paygate-mcp 4.9.0 → 5.1.0

package/dist/server.js

@@ -83,6 +83,7 @@ const tokens_1 = require("./tokens");
 const admin_keys_1 = require("./admin-keys");
 const plugin_1 = require("./plugin");
 const groups_1 = require("./groups");
+const expiry_scanner_1 = require("./expiry-scanner");
 /** Max request body size: 1MB */
 const MAX_BODY_SIZE = 1_048_576;
 class PayGateServer {
@@ -121,6 +122,8 @@ class PayGateServer {
     /** Plugin manager for extensible middleware hooks */
     plugins;
     groups;
+    /** Background key expiry scanner */
+    expiryScanner;
     /** Server start time (ms since epoch) */
     startedAt = Date.now();
     /** Whether the server is draining (shutting down gracefully) */
@@ -239,6 +242,24 @@ class PayGateServer {
         this.metrics.registerGauge('paygate_groups_total', 'Number of active key groups', () => {
             return this.groups.count;
         });
+        // Key expiry scanner — proactive background scanning for expiring keys
+        const scannerConfig = this.config.expiryScanner;
+        this.expiryScanner = new expiry_scanner_1.ExpiryScanner(scannerConfig ? {
+            enabled: scannerConfig.enabled !== false,
+            intervalSeconds: scannerConfig.intervalSeconds || 3600,
+            thresholds: scannerConfig.thresholds || [604800, 86400, 3600],
+        } : undefined);
+        // Wire scanner callbacks: audit + webhook
+        this.expiryScanner.onWarning = (warning) => {
+            const keyMasked = (0, audit_1.maskKeyForAudit)(warning.key);
+            this.audit.log('key.expiry_warning', 'system', `Key "${warning.name}" expires in ${warning.remainingHuman} (threshold: ${warning.thresholdSeconds}s)`, { keyMasked, expiresAt: warning.expiresAt, remainingSeconds: warning.remainingSeconds, thresholdSeconds: warning.thresholdSeconds, alias: warning.alias || null });
+            this.emitWebhookAdmin('key.expiry_warning', 'system', {
+                keyMasked, keyName: warning.name, alias: warning.alias || null,
+                namespace: warning.namespace, expiresAt: warning.expiresAt,
+                remainingSeconds: warning.remainingSeconds, remainingHuman: warning.remainingHuman,
+                thresholdSeconds: warning.thresholdSeconds,
+            });
+        };
         // Scoped token manager (uses bootstrap admin key as signing secret, padded to min length)
         const tokenSecret = this.bootstrapAdminKey.length >= 8
             ? this.bootstrapAdminKey
@@ -298,6 +319,8 @@ class PayGateServer {
             console.log('[paygate] Redis distributed state enabled');
         }
         await this.handler.start();
+        // Start the key expiry scanner (proactive background scanning)
+        this.expiryScanner.start(() => this.gate.store.getAllRecords());
         // Plugin lifecycle: onStart
         if (this.plugins.count > 0) {
             await this.plugins.executeStart();
@@ -364,6 +387,8 @@ class PayGateServer {
                 return this.handleResumeKey(req, res);
             case '/keys/clone':
                 return this.handleCloneKey(req, res);
+            case '/keys/alias':
+                return this.handleSetAlias(req, res);
             case '/keys/rotate':
                 return this.handleRotateKey(req, res);
             case '/keys/acl':
@@ -382,6 +407,8 @@ class PayGateServer {
                 return this.handleSetAutoTopup(req, res);
             case '/keys/usage':
                 return this.handleKeyUsage(req, res);
+            case '/keys/expiring':
+                return this.handleKeysExpiring(req, res);
             case '/topup':
                 return this.handleTopUp(req, res);
             case '/keys/transfer':
@@ -889,6 +916,7 @@ class PayGateServer {
                 suspendKey: 'POST /keys/suspend — Temporarily suspend a key (requires X-Admin-Key)',
                 resumeKey: 'POST /keys/resume — Resume a suspended key (requires X-Admin-Key)',
                 cloneKey: 'POST /keys/clone — Clone a key with same config (requires X-Admin-Key)',
+                keyAlias: 'POST /keys/alias — Set or clear a human-readable alias for a key (requires X-Admin-Key)',
                 rotateKey: 'POST /keys/rotate — Rotate a key (requires X-Admin-Key)',
                 setAcl: 'POST /keys/acl — Set tool ACL (requires X-Admin-Key)',
                 setExpiry: 'POST /keys/expiry — Set key expiry (requires X-Admin-Key)',
@@ -905,6 +933,7 @@ class PayGateServer {
                 searchKeys: 'POST /keys/search — Search keys by tags (requires X-Admin-Key)',
                 autoTopup: 'POST /keys/auto-topup — Configure auto-topup for a key (requires X-Admin-Key)',
                 keyUsage: 'GET /keys/usage?key=... — Per-key usage breakdown (requires X-Admin-Key)',
+                keysExpiring: 'GET /keys/expiring?within=86400 — List keys expiring within N seconds (requires X-Admin-Key)',
                 pricing: 'GET /pricing — Tool pricing breakdown (public)',
                 mcpPayment: 'GET /.well-known/mcp-payment — Payment metadata (SEP-2007)',
                 audit: 'GET /audit — Query audit log (requires X-Admin-Key)',
@@ -1120,20 +1149,23 @@ class PayGateServer {
             res.end(JSON.stringify({ error: 'Credits must be a positive integer' }));
             return;
         }
+        // Resolve alias to actual key
+        const resolved = this.gate.store.resolveKey(params.key);
+        const actualKey = resolved ? resolved.key : params.key;
         // Use Redis atomic topup when available, fall back to local store
         let success;
         if (this.redisSync) {
-            success = await this.redisSync.atomicTopup(params.key, credits);
+            success = await this.redisSync.atomicTopup(actualKey, credits);
         }
         else {
-            success = this.gate.store.addCredits(params.key, credits);
+            success = this.gate.store.addCredits(actualKey, credits);
         }
         if (!success) {
             res.writeHead(404, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: 'Key not found or inactive' }));
             return;
         }
-        const record = this.gate.store.getKey(params.key);
+        const record = this.gate.store.getKey(actualKey);
         this.audit.log('key.topup', 'admin', `Added ${credits} credits`, {
             keyMasked: (0, audit_1.maskKeyForAudit)(params.key),
             creditsAdded: credits,
@@ -1181,7 +1213,7 @@ class PayGateServer {
             return;
         }
         // Validate source key exists and has enough credits
-        const sourceRecord = this.gate.store.getKey(params.from);
+        const sourceRecord = this.gate.store.resolveKey(params.from);
         if (!sourceRecord) {
             res.writeHead(404, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: 'Source key not found' }));
@@ -1195,7 +1227,7 @@ class PayGateServer {
             return;
         }
         // Validate destination key exists (getKey returns null for revoked/expired keys)
-        const destRecord = this.gate.store.getKey(params.to);
+        const destRecord = this.gate.store.resolveKey(params.to);
         if (!destRecord) {
             res.writeHead(404, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: 'Destination key not found' }));
@@ -1204,13 +1236,13 @@ class PayGateServer {
         // Perform transfer atomically (deduct from source, add to destination)
         if (this.redisSync) {
             // Redis atomic transfer: deduct first, then add
-            const deducted = await this.redisSync.atomicDeduct(params.from, credits);
+            const deducted = await this.redisSync.atomicDeduct(sourceRecord.key, credits);
             if (!deducted) {
                 res.writeHead(400, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({ error: 'Redis deduction failed (insufficient credits or key not found)' }));
                 return;
             }
-            await this.redisSync.atomicTopup(params.to, credits);
+            await this.redisSync.atomicTopup(destRecord.key, credits);
         }
         else {
             // Local store: deduct and add
@@ -1218,20 +1250,20 @@ class PayGateServer {
             destRecord.credits += credits;
             this.gate.store.save();
         }
-        const fromBalance = this.gate.store.getKey(params.from)?.credits ?? 0;
-        const toBalance = this.gate.store.getKey(params.to)?.credits ?? 0;
+        const fromBalance = sourceRecord.credits;
+        const toBalance = destRecord.credits;
         const memo = params.memo || '';
         this.audit.log('key.credits_transferred', 'admin', `Transferred ${credits} credits`, {
-            fromKeyMasked: (0, audit_1.maskKeyForAudit)(params.from),
-            toKeyMasked: (0, audit_1.maskKeyForAudit)(params.to),
+            fromKeyMasked: (0, audit_1.maskKeyForAudit)(sourceRecord.key),
+            toKeyMasked: (0, audit_1.maskKeyForAudit)(destRecord.key),
             credits,
             fromBalance,
             toBalance,
             memo,
         });
         this.emitWebhookAdmin('key.credits_transferred', 'admin', {
-            fromKeyMasked: (0, audit_1.maskKeyForAudit)(params.from),
-            toKeyMasked: (0, audit_1.maskKeyForAudit)(params.to),
+            fromKeyMasked: (0, audit_1.maskKeyForAudit)(sourceRecord.key),
+            toKeyMasked: (0, audit_1.maskKeyForAudit)(destRecord.key),
             credits,
             fromBalance,
             toBalance,
@@ -1240,8 +1272,8 @@ class PayGateServer {
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({
             transferred: credits,
-            from: { keyMasked: (0, audit_1.maskKeyForAudit)(params.from), balance: fromBalance },
-            to: { keyMasked: (0, audit_1.maskKeyForAudit)(params.to), balance: toBalance },
+            from: { keyMasked: (0, audit_1.maskKeyForAudit)(sourceRecord.key), balance: fromBalance, credits: fromBalance },
+            to: { keyMasked: (0, audit_1.maskKeyForAudit)(destRecord.key), balance: toBalance, credits: toBalance },
             memo: memo || undefined,
             message: `Transferred ${credits} credits`,
         }));
@@ -1515,13 +1547,16 @@ class PayGateServer {
             res.end(JSON.stringify({ error: 'Missing key' }));
             return;
         }
+        // Resolve alias to actual key
+        const resolved = this.gate.store.resolveKeyRaw(params.key);
+        const actualKey = resolved ? resolved.key : params.key;
         // Use Redis-backed revoke when available (broadcasts to other instances)
         let success;
         if (this.redisSync) {
-            success = await this.redisSync.revokeKey(params.key);
+            success = await this.redisSync.revokeKey(actualKey);
         }
         else {
-            success = this.gate.store.revokeKey(params.key);
+            success = this.gate.store.revokeKey(actualKey);
         }
         if (!success) {
             res.writeHead(404, { 'Content-Type': 'application/json' });
@@ -1529,13 +1564,13 @@ class PayGateServer {
             return;
         }
         this.audit.log('key.revoked', 'admin', `Key revoked`, {
-            keyMasked: (0, audit_1.maskKeyForAudit)(params.key),
+            keyMasked: (0, audit_1.maskKeyForAudit)(actualKey),
         });
         this.emitWebhookAdmin('key.revoked', 'admin', {
-            keyMasked: (0, audit_1.maskKeyForAudit)(params.key),
+            keyMasked: (0, audit_1.maskKeyForAudit)(actualKey),
         });
         res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ message: 'Key revoked' }));
+        res.end(JSON.stringify({ message: 'Key revoked', revoked: true }));
     }
     // ─── /keys/suspend — Temporarily suspend a key ─────────────────────────────
     async handleSuspendKey(req, res) {
@@ -1561,7 +1596,7 @@ class PayGateServer {
             res.end(JSON.stringify({ error: 'Missing key' }));
             return;
         }
-        const record = this.gate.store.getKeyRaw(params.key);
+        const record = this.gate.store.resolveKeyRaw(params.key);
         if (!record) {
             res.writeHead(404, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: 'Key not found' }));
@@ -1577,19 +1612,19 @@ class PayGateServer {
             res.end(JSON.stringify({ error: 'Key is already suspended' }));
             return;
         }
-        const success = this.gate.store.suspendKey(params.key);
+        const success = this.gate.store.suspendKey(record.key);
         if (!success) {
             res.writeHead(500, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: 'Failed to suspend key' }));
             return;
         }
-        this.syncKeyMutation(params.key);
+        this.syncKeyMutation(record.key);
         this.audit.log('key.suspended', 'admin', `Key suspended${params.reason ? ': ' + params.reason : ''}`, {
-            keyMasked: (0, audit_1.maskKeyForAudit)(params.key),
+            keyMasked: (0, audit_1.maskKeyForAudit)(record.key),
             reason: params.reason || null,
         });
         this.emitWebhookAdmin('key.suspended', 'admin', {
-            keyMasked: (0, audit_1.maskKeyForAudit)(params.key),
+            keyMasked: (0, audit_1.maskKeyForAudit)(record.key),
             reason: params.reason || null,
         });
         res.writeHead(200, { 'Content-Type': 'application/json' });
@@ -1619,7 +1654,7 @@ class PayGateServer {
             res.end(JSON.stringify({ error: 'Missing key' }));
             return;
         }
-        const record = this.gate.store.getKeyRaw(params.key);
+        const record = this.gate.store.resolveKeyRaw(params.key);
         if (!record) {
             res.writeHead(404, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: 'Key not found' }));
@@ -1635,18 +1670,18 @@ class PayGateServer {
             res.end(JSON.stringify({ error: 'Key is not suspended' }));
             return;
         }
-        const success = this.gate.store.resumeKey(params.key);
+        const success = this.gate.store.resumeKey(record.key);
         if (!success) {
             res.writeHead(500, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: 'Failed to resume key' }));
             return;
         }
-        this.syncKeyMutation(params.key);
+        this.syncKeyMutation(record.key);
         this.audit.log('key.resumed', 'admin', 'Key resumed', {
-            keyMasked: (0, audit_1.maskKeyForAudit)(params.key),
+            keyMasked: (0, audit_1.maskKeyForAudit)(record.key),
         });
         this.emitWebhookAdmin('key.resumed', 'admin', {
-            keyMasked: (0, audit_1.maskKeyForAudit)(params.key),
+            keyMasked: (0, audit_1.maskKeyForAudit)(record.key),
         });
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ message: 'Key resumed', suspended: false }));
@@ -1676,7 +1711,7 @@ class PayGateServer {
             return;
         }
         // Use getKeyRaw to allow cloning suspended/expired keys (but not revoked)
-        const source = this.gate.store.getKeyRaw(params.key);
+        const source = this.gate.store.resolveKeyRaw(params.key);
         if (!source) {
             res.writeHead(404, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: 'Source key not found' }));
@@ -1687,7 +1722,7 @@ class PayGateServer {
             res.end(JSON.stringify({ error: 'Cannot clone a revoked key' }));
             return;
         }
-        const cloned = this.gate.store.cloneKey(params.key, {
+        const cloned = this.gate.store.cloneKey(source.key, {
             name: params.name,
             credits: params.credits,
             tags: params.tags,
@@ -1700,14 +1735,14 @@ class PayGateServer {
         }
         // Sync new key to Redis
         this.syncKeyMutation(cloned.key);
-        this.audit.log('key.cloned', 'admin', `Key cloned from ${(0, audit_1.maskKeyForAudit)(params.key)}`, {
-            sourceKeyMasked: (0, audit_1.maskKeyForAudit)(params.key),
+        this.audit.log('key.cloned', 'admin', `Key cloned from ${(0, audit_1.maskKeyForAudit)(source.key)}`, {
+            sourceKeyMasked: (0, audit_1.maskKeyForAudit)(source.key),
             newKeyMasked: (0, audit_1.maskKeyForAudit)(cloned.key),
             name: cloned.name,
             credits: cloned.credits,
         });
         this.emitWebhookAdmin('key.cloned', 'admin', {
-            sourceKeyMasked: (0, audit_1.maskKeyForAudit)(params.key),
+            sourceKeyMasked: (0, audit_1.maskKeyForAudit)(source.key),
             newKeyMasked: (0, audit_1.maskKeyForAudit)(cloned.key),
             name: cloned.name,
             credits: cloned.credits,
@@ -1718,6 +1753,7 @@ class PayGateServer {
             key: cloned.key,
             name: cloned.name,
             credits: cloned.credits,
+            clonedFrom: source.key.slice(0, 10) + '...',
             sourceName: source.name,
             allowedTools: cloned.allowedTools,
             deniedTools: cloned.deniedTools,
@@ -1730,6 +1766,65 @@ class PayGateServer {
             spendingLimit: cloned.spendingLimit,
         }));
     }
+    // ─── /keys/alias — Set or clear key alias ──────────────────────────────────
+    async handleSetAlias(req, res) {
+        if (req.method !== 'POST') {
+            res.writeHead(405, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Method not allowed' }));
+            return;
+        }
+        if (!this.checkAdmin(req, res))
+            return;
+        const raw = await this.readBody(req);
+        const params = JSON.parse(raw);
+        if (!params.key) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Missing "key" parameter' }));
+            return;
+        }
+        // Resolve the key (support existing aliases for the source key)
+        const record = this.gate.store.resolveKeyRaw(params.key);
+        if (!record) {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Key not found' }));
+            return;
+        }
+        const alias = params.alias !== undefined ? (params.alias === null || params.alias === '' ? null : String(params.alias)) : undefined;
+        if (alias === undefined) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Missing "alias" parameter (string to set, null to clear)' }));
+            return;
+        }
+        const result = this.gate.store.setAlias(record.key, alias);
+        if (!result.success) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: result.error }));
+            return;
+        }
+        const action = alias ? `set to "${alias}"` : 'cleared';
+        this.audit.log('key.alias_set', 'admin', `Key alias ${action} for ${record.key.slice(0, 10)}...`, {
+            key: record.key.slice(0, 10),
+            alias: alias || null,
+        });
+        // Sync to Redis if configured
+        if (typeof this.syncKeyMutation === 'function') {
+            this.syncKeyMutation(record.key);
+        }
+        // Webhook event
+        if (this.gate.webhook) {
+            this.gate.webhook.emitAdmin('key.created', 'admin', {
+                key: record.key.slice(0, 10),
+                alias: alias || null,
+                event: 'alias_set',
+            });
+        }
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            key: record.key.slice(0, 10) + '...',
+            alias: record.alias || null,
+            message: `Alias ${action}`,
+        }));
+    }
     // ─── /keys/rotate — Rotate API key ─────────────────────────────────────────
     async handleRotateKey(req, res) {
         if (req.method !== 'POST') {
@@ -1813,7 +1908,7 @@ class PayGateServer {
             return;
         }
         this.syncKeyMutation(params.key);
-        const record = this.gate.store.getKey(params.key);
+        const record = this.gate.store.resolveKey(params.key);
         this.audit.log('key.acl_updated', 'admin', `ACL updated`, {
             keyMasked: (0, audit_1.maskKeyForAudit)(params.key),
             allowedTools: record?.allowedTools || [],
@@ -1865,7 +1960,7 @@ class PayGateServer {
             return;
         }
         this.syncKeyMutation(params.key);
-        const record = this.gate.store.getKeyRaw(params.key);
+        const record = this.gate.store.resolveKeyRaw(params.key);
         this.audit.log('key.expiry_updated', 'admin', expiresAt ? `Key expiry set to ${expiresAt}` : 'Key expiry removed', {
             keyMasked: (0, audit_1.maskKeyForAudit)(params.key),
             expiresAt: record?.expiresAt || null,
@@ -1968,7 +2063,7 @@ class PayGateServer {
             return;
         }
         this.syncKeyMutation(params.key);
-        const record = this.gate.store.getKey(params.key);
+        const record = this.gate.store.resolveKey(params.key);
         this.audit.log('key.tags_updated', 'admin', `Tags updated`, {
             keyMasked: (0, audit_1.maskKeyForAudit)(params.key),
             tags: record?.tags || {},
@@ -2015,7 +2110,7 @@ class PayGateServer {
             return;
         }
         this.syncKeyMutation(params.key);
-        const record = this.gate.store.getKey(params.key);
+        const record = this.gate.store.resolveKey(params.key);
         this.audit.log('key.ip_updated', 'admin', `IP allowlist updated`, {
             keyMasked: (0, audit_1.maskKeyForAudit)(params.key),
             ipAllowlist: record?.ipAllowlist || [],
@@ -2072,14 +2167,14 @@ class PayGateServer {
             res.end(JSON.stringify({ error: 'Missing key query parameter' }));
             return;
         }
-        // Verify key exists (use getKeyRaw to allow querying expired/suspended keys)
-        const record = this.gate.store.getKeyRaw(key);
+        // Verify key exists (use resolveKeyRaw to allow querying by alias and expired/suspended keys)
+        const record = this.gate.store.resolveKeyRaw(key);
         if (!record) {
             res.writeHead(404, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: 'Key not found' }));
             return;
         }
-        const usage = this.gate.meter.getKeyUsage(key, since);
+        const usage = this.gate.meter.getKeyUsage(record.key, since);
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({
             key: key.slice(0, 10) + '...',
@@ -2091,6 +2186,34 @@ class PayGateServer {
             ...usage,
         }, null, 2));
     }
+    // ─── /keys/expiring — List keys expiring within a time window ───────────────
+    handleKeysExpiring(req, res) {
+        if (req.method !== 'GET') {
+            res.writeHead(405, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Method not allowed' }));
+            return;
+        }
+        if (!this.checkAdmin(req, res))
+            return;
+        const urlParts = req.url?.split('?') || [];
+        const params = new URLSearchParams(urlParts[1] || '');
+        const withinStr = params.get('within');
+        const within = withinStr ? parseInt(withinStr, 10) : 86400; // Default: 24 hours
+        if (isNaN(within) || within <= 0) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Invalid within parameter — must be a positive number of seconds' }));
+            return;
+        }
+        const allKeys = this.gate.store.getAllRecords();
+        const expiring = expiry_scanner_1.ExpiryScanner.queryExpiring(allKeys, within);
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            within,
+            count: expiring.length,
+            scanner: this.expiryScanner.status,
+            keys: expiring,
+        }, null, 2));
+    }
     // ─── /keys/auto-topup — Configure auto-topup ────────────────────────────────
     async handleSetAutoTopup(req, res) {
         if (req.method !== 'POST') {
@@ -2115,7 +2238,7 @@ class PayGateServer {
             res.end(JSON.stringify({ error: 'Missing key' }));
             return;
         }
-        const record = this.gate.store.getKey(params.key);
+        const record = this.gate.store.resolveKey(params.key);
         if (!record) {
             res.writeHead(404, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: 'Key not found or inactive' }));
@@ -2236,7 +2359,7 @@ class PayGateServer {
             res.end(JSON.stringify({ error: 'Missing key' }));
             return;
         }
-        const record = this.gate.store.getKey(params.key);
+        const record = this.gate.store.resolveKey(params.key);
         if (!record) {
             res.writeHead(404, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: 'Key not found or inactive' }));
@@ -3539,7 +3662,7 @@ class PayGateServer {
             return;
         }
         // Verify the key exists
-        const keyRecord = this.gate.store.getKey(params.key);
+        const keyRecord = this.gate.store.resolveKey(params.key);
         if (!keyRecord) {
             res.writeHead(404, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: 'API key not found' }));
@@ -3658,7 +3781,7 @@ class PayGateServer {
             return;
         }
         // Verify the parent key exists and is active
-        const keyRecord = this.gate.store.getKey(params.key);
+        const keyRecord = this.gate.store.resolveKey(params.key);
         if (!keyRecord || !keyRecord.active) {
             res.writeHead(404, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ error: 'API key not found or inactive' }));
@@ -4195,6 +4318,7 @@ class PayGateServer {
         this.sessions.destroy();
         this.audit.destroy();
         this.tokens.destroy();
+        this.expiryScanner.destroy();
         if (this.redisSync) {
             await this.redisSync.destroy();
         }
@@ -4250,6 +4374,7 @@ class PayGateServer {
         this.sessions.destroy();
         this.audit.destroy();
         this.tokens.destroy();
+        this.expiryScanner.destroy();
         if (this.redisSync) {
             await this.redisSync.destroy();
         }