socketduct 0.1.25 → 0.1.26

package/test/integration/socketduct-https-agent.test.js

@@ -1,4 +1,4 @@
-import assert from "node:assert/strict"
+import {describe, expect, it} from "@velocious/testing"
 import {createHook} from "node:async_hooks"
 import {once} from "node:events"
 import {mkdtemp, readdir, readFile, rm} from "node:fs/promises"
@@ -6,7 +6,6 @@ import https from "node:https"
 import {createServer as createTcpServer} from "node:net"
 import {tmpdir} from "node:os"
 import {join} from "node:path"
-import test from "node:test"
 
 import {InMemoryUserStore, login, TokenStore} from "../../src/auth/user-store.js"
 import {SocketductHttpsAgent} from "../../src/client/https-agent.js"
@@ -146,524 +145,556 @@ function createAgent(targetTls, fixture) {
   })
 }
 
-test("SocketductHttpsAgent rejects callback-less direct connections before allocating resources", async () => {
-  const root = await mkdtemp(join(tmpdir(), "socketduct-https-unowned-"))
-  let targetConnections = 0
-  const targetServer = createTcpServer(() => { targetConnections += 1 })
-  const port = await listen(targetServer)
-  const fixture = await authenticatedRelay(port)
-  const agent = createAgent({ca: Buffer.alloc(0)}, {
-    port, relay: fixture.relay, spoolDirectory: join(root, "spool"), token: fixture.token
-  })
-  try {
-    assert.throws(() => Reflect.apply(agent.createConnection, agent, [{host: "localhost", port: 443}]), {
-      code: "ERR_INVALID_ARG_TYPE"
-    })
-    await new Promise((resolve) => setImmediate(resolve))
-    assert.equal(targetConnections, 0)
-    assert.deepEqual(fixture.relay.status(), {
-      activeTunnels: 0, activeTargets: 0, sessions: 0, attachedSessions: 0,
-      detachedSessions: 0, bufferedTargetBytes: 0, targetConnectionAttempts: 0, targetRetryTimers: 0
-    })
-    assert.deepEqual(await readdir(join(root, "spool")).catch((error) => {
-      if (error instanceof Error && /** @type {Error & {code?: string}} */ (error).code === "ENOENT") return []
-      throw error
-    }), [])
-  } finally {
-    agent.destroy()
-    await fixture.relay.close()
-    await closeServer(targetServer)
-    await rm(root, {recursive: true, force: true})
-  }
-})
-
-test("SocketductHttpsAgent rejects an already-aborted request before allocating resources", async () => {
-  const root = await mkdtemp(join(tmpdir(), "socketduct-https-pre-aborted-"))
-  let targetConnections = 0
-  const targetServer = createTcpServer(() => { targetConnections += 1 })
-  const port = await listen(targetServer)
-  const fixture = await authenticatedRelay(port)
-  const agent = createAgent({ca: Buffer.alloc(0)}, {
-    port, relay: fixture.relay, spoolDirectory: join(root, "spool"), token: fixture.token
-  })
-  const controller = new AbortController()
-  controller.abort()
-  try {
-    await assert.rejects(request({agent, host: "localhost", port: 443, path: "/already-aborted", signal: controller.signal}), (error) => {
-      return error instanceof Error && error.name === "AbortError"
+describe("socketduct https agent", () => {
+  it("SocketductHttpsAgent rejects callback-less direct connections before allocating resources", async () => {
+    const root = await mkdtemp(join(tmpdir(), "socketduct-https-unowned-"))
+    let targetConnections = 0
+    const targetServer = createTcpServer(() => { targetConnections += 1 })
+    const port = await listen(targetServer)
+    const fixture = await authenticatedRelay(port)
+    const agent = createAgent({ca: Buffer.alloc(0)}, {
+      port, relay: fixture.relay, spoolDirectory: join(root, "spool"), token: fixture.token
     })
-    await new Promise((resolve) => setImmediate(resolve))
-    assert.equal(targetConnections, 0)
-    assert.equal(fixture.relay.status().sessions, 0)
-    assert.equal(fixture.relay.status().activeTunnels, 0)
-    assert.equal(fixture.relay.status().activeTargets, 0)
-  } finally {
-    agent.destroy()
-    await fixture.relay.close()
-    await closeServer(targetServer)
-    await rm(root, {recursive: true, force: true})
-  }
-})
-
-test("SocketductHttpsAgent verifies the target CA and logical hostname", async () => {
-  const root = await mkdtemp(join(tmpdir(), "socketduct-https-strict-"))
-  const certs = generateTestCertificates(join(root, "certs"))
-  const ca = await readFile(certs.caCertFile)
-  const targetServer = https.createServer({cert: await readFile(certs.serverCertFile), key: await readFile(certs.serverKeyFile)}, (req, res) => {
-    res.writeHead(200)
-    res.end("secure-ok")
-  })
-  const port = await listen(targetServer)
-  const fixture = await authenticatedRelay(port, {tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile}})
-  const agent = createAgent({ca}, {
-    port,
-    relay: fixture.relay,
-    relayTls: {caFile: certs.caCertFile, servername: "localhost"},
-    spoolDirectory: join(root, "spool"),
-    token: fixture.token
+    try {
+      let error
+      try {
+        Reflect.apply(agent.createConnection, agent, [{host: "localhost", port: 443}])
+      } catch (caught) {
+        error = caught
+      }
+      expect(error).toBeDefined()
+      expect(/** @type {Error & {code?: string}} */ (error).code).toBe("ERR_INVALID_ARG_TYPE")
+      await new Promise((resolve) => setImmediate(resolve))
+      expect(targetConnections).toBe(0)
+      expect(fixture.relay.status()).toEqual({
+        activeTunnels: 0, activeTargets: 0, sessions: 0, attachedSessions: 0,
+        detachedSessions: 0, bufferedTargetBytes: 0, targetConnectionAttempts: 0, targetRetryTimers: 0
+      })
+      expect(await readdir(join(root, "spool")).catch((error) => {
+        if (error instanceof Error && /** @type {Error & {code?: string}} */ (error).code === "ENOENT") return []
+        throw error
+      })).toEqual([])
+    } finally {
+      agent.destroy()
+      await fixture.relay.close()
+      await closeServer(targetServer)
+      await rm(root, {recursive: true, force: true})
+    }
   })
-  try {
-    assert.deepEqual(await request({agent, host: "localhost", port: 443, path: "/_ping"}), {body: "secure-ok", statusCode: 200})
-  } finally {
-    agent.destroy()
-    await fixture.relay.close()
-    await closeServer(targetServer)
-    await rm(root, {recursive: true, force: true})
-  }
-})
 
-test("SocketductHttpsAgent omits IP SNI while strictly verifying the target IP", async () => {
-  const root = await mkdtemp(join(tmpdir(), "socketduct-https-ip-"))
-  const certs = generateTestCertificates(join(root, "certs"))
-  const ca = await readFile(certs.caCertFile)
-  /** @type {Array<string | false | null>} */
-  const servernames = []
-  const targetServer = https.createServer({cert: await readFile(certs.serverCertFile), key: await readFile(certs.serverKeyFile)}, (req, res) => res.end("ip-ok"))
-  targetServer.on("secureConnection", (socket) => servernames.push(socket.servername))
-  const port = await listen(targetServer)
-  const fixture = await authenticatedRelay(port)
-  const successAgent = createAgent({ca, servername: "127.0.0.1"}, {
-    port, relay: fixture.relay, spoolDirectory: join(root, "spool"), token: fixture.token
-  })
-  const mismatchAgent = createAgent({ca, servername: "127.0.0.2"}, {
-    port, relay: fixture.relay, spoolDirectory: join(root, "spool"), token: fixture.token
+  it("SocketductHttpsAgent rejects an already-aborted request before allocating resources", async () => {
+    const root = await mkdtemp(join(tmpdir(), "socketduct-https-pre-aborted-"))
+    let targetConnections = 0
+    const targetServer = createTcpServer(() => { targetConnections += 1 })
+    const port = await listen(targetServer)
+    const fixture = await authenticatedRelay(port)
+    const agent = createAgent({ca: Buffer.alloc(0)}, {
+      port, relay: fixture.relay, spoolDirectory: join(root, "spool"), token: fixture.token
+    })
+    const controller = new AbortController()
+    controller.abort()
+    try {
+      let error
+      try {
+        await request({agent, host: "localhost", port: 443, path: "/already-aborted", signal: controller.signal})
+      } catch (caught) {
+        error = caught
+      }
+      expect(error).toBeDefined()
+      expect(error instanceof Error && error.name === "AbortError").toBe(true)
+      await new Promise((resolve) => setImmediate(resolve))
+      expect(targetConnections).toBe(0)
+      expect(fixture.relay.status().sessions).toBe(0)
+      expect(fixture.relay.status().activeTunnels).toBe(0)
+      expect(fixture.relay.status().activeTargets).toBe(0)
+    } finally {
+      agent.destroy()
+      await fixture.relay.close()
+      await closeServer(targetServer)
+      await rm(root, {recursive: true, force: true})
+    }
   })
-  try {
-    assert.equal((await request({agent: successAgent, host: "127.0.0.1", port: 443, path: "/ip"})).body, "ip-ok")
-    successAgent.destroy()
-    await waitUntil(() => fixture.relay.status().sessions === 0)
-    assert.deepEqual(servernames, [false])
 
-    await assert.rejects(request({agent: mismatchAgent, host: "127.0.0.2", port: 443, path: "/ip-mismatch"}), {
-      code: "ERR_TLS_CERT_ALTNAME_INVALID"
+  it("SocketductHttpsAgent verifies the target CA and logical hostname", async () => {
+    const root = await mkdtemp(join(tmpdir(), "socketduct-https-strict-"))
+    const certs = generateTestCertificates(join(root, "certs"))
+    const ca = await readFile(certs.caCertFile)
+    const targetServer = https.createServer({cert: await readFile(certs.serverCertFile), key: await readFile(certs.serverKeyFile)}, (req, res) => {
+      res.writeHead(200)
+      res.end("secure-ok")
     })
-    mismatchAgent.destroy()
-    await waitUntil(() => fixture.relay.status().sessions === 0)
-  } finally {
-    successAgent.destroy()
-    mismatchAgent.destroy()
-    await fixture.relay.close()
-    await closeServer(targetServer)
-    await rm(root, {recursive: true, force: true})
-  }
-})
-
-test("SocketductHttpsAgent derives an omitted target TLS identity from the fixed IP without sending SNI", async () => {
-  const root = await mkdtemp(join(tmpdir(), "socketduct-https-derived-ip-"))
-  const certs = generateTestCertificates(join(root, "certs"), {serverSubjectAltName: "IP:127.0.0.1"})
-  const ca = await readFile(certs.caCertFile)
-  /** @type {Array<string | false | null>} */
-  const servernames = []
-  const targetServer = https.createServer({
-    cert: await readFile(certs.serverCertFile),
-    key: await readFile(certs.serverKeyFile)
-  }, (req, res) => res.end("derived-ip-ok"))
-  targetServer.on("secureConnection", (socket) => servernames.push(socket.servername))
-  const port = await listen(targetServer)
-  const fixture = await authenticatedRelay(port)
-  const spoolDirectory = join(root, "spool")
-  const agent = new SocketductHttpsAgent({
-    relay: {host: "127.0.0.1", port: fixture.relay.port, token: fixture.token.value},
-    target: {host: "127.0.0.1", port},
-    targetTls: {ca, rejectUnauthorized: true},
-    spoolDirectory,
-    keepAlive: false
+    const port = await listen(targetServer)
+    const fixture = await authenticatedRelay(port, {tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile}})
+    const agent = createAgent({ca}, {
+      port,
+      relay: fixture.relay,
+      relayTls: {caFile: certs.caCertFile, servername: "localhost"},
+      spoolDirectory: join(root, "spool"),
+      token: fixture.token
+    })
+    try {
+      expect(await request({agent, host: "localhost", port: 443, path: "/_ping"})).toEqual({body: "secure-ok", statusCode: 200})
+    } finally {
+      agent.destroy()
+      await fixture.relay.close()
+      await closeServer(targetServer)
+      await rm(root, {recursive: true, force: true})
+    }
   })
-  try {
-    assert.equal((await request({agent, host: "127.0.0.1", port: 443, path: "/derived-ip"})).body, "derived-ip-ok")
-    agent.destroy()
-    await waitUntil(() => {
-      const status = fixture.relay.status()
-      return status.sessions === 0 && status.activeTunnels === 0 && status.activeTargets === 0
+
+  it("SocketductHttpsAgent omits IP SNI while strictly verifying the target IP", async () => {
+    const root = await mkdtemp(join(tmpdir(), "socketduct-https-ip-"))
+    const certs = generateTestCertificates(join(root, "certs"))
+    const ca = await readFile(certs.caCertFile)
+    /** @type {Array<string | false | null>} */
+    const servernames = []
+    const targetServer = https.createServer({cert: await readFile(certs.serverCertFile), key: await readFile(certs.serverKeyFile)}, (req, res) => res.end("ip-ok"))
+    targetServer.on("secureConnection", (socket) => servernames.push(socket.servername))
+    const port = await listen(targetServer)
+    const fixture = await authenticatedRelay(port)
+    const successAgent = createAgent({ca, servername: "127.0.0.1"}, {
+      port, relay: fixture.relay, spoolDirectory: join(root, "spool"), token: fixture.token
     })
-    assert.deepEqual(servernames, [false])
-    assert.deepEqual(fixture.relay.status(), {
-      activeTunnels: 0, activeTargets: 0, sessions: 0, attachedSessions: 0,
-      detachedSessions: 0, bufferedTargetBytes: 0, targetConnectionAttempts: 0, targetRetryTimers: 0
+    const mismatchAgent = createAgent({ca, servername: "127.0.0.2"}, {
+      port, relay: fixture.relay, spoolDirectory: join(root, "spool"), token: fixture.token
     })
-    await waitUntilAsync(async () => (await readDirectoryOrEmpty(spoolDirectory)).length === 0)
-    assert.deepEqual(await readDirectoryOrEmpty(spoolDirectory), [])
-  } finally {
-    agent.destroy()
-    await fixture.relay.close()
-    await closeServer(targetServer)
-    await rm(root, {recursive: true, force: true})
-  }
-})
+    try {
+      expect((await request({agent: successAgent, host: "127.0.0.1", port: 443, path: "/ip"})).body).toBe("ip-ok")
+      successAgent.destroy()
+      await waitUntil(() => fixture.relay.status().sessions === 0)
+      expect(servernames).toEqual([false])
 
-test("SocketductHttpsAgent rejects a trusted different identity when target TLS servername is omitted", async () => {
-  const root = await mkdtemp(join(tmpdir(), "socketduct-https-derived-ip-mismatch-"))
-  const certs = generateTestCertificates(join(root, "certs"), {serverSubjectAltName: "IP:127.0.0.1"})
-  const wrongCerts = generateTestServerCertificate(join(root, "wrong-certs"), {
-    caCertFile: certs.caCertFile,
-    caKeyFile: certs.caKeyFile,
-    commonName: "localhost",
-    subjectAltName: "DNS:localhost"
-  })
-  const ca = await readFile(certs.caCertFile)
-  const targetServer = https.createServer({
-    cert: await readFile(wrongCerts.serverCertFile),
-    key: await readFile(wrongCerts.serverKeyFile)
-  }, (req, res) => res.end("wrongly-accepted"))
-  const port = await listen(targetServer)
-  const fixture = await authenticatedRelay(port)
-  const spoolDirectory = join(root, "spool")
-  const agent = new SocketductHttpsAgent({
-    relay: {host: "127.0.0.1", port: fixture.relay.port, token: fixture.token.value},
-    target: {host: "127.0.0.1", port},
-    targetTls: {ca, rejectUnauthorized: true},
-    spoolDirectory,
-    keepAlive: false
+      await expect(request({agent: mismatchAgent, host: "127.0.0.2", port: 443, path: "/ip-mismatch"})).rejects.toMatchObject({
+        code: "ERR_TLS_CERT_ALTNAME_INVALID"
+      })
+      mismatchAgent.destroy()
+      await waitUntil(() => fixture.relay.status().sessions === 0)
+    } finally {
+      successAgent.destroy()
+      mismatchAgent.destroy()
+      await fixture.relay.close()
+      await closeServer(targetServer)
+      await rm(root, {recursive: true, force: true})
+    }
   })
-  try {
-    await assert.rejects(request({agent, host: "127.0.0.1", port: 443, path: "/wrong-identity"}), {
-      code: "ERR_TLS_CERT_ALTNAME_INVALID"
+
+  it("SocketductHttpsAgent derives an omitted target TLS identity from the fixed IP without sending SNI", async () => {
+    const root = await mkdtemp(join(tmpdir(), "socketduct-https-derived-ip-"))
+    const certs = generateTestCertificates(join(root, "certs"), {serverSubjectAltName: "IP:127.0.0.1"})
+    const ca = await readFile(certs.caCertFile)
+    /** @type {Array<string | false | null>} */
+    const servernames = []
+    const targetServer = https.createServer({
+      cert: await readFile(certs.serverCertFile),
+      key: await readFile(certs.serverKeyFile)
+    }, (req, res) => res.end("derived-ip-ok"))
+    targetServer.on("secureConnection", (socket) => servernames.push(socket.servername))
+    const port = await listen(targetServer)
+    const fixture = await authenticatedRelay(port)
+    const spoolDirectory = join(root, "spool")
+    const agent = new SocketductHttpsAgent({
+      relay: {host: "127.0.0.1", port: fixture.relay.port, token: fixture.token.value},
+      target: {host: "127.0.0.1", port},
+      targetTls: {ca, rejectUnauthorized: true},
+      spoolDirectory,
+      keepAlive: false
     })
-    agent.destroy()
-    await waitUntil(() => {
-      const status = fixture.relay.status()
-      return status.sessions === 0 && status.activeTunnels === 0 && status.activeTargets === 0
+    try {
+      expect((await request({agent, host: "127.0.0.1", port: 443, path: "/derived-ip"})).body).toBe("derived-ip-ok")
+      agent.destroy()
+      await waitUntil(() => {
+        const status = fixture.relay.status()
+        return status.sessions === 0 && status.activeTunnels === 0 && status.activeTargets === 0
+      })
+      expect(servernames).toEqual([false])
+      expect(fixture.relay.status()).toEqual({
+        activeTunnels: 0, activeTargets: 0, sessions: 0, attachedSessions: 0,
+        detachedSessions: 0, bufferedTargetBytes: 0, targetConnectionAttempts: 0, targetRetryTimers: 0
+      })
+      await waitUntilAsync(async () => (await readDirectoryOrEmpty(spoolDirectory)).length === 0)
+      expect(await readDirectoryOrEmpty(spoolDirectory)).toEqual([])
+    } finally {
+      agent.destroy()
+      await fixture.relay.close()
+      await closeServer(targetServer)
+      await rm(root, {recursive: true, force: true})
+    }
+  })
+
+  it("SocketductHttpsAgent rejects a trusted different identity when target TLS servername is omitted", async () => {
+    const root = await mkdtemp(join(tmpdir(), "socketduct-https-derived-ip-mismatch-"))
+    const certs = generateTestCertificates(join(root, "certs"), {serverSubjectAltName: "IP:127.0.0.1"})
+    const wrongCerts = generateTestServerCertificate(join(root, "wrong-certs"), {
+      caCertFile: certs.caCertFile,
+      caKeyFile: certs.caKeyFile,
+      commonName: "localhost",
+      subjectAltName: "DNS:localhost"
     })
-    assert.deepEqual(fixture.relay.status(), {
-      activeTunnels: 0, activeTargets: 0, sessions: 0, attachedSessions: 0,
-      detachedSessions: 0, bufferedTargetBytes: 0, targetConnectionAttempts: 0, targetRetryTimers: 0
+    const ca = await readFile(certs.caCertFile)
+    const targetServer = https.createServer({
+      cert: await readFile(wrongCerts.serverCertFile),
+      key: await readFile(wrongCerts.serverKeyFile)
+    }, (req, res) => res.end("wrongly-accepted"))
+    const port = await listen(targetServer)
+    const fixture = await authenticatedRelay(port)
+    const spoolDirectory = join(root, "spool")
+    const agent = new SocketductHttpsAgent({
+      relay: {host: "127.0.0.1", port: fixture.relay.port, token: fixture.token.value},
+      target: {host: "127.0.0.1", port},
+      targetTls: {ca, rejectUnauthorized: true},
+      spoolDirectory,
+      keepAlive: false
     })
-    await waitUntilAsync(async () => (await readDirectoryOrEmpty(spoolDirectory)).length === 0)
-    assert.deepEqual(await readDirectoryOrEmpty(spoolDirectory), [])
-  } finally {
-    agent.destroy()
-    await fixture.relay.close()
-    await closeServer(targetServer)
-    await rm(root, {recursive: true, force: true})
-  }
-})
-
-test("SocketductHttpsAgent rejects an explicitly empty target TLS servername before allocation", () => {
-  assert.throws(() => new SocketductHttpsAgent({
-    relay: {host: "127.0.0.1", port: 1, token: "unused-test-token"},
-    target: {host: "127.0.0.1", port: 1},
-    targetTls: {servername: ""},
-    spoolDirectory: "/unused"
-  }), /Target TLS servername must be a non-empty string/)
-})
-
-test("SocketductHttpsAgent supports target mTLS", async () => {
-  const root = await mkdtemp(join(tmpdir(), "socketduct-https-mtls-"))
-  const certs = generateTestCertificates(join(root, "certs"))
-  const ca = await readFile(certs.caCertFile)
-  const targetServer = https.createServer({
-    ca,
-    cert: await readFile(certs.serverCertFile),
-    key: await readFile(certs.serverKeyFile),
-    requestCert: true,
-    rejectUnauthorized: true
-  }, (req, res) => {
-    res.writeHead(200)
-    res.end(/** @type {import('node:tls').TLSSocket} */ (req.socket).authorized ? "mtls-ok" : "unauthorized")
+    try {
+      await expect(request({agent, host: "127.0.0.1", port: 443, path: "/wrong-identity"})).rejects.toMatchObject({
+        code: "ERR_TLS_CERT_ALTNAME_INVALID"
+      })
+      agent.destroy()
+      await waitUntil(() => {
+        const status = fixture.relay.status()
+        return status.sessions === 0 && status.activeTunnels === 0 && status.activeTargets === 0
+      })
+      expect(fixture.relay.status()).toEqual({
+        activeTunnels: 0, activeTargets: 0, sessions: 0, attachedSessions: 0,
+        detachedSessions: 0, bufferedTargetBytes: 0, targetConnectionAttempts: 0, targetRetryTimers: 0
+      })
+      await waitUntilAsync(async () => (await readDirectoryOrEmpty(spoolDirectory)).length === 0)
+      expect(await readDirectoryOrEmpty(spoolDirectory)).toEqual([])
+    } finally {
+      agent.destroy()
+      await fixture.relay.close()
+      await closeServer(targetServer)
+      await rm(root, {recursive: true, force: true})
+    }
   })
-  const port = await listen(targetServer)
-  const fixture = await authenticatedRelay(port)
-  const agent = createAgent({
-    ca,
-    cert: await readFile(certs.clientCertFile),
-    key: await readFile(certs.clientKeyFile)
-  }, {port, relay: fixture.relay, spoolDirectory: join(root, "spool"), token: fixture.token})
-  try {
-    assert.equal((await request({agent, host: "localhost", port: 443, path: "/_ping"})).body, "mtls-ok")
-  } finally {
-    agent.destroy()
-    await fixture.relay.close()
-    await closeServer(targetServer)
-    await rm(root, {recursive: true, force: true})
-  }
-})
 
-test("SocketductHttpsAgent keeps one target TLS connection through relay interruption", async () => {
-  const root = await mkdtemp(join(tmpdir(), "socketduct-https-resume-"))
-  const certs = generateTestCertificates(join(root, "certs"))
-  const ca = await readFile(certs.caCertFile)
-  let targetConnections = 0
-  /** @type {(() => void) | undefined} */
-  let releaseResponse
-  const continueResponse = new Promise((resolve) => { releaseResponse = () => resolve(undefined) })
-  /** @type {(() => void) | undefined} */
-  let firstChunkResolve
-  const firstChunk = new Promise((resolve) => { firstChunkResolve = () => resolve(undefined) })
-  const targetServer = https.createServer({
-    cert: await readFile(certs.serverCertFile),
-    key: await readFile(certs.serverKeyFile)
-  }, (req, res) => {
-    res.writeHead(200)
-    res.write("before-")
-    firstChunkResolve?.()
-    void continueResponse.then(() => res.end("after"))
+  it("SocketductHttpsAgent rejects an explicitly empty target TLS servername before allocation", () => {
+    expect(() => new SocketductHttpsAgent({
+      relay: {host: "127.0.0.1", port: 1, token: "unused-test-token"},
+      target: {host: "127.0.0.1", port: 1},
+      targetTls: {servername: ""},
+      spoolDirectory: "/unused"
+    })).toThrow(/Target TLS servername must be a non-empty string/)
   })
-  targetServer.on("connection", () => { targetConnections += 1 })
-  const port = await listen(targetServer)
-  const fixture = await authenticatedRelay(port)
-  const spoolDirectory = join(root, "spool")
-  const agent = createAgent({ca}, {port, relay: fixture.relay, spoolDirectory, token: fixture.token})
-  /** @type {Promise<void> | undefined} */
-  let socketductClosed
-  try {
-    const responsePromise = request(
-      {agent, host: "localhost", port: 443, path: "/stream"},
-      (socket) => { socketductClosed = once(socket, "close").then(() => undefined) }
-    )
-    await firstChunk
-    await waitUntil(() => fixture.relay.status().attachedSessions === 1)
-    await fixture.relay.closeActiveTunnel()
-    await waitUntil(() => fixture.relay.status().attachedSessions === 1)
-    releaseResponse?.()
-    assert.equal((await responsePromise).body, "before-after")
-    assert.equal(targetConnections, 1)
-    agent.destroy()
-    await socketductClosed
-    assert.deepEqual(await readDirectoryOrEmpty(spoolDirectory), [])
-  } finally {
-    releaseResponse?.()
-    agent.destroy()
-    await socketductClosed
-    await fixture.relay.close()
-    await closeServer(targetServer)
-    await rm(root, {recursive: true, force: true})
-  }
-})
 
-test("SocketductHttpsAgent preserves TLS verification errors and settles its callback once", async () => {
-  const root = await mkdtemp(join(tmpdir(), "socketduct-https-failure-"))
-  const certs = generateTestCertificates(join(root, "certs"))
-  const targetServer = https.createServer({cert: await readFile(certs.serverCertFile), key: await readFile(certs.serverKeyFile)})
-  const port = await listen(targetServer)
-  const fixture = await authenticatedRelay(port)
-  const agent = createAgent({ca: await readFile(certs.caCertFile), servername: "wrong.example.test"}, {
-    port, relay: fixture.relay, spoolDirectory: join(root, "spool"), token: fixture.token
-  })
-  let callbackCount = 0
-  try {
-    const result = await new Promise((resolve) => {
-      agent.createConnection({host: "wrong.example.test", port: 443}, (error, socket) => {
-        callbackCount += 1
-        resolve({error, socket})
-      })
-    })
-    assert.equal(callbackCount, 1)
-    assert.ok(result.error instanceof Error)
-    assert.equal(result.error.code, "ERR_TLS_CERT_ALTNAME_INVALID")
-    assert.equal(result.socket, undefined)
-    await waitUntil(() => fixture.relay.status().sessions === 0).catch(() => {
-      assert.fail(`relay resources after TLS verification failure: ${JSON.stringify(fixture.relay.status())}`)
+  it("SocketductHttpsAgent supports target mTLS", async () => {
+    const root = await mkdtemp(join(tmpdir(), "socketduct-https-mtls-"))
+    const certs = generateTestCertificates(join(root, "certs"))
+    const ca = await readFile(certs.caCertFile)
+    const targetServer = https.createServer({
+      ca,
+      cert: await readFile(certs.serverCertFile),
+      key: await readFile(certs.serverKeyFile),
+      requestCert: true,
+      rejectUnauthorized: true
+    }, (req, res) => {
+      res.writeHead(200)
+      res.end(/** @type {import('node:tls').TLSSocket} */ (req.socket).authorized ? "mtls-ok" : "unauthorized")
     })
-  } finally {
-    agent.destroy()
-    await fixture.relay.close()
-    await closeServer(targetServer)
-    await rm(root, {recursive: true, force: true})
-  }
-})
+    const port = await listen(targetServer)
+    const fixture = await authenticatedRelay(port)
+    const agent = createAgent({
+      ca,
+      cert: await readFile(certs.clientCertFile),
+      key: await readFile(certs.clientKeyFile)
+    }, {port, relay: fixture.relay, spoolDirectory: join(root, "spool"), token: fixture.token})
+    try {
+      expect((await request({agent, host: "localhost", port: 443, path: "/_ping"})).body).toBe("mtls-ok")
+    } finally {
+      agent.destroy()
+      await fixture.relay.close()
+      await closeServer(targetServer)
+      await rm(root, {recursive: true, force: true})
+    }
+  })
 
-test("SocketductHttpsAgent aborts and times out stalled target TLS handshakes without resources", {timeout: 5_000}, async () => {
-  const root = await mkdtemp(join(tmpdir(), "socketduct-https-stalled-"))
-  const certs = generateTestCertificates(join(root, "certs"))
-  /** @type {Set<import('node:net').Socket>} */
-  const accepted = new Set()
-  let acceptedCount = 0
-  /** @type {Set<{count: number, resolve: () => void}>} */
-  const acceptanceWaiters = new Set()
-  const stalledTarget = createTcpServer((socket) => {
-    socket.once("close", () => accepted.delete(socket))
-    socket.once("data", () => {
-      accepted.add(socket)
-      acceptedCount += 1
-      for (const waiter of acceptanceWaiters) {
-        if (acceptedCount < waiter.count) continue
-        acceptanceWaiters.delete(waiter)
-        waiter.resolve()
-      }
+  it("SocketductHttpsAgent keeps one target TLS connection through relay interruption", async () => {
+    const root = await mkdtemp(join(tmpdir(), "socketduct-https-resume-"))
+    const certs = generateTestCertificates(join(root, "certs"))
+    const ca = await readFile(certs.caCertFile)
+    let targetConnections = 0
+    /** @type {(() => void) | undefined} */
+    let releaseResponse
+    const continueResponse = new Promise((resolve) => { releaseResponse = () => resolve(undefined) })
+    /** @type {(() => void) | undefined} */
+    let firstChunkResolve
+    const firstChunk = new Promise((resolve) => { firstChunkResolve = () => resolve(undefined) })
+    const targetServer = https.createServer({
+      cert: await readFile(certs.serverCertFile),
+      key: await readFile(certs.serverKeyFile)
+    }, (req, res) => {
+      res.writeHead(200)
+      res.write("before-")
+      firstChunkResolve?.()
+      void continueResponse.then(() => res.end("after"))
     })
+    targetServer.on("connection", () => { targetConnections += 1 })
+    const port = await listen(targetServer)
+    const fixture = await authenticatedRelay(port)
+    const spoolDirectory = join(root, "spool")
+    const agent = createAgent({ca}, {port, relay: fixture.relay, spoolDirectory, token: fixture.token})
+    /** @type {Promise<void> | undefined} */
+    let socketductClosed
+    try {
+      const responsePromise = request(
+        {agent, host: "localhost", port: 443, path: "/stream"},
+        (socket) => { socketductClosed = once(socket, "close").then(() => undefined) }
+      )
+      await firstChunk
+      await waitUntil(() => fixture.relay.status().attachedSessions === 1)
+      await fixture.relay.closeActiveTunnel()
+      await waitUntil(() => fixture.relay.status().attachedSessions === 1)
+      releaseResponse?.()
+      expect((await responsePromise).body).toBe("before-after")
+      expect(targetConnections).toBe(1)
+      agent.destroy()
+      await socketductClosed
+      expect(await readDirectoryOrEmpty(spoolDirectory)).toEqual([])
+    } finally {
+      releaseResponse?.()
+      agent.destroy()
+      await socketductClosed
+      await fixture.relay.close()
+      await closeServer(targetServer)
+      await rm(root, {recursive: true, force: true})
+    }
   })
-  const port = await listen(stalledTarget)
-  const fixture = await authenticatedRelay(port)
-  const agent = createAgent({ca: await readFile(certs.caCertFile)}, {
-    port, relay: fixture.relay, spoolDirectory: join(root, "spool"), token: fixture.token
-  })
-  /**
-   * @param {number} count - Expected accepted sockets.
-   * @returns {Promise<void>}
-   */
-  const waitForAccepted = async (count) => {
-    if (acceptedCount >= count) return
-    await new Promise((resolve) => {
-      acceptanceWaiters.add({count, resolve: () => resolve(undefined)})
+
+  it("SocketductHttpsAgent preserves TLS verification errors and settles its callback once", async () => {
+    const root = await mkdtemp(join(tmpdir(), "socketduct-https-failure-"))
+    const certs = generateTestCertificates(join(root, "certs"))
+    const targetServer = https.createServer({cert: await readFile(certs.serverCertFile), key: await readFile(certs.serverKeyFile)})
+    const port = await listen(targetServer)
+    const fixture = await authenticatedRelay(port)
+    const agent = createAgent({ca: await readFile(certs.caCertFile), servername: "wrong.example.test"}, {
+      port, relay: fixture.relay, spoolDirectory: join(root, "spool"), token: fixture.token
     })
-  }
-  const repeatingTimeouts = new Set()
-  const timeoutHook = createHook({
-    init: (asyncId, type, _triggerAsyncId, resource) => {
-      const repeat = /** @type {{_repeat?: unknown}} */ (resource)._repeat
-      if (type === "Timeout" && typeof repeat === "number" && repeat > 0) repeatingTimeouts.add(asyncId)
-    },
-    destroy: (asyncId) => repeatingTimeouts.delete(asyncId)
+    let callbackCount = 0
+    try {
+      const result = await new Promise((resolve) => {
+        agent.createConnection({host: "wrong.example.test", port: 443}, (error, socket) => {
+          callbackCount += 1
+          resolve({error, socket})
+        })
+      })
+      expect(callbackCount).toBe(1)
+      expect(result.error instanceof Error).toBeTruthy()
+      expect(result.error.code).toBe("ERR_TLS_CERT_ALTNAME_INVALID")
+      expect(result.socket).toBe(undefined)
+      await waitUntil(() => fixture.relay.status().sessions === 0).catch(() => {
+        throw new Error(`relay resources after TLS verification failure: ${JSON.stringify(fixture.relay.status())}`)
+      })
+    } finally {
+      agent.destroy()
+      await fixture.relay.close()
+      await closeServer(targetServer)
+      await rm(root, {recursive: true, force: true})
+    }
   })
-  try {
-    const controller = new AbortController()
-    /** @type {import('node:http').ClientRequest | undefined} */
-    let signalRequest
-    let signalErrorCount = 0
-    const signalAborted = new Promise((resolve, reject) => {
-      signalRequest = https.request({agent, host: "localhost", port: 443, path: "/signal-abort", signal: controller.signal}, resolve)
-      signalRequest.on("error", (error) => {
-        signalErrorCount += 1
-        reject(error)
+
+  it("SocketductHttpsAgent aborts and times out stalled target TLS handshakes without resources", {timeoutMs: 5_000}, async () => {
+    const root = await mkdtemp(join(tmpdir(), "socketduct-https-stalled-"))
+    const certs = generateTestCertificates(join(root, "certs"))
+    /** @type {Set<import('node:net').Socket>} */
+    const accepted = new Set()
+    let acceptedCount = 0
+    /** @type {Set<{count: number, resolve: () => void}>} */
+    const acceptanceWaiters = new Set()
+    const stalledTarget = createTcpServer((socket) => {
+      socket.once("close", () => accepted.delete(socket))
+      socket.once("data", () => {
+        accepted.add(socket)
+        acceptedCount += 1
+        for (const waiter of acceptanceWaiters) {
+          if (acceptedCount < waiter.count) continue
+          acceptanceWaiters.delete(waiter)
+          waiter.resolve()
+        }
       })
-      signalRequest.end()
     })
-    void signalAborted.catch(() => {})
-    await waitForAccepted(1)
-    controller.abort()
-    await waitUntil(() => fixture.relay.status().sessions === 0 && accepted.size === 0, 100).catch(() => {
-      assert.fail(`relay resources after AbortSignal: ${JSON.stringify(fixture.relay.status())}; accepted=${accepted.size}`)
-    })
-    await assert.rejects(signalAborted, (error) => error instanceof Error && error.name === "AbortError")
-    await new Promise((resolve) => setImmediate(resolve))
-    assert.equal(signalErrorCount, 1)
-    assert.equal(signalRequest?.listeners("abort").some((listener) => listener.name === "abort"), false)
-    assert.equal(signalRequest?.listeners("close").some((listener) => listener.name === "onClose"), false)
-
-    timeoutHook.enable()
-    /** @type {import('node:http').ClientRequest | undefined} */
-    let abortRequest
-    const aborted = new Promise((resolve, reject) => {
-      abortRequest = https.request({agent, host: "localhost", port: 443, path: "/abort"}, resolve)
-      abortRequest.once("error", reject)
-      abortRequest.end()
+    const port = await listen(stalledTarget)
+    const fixture = await authenticatedRelay(port)
+    const agent = createAgent({ca: await readFile(certs.caCertFile)}, {
+      port, relay: fixture.relay, spoolDirectory: join(root, "spool"), token: fixture.token
     })
-    await waitForAccepted(2)
-    await new Promise((resolve) => setImmediate(resolve))
-    const repeatingTimeoutCount = repeatingTimeouts.size
-    timeoutHook.disable()
-    abortRequest?.abort()
-    await assert.rejects(aborted, (error) => error instanceof Error && error.name === "AbortError")
-    assert.equal(repeatingTimeoutCount, 0, "a pending request must not install a polling timer")
-    await waitUntil(() => fixture.relay.status().sessions === 0 && accepted.size === 0).catch(() => {
-      assert.fail(`relay resources after request abort: ${JSON.stringify(fixture.relay.status())}; accepted=${accepted.size}`)
+    /**
+     * @param {number} count - Expected accepted sockets.
+     * @returns {Promise<void>}
+     */
+    const waitForAccepted = async (count) => {
+      if (acceptedCount >= count) return
+      await new Promise((resolve) => {
+        acceptanceWaiters.add({count, resolve: () => resolve(undefined)})
+      })
+    }
+    const repeatingTimeouts = new Set()
+    const timeoutHook = createHook({
+      init: (asyncId, type, _triggerAsyncId, resource) => {
+        const repeat = /** @type {{_repeat?: unknown}} */ (resource)._repeat
+        if (type === "Timeout" && typeof repeat === "number" && repeat > 0) repeatingTimeouts.add(asyncId)
+      },
+      destroy: (asyncId) => repeatingTimeouts.delete(asyncId)
     })
+    try {
+      const controller = new AbortController()
+      /** @type {import('node:http').ClientRequest | undefined} */
+      let signalRequest
+      let signalErrorCount = 0
+      const signalAborted = new Promise((resolve, reject) => {
+        signalRequest = https.request({agent, host: "localhost", port: 443, path: "/signal-abort", signal: controller.signal}, resolve)
+        signalRequest.on("error", (error) => {
+          signalErrorCount += 1
+          reject(error)
+        })
+        signalRequest.end()
+      })
+      void signalAborted.catch(() => {})
+      await waitForAccepted(1)
+      controller.abort()
+      await waitUntil(() => fixture.relay.status().sessions === 0 && accepted.size === 0, 100).catch(() => {
+        throw new Error(`relay resources after AbortSignal: ${JSON.stringify(fixture.relay.status())}; accepted=${accepted.size}`)
+      })
+      let signalError
+      try {
+        await signalAborted
+      } catch (caught) {
+        signalError = caught
+      }
+      expect(signalError).toBeDefined()
+      expect(signalError instanceof Error && signalError.name === "AbortError").toBe(true)
+      await new Promise((resolve) => setImmediate(resolve))
+      expect(signalErrorCount).toBe(1)
+      expect(signalRequest?.listeners("abort").some((listener) => listener.name === "abort")).toBe(false)
+      expect(signalRequest?.listeners("close").some((listener) => listener.name === "onClose")).toBe(false)
 
-    const timedOut = assert.rejects(
-      request({agent, host: "localhost", port: 443, path: "/timeout", timeout: 25}),
-      (error) => error instanceof Error && /** @type {Error & {code?: string}} */ (error).code === "ETIMEDOUT"
-    )
-    await waitForAccepted(3)
-    await timedOut
-    await waitUntil(() => fixture.relay.status().sessions === 0 && accepted.size === 0)
-  } finally {
-    timeoutHook.disable()
-    agent.destroy()
-    for (const socket of accepted) socket.destroy()
-    await fixture.relay.close()
-    await closeServer(stalledTarget)
-    await rm(root, {recursive: true, force: true})
-  }
-})
+      timeoutHook.enable()
+      /** @type {import('node:http').ClientRequest | undefined} */
+      let abortRequest
+      const aborted = new Promise((resolve, reject) => {
+        abortRequest = https.request({agent, host: "localhost", port: 443, path: "/abort"}, resolve)
+        abortRequest.once("error", reject)
+        abortRequest.end()
+      })
+      await waitForAccepted(2)
+      await new Promise((resolve) => setImmediate(resolve))
+      const repeatingTimeoutCount = repeatingTimeouts.size
+      timeoutHook.disable()
+      abortRequest?.abort()
+      let abortError
+      try {
+        await aborted
+      } catch (caught) {
+        abortError = caught
+      }
+      expect(abortError).toBeDefined()
+      expect(abortError instanceof Error && abortError.name === "AbortError").toBe(true)
+      expect(repeatingTimeoutCount).toBe(0)
+      await waitUntil(() => fixture.relay.status().sessions === 0 && accepted.size === 0).catch(() => {
+        throw new Error(`relay resources after request abort: ${JSON.stringify(fixture.relay.status())}; accepted=${accepted.size}`)
+      })
 
-test("SocketductHttpsAgent destroy cancels a stalled handshake exactly once", {timeout: 5_000}, async () => {
-  const root = await mkdtemp(join(tmpdir(), "socketduct-https-destroy-"))
-  const certs = generateTestCertificates(join(root, "certs"))
-  /** @type {((socket: import('node:net').Socket) => void) | undefined} */
-  let acceptedResolve
-  const accepted = new Promise((resolve) => { acceptedResolve = resolve })
-  let targetClosed = false
-  const stalledTarget = createTcpServer((socket) => {
-    socket.once("close", () => { targetClosed = true })
-    socket.once("data", () => acceptedResolve?.(socket))
-  })
-  const port = await listen(stalledTarget)
-  const fixture = await authenticatedRelay(port)
-  const agent = createAgent({ca: await readFile(certs.caCertFile)}, {
-    port, relay: fixture.relay, spoolDirectory: join(root, "spool"), token: fixture.token
+      const timedOut = (async () => {
+        let timedOutError
+        try {
+          await request({agent, host: "localhost", port: 443, path: "/timeout", timeout: 25})
+        } catch (caught) {
+          timedOutError = caught
+        }
+        expect(timedOutError).toBeDefined()
+        expect(timedOutError instanceof Error && /** @type {Error & {code?: string}} */ (timedOutError).code === "ETIMEDOUT").toBe(true)
+      })()
+      await waitForAccepted(3)
+      await timedOut
+      await waitUntil(() => fixture.relay.status().sessions === 0 && accepted.size === 0)
+    } finally {
+      timeoutHook.disable()
+      agent.destroy()
+      for (const socket of accepted) socket.destroy()
+      await fixture.relay.close()
+      await closeServer(stalledTarget)
+      await rm(root, {recursive: true, force: true})
+    }
   })
-  let callbackCount = 0
-  const result = new Promise((resolve) => {
-    agent.createConnection({host: "localhost", port: 443}, (error, socket) => {
-      callbackCount += 1
-      resolve({error, socket})
+
+  it("SocketductHttpsAgent destroy cancels a stalled handshake exactly once", {timeoutMs: 5_000}, async () => {
+    const root = await mkdtemp(join(tmpdir(), "socketduct-https-destroy-"))
+    const certs = generateTestCertificates(join(root, "certs"))
+    /** @type {((socket: import('node:net').Socket) => void) | undefined} */
+    let acceptedResolve
+    const accepted = new Promise((resolve) => { acceptedResolve = resolve })
+    let targetClosed = false
+    const stalledTarget = createTcpServer((socket) => {
+      socket.once("close", () => { targetClosed = true })
+      socket.once("data", () => acceptedResolve?.(socket))
     })
-  })
-  const targetSocket = /** @type {import('node:net').Socket} */ (await accepted)
-  try {
-    agent.destroy()
-    const settled = await result
-    assert.equal(callbackCount, 1)
-    assert.ok(settled.error instanceof Error)
-    assert.equal(settled.socket, undefined)
-    await waitUntil(() => fixture.relay.status().sessions === 0 && targetClosed).catch(() => {
-      assert.fail(`relay resources after agent destroy: ${JSON.stringify(fixture.relay.status())}; targetClosed=${targetClosed}`)
+    const port = await listen(stalledTarget)
+    const fixture = await authenticatedRelay(port)
+    const agent = createAgent({ca: await readFile(certs.caCertFile)}, {
+      port, relay: fixture.relay, spoolDirectory: join(root, "spool"), token: fixture.token
     })
-  } finally {
-    agent.destroy()
-    targetSocket.destroy()
-    await fixture.relay.close()
-    await closeServer(stalledTarget)
-    await rm(root, {recursive: true, force: true})
-  }
-})
+    let callbackCount = 0
+    const result = new Promise((resolve) => {
+      agent.createConnection({host: "localhost", port: 443}, (error, socket) => {
+        callbackCount += 1
+        resolve({error, socket})
+      })
+    })
+    const targetSocket = /** @type {import('node:net').Socket} */ (await accepted)
+    try {
+      agent.destroy()
+      const settled = await result
+      expect(callbackCount).toBe(1)
+      expect(settled.error instanceof Error).toBeTruthy()
+      expect(settled.socket).toBe(undefined)
+      await waitUntil(() => fixture.relay.status().sessions === 0 && targetClosed).catch(() => {
+        throw new Error(`relay resources after agent destroy: ${JSON.stringify(fixture.relay.status())}; targetClosed=${targetClosed}`)
+      })
+    } finally {
+      agent.destroy()
+      targetSocket.destroy()
+      await fixture.relay.close()
+      await closeServer(stalledTarget)
+      await rm(root, {recursive: true, force: true})
+    }
+  })
 
-test("SocketductHttpsAgent repeated success and verification failure returns to baseline without spool leaks", async () => {
-  const root = await mkdtemp(join(tmpdir(), "socketduct-https-bounded-"))
-  const certs = generateTestCertificates(join(root, "certs"))
-  const ca = await readFile(certs.caCertFile)
-  const targetServer = https.createServer({cert: await readFile(certs.serverCertFile), key: await readFile(certs.serverKeyFile)}, (req, res) => res.end("ok"))
-  const port = await listen(targetServer)
-  const fixture = await authenticatedRelay(port)
-  try {
-    for (let index = 0; index < 3; index += 1) {
-      const successAgent = createAgent({ca}, {port, relay: fixture.relay, spoolDirectory: join(root, "spool"), token: fixture.token})
-      assert.equal((await request({agent: successAgent, host: "localhost", port: 443, path: `/ok-${index}`})).body, "ok")
-      successAgent.destroy()
-      await waitUntil(() => fixture.relay.status().sessions === 0)
+  it("SocketductHttpsAgent repeated success and verification failure returns to baseline without spool leaks", async () => {
+    const root = await mkdtemp(join(tmpdir(), "socketduct-https-bounded-"))
+    const certs = generateTestCertificates(join(root, "certs"))
+    const ca = await readFile(certs.caCertFile)
+    const targetServer = https.createServer({cert: await readFile(certs.serverCertFile), key: await readFile(certs.serverKeyFile)}, (req, res) => res.end("ok"))
+    const port = await listen(targetServer)
+    const fixture = await authenticatedRelay(port)
+    try {
+      for (let index = 0; index < 3; index += 1) {
+        const successAgent = createAgent({ca}, {port, relay: fixture.relay, spoolDirectory: join(root, "spool"), token: fixture.token})
+        expect((await request({agent: successAgent, host: "localhost", port: 443, path: `/ok-${index}`})).body).toBe("ok")
+        successAgent.destroy()
+        await waitUntil(() => fixture.relay.status().sessions === 0)
 
-      const failureAgent = createAgent({ca, servername: "wrong.example.test"}, {
-        port, relay: fixture.relay, spoolDirectory: join(root, "spool"), token: fixture.token
-      })
-      await assert.rejects(request({agent: failureAgent, host: "localhost", port: 443, path: `/fail-${index}`}), {
-        code: "ERR_TLS_CERT_ALTNAME_INVALID"
+        const failureAgent = createAgent({ca, servername: "wrong.example.test"}, {
+          port, relay: fixture.relay, spoolDirectory: join(root, "spool"), token: fixture.token
+        })
+        await expect(request({agent: failureAgent, host: "localhost", port: 443, path: `/fail-${index}`})).rejects.toMatchObject({
+          code: "ERR_TLS_CERT_ALTNAME_INVALID"
+        })
+        failureAgent.destroy()
+        await waitUntil(() => fixture.relay.status().sessions === 0)
+        expect(fixture.relay.status().activeTargets).toBe(0)
+        expect(fixture.relay.status().targetConnectionAttempts).toBe(0)
+        expect(fixture.relay.status().targetRetryTimers).toBe(0)
+      }
+      const readSpoolEntries = async () => await readdir(join(root, "spool")).catch((error) => {
+        if (error instanceof Error && /** @type {Error & {code?: string}} */ (error).code === "ENOENT") return []
+        throw error
       })
-      failureAgent.destroy()
-      await waitUntil(() => fixture.relay.status().sessions === 0)
-      assert.equal(fixture.relay.status().activeTargets, 0)
-      assert.equal(fixture.relay.status().targetConnectionAttempts, 0)
-      assert.equal(fixture.relay.status().targetRetryTimers, 0)
+      await waitUntilAsync(async () => (await readSpoolEntries()).length === 0)
+      const spoolEntries = await readSpoolEntries()
+      expect(spoolEntries).toEqual([])
+    } finally {
+      await fixture.relay.close()
+      await closeServer(targetServer)
+      await rm(root, {recursive: true, force: true})
     }
-    const readSpoolEntries = async () => await readdir(join(root, "spool")).catch((error) => {
-      if (error instanceof Error && /** @type {Error & {code?: string}} */ (error).code === "ENOENT") return []
-      throw error
-    })
-    await waitUntilAsync(async () => (await readSpoolEntries()).length === 0)
-    const spoolEntries = await readSpoolEntries()
-    assert.deepEqual(spoolEntries, [])
-  } finally {
-    await fixture.relay.close()
-    await closeServer(targetServer)
-    await rm(root, {recursive: true, force: true})
-  }
+  })
 })