Rename AGW_MCP_CALLBACK_SIGNING_* to AGW_CALLBACK_SIGNING_*

Align server env var names with CLI convention. The MCP_ prefix was
misleading — callback signing is not MCP-specific.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: jarrodwatts

app/.env.example

@@ -10,6 +10,6 @@ PRIVY_APP_SECRET=
 PRIVY_DEFAULT_POLICY_ID=
 
 # Callback attestation signing (optional in dev — ephemeral key auto-generated)
-AGW_MCP_CALLBACK_SIGNING_PRIVATE_KEY=
-AGW_MCP_CALLBACK_SIGNING_PUBLIC_KEY=
-AGW_MCP_CALLBACK_SIGNING_ISSUER=
+AGW_CALLBACK_SIGNING_PRIVATE_KEY=
+AGW_CALLBACK_SIGNING_PUBLIC_KEY=
+AGW_CALLBACK_SIGNING_ISSUER=

app/src/lib/__tests__/callback-attestation.test.ts

@@ -7,9 +7,9 @@ import {
   verifySignedServerPayload,
 } from '../server/callback-attestation';
 
-const originalPrivateKey = process.env.AGW_MCP_CALLBACK_SIGNING_PRIVATE_KEY;
-const originalPublicKey = process.env.AGW_MCP_CALLBACK_SIGNING_PUBLIC_KEY;
-const originalIssuer = process.env.AGW_MCP_CALLBACK_SIGNING_ISSUER;
+const originalPrivateKey = process.env.AGW_CALLBACK_SIGNING_PRIVATE_KEY;
+const originalPublicKey = process.env.AGW_CALLBACK_SIGNING_PUBLIC_KEY;
+const originalIssuer = process.env.AGW_CALLBACK_SIGNING_ISSUER;
 
 declare global {
   // eslint-disable-next-line no-var
@@ -24,29 +24,29 @@ declare global {
 
 function resetSignerCache() {
   delete globalThis.__agwMcpCallbackSigner;
-  delete process.env.AGW_MCP_CALLBACK_SIGNING_PRIVATE_KEY;
-  delete process.env.AGW_MCP_CALLBACK_SIGNING_PUBLIC_KEY;
-  delete process.env.AGW_MCP_CALLBACK_SIGNING_ISSUER;
+  delete process.env.AGW_CALLBACK_SIGNING_PRIVATE_KEY;
+  delete process.env.AGW_CALLBACK_SIGNING_PUBLIC_KEY;
+  delete process.env.AGW_CALLBACK_SIGNING_ISSUER;
 }
 
 afterEach(() => {
   resetSignerCache();
 
   if (originalPrivateKey !== undefined) {
-    process.env.AGW_MCP_CALLBACK_SIGNING_PRIVATE_KEY = originalPrivateKey;
+    process.env.AGW_CALLBACK_SIGNING_PRIVATE_KEY = originalPrivateKey;
   }
   if (originalPublicKey !== undefined) {
-    process.env.AGW_MCP_CALLBACK_SIGNING_PUBLIC_KEY = originalPublicKey;
+    process.env.AGW_CALLBACK_SIGNING_PUBLIC_KEY = originalPublicKey;
   }
   if (originalIssuer !== undefined) {
-    process.env.AGW_MCP_CALLBACK_SIGNING_ISSUER = originalIssuer;
+    process.env.AGW_CALLBACK_SIGNING_ISSUER = originalIssuer;
   }
 });
 
 describe('callback attestation', () => {
   it('signs and verifies init callback payloads with freshness metadata', () => {
     resetSignerCache();
-    process.env.AGW_MCP_CALLBACK_SIGNING_ISSUER = 'agw-test';
+    process.env.AGW_CALLBACK_SIGNING_ISSUER = 'agw-test';
 
     const payload = buildSignedCallbackPayload({
       version: 2 as const,

app/src/lib/server/callback-attestation.ts

@@ -26,11 +26,11 @@ function encodeBase64Url(input: Buffer | string): string {
 }
 
 function resolveIssuer(): string {
-  return process.env.AGW_MCP_CALLBACK_SIGNING_ISSUER?.trim() || DEFAULT_CALLBACK_ISSUER;
+  return process.env.AGW_CALLBACK_SIGNING_ISSUER?.trim() || DEFAULT_CALLBACK_ISSUER;
 }
 
 function loadConfiguredSigner(): CallbackSigner | null {
-  const privateKeyBase64 = process.env.AGW_MCP_CALLBACK_SIGNING_PRIVATE_KEY?.trim();
+  const privateKeyBase64 = process.env.AGW_CALLBACK_SIGNING_PRIVATE_KEY?.trim();
   if (!privateKeyBase64) {
     return null;
   }
@@ -44,7 +44,7 @@ function loadConfiguredSigner(): CallbackSigner | null {
     format: 'der',
     type: 'spki',
   }).toString('base64');
-  const configuredPublicKey = process.env.AGW_MCP_CALLBACK_SIGNING_PUBLIC_KEY?.trim();
+  const configuredPublicKey = process.env.AGW_CALLBACK_SIGNING_PUBLIC_KEY?.trim();
   if (configuredPublicKey && configuredPublicKey !== publicKeyBase64) {
     throw new Error('Configured callback signing public key does not match the provided private key.');
   }
@@ -87,7 +87,7 @@ function getCallbackSigner(): CallbackSigner {
   }
 
   if (process.env.NODE_ENV === 'production') {
-    throw new Error('Missing AGW_MCP_CALLBACK_SIGNING_PRIVATE_KEY in production environment.');
+    throw new Error('Missing AGW_CALLBACK_SIGNING_PRIVATE_KEY in production environment.');
   }
 
   cachedCallbackSigner = createEphemeralSigner();