@frontmcp/testing 1.8.6 → 1.9.0

package/perf/index.js

@@ -1,9 +1,7 @@
 "use strict";
-var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -17,14 +15,6 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // libs/testing/src/perf/index.ts
@@ -834,6 +824,192 @@ function getMeasurementsForProject(project) {
   return getGlobalMeasurementsArray().filter((m) => m.project === project);
 }
 
+// libs/testing/src/auth/token-factory.ts
+var import_jose = require("jose");
+var TestTokenFactory = class {
+  issuer;
+  audience;
+  privateKey = null;
+  publicKey = null;
+  jwk = null;
+  keyId;
+  /** HS256 shared secret (gateway mode). Null → RS256 + JWKS (default). */
+  hmacSecret;
+  constructor(options = {}) {
+    this.issuer = options.issuer ?? "https://test.frontmcp.local";
+    this.audience = options.audience ?? "frontmcp-test";
+    this.keyId = `test-key-${Date.now()}`;
+    this.hmacSecret = options.hmacSecret ? new TextEncoder().encode(options.hmacSecret) : null;
+  }
+  /** True when this factory signs HS256 with a shared secret (gateway mode). */
+  get isHmac() {
+    return this.hmacSecret !== null;
+  }
+  /** The JWS `alg` this factory signs with. */
+  get alg() {
+    return this.isHmac ? "HS256" : "RS256";
+  }
+  /**
+   * The signing key: the shared HMAC secret in gateway mode, otherwise the
+   * generated RSA private key (lazily created via ensureKeys()).
+   */
+  signingKey() {
+    if (this.hmacSecret) return this.hmacSecret;
+    if (!this.privateKey) {
+      throw new Error("Private key not initialized");
+    }
+    return this.privateKey;
+  }
+  /**
+   * Initialize the key pair (called automatically on first use). No-op in HS256
+   * mode — there is no asymmetric keypair, just the shared secret.
+   */
+  async ensureKeys() {
+    if (this.isHmac) return;
+    if (this.privateKey && this.publicKey) return;
+    const { publicKey, privateKey } = await (0, import_jose.generateKeyPair)("RS256", {
+      extractable: true
+    });
+    this.privateKey = privateKey;
+    this.publicKey = publicKey;
+    this.jwk = await (0, import_jose.exportJWK)(publicKey);
+    this.jwk.kid = this.keyId;
+    this.jwk.use = "sig";
+    this.jwk.alg = "RS256";
+  }
+  /**
+   * Create a JWT token with the specified claims
+   */
+  async createTestToken(options) {
+    await this.ensureKeys();
+    const nowMs = Date.now();
+    const iat = Math.floor(nowMs / 1e3);
+    const exp = options.exp ?? 3600;
+    const payload = {
+      iss: options.iss ?? this.issuer,
+      sub: options.sub,
+      aud: options.aud ?? this.audience,
+      iat,
+      exp: Math.ceil(nowMs / 1e3) + exp,
+      scope: options.scopes?.join(" "),
+      ...options.claims
+    };
+    const header = this.isHmac ? { alg: this.alg, typ: "JWT" } : { alg: this.alg, kid: this.keyId };
+    const token = await new import_jose.SignJWT(payload).setProtectedHeader(header).sign(this.signingKey());
+    return token;
+  }
+  /**
+   * Create an admin token with full access
+   */
+  async createAdminToken(sub = "admin-001") {
+    return this.createTestToken({
+      sub,
+      scopes: ["admin:*", "read", "write", "delete"],
+      claims: {
+        email: "admin@test.local",
+        name: "Test Admin",
+        role: "admin"
+      }
+    });
+  }
+  /**
+   * Create a regular user token
+   */
+  async createUserToken(sub = "user-001", scopes = ["read", "write"]) {
+    return this.createTestToken({
+      sub,
+      scopes,
+      claims: {
+        email: "user@test.local",
+        name: "Test User",
+        role: "user"
+      }
+    });
+  }
+  /**
+   * Create an anonymous user token
+   */
+  async createAnonymousToken(expiresIn) {
+    return this.createTestToken({
+      sub: `anon:${Date.now()}`,
+      scopes: ["anonymous"],
+      exp: expiresIn,
+      claims: {
+        name: "Anonymous",
+        role: "anonymous"
+      }
+    });
+  }
+  /**
+   * Create an expired token (for testing token expiration)
+   */
+  async createExpiredToken(options) {
+    await this.ensureKeys();
+    const now = Math.floor(Date.now() / 1e3);
+    const payload = {
+      iss: this.issuer,
+      sub: options.sub,
+      aud: this.audience,
+      iat: now - 7200,
+      // 2 hours ago
+      exp: now - 3600
+      // Expired 1 hour ago
+    };
+    const header = this.isHmac ? { alg: this.alg, typ: "JWT" } : { alg: this.alg, kid: this.keyId };
+    const token = await new import_jose.SignJWT(payload).setProtectedHeader(header).sign(this.signingKey());
+    return token;
+  }
+  /**
+   * Create a token with an invalid signature (for testing signature validation)
+   */
+  createTokenWithInvalidSignature(options) {
+    const now = Math.floor(Date.now() / 1e3);
+    const headerObj = this.isHmac ? { alg: this.alg, typ: "JWT" } : { alg: this.alg, kid: this.keyId };
+    const header = Buffer.from(JSON.stringify(headerObj)).toString("base64url");
+    const payload = Buffer.from(
+      JSON.stringify({
+        iss: this.issuer,
+        sub: options.sub,
+        aud: this.audience,
+        iat: now,
+        exp: now + 3600
+      })
+    ).toString("base64url");
+    const signature = Buffer.from("invalid-signature-" + Date.now()).toString("base64url");
+    return `${header}.${payload}.${signature}`;
+  }
+  /**
+   * Get the public JWKS for verifying tokens.
+   *
+   * Only meaningful in RS256 mode — HS256 (gateway) tokens are verified against
+   * the shared secret, not a published public key, so there is no JWKS to serve.
+   */
+  async getPublicJwks() {
+    if (this.isHmac) {
+      throw new Error("getPublicJwks() is not available in HS256 mode (gateway tokens use a shared secret)");
+    }
+    await this.ensureKeys();
+    if (!this.jwk) {
+      throw new Error("JWK not initialized");
+    }
+    return {
+      keys: [this.jwk]
+    };
+  }
+  /**
+   * Get the issuer URL
+   */
+  getIssuer() {
+    return this.issuer;
+  }
+  /**
+   * Get the audience
+   */
+  getAudience() {
+    return this.audience;
+  }
+};
+
 // libs/testing/src/interceptor/mock-registry.ts
 var DefaultMockRegistry = class {
   mocks = [];
@@ -1106,8 +1282,479 @@ function sleep3(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
-// libs/testing/src/transport/streamable-http.transport.ts
+// libs/testing/src/transport/error-utils.ts
+function errorName(err) {
+  if (typeof err !== "object" || err === null) return void 0;
+  const name = err.name;
+  return typeof name === "string" ? name : void 0;
+}
+function isAbortError(err) {
+  return errorName(err) === "AbortError";
+}
+function errorMessage(err, fallback = "Unknown error") {
+  if (typeof err === "string" && err) return err;
+  if (typeof err === "object" && err !== null) {
+    const message = err.message;
+    if (typeof message === "string" && message) return message;
+  }
+  return fallback;
+}
+var interceptedErrors = /* @__PURE__ */ new WeakSet();
+function markInterceptedError(err) {
+  interceptedErrors.add(err);
+  return err;
+}
+function isInterceptedError(err) {
+  return typeof err === "object" && err !== null && interceptedErrors.has(err);
+}
+
+// libs/testing/src/transport/sse.transport.ts
 var DEFAULT_TIMEOUT = 3e4;
+var SseTransport = class {
+  baseUrl;
+  entryPath;
+  timeout;
+  authHeaders;
+  publicMode;
+  debug;
+  clientInfo;
+  notificationHandler;
+  interceptors;
+  elicitationHandler;
+  state = "disconnected";
+  authToken;
+  sessionId;
+  messageEndpoint;
+  stream;
+  pending = /* @__PURE__ */ new Map();
+  connectionCount = 0;
+  reconnectCount = 0;
+  lastRequestHeaders = {};
+  constructor(config) {
+    this.baseUrl = config.baseUrl.replace(/\/$/, "");
+    this.entryPath = config.entryPath;
+    this.timeout = config.timeout ?? DEFAULT_TIMEOUT;
+    this.authHeaders = config.auth?.headers ?? {};
+    this.authToken = config.auth?.token;
+    this.publicMode = config.publicMode ?? false;
+    this.debug = config.debug ?? false;
+    this.clientInfo = config.clientInfo;
+    this.notificationHandler = config.notificationHandler;
+    this.interceptors = config.interceptors;
+    this.elicitationHandler = config.elicitationHandler;
+  }
+  async connect() {
+    this.state = "connecting";
+    this.connectionCount++;
+    try {
+      if (!this.publicMode && !this.authToken) {
+        await this.requestAnonymousToken();
+      }
+      await this.openStream();
+      this.state = "connected";
+      this.log(`Connected; messages go to ${this.messageEndpoint}`);
+    } catch (error) {
+      this.state = "error";
+      this.stream?.abort();
+      this.stream = void 0;
+      throw error;
+    }
+  }
+  async request(message) {
+    this.ensureConnected();
+    const startTime = Date.now();
+    if (this.interceptors) {
+      const intercepted = await this.interceptors.processRequest(message, {
+        timestamp: /* @__PURE__ */ new Date(),
+        transport: "sse",
+        sessionId: this.sessionId
+      });
+      switch (intercepted.type) {
+        case "mock":
+          return await this.interceptors.processResponse(
+            message,
+            intercepted.response,
+            Date.now() - startTime
+          );
+        case "error":
+          throw markInterceptedError(intercepted.error);
+        case "continue":
+          message = intercepted.request;
+          break;
+      }
+    }
+    let response;
+    if (message.id === void 0) {
+      await this.post(JSON.stringify(message));
+      response = { jsonrpc: "2.0", id: null, result: void 0 };
+    } else {
+      response = await this.postAndAwait(message.id, JSON.stringify(message));
+    }
+    if (this.interceptors) {
+      response = await this.interceptors.processResponse(message, response, Date.now() - startTime);
+    }
+    return response;
+  }
+  async notify(message) {
+    this.ensureConnected();
+    const result = await this.post(JSON.stringify(message));
+    if (!result.ok) this.log(`HTTP ${result.status} on notification: ${result.body}`);
+  }
+  async sendRaw(data) {
+    this.ensureConnected();
+    let id;
+    try {
+      const parsed = JSON.parse(data);
+      if (typeof parsed.id === "string" || typeof parsed.id === "number") id = parsed.id;
+    } catch {
+    }
+    if (id !== void 0) return this.postAndAwait(id, data);
+    const result = await this.post(data);
+    if (!result.ok) {
+      return { jsonrpc: "2.0", id: null, error: { code: -32700, message: "Parse error", data: result.body } };
+    }
+    return { jsonrpc: "2.0", id: null, result: void 0 };
+  }
+  async close() {
+    this.closeStream("Transport closed");
+    this.state = "disconnected";
+    this.sessionId = void 0;
+    this.messageEndpoint = void 0;
+    this.log("SSE transport closed");
+  }
+  isConnected() {
+    return this.state === "connected";
+  }
+  getState() {
+    return this.state;
+  }
+  getSessionId() {
+    return this.sessionId;
+  }
+  setAuthToken(token) {
+    this.authToken = token;
+  }
+  setTimeout(ms) {
+    this.timeout = ms;
+  }
+  getMessageEndpoint() {
+    return this.messageEndpoint;
+  }
+  getConnectionCount() {
+    return this.connectionCount;
+  }
+  getReconnectCount() {
+    return this.reconnectCount;
+  }
+  getLastRequestHeaders() {
+    return { ...this.lastRequestHeaders };
+  }
+  setInterceptors(interceptors2) {
+    this.interceptors = interceptors2;
+  }
+  getInterceptors() {
+    return this.interceptors;
+  }
+  setElicitationHandler(handler) {
+    this.elicitationHandler = handler;
+  }
+  async simulateDisconnect() {
+    this.closeStream("Simulated disconnect");
+    this.state = "disconnected";
+    this.sessionId = void 0;
+    this.messageEndpoint = void 0;
+  }
+  async waitForReconnect(timeoutMs) {
+    this.reconnectCount++;
+    let timer;
+    try {
+      await Promise.race([
+        this.connect(),
+        new Promise((_, reject) => {
+          timer = setTimeout(() => reject(new Error("Timeout waiting for reconnection")), timeoutMs);
+        })
+      ]);
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  // ═══════════════════════════════════════════════════════════════════
+  // STREAM
+  // ═══════════════════════════════════════════════════════════════════
+  /** Open `GET <entry>/sse` and wait for the `endpoint` event. */
+  async openStream() {
+    const controller = new AbortController();
+    this.stream = controller;
+    const url = this.sseUrl();
+    const { "Content-Type": _contentType, ...headers } = this.buildHeaders();
+    this.log(`GET ${url}`);
+    const connectTimer = setTimeout(() => controller.abort(), this.timeout);
+    let response;
+    try {
+      response = await fetch(url, {
+        method: "GET",
+        headers: { ...headers, Accept: "text/event-stream" },
+        signal: controller.signal
+      });
+    } catch (error) {
+      clearTimeout(connectTimer);
+      throw new Error(
+        isAbortError(error) ? `SSE connection to ${url} timed out after ${this.timeout}ms` : `SSE connection to ${url} failed: ${errorMessage(error)}`,
+        { cause: error }
+      );
+    }
+    const isEventStream = response.headers.get("content-type")?.includes("text/event-stream") ?? false;
+    if (!response.ok || !response.body || !isEventStream) {
+      clearTimeout(connectTimer);
+      const body = await response.text().catch(() => "");
+      throw new Error(
+        `SSE connection to ${url} failed: HTTP ${response.status} ${response.statusText}${body ? ` \u2014 ${body}` : ""}. The legacy HTTP+SSE transport needs a server that serves it (@FrontMcp({ transport: { protocol: { legacy: true } } })).`
+      );
+    }
+    const endpoint = new Promise((resolve, reject) => {
+      const reader = response.body?.getReader();
+      if (!reader) {
+        reject(new Error(`SSE connection to ${url} has no body`));
+        return;
+      }
+      void this.readStream(controller, reader, resolve, reject);
+    });
+    try {
+      const data = await endpoint;
+      const messageUrl = new URL(data, url);
+      this.messageEndpoint = messageUrl.toString();
+      this.sessionId = messageUrl.searchParams.get("sessionId") ?? void 0;
+    } finally {
+      clearTimeout(connectTimer);
+    }
+  }
+  async readStream(controller, reader, onEndpoint, onEndpointError) {
+    const decoder = new TextDecoder();
+    let buffer = "";
+    let endpointSeen = false;
+    try {
+      for (let chunk = await reader.read(); !chunk.done; chunk = await reader.read()) {
+        const { completeEvents, remainder } = splitSSEEvents(buffer + decoder.decode(chunk.value, { stream: true }));
+        buffer = remainder;
+        for (const text of completeEvents) {
+          const event = parseSSEEvent(text);
+          if (!event) continue;
+          if (event.type === "endpoint") {
+            if (!endpointSeen) {
+              endpointSeen = true;
+              onEndpoint(event.data);
+            }
+            continue;
+          }
+          await this.handleMessage(event.data);
+        }
+      }
+    } catch (error) {
+      if (!controller.signal.aborted) this.log("SSE stream failed:", error);
+    } finally {
+      reader.releaseLock();
+    }
+    if (!endpointSeen) {
+      onEndpointError(
+        new Error(
+          controller.signal.aborted ? `SSE stream at ${this.sseUrl()} sent no endpoint event within ${this.timeout}ms` : `SSE stream at ${this.sseUrl()} ended before the server sent its endpoint`
+        )
+      );
+    }
+    if (this.stream === controller) {
+      this.stream = void 0;
+      this.rejectPending("SSE stream closed by the server");
+      if (this.state === "connected") this.state = "disconnected";
+    }
+  }
+  async handleMessage(data) {
+    let message;
+    try {
+      message = JSON.parse(data);
+    } catch {
+      this.log("Ignoring SSE event that is not JSON:", data);
+      return;
+    }
+    if (!message || typeof message !== "object") return;
+    if (typeof message.method === "string") {
+      const request = message;
+      if (request.id === void 0 || request.id === null) {
+        this.notificationHandler?.(request);
+        return;
+      }
+      await this.answerServerRequest(request);
+      return;
+    }
+    if (message.id !== void 0 && message.id !== null) {
+      const pending = this.pending.get(message.id);
+      if (pending) {
+        clearTimeout(pending.timer);
+        this.pending.delete(message.id);
+        pending.resolve(message);
+      }
+    }
+  }
+  /** Server→client requests: elicitation goes to the handler, `ping` is answered, the rest refused. */
+  async answerServerRequest(request) {
+    const id = request.id;
+    let reply;
+    if (request.method === "elicitation/create") {
+      reply = { jsonrpc: "2.0", id, result: await this.elicit(request.params) };
+    } else if (request.method === "ping") {
+      reply = { jsonrpc: "2.0", id, result: {} };
+    } else {
+      reply = { jsonrpc: "2.0", id, error: { code: -32601, message: `Method not found: ${request.method}` } };
+    }
+    const result = await this.post(JSON.stringify(reply));
+    if (!result.ok) this.log(`HTTP ${result.status} answering ${request.method}: ${result.body}`);
+  }
+  async elicit(params) {
+    if (!this.elicitationHandler) return { action: "decline" };
+    try {
+      return await this.elicitationHandler(params);
+    } catch (error) {
+      this.log("Elicitation handler error:", error);
+      return { action: "cancel" };
+    }
+  }
+  closeStream(reason) {
+    const controller = this.stream;
+    this.stream = void 0;
+    controller?.abort();
+    this.rejectPending(reason);
+  }
+  rejectPending(reason) {
+    for (const [id, pending] of this.pending) {
+      clearTimeout(pending.timer);
+      pending.resolve({ jsonrpc: "2.0", id, error: { code: -32e3, message: reason } });
+    }
+    this.pending.clear();
+  }
+  // ═══════════════════════════════════════════════════════════════════
+  // POSTING
+  // ═══════════════════════════════════════════════════════════════════
+  /** POST a message and resolve with the response the stream carries for `id`. */
+  async postAndAwait(id, body) {
+    const answer = new Promise((resolve) => {
+      const timer = setTimeout(() => {
+        this.pending.delete(id);
+        resolve({ jsonrpc: "2.0", id, error: { code: -32e3, message: `Request timeout after ${this.timeout}ms` } });
+      }, this.timeout);
+      this.pending.set(id, { resolve, timer });
+    });
+    const result = await this.post(body);
+    if (!result.ok) {
+      const pending = this.pending.get(id);
+      if (pending) {
+        clearTimeout(pending.timer);
+        this.pending.delete(id);
+      }
+      return {
+        jsonrpc: "2.0",
+        id,
+        error: { code: -32e3, message: `HTTP ${result.status}: ${result.statusText}`, data: result.body }
+      };
+    }
+    return answer;
+  }
+  async post(body) {
+    const endpoint = this.messageEndpoint;
+    if (!endpoint) throw new Error("SSE transport has no message endpoint. Call connect() first.");
+    const headers = this.buildHeaders();
+    this.lastRequestHeaders = headers;
+    this.log(`POST ${endpoint}`, body);
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.timeout);
+    try {
+      const response = await fetch(endpoint, { method: "POST", headers, body, signal: controller.signal });
+      const text = await response.text();
+      return { ok: response.ok, status: response.status, statusText: response.statusText, body: text };
+    } catch (error) {
+      if (isAbortError(error)) {
+        return { ok: false, status: 0, statusText: `timeout after ${this.timeout}ms`, body: "" };
+      }
+      throw error;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  // ═══════════════════════════════════════════════════════════════════
+  // HELPERS
+  // ═══════════════════════════════════════════════════════════════════
+  async requestAnonymousToken() {
+    const url = new URL(this.baseUrl);
+    url.pathname = `${url.pathname.replace(/\/+$/, "")}/oauth/token`;
+    url.search = "";
+    const tokenUrl = url.toString();
+    try {
+      const response = await fetch(tokenUrl, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ grant_type: "anonymous", client_id: crypto.randomUUID(), resource: this.baseUrl })
+      });
+      if (!response.ok) {
+        this.log(`No anonymous token (HTTP ${response.status})`);
+        return;
+      }
+      const token = await response.json();
+      if (token.access_token) this.authToken = token.access_token;
+    } catch (error) {
+      this.log("Error requesting anonymous token:", error);
+    }
+  }
+  /** `<baseUrl><entryPath>/sse`, built from URL parts so query params on `baseUrl` survive. */
+  sseUrl() {
+    const url = new URL(this.baseUrl);
+    const entry = (this.entryPath ?? "").replace(/^\/+|\/+$/g, "");
+    const basePath = url.pathname.replace(/\/+$/, "");
+    url.pathname = entry ? `${basePath}/${entry}/sse` : `${basePath}/sse`;
+    return url.toString();
+  }
+  buildHeaders() {
+    const headers = {
+      "Content-Type": "application/json",
+      Accept: "application/json, text/event-stream"
+    };
+    if (this.clientInfo) headers["User-Agent"] = `${this.clientInfo.name}/${this.clientInfo.version}`;
+    if (this.authToken) headers["Authorization"] = `Bearer ${this.authToken}`;
+    if (this.sessionId) headers["mcp-session-id"] = this.sessionId;
+    Object.assign(headers, this.authHeaders);
+    return headers;
+  }
+  ensureConnected() {
+    if (this.state !== "connected") {
+      throw new Error("Transport not connected. Call connect() first.");
+    }
+  }
+  log(message, data) {
+    if (this.debug) {
+      console.log(`[SSE] ${message}`, data ?? "");
+    }
+  }
+};
+function splitSSEEvents(buffer) {
+  const endsWithCarriageReturn = buffer.endsWith("\r");
+  const normalized = (endsWithCarriageReturn ? buffer.slice(0, -1) : buffer).replace(/\r\n?/g, "\n");
+  const completeEvents = normalized.split("\n\n");
+  const remainder = completeEvents.pop() ?? "";
+  return { completeEvents, remainder: endsWithCarriageReturn ? `${remainder}\r` : remainder };
+}
+function parseSSEEvent(text) {
+  let type = "message";
+  const data = [];
+  for (const line of text.split("\n")) {
+    if (line.startsWith(":")) continue;
+    const colon = line.indexOf(":");
+    const field = colon === -1 ? line : line.slice(0, colon);
+    const value = colon === -1 ? "" : line.slice(colon + 1).replace(/^ /, "");
+    if (field === "event") type = value;
+    else if (field === "data") data.push(value);
+  }
+  return data.length > 0 ? { type, data: data.join("\n") } : void 0;
+}
+
+// libs/testing/src/transport/streamable-http.transport.ts
+var DEFAULT_TIMEOUT2 = 3e4;
 var NOTIFICATION_STREAM_REOPEN_DELAY_MS = 250;
 var StreamableHttpTransport = class {
   config;
@@ -1129,7 +1776,7 @@ var StreamableHttpTransport = class {
       baseUrl: config.baseUrl.replace(/\/$/, ""),
       // Remove trailing slash
       entryPath: config.entryPath,
-      timeout: config.timeout ?? DEFAULT_TIMEOUT,
+      timeout: config.timeout ?? DEFAULT_TIMEOUT2,
       auth: config.auth ?? {},
       publicMode: config.publicMode ?? false,
       debug: config.debug ?? false,
@@ -1214,7 +1861,7 @@ var StreamableHttpTransport = class {
           return mockResponse2;
         }
         case "error":
-          throw interceptResult.error;
+          throw markInterceptedError(interceptResult.error);
         case "continue":
           message = interceptResult.request;
           break;
@@ -1275,7 +1922,7 @@ var StreamableHttpTransport = class {
       return jsonResponse;
     } catch (error) {
       clearTimeout(timeoutId);
-      if (error instanceof Error && error.name === "AbortError") {
+      if (isAbortError(error)) {
         return {
           jsonrpc: "2.0",
           id: message.id ?? null,
@@ -1314,7 +1961,7 @@ var StreamableHttpTransport = class {
       }
     } catch (error) {
       clearTimeout(timeoutId);
-      if (error instanceof Error && error.name !== "AbortError") {
+      if (!isAbortError(error)) {
         throw error;
       }
     }
@@ -1355,7 +2002,7 @@ var StreamableHttpTransport = class {
         error: {
           code: -32700,
           message: "Parse error",
-          data: error instanceof Error ? error.message : "Unknown error"
+          data: errorMessage(error)
         }
       };
     }
@@ -1469,7 +2116,7 @@ var StreamableHttpTransport = class {
     let buffer = "";
     try {
       for (let chunk = await reader.read(); !chunk.done; chunk = await reader.read()) {
-        const { completeEvents, remainder } = splitSSEEvents(buffer + decoder.decode(chunk.value, { stream: true }));
+        const { completeEvents, remainder } = splitSSEEvents2(buffer + decoder.decode(chunk.value, { stream: true }));
         buffer = remainder;
         for (const eventText of completeEvents) {
           for (const event of this.parseSSEEvents(eventText, void 0).events) {
@@ -1725,7 +2372,7 @@ var StreamableHttpTransport = class {
     if (this.config.clientInfo) {
       headers["User-Agent"] = `${this.config.clientInfo.name}/${this.config.clientInfo.version}`;
     }
-    if (this.authToken && !this.publicMode) {
+    if (this.authToken) {
       headers["Authorization"] = `Bearer ${this.authToken}`;
     }
     if (this.sessionId) {
@@ -1803,7 +2450,7 @@ var StreamableHttpTransport = class {
     };
   }
 };
-function splitSSEEvents(buffer) {
+function splitSSEEvents2(buffer) {
   const endsWithCarriageReturn = buffer.endsWith("\r");
   const normalized = (endsWithCarriageReturn ? buffer.slice(0, -1) : buffer).replace(/\r\n?/g, "\n");
   const completeEvents = normalized.split("\n\n");
@@ -2041,7 +2688,7 @@ var McpTestClientBuilder = class {
 };
 
 // libs/testing/src/client/mcp-test-client.ts
-var DEFAULT_TIMEOUT2 = 3e4;
+var DEFAULT_TIMEOUT3 = 3e4;
 var DEFAULT_PROTOCOL_VERSION = "2025-06-18";
 var UNSUPPORTED_PROTOCOL_VERSIONS = ["2026-07-28"];
 var DEFAULT_CLIENT_INFO = {
@@ -2049,6 +2696,15 @@ var DEFAULT_CLIENT_INFO = {
   version: "0.4.0"
 };
 var MAX_LIST_PAGES = 1e3;
+function isAuthFailure(error) {
+  return typeof error?.message === "string" && /^HTTP (401|403)\b/.test(error.message);
+}
+function describeInitializeError(error) {
+  const message = error?.message ?? "Unknown error";
+  const data = error?.data;
+  const detail = typeof data === "string" ? data.trim() : "";
+  return detail ? `${message} - ${detail.slice(0, 500)}` : message;
+}
 function extractEntryPaths(data) {
   let payload = data;
   if (typeof payload === "string") {
@@ -2102,7 +2758,7 @@ var McpTestClient = class {
       transport: config.transport ?? "streamable-http",
       auth: config.auth ?? {},
       publicMode: config.publicMode ?? false,
-      timeout: config.timeout ?? DEFAULT_TIMEOUT2,
+      timeout: config.timeout ?? DEFAULT_TIMEOUT3,
       debug: config.debug ?? false,
       protocolVersion: config.protocolVersion ?? DEFAULT_PROTOCOL_VERSION,
       clientInfo: config.clientInfo ?? DEFAULT_CLIENT_INFO,
@@ -2135,19 +2791,22 @@ var McpTestClient = class {
   async connect() {
     this.log("debug", `Connecting to ${this.config.baseUrl}...`);
     this.triedDiscoveredEntryPath = false;
+    this.initResult = null;
     this.transport = this.createTransport();
     await this.transport.connect();
     const maxRetries = 3;
     const retryDelayMs = 500;
     let lastError;
     let reportedEntryPaths;
+    let attemptsMade = 0;
     for (let attempt = 1; attempt <= maxRetries; attempt++) {
+      attemptsMade = attempt;
       const initResponse = await this.initialize();
       if (initResponse.success && initResponse.data) {
         this.initResult = initResponse.data;
         break;
       }
-      lastError = initResponse.error?.message ?? "Unknown error";
+      lastError = describeInitializeError(initResponse.error);
       reportedEntryPaths = extractEntryPaths(initResponse.error?.data) ?? reportedEntryPaths;
       if (reportedEntryPaths?.length === 1 && !this.triedDiscoveredEntryPath) {
         this.triedDiscoveredEntryPath = true;
@@ -2159,6 +2818,7 @@ var McpTestClient = class {
         await this.transport.connect();
         continue;
       }
+      if (isAuthFailure(initResponse.error)) break;
       if (attempt < maxRetries) {
         this.log("debug", `MCP init attempt ${attempt} failed (${lastError}), retrying in ${retryDelayMs}ms...`);
         await new Promise((resolve) => setTimeout(resolve, retryDelayMs));
@@ -2167,7 +2827,7 @@ var McpTestClient = class {
     if (!this.initResult) {
       const served = reportedEntryPaths?.length ? ` The server reports it serves MCP at ${reportedEntryPaths.join(", ")}; set \`entryPath\` in test.use() (or \`http.entryPath\` on the server) to match.` : "";
       throw new Error(
-        `Failed to initialize MCP connection to ${this.config.baseUrl}${this.mcpPathLabel()} after ${maxRetries} attempts: ${lastError}.${served}`
+        `Failed to initialize MCP connection to ${this.config.baseUrl}${this.mcpPathLabel()} after ${attemptsMade} attempt${attemptsMade === 1 ? "" : "s"}: ${lastError}.${served}`
       );
     }
     this._sessionId = this.transport.getSessionId();
@@ -2237,18 +2897,47 @@ var McpTestClient = class {
     return this._authState;
   }
   /**
-   * Authenticate with a token
+   * Authenticate with a token.
+   *
+   * When connected, this opens a NEW session with the token (the previous session was created
+   * for the previous identity) and rejects if the server refuses it — for example because the
+   * token is expired or badly signed. On rejection the client keeps its previous identity and
+   * session. The token is kept in the client config, so `reconnect()` keeps using it.
    */
   async authenticate(token) {
+    if (typeof token !== "string" || token.trim() === "") {
+      throw new Error("authenticate() requires a non-empty token");
+    }
+    const previousAuthState = this._authState;
+    const previousConfigAuth = this.config.auth;
+    this.config.auth = { ...previousConfigAuth, token };
     this._authState = {
       isAnonymous: false,
       token,
       scopes: this.parseScopesFromToken(token),
       user: this.parseUserFromToken(token)
     };
-    if (this.transport) {
-      this.transport.setAuthToken(token);
+    const previousTransport = this.transport;
+    if (!previousTransport) {
+      this.log("debug", "Authentication updated (not connected yet)");
+      return;
     }
+    const previousInit = this.initResult;
+    const previousSessionId = this._sessionId;
+    const previousSessionInfo = this._sessionInfo;
+    try {
+      await this.connect();
+    } catch (err) {
+      await this.transport?.close().catch(() => void 0);
+      this.transport = previousTransport;
+      this.initResult = previousInit;
+      this._sessionId = previousSessionId;
+      this._sessionInfo = previousSessionInfo;
+      this.config.auth = previousConfigAuth;
+      this._authState = previousAuthState;
+      throw err;
+    }
+    await previousTransport.close().catch(() => void 0);
     this.log("debug", "Authentication updated");
   }
   // ═══════════════════════════════════════════════════════════════════
@@ -2834,8 +3523,19 @@ var McpTestClient = class {
           elicitationHandler: this._elicitationHandler,
           notificationHandler: this.recordNotification
         });
-      case "sse":
-        throw new Error("SSE transport not yet implemented");
+      case "sse":
+        return new SseTransport({
+          baseUrl,
+          entryPath: this.config.entryPath,
+          timeout: this.config.timeout,
+          auth: this.config.auth,
+          publicMode: this.config.publicMode,
+          debug: this.config.debug,
+          interceptors: this._interceptors,
+          clientInfo: this.config.clientInfo,
+          elicitationHandler: this._elicitationHandler,
+          notificationHandler: this.recordNotification
+        });
       default:
         throw new Error(`Unknown transport type: ${this.config.transport}`);
     }
@@ -2872,10 +3572,11 @@ var McpTestClient = class {
         requestId: id
       };
     } catch (err) {
+      if (isInterceptedError(err)) throw err;
       const durationMs = Date.now() - start;
       const error = {
         code: -32603,
-        message: err instanceof Error ? err.message : "Unknown error"
+        message: errorMessage(err)
       };
       return {
         success: false,
@@ -3102,190 +3803,6 @@ var ProgressCollector = class {
   }
 };
 
-// libs/testing/src/auth/token-factory.ts
-var import_jose = require("jose");
-var TestTokenFactory = class {
-  issuer;
-  audience;
-  privateKey = null;
-  publicKey = null;
-  jwk = null;
-  keyId;
-  /** HS256 shared secret (gateway mode). Null → RS256 + JWKS (default). */
-  hmacSecret;
-  constructor(options = {}) {
-    this.issuer = options.issuer ?? "https://test.frontmcp.local";
-    this.audience = options.audience ?? "frontmcp-test";
-    this.keyId = `test-key-${Date.now()}`;
-    this.hmacSecret = options.hmacSecret ? new TextEncoder().encode(options.hmacSecret) : null;
-  }
-  /** True when this factory signs HS256 with a shared secret (gateway mode). */
-  get isHmac() {
-    return this.hmacSecret !== null;
-  }
-  /** The JWS `alg` this factory signs with. */
-  get alg() {
-    return this.isHmac ? "HS256" : "RS256";
-  }
-  /**
-   * The signing key: the shared HMAC secret in gateway mode, otherwise the
-   * generated RSA private key (lazily created via ensureKeys()).
-   */
-  signingKey() {
-    if (this.hmacSecret) return this.hmacSecret;
-    if (!this.privateKey) {
-      throw new Error("Private key not initialized");
-    }
-    return this.privateKey;
-  }
-  /**
-   * Initialize the key pair (called automatically on first use). No-op in HS256
-   * mode — there is no asymmetric keypair, just the shared secret.
-   */
-  async ensureKeys() {
-    if (this.isHmac) return;
-    if (this.privateKey && this.publicKey) return;
-    const { publicKey, privateKey } = await (0, import_jose.generateKeyPair)("RS256", {
-      extractable: true
-    });
-    this.privateKey = privateKey;
-    this.publicKey = publicKey;
-    this.jwk = await (0, import_jose.exportJWK)(publicKey);
-    this.jwk.kid = this.keyId;
-    this.jwk.use = "sig";
-    this.jwk.alg = "RS256";
-  }
-  /**
-   * Create a JWT token with the specified claims
-   */
-  async createTestToken(options) {
-    await this.ensureKeys();
-    const now = Math.floor(Date.now() / 1e3);
-    const exp = options.exp ?? 3600;
-    const payload = {
-      iss: options.iss ?? this.issuer,
-      sub: options.sub,
-      aud: options.aud ?? this.audience,
-      iat: now,
-      exp: now + exp,
-      scope: options.scopes?.join(" "),
-      ...options.claims
-    };
-    const header = this.isHmac ? { alg: this.alg, typ: "JWT" } : { alg: this.alg, kid: this.keyId };
-    const token = await new import_jose.SignJWT(payload).setProtectedHeader(header).sign(this.signingKey());
-    return token;
-  }
-  /**
-   * Create an admin token with full access
-   */
-  async createAdminToken(sub = "admin-001") {
-    return this.createTestToken({
-      sub,
-      scopes: ["admin:*", "read", "write", "delete"],
-      claims: {
-        email: "admin@test.local",
-        name: "Test Admin",
-        role: "admin"
-      }
-    });
-  }
-  /**
-   * Create a regular user token
-   */
-  async createUserToken(sub = "user-001", scopes = ["read", "write"]) {
-    return this.createTestToken({
-      sub,
-      scopes,
-      claims: {
-        email: "user@test.local",
-        name: "Test User",
-        role: "user"
-      }
-    });
-  }
-  /**
-   * Create an anonymous user token
-   */
-  async createAnonymousToken() {
-    return this.createTestToken({
-      sub: `anon:${Date.now()}`,
-      scopes: ["anonymous"],
-      claims: {
-        name: "Anonymous",
-        role: "anonymous"
-      }
-    });
-  }
-  /**
-   * Create an expired token (for testing token expiration)
-   */
-  async createExpiredToken(options) {
-    await this.ensureKeys();
-    const now = Math.floor(Date.now() / 1e3);
-    const payload = {
-      iss: this.issuer,
-      sub: options.sub,
-      aud: this.audience,
-      iat: now - 7200,
-      // 2 hours ago
-      exp: now - 3600
-      // Expired 1 hour ago
-    };
-    const header = this.isHmac ? { alg: this.alg, typ: "JWT" } : { alg: this.alg, kid: this.keyId };
-    const token = await new import_jose.SignJWT(payload).setProtectedHeader(header).sign(this.signingKey());
-    return token;
-  }
-  /**
-   * Create a token with an invalid signature (for testing signature validation)
-   */
-  createTokenWithInvalidSignature(options) {
-    const now = Math.floor(Date.now() / 1e3);
-    const headerObj = this.isHmac ? { alg: this.alg, typ: "JWT" } : { alg: this.alg, kid: this.keyId };
-    const header = Buffer.from(JSON.stringify(headerObj)).toString("base64url");
-    const payload = Buffer.from(
-      JSON.stringify({
-        iss: this.issuer,
-        sub: options.sub,
-        aud: this.audience,
-        iat: now,
-        exp: now + 3600
-      })
-    ).toString("base64url");
-    const signature = Buffer.from("invalid-signature-" + Date.now()).toString("base64url");
-    return `${header}.${payload}.${signature}`;
-  }
-  /**
-   * Get the public JWKS for verifying tokens.
-   *
-   * Only meaningful in RS256 mode — HS256 (gateway) tokens are verified against
-   * the shared secret, not a published public key, so there is no JWKS to serve.
-   */
-  async getPublicJwks() {
-    if (this.isHmac) {
-      throw new Error("getPublicJwks() is not available in HS256 mode (gateway tokens use a shared secret)");
-    }
-    await this.ensureKeys();
-    if (!this.jwk) {
-      throw new Error("JWK not initialized");
-    }
-    return {
-      keys: [this.jwk]
-    };
-  }
-  /**
-   * Get the issuer URL
-   */
-  getIssuer() {
-    return this.issuer;
-  }
-  /**
-   * Get the audience
-   */
-  getAudience() {
-    return this.audience;
-  }
-};
-
 // libs/testing/src/server/test-server.ts
 var import_child_process = require("child_process");
 var import_utils = require("@frontmcp/utils");
@@ -3358,6 +3875,8 @@ var E2E_PORT_RANGES = {
   "demo-e2e-distributed": { start: 50440, size: 20 },
   // Protocol revision E2E tests (50460-50479)
   "demo-e2e-protocol-20260728": { start: 50460, size: 20 },
+  // Testing library E2E tests (50480-50499)
+  "demo-e2e-testing": { start: 50480, size: 20 },
   // Mock servers and utilities (50900-50999)
   "mock-oauth": { start: 50900, size: 10 },
   "mock-api": { start: 50910, size: 10 },
@@ -3366,6 +3885,66 @@ var E2E_PORT_RANGES = {
   default: { start: 51e3, size: 100 }
 };
 var reservedPorts = /* @__PURE__ */ new Map();
+var lockedPorts = /* @__PURE__ */ new Set();
+var LOCK_MAX_AGE_MS = 10 * 60 * 1e3;
+function lockDir() {
+  try {
+    const os = require("node:os");
+    const path = require("node:path");
+    return path.join(os.tmpdir(), "frontmcp-testing-ports");
+  } catch {
+    return void 0;
+  }
+}
+function pidIsAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+function acquirePortLock(port) {
+  if (lockedPorts.has(port)) return false;
+  let fs;
+  let file;
+  try {
+    fs = require("node:fs");
+    const dir = lockDir();
+    if (!dir) return true;
+    fs.mkdirSync(dir, { recursive: true });
+    file = require("node:path").join(dir, `${port}.lock`);
+  } catch {
+    return true;
+  }
+  const payload = JSON.stringify({ pid: process.pid, at: Date.now() });
+  for (let attempt = 0; attempt < 2; attempt++) {
+    try {
+      fs.writeFileSync(file, payload, { flag: "wx" });
+      lockedPorts.add(port);
+      return true;
+    } catch (error) {
+      if (error.code !== "EEXIST") return true;
+      try {
+        const held = JSON.parse(fs.readFileSync(file, "utf8"));
+        const fresh = typeof held.at === "number" && Date.now() - held.at < LOCK_MAX_AGE_MS;
+        if (fresh && typeof held.pid === "number" && pidIsAlive(held.pid)) return false;
+        fs.unlinkSync(file);
+      } catch {
+      }
+    }
+  }
+  return false;
+}
+function releasePortLock(port) {
+  if (!lockedPorts.delete(port)) return;
+  try {
+    const fs = require("node:fs");
+    const dir = lockDir();
+    if (dir) fs.unlinkSync(require("node:path").join(dir, `${port}.lock`));
+  } catch {
+  }
+}
 var projectPortIndex = /* @__PURE__ */ new Map();
 function getPortRange(project) {
   const key = project;
@@ -3376,15 +3955,22 @@ function getPortRange(project) {
 }
 async function reservePort(project, preferredPort) {
   const range = getPortRange(project);
-  if (preferredPort !== void 0) {
+  const handle = (port) => ({
+    port,
+    // Frees the socket only, so the server about to be spawned can bind the port; the lock file stays
+    releaseSocket: async () => {
+      await releasePort(port);
+    },
+    release: async () => {
+      await releasePort(port);
+      releasePortLock(port);
+    }
+  });
+  const wantsSpecificPort = preferredPort !== void 0 && Number.isInteger(preferredPort) && preferredPort > 0;
+  if (wantsSpecificPort) {
     const reservation = await tryReservePort(preferredPort, project);
     if (reservation) {
-      return {
-        port: preferredPort,
-        release: async () => {
-          await releasePort(preferredPort);
-        }
-      };
+      return handle(preferredPort);
     }
     console.warn(`[PortRegistry] Preferred port ${preferredPort} not available for ${project}, allocating from range`);
   }
@@ -3393,30 +3979,19 @@ async function reservePort(project, preferredPort) {
   for (let attempt = 0; attempt < maxAttempts; attempt++) {
     const port = range.start + index % range.size;
     index = (index + 1) % range.size;
-    if (reservedPorts.has(port)) {
+    if (reservedPorts.has(port) || lockedPorts.has(port)) {
       continue;
     }
     const reservation = await tryReservePort(port, project);
     if (reservation) {
       projectPortIndex.set(project, index);
-      return {
-        port,
-        release: async () => {
-          await releasePort(port);
-        }
-      };
+      return handle(port);
     }
   }
-  const dynamicPort = await findAvailablePortInRange(51e3, 52e3);
-  if (dynamicPort) {
-    const reservation = await tryReservePort(dynamicPort, project);
-    if (reservation) {
-      return {
-        port: dynamicPort,
-        release: async () => {
-          await releasePort(dynamicPort);
-        }
-      };
+  for (let port = 51e3; port < 52e3; port++) {
+    if (reservedPorts.has(port) || lockedPorts.has(port)) continue;
+    if (await tryReservePort(port, project)) {
+      return handle(port);
     }
   }
   throw new Error(
@@ -3424,9 +3999,13 @@ async function reservePort(project, preferredPort) {
   );
 }
 async function tryReservePort(port, project) {
+  if (!acquirePortLock(port)) {
+    return false;
+  }
   return new Promise((resolve) => {
     const server = (0, import_net.createServer)();
     server.once("error", () => {
+      releasePortLock(port);
       resolve(false);
     });
     server.listen(port, () => {
@@ -3452,31 +4031,6 @@ async function releasePort(port) {
     });
   });
 }
-async function findAvailablePortInRange(start, end) {
-  for (let port = start; port < end; port++) {
-    if (reservedPorts.has(port)) {
-      continue;
-    }
-    const available = await isPortAvailable(port);
-    if (available) {
-      return port;
-    }
-  }
-  return null;
-}
-async function isPortAvailable(port) {
-  return new Promise((resolve) => {
-    const server = (0, import_net.createServer)();
-    server.once("error", () => {
-      resolve(false);
-    });
-    server.listen(port, () => {
-      server.close(() => {
-        resolve(true);
-      });
-    });
-  });
-}
 
 // libs/testing/src/server/test-server.ts
 var DEBUG_SERVER = process.env["DEBUG_SERVER"] === "1" || process.env["DEBUG"] === "1";
@@ -3485,8 +4039,11 @@ var TestServer = class _TestServer {
   options;
   _info;
   logs = [];
+  /** Frees the port reservation (socket and cross-process lock); held until stop() */
   portRelease = null;
-  constructor(options, port, portRelease) {
+  /** Frees only the reservation socket, just before the server is spawned */
+  portReleaseSocket = null;
+  constructor(options, port, portRelease, portReleaseSocket) {
     this.options = {
       port,
       project: options.project,
@@ -3498,6 +4055,7 @@ var TestServer = class _TestServer {
       debug: options.debug ?? DEBUG_SERVER
     };
     this.portRelease = portRelease ?? null;
+    this.portReleaseSocket = portReleaseSocket ?? portRelease ?? null;
     this._info = {
       baseUrl: `http://localhost:${port}`,
       port
@@ -3510,8 +4068,8 @@ var TestServer = class _TestServer {
     const project = options.project ?? "default";
     const maxAttempts = 3;
     for (let attempt = 1; attempt <= maxAttempts; attempt++) {
-      const { port, release } = await reservePort(project, options.port);
-      const server = new _TestServer(options, port, release);
+      const { port, release, releaseSocket } = await reservePort(project, options.port);
+      const server = new _TestServer(options, port, release, releaseSocket);
       try {
         await server.startProcess();
         return server;
@@ -3551,7 +4109,7 @@ var TestServer = class _TestServer {
     }
     const maxAttempts = 3;
     for (let attempt = 1; attempt <= maxAttempts; attempt++) {
-      const { port, release } = await reservePort(project, options.port);
+      const { port, release, releaseSocket } = await reservePort(project, options.port);
       const serverOptions = {
         ...options,
         port,
@@ -3559,7 +4117,7 @@ var TestServer = class _TestServer {
         command: `npx nx serve ${project} --port ${port}`,
         cwd: options.cwd ?? process.cwd()
       };
-      const server = new _TestServer(serverOptions, port, release);
+      const server = new _TestServer(serverOptions, port, release, releaseSocket);
       try {
         await server.startProcess();
         return server;
@@ -3617,10 +4175,17 @@ var TestServer = class _TestServer {
    * Stop the test server
    */
   async stop() {
-    if (this.portRelease) {
-      await this.portRelease();
-      this.portRelease = null;
+    try {
+      await this.stopProcess();
+    } finally {
+      if (this.portRelease) {
+        await this.portRelease();
+        this.portRelease = null;
+      }
+      this.portReleaseSocket = null;
     }
+  }
+  async stopProcess() {
     if (this.process) {
       this.log("Stopping server...");
       if (this.process.exitCode !== null || this.process.signalCode !== null) {
@@ -3693,7 +4258,7 @@ var TestServer = class _TestServer {
    * Restart the server
    */
   async restart() {
-    await this.stop();
+    await this.stopProcess();
     await this.startProcess();
   }
   /**
@@ -3723,9 +4288,9 @@ var TestServer = class _TestServer {
       PORT: String(this.options.port)
     };
     const runtimeEnv = withWorkspaceProtocolFallback(env, this.options.cwd);
-    if (this.portRelease) {
-      await this.portRelease();
-      this.portRelease = null;
+    if (this.portReleaseSocket) {
+      await this.portReleaseSocket();
+      this.portReleaseSocket = null;
       await sleep4(300);
     }
     this.process = (0, import_child_process.spawn)(this.options.command, [], {
@@ -3735,9 +4300,8 @@ var TestServer = class _TestServer {
       detached: true,
       stdio: ["pipe", "pipe", "pipe"]
     });
-    if (this.process.pid !== void 0) {
-      this._info.pid = this.process.pid;
-    }
+    this._info.pid = this.process.pid;
+    this._info.shellPid = this.process.pid;
     let processExited = false;
     let exitCode = null;
     let exitError = null;
@@ -3840,6 +4404,8 @@ ${allLogs}`);
         });
         if (response.ok || response.status === 404) {
           this.log(`Server is ready after ${healthCheckAttempts} health check attempts`);
+          const listeningPid = await findListeningPid(this.options.port);
+          if (listeningPid !== void 0) this._info.pid = listeningPid;
           return;
         }
         lastHealthCheckError = `HTTP ${response.status}: ${response.statusText}`;
@@ -3884,6 +4450,19 @@ TIP: Set DEBUG_SERVER=1 or DEBUG=1 environment variable for verbose output`
 function sleep4(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
+function findListeningPid(port) {
+  if (process.platform === "win32") return Promise.resolve(void 0);
+  return new Promise((resolve) => {
+    (0, import_child_process.execFile)("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN", "-t"], { timeout: 2e3 }, (error, stdout) => {
+      if (error) {
+        resolve(void 0);
+        return;
+      }
+      const pid = parseInt(String(stdout).split("\n")[0] ?? "", 10);
+      resolve(Number.isInteger(pid) && pid > 0 ? pid : void 0);
+    });
+  });
+}
 function withWorkspaceProtocolFallback(env, cwd) {
   if (findInstalledProtocolPackageDir(cwd)) {
     return env;
@@ -4031,7 +4610,8 @@ Server entry: ${currentConfig.server}
 Project: ${currentConfig.project ?? "default"}
 Command: ${serverCommand}
 
-Error: ${errMsg}`
+Error: ${errMsg}`,
+          { cause: error }
         );
       }
     } else {
@@ -4221,16 +4801,19 @@ function todo(name) {
 }
 var perfTest = perfTestWithFixtures;
 perfTest.use = use;
-perfTest.describe = describe;
-perfTest.beforeAll = beforeAll;
-perfTest.beforeEach = beforeEach;
-perfTest.afterEach = afterEach;
-perfTest.afterAll = afterAll;
+for (const hook of ["describe", "beforeAll", "beforeEach", "afterEach", "afterAll"]) {
+  Object.defineProperty(perfTest, hook, {
+    get: () => globalThis[hook],
+    enumerable: true,
+    configurable: true
+  });
+}
 perfTest.skip = skip;
 perfTest.only = only;
 perfTest.todo = todo;
 
 // libs/testing/src/perf/baseline-store.ts
+var import_utils2 = require("@frontmcp/utils");
 var BASELINE_START_MARKER = "<!-- PERF_BASELINE_START -->";
 var BASELINE_END_MARKER = "<!-- PERF_BASELINE_END -->";
 var DEFAULT_BASELINE_PATH = "perf-results/baseline.json";
@@ -4245,11 +4828,10 @@ var BaselineStore = class {
    */
   async load() {
     try {
-      const { readFile, fileExists } = await import("@frontmcp/utils");
-      if (!await fileExists(this.baselinePath)) {
+      if (!await (0, import_utils2.fileExists)(this.baselinePath)) {
         return null;
       }
-      const content = await readFile(this.baselinePath);
+      const content = await (0, import_utils2.readFile)(this.baselinePath);
       this.baseline = JSON.parse(content);
       return this.baseline;
     } catch {
@@ -4260,10 +4842,9 @@ var BaselineStore = class {
    * Save baseline to local file.
    */
   async save(baseline) {
-    const { writeFile, ensureDir } = await import("@frontmcp/utils");
     const dir = this.baselinePath.substring(0, this.baselinePath.lastIndexOf("/"));
-    await ensureDir(dir);
-    await writeFile(this.baselinePath, JSON.stringify(baseline, null, 2));
+    await (0, import_utils2.ensureDir)(dir);
+    await (0, import_utils2.writeFile)(this.baselinePath, JSON.stringify(baseline, null, 2));
     this.baseline = baseline;
   }
   /**
@@ -4539,6 +5120,7 @@ function resetRegressionDetector() {
 }
 
 // libs/testing/src/perf/report-generator.ts
+var import_utils3 = require("@frontmcp/utils");
 var ReportGenerator = class {
   detector;
   constructor() {
@@ -4794,14 +5376,13 @@ var ReportGenerator = class {
   }
 };
 async function saveReports(measurements, outputDir, baseline, gitInfo) {
-  const { writeFile, ensureDir } = await import("@frontmcp/utils");
-  await ensureDir(outputDir);
+  await (0, import_utils3.ensureDir)(outputDir);
   const generator = new ReportGenerator();
   const report = generator.generateReport(measurements, baseline, gitInfo);
   const jsonPath = `${outputDir}/report.json`;
   const markdownPath = `${outputDir}/report.md`;
-  await writeFile(jsonPath, generator.generateJsonReport(report));
-  await writeFile(markdownPath, generator.generateMarkdownReport(report));
+  await (0, import_utils3.writeFile)(jsonPath, generator.generateJsonReport(report));
+  await (0, import_utils3.writeFile)(markdownPath, generator.generateMarkdownReport(report));
   return { jsonPath, markdownPath };
 }
 function createReportGenerator() {