@frontmcp/testing 1.3.0 → 1.4.0

package/auth/token-factory.d.ts

@@ -22,6 +22,17 @@ export interface TokenFactoryOptions {
     issuer?: string;
     /** Default audience */
     audience?: string;
+    /**
+     * When set, tokens are HS256-signed with this shared secret instead of an
+     * auto-generated RSA key (the default RS256 + JWKS behaviour). Use this for
+     * GATEWAY-mode servers (auth.mode public/local/orchestrated) that verify
+     * tokens against their own `JWT_SECRET` — sign with the same secret so the
+     * minted tokens are genuinely cryptographically valid (not just decodable).
+     *
+     * Leave unset for TRANSPARENT mode, where the server verifies against the
+     * provider's published JWKS (RS256).
+     */
+    hmacSecret?: string;
 }
 /**
  * Factory for creating JWT tokens for testing
@@ -48,9 +59,21 @@ export declare class TestTokenFactory {
     private publicKey;
     private jwk;
     private keyId;
+    /** HS256 shared secret (gateway mode). Null → RS256 + JWKS (default). */
+    private readonly hmacSecret;
     constructor(options?: TokenFactoryOptions);
+    /** True when this factory signs HS256 with a shared secret (gateway mode). */
+    private get isHmac();
+    /** The JWS `alg` this factory signs with. */
+    private get alg();
+    /**
+     * The signing key: the shared HMAC secret in gateway mode, otherwise the
+     * generated RSA private key (lazily created via ensureKeys()).
+     */
+    private signingKey;
     /**
-     * Initialize the key pair (called automatically on first use)
+     * Initialize the key pair (called automatically on first use). No-op in HS256
+     * mode — there is no asymmetric keypair, just the shared secret.
      */
     private ensureKeys;
     /**
@@ -78,7 +101,10 @@ export declare class TestTokenFactory {
      */
     createTokenWithInvalidSignature(options: Pick<CreateTokenOptions, 'sub'>): string;
     /**
-     * Get the public JWKS for verifying tokens
+     * Get the public JWKS for verifying tokens.
+     *
+     * Only meaningful in RS256 mode — HS256 (gateway) tokens are verified against
+     * the shared secret, not a published public key, so there is no JWKS to serve.
      */
     getPublicJwks(): Promise<{
         keys: JWK[];

package/auth/token-factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-factory.d.ts","sourceRoot":"","sources":["../../src/auth/token-factory.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAwD,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAMtF,MAAM,WAAW,kBAAkB;IACjC,mCAAmC;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,iBAAiB;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,eAAe;IACf,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,mBAAmB;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,yBAAyB;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uBAAuB;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AASD;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,UAAU,CAA8B;IAChD,OAAO,CAAC,SAAS,CAA8B;IAC/C,OAAO,CAAC,GAAG,CAAoB;IAC/B,OAAO,CAAC,KAAK,CAAS;gBAEV,OAAO,GAAE,mBAAwB;IAM7C;;OAEG;YACW,UAAU;IAkBxB;;OAEG;IACG,eAAe,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC;IA2BnE;;OAEG;IACG,gBAAgB,CAAC,GAAG,SAAc,GAAG,OAAO,CAAC,MAAM,CAAC;IAY1D;;OAEG;IACG,eAAe,CAAC,GAAG,SAAa,EAAE,MAAM,WAAoB,GAAG,OAAO,CAAC,MAAM,CAAC;IAYpF;;OAEG;IACG,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC;IAW7C;;OAEG;IACG,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IAwBnF;;OAEG;IACH,+BAA+B,CAAC,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,KAAK,CAAC,GAAG,MAAM;IAqBjF;;OAEG;IACG,aAAa,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE,CAAC;IAU/C;;OAEG;IACH,SAAS,IAAI,MAAM;IAInB;;OAEG;IACH,WAAW,IAAI,MAAM;CAGtB"}
+{"version":3,"file":"token-factory.d.ts","sourceRoot":"","sources":["../../src/auth/token-factory.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAuC,KAAK,GAAG,EAAmB,MAAM,MAAM,CAAC;AAMtF,MAAM,WAAW,kBAAkB;IACjC,mCAAmC;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,iBAAiB;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,eAAe;IACf,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,mBAAmB;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,yBAAyB;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uBAAuB;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AASD;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,UAAU,CAA8B;IAChD,OAAO,CAAC,SAAS,CAA8B;IAC/C,OAAO,CAAC,GAAG,CAAoB;IAC/B,OAAO,CAAC,KAAK,CAAS;IACtB,yEAAyE;IACzE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoB;gBAEnC,OAAO,GAAE,mBAAwB;IAO7C,8EAA8E;IAC9E,OAAO,KAAK,MAAM,GAEjB;IAED,6CAA6C;IAC7C,OAAO,KAAK,GAAG,GAEd;IAED;;;OAGG;IACH,OAAO,CAAC,UAAU;IAQlB;;;OAGG;YACW,UAAU;IAmBxB;;OAEG;IACG,eAAe,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC;IAsBnE;;OAEG;IACG,gBAAgB,CAAC,GAAG,SAAc,GAAG,OAAO,CAAC,MAAM,CAAC;IAY1D;;OAEG;IACG,eAAe,CAAC,GAAG,SAAa,EAAE,MAAM,WAAoB,GAAG,OAAO,CAAC,MAAM,CAAC;IAYpF;;OAEG;IACG,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC;IAW7C;;OAEG;IACG,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IAmBnF;;OAEG;IACH,+BAA+B,CAAC,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,KAAK,CAAC,GAAG,MAAM;IAuBjF;;;;;OAKG;IACG,aAAa,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,GAAG,EAAE,CAAA;KAAE,CAAC;IAa/C;;OAEG;IACH,SAAS,IAAI,MAAM;IAInB;;OAEG;IACH,WAAW,IAAI,MAAM;CAGtB"}

package/esm/fixtures/index.mjs

@@ -7,14 +7,198 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
 
 // libs/testing/src/fixtures/test-fixture.ts
 import {
-  describe as _describe,
+  afterAll as _afterAll,
+  afterEach as _afterEach,
   beforeAll as _beforeAll,
   beforeEach as _beforeEach,
-  afterEach as _afterEach,
-  afterAll as _afterAll,
+  describe as _describe,
   it as _it
 } from "@jest/globals";
 
+// libs/testing/src/auth/token-factory.ts
+import { exportJWK, generateKeyPair, SignJWT } from "jose";
+var TestTokenFactory = class {
+  issuer;
+  audience;
+  privateKey = null;
+  publicKey = null;
+  jwk = null;
+  keyId;
+  /** HS256 shared secret (gateway mode). Null → RS256 + JWKS (default). */
+  hmacSecret;
+  constructor(options = {}) {
+    this.issuer = options.issuer ?? "https://test.frontmcp.local";
+    this.audience = options.audience ?? "frontmcp-test";
+    this.keyId = `test-key-${Date.now()}`;
+    this.hmacSecret = options.hmacSecret ? new TextEncoder().encode(options.hmacSecret) : null;
+  }
+  /** True when this factory signs HS256 with a shared secret (gateway mode). */
+  get isHmac() {
+    return this.hmacSecret !== null;
+  }
+  /** The JWS `alg` this factory signs with. */
+  get alg() {
+    return this.isHmac ? "HS256" : "RS256";
+  }
+  /**
+   * The signing key: the shared HMAC secret in gateway mode, otherwise the
+   * generated RSA private key (lazily created via ensureKeys()).
+   */
+  signingKey() {
+    if (this.hmacSecret) return this.hmacSecret;
+    if (!this.privateKey) {
+      throw new Error("Private key not initialized");
+    }
+    return this.privateKey;
+  }
+  /**
+   * Initialize the key pair (called automatically on first use). No-op in HS256
+   * mode — there is no asymmetric keypair, just the shared secret.
+   */
+  async ensureKeys() {
+    if (this.isHmac) return;
+    if (this.privateKey && this.publicKey) return;
+    const { publicKey, privateKey } = await generateKeyPair("RS256", {
+      extractable: true
+    });
+    this.privateKey = privateKey;
+    this.publicKey = publicKey;
+    this.jwk = await exportJWK(publicKey);
+    this.jwk.kid = this.keyId;
+    this.jwk.use = "sig";
+    this.jwk.alg = "RS256";
+  }
+  /**
+   * Create a JWT token with the specified claims
+   */
+  async createTestToken(options) {
+    await this.ensureKeys();
+    const now = Math.floor(Date.now() / 1e3);
+    const exp = options.exp ?? 3600;
+    const payload = {
+      iss: options.iss ?? this.issuer,
+      sub: options.sub,
+      aud: options.aud ?? this.audience,
+      iat: now,
+      exp: now + exp,
+      scope: options.scopes?.join(" "),
+      ...options.claims
+    };
+    const header = this.isHmac ? { alg: this.alg, typ: "JWT" } : { alg: this.alg, kid: this.keyId };
+    const token = await new SignJWT(payload).setProtectedHeader(header).sign(this.signingKey());
+    return token;
+  }
+  /**
+   * Create an admin token with full access
+   */
+  async createAdminToken(sub = "admin-001") {
+    return this.createTestToken({
+      sub,
+      scopes: ["admin:*", "read", "write", "delete"],
+      claims: {
+        email: "admin@test.local",
+        name: "Test Admin",
+        role: "admin"
+      }
+    });
+  }
+  /**
+   * Create a regular user token
+   */
+  async createUserToken(sub = "user-001", scopes = ["read", "write"]) {
+    return this.createTestToken({
+      sub,
+      scopes,
+      claims: {
+        email: "user@test.local",
+        name: "Test User",
+        role: "user"
+      }
+    });
+  }
+  /**
+   * Create an anonymous user token
+   */
+  async createAnonymousToken() {
+    return this.createTestToken({
+      sub: `anon:${Date.now()}`,
+      scopes: ["anonymous"],
+      claims: {
+        name: "Anonymous",
+        role: "anonymous"
+      }
+    });
+  }
+  /**
+   * Create an expired token (for testing token expiration)
+   */
+  async createExpiredToken(options) {
+    await this.ensureKeys();
+    const now = Math.floor(Date.now() / 1e3);
+    const payload = {
+      iss: this.issuer,
+      sub: options.sub,
+      aud: this.audience,
+      iat: now - 7200,
+      // 2 hours ago
+      exp: now - 3600
+      // Expired 1 hour ago
+    };
+    const header = this.isHmac ? { alg: this.alg, typ: "JWT" } : { alg: this.alg, kid: this.keyId };
+    const token = await new SignJWT(payload).setProtectedHeader(header).sign(this.signingKey());
+    return token;
+  }
+  /**
+   * Create a token with an invalid signature (for testing signature validation)
+   */
+  createTokenWithInvalidSignature(options) {
+    const now = Math.floor(Date.now() / 1e3);
+    const headerObj = this.isHmac ? { alg: this.alg, typ: "JWT" } : { alg: this.alg, kid: this.keyId };
+    const header = Buffer.from(JSON.stringify(headerObj)).toString("base64url");
+    const payload = Buffer.from(
+      JSON.stringify({
+        iss: this.issuer,
+        sub: options.sub,
+        aud: this.audience,
+        iat: now,
+        exp: now + 3600
+      })
+    ).toString("base64url");
+    const signature = Buffer.from("invalid-signature-" + Date.now()).toString("base64url");
+    return `${header}.${payload}.${signature}`;
+  }
+  /**
+   * Get the public JWKS for verifying tokens.
+   *
+   * Only meaningful in RS256 mode — HS256 (gateway) tokens are verified against
+   * the shared secret, not a published public key, so there is no JWKS to serve.
+   */
+  async getPublicJwks() {
+    if (this.isHmac) {
+      throw new Error("getPublicJwks() is not available in HS256 mode (gateway tokens use a shared secret)");
+    }
+    await this.ensureKeys();
+    if (!this.jwk) {
+      throw new Error("JWK not initialized");
+    }
+    return {
+      keys: [this.jwk]
+    };
+  }
+  /**
+   * Get the issuer URL
+   */
+  getIssuer() {
+    return this.issuer;
+  }
+  /**
+   * Get the audience
+   */
+  getAudience() {
+    return this.audience;
+  }
+};
+
 // libs/testing/src/platform/platform-client-info.ts
 var MCP_APPS_EXTENSION_KEY = "io.modelcontextprotocol/ui";
 function getPlatformClientInfo(platform) {
@@ -2085,163 +2269,6 @@ var ProgressCollector = class {
   }
 };
 
-// libs/testing/src/auth/token-factory.ts
-import { SignJWT, generateKeyPair, exportJWK } from "jose";
-var TestTokenFactory = class {
-  issuer;
-  audience;
-  privateKey = null;
-  publicKey = null;
-  jwk = null;
-  keyId;
-  constructor(options = {}) {
-    this.issuer = options.issuer ?? "https://test.frontmcp.local";
-    this.audience = options.audience ?? "frontmcp-test";
-    this.keyId = `test-key-${Date.now()}`;
-  }
-  /**
-   * Initialize the key pair (called automatically on first use)
-   */
-  async ensureKeys() {
-    if (this.privateKey && this.publicKey) return;
-    const { publicKey, privateKey } = await generateKeyPair("RS256", {
-      extractable: true
-    });
-    this.privateKey = privateKey;
-    this.publicKey = publicKey;
-    this.jwk = await exportJWK(publicKey);
-    this.jwk.kid = this.keyId;
-    this.jwk.use = "sig";
-    this.jwk.alg = "RS256";
-  }
-  /**
-   * Create a JWT token with the specified claims
-   */
-  async createTestToken(options) {
-    await this.ensureKeys();
-    const now = Math.floor(Date.now() / 1e3);
-    const exp = options.exp ?? 3600;
-    const payload = {
-      iss: options.iss ?? this.issuer,
-      sub: options.sub,
-      aud: options.aud ?? this.audience,
-      iat: now,
-      exp: now + exp,
-      scope: options.scopes?.join(" "),
-      ...options.claims
-    };
-    if (!this.privateKey) {
-      throw new Error("Private key not initialized");
-    }
-    const token = await new SignJWT(payload).setProtectedHeader({ alg: "RS256", kid: this.keyId }).sign(this.privateKey);
-    return token;
-  }
-  /**
-   * Create an admin token with full access
-   */
-  async createAdminToken(sub = "admin-001") {
-    return this.createTestToken({
-      sub,
-      scopes: ["admin:*", "read", "write", "delete"],
-      claims: {
-        email: "admin@test.local",
-        name: "Test Admin",
-        role: "admin"
-      }
-    });
-  }
-  /**
-   * Create a regular user token
-   */
-  async createUserToken(sub = "user-001", scopes = ["read", "write"]) {
-    return this.createTestToken({
-      sub,
-      scopes,
-      claims: {
-        email: "user@test.local",
-        name: "Test User",
-        role: "user"
-      }
-    });
-  }
-  /**
-   * Create an anonymous user token
-   */
-  async createAnonymousToken() {
-    return this.createTestToken({
-      sub: `anon:${Date.now()}`,
-      scopes: ["anonymous"],
-      claims: {
-        name: "Anonymous",
-        role: "anonymous"
-      }
-    });
-  }
-  /**
-   * Create an expired token (for testing token expiration)
-   */
-  async createExpiredToken(options) {
-    await this.ensureKeys();
-    const now = Math.floor(Date.now() / 1e3);
-    const payload = {
-      iss: this.issuer,
-      sub: options.sub,
-      aud: this.audience,
-      iat: now - 7200,
-      // 2 hours ago
-      exp: now - 3600
-      // Expired 1 hour ago
-    };
-    if (!this.privateKey) {
-      throw new Error("Private key not initialized");
-    }
-    const token = await new SignJWT(payload).setProtectedHeader({ alg: "RS256", kid: this.keyId }).sign(this.privateKey);
-    return token;
-  }
-  /**
-   * Create a token with an invalid signature (for testing signature validation)
-   */
-  createTokenWithInvalidSignature(options) {
-    const now = Math.floor(Date.now() / 1e3);
-    const header = Buffer.from(JSON.stringify({ alg: "RS256", kid: this.keyId })).toString("base64url");
-    const payload = Buffer.from(
-      JSON.stringify({
-        iss: this.issuer,
-        sub: options.sub,
-        aud: this.audience,
-        iat: now,
-        exp: now + 3600
-      })
-    ).toString("base64url");
-    const signature = Buffer.from("invalid-signature-" + Date.now()).toString("base64url");
-    return `${header}.${payload}.${signature}`;
-  }
-  /**
-   * Get the public JWKS for verifying tokens
-   */
-  async getPublicJwks() {
-    await this.ensureKeys();
-    if (!this.jwk) {
-      throw new Error("JWK not initialized");
-    }
-    return {
-      keys: [this.jwk]
-    };
-  }
-  /**
-   * Get the issuer URL
-   */
-  getIssuer() {
-    return this.issuer;
-  }
-  /**
-   * Get the audience
-   */
-  getAudience() {
-    return this.audience;
-  }
-};
-
 // libs/testing/src/server/test-server.ts
 import { spawn } from "child_process";
 import { sha256Hex } from "@frontmcp/utils";
@@ -2281,6 +2308,7 @@ var E2E_PORT_RANGES = {
   "demo-e2e-orchestrated": { start: 50100, size: 10 },
   "demo-e2e-transparent": { start: 50110, size: 10 },
   "demo-e2e-cimd": { start: 50120, size: 10 },
+  "demo-e2e-remote-proxy": { start: 50130, size: 10 },
   // Feature E2E tests (50200-50299)
   "demo-e2e-skills": { start: 50200, size: 10 },
   "demo-e2e-remote": { start: 50210, size: 10 },
@@ -2955,7 +2983,8 @@ var tokenFactory = null;
 var serverStartedByUs = false;
 async function initializeSharedResources() {
   if (!tokenFactory) {
-    tokenFactory = new TestTokenFactory();
+    const sharedSecret = currentConfig.env?.["JWT_SECRET"];
+    tokenFactory = new TestTokenFactory(sharedSecret ? { hmacSecret: sharedSecret } : {});
   }
   if (!serverInstance) {
     if (currentConfig.baseUrl) {

package/esm/index.mjs

@@ -2159,7 +2159,7 @@ var ProgressCollector = class {
 };
 
 // libs/testing/src/auth/token-factory.ts
-import { SignJWT, generateKeyPair, exportJWK } from "jose";
+import { exportJWK, generateKeyPair, SignJWT } from "jose";
 var TestTokenFactory = class {
   issuer;
   audience;
@@ -2167,15 +2167,39 @@ var TestTokenFactory = class {
   publicKey = null;
   jwk = null;
   keyId;
+  /** HS256 shared secret (gateway mode). Null → RS256 + JWKS (default). */
+  hmacSecret;
   constructor(options = {}) {
     this.issuer = options.issuer ?? "https://test.frontmcp.local";
     this.audience = options.audience ?? "frontmcp-test";
     this.keyId = `test-key-${Date.now()}`;
+    this.hmacSecret = options.hmacSecret ? new TextEncoder().encode(options.hmacSecret) : null;
+  }
+  /** True when this factory signs HS256 with a shared secret (gateway mode). */
+  get isHmac() {
+    return this.hmacSecret !== null;
+  }
+  /** The JWS `alg` this factory signs with. */
+  get alg() {
+    return this.isHmac ? "HS256" : "RS256";
+  }
+  /**
+   * The signing key: the shared HMAC secret in gateway mode, otherwise the
+   * generated RSA private key (lazily created via ensureKeys()).
+   */
+  signingKey() {
+    if (this.hmacSecret) return this.hmacSecret;
+    if (!this.privateKey) {
+      throw new Error("Private key not initialized");
+    }
+    return this.privateKey;
   }
   /**
-   * Initialize the key pair (called automatically on first use)
+   * Initialize the key pair (called automatically on first use). No-op in HS256
+   * mode — there is no asymmetric keypair, just the shared secret.
    */
   async ensureKeys() {
+    if (this.isHmac) return;
     if (this.privateKey && this.publicKey) return;
     const { publicKey, privateKey } = await generateKeyPair("RS256", {
       extractable: true
@@ -2203,10 +2227,8 @@ var TestTokenFactory = class {
       scope: options.scopes?.join(" "),
       ...options.claims
     };
-    if (!this.privateKey) {
-      throw new Error("Private key not initialized");
-    }
-    const token = await new SignJWT(payload).setProtectedHeader({ alg: "RS256", kid: this.keyId }).sign(this.privateKey);
+    const header = this.isHmac ? { alg: this.alg, typ: "JWT" } : { alg: this.alg, kid: this.keyId };
+    const token = await new SignJWT(payload).setProtectedHeader(header).sign(this.signingKey());
     return token;
   }
   /**
@@ -2265,10 +2287,8 @@ var TestTokenFactory = class {
       exp: now - 3600
       // Expired 1 hour ago
     };
-    if (!this.privateKey) {
-      throw new Error("Private key not initialized");
-    }
-    const token = await new SignJWT(payload).setProtectedHeader({ alg: "RS256", kid: this.keyId }).sign(this.privateKey);
+    const header = this.isHmac ? { alg: this.alg, typ: "JWT" } : { alg: this.alg, kid: this.keyId };
+    const token = await new SignJWT(payload).setProtectedHeader(header).sign(this.signingKey());
     return token;
   }
   /**
@@ -2276,7 +2296,8 @@ var TestTokenFactory = class {
    */
   createTokenWithInvalidSignature(options) {
     const now = Math.floor(Date.now() / 1e3);
-    const header = Buffer.from(JSON.stringify({ alg: "RS256", kid: this.keyId })).toString("base64url");
+    const headerObj = this.isHmac ? { alg: this.alg, typ: "JWT" } : { alg: this.alg, kid: this.keyId };
+    const header = Buffer.from(JSON.stringify(headerObj)).toString("base64url");
     const payload = Buffer.from(
       JSON.stringify({
         iss: this.issuer,
@@ -2290,9 +2311,15 @@ var TestTokenFactory = class {
     return `${header}.${payload}.${signature}`;
   }
   /**
-   * Get the public JWKS for verifying tokens
+   * Get the public JWKS for verifying tokens.
+   *
+   * Only meaningful in RS256 mode — HS256 (gateway) tokens are verified against
+   * the shared secret, not a published public key, so there is no JWKS to serve.
    */
   async getPublicJwks() {
+    if (this.isHmac) {
+      throw new Error("getPublicJwks() is not available in HS256 mode (gateway tokens use a shared secret)");
+    }
     await this.ensureKeys();
     if (!this.jwk) {
       throw new Error("JWK not initialized");
@@ -3888,6 +3915,7 @@ var E2E_PORT_RANGES = {
   "demo-e2e-orchestrated": { start: 50100, size: 10 },
   "demo-e2e-transparent": { start: 50110, size: 10 },
   "demo-e2e-cimd": { start: 50120, size: 10 },
+  "demo-e2e-remote-proxy": { start: 50130, size: 10 },
   // Feature E2E tests (50200-50299)
   "demo-e2e-skills": { start: 50200, size: 10 },
   "demo-e2e-remote": { start: 50210, size: 10 },
@@ -4716,11 +4744,11 @@ function hasMimeType(result, mimeType) {
 
 // libs/testing/src/fixtures/test-fixture.ts
 import {
-  describe as _describe,
+  afterAll as _afterAll,
+  afterEach as _afterEach,
   beforeAll as _beforeAll,
   beforeEach as _beforeEach,
-  afterEach as _afterEach,
-  afterAll as _afterAll,
+  describe as _describe,
   it as _it
 } from "@jest/globals";
 var describe2 = _describe;
@@ -4735,7 +4763,8 @@ var tokenFactory = null;
 var serverStartedByUs = false;
 async function initializeSharedResources() {
   if (!tokenFactory) {
-    tokenFactory = new TestTokenFactory();
+    const sharedSecret = currentConfig.env?.["JWT_SECRET"];
+    tokenFactory = new TestTokenFactory(sharedSecret ? { hmacSecret: sharedSecret } : {});
   }
   if (!serverInstance) {
     if (currentConfig.baseUrl) {
@@ -7981,6 +8010,26 @@ function createReportGenerator() {
 // libs/testing/src/raw-client/index.ts
 import { Client } from "@frontmcp/protocol";
 import { StdioClientTransport } from "@frontmcp/protocol";
+
+// libs/testing/src/raw-client/port-probe.ts
+import net from "node:net";
+function isTcpPortListening(port, host = "127.0.0.1", timeoutMs = 1500) {
+  return new Promise((resolve) => {
+    const socket = net.connect({ port, host });
+    socket.unref();
+    socket.setTimeout(timeoutMs);
+    let settled = false;
+    const finish = (listening) => {
+      if (settled) return;
+      settled = true;
+      socket.destroy();
+      resolve(listening);
+    };
+    socket.once("connect", () => finish(true));
+    socket.once("error", () => finish(false));
+    socket.once("timeout", () => finish(false));
+  });
+}
 export {
   AssertionError,
   AuthHeaders,
@@ -8063,6 +8112,7 @@ export {
   isGcAvailable,
   isOpenAIPlatform,
   isSuccessful,
+  isTcpPortListening,
   isUiPlatform,
   mcpMatchers,
   mockResponse,

package/esm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/testing",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "E2E testing framework for FrontMCP servers - MCP client, auth mocks, Playwright integration",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://docs.agentfront.dev",
@@ -87,12 +87,12 @@
     "./esm": null
   },
   "peerDependencies": {
-    "@frontmcp/sdk": "1.3.0",
-    "@frontmcp/ui": "1.3.0",
+    "@frontmcp/sdk": "1.4.0",
+    "@frontmcp/ui": "1.4.0",
     "@playwright/test": "^1.40.0",
     "jest": "^29.0.0 || ^30.0.0",
     "@jest/globals": "^29.0.0 || ^30.0.0",
-    "@frontmcp/lazy-zod": "1.3.0"
+    "@frontmcp/lazy-zod": "1.4.0"
   },
   "peerDependenciesMeta": {
     "@frontmcp/ui": {
@@ -112,8 +112,8 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@frontmcp/utils": "1.3.0",
-    "@frontmcp/protocol": "1.3.0",
+    "@frontmcp/utils": "1.4.0",
+    "@frontmcp/protocol": "1.4.0",
     "jose": "^6.0.11",
     "tslib": "^2.3.0"
   },