socketduct 0.1.15

package/test/integration/multiplexed-transport-set.test.js

@@ -0,0 +1,456 @@
+/* eslint-disable jsdoc/escape-inline-tags, jsdoc/require-param, jsdoc/require-returns */
+import assert from "node:assert/strict"
+import {readFileSync} from "node:fs"
+import {mkdtemp, rm} from "node:fs/promises"
+import {createConnection, createServer} from "node:net"
+import {tmpdir} from "node:os"
+import {join} from "node:path"
+import test from "node:test"
+import {createServer as createTlsServer} from "node:tls"
+
+import {StaticTokenStore} from "../../src/auth/static-token-store.js"
+import {MultiplexedSocketductTransportSet} from "../../src/client/multiplexed-transport-set.js"
+import {encodeV3Frame, V3FrameDecoder, V3FrameType} from "../../src/protocol/v3-frame.js"
+import {startMultiplexedTcpRelay} from "../../src/proxy/multiplexed-relay.js"
+import {SessionSpool} from "../../src/spool/spool-file.js"
+import {generateTestCertificates} from "../helpers/tls-certificates.js"
+
+/** @param {import('node:net').Server} server - Server. @returns {Promise<number>} */
+async function listen(server) {
+  await new Promise((resolve, reject) => {
+    server.once("error", reject)
+    server.listen(0, "127.0.0.1", () => { server.off("error", reject); resolve(undefined) })
+  })
+  const address = server.address()
+  assert(address !== null && typeof address !== "string")
+  return address.port
+}
+
+/** @param {import('node:events').EventEmitter} emitter - Emitter. @param {string} event - Event. @returns {Promise<void>} */
+async function onceEvent(emitter, event) {
+  await new Promise((resolve, reject) => {
+    emitter.once("error", reject)
+    emitter.once(event, () => { emitter.off("error", reject); resolve(undefined) })
+  })
+}
+
+/**
+ * @param {MultiplexedSocketductTransportSet} set - Transport set.
+ * @param {(status: ReturnType<MultiplexedSocketductTransportSet['status']>) => boolean} predicate - Condition.
+ * @returns {Promise<void>}
+ */
+async function waitForStatus(set, predicate) {
+  if (predicate(set.status())) return
+  await new Promise((resolve, reject) => {
+    const timeout = setTimeout(() => { cleanup(); reject(new Error("timed out waiting for transport-set status")) }, 2_000)
+    const changed = () => {
+      if (!predicate(set.status())) return
+      cleanup()
+      resolve(undefined)
+    }
+    const cleanup = () => {
+      clearTimeout(timeout)
+      set.off("stateChange", changed)
+    }
+    set.on("stateChange", changed)
+  })
+}
+
+/** @template T @param {T[]} values - Values. @param {number} index - Index. @returns {T} */
+function at(values, index) {
+  const value = values[index]
+  assert(value !== undefined)
+  return value
+}
+
+/** @param {number} relayPort - Relay port. */
+async function createFirstDataDropProxy(relayPort) {
+  let accepts = 0
+  /** @type {() => void} */
+  let resolveDropped = () => {}
+  const dropped = new Promise((resolve) => { resolveDropped = () => resolve(undefined) })
+  const sockets = new Set()
+  const server = createServer((downstream) => {
+    sockets.add(downstream)
+    accepts += 1
+    const generation = accepts
+    const upstream = createConnection({host: "127.0.0.1", port: relayPort})
+    sockets.add(upstream)
+    const cleanup = () => {
+      sockets.delete(downstream)
+      sockets.delete(upstream)
+    }
+    downstream.once("close", cleanup)
+    upstream.once("close", cleanup)
+    downstream.on("error", () => {})
+    upstream.on("error", () => {})
+    if (generation !== 1) {
+      downstream.pipe(upstream)
+      upstream.pipe(downstream)
+      return
+    }
+    const decoder = new V3FrameDecoder({maxFrameBytes: 64 * 1024, maxBufferedBytes: 128 * 1024})
+    downstream.on("data", (chunk) => {
+      for (const frame of decoder.push(chunk)) {
+        if (frame.type === V3FrameType.DATA) {
+          resolveDropped()
+          downstream.destroy()
+          upstream.destroy()
+          return
+        }
+        upstream.write(encodeV3Frame(frame, frame.payload))
+      }
+    })
+    upstream.pipe(downstream)
+  })
+  const port = await listen(server)
+  return {
+    port,
+    dropped,
+    accepts: () => accepts,
+    async close() {
+      for (const socket of sockets) socket.destroy()
+      await new Promise((resolve) => server.close(() => resolve(undefined)))
+    }
+  }
+}
+
+test("three pinned gateways warm once and balance virtual sockets without extra physical accepts", async (t) => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-set-integration-"))
+  const target = createServer((socket) => socket.on("data", (chunk) => socket.write(chunk)))
+  const targetPort = await listen(target)
+  t.after(() => new Promise((resolve) => target.close(() => resolve(undefined))))
+  const relays = await Promise.all(["starlink", "zyxel", "o2gateway"].map(() => startMultiplexedTcpRelay({
+    tokens: new StaticTokenStore([{username: "edge", token: "valid-token"}]),
+    authorizeTarget: ({target: requested}) => requested.host === "127.0.0.1" && requested.port === targetPort,
+    maxStreams: 256
+  })))
+  const gatewayIds = ["starlink", "zyxel", "o2gateway"]
+  t.after(() => Promise.all(relays.map((relay) => relay.close())))
+
+  const set = new MultiplexedSocketductTransportSet({
+    connectionId: "integration_process_01",
+    spoolDirectory: root,
+    minimumReadyMembers: 3,
+    maxTotalBufferBytes: 32 * 1024 * 1024,
+    maxTotalSpoolBytes: 32 * 1024 * 1024,
+    maxTotalQueuedBytes: 33 * 1024 * 1024,
+    memberOptions: {maxStreams: 256, reconnectDelayMs: 10},
+    gateways: relays.map((relay, index) => ({
+      gatewayId: at(gatewayIds, index),
+      endpoint: {relay: {host: "127.0.0.1", port: relay.port, token: "valid-token"}}
+    }))
+  })
+  t.after(async () => {
+    await set.close()
+    await rm(root, {recursive: true, force: true})
+  })
+  const started = set.start()
+  const firstSocket = set.createConnection({
+    host: "127.0.0.1",
+    port: targetPort,
+    sessionName: "set-flow-1"
+  })
+  const firstConnected = onceEvent(firstSocket, "connect")
+  assert.equal(firstSocket.gatewayId, undefined)
+  await Promise.all([started, firstConnected])
+  assert.deepEqual(relays.map((relay) => relay.status().physicalAccepts), [1, 1, 1])
+  assert.deepEqual(relays.map((relay) => relay.status().virtualStreams), [1, 0, 0])
+
+  const sockets = [firstSocket, ...Array.from({length: 99}, (_, index) => set.createConnection({
+    host: "127.0.0.1",
+    port: targetPort,
+    sessionName: `set-flow-${index + 2}`
+  }))]
+  await Promise.all(sockets.slice(1).map((socket) => onceEvent(socket, "connect")))
+  assert.deepEqual(set.status().members.map((member) => member.assignments), [34, 33, 33])
+  assert.deepEqual(relays.map((relay) => relay.status().physicalAccepts), [1, 1, 1])
+  assert.deepEqual(relays.map((relay) => relay.status().virtualStreams), [34, 33, 33])
+  sockets.forEach((socket) => socket.destroy())
+})
+
+test("a failed gateway keeps its streams pinned while healthy siblings take new opens and recovery rejoins", async (t) => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-set-recovery-"))
+  const target = createServer((socket) => socket.on("data", (chunk) => socket.write(chunk)))
+  const targetPort = await listen(target)
+  t.after(() => new Promise((resolve) => target.close(() => resolve(undefined))))
+  const relays = await Promise.all([0, 1, 2].map(() => startMultiplexedTcpRelay({
+    tokens: new StaticTokenStore([{username: "edge", token: "valid-token"}]),
+    authorizeTarget: ({target: requested}) => requested.port === targetPort
+  })))
+  const gatewayIds = ["starlink", "zyxel", "o2gateway"]
+  t.after(() => Promise.all(relays.map((relay) => relay.close())))
+  const set = new MultiplexedSocketductTransportSet({
+    connectionId: "integration_process_recovery_01",
+    spoolDirectory: root,
+    maxTotalBufferBytes: 32 * 1024 * 1024,
+    maxTotalSpoolBytes: 32 * 1024 * 1024,
+    maxTotalQueuedBytes: 33 * 1024 * 1024,
+    memberOptions: {reconnectDelayMs: 100},
+    gateways: relays.map((relay, index) => ({
+      gatewayId: at(gatewayIds, index),
+      endpoint: {relay: {host: "127.0.0.1", port: relay.port, token: "valid-token"}}
+    }))
+  })
+  t.after(async () => {
+    await set.close()
+    await rm(root, {recursive: true, force: true})
+  })
+  await set.start()
+  await waitForStatus(set, (status) => status.readyMembers === 3)
+  const sticky = Array.from({length: 3}, () => set.createConnection({host: "127.0.0.1", port: targetPort}))
+  await Promise.all(sticky.map((socket) => onceEvent(socket, "connect")))
+  const recovered = onceEvent(at(sticky, 1), "ready")
+  await at(relays, 1).closeActiveTransport()
+  await waitForStatus(set, (status) => at(status.members, 1).state === "reconnecting")
+
+  const siblingOpens = Array.from({length: 10}, () => set.createConnection({host: "127.0.0.1", port: targetPort}))
+  assert.equal(at(set.status().members, 1).assignments, 1)
+  const siblingCounts = [at(set.status().members, 0).assignments, at(set.status().members, 2).assignments]
+  assert(Math.max(...siblingCounts) - Math.min(...siblingCounts) <= 1)
+  await Promise.all(siblingOpens.map((socket) => onceEvent(socket, "connect")))
+  await recovered
+  await waitForStatus(set, (status) => status.readyMembers === 3)
+  const before = at(set.status().members, 1).assignments
+  const rejoined = Array.from({length: 3}, () => set.createConnection({host: "127.0.0.1", port: targetPort}))
+  assert(at(set.status().members, 1).assignments > before)
+  assert.equal(at(sticky, 1).destroyed, false)
+  assert.equal(at(relays, 1).status().physicalAccepts, 2)
+  sticky.forEach((socket) => socket.destroy())
+  siblingOpens.forEach((socket) => socket.destroy())
+  rejoined.forEach((socket) => socket.destroy())
+})
+
+test("all reconnecting members hold a new socket until one real member recovers", async (t) => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-set-all-reconnect-"))
+  const target = createServer((socket) => socket.on("data", (chunk) => socket.write(chunk)))
+  const targetPort = await listen(target)
+  const relays = await Promise.all([0, 1, 2].map(() => startMultiplexedTcpRelay({
+    tokens: new StaticTokenStore([{username: "edge", token: "valid-token"}]),
+    authorizeTarget: ({target: requested}) => requested.port === targetPort
+  })))
+  const gatewayIds = ["starlink", "zyxel", "o2gateway"]
+  const set = new MultiplexedSocketductTransportSet({
+    connectionId: "integration_all_reconnect_01",
+    spoolDirectory: root,
+    minimumReadyMembers: 3,
+    memberOptions: {reconnectDelayMs: 1_000},
+    gateways: relays.map((relay, index) => ({
+      gatewayId: at(gatewayIds, index),
+      endpoint: {relay: {host: "127.0.0.1", port: relay.port, token: "valid-token"}}
+    }))
+  })
+  let siblingRelaysClosed = false
+  t.after(async () => {
+    await set.close()
+    if (!siblingRelaysClosed) await Promise.all(relays.slice(1).map((relay) => relay.close()))
+    await at(relays, 0).close()
+    await new Promise((resolve) => target.close(() => resolve(undefined)))
+    await rm(root, {recursive: true, force: true})
+  })
+  await set.start()
+  await Promise.all(relays.map((relay) => relay.closeActiveTransport()))
+  await waitForStatus(set, (status) => status.readyMembers === 0)
+  await Promise.all(relays.slice(1).map((relay) => relay.close()))
+  siblingRelaysClosed = true
+
+  const socket = set.createConnection({host: "127.0.0.1", port: targetPort})
+  assert.equal(socket.gatewayId, undefined)
+  assert.equal(set.status().pendingOpens, 1)
+  await onceEvent(socket, "connect")
+  assert.equal(socket.gatewayId, "starlink")
+  assert.equal(set.status().pendingOpens, 0)
+  assert.deepEqual(set.status().members.map((member) => member.assignments), [1, 0, 0])
+  socket.destroy()
+})
+
+test("terminal authentication failure rejects start and the pending socket once", async (t) => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-set-start-failure-"))
+  const relay = await startMultiplexedTcpRelay({
+    tokens: new StaticTokenStore([{username: "edge", token: "valid-token"}]),
+    authorizeTarget: () => true
+  })
+  const set = new MultiplexedSocketductTransportSet({
+    connectionId: "integration_start_failure_01",
+    spoolDirectory: root,
+    gateways: [{gatewayId: "starlink", endpoint: {relay: {host: "127.0.0.1", port: relay.port, token: "invalid-token"}}}]
+  })
+  t.after(async () => {
+    await set.close()
+    await relay.close()
+    await rm(root, {recursive: true, force: true})
+  })
+  const started = set.start()
+  let callbacks = 0
+  const callbackResult = new Promise((resolve) => {
+    set.createConnection({host: "target.internal", port: 443}, (error, socket) => {
+      callbacks += 1
+      resolve({error, socket})
+    })
+  })
+  await assert.rejects(started, (error) => error instanceof AggregateError)
+  const result = /** @type {{error: Error, socket: import('../../src/client/virtual-socket.js').VirtualSocket}} */ (await callbackResult)
+  assert(result.error instanceof AggregateError)
+  assert.equal(callbacks, 1)
+  assert.equal(result.socket.destroyed, true)
+  assert.equal(set.status().state, "failed")
+  assert.equal(relay.status().virtualStreams, 0)
+})
+
+test("createTlsConnection preserves callback ownership on the selected sticky member", async (t) => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-set-tls-"))
+  const certs = generateTestCertificates(join(root, "certs"))
+  const target = createTlsServer({
+    cert: readFileSync(certs.serverCertFile),
+    key: readFileSync(certs.serverKeyFile)
+  }, (socket) => socket.on("data", (chunk) => socket.write(chunk)))
+  const targetPort = await listen(target)
+  const relay = await startMultiplexedTcpRelay({
+    tokens: new StaticTokenStore([{username: "edge", token: "valid-token"}]),
+    authorizeTarget: ({target: requested}) => requested.host === "127.0.0.1" && requested.port === targetPort
+  })
+  const set = new MultiplexedSocketductTransportSet({
+    connectionId: "integration_process_tls_01",
+    spoolDirectory: root,
+    gateways: [{gatewayId: "starlink", endpoint: {relay: {host: "127.0.0.1", port: relay.port, token: "valid-token"}}}]
+  })
+  t.after(async () => {
+    await set.close()
+    await relay.close()
+    await new Promise((resolve) => target.close(() => resolve(undefined)))
+    await rm(root, {recursive: true, force: true})
+  })
+  const started = set.start()
+  let callbacks = 0
+  const secure = /** @type {import('node:tls').TLSSocket & {readonly gatewayId: string | undefined}} */ (await new Promise((resolve, reject) => {
+    const returned = set.createTlsConnection({
+      host: "127.0.0.1",
+      port: targetPort,
+      servername: "localhost",
+      ca: readFileSync(certs.caCertFile)
+    }, (error, socket) => {
+      callbacks += 1
+      if (error === null) resolve(socket)
+      else reject(error)
+    })
+    assert(returned !== undefined)
+    assert.equal(returned.gatewayId, undefined)
+  }))
+  await started
+  assert.equal(callbacks, 1)
+  assert.equal(secure.gatewayId, "starlink")
+  const response = new Promise((resolve, reject) => {
+    secure.once("data", (chunk) => resolve(Buffer.from(chunk)))
+    secure.once("error", reject)
+  })
+  secure.write("tls-over-set")
+  const chunk = /** @type {Buffer} */ (await response)
+  assert.equal(chunk.toString(), "tls-over-set")
+  assert.equal(at(set.status().members, 0).assignments, 1)
+  secure.destroy()
+})
+
+test("process replacement recovers a durable stream on its original named gateway before start", async (t) => {
+  const root = await mkdtemp(join(tmpdir(), "socketduct-set-process-recovery-"))
+  let targetAccepts = 0
+  let received = Buffer.alloc(0)
+  /** @type {() => void} */
+  let resolveReceived = () => {}
+  const receivedAll = new Promise((resolve) => { resolveReceived = () => resolve(undefined) })
+  const target = createServer((socket) => {
+    targetAccepts += 1
+    socket.on("data", (chunk) => {
+      received = Buffer.concat([received, chunk])
+      if (received.length === 32) resolveReceived()
+    })
+  })
+  const targetPort = await listen(target)
+  const relays = await Promise.all([0, 1, 2].map(() => startMultiplexedTcpRelay({
+    tokens: new StaticTokenStore([{username: "edge", token: "valid-token"}]),
+    authorizeTarget: ({target: requested}) => requested.host === "127.0.0.1" && requested.port === targetPort,
+    initialWindowBytes: 32,
+    maxFrameBytes: 32,
+    resumeWindowMs: 2_000
+  })))
+  const fault = await createFirstDataDropProxy(at(relays, 0).port)
+  const gatewayIds = ["starlink", "zyxel", "o2gateway"]
+  const physicalCreates = [0, 0, 0]
+  const physicalFactories = relays.map((_relay, index) => (/** @type {{host: string, port: number}} */ options) => {
+    physicalCreates[index] = at(physicalCreates, index) + 1
+    return createConnection(options)
+  })
+  const setOptions = {
+    connectionId: "replacement_process_identity_01",
+    spoolDirectory: root,
+    minimumReadyMembers: 3,
+    maxTotalBufferBytes: 128,
+    maxTotalSpoolBytes: 128,
+    maxTotalQueuedBytes: 1024,
+    memberOptions: {initialWindowBytes: 32, maxFrameBytes: 32, reconnectDelayMs: 1_000},
+    gateways: relays.map((relay, index) => ({
+      gatewayId: at(gatewayIds, index),
+      endpoint: {
+        relay: {host: "127.0.0.1", port: index === 0 ? fault.port : relay.port, token: "valid-token"},
+        createPhysicalSocket: at(physicalFactories, index)
+      }
+    }))
+  }
+  /** @type {MultiplexedSocketductTransportSet | undefined} */
+  let replacement
+  t.after(async () => {
+    await replacement?.close()
+    await Promise.all(relays.map((relay) => relay.close()))
+    await fault.close()
+    await new Promise((resolve) => target.close(() => resolve(undefined)))
+    await rm(root, {recursive: true, force: true})
+  })
+
+  const original = new MultiplexedSocketductTransportSet(setOptions)
+  await original.start()
+  assert.deepEqual(physicalCreates, [1, 1, 1])
+  const initial = original.createConnection({
+    host: "127.0.0.1",
+    port: targetPort,
+    identifier: "gateway_bound_stream_01",
+    sessionName: "gateway-bound"
+  })
+  await onceEvent(initial, "connect")
+  await new Promise((resolve, reject) => initial.write(Buffer.alloc(32, 0x72), (error) => error ? reject(error) : resolve(undefined)))
+  await fault.dropped
+  await original.detach()
+
+  const originalReadChunksAfter = SessionSpool.prototype.readChunksAfter
+  /** @type {() => void} */
+  let resolveRecoveryRead = () => {}
+  const recoveryRead = new Promise((resolve) => { resolveRecoveryRead = () => resolve(undefined) })
+  SessionSpool.prototype.readChunksAfter = async function (/** @type {string} */ identifier, /** @type {number} */ sequence) {
+    const chunks = await originalReadChunksAfter.call(this, identifier, sequence)
+    if (identifier === "gateway_bound_stream_01") resolveRecoveryRead()
+    return chunks
+  }
+  t.after(() => { SessionSpool.prototype.readChunksAfter = originalReadChunksAfter })
+  replacement = new MultiplexedSocketductTransportSet(setOptions)
+  const recovered = replacement.recoverConnection({
+    gatewayId: "starlink",
+    host: "127.0.0.1",
+    port: targetPort,
+    identifier: "gateway_bound_stream_01",
+    sessionName: "gateway-bound"
+  })
+  await recoveryRead
+  await new Promise((resolve) => setImmediate(resolve))
+  assert.deepEqual(physicalCreates, [1, 1, 1])
+  assert.equal(fault.accepts(), 1)
+  assert.deepEqual(replacement.status().members.map((member) => member.assignments), [1, 0, 0])
+  const connected = onceEvent(recovered, "connect")
+  await replacement.start()
+  await connected
+  assert.deepEqual(physicalCreates, [2, 2, 2])
+  await receivedAll
+
+  assert.equal(received.toString(), "r".repeat(32))
+  assert.equal(targetAccepts, 1)
+  assert.equal(fault.accepts(), 2)
+  assert.deepEqual(relays.slice(1).map((relay) => relay.status().virtualStreams), [0, 0])
+  recovered.destroy()
+})

package/test/integration/multiplexed-transport.test.js

@@ -0,0 +1,208 @@
+/* eslint-disable jsdoc/escape-inline-tags, jsdoc/require-param-type, jsdoc/require-returns */
+import assert from "node:assert/strict"
+import {createServer} from "node:net"
+import test from "node:test"
+
+import {StaticTokenStore} from "../../src/auth/static-token-store.js"
+import {MultiplexedSocketductConnection} from "../../src/client/multiplexed-connection.js"
+import {startMultiplexedTcpRelay} from "../../src/proxy/multiplexed-relay.js"
+
+/** @param {import('node:net').Server} server - Server. @returns {Promise<number>} */
+async function listen(server) {
+  await new Promise((resolve, reject) => {
+    server.once("error", reject)
+    server.listen(0, "127.0.0.1", () => {
+      server.off("error", reject)
+      resolve(undefined)
+    })
+  })
+  const address = server.address()
+  assert(address !== null && typeof address !== "string")
+  return address.port
+}
+
+/**
+ * @param {import('node:events').EventEmitter} emitter - Emitter. @param {string} event - Event. @returns {Promise<void>}
+ * @param event
+ */
+async function onceEvent(emitter, event) {
+  await new Promise((resolve, reject) => {
+    emitter.once("error", reject)
+    emitter.once(event, () => {
+      emitter.off("error", reject)
+      resolve(undefined)
+    })
+  })
+}
+
+/**
+ * @param {import('node:stream').Duplex} socket - Socket. @param {string} expected - Expected text. @returns {Promise<void>}
+ * @param expected
+ */
+async function readExactly(socket, expected) {
+  await new Promise((resolve, reject) => {
+    let value = ""
+    /** @param {Error} error - Read error. */
+    const onError = (error) => { cleanup(); reject(error) }
+    /** @param {Buffer} chunk - Data. */
+    const onData = (chunk) => {
+      value += chunk.toString()
+      if (value.length < expected.length) return
+      cleanup()
+      try {
+        assert.equal(value, expected)
+        resolve(undefined)
+      } catch (error) {
+        reject(error)
+      }
+    }
+    const cleanup = () => {
+      socket.off("error", onError)
+      socket.off("data", onData)
+    }
+    socket.on("error", onError)
+    socket.on("data", onData)
+  })
+}
+
+test("two virtual sockets use one authenticated physical transport", async (t) => {
+  let targetAccepts = 0
+  const target = createServer((socket) => {
+    targetAccepts += 1
+    socket.on("data", (chunk) => socket.write(chunk))
+  })
+  const targetPort = await listen(target)
+  t.after(() => new Promise((resolve) => target.close(() => resolve(undefined))))
+
+  const relay = await startMultiplexedTcpRelay({
+    tokens: new StaticTokenStore([{username: "edge", token: "valid-token"}]),
+    authorizeTarget: ({target: requested}) => requested.host === "127.0.0.1" && requested.port === targetPort
+  })
+  t.after(() => relay.close())
+
+  const connection = new MultiplexedSocketductConnection({
+    relay: {host: "127.0.0.1", port: relay.port, token: "valid-token"}
+  })
+  t.after(() => connection.close())
+
+  const first = connection.createConnection({host: "127.0.0.1", port: targetPort, sessionName: "first"})
+  const second = connection.createConnection({host: "127.0.0.1", port: targetPort, sessionName: "second"})
+  await Promise.all([onceEvent(first, "connect"), onceEvent(second, "connect")])
+
+  first.write("one")
+  second.write("two")
+  await Promise.all([readExactly(first, "one"), readExactly(second, "two")])
+
+  assert.equal(relay.status().physicalAccepts, 1)
+  assert.equal(relay.status().authenticatedConnections, 1)
+  assert.equal(targetAccepts, 2)
+  assert.equal(connection.status().virtualStreams, 2)
+
+  first.destroy()
+  assert.equal(second.destroyed, false)
+  second.destroy()
+})
+
+test("one transport drop has one reconnect owner and resumes sibling streams without gaps", async (t) => {
+  /** @type {Array<{event: string} & Record<string, unknown>>} */
+  const lifecycle = []
+  const logger = {log: (/** @type {string} */ event, /** @type {Record<string, unknown>} */ fields = {}) => lifecycle.push({event, ...fields})}
+  const target = createServer((socket) => socket.on("data", (chunk) => socket.write(chunk)))
+  const targetPort = await listen(target)
+  t.after(() => new Promise((resolve) => target.close(() => resolve(undefined))))
+  const relay = await startMultiplexedTcpRelay({
+    tokens: new StaticTokenStore([{username: "edge", token: "valid-token"}]),
+    authorizeTarget: ({target: requested}) => requested.host === "127.0.0.1" && requested.port === targetPort
+  })
+  t.after(() => relay.close())
+  const connection = new MultiplexedSocketductConnection({
+    relay: {host: "127.0.0.1", port: relay.port, token: "valid-token"},
+    reconnectDelayMs: 10,
+    logger
+  })
+  t.after(() => connection.close())
+  const first = connection.createConnection({host: "127.0.0.1", port: targetPort, sessionName: "resume-a"})
+  const second = connection.createConnection({host: "127.0.0.1", port: targetPort, sessionName: "resume-b"})
+  await Promise.all([onceEvent(first, "connect"), onceEvent(second, "connect")])
+  first.write("before-a")
+  second.write("before-b")
+  await Promise.all([readExactly(first, "before-a"), readExactly(second, "before-b")])
+
+  const ready = Promise.all([onceEvent(first, "ready"), onceEvent(second, "ready")])
+  await relay.closeActiveTransport()
+  first.write("after-a")
+  second.write("after-b")
+  await ready
+  await Promise.all([readExactly(first, "after-a"), readExactly(second, "after-b")])
+
+  assert.equal(relay.status().physicalAccepts, 2)
+  assert.equal(connection.status().reconnectAttempts, 1)
+  assert.equal(connection.status().reconnectSuccesses, 1)
+  assert.equal(relay.status().resumeSuccesses, 2)
+  const closed = Promise.all([onceEvent(first, "close"), onceEvent(second, "close")])
+  first.destroy()
+  second.destroy()
+  await closed
+  for (const event of [
+    "transport.connecting",
+    "transport.connected",
+    "transport.disconnected",
+    "transport.reconnect_scheduled",
+    "transport.reconnect_succeeded",
+    "virtual_stream.opening",
+    "virtual_stream.opened",
+    "virtual_stream.closed"
+  ]) assert(lifecycle.some((entry) => entry.event === event), `missing ${event}`)
+  assert.doesNotMatch(JSON.stringify(lifecycle), /valid-token|resume-a|resume-b|127\.0\.0\.1/)
+})
+
+test("100 concurrent build-like streams create zero extra physical accepts", async (t) => {
+  let targetAccepts = 0
+  const target = createServer((socket) => {
+    targetAccepts += 1
+    socket.on("data", (chunk) => {
+      const split = Math.max(1, Math.floor(chunk.length / 2))
+      socket.write(chunk.subarray(0, split))
+      socket.write(chunk.subarray(split))
+    })
+  })
+  const targetPort = await listen(target)
+  t.after(() => new Promise((resolve) => target.close(() => resolve(undefined))))
+  const relay = await startMultiplexedTcpRelay({
+    tokens: new StaticTokenStore([{username: "edge", token: "valid-token"}]),
+    authorizeTarget: ({target: requested}) => requested.host === "127.0.0.1" && requested.port === targetPort,
+    maxStreams: 128
+  })
+  t.after(() => relay.close())
+  const connection = new MultiplexedSocketductConnection({
+    relay: {host: "127.0.0.1", port: relay.port, token: "valid-token"},
+    maxStreams: 128
+  })
+  t.after(() => connection.close())
+
+  const sockets = Array.from({length: 100}, (_, index) => connection.createConnection({
+    host: "127.0.0.1",
+    port: targetPort,
+    sessionName: `build-flow-${index + 1}`
+  }))
+  await Promise.all(sockets.map((socket) => onceEvent(socket, "connect")))
+  const reads = sockets.map((socket, index) => readExactly(socket, `flow-${index + 1}:${"x".repeat(1024)}`))
+  sockets.forEach((socket, index) => socket.write(`flow-${index + 1}:${"x".repeat(1024)}`))
+  await Promise.all(reads)
+
+  assert.equal(relay.status().physicalAccepts, 1)
+  assert.equal(relay.status().physicalConnections, 1)
+  assert.equal(targetAccepts, 100)
+  assert.equal(connection.status().virtualStreams, 100)
+
+  const resumed = Promise.all(sockets.map((socket) => onceEvent(socket, "ready")))
+  await relay.closeActiveTransport()
+  await resumed
+  const resumedReads = sockets.map((socket, index) => readExactly(socket, `resumed-${index + 1}`))
+  sockets.forEach((socket, index) => socket.write(`resumed-${index + 1}`))
+  await Promise.all(resumedReads)
+  assert.equal(relay.status().physicalAccepts, 2)
+  assert.equal(relay.status().resumeSuccesses, 100)
+  assert.equal(connection.status().reconnectAttempts, 1)
+  sockets.forEach((socket) => socket.destroy())
+})