OAAO,CAAC,QAAQ,CAAS;IACzB,wCAAwC;IACxC,OAAO,CAAC,QAAQ,CAAK;IAErB,0DAA0D;IAC1D,OAAO,KAAK,OAAO,GAElB;gBAGC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,EAC1D,QAAQ,CAAC,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,mBAAmB,CAAC,EAAE,MAAM,EAC5B,OAAO,CAAC,EAAE,mBAAmB,EAAE,EAC/B,QAAQ,CAAC,EAAE,MAAM;IAsJnB;;;;;;;;;;;OAWG;IACH,GAAG,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI;IAK1B,KAAK,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;YAmC5C,aAAa;YAsKb,SAAS;IAqNvB;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IA+C1B;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAyB9B;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAyCrB;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IAuC7B,OAAO,CAAC,UAAU;IAsElB,OAAO,CAAC,YAAY;IAepB,OAAO,CAAC,YAAY;YAyCN,eAAe;IAsF7B,OAAO,CAAC,cAAc;YAaR,WAAW;YA6DX,eAAe;YAkDf,eAAe;YA0Df,YAAY;YAkDZ,eAAe;YAwDf,cAAc;YA+Dd,aAAa;YAsDb,oBAAoB;YAsDpB,qBAAqB;YAgCrB,kBAAkB;IAoFhC,OAAO,CAAC,aAAa;YAuDP,YAAY;IAkD1B,OAAO,CAAC,WAAW;YA+CL,mBAAmB;IAmCjC,OAAO,CAAC,eAAe;IAYvB,+EAA+E;IAC/E,OAAO,CAAC,mBAAmB;IAU3B,oEAAoE;YACtD,mBAAmB;IA4DjC,yDAAyD;YAC3C,oBAAoB;IAuFlC,yCAAyC;YAC3B,gBAAgB;IA8E9B,uDAAuD;YACzC,iBAAiB;IAiC/B,sEAAsE;IACtE,OAAO,CAAC,kBAAkB;IAqB1B,OAAO,CAAC,qBAAqB;IAO7B,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,eAAe;IA0BvB,OAAO,CAAC,eAAe;YAYT,qBAAqB;IAmDnC,OAAO,CAAC,oBAAoB;IAiB5B,OAAO,CAAC,sBAAsB;IAwB9B,OAAO,CAAC,kBAAkB;IA4B1B,OAAO,CAAC,WAAW;IA0BnB,OAAO,CAAC,iBAAiB;IAgCzB,OAAO,CAAC,gBAAgB;IAcxB,OAAO,CAAC,UAAU;IAiClB,OAAO,CAAC,eAAe;YAiBT,gBAAgB;YA4ChB,gBAAgB;YA6ChB,gBAAgB;YAsChB,mBAAmB;YAsDnB,mBAAmB;IA8CjC,OAAO,CAAC,eAAe;IA8BvB,OAAO,CAAC,oBAAoB;YAgBd,iBAAiB;YAyDjB,iBAAiB;IAiE/B,OAAO,CAAC,uBAAuB;IAyB/B,OAAO,CAAC,iBAAiB;IAezB,OAAO,CAAC,gBAAgB;YAOV,iBAAiB;YA0CjB,iBAAiB;YAsDjB,iBAAiB;YAwCjB,sBAAsB;YAqDtB,wBAAwB;IAgDtC,OAAO,CAAC,mBAAmB;YAsBb,oBAAoB;YAwDpB,oBAAoB;IAsDlC;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAUvB,OAAO,CAAC,QAAQ;IAkBV,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAqB3B;;;;;;;OAOG;IACG,YAAY,CAAC,SAAS,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;CA4CtD"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,EAAE,aAAa,EAAkB,mBAAmB,EAAkB,MAAM,SAAS,CAAC;AAS7F,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC9B,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAE7C,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,EAAE,cAAc,EAAqD,MAAM,WAAW,CAAC;AAC9F,OAAO,EAAE,WAAW,EAAmB,MAAM,SAAS,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAS,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAEtC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,eAAe,EAA6B,MAAM,cAAc,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,aAAa,EAAqB,MAAM,UAAU,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAM3C,yCAAyC;AACzC,KAAK,YAAY,GAAG,QAAQ,GAAG,YAAY,CAAC;AAa5C,qBAAa,aAAa;IACxB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAAC;IACpC,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAC1C,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;IACvC,oEAAoE;IACpE,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,OAAO,CAAC,aAAa,CAAqC;IAC1D,wDAAwD;IACxD,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,CAAQ;IAC5C,oDAAoD;IACpD,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,2BAA2B;IAC3B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,0CAA0C;IAC1C,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,8CAA8C;IAC9C,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACnC,mCAAmC;IACnC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,4CAA4C;IAC5C,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,gCAAgC;IAChC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,yEAAyE;IACzE,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI,CAAQ;IAC5C,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,qDAAqD;IACrD,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,yCAAyC;IACzC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsB;IAChD,gEAAgE;IAChE,OAAO,CAAC,QAAQ,CAAS;IACzB,wCAAwC;IACxC,OAAO,CAAC,QAAQ,CAAK;IAErB,0DAA0D;IAC1D,OAAO,KAAK,OAAO,GAElB;gBAGC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,EAC1D,QAAQ,CAAC,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,mBAAmB,CAAC,EAAE,MAAM,EAC5B,OAAO,CAAC,EAAE,mBAAmB,EAAE,EAC/B,QAAQ,CAAC,EAAE,MAAM;IAuJnB;;;;;;;;;;;OAWG;IACH,GAAG,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI;IAK1B,KAAK,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;YAmC5C,aAAa;YA8Kb,SAAS;IAqNvB;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IA+C1B;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAyB9B;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAyCrB;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IAuC7B,OAAO,CAAC,UAAU;IAyElB,OAAO,CAAC,YAAY;IAepB,OAAO,CAAC,YAAY;YAyCN,eAAe;IAsF7B,OAAO,CAAC,cAAc;YAaR,WAAW;YA6DX,eAAe;YAkDf,eAAe;YA0Df,YAAY;YAkDZ,eAAe;YAwDf,cAAc;YA+Dd,aAAa;YAsDb,oBAAoB;YAsDpB,qBAAqB;YAgCrB,kBAAkB;IAoFhC,OAAO,CAAC,aAAa;YAuDP,YAAY;IAkD1B,OAAO,CAAC,WAAW;YA+CL,mBAAmB;IAmCjC,OAAO,CAAC,eAAe;IAYvB,+EAA+E;IAC/E,OAAO,CAAC,mBAAmB;IAU3B,oEAAoE;YACtD,mBAAmB;IA4DjC,yDAAyD;YAC3C,oBAAoB;IAuFlC,yCAAyC;YAC3B,gBAAgB;IA8E9B,uDAAuD;YACzC,iBAAiB;IAiC/B,sEAAsE;IACtE,OAAO,CAAC,kBAAkB;IAqB1B,OAAO,CAAC,qBAAqB;IAO7B,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,eAAe;IA0BvB,OAAO,CAAC,eAAe;YAYT,qBAAqB;IAmDnC,OAAO,CAAC,oBAAoB;IAiB5B,OAAO,CAAC,sBAAsB;IAwB9B,OAAO,CAAC,kBAAkB;IA8B1B,OAAO,CAAC,wBAAwB;YAclB,yBAAyB;YAsCzB,yBAAyB;YAiDzB,yBAAyB;IA4CvC,OAAO,CAAC,WAAW;IA0BnB,OAAO,CAAC,iBAAiB;IAgCzB,OAAO,CAAC,gBAAgB;IAcxB,OAAO,CAAC,UAAU;IAiClB,OAAO,CAAC,eAAe;YAiBT,gBAAgB;YA4ChB,gBAAgB;YA6ChB,gBAAgB;YAsChB,mBAAmB;YAsDnB,mBAAmB;IA8CjC,OAAO,CAAC,eAAe;IA8BvB,OAAO,CAAC,oBAAoB;YAgBd,iBAAiB;YAyDjB,iBAAiB;IAiE/B,OAAO,CAAC,uBAAuB;IAyB/B,OAAO,CAAC,iBAAiB;IAezB,OAAO,CAAC,gBAAgB;YAOV,iBAAiB;YA2CjB,iBAAiB;YAuDjB,iBAAiB;YAyCjB,sBAAsB;YAsDtB,wBAAwB;IAiDtC,OAAO,CAAC,mBAAmB;YAsBb,oBAAoB;YAwDpB,oBAAoB;IAsDlC;;;;OAIG;IACH;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,eAAe;IAUvB,OAAO,CAAC,QAAQ;IAkBV,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAqB3B;;;;;;;OAOG;IACG,YAAY,CAAC,SAAS,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;CA4CtD"}

package/dist/server.js

@@ -183,7 +183,7 @@ class PayGateServer {
             this.audit.log('key.auto_topped_up', 'system', `Auto-topup: added ${amount} credits`, {
                 keyMasked, creditsAdded: amount, newBalance,
             });
-            this.gate.webhook?.emitAdmin('key.auto_topped_up', 'system', {
+            this.emitWebhookAdmin('key.auto_topped_up', 'system', {
                 keyMasked, creditsAdded: amount, newBalance,
             });
             // Sync to Redis (if configured)
@@ -194,7 +194,8 @@ class PayGateServer {
         // Plugin manager for extensible middleware hooks
         this.plugins = new plugin_1.PluginManager();
         this.gate.pluginManager = this.plugins;
-        this.groups = new groups_1.KeyGroupManager();
+        const groupsStatePath = statePath ? statePath.replace(/\.json$/, '-groups.json') : undefined;
+        this.groups = new groups_1.KeyGroupManager(groupsStatePath);
         this.gate.groupManager = this.groups;
         this.metrics.registerGauge('paygate_plugins_total', 'Number of registered plugins', () => {
             return this.plugins.count;
@@ -372,6 +373,16 @@ class PayGateServer {
                 break;
             case '/webhooks/stats':
                 return this.handleWebhookStats(req, res);
+            case '/webhooks/filters':
+                if (req.method === 'GET')
+                    return this.handleListWebhookFilters(req, res);
+                if (req.method === 'POST')
+                    return this.handleCreateWebhookFilter(req, res);
+                break;
+            case '/webhooks/filters/update':
+                return this.handleUpdateWebhookFilter(req, res);
+            case '/webhooks/filters/delete':
+                return this.handleDeleteWebhookFilter(req, res);
             // ─── Team management endpoints ────────────────────────────────────
             case '/teams':
                 if (req.method === 'GET')
@@ -610,7 +621,7 @@ class PayGateServer {
                 const fired = this.alerts.check(apiKey, keyRecord, { rateLimitDenied: isRateLimited });
                 // Send alert events via webhook
                 for (const alert of fired) {
-                    this.gate.webhook?.emitAdmin('alert.fired', 'system', {
+                    this.emitWebhookAdmin('alert.fired', 'system', {
                         alertType: alert.type,
                         keyPrefix: alert.keyPrefix,
                         keyName: alert.keyName,
@@ -824,6 +835,9 @@ class PayGateServer {
                 alerts: 'GET /alerts — Get pending alerts + POST /alerts — Configure alert rules (requires X-Admin-Key)',
                 webhookDeadLetters: 'GET /webhooks/dead-letter — View failed webhook deliveries + DELETE to clear (requires X-Admin-Key)',
                 webhookStats: 'GET /webhooks/stats — Webhook delivery statistics (requires X-Admin-Key)',
+                webhookFilters: 'GET|POST /webhooks/filters — List or create webhook filter rules (requires X-Admin-Key)',
+                updateWebhookFilter: 'POST /webhooks/filters/update — Update a webhook filter rule (requires X-Admin-Key)',
+                deleteWebhookFilter: 'POST /webhooks/filters/delete — Delete a webhook filter rule (requires X-Admin-Key)',
                 teams: 'GET /teams — List teams + POST /teams — Create team (requires X-Admin-Key)',
                 teamsUpdate: 'POST /teams/update — Update team (requires X-Admin-Key)',
                 teamsDelete: 'POST /teams/delete — Delete team (requires X-Admin-Key)',
@@ -963,7 +977,7 @@ class PayGateServer {
             deniedTools: record.deniedTools,
             expiresAt: record.expiresAt,
         });
-        this.gate.webhook?.emitAdmin('key.created', 'admin', {
+        this.emitWebhookAdmin('key.created', 'admin', {
             keyMasked: (0, audit_1.maskKeyForAudit)(record.key), name, credits,
         });
         res.writeHead(201, { 'Content-Type': 'application/json' });
@@ -1039,7 +1053,7 @@ class PayGateServer {
             creditsAdded: credits,
             newBalance: record?.credits,
         });
-        this.gate.webhook?.emitAdmin('key.topup', 'admin', {
+        this.emitWebhookAdmin('key.topup', 'admin', {
             keyMasked: (0, audit_1.maskKeyForAudit)(params.key), creditsAdded: credits, newBalance: record?.credits,
         });
         res.writeHead(200, { 'Content-Type': 'application/json' });
@@ -1085,7 +1099,7 @@ class PayGateServer {
         this.audit.log('key.revoked', 'admin', `Key revoked`, {
             keyMasked: (0, audit_1.maskKeyForAudit)(params.key),
         });
-        this.gate.webhook?.emitAdmin('key.revoked', 'admin', {
+        this.emitWebhookAdmin('key.revoked', 'admin', {
             keyMasked: (0, audit_1.maskKeyForAudit)(params.key),
         });
         res.writeHead(200, { 'Content-Type': 'application/json' });
@@ -1131,7 +1145,7 @@ class PayGateServer {
             oldKeyMasked: (0, audit_1.maskKeyForAudit)(params.key),
             newKeyMasked: (0, audit_1.maskKeyForAudit)(rotated.key),
         });
-        this.gate.webhook?.emitAdmin('key.rotated', 'admin', {
+        this.emitWebhookAdmin('key.rotated', 'admin', {
             oldKeyMasked: (0, audit_1.maskKeyForAudit)(params.key),
             newKeyMasked: (0, audit_1.maskKeyForAudit)(rotated.key),
         });
@@ -1478,7 +1492,7 @@ class PayGateServer {
             keyMasked: (0, audit_1.maskKeyForAudit)(params.key),
             threshold, amount, maxDaily,
         });
-        this.gate.webhook?.emitAdmin('key.auto_topup_configured', 'admin', {
+        this.emitWebhookAdmin('key.auto_topup_configured', 'admin', {
             keyMasked: (0, audit_1.maskKeyForAudit)(params.key), threshold, amount, maxDaily,
         });
         res.writeHead(200, { 'Content-Type': 'application/json' });
@@ -2083,13 +2097,151 @@ class PayGateServer {
             return;
         }
         const stats = this.gate.webhook.getRetryStats();
+        const routerStats = this.gate.webhookRouter ? this.gate.webhookRouter.getAggregateStats() : null;
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({
             configured: true,
             maxRetries: this.gate.webhook.maxRetries,
             ...stats,
+            ...(routerStats ? { filters: routerStats } : {}),
         }));
     }
+    // ─── /webhooks/filters — Webhook filter CRUD ─────────────────────────────
+    handleListWebhookFilters(req, res) {
+        if (!this.checkAdmin(req, res))
+            return;
+        if (!this.gate.webhookRouter) {
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ count: 0, filters: [], message: 'No webhook router configured' }));
+            return;
+        }
+        const filters = this.gate.webhookRouter.listRules();
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ count: filters.length, filters }));
+    }
+    async handleCreateWebhookFilter(req, res) {
+        if (!this.checkAdmin(req, res, 'admin'))
+            return;
+        if (!this.gate.webhookRouter) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'No webhook configured. Set webhookUrl or webhookFilters to enable webhook routing.' }));
+            return;
+        }
+        const body = await this.readBody(req);
+        let params;
+        try {
+            params = JSON.parse(body);
+        }
+        catch {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Invalid JSON' }));
+            return;
+        }
+        try {
+            const rule = this.gate.webhookRouter.addRule({
+                id: '', // auto-generated
+                name: String(params.name || ''),
+                events: Array.isArray(params.events) ? params.events.map(String) : [],
+                url: String(params.url || ''),
+                secret: params.secret ? String(params.secret) : undefined,
+                keyPrefixes: Array.isArray(params.keyPrefixes) ? params.keyPrefixes.map(String) : undefined,
+                active: params.active !== false,
+            });
+            this.audit.log('webhook_filter.created', 'admin', `Webhook filter created: ${rule.name}`, { filterId: rule.id, name: rule.name });
+            res.writeHead(201, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify(rule));
+        }
+        catch (err) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: err.message }));
+        }
+    }
+    async handleUpdateWebhookFilter(req, res) {
+        if (req.method !== 'POST') {
+            res.writeHead(405, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Method not allowed. Use POST.' }));
+            return;
+        }
+        if (!this.checkAdmin(req, res, 'admin'))
+            return;
+        if (!this.gate.webhookRouter) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'No webhook router configured' }));
+            return;
+        }
+        const body = await this.readBody(req);
+        let params;
+        try {
+            params = JSON.parse(body);
+        }
+        catch {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Invalid JSON' }));
+            return;
+        }
+        const filterId = String(params.id || '');
+        if (!filterId) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Missing id field' }));
+            return;
+        }
+        try {
+            const rule = this.gate.webhookRouter.updateRule(filterId, {
+                name: params.name !== undefined ? String(params.name) : undefined,
+                events: Array.isArray(params.events) ? params.events.map(String) : undefined,
+                url: params.url !== undefined ? String(params.url) : undefined,
+                secret: params.secret !== undefined ? String(params.secret) : undefined,
+                keyPrefixes: Array.isArray(params.keyPrefixes) ? params.keyPrefixes.map(String) : undefined,
+                active: params.active !== undefined ? Boolean(params.active) : undefined,
+            });
+            this.audit.log('webhook_filter.updated', 'admin', `Webhook filter updated: ${rule.name}`, { filterId: rule.id });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify(rule));
+        }
+        catch (err) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: err.message }));
+        }
+    }
+    async handleDeleteWebhookFilter(req, res) {
+        if (req.method !== 'POST') {
+            res.writeHead(405, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Method not allowed. Use POST.' }));
+            return;
+        }
+        if (!this.checkAdmin(req, res, 'admin'))
+            return;
+        if (!this.gate.webhookRouter) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'No webhook router configured' }));
+            return;
+        }
+        const body = await this.readBody(req);
+        let params;
+        try {
+            params = JSON.parse(body);
+        }
+        catch {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Invalid JSON' }));
+            return;
+        }
+        const filterId = String(params.id || '');
+        if (!filterId) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Missing id field' }));
+            return;
+        }
+        const deleted = this.gate.webhookRouter.deleteRule(filterId);
+        if (!deleted) {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Filter not found' }));
+            return;
+        }
+        this.audit.log('webhook_filter.deleted', 'admin', `Webhook filter deleted: ${filterId}`, { filterId });
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ ok: true, message: `Filter ${filterId} deleted` }));
+    }
     // ─── /audit — Query audit log ─────────────────────────────────────────────
     handleAudit(req, res) {
         if (req.method !== 'GET') {
@@ -2621,6 +2773,7 @@ class PayGateServer {
                 tags: params.tags,
             });
             this.audit.log('group.created', 'admin', `Group created: ${group.name}`, { groupId: group.id, name: group.name });
+            this.groups.saveToFile();
             if (this.redisSync)
                 this.redisSync.saveGroup(group).catch(() => { });
             res.writeHead(201, { 'Content-Type': 'application/json' });
@@ -2675,6 +2828,7 @@ class PayGateServer {
                 tags: params.tags,
             });
             this.audit.log('group.updated', 'admin', `Group updated: ${group.name}`, { groupId: group.id });
+            this.groups.saveToFile();
             if (this.redisSync)
                 this.redisSync.saveGroup(group).catch(() => { });
             res.writeHead(200, { 'Content-Type': 'application/json' });
@@ -2716,6 +2870,7 @@ class PayGateServer {
             return;
         }
         this.audit.log('group.deleted', 'admin', `Group deleted: ${groupId}`, { groupId });
+        this.groups.saveToFile();
         if (this.redisSync) {
             this.redisSync.deleteGroup(groupId).catch(() => { });
             this.redisSync.saveGroupAssignments().catch(() => { });
@@ -2762,6 +2917,7 @@ class PayGateServer {
             this.audit.log('group.key_assigned', 'admin', `Key assigned to group ${groupId}`, {
                 keyMasked: (0, audit_1.maskKeyForAudit)(apiKey), groupId,
             });
+            this.groups.saveToFile();
             if (this.redisSync) {
                 this.redisSync.saveGroupAssignments().catch(() => { });
                 this.syncKeyMutation(apiKey);
@@ -2810,6 +2966,7 @@ class PayGateServer {
             delete keyRecord.group;
         }
         this.audit.log('group.key_removed', 'admin', `Key removed from group`, { keyMasked: (0, audit_1.maskKeyForAudit)(apiKey) });
+        this.groups.saveToFile();
         if (this.redisSync) {
             this.redisSync.saveGroupAssignments().catch(() => { });
             this.syncKeyMutation(apiKey);
@@ -2875,7 +3032,7 @@ class PayGateServer {
             newKeyMasked: record.key.slice(0, 7) + '...' + record.key.slice(-4),
             role,
         });
-        this.gate.webhook?.emitAdmin('admin_key.created', callerMasked, {
+        this.emitWebhookAdmin('admin_key.created', callerMasked, {
             newKeyMasked: record.key.slice(0, 7) + '...' + record.key.slice(-4),
             name: params.name,
             role,
@@ -2929,7 +3086,7 @@ class PayGateServer {
         this.audit.log('admin_key.revoked', callerMasked, `Revoked admin key ${targetMasked}`, {
             revokedKeyMasked: targetMasked,
         });
-        this.gate.webhook?.emitAdmin('admin_key.revoked', callerMasked, {
+        this.emitWebhookAdmin('admin_key.revoked', callerMasked, {
             revokedKeyMasked: targetMasked,
         });
         res.writeHead(200, { 'Content-Type': 'application/json' });
@@ -2940,6 +3097,17 @@ class PayGateServer {
      * (setAcl, setExpiry, setQuota, setTags, setIpAllowlist, setSpendingLimit).
      * Fire-and-forget: errors logged, never thrown.
      */
+    /**
+     * Route admin webhook events through the WebhookRouter (for filter rules) or direct emitter.
+     */
+    emitWebhookAdmin(type, actor, metadata = {}) {
+        if (this.gate.webhookRouter) {
+            this.gate.webhookRouter.emitAdmin(type, actor, metadata);
+        }
+        else if (this.gate.webhook) {
+            this.gate.webhook.emitAdmin(type, actor, metadata);
+        }
+    }
     syncKeyMutation(apiKey) {
         if (!this.redisSync)
             return;