@yalehwang/cloudpit 2.0.0 → 3.0.0

package/server/modules/mcp-gateway/tests/mcp-ui-last-opened.test.ts

@@ -217,7 +217,7 @@ async function withHarness(run: (harness: Harness) => Promise<void>): Promise<vo
 
   const tokens = createAccessTokensService({ now: () => new Date(NOW_MS) });
   const readToken = tokens.issueToken({
-    userId: USER_ONE, name: 'mcp-read', scopes: ['cloudcli:read'], expiresInDays: 30,
+    userId: USER_ONE, name: 'mcp-read', scopes: ['cloudpit:read'], expiresInDays: 30,
   });
   if (!readToken.ok) {
     throw new Error('the harness must mint the read token');

package/server/modules/mcp-gateway/tests/mcp-usage-stats.test.ts

@@ -225,7 +225,7 @@ async function withStatsServer(run: (server: StatsServer) => Promise<void>): Pro
   const port = (httpServer.address() as AddressInfo).port;
 
   const issue = (userId: number, scopes: string[]): { id: number; token: string } => {
-    const issued = tokens.issueToken({ userId, name: 'self-check', scopes, expiresInDays: 30 });
+    const issued = tokens.issueToken({ userId, name: 'self-check', scopes: scopes.map((scope) => scope.replace('cloudcli:', 'cloudpit:')), expiresInDays: 30 });
     if (!issued.ok) {
       throw new Error('the harness issued a token with a lifetime the service rejects');
     }

package/server/modules/mcp-gateway/tests/mcp-write-notification.test.ts

@@ -356,13 +356,13 @@ async function withHarness(options: HarnessOptions, run: (harness: Harness) => P
     const fullToken = tokens.issueToken({
       userId: USER_ONE,
       name: FULL_TOKEN_NAME,
-      scopes: [...ACCESS_TOKEN_SCOPES],
+      scopes: ACCESS_TOKEN_SCOPES.map((scope) => scope.replace('cloudcli:', 'cloudpit:')),
       expiresInDays: 30,
     });
     const readOnlyToken = tokens.issueToken({
       userId: USER_ONE,
       name: 'ac303-read',
-      scopes: [ACCESS_TOKEN_SCOPES[0]],
+      scopes: [ACCESS_TOKEN_SCOPES[0].replace('cloudcli:', 'cloudpit:')],
       expiresInDays: 30,
     });
     if (!fullToken.ok || !readOnlyToken.ok) {

package/server/modules/mcp-gateway/tests/oauth-flow.e2e.test.ts

@@ -69,14 +69,14 @@ const USERNAME = 'oauth-e2e-user';
  */
 const ACCOUNT_PASSWORD = 'oauth-e2e-password';
 const REDIRECT_URI = 'https://app.example/cb';
-const READ_SCOPE = 'cloudcli:read';
+const READ_SCOPE = 'cloudpit:read';
 /**
  * A state-changing scope. Since gap-oauth-consent-flow-ux-hardening the consent
  * `allow` branch asks for the password ONLY when the grant reaches past
  * `cloudcli:read`, so the wrong-password counterexample and the password-carrying
  * mode below must submit this alongside the read scope.
  */
-const WRITE_SCOPE = 'cloudcli:session:send';
+const WRITE_SCOPE = 'cloudpit:session:send';
 
 /**
  * The same native module the auth module hashes with (`bcrypt.hash(pw, 12)` in
@@ -251,7 +251,7 @@ type ServerContext = {
 };
 
 /**
- * Seeds a temp database with ONE CloudCLI user, boots a real `server/index.ts`
+ * Seeds a temp database with ONE Cloudpit user, boots a real `server/index.ts`
  * process against it on a temp port, waits for the ready line, and hands the
  * context to `run`. The user row is what `oauth_grants.user_id` references and
  * what `authenticateToken` loads for the minted JWT; since AC-261 it is also what

package/server/modules/notifications/services/notification-orchestrator.service.js

@@ -165,7 +165,7 @@ function buildNotificationPayload(event) {
   const message = CODE_MAP[normalizedEvent.code] || 'You have a new notification';
 
   return {
-    title: sessionName || 'CloudCLI',
+    title: sessionName || 'Cloudpit',
     body: `${providerLabel}: ${message}`,
     data: {
       sessionId: normalizedEvent.sessionId || null,

package/server/modules/oauth/access-tokens.service.ts

@@ -137,16 +137,16 @@ function isAllowedExpiryDays(days: number | null | undefined): days is number {
 }
 
 /**
- * Validates a requested scope list against the accepted vocabulary (both the
- * `cloudcli:*` and `cloudpit:*` spellings) and removes duplicates, preserving
- * first-occurrence order and the spelling the caller asked for. This is the single
- * vocabulary check and deduplication used by both issuance paths, so no caller
- * can mint an unknown, reserved, empty or duplicated scope. Consumers: this
- * module's `issueToken` and the settings module's `createAccessToken`.
+ * Validates a requested scope list against the accepted vocabulary (3.0: the
+ * eight `cloudpit:*` spellings only) and removes duplicates, preserving
+ * first-occurrence order. This is the single vocabulary check and deduplication
+ * used by both issuance paths, so no caller can mint an unknown, reserved,
+ * retired, empty or duplicated scope. Consumers: this module's `issueToken` and
+ * the settings module's `createAccessToken`.
  *
  * Returns `{ ok: false }` for a non-array, an empty array, any non-string
- * element, or any string outside the vocabulary; otherwise `{ ok: true }` with
- * the deduplicated list.
+ * element, or any string outside the vocabulary (including the retired
+ * `cloudcli:*` spelling); otherwise `{ ok: true }` with the deduplicated list.
  */
 export function normalizeAccessTokenScopes(
   scopes: unknown,

package/server/modules/oauth/oauth-consent.service.ts

@@ -19,10 +19,13 @@
  */
 
 import type { OAuthClientRow } from '@/modules/database/index.js';
-import { ACCESS_TOKEN_SCOPES } from '@/modules/oauth/access-tokens.service.js';
-import { canonicalScope } from '@/shared/mcp-contract/index.js';
+import { CLOUDPIT_ACCESS_TOKEN_SCOPES, canonicalScope } from '@/shared/mcp-contract/index.js';
 
-/** The scope every consent grants; the SPA lists it checked and not removable. */
+/**
+ * The canonical scope every consent grants; the SPA lists the wire spelling
+ * `cloudpit:read` checked and not removable, and the stored grant keeps this
+ * canonical name so existing `requiredScopes` literals keep matching.
+ */
 export const OAUTH_CONSENT_READ_SCOPE = 'cloudcli:read';
 
 /**
@@ -106,9 +109,9 @@ export type OAuthConsentClients = { findById(clientId: string): OAuthClientRow |
 
 /** The whole vocabulary, each entry flagged for the screen. */
 export function consentScopeOptions(): ConsentScopeOption[] {
-  return ACCESS_TOKEN_SCOPES.map((scope) => {
-    // The tables stay keyed by the legacy names; the lookup is canonical so an
-    // option added in either spelling still finds its description and risk badge.
+  return CLOUDPIT_ACCESS_TOKEN_SCOPES.map((scope) => {
+    // The screen offers the 3.0 wire spellings; the description/risk tables stay
+    // keyed by the canonical names, so the lookup goes through `canonicalScope`.
     const canonical = canonicalScope(scope);
     return {
       scope,
@@ -197,21 +200,23 @@ export function readConsentRequest(
 }
 
 /**
- * The scopes a decision grants: `cloudcli:read` first (forced, as the screen
- * pins it), then every submitted scope that is in the vocabulary, once each. A
- * value the client invented — `cloudcli:admin`, a typo, anything else — is
- * dropped rather than stored on the grant.
+ * The scopes a decision grants: the canonical read scope first (forced, as the
+ * screen pins it), then every submitted wire scope, once each, stored under its
+ * canonical name. A value the client invented — `cloudcli:admin`, a typo, the
+ * retired `cloudcli:*` spelling — is dropped rather than stored on the grant.
  */
 export function grantedScopes(submitted: readonly string[]): string[] {
-  const vocabulary = new Set<string>(ACCESS_TOKEN_SCOPES);
+  const vocabulary = new Set<string>(CLOUDPIT_ACCESS_TOKEN_SCOPES);
   const seen = new Set<string>([OAUTH_CONSENT_READ_SCOPE]);
   const scopes = [OAUTH_CONSENT_READ_SCOPE];
   for (const submittedScope of submitted) {
-    // A `cloudpit:*` request grants the same permission as its legacy spelling; the
-    // stored grant keeps the legacy name so existing `requiredScopes` literals and
-    // the consent screen's own vocabulary keep matching.
+    // 3.0 accepts one wire spelling; the stored grant uses the canonical name so
+    // existing `requiredScopes` literals and the screen's tables keep matching.
+    if (!vocabulary.has(submittedScope)) {
+      continue;
+    }
     const scope = canonicalScope(submittedScope);
-    if (!vocabulary.has(scope) || seen.has(scope)) {
+    if (seen.has(scope)) {
       continue;
     }
     seen.add(scope);

package/server/modules/oauth/tests/access-token-scopes.test.ts

@@ -8,10 +8,10 @@
  * temp directory. Covers:
  *   (a) any non-empty subset of the vocabulary issues 201, the response scopes
  *       equal the requested set with no duplicates, and the stored scopes match;
- *   (b) a mistyped scope, an unprefixed `read`, `cloudcli:admin`, an empty list
+ *   (b) a mistyped scope, an unprefixed `read`, `cloudpit:admin`, an empty list
  *       and a non-string element are all 400 with the same `INVALID_SCOPE` code
  *       and write no row;
- *   (c) an omitted scope list still defaults to `cloudcli:read`;
+ *   (c) an omitted scope list still defaults to `cloudpit:read`;
  *   (d) the service's own `issueToken` rejects the same illegal scopes and still
  *       issues a valid one — bypassing the route cannot mint a bad scope.
  */
@@ -29,6 +29,7 @@ import express from 'express';
 
 import { accessTokensDb, closeConnection, getConnection, initializeDatabase } from '@/modules/database/index.js';
 import { ACCESS_TOKEN_SCOPES, createAccessTokensService } from '@/modules/oauth/index.js';
+import { CLOUDPIT_ACCESS_TOKEN_SCOPES } from '@/shared/mcp-contract/index.js';
 import type { AccessTokensService } from '@/modules/oauth/index.js';
 import { createSettingsRouter, createSettingsService } from '@/modules/settings/index.js';
 import { AppError } from '@/shared/utils.js';
@@ -37,50 +38,50 @@ const OWNER_ID = 1;
 
 /**
  * The eight issuable scopes written out literally, so a source change that adds
- * `cloudcli:admin` (or drops a scope) is caught here rather than silently
+ * `cloudpit:admin` (or drops a scope) is caught here rather than silently
  * changing what the criterion expects.
  */
 const VOCABULARY = [
-  'cloudcli:read',
-  'cloudcli:session:send',
-  'cloudcli:session:create',
-  'cloudcli:session:control',
-  'cloudcli:approve',
+  'cloudpit:read',
+  'cloudpit:session:send',
+  'cloudpit:session:create',
+  'cloudpit:session:control',
+  'cloudpit:approve',
   // gap-mcp-ui-open-session: appended last, so the five positional reads in the
   // gateway's write-tool table keep their index.
-  'cloudcli:navigate',
+  'cloudpit:navigate',
   // gap-ui-visible-context-extended-fields: appended after navigate for the same
   // reason — every positional read in the gateway keeps its index.
-  'cloudcli:selection',
+  'cloudpit:selection',
   // gap-mcp-cockpit-card-tools: the confirm scope for cockpit cards, appended
-  // LAST for the same positional reason. There is no `cloudcli:cockpit:read`:
-  // the three cockpit read tools use `cloudcli:read`.
-  'cloudcli:cockpit:act',
+  // LAST for the same positional reason. There is no `cloudpit:cockpit:read`:
+  // the three cockpit read tools use the canonical read scope.
+  'cloudpit:cockpit:act',
 ] as const;
 
 /** A non-empty subset request and the unique scopes it must resolve to. */
 const SUBSET_REQUESTS: { requested: string[]; expectedUnique: string[] }[] = [
-  { requested: ['cloudcli:read'], expectedUnique: ['cloudcli:read'] },
-  { requested: ['cloudcli:session:send'], expectedUnique: ['cloudcli:session:send'] },
-  { requested: ['cloudcli:session:create'], expectedUnique: ['cloudcli:session:create'] },
-  { requested: ['cloudcli:session:control'], expectedUnique: ['cloudcli:session:control'] },
-  { requested: ['cloudcli:approve'], expectedUnique: ['cloudcli:approve'] },
-  { requested: ['cloudcli:read', 'cloudcli:approve'], expectedUnique: ['cloudcli:read', 'cloudcli:approve'] },
+  { requested: ['cloudpit:read'], expectedUnique: ['cloudpit:read'] },
+  { requested: ['cloudpit:session:send'], expectedUnique: ['cloudpit:session:send'] },
+  { requested: ['cloudpit:session:create'], expectedUnique: ['cloudpit:session:create'] },
+  { requested: ['cloudpit:session:control'], expectedUnique: ['cloudpit:session:control'] },
+  { requested: ['cloudpit:approve'], expectedUnique: ['cloudpit:approve'] },
+  { requested: ['cloudpit:read', 'cloudpit:approve'], expectedUnique: ['cloudpit:read', 'cloudpit:approve'] },
   { requested: [...VOCABULARY], expectedUnique: [...VOCABULARY] },
   {
     // First-occurrence order is preserved: read then approve.
-    requested: ['cloudcli:read', 'cloudcli:read', 'cloudcli:approve'],
-    expectedUnique: ['cloudcli:read', 'cloudcli:approve'],
+    requested: ['cloudpit:read', 'cloudpit:read', 'cloudpit:approve'],
+    expectedUnique: ['cloudpit:read', 'cloudpit:approve'],
   },
 ];
 
 /** The five illegal scope payloads that must all share one 400 code. */
 const ILLEGAL_SCOPES: unknown[] = [
-  ['cloudcli:reed'],
+  ['cloudpit:reed'],
   ['read'],
-  ['cloudcli:admin'],
+  ['cloudpit:admin'],
   [],
-  ['cloudcli:read', 42],
+  ['cloudpit:read', 42],
 ];
 
 type HttpResponse = { status: number; body: Record<string, unknown>; text: string };
@@ -234,10 +235,13 @@ async function withSettingsServer(run: (harness: Harness) => Promise<void>): Pro
   }
 }
 
-test('(vocabulary) ACCESS_TOKEN_SCOPES is exactly the eight issuable scopes, admin absent', () => {
-  assert.deepEqual([...ACCESS_TOKEN_SCOPES], [...VOCABULARY]);
+test('(vocabulary) the eight issuable scopes are the cloudpit:* spellings, admin absent', () => {
+  assert.deepEqual([...CLOUDPIT_ACCESS_TOKEN_SCOPES], [...VOCABULARY]);
+  assert.equal((CLOUDPIT_ACCESS_TOKEN_SCOPES as readonly string[]).includes('cloudpit:admin'), false);
+  // The canonical table is internal, still eight names, and never the request vocabulary.
+  assert.equal(ACCESS_TOKEN_SCOPES.length, 8);
   assert.equal((ACCESS_TOKEN_SCOPES as readonly string[]).includes('cloudcli:admin'), false);
-  console.log(`(vocabulary) ACCESS_TOKEN_SCOPES = ${JSON.stringify(ACCESS_TOKEN_SCOPES)}`);
+  console.log(`(vocabulary) CLOUDPIT_ACCESS_TOKEN_SCOPES = ${JSON.stringify(CLOUDPIT_ACCESS_TOKEN_SCOPES)}`);
 });
 
 test('(a) any non-empty vocabulary subset issues 201 with set-equal, deduplicated, stored scopes', async () => {
@@ -300,7 +304,24 @@ test('(b) the five illegal scope payloads are all 400 INVALID_SCOPE and write no
   });
 });
 
-test('(c) an omitted scope list still defaults to cloudcli:read', async () => {
+test('(b2) the retired cloudcli:* spelling is a 400 INVALID_SCOPE and writes no row', async () => {
+  await withSettingsServer(async (harness) => {
+    for (const scopes of [['cloudcli:read'], ['cloudcli:session:send'], ['cloudcli:cockpit:act']]) {
+      const beforeCount = harness.countRows();
+      const response = await postJson(harness, '/api/settings/access-tokens', {
+        name: 'retired',
+        expiresInDays: 30,
+        scopes,
+      });
+      assert.equal(response.status, 400);
+      assert.equal(errorCode(response.body), 'INVALID_SCOPE');
+      assert.equal(harness.countRows(), beforeCount);
+      console.log(`(b2) scopes=${JSON.stringify(scopes)} status=${response.status} code=${errorCode(response.body)}`);
+    }
+  });
+});
+
+test('(c) an omitted scope list still defaults to cloudpit:read', async () => {
   await withSettingsServer(async (harness) => {
     const response = await postJson(harness, '/api/settings/access-tokens', {
       name: 'default-scope',
@@ -308,10 +329,10 @@ test('(c) an omitted scope list still defaults to cloudcli:read', async () => {
     });
     const scopes = responseScopes(response.body);
     assert.equal(response.status, 201);
-    assert.deepEqual(scopes, ['cloudcli:read']);
+    assert.deepEqual(scopes, ['cloudpit:read']);
 
     const stored = harness.storedScopes((response.body.token as { id: number }).id);
-    assert.deepEqual(stored, ['cloudcli:read']);
+    assert.deepEqual(stored, ['cloudpit:read']);
 
     console.log(`(c) status=${response.status} token.scopes=${JSON.stringify(scopes)} stored=${JSON.stringify(stored)}`);
   });
@@ -322,8 +343,8 @@ test('(d) service-level issueToken rejects illegal scopes and still issues a val
     const beforeCount = harness.countRows();
 
     const illegal = [
-      { scopes: ['cloudcli:reed'] },
-      { scopes: ['cloudcli:admin'] },
+      { scopes: ['cloudpit:reed'] },
+      { scopes: ['cloudpit:admin'] },
       { scopes: [] },
     ];
     for (const { scopes } of illegal) {
@@ -333,11 +354,11 @@ test('(d) service-level issueToken rejects illegal scopes and still issues a val
     }
     assert.equal(harness.countRows(), beforeCount);
 
-    const valid = harness.tokens.issueToken({ userId: OWNER_ID, scopes: ['cloudcli:read'] });
+    const valid = harness.tokens.issueToken({ userId: OWNER_ID, scopes: ['cloudpit:read'] });
     assert.equal(valid.ok, true);
     assert.equal(harness.countRows(), beforeCount + 1);
     console.log(
-      `(d) issueToken(['cloudcli:read']) = ok=${valid.ok} id=${valid.ok ? valid.token.id : '-'} `
+      `(d) issueToken(['cloudpit:read']) = ok=${valid.ok} id=${valid.ok ? valid.token.id : '-'} `
       + `rows ${beforeCount}->${harness.countRows()}`,
     );
   });

package/server/modules/oauth/tests/access-tokens.service.test.ts

@@ -99,7 +99,7 @@ function tokenRowCount(): number {
 
 test('(a) plaintext appears once in the issue result and zero times in the database', async () => {
   await withAccessTokenDb(async ({ service, userId, dbPath }) => {
-    const issued = service.issueToken({ userId, name: 'laptop', scopes: ['cloudcli:read'] });
+    const issued = service.issueToken({ userId, name: 'laptop', scopes: ['cloudpit:read'] });
     assert.equal(issued.ok, true);
     if (!issued.ok) return;
 
@@ -149,7 +149,7 @@ test('(b) a live token verifies and stamps last_used from the injected clock, th
     const issued = service.issueToken({
       userId,
       name: 'laptop',
-      scopes: ['cloudcli:read', 'cloudcli:session:send'],
+      scopes: ['cloudpit:read', 'cloudpit:session:send'],
     });
     assert.equal(issued.ok, true);
     if (!issued.ok) return;
@@ -161,11 +161,11 @@ test('(b) a live token verifies and stamps last_used from the injected clock, th
 
     assert.equal(readLastUsed(), null);
 
-    const verified = service.verifyToken(issued.token.token, 'cloudcli:read');
+    const verified = service.verifyToken(issued.token.token, 'cloudpit:read');
     assert.equal(verified.ok, true);
     if (!verified.ok) return;
     assert.equal(verified.userId, userId);
-    assert.deepEqual(verified.scopes, ['cloudcli:read', 'cloudcli:session:send']);
+    assert.deepEqual(verified.scopes, ['cloudpit:read', 'cloudpit:session:send']);
 
     // t0: the first use fills the NULL column with the clock's reading.
     const firstStamp = currentTime().toISOString();
@@ -173,12 +173,12 @@ test('(b) a live token verifies and stamps last_used from the injected clock, th
 
     // t0+59s: inside the window, so the stored instant is left alone.
     advanceTo(new Date(START.getTime() + 59_000));
-    assert.equal(service.verifyToken(issued.token.token, 'cloudcli:read').ok, true);
+    assert.equal(service.verifyToken(issued.token.token, 'cloudpit:read').ok, true);
     assert.equal(readLastUsed(), firstStamp);
 
     // t0+61s: past the window, so the instant advances to the new reading.
     advanceTo(new Date(START.getTime() + 61_000));
-    assert.equal(service.verifyToken(issued.token.token, 'cloudcli:read').ok, true);
+    assert.equal(service.verifyToken(issued.token.token, 'cloudpit:read').ok, true);
     assert.equal(readLastUsed(), new Date(START.getTime() + 61_000).toISOString());
   });
 });
@@ -190,7 +190,7 @@ test('(c) the five rejection paths yield five pairwise-distinct reasons', async
     const results: VerifyAccessTokenResult[] = [];
 
     await t.test('expired', () => {
-      const issued = service.issueToken({ userId, scopes: ['cloudcli:read'], expiresInDays: 7 });
+      const issued = service.issueToken({ userId, scopes: ['cloudpit:read'], expiresInDays: 7 });
       assert.equal(issued.ok, true);
       if (!issued.ok) return;
       advanceTo(new Date(START.getTime() + 8 * MS_PER_DAY));
@@ -201,7 +201,7 @@ test('(c) the five rejection paths yield five pairwise-distinct reasons', async
     });
 
     await t.test('revoked', () => {
-      const issued = service.issueToken({ userId, scopes: ['cloudcli:read'] });
+      const issued = service.issueToken({ userId, scopes: ['cloudpit:read'] });
       assert.equal(issued.ok, true);
       if (!issued.ok) return;
       assert.equal(service.revokeToken(issued.token.id), true);
@@ -211,7 +211,7 @@ test('(c) the five rejection paths yield five pairwise-distinct reasons', async
     });
 
     await t.test('rewritten plaintext is not found', () => {
-      const issued = service.issueToken({ userId, scopes: ['cloudcli:read'] });
+      const issued = service.issueToken({ userId, scopes: ['cloudpit:read'] });
       assert.equal(issued.ok, true);
       if (!issued.ok) return;
       const rewritten =
@@ -228,7 +228,7 @@ test('(c) the five rejection paths yield five pairwise-distinct reasons', async
     });
 
     await t.test('insufficient scope', () => {
-      const issued = service.issueToken({ userId, scopes: ['cloudcli:read'] });
+      const issued = service.issueToken({ userId, scopes: ['cloudpit:read'] });
       assert.equal(issued.ok, true);
       if (!issued.ok) return;
       const result = service.verifyToken(issued.token.token, 'cloudcli:admin');
@@ -247,14 +247,14 @@ test('(c) the five rejection paths yield five pairwise-distinct reasons', async
 test('(d) only 7/30/90 day lifetimes are accepted; anything else writes no row', async () => {
   await withAccessTokenDb(async ({ service, userId }) => {
     for (const days of [7, 30, 90]) {
-      const result = service.issueToken({ userId, scopes: ['cloudcli:read'], expiresInDays: days });
+      const result = service.issueToken({ userId, scopes: ['cloudpit:read'], expiresInDays: days });
       assert.equal(result.ok, true);
       if (!result.ok) return;
       assert.equal(result.token.expiresAt, new Date(START.getTime() + days * MS_PER_DAY).toISOString());
     }
 
     // Omitted lifetime defaults to 30 days.
-    const defaulted = service.issueToken({ userId, scopes: ['cloudcli:read'] });
+    const defaulted = service.issueToken({ userId, scopes: ['cloudpit:read'] });
     assert.equal(defaulted.ok, true);
     if (!defaulted.ok) return;
     assert.equal(defaulted.token.expiresAt, new Date(START.getTime() + 30 * MS_PER_DAY).toISOString());
@@ -266,7 +266,7 @@ test('(d) only 7/30/90 day lifetimes are accepted; anything else writes no row',
     const rejected: (number | null)[] = [null, Infinity, 0, -1, 365];
     for (const days of rejected) {
       assert.deepEqual(
-        service.issueToken({ userId, scopes: ['cloudcli:read'], expiresInDays: days }),
+        service.issueToken({ userId, scopes: ['cloudpit:read'], expiresInDays: days }),
         { ok: false, reason: 'invalid_expiry' }
       );
     }
@@ -277,7 +277,7 @@ test('(d) only 7/30/90 day lifetimes are accepted; anything else writes no row',
 
 test('(e) revocation takes effect on the next verify, same process, no restart', async () => {
   await withAccessTokenDb(async ({ service, userId }) => {
-    const issued = service.issueToken({ userId, scopes: ['cloudcli:read'] });
+    const issued = service.issueToken({ userId, scopes: ['cloudpit:read'] });
     assert.equal(issued.ok, true);
     if (!issued.ok) return;
 
@@ -286,3 +286,39 @@ test('(e) revocation takes effect on the next verify, same process, no restart',
     assert.deepEqual(service.verifyToken(issued.token.token), { ok: false, reason: 'revoked' });
   });
 });
+
+test('(f) v3.0 refuses a legacy cloudcli:* request and still verifies a pre-3.0 token row', async () => {
+  await withAccessTokenDb(async ({ service, userId }) => {
+    // The retired spelling cannot mint a new token.
+    for (const scope of ['cloudcli:read', 'cloudcli:session:send', 'cloudcli:cockpit:act']) {
+      assert.deepEqual(
+        service.issueToken({ userId, scopes: [scope] }),
+        { ok: false, reason: 'invalid_scope' },
+        `${scope} must be refused at the issue boundary`,
+      );
+    }
+
+    // An old token row carries the canonical spelling. Seed one directly (the 2.x writer) and
+    // verify it still authenticates against the canonical required scope — no forced revocation.
+    const token = `ccp_${'a'.repeat(64)}`;
+    const hash = crypto.createHash('sha256').update(token).digest('hex');
+    getConnection()
+      .prepare(
+        `INSERT INTO access_tokens (user_id, token_hash, token_prefix, name, scopes, expires_at, created_at)
+         VALUES (?, ?, ?, 'legacy', ?, ?, ?)`,
+      )
+      .run(
+        userId,
+        hash,
+        token.slice(0, 8),
+        JSON.stringify(['cloudcli:read', 'cloudcli:session:send']),
+        new Date(START.getTime() + 30 * MS_PER_DAY).toISOString(),
+        START.toISOString(),
+      );
+
+    const verified = service.verifyToken(token, 'cloudcli:read');
+    assert.equal(verified.ok, true, 'an old token row keeps working');
+    if (!verified.ok) return;
+    assert.deepEqual(verified.scopes, ['cloudcli:read', 'cloudcli:session:send']);
+  });
+});