socketduct 0.1.24 → 0.1.26

package/test/integration/multiplexed-transport-set.test.js

@@ -1,11 +1,10 @@
 /* eslint-disable jsdoc/escape-inline-tags, jsdoc/require-param, jsdoc/require-returns */
-import assert from "node:assert/strict"
+import {describe, expect, it, withTestCleanup} from "@velocious/testing"
 import {readFileSync} from "node:fs"
 import {mkdtemp, rm} from "node:fs/promises"
 import {createConnection, createServer} from "node:net"
 import {tmpdir} from "node:os"
 import {join} from "node:path"
-import test from "node:test"
 import {createServer as createTlsServer} from "node:tls"
 
 import {StaticTokenStore} from "../../src/auth/static-token-store.js"
@@ -22,7 +21,7 @@ async function listen(server) {
     server.listen(0, "127.0.0.1", () => { server.off("error", reject); resolve(undefined) })
   })
   const address = server.address()
-  assert(address !== null && typeof address !== "string")
+  if (address === null || typeof address === "string") throw new Error("Expected a bound TCP address")
   return address.port
 }
 
@@ -59,7 +58,7 @@ async function waitForStatus(set, predicate) {
 /** @template T @param {T[]} values - Values. @param {number} index - Index. @returns {T} */
 function at(values, index) {
   const value = values[index]
-  assert(value !== undefined)
+  if (value === undefined) throw new Error(`Expected a value at index ${index}`)
   return value
 }
 
@@ -115,338 +114,351 @@ async function createFirstDataDropProxy(relayPort) {
   }
 }
 
-test("three pinned gateways warm once and balance virtual sockets without extra physical accepts", async (t) => {
-  const root = await mkdtemp(join(tmpdir(), "socketduct-set-integration-"))
-  const target = createServer((socket) => socket.on("data", (chunk) => socket.write(chunk)))
-  const targetPort = await listen(target)
-  t.after(() => new Promise((resolve) => target.close(() => resolve(undefined))))
-  const relays = await Promise.all(["starlink", "zyxel", "o2gateway"].map(() => startMultiplexedTcpRelay({
-    tokens: new StaticTokenStore([{username: "edge", token: "valid-token"}]),
-    authorizeTarget: ({target: requested}) => requested.host === "127.0.0.1" && requested.port === targetPort,
-    maxStreams: 256
-  })))
-  const gatewayIds = ["starlink", "zyxel", "o2gateway"]
-  t.after(() => Promise.all(relays.map((relay) => relay.close())))
+describe("multiplexed transport set", () => {
+  it("three pinned gateways warm once and balance virtual sockets without extra physical accepts", async () => withTestCleanup(async (after) => {
+    const root = await mkdtemp(join(tmpdir(), "socketduct-set-integration-"))
+    const target = createServer((socket) => socket.on("data", (chunk) => socket.write(chunk)))
+    const targetPort = await listen(target)
+    after(() => new Promise((resolve) => target.close(() => resolve(undefined))))
+    const relays = await Promise.all(["starlink", "zyxel", "o2gateway"].map(() => startMultiplexedTcpRelay({
+      tokens: new StaticTokenStore([{username: "edge", token: "valid-token"}]),
+      authorizeTarget: ({target: requested}) => requested.host === "127.0.0.1" && requested.port === targetPort,
+      maxStreams: 256
+    })))
+    const gatewayIds = ["starlink", "zyxel", "o2gateway"]
+    after(async () => {
+      await Promise.all(relays.map((relay) => relay.close()))
+    })
 
-  const set = new MultiplexedSocketductTransportSet({
-    connectionId: "integration_process_01",
-    spoolDirectory: root,
-    minimumReadyMembers: 3,
-    maxTotalBufferBytes: 32 * 1024 * 1024,
-    maxTotalSpoolBytes: 32 * 1024 * 1024,
-    maxTotalQueuedBytes: 33 * 1024 * 1024,
-    memberOptions: {maxStreams: 256, reconnectDelayMs: 10},
-    gateways: relays.map((relay, index) => ({
-      gatewayId: at(gatewayIds, index),
-      endpoint: {relay: {host: "127.0.0.1", port: relay.port, token: "valid-token"}}
-    }))
-  })
-  t.after(async () => {
-    await set.close()
-    await rm(root, {recursive: true, force: true})
-  })
-  const started = set.start()
-  const firstSocket = set.createConnection({
-    host: "127.0.0.1",
-    port: targetPort,
-    sessionName: "set-flow-1"
-  })
-  const firstConnected = onceEvent(firstSocket, "connect")
-  assert.equal(firstSocket.gatewayId, undefined)
-  await Promise.all([started, firstConnected])
-  assert.deepEqual(relays.map((relay) => relay.status().physicalAccepts), [1, 1, 1])
-  assert.deepEqual(relays.map((relay) => relay.status().virtualStreams), [1, 0, 0])
+    const set = new MultiplexedSocketductTransportSet({
+      connectionId: "integration_process_01",
+      spoolDirectory: root,
+      minimumReadyMembers: 3,
+      maxTotalBufferBytes: 32 * 1024 * 1024,
+      maxTotalSpoolBytes: 32 * 1024 * 1024,
+      maxTotalQueuedBytes: 33 * 1024 * 1024,
+      memberOptions: {maxStreams: 256, reconnectDelayMs: 10},
+      gateways: relays.map((relay, index) => ({
+        gatewayId: at(gatewayIds, index),
+        endpoint: {relay: {host: "127.0.0.1", port: relay.port, token: "valid-token"}}
+      }))
+    })
+    after(async () => {
+      await set.close()
+      await rm(root, {recursive: true, force: true})
+    })
+    const started = set.start()
+    const firstSocket = set.createConnection({
+      host: "127.0.0.1",
+      port: targetPort,
+      sessionName: "set-flow-1"
+    })
+    const firstConnected = onceEvent(firstSocket, "connect")
+    expect(firstSocket.gatewayId).toBeUndefined()
+    await Promise.all([started, firstConnected])
+    expect(relays.map((relay) => relay.status().physicalAccepts)).toEqual([1, 1, 1])
+    expect(relays.map((relay) => relay.status().virtualStreams)).toEqual([1, 0, 0])
 
-  const sockets = [firstSocket, ...Array.from({length: 99}, (_, index) => set.createConnection({
-    host: "127.0.0.1",
-    port: targetPort,
-    sessionName: `set-flow-${index + 2}`
-  }))]
-  await Promise.all(sockets.slice(1).map((socket) => onceEvent(socket, "connect")))
-  assert.deepEqual(set.status().members.map((member) => member.assignments), [34, 33, 33])
-  assert.deepEqual(relays.map((relay) => relay.status().physicalAccepts), [1, 1, 1])
-  assert.deepEqual(relays.map((relay) => relay.status().virtualStreams), [34, 33, 33])
-  sockets.forEach((socket) => socket.destroy())
-})
+    const sockets = [firstSocket, ...Array.from({length: 99}, (_, index) => set.createConnection({
+      host: "127.0.0.1",
+      port: targetPort,
+      sessionName: `set-flow-${index + 2}`
+    }))]
+    await Promise.all(sockets.slice(1).map((socket) => onceEvent(socket, "connect")))
+    expect(set.status().members.map((member) => member.assignments)).toEqual([34, 33, 33])
+    expect(relays.map((relay) => relay.status().physicalAccepts)).toEqual([1, 1, 1])
+    expect(relays.map((relay) => relay.status().virtualStreams)).toEqual([34, 33, 33])
+    sockets.forEach((socket) => socket.destroy())
+  }))
 
-test("a failed gateway keeps its streams pinned while healthy siblings take new opens and recovery rejoins", async (t) => {
-  const root = await mkdtemp(join(tmpdir(), "socketduct-set-recovery-"))
-  const target = createServer((socket) => socket.on("data", (chunk) => socket.write(chunk)))
-  const targetPort = await listen(target)
-  t.after(() => new Promise((resolve) => target.close(() => resolve(undefined))))
-  const relays = await Promise.all([0, 1, 2].map(() => startMultiplexedTcpRelay({
-    tokens: new StaticTokenStore([{username: "edge", token: "valid-token"}]),
-    authorizeTarget: ({target: requested}) => requested.port === targetPort
-  })))
-  const gatewayIds = ["starlink", "zyxel", "o2gateway"]
-  t.after(() => Promise.all(relays.map((relay) => relay.close())))
-  const set = new MultiplexedSocketductTransportSet({
-    connectionId: "integration_process_recovery_01",
-    spoolDirectory: root,
-    maxTotalBufferBytes: 32 * 1024 * 1024,
-    maxTotalSpoolBytes: 32 * 1024 * 1024,
-    maxTotalQueuedBytes: 33 * 1024 * 1024,
-    memberOptions: {reconnectDelayMs: 100},
-    gateways: relays.map((relay, index) => ({
-      gatewayId: at(gatewayIds, index),
-      endpoint: {relay: {host: "127.0.0.1", port: relay.port, token: "valid-token"}}
-    }))
-  })
-  t.after(async () => {
-    await set.close()
-    await rm(root, {recursive: true, force: true})
-  })
-  await set.start()
-  await waitForStatus(set, (status) => status.readyMembers === 3)
-  const sticky = Array.from({length: 3}, () => set.createConnection({host: "127.0.0.1", port: targetPort}))
-  await Promise.all(sticky.map((socket) => onceEvent(socket, "connect")))
-  const recovered = onceEvent(at(sticky, 1), "ready")
-  await at(relays, 1).closeActiveTransport()
-  await waitForStatus(set, (status) => at(status.members, 1).state === "reconnecting")
+  it("a failed gateway keeps its streams pinned while healthy siblings take new opens and recovery rejoins", async () => withTestCleanup(async (after) => {
+    const root = await mkdtemp(join(tmpdir(), "socketduct-set-recovery-"))
+    const target = createServer((socket) => socket.on("data", (chunk) => socket.write(chunk)))
+    const targetPort = await listen(target)
+    after(() => new Promise((resolve) => target.close(() => resolve(undefined))))
+    const relays = await Promise.all([0, 1, 2].map(() => startMultiplexedTcpRelay({
+      tokens: new StaticTokenStore([{username: "edge", token: "valid-token"}]),
+      authorizeTarget: ({target: requested}) => requested.port === targetPort
+    })))
+    const gatewayIds = ["starlink", "zyxel", "o2gateway"]
+    after(async () => {
+      await Promise.all(relays.map((relay) => relay.close()))
+    })
+    const set = new MultiplexedSocketductTransportSet({
+      connectionId: "integration_process_recovery_01",
+      spoolDirectory: root,
+      maxTotalBufferBytes: 32 * 1024 * 1024,
+      maxTotalSpoolBytes: 32 * 1024 * 1024,
+      maxTotalQueuedBytes: 33 * 1024 * 1024,
+      memberOptions: {reconnectDelayMs: 100},
+      gateways: relays.map((relay, index) => ({
+        gatewayId: at(gatewayIds, index),
+        endpoint: {relay: {host: "127.0.0.1", port: relay.port, token: "valid-token"}}
+      }))
+    })
+    after(async () => {
+      await set.close()
+      await rm(root, {recursive: true, force: true})
+    })
+    await set.start()
+    await waitForStatus(set, (status) => status.readyMembers === 3)
+    const sticky = Array.from({length: 3}, () => set.createConnection({host: "127.0.0.1", port: targetPort}))
+    await Promise.all(sticky.map((socket) => onceEvent(socket, "connect")))
+    const recovered = onceEvent(at(sticky, 1), "ready")
+    await at(relays, 1).closeActiveTransport()
+    await waitForStatus(set, (status) => at(status.members, 1).state === "reconnecting")
 
-  const siblingOpens = Array.from({length: 10}, () => set.createConnection({host: "127.0.0.1", port: targetPort}))
-  assert.equal(at(set.status().members, 1).assignments, 1)
-  const siblingCounts = [at(set.status().members, 0).assignments, at(set.status().members, 2).assignments]
-  assert(Math.max(...siblingCounts) - Math.min(...siblingCounts) <= 1)
-  await Promise.all(siblingOpens.map((socket) => onceEvent(socket, "connect")))
-  await recovered
-  await waitForStatus(set, (status) => status.readyMembers === 3)
-  const before = at(set.status().members, 1).assignments
-  const rejoined = Array.from({length: 3}, () => set.createConnection({host: "127.0.0.1", port: targetPort}))
-  assert(at(set.status().members, 1).assignments > before)
-  assert.equal(at(sticky, 1).destroyed, false)
-  assert.equal(at(relays, 1).status().physicalAccepts, 2)
-  sticky.forEach((socket) => socket.destroy())
-  siblingOpens.forEach((socket) => socket.destroy())
-  rejoined.forEach((socket) => socket.destroy())
-})
+    const siblingOpens = Array.from({length: 10}, () => set.createConnection({host: "127.0.0.1", port: targetPort}))
+    expect(at(set.status().members, 1).assignments).toBe(1)
+    const siblingCounts = [at(set.status().members, 0).assignments, at(set.status().members, 2).assignments]
+    expect(Math.max(...siblingCounts) - Math.min(...siblingCounts) <= 1).toBeTruthy()
+    await Promise.all(siblingOpens.map((socket) => onceEvent(socket, "connect")))
+    await recovered
+    await waitForStatus(set, (status) => status.readyMembers === 3)
+    const before = at(set.status().members, 1).assignments
+    const rejoined = Array.from({length: 3}, () => set.createConnection({host: "127.0.0.1", port: targetPort}))
+    expect(at(set.status().members, 1).assignments > before).toBeTruthy()
+    expect(at(sticky, 1).destroyed).toBe(false)
+    expect(at(relays, 1).status().physicalAccepts).toBe(2)
+    sticky.forEach((socket) => socket.destroy())
+    siblingOpens.forEach((socket) => socket.destroy())
+    rejoined.forEach((socket) => socket.destroy())
+  }))
 
-test("all reconnecting members hold a new socket until one real member recovers", async (t) => {
-  const root = await mkdtemp(join(tmpdir(), "socketduct-set-all-reconnect-"))
-  const target = createServer((socket) => socket.on("data", (chunk) => socket.write(chunk)))
-  const targetPort = await listen(target)
-  const relays = await Promise.all([0, 1, 2].map(() => startMultiplexedTcpRelay({
-    tokens: new StaticTokenStore([{username: "edge", token: "valid-token"}]),
-    authorizeTarget: ({target: requested}) => requested.port === targetPort
-  })))
-  const gatewayIds = ["starlink", "zyxel", "o2gateway"]
-  const set = new MultiplexedSocketductTransportSet({
-    connectionId: "integration_all_reconnect_01",
-    spoolDirectory: root,
-    minimumReadyMembers: 3,
-    memberOptions: {reconnectDelayMs: 1_000},
-    gateways: relays.map((relay, index) => ({
-      gatewayId: at(gatewayIds, index),
-      endpoint: {relay: {host: "127.0.0.1", port: relay.port, token: "valid-token"}}
-    }))
-  })
-  let siblingRelaysClosed = false
-  t.after(async () => {
-    await set.close()
-    if (!siblingRelaysClosed) await Promise.all(relays.slice(1).map((relay) => relay.close()))
-    await at(relays, 0).close()
-    await new Promise((resolve) => target.close(() => resolve(undefined)))
-    await rm(root, {recursive: true, force: true})
-  })
-  await set.start()
-  await Promise.all(relays.map((relay) => relay.closeActiveTransport()))
-  await waitForStatus(set, (status) => status.readyMembers === 0)
-  await Promise.all(relays.slice(1).map((relay) => relay.close()))
-  siblingRelaysClosed = true
+  it("all reconnecting members hold a new socket until one real member recovers", async () => withTestCleanup(async (after) => {
+    const root = await mkdtemp(join(tmpdir(), "socketduct-set-all-reconnect-"))
+    const target = createServer((socket) => socket.on("data", (chunk) => socket.write(chunk)))
+    const targetPort = await listen(target)
+    const relays = await Promise.all([0, 1, 2].map(() => startMultiplexedTcpRelay({
+      tokens: new StaticTokenStore([{username: "edge", token: "valid-token"}]),
+      authorizeTarget: ({target: requested}) => requested.port === targetPort
+    })))
+    const gatewayIds = ["starlink", "zyxel", "o2gateway"]
+    const set = new MultiplexedSocketductTransportSet({
+      connectionId: "integration_all_reconnect_01",
+      spoolDirectory: root,
+      minimumReadyMembers: 3,
+      memberOptions: {reconnectDelayMs: 1_000},
+      gateways: relays.map((relay, index) => ({
+        gatewayId: at(gatewayIds, index),
+        endpoint: {relay: {host: "127.0.0.1", port: relay.port, token: "valid-token"}}
+      }))
+    })
+    let siblingRelaysClosed = false
+    after(async () => {
+      await set.close()
+      if (!siblingRelaysClosed) await Promise.all(relays.slice(1).map((relay) => relay.close()))
+      await at(relays, 0).close()
+      await new Promise((resolve) => target.close(() => resolve(undefined)))
+      await rm(root, {recursive: true, force: true})
+    })
+    await set.start()
+    await Promise.all(relays.map((relay) => relay.closeActiveTransport()))
+    await waitForStatus(set, (status) => status.readyMembers === 0)
+    await Promise.all(relays.slice(1).map((relay) => relay.close()))
+    siblingRelaysClosed = true
 
-  const socket = set.createConnection({host: "127.0.0.1", port: targetPort})
-  assert.equal(socket.gatewayId, undefined)
-  assert.equal(set.status().pendingOpens, 1)
-  await onceEvent(socket, "connect")
-  assert.equal(socket.gatewayId, "starlink")
-  assert.equal(set.status().pendingOpens, 0)
-  assert.deepEqual(set.status().members.map((member) => member.assignments), [1, 0, 0])
-  socket.destroy()
-})
+    const socket = set.createConnection({host: "127.0.0.1", port: targetPort})
+    expect(socket.gatewayId).toBeUndefined()
+    expect(set.status().pendingOpens).toBe(1)
+    await onceEvent(socket, "connect")
+    expect(socket.gatewayId).toBe("starlink")
+    expect(set.status().pendingOpens).toBe(0)
+    expect(set.status().members.map((member) => member.assignments)).toEqual([1, 0, 0])
+    socket.destroy()
+  }))
 
-test("terminal authentication failure rejects start and the pending socket once", async (t) => {
-  const root = await mkdtemp(join(tmpdir(), "socketduct-set-start-failure-"))
-  const relay = await startMultiplexedTcpRelay({
-    tokens: new StaticTokenStore([{username: "edge", token: "valid-token"}]),
-    authorizeTarget: () => true
-  })
-  const set = new MultiplexedSocketductTransportSet({
-    connectionId: "integration_start_failure_01",
-    spoolDirectory: root,
-    gateways: [{gatewayId: "starlink", endpoint: {relay: {host: "127.0.0.1", port: relay.port, token: "invalid-token"}}}]
-  })
-  t.after(async () => {
-    await set.close()
-    await relay.close()
-    await rm(root, {recursive: true, force: true})
-  })
-  const started = set.start()
-  let callbacks = 0
-  const callbackResult = new Promise((resolve) => {
-    set.createConnection({host: "target.internal", port: 443}, (error, socket) => {
-      callbacks += 1
-      resolve({error, socket})
+  it("terminal authentication failure rejects start and the pending socket once", async () => withTestCleanup(async (after) => {
+    const root = await mkdtemp(join(tmpdir(), "socketduct-set-start-failure-"))
+    const relay = await startMultiplexedTcpRelay({
+      tokens: new StaticTokenStore([{username: "edge", token: "valid-token"}]),
+      authorizeTarget: () => true
     })
-  })
-  await assert.rejects(started, (error) => error instanceof AggregateError)
-  const result = /** @type {{error: Error, socket: import('../../src/client/virtual-socket.js').VirtualSocket}} */ (await callbackResult)
-  assert(result.error instanceof AggregateError)
-  assert.equal(callbacks, 1)
-  assert.equal(result.socket.destroyed, true)
-  assert.equal(set.status().state, "failed")
-  assert.equal(relay.status().virtualStreams, 0)
-})
-
-test("createTlsConnection preserves callback ownership on the selected sticky member", async (t) => {
-  const root = await mkdtemp(join(tmpdir(), "socketduct-set-tls-"))
-  const certs = generateTestCertificates(join(root, "certs"))
-  const target = createTlsServer({
-    cert: readFileSync(certs.serverCertFile),
-    key: readFileSync(certs.serverKeyFile)
-  }, (socket) => socket.on("data", (chunk) => socket.write(chunk)))
-  const targetPort = await listen(target)
-  const relay = await startMultiplexedTcpRelay({
-    tokens: new StaticTokenStore([{username: "edge", token: "valid-token"}]),
-    authorizeTarget: ({target: requested}) => requested.host === "127.0.0.1" && requested.port === targetPort
-  })
-  const set = new MultiplexedSocketductTransportSet({
-    connectionId: "integration_process_tls_01",
-    spoolDirectory: root,
-    gateways: [{gatewayId: "starlink", endpoint: {relay: {host: "127.0.0.1", port: relay.port, token: "valid-token"}}}]
-  })
-  t.after(async () => {
-    await set.close()
-    await relay.close()
-    await new Promise((resolve) => target.close(() => resolve(undefined)))
-    await rm(root, {recursive: true, force: true})
-  })
-  const started = set.start()
-  let callbacks = 0
-  const secure = /** @type {import('node:tls').TLSSocket & {readonly gatewayId: string | undefined}} */ (await new Promise((resolve, reject) => {
-    const returned = set.createTlsConnection({
-      host: "127.0.0.1",
-      port: targetPort,
-      servername: "localhost",
-      ca: readFileSync(certs.caCertFile)
-    }, (error, socket) => {
-      callbacks += 1
-      if (error === null) resolve(socket)
-      else reject(error)
+    const set = new MultiplexedSocketductTransportSet({
+      connectionId: "integration_start_failure_01",
+      spoolDirectory: root,
+      gateways: [{gatewayId: "starlink", endpoint: {relay: {host: "127.0.0.1", port: relay.port, token: "invalid-token"}}}]
+    })
+    after(async () => {
+      await set.close()
+      await relay.close()
+      await rm(root, {recursive: true, force: true})
     })
-    assert(returned !== undefined)
-    assert.equal(returned.gatewayId, undefined)
+    const started = set.start()
+    let callbacks = 0
+    const callbackResult = new Promise((resolve) => {
+      set.createConnection({host: "target.internal", port: 443}, (error, socket) => {
+        callbacks += 1
+        resolve({error, socket})
+      })
+    })
+    let error
+    try {
+      await started
+    } catch (caught) {
+      error = caught
+    }
+    expect(error).toBeDefined()
+    expect(error).toBeInstanceOf(AggregateError)
+    const result = /** @type {{error: Error, socket: import('../../src/client/virtual-socket.js').VirtualSocket}} */ (await callbackResult)
+    expect(result.error).toBeInstanceOf(AggregateError)
+    expect(callbacks).toBe(1)
+    expect(result.socket.destroyed).toBe(true)
+    expect(set.status().state).toBe("failed")
+    expect(relay.status().virtualStreams).toBe(0)
   }))
-  await started
-  assert.equal(callbacks, 1)
-  assert.equal(secure.gatewayId, "starlink")
-  const response = new Promise((resolve, reject) => {
-    secure.once("data", (chunk) => resolve(Buffer.from(chunk)))
-    secure.once("error", reject)
-  })
-  secure.write("tls-over-set")
-  const chunk = /** @type {Buffer} */ (await response)
-  assert.equal(chunk.toString(), "tls-over-set")
-  assert.equal(at(set.status().members, 0).assignments, 1)
-  secure.destroy()
-})
 
-test("process replacement recovers a durable stream on its original named gateway before start", async (t) => {
-  const root = await mkdtemp(join(tmpdir(), "socketduct-set-process-recovery-"))
-  let targetAccepts = 0
-  let received = Buffer.alloc(0)
-  /** @type {() => void} */
-  let resolveReceived = () => {}
-  const receivedAll = new Promise((resolve) => { resolveReceived = () => resolve(undefined) })
-  const target = createServer((socket) => {
-    targetAccepts += 1
-    socket.on("data", (chunk) => {
-      received = Buffer.concat([received, chunk])
-      if (received.length === 32) resolveReceived()
+  it("createTlsConnection preserves callback ownership on the selected sticky member", async () => withTestCleanup(async (after) => {
+    const root = await mkdtemp(join(tmpdir(), "socketduct-set-tls-"))
+    const certs = generateTestCertificates(join(root, "certs"))
+    const target = createTlsServer({
+      cert: readFileSync(certs.serverCertFile),
+      key: readFileSync(certs.serverKeyFile)
+    }, (socket) => socket.on("data", (chunk) => socket.write(chunk)))
+    const targetPort = await listen(target)
+    const relay = await startMultiplexedTcpRelay({
+      tokens: new StaticTokenStore([{username: "edge", token: "valid-token"}]),
+      authorizeTarget: ({target: requested}) => requested.host === "127.0.0.1" && requested.port === targetPort
     })
-  })
-  const targetPort = await listen(target)
-  const relays = await Promise.all([0, 1, 2].map(() => startMultiplexedTcpRelay({
-    tokens: new StaticTokenStore([{username: "edge", token: "valid-token"}]),
-    authorizeTarget: ({target: requested}) => requested.host === "127.0.0.1" && requested.port === targetPort,
-    initialWindowBytes: 32,
-    maxFrameBytes: 32,
-    resumeWindowMs: 2_000
-  })))
-  const fault = await createFirstDataDropProxy(at(relays, 0).port)
-  const gatewayIds = ["starlink", "zyxel", "o2gateway"]
-  const physicalCreates = [0, 0, 0]
-  const physicalFactories = relays.map((_relay, index) => (/** @type {{host: string, port: number}} */ options) => {
-    physicalCreates[index] = at(physicalCreates, index) + 1
-    return createConnection(options)
-  })
-  const setOptions = {
-    connectionId: "replacement_process_identity_01",
-    spoolDirectory: root,
-    minimumReadyMembers: 3,
-    maxTotalBufferBytes: 128,
-    maxTotalSpoolBytes: 128,
-    maxTotalQueuedBytes: 1024,
-    memberOptions: {initialWindowBytes: 32, maxFrameBytes: 32, reconnectDelayMs: 1_000},
-    gateways: relays.map((relay, index) => ({
-      gatewayId: at(gatewayIds, index),
-      endpoint: {
-        relay: {host: "127.0.0.1", port: index === 0 ? fault.port : relay.port, token: "valid-token"},
-        createPhysicalSocket: at(physicalFactories, index)
-      }
+    const set = new MultiplexedSocketductTransportSet({
+      connectionId: "integration_process_tls_01",
+      spoolDirectory: root,
+      gateways: [{gatewayId: "starlink", endpoint: {relay: {host: "127.0.0.1", port: relay.port, token: "valid-token"}}}]
+    })
+    after(async () => {
+      await set.close()
+      await relay.close()
+      await new Promise((resolve) => target.close(() => resolve(undefined)))
+      await rm(root, {recursive: true, force: true})
+    })
+    const started = set.start()
+    let callbacks = 0
+    const secure = /** @type {import('node:tls').TLSSocket & {readonly gatewayId: string | undefined}} */ (await new Promise((resolve, reject) => {
+      const returned = set.createTlsConnection({
+        host: "127.0.0.1",
+        port: targetPort,
+        servername: "localhost",
+        ca: readFileSync(certs.caCertFile)
+      }, (error, socket) => {
+        callbacks += 1
+        if (error === null) resolve(socket)
+        else reject(error)
+      })
+      if (returned === undefined) throw new Error("Expected createTlsConnection to return a socket")
+      expect(returned.gatewayId).toBeUndefined()
     }))
-  }
-  /** @type {MultiplexedSocketductTransportSet | undefined} */
-  let replacement
-  t.after(async () => {
-    await replacement?.close()
-    await Promise.all(relays.map((relay) => relay.close()))
-    await fault.close()
-    await new Promise((resolve) => target.close(() => resolve(undefined)))
-    await rm(root, {recursive: true, force: true})
-  })
+    await started
+    expect(callbacks).toBe(1)
+    expect(secure.gatewayId).toBe("starlink")
+    const response = new Promise((resolve, reject) => {
+      secure.once("data", (chunk) => resolve(Buffer.from(chunk)))
+      secure.once("error", reject)
+    })
+    secure.write("tls-over-set")
+    const chunk = /** @type {Buffer} */ (await response)
+    expect(chunk.toString()).toBe("tls-over-set")
+    expect(at(set.status().members, 0).assignments).toBe(1)
+    secure.destroy()
+  }))
 
-  const original = new MultiplexedSocketductTransportSet(setOptions)
-  await original.start()
-  assert.deepEqual(physicalCreates, [1, 1, 1])
-  const initial = original.createConnection({
-    host: "127.0.0.1",
-    port: targetPort,
-    identifier: "gateway_bound_stream_01",
-    sessionName: "gateway-bound"
-  })
-  await onceEvent(initial, "connect")
-  await new Promise((resolve, reject) => initial.write(Buffer.alloc(32, 0x72), (error) => error ? reject(error) : resolve(undefined)))
-  await fault.dropped
-  await original.detach()
+  it("process replacement recovers a durable stream on its original named gateway before start", async () => withTestCleanup(async (after) => {
+    const root = await mkdtemp(join(tmpdir(), "socketduct-set-process-recovery-"))
+    let targetAccepts = 0
+    let received = Buffer.alloc(0)
+    /** @type {() => void} */
+    let resolveReceived = () => {}
+    const receivedAll = new Promise((resolve) => { resolveReceived = () => resolve(undefined) })
+    const target = createServer((socket) => {
+      targetAccepts += 1
+      socket.on("data", (chunk) => {
+        received = Buffer.concat([received, chunk])
+        if (received.length === 32) resolveReceived()
+      })
+    })
+    const targetPort = await listen(target)
+    const relays = await Promise.all([0, 1, 2].map(() => startMultiplexedTcpRelay({
+      tokens: new StaticTokenStore([{username: "edge", token: "valid-token"}]),
+      authorizeTarget: ({target: requested}) => requested.host === "127.0.0.1" && requested.port === targetPort,
+      initialWindowBytes: 32,
+      maxFrameBytes: 32,
+      resumeWindowMs: 2_000
+    })))
+    const fault = await createFirstDataDropProxy(at(relays, 0).port)
+    const gatewayIds = ["starlink", "zyxel", "o2gateway"]
+    const physicalCreates = [0, 0, 0]
+    const physicalFactories = relays.map((_relay, index) => (/** @type {{host: string, port: number}} */ options) => {
+      physicalCreates[index] = at(physicalCreates, index) + 1
+      return createConnection(options)
+    })
+    const setOptions = {
+      connectionId: "replacement_process_identity_01",
+      spoolDirectory: root,
+      minimumReadyMembers: 3,
+      maxTotalBufferBytes: 128,
+      maxTotalSpoolBytes: 128,
+      maxTotalQueuedBytes: 1024,
+      memberOptions: {initialWindowBytes: 32, maxFrameBytes: 32, reconnectDelayMs: 1_000},
+      gateways: relays.map((relay, index) => ({
+        gatewayId: at(gatewayIds, index),
+        endpoint: {
+          relay: {host: "127.0.0.1", port: index === 0 ? fault.port : relay.port, token: "valid-token"},
+          createPhysicalSocket: at(physicalFactories, index)
+        }
+      }))
+    }
+    /** @type {MultiplexedSocketductTransportSet | undefined} */
+    let replacement
+    after(async () => {
+      await replacement?.close()
+      await Promise.all(relays.map((relay) => relay.close()))
+      await fault.close()
+      await new Promise((resolve) => target.close(() => resolve(undefined)))
+      await rm(root, {recursive: true, force: true})
+    })
 
-  const originalReadChunksAfter = SessionSpool.prototype.readChunksAfter
-  /** @type {() => void} */
-  let resolveRecoveryRead = () => {}
-  const recoveryRead = new Promise((resolve) => { resolveRecoveryRead = () => resolve(undefined) })
-  SessionSpool.prototype.readChunksAfter = async function (/** @type {string} */ identifier, /** @type {number} */ sequence) {
-    const chunks = await originalReadChunksAfter.call(this, identifier, sequence)
-    if (identifier === "gateway_bound_stream_01") resolveRecoveryRead()
-    return chunks
-  }
-  t.after(() => { SessionSpool.prototype.readChunksAfter = originalReadChunksAfter })
-  replacement = new MultiplexedSocketductTransportSet(setOptions)
-  const recovered = replacement.recoverConnection({
-    identifier: "gateway_bound_stream_01"
-  })
-  await recoveryRead
-  await new Promise((resolve) => setImmediate(resolve))
-  assert.deepEqual(physicalCreates, [1, 1, 1])
-  assert.equal(fault.accepts(), 1)
-  assert.deepEqual(replacement.status().members.map((member) => member.assignments), [1, 0, 0])
-  const connected = onceEvent(recovered, "connect")
-  await replacement.start()
-  await connected
-  assert.deepEqual(physicalCreates, [2, 2, 2])
-  await receivedAll
+    const original = new MultiplexedSocketductTransportSet(setOptions)
+    await original.start()
+    expect(physicalCreates).toEqual([1, 1, 1])
+    const initial = original.createConnection({
+      host: "127.0.0.1",
+      port: targetPort,
+      identifier: "gateway_bound_stream_01",
+      sessionName: "gateway-bound"
+    })
+    await onceEvent(initial, "connect")
+    await new Promise((resolve, reject) => initial.write(Buffer.alloc(32, 0x72), (error) => error ? reject(error) : resolve(undefined)))
+    await fault.dropped
+    await original.detach()
 
-  assert.equal(received.toString(), "r".repeat(32))
-  assert.equal(targetAccepts, 1)
-  assert.equal(fault.accepts(), 2)
-  assert.deepEqual(relays.slice(1).map((relay) => relay.status().virtualStreams), [0, 0])
-  recovered.destroy()
+    const originalReadChunksAfter = SessionSpool.prototype.readChunksAfter
+    /** @type {() => void} */
+    let resolveRecoveryRead = () => {}
+    const recoveryRead = new Promise((resolve) => { resolveRecoveryRead = () => resolve(undefined) })
+    SessionSpool.prototype.readChunksAfter = async function (/** @type {string} */ identifier, /** @type {number} */ sequence) {
+      const chunks = await originalReadChunksAfter.call(this, identifier, sequence)
+      if (identifier === "gateway_bound_stream_01") resolveRecoveryRead()
+      return chunks
+    }
+    after(() => { SessionSpool.prototype.readChunksAfter = originalReadChunksAfter })
+    replacement = new MultiplexedSocketductTransportSet(setOptions)
+    const recovered = replacement.recoverConnection({
+      identifier: "gateway_bound_stream_01"
+    })
+    await recoveryRead
+    await new Promise((resolve) => setImmediate(resolve))
+    expect(physicalCreates).toEqual([1, 1, 1])
+    expect(fault.accepts()).toBe(1)
+    expect(replacement.status().members.map((member) => member.assignments)).toEqual([1, 0, 0])
+    const connected = onceEvent(recovered, "connect")
+    await replacement.start()
+    await connected
+    expect(physicalCreates).toEqual([2, 2, 2])
+    await receivedAll
+
+    expect(received.toString()).toBe("r".repeat(32))
+    expect(targetAccepts).toBe(1)
+    expect(fault.accepts()).toBe(2)
+    expect(relays.slice(1).map((relay) => relay.status().virtualStreams)).toEqual([0, 0])
+    recovered.destroy()
+  }))
 })