@frontmcp/testing 1.3.0 → 1.4.1

package/esm/perf/index.mjs

@@ -2841,7 +2841,7 @@ var ProgressCollector = class {
 };
 
 // libs/testing/src/auth/token-factory.ts
-import { SignJWT, generateKeyPair, exportJWK } from "jose";
+import { exportJWK, generateKeyPair, SignJWT } from "jose";
 var TestTokenFactory = class {
   issuer;
   audience;
@@ -2849,15 +2849,39 @@ var TestTokenFactory = class {
   publicKey = null;
   jwk = null;
   keyId;
+  /** HS256 shared secret (gateway mode). Null → RS256 + JWKS (default). */
+  hmacSecret;
   constructor(options = {}) {
     this.issuer = options.issuer ?? "https://test.frontmcp.local";
     this.audience = options.audience ?? "frontmcp-test";
     this.keyId = `test-key-${Date.now()}`;
+    this.hmacSecret = options.hmacSecret ? new TextEncoder().encode(options.hmacSecret) : null;
+  }
+  /** True when this factory signs HS256 with a shared secret (gateway mode). */
+  get isHmac() {
+    return this.hmacSecret !== null;
+  }
+  /** The JWS `alg` this factory signs with. */
+  get alg() {
+    return this.isHmac ? "HS256" : "RS256";
+  }
+  /**
+   * The signing key: the shared HMAC secret in gateway mode, otherwise the
+   * generated RSA private key (lazily created via ensureKeys()).
+   */
+  signingKey() {
+    if (this.hmacSecret) return this.hmacSecret;
+    if (!this.privateKey) {
+      throw new Error("Private key not initialized");
+    }
+    return this.privateKey;
   }
   /**
-   * Initialize the key pair (called automatically on first use)
+   * Initialize the key pair (called automatically on first use). No-op in HS256
+   * mode — there is no asymmetric keypair, just the shared secret.
    */
   async ensureKeys() {
+    if (this.isHmac) return;
     if (this.privateKey && this.publicKey) return;
     const { publicKey, privateKey } = await generateKeyPair("RS256", {
       extractable: true
@@ -2885,10 +2909,8 @@ var TestTokenFactory = class {
       scope: options.scopes?.join(" "),
       ...options.claims
     };
-    if (!this.privateKey) {
-      throw new Error("Private key not initialized");
-    }
-    const token = await new SignJWT(payload).setProtectedHeader({ alg: "RS256", kid: this.keyId }).sign(this.privateKey);
+    const header = this.isHmac ? { alg: this.alg, typ: "JWT" } : { alg: this.alg, kid: this.keyId };
+    const token = await new SignJWT(payload).setProtectedHeader(header).sign(this.signingKey());
     return token;
   }
   /**
@@ -2947,10 +2969,8 @@ var TestTokenFactory = class {
       exp: now - 3600
       // Expired 1 hour ago
     };
-    if (!this.privateKey) {
-      throw new Error("Private key not initialized");
-    }
-    const token = await new SignJWT(payload).setProtectedHeader({ alg: "RS256", kid: this.keyId }).sign(this.privateKey);
+    const header = this.isHmac ? { alg: this.alg, typ: "JWT" } : { alg: this.alg, kid: this.keyId };
+    const token = await new SignJWT(payload).setProtectedHeader(header).sign(this.signingKey());
     return token;
   }
   /**
@@ -2958,7 +2978,8 @@ var TestTokenFactory = class {
    */
   createTokenWithInvalidSignature(options) {
     const now = Math.floor(Date.now() / 1e3);
-    const header = Buffer.from(JSON.stringify({ alg: "RS256", kid: this.keyId })).toString("base64url");
+    const headerObj = this.isHmac ? { alg: this.alg, typ: "JWT" } : { alg: this.alg, kid: this.keyId };
+    const header = Buffer.from(JSON.stringify(headerObj)).toString("base64url");
     const payload = Buffer.from(
       JSON.stringify({
         iss: this.issuer,
@@ -2972,9 +2993,15 @@ var TestTokenFactory = class {
     return `${header}.${payload}.${signature}`;
   }
   /**
-   * Get the public JWKS for verifying tokens
+   * Get the public JWKS for verifying tokens.
+   *
+   * Only meaningful in RS256 mode — HS256 (gateway) tokens are verified against
+   * the shared secret, not a published public key, so there is no JWKS to serve.
    */
   async getPublicJwks() {
+    if (this.isHmac) {
+      throw new Error("getPublicJwks() is not available in HS256 mode (gateway tokens use a shared secret)");
+    }
     await this.ensureKeys();
     if (!this.jwk) {
       throw new Error("JWK not initialized");
@@ -3036,6 +3063,7 @@ var E2E_PORT_RANGES = {
   "demo-e2e-orchestrated": { start: 50100, size: 10 },
   "demo-e2e-transparent": { start: 50110, size: 10 },
   "demo-e2e-cimd": { start: 50120, size: 10 },
+  "demo-e2e-remote-proxy": { start: 50130, size: 10 },
   // Feature E2E tests (50200-50299)
   "demo-e2e-skills": { start: 50200, size: 10 },
   "demo-e2e-remote": { start: 50210, size: 10 },

package/fixtures/index.js

@@ -31,6 +31,190 @@ module.exports = __toCommonJS(fixtures_exports);
 // libs/testing/src/fixtures/test-fixture.ts
 var import_globals = require("@jest/globals");
 
+// libs/testing/src/auth/token-factory.ts
+var import_jose = require("jose");
+var TestTokenFactory = class {
+  issuer;
+  audience;
+  privateKey = null;
+  publicKey = null;
+  jwk = null;
+  keyId;
+  /** HS256 shared secret (gateway mode). Null → RS256 + JWKS (default). */
+  hmacSecret;
+  constructor(options = {}) {
+    this.issuer = options.issuer ?? "https://test.frontmcp.local";
+    this.audience = options.audience ?? "frontmcp-test";
+    this.keyId = `test-key-${Date.now()}`;
+    this.hmacSecret = options.hmacSecret ? new TextEncoder().encode(options.hmacSecret) : null;
+  }
+  /** True when this factory signs HS256 with a shared secret (gateway mode). */
+  get isHmac() {
+    return this.hmacSecret !== null;
+  }
+  /** The JWS `alg` this factory signs with. */
+  get alg() {
+    return this.isHmac ? "HS256" : "RS256";
+  }
+  /**
+   * The signing key: the shared HMAC secret in gateway mode, otherwise the
+   * generated RSA private key (lazily created via ensureKeys()).
+   */
+  signingKey() {
+    if (this.hmacSecret) return this.hmacSecret;
+    if (!this.privateKey) {
+      throw new Error("Private key not initialized");
+    }
+    return this.privateKey;
+  }
+  /**
+   * Initialize the key pair (called automatically on first use). No-op in HS256
+   * mode — there is no asymmetric keypair, just the shared secret.
+   */
+  async ensureKeys() {
+    if (this.isHmac) return;
+    if (this.privateKey && this.publicKey) return;
+    const { publicKey, privateKey } = await (0, import_jose.generateKeyPair)("RS256", {
+      extractable: true
+    });
+    this.privateKey = privateKey;
+    this.publicKey = publicKey;
+    this.jwk = await (0, import_jose.exportJWK)(publicKey);
+    this.jwk.kid = this.keyId;
+    this.jwk.use = "sig";
+    this.jwk.alg = "RS256";
+  }
+  /**
+   * Create a JWT token with the specified claims
+   */
+  async createTestToken(options) {
+    await this.ensureKeys();
+    const now = Math.floor(Date.now() / 1e3);
+    const exp = options.exp ?? 3600;
+    const payload = {
+      iss: options.iss ?? this.issuer,
+      sub: options.sub,
+      aud: options.aud ?? this.audience,
+      iat: now,
+      exp: now + exp,
+      scope: options.scopes?.join(" "),
+      ...options.claims
+    };
+    const header = this.isHmac ? { alg: this.alg, typ: "JWT" } : { alg: this.alg, kid: this.keyId };
+    const token = await new import_jose.SignJWT(payload).setProtectedHeader(header).sign(this.signingKey());
+    return token;
+  }
+  /**
+   * Create an admin token with full access
+   */
+  async createAdminToken(sub = "admin-001") {
+    return this.createTestToken({
+      sub,
+      scopes: ["admin:*", "read", "write", "delete"],
+      claims: {
+        email: "admin@test.local",
+        name: "Test Admin",
+        role: "admin"
+      }
+    });
+  }
+  /**
+   * Create a regular user token
+   */
+  async createUserToken(sub = "user-001", scopes = ["read", "write"]) {
+    return this.createTestToken({
+      sub,
+      scopes,
+      claims: {
+        email: "user@test.local",
+        name: "Test User",
+        role: "user"
+      }
+    });
+  }
+  /**
+   * Create an anonymous user token
+   */
+  async createAnonymousToken() {
+    return this.createTestToken({
+      sub: `anon:${Date.now()}`,
+      scopes: ["anonymous"],
+      claims: {
+        name: "Anonymous",
+        role: "anonymous"
+      }
+    });
+  }
+  /**
+   * Create an expired token (for testing token expiration)
+   */
+  async createExpiredToken(options) {
+    await this.ensureKeys();
+    const now = Math.floor(Date.now() / 1e3);
+    const payload = {
+      iss: this.issuer,
+      sub: options.sub,
+      aud: this.audience,
+      iat: now - 7200,
+      // 2 hours ago
+      exp: now - 3600
+      // Expired 1 hour ago
+    };
+    const header = this.isHmac ? { alg: this.alg, typ: "JWT" } : { alg: this.alg, kid: this.keyId };
+    const token = await new import_jose.SignJWT(payload).setProtectedHeader(header).sign(this.signingKey());
+    return token;
+  }
+  /**
+   * Create a token with an invalid signature (for testing signature validation)
+   */
+  createTokenWithInvalidSignature(options) {
+    const now = Math.floor(Date.now() / 1e3);
+    const headerObj = this.isHmac ? { alg: this.alg, typ: "JWT" } : { alg: this.alg, kid: this.keyId };
+    const header = Buffer.from(JSON.stringify(headerObj)).toString("base64url");
+    const payload = Buffer.from(
+      JSON.stringify({
+        iss: this.issuer,
+        sub: options.sub,
+        aud: this.audience,
+        iat: now,
+        exp: now + 3600
+      })
+    ).toString("base64url");
+    const signature = Buffer.from("invalid-signature-" + Date.now()).toString("base64url");
+    return `${header}.${payload}.${signature}`;
+  }
+  /**
+   * Get the public JWKS for verifying tokens.
+   *
+   * Only meaningful in RS256 mode — HS256 (gateway) tokens are verified against
+   * the shared secret, not a published public key, so there is no JWKS to serve.
+   */
+  async getPublicJwks() {
+    if (this.isHmac) {
+      throw new Error("getPublicJwks() is not available in HS256 mode (gateway tokens use a shared secret)");
+    }
+    await this.ensureKeys();
+    if (!this.jwk) {
+      throw new Error("JWK not initialized");
+    }
+    return {
+      keys: [this.jwk]
+    };
+  }
+  /**
+   * Get the issuer URL
+   */
+  getIssuer() {
+    return this.issuer;
+  }
+  /**
+   * Get the audience
+   */
+  getAudience() {
+    return this.audience;
+  }
+};
+
 // libs/testing/src/platform/platform-client-info.ts
 var MCP_APPS_EXTENSION_KEY = "io.modelcontextprotocol/ui";
 function getPlatformClientInfo(platform) {
@@ -2101,163 +2285,6 @@ var ProgressCollector = class {
   }
 };
 
-// libs/testing/src/auth/token-factory.ts
-var import_jose = require("jose");
-var TestTokenFactory = class {
-  issuer;
-  audience;
-  privateKey = null;
-  publicKey = null;
-  jwk = null;
-  keyId;
-  constructor(options = {}) {
-    this.issuer = options.issuer ?? "https://test.frontmcp.local";
-    this.audience = options.audience ?? "frontmcp-test";
-    this.keyId = `test-key-${Date.now()}`;
-  }
-  /**
-   * Initialize the key pair (called automatically on first use)
-   */
-  async ensureKeys() {
-    if (this.privateKey && this.publicKey) return;
-    const { publicKey, privateKey } = await (0, import_jose.generateKeyPair)("RS256", {
-      extractable: true
-    });
-    this.privateKey = privateKey;
-    this.publicKey = publicKey;
-    this.jwk = await (0, import_jose.exportJWK)(publicKey);
-    this.jwk.kid = this.keyId;
-    this.jwk.use = "sig";
-    this.jwk.alg = "RS256";
-  }
-  /**
-   * Create a JWT token with the specified claims
-   */
-  async createTestToken(options) {
-    await this.ensureKeys();
-    const now = Math.floor(Date.now() / 1e3);
-    const exp = options.exp ?? 3600;
-    const payload = {
-      iss: options.iss ?? this.issuer,
-      sub: options.sub,
-      aud: options.aud ?? this.audience,
-      iat: now,
-      exp: now + exp,
-      scope: options.scopes?.join(" "),
-      ...options.claims
-    };
-    if (!this.privateKey) {
-      throw new Error("Private key not initialized");
-    }
-    const token = await new import_jose.SignJWT(payload).setProtectedHeader({ alg: "RS256", kid: this.keyId }).sign(this.privateKey);
-    return token;
-  }
-  /**
-   * Create an admin token with full access
-   */
-  async createAdminToken(sub = "admin-001") {
-    return this.createTestToken({
-      sub,
-      scopes: ["admin:*", "read", "write", "delete"],
-      claims: {
-        email: "admin@test.local",
-        name: "Test Admin",
-        role: "admin"
-      }
-    });
-  }
-  /**
-   * Create a regular user token
-   */
-  async createUserToken(sub = "user-001", scopes = ["read", "write"]) {
-    return this.createTestToken({
-      sub,
-      scopes,
-      claims: {
-        email: "user@test.local",
-        name: "Test User",
-        role: "user"
-      }
-    });
-  }
-  /**
-   * Create an anonymous user token
-   */
-  async createAnonymousToken() {
-    return this.createTestToken({
-      sub: `anon:${Date.now()}`,
-      scopes: ["anonymous"],
-      claims: {
-        name: "Anonymous",
-        role: "anonymous"
-      }
-    });
-  }
-  /**
-   * Create an expired token (for testing token expiration)
-   */
-  async createExpiredToken(options) {
-    await this.ensureKeys();
-    const now = Math.floor(Date.now() / 1e3);
-    const payload = {
-      iss: this.issuer,
-      sub: options.sub,
-      aud: this.audience,
-      iat: now - 7200,
-      // 2 hours ago
-      exp: now - 3600
-      // Expired 1 hour ago
-    };
-    if (!this.privateKey) {
-      throw new Error("Private key not initialized");
-    }
-    const token = await new import_jose.SignJWT(payload).setProtectedHeader({ alg: "RS256", kid: this.keyId }).sign(this.privateKey);
-    return token;
-  }
-  /**
-   * Create a token with an invalid signature (for testing signature validation)
-   */
-  createTokenWithInvalidSignature(options) {
-    const now = Math.floor(Date.now() / 1e3);
-    const header = Buffer.from(JSON.stringify({ alg: "RS256", kid: this.keyId })).toString("base64url");
-    const payload = Buffer.from(
-      JSON.stringify({
-        iss: this.issuer,
-        sub: options.sub,
-        aud: this.audience,
-        iat: now,
-        exp: now + 3600
-      })
-    ).toString("base64url");
-    const signature = Buffer.from("invalid-signature-" + Date.now()).toString("base64url");
-    return `${header}.${payload}.${signature}`;
-  }
-  /**
-   * Get the public JWKS for verifying tokens
-   */
-  async getPublicJwks() {
-    await this.ensureKeys();
-    if (!this.jwk) {
-      throw new Error("JWK not initialized");
-    }
-    return {
-      keys: [this.jwk]
-    };
-  }
-  /**
-   * Get the issuer URL
-   */
-  getIssuer() {
-    return this.issuer;
-  }
-  /**
-   * Get the audience
-   */
-  getAudience() {
-    return this.audience;
-  }
-};
-
 // libs/testing/src/server/test-server.ts
 var import_child_process = require("child_process");
 var import_utils = require("@frontmcp/utils");
@@ -2297,6 +2324,7 @@ var E2E_PORT_RANGES = {
   "demo-e2e-orchestrated": { start: 50100, size: 10 },
   "demo-e2e-transparent": { start: 50110, size: 10 },
   "demo-e2e-cimd": { start: 50120, size: 10 },
+  "demo-e2e-remote-proxy": { start: 50130, size: 10 },
   // Feature E2E tests (50200-50299)
   "demo-e2e-skills": { start: 50200, size: 10 },
   "demo-e2e-remote": { start: 50210, size: 10 },
@@ -2971,7 +2999,8 @@ var tokenFactory = null;
 var serverStartedByUs = false;
 async function initializeSharedResources() {
   if (!tokenFactory) {
-    tokenFactory = new TestTokenFactory();
+    const sharedSecret = currentConfig.env?.["JWT_SECRET"];
+    tokenFactory = new TestTokenFactory(sharedSecret ? { hmacSecret: sharedSecret } : {});
   }
   if (!serverInstance) {
     if (currentConfig.baseUrl) {

package/fixtures/test-fixture.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"test-fixture.d.ts","sourceRoot":"","sources":["../../src/fixtures/test-fixture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAwBH,OAAO,KAAK,EAEV,YAAY,EAIZ,gBAAgB,EAEjB,MAAM,iBAAiB,CAAC;AAsBzB;;GAEG;AACH,iBAAe,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC,CAqDxD;AAED;;GAEG;AACH,iBAAe,kBAAkB,IAAI,OAAO,CAAC,YAAY,CAAC,CA6BzD;AAED;;;;GAIG;AACH,iBAAe,mBAAmB,CAAC,QAAQ,EAAE,YAAY,EAAE,UAAU,UAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAoB5F;AAED;;GAEG;AACH,iBAAe,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAQrD;AAmMD,QAAA,MAAM,IAAI,EAAuB,gBAAgB,CAAC;AAqBlD,OAAO,EAAE,IAAI,EAAE,CAAC;AAGhB,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,CAAC"}
+{"version":3,"file":"test-fixture.d.ts","sourceRoot":"","sources":["../../src/fixtures/test-fixture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAeH,OAAO,KAAK,EAIV,YAAY,EAGZ,gBAAgB,EACjB,MAAM,iBAAiB,CAAC;AA+BzB;;GAEG;AACH,iBAAe,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC,CA6DxD;AAED;;GAEG;AACH,iBAAe,kBAAkB,IAAI,OAAO,CAAC,YAAY,CAAC,CA6BzD;AAED;;;;GAIG;AACH,iBAAe,mBAAmB,CAAC,QAAQ,EAAE,YAAY,EAAE,UAAU,UAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAoB5F;AAED;;GAEG;AACH,iBAAe,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAQrD;AAmMD,QAAA,MAAM,IAAI,EAAuB,gBAAgB,CAAC;AAqBlD,OAAO,EAAE,IAAI,EAAE,CAAC;AAGhB,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,CAAC"}

package/index.d.ts

@@ -73,6 +73,6 @@ export type { TestPlatformType, PlatformMetaNamespace, TestClientInfo } from './
 export { getPlatformMetaNamespace, getPlatformMimeType, isOpenAIPlatform, isExtAppsPlatform, isUiPlatform, getToolsListMetaPrefixes, getToolCallMetaPrefixes, getForbiddenMetaPrefixes, getPlatformClientInfo, buildUserAgent, getPlatformUserAgent, PLATFORM_DETECTION_PATTERNS, } from './platform';
 export { BASIC_UI_TOOL_CONFIG, FULL_UI_TOOL_CONFIG, basicUIToolInputSchema, basicUIToolOutputSchema, fullUIToolInputSchema, fullUIToolOutputSchema, generateBasicUIToolOutput, generateFullUIToolOutput, EXPECTED_OPENAI_TOOLS_LIST_META_KEYS, EXPECTED_OPENAI_TOOL_CALL_META_KEYS, EXPECTED_EXTAPPS_TOOLS_LIST_META_KEYS, EXPECTED_EXTAPPS_TOOL_CALL_META_KEYS, EXPECTED_GENERIC_TOOLS_LIST_META_KEYS, EXPECTED_GENERIC_TOOL_CALL_META_KEYS, } from './example-tools';
 export { perfTest, MetricsCollector, isGcAvailable, forceGc, forceFullGc, formatBytes, formatMicroseconds, formatDuration, LeakDetector, assertNoLeak, createLeakDetector, createPerfFixtures, PerfFixturesImpl, getGlobalMeasurements, clearGlobalMeasurements, BaselineStore, parseBaselineFromComment, formatBaselineAsComment, getBaselineStore, RegressionDetector, summarizeRegressions, getRegressionDetector, ReportGenerator, saveReports, createReportGenerator, } from './perf';
-export { McpClient, McpStdioClientTransport } from './raw-client';
+export { McpClient, McpStdioClientTransport, isTcpPortListening } from './raw-client';
 export type { MemoryMetrics, CpuMetrics, PerfSnapshot, PerfMeasurement, PerfIssue, PerfThresholds, LeakDetectionOptions, LeakDetectionResult, MetricBaseline, TestBaseline, PerfBaseline, RegressionConfig, MetricRegression, RegressionResult, PerfTestSummary, ProjectSummary, PerfReport, PerfFixtures, PerfTestFixtures, PerfTestConfig, PerfTestFn, PerfTestWithFixtures, } from './perf';
 //# sourceMappingURL=index.d.ts.map

package/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAMH,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,YAAY,EACV,mBAAmB,EACnB,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,EACnB,QAAQ,EACR,QAAQ,EACR,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,WAAW,EACX,SAAS,GACV,MAAM,gCAAgC,CAAC;AAMxC,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACrG,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAMhF,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AACpF,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACjE,YAAY,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,YAAY,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC1G,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,YAAY,EACV,oBAAoB,EACpB,iBAAiB,EACjB,SAAS,EACT,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,YAAY,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAMhH,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAM9E,OAAO,EACL,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,wBAAwB,EACxB,cAAc,EACd,YAAY,EACZ,OAAO,EACP,cAAc,EACd,WAAW,GACZ,MAAM,6BAA6B,CAAC;AAMrC,OAAO,EACL,eAAe,EACf,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,GACf,MAAM,gBAAgB,CAAC;AAMxB,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,kBAAkB,EAClB,2BAA2B,EAC3B,iBAAiB,EACjB,eAAe,EACf,IAAI,EACJ,QAAQ,EACR,gBAAgB,EAChB,MAAM,EAEN,cAAc,EACd,eAAe,GAChB,MAAM,gCAAgC,CAAC;AAMxC,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAClC,YAAY,EACV,UAAU,EACV,YAAY,EACZ,WAAW,EACX,aAAa,EACb,MAAM,EACN,gBAAgB,EAChB,QAAQ,GACT,MAAM,YAAY,CAAC;AAQpB,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAMlC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAM9C,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAEzG,YAAY,EACV,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,0BAA0B,EAC1B,yBAAyB,EACzB,mBAAmB,EACnB,cAAc,EACd,YAAY,EACZ,UAAU,EACV,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAMvB,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAErD,YAAY,EACV,UAAU,EACV,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,eAAe,EACf,eAAe,GAChB,MAAM,aAAa,CAAC;AAMrB,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,MAAM,CAAC;AAMhD,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE1F,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EACxB,qBAAqB,EACrB,cAAc,EACd,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,YAAY,CAAC;AAMpB,OAAO,EAEL,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EAEtB,yBAAyB,EACzB,wBAAwB,EAExB,oCAAoC,EACpC,mCAAmC,EACnC,qCAAqC,EACrC,oCAAoC,EACpC,qCAAqC,EACrC,oCAAoC,GACrC,MAAM,iBAAiB,CAAC;AAMzB,OAAO,EAEL,QAAQ,EAGR,gBAAgB,EAChB,aAAa,EACb,OAAO,EACP,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,cAAc,EAGd,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAGlB,kBAAkB,EAClB,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EAGvB,aAAa,EACb,wBAAwB,EACxB,uBAAuB,EACvB,gBAAgB,EAGhB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EAGrB,eAAe,EACf,WAAW,EACX,qBAAqB,GACtB,MAAM,QAAQ,CAAC;AAMhB,OAAO,EAAE,SAAS,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAElE,YAAY,EAEV,aAAa,EACb,UAAU,EACV,YAAY,EAGZ,eAAe,EACf,SAAS,EACT,cAAc,EAGd,oBAAoB,EACpB,mBAAmB,EAGnB,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAGhB,eAAe,EACf,cAAc,EACd,UAAU,EAGV,YAAY,EACZ,gBAAgB,EAChB,cAAc,EACd,UAAU,EACV,oBAAoB,GACrB,MAAM,QAAQ,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAMH,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,YAAY,EACV,mBAAmB,EACnB,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,EACnB,QAAQ,EACR,QAAQ,EACR,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,WAAW,EACX,SAAS,GACV,MAAM,gCAAgC,CAAC;AAMxC,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACrG,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAMhF,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AACpF,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACjE,YAAY,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,YAAY,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC1G,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,YAAY,EACV,oBAAoB,EACpB,iBAAiB,EACjB,SAAS,EACT,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,YAAY,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAMhH,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAM9E,OAAO,EACL,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,wBAAwB,EACxB,cAAc,EACd,YAAY,EACZ,OAAO,EACP,cAAc,EACd,WAAW,GACZ,MAAM,6BAA6B,CAAC;AAMrC,OAAO,EACL,eAAe,EACf,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,GACf,MAAM,gBAAgB,CAAC;AAMxB,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,kBAAkB,EAClB,2BAA2B,EAC3B,iBAAiB,EACjB,eAAe,EACf,IAAI,EACJ,QAAQ,EACR,gBAAgB,EAChB,MAAM,EAEN,cAAc,EACd,eAAe,GAChB,MAAM,gCAAgC,CAAC;AAMxC,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAClC,YAAY,EACV,UAAU,EACV,YAAY,EACZ,WAAW,EACX,aAAa,EACb,MAAM,EACN,gBAAgB,EAChB,QAAQ,GACT,MAAM,YAAY,CAAC;AAQpB,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAMlC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAM9C,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAEzG,YAAY,EACV,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,0BAA0B,EAC1B,yBAAyB,EACzB,mBAAmB,EACnB,cAAc,EACd,YAAY,EACZ,UAAU,EACV,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAMvB,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAErD,YAAY,EACV,UAAU,EACV,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,eAAe,EACf,eAAe,GAChB,MAAM,aAAa,CAAC;AAMrB,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,MAAM,CAAC;AAMhD,YAAY,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE1F,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EACxB,qBAAqB,EACrB,cAAc,EACd,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,YAAY,CAAC;AAMpB,OAAO,EAEL,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EAEtB,yBAAyB,EACzB,wBAAwB,EAExB,oCAAoC,EACpC,mCAAmC,EACnC,qCAAqC,EACrC,oCAAoC,EACpC,qCAAqC,EACrC,oCAAoC,GACrC,MAAM,iBAAiB,CAAC;AAMzB,OAAO,EAEL,QAAQ,EAGR,gBAAgB,EAChB,aAAa,EACb,OAAO,EACP,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,cAAc,EAGd,YAAY,EACZ,YAAY,EACZ,kBAAkB,EAGlB,kBAAkB,EAClB,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EAGvB,aAAa,EACb,wBAAwB,EACxB,uBAAuB,EACvB,gBAAgB,EAGhB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EAGrB,eAAe,EACf,WAAW,EACX,qBAAqB,GACtB,MAAM,QAAQ,CAAC;AAMhB,OAAO,EAAE,SAAS,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEtF,YAAY,EAEV,aAAa,EACb,UAAU,EACV,YAAY,EAGZ,eAAe,EACf,SAAS,EACT,cAAc,EAGd,oBAAoB,EACpB,mBAAmB,EAGnB,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAGhB,eAAe,EACf,cAAc,EACd,UAAU,EAGV,YAAY,EACZ,gBAAgB,EAChB,cAAc,EACd,UAAU,EACV,oBAAoB,GACrB,MAAM,QAAQ,CAAC"}

package/index.js

@@ -111,6 +111,7 @@ __export(index_exports, {
   isGcAvailable: () => isGcAvailable,
   isOpenAIPlatform: () => isOpenAIPlatform,
   isSuccessful: () => isSuccessful,
+  isTcpPortListening: () => isTcpPortListening,
   isUiPlatform: () => isUiPlatform,
   mcpMatchers: () => mcpMatchers,
   mockResponse: () => mockResponse,
@@ -2285,15 +2286,39 @@ var TestTokenFactory = class {
   publicKey = null;
   jwk = null;
   keyId;
+  /** HS256 shared secret (gateway mode). Null → RS256 + JWKS (default). */
+  hmacSecret;
   constructor(options = {}) {
     this.issuer = options.issuer ?? "https://test.frontmcp.local";
     this.audience = options.audience ?? "frontmcp-test";
     this.keyId = `test-key-${Date.now()}`;
+    this.hmacSecret = options.hmacSecret ? new TextEncoder().encode(options.hmacSecret) : null;
+  }
+  /** True when this factory signs HS256 with a shared secret (gateway mode). */
+  get isHmac() {
+    return this.hmacSecret !== null;
+  }
+  /** The JWS `alg` this factory signs with. */
+  get alg() {
+    return this.isHmac ? "HS256" : "RS256";
   }
   /**
-   * Initialize the key pair (called automatically on first use)
+   * The signing key: the shared HMAC secret in gateway mode, otherwise the
+   * generated RSA private key (lazily created via ensureKeys()).
+   */
+  signingKey() {
+    if (this.hmacSecret) return this.hmacSecret;
+    if (!this.privateKey) {
+      throw new Error("Private key not initialized");
+    }
+    return this.privateKey;
+  }
+  /**
+   * Initialize the key pair (called automatically on first use). No-op in HS256
+   * mode — there is no asymmetric keypair, just the shared secret.
    */
   async ensureKeys() {
+    if (this.isHmac) return;
     if (this.privateKey && this.publicKey) return;
     const { publicKey, privateKey } = await (0, import_jose.generateKeyPair)("RS256", {
       extractable: true
@@ -2321,10 +2346,8 @@ var TestTokenFactory = class {
       scope: options.scopes?.join(" "),
       ...options.claims
     };
-    if (!this.privateKey) {
-      throw new Error("Private key not initialized");
-    }
-    const token = await new import_jose.SignJWT(payload).setProtectedHeader({ alg: "RS256", kid: this.keyId }).sign(this.privateKey);
+    const header = this.isHmac ? { alg: this.alg, typ: "JWT" } : { alg: this.alg, kid: this.keyId };
+    const token = await new import_jose.SignJWT(payload).setProtectedHeader(header).sign(this.signingKey());
     return token;
   }
   /**
@@ -2383,10 +2406,8 @@ var TestTokenFactory = class {
       exp: now - 3600
       // Expired 1 hour ago
     };
-    if (!this.privateKey) {
-      throw new Error("Private key not initialized");
-    }
-    const token = await new import_jose.SignJWT(payload).setProtectedHeader({ alg: "RS256", kid: this.keyId }).sign(this.privateKey);
+    const header = this.isHmac ? { alg: this.alg, typ: "JWT" } : { alg: this.alg, kid: this.keyId };
+    const token = await new import_jose.SignJWT(payload).setProtectedHeader(header).sign(this.signingKey());
     return token;
   }
   /**
@@ -2394,7 +2415,8 @@ var TestTokenFactory = class {
    */
   createTokenWithInvalidSignature(options) {
     const now = Math.floor(Date.now() / 1e3);
-    const header = Buffer.from(JSON.stringify({ alg: "RS256", kid: this.keyId })).toString("base64url");
+    const headerObj = this.isHmac ? { alg: this.alg, typ: "JWT" } : { alg: this.alg, kid: this.keyId };
+    const header = Buffer.from(JSON.stringify(headerObj)).toString("base64url");
     const payload = Buffer.from(
       JSON.stringify({
         iss: this.issuer,
@@ -2408,9 +2430,15 @@ var TestTokenFactory = class {
     return `${header}.${payload}.${signature}`;
   }
   /**
-   * Get the public JWKS for verifying tokens
+   * Get the public JWKS for verifying tokens.
+   *
+   * Only meaningful in RS256 mode — HS256 (gateway) tokens are verified against
+   * the shared secret, not a published public key, so there is no JWKS to serve.
    */
   async getPublicJwks() {
+    if (this.isHmac) {
+      throw new Error("getPublicJwks() is not available in HS256 mode (gateway tokens use a shared secret)");
+    }
     await this.ensureKeys();
     if (!this.jwk) {
       throw new Error("JWK not initialized");
@@ -4006,6 +4034,7 @@ var E2E_PORT_RANGES = {
   "demo-e2e-orchestrated": { start: 50100, size: 10 },
   "demo-e2e-transparent": { start: 50110, size: 10 },
   "demo-e2e-cimd": { start: 50120, size: 10 },
+  "demo-e2e-remote-proxy": { start: 50130, size: 10 },
   // Feature E2E tests (50200-50299)
   "demo-e2e-skills": { start: 50200, size: 10 },
   "demo-e2e-remote": { start: 50210, size: 10 },
@@ -4846,7 +4875,8 @@ var tokenFactory = null;
 var serverStartedByUs = false;
 async function initializeSharedResources() {
   if (!tokenFactory) {
-    tokenFactory = new TestTokenFactory();
+    const sharedSecret = currentConfig.env?.["JWT_SECRET"];
+    tokenFactory = new TestTokenFactory(sharedSecret ? { hmacSecret: sharedSecret } : {});
   }
   if (!serverInstance) {
     if (currentConfig.baseUrl) {
@@ -8092,6 +8122,26 @@ function createReportGenerator() {
 // libs/testing/src/raw-client/index.ts
 var import_protocol = require("@frontmcp/protocol");
 var import_protocol2 = require("@frontmcp/protocol");
+
+// libs/testing/src/raw-client/port-probe.ts
+var import_node_net = __toESM(require("node:net"));
+function isTcpPortListening(port, host = "127.0.0.1", timeoutMs = 1500) {
+  return new Promise((resolve) => {
+    const socket = import_node_net.default.connect({ port, host });
+    socket.unref();
+    socket.setTimeout(timeoutMs);
+    let settled = false;
+    const finish = (listening) => {
+      if (settled) return;
+      settled = true;
+      socket.destroy();
+      resolve(listening);
+    };
+    socket.once("connect", () => finish(true));
+    socket.once("error", () => finish(false));
+    socket.once("timeout", () => finish(false));
+  });
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AssertionError,
@@ -8175,6 +8225,7 @@ var import_protocol2 = require("@frontmcp/protocol");
   isGcAvailable,
   isOpenAIPlatform,
   isSuccessful,
+  isTcpPortListening,
   isUiPlatform,
   mcpMatchers,
   mockResponse,