socketduct 0.1.25 → 0.1.26

package/test/integration/tls-forwarding.test.js

@@ -1,4 +1,4 @@
-import assert from "node:assert/strict"
+import {describe, expect, it} from "@velocious/testing"
 import {connect as tlsConnect} from "node:tls"
 import {createConnection, createServer} from "node:net"
 import {mkdtemp, rm} from "node:fs/promises"
@@ -6,7 +6,6 @@ import {mkdtempSync} from "node:fs"
 import {tmpdir} from "node:os"
 import {join} from "node:path"
 import {readFileSync} from "node:fs"
-import test from "node:test"
 
 import {InMemoryUserStore, login, TokenStore} from "../../src/auth/user-store.js"
 import {SocketductSocket, connectSocketduct} from "../../src/client/socketduct-socket.js"
@@ -60,689 +59,691 @@ async function waitConnect(socket) {
   })
 }
 
-test("TLS relay forwards traffic and edge replays after reconnect", async () => {
-  const certDir = mkdtempSync(join(tmpdir(), "socketduct-tls-forwarding-"))
-  const certs = generateTestCertificates(certDir)
+describe("tls forwarding", () => {
+  it("TLS relay forwards traffic and edge replays after reconnect", async () => {
+    const certDir = mkdtempSync(join(tmpdir(), "socketduct-tls-forwarding-"))
+    const certs = generateTestCertificates(certDir)
 
-  const tempDir = await mkdtemp(join(tmpdir(), "socketduct-tls-edge-spool-"))
-  const echoServer = createServer((socket) => {
-    socket.on("data", (chunk) => socket.write(chunk))
-  })
-  const targetPort = await listen(echoServer)
-
-  const users = new InMemoryUserStore()
-  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
-  await users.createUser({username: "kasper", password: "correct horse battery staple"})
-  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
-
-  const relay = await startTcpRelay({
-    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
-    tokens,
-    sessions: new SessionStore({now: () => 1000}),
-    tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile}
-  })
+    const tempDir = await mkdtemp(join(tmpdir(), "socketduct-tls-edge-spool-"))
+    const echoServer = createServer((socket) => {
+      socket.on("data", (chunk) => socket.write(chunk))
+    })
+    const targetPort = await listen(echoServer)
+
+    const users = new InMemoryUserStore()
+    const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+    await users.createUser({username: "kasper", password: "correct horse battery staple"})
+    const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+
+    const relay = await startTcpRelay({
+      authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+      tokens,
+      sessions: new SessionStore({now: () => 1000}),
+      tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile}
+    })
 
-  const tlsSocket = tlsConnect({
-    host: "127.0.0.1",
-    port: relay.port,
-    ca: readFileSync(certs.caCertFile),
-    rejectUnauthorized: true
-  })
+    const tlsSocket = tlsConnect({
+      host: "127.0.0.1",
+      port: relay.port,
+      ca: readFileSync(certs.caCertFile),
+      rejectUnauthorized: true
+    })
 
-  const decoder = new FrameDecoder({compactDirection: "target-to-client"})
-  await waitConnect(tlsSocket)
+    const decoder = new FrameDecoder({compactDirection: "target-to-client"})
+    await waitConnect(tlsSocket)
 
-  const createdPromise = new Promise((resolve) => {
-    tlsSocket.on("data", (chunk) => {
-      for (const frame of decoder.push(chunk)) {
-        if (frame.header.type === "session.created") {
-          resolve(frame.header)
+    const createdPromise = new Promise((resolve) => {
+      tlsSocket.on("data", (chunk) => {
+        for (const frame of decoder.push(chunk)) {
+          if (frame.header.type === "session.created") {
+            resolve(frame.header)
+          }
         }
-      }
+      })
     })
-  })
 
-  tlsSocket.write(encodeFrame({
-    type: "session.create",
-    token: token.value,
-    name: "tls-forward-session",
-    identifier: "tls-forward-session",
-    target: {host: "127.0.0.1", port: targetPort},
-    framing: [2]
-  }))
-
-  const created = await createdPromise
-  assert.equal(/** @type {{type: string}} */ (created).type, "session.created")
-
-  const echoPromise = new Promise((resolve) => {
-    tlsSocket.on("data", (chunk) => {
-      for (const frame of decoder.push(chunk)) {
-        if (frame.header.type === "stream.data" && frame.header.direction === "target-to-client") {
-          resolve(frame.payload.toString("utf8"))
+    tlsSocket.write(encodeFrame({
+      type: "session.create",
+      token: token.value,
+      name: "tls-forward-session",
+      identifier: "tls-forward-session",
+      target: {host: "127.0.0.1", port: targetPort},
+      framing: [2]
+    }))
+
+    const created = await createdPromise
+    expect(/** @type {{type: string}} */ (created).type).toBe("session.created")
+
+    const echoPromise = new Promise((resolve) => {
+      tlsSocket.on("data", (chunk) => {
+        for (const frame of decoder.push(chunk)) {
+          if (frame.header.type === "stream.data" && frame.header.direction === "target-to-client") {
+            resolve(frame.payload.toString("utf8"))
+          }
         }
-      }
+      })
     })
-  })
 
-  tlsSocket.write(encodeCompactData({sequence: 8, payload: Buffer.from("tls-echo")}))
+    tlsSocket.write(encodeCompactData({sequence: 8, payload: Buffer.from("tls-echo")}))
 
-  const echoed = await echoPromise
-  assert.equal(echoed, "tls-echo")
+    const echoed = await echoPromise
+    expect(echoed).toBe("tls-echo")
 
-  tlsSocket.destroy()
-  await relay.close()
-  await new Promise((resolve, reject) => {
-    echoServer.close((error) => {
-      if (error) {
-        reject(error)
-        return
-      }
-      resolve(undefined)
+    tlsSocket.destroy()
+    await relay.close()
+    await new Promise((resolve, reject) => {
+      echoServer.close((error) => {
+        if (error) {
+          reject(error)
+          return
+        }
+        resolve(undefined)
+      })
     })
-  })
-  await rm(tempDir, {recursive: true, force: true})
-  await rm(certDir, {recursive: true, force: true})
-})
-
-test("TLS relay with mTLS rejects client without valid certificate (handshake completes, server closes)", async () => {
-  const certDir = mkdtempSync(join(tmpdir(), "socketduct-mtls-reject-"))
-  const certs = generateTestCertificates(certDir)
-
-  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
-  const relay = await startTcpRelay({
-    authorizeTarget: () => true,
-    tokens,
-    sessions: new SessionStore({now: () => 1000}),
-    tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile, clientCaFile: certs.caCertFile}
+    await rm(tempDir, {recursive: true, force: true})
+    await rm(certDir, {recursive: true, force: true})
   })
 
-  const unauthorizedSocket = tlsConnect({
-    host: "127.0.0.1",
-    port: relay.port,
-    ca: readFileSync(certs.caCertFile),
-    rejectUnauthorized: false
-  })
-
-  let dataReceived = false
-  unauthorizedSocket.on("data", () => { dataReceived = true })
+  it("TLS relay with mTLS rejects client without valid certificate (handshake completes, server closes)", async () => {
+    const certDir = mkdtempSync(join(tmpdir(), "socketduct-mtls-reject-"))
+    const certs = generateTestCertificates(certDir)
 
-  await new Promise((resolve) => {
-    unauthorizedSocket.once("error", () => resolve("error"))
-    unauthorizedSocket.once("close", () => resolve("close"))
-  })
+    const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+    const relay = await startTcpRelay({
+      authorizeTarget: () => true,
+      tokens,
+      sessions: new SessionStore({now: () => 1000}),
+      tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile, clientCaFile: certs.caCertFile}
+    })
 
-  assert.equal(dataReceived, false, "client without mTLS certificate must not receive data from the relay")
+    const unauthorizedSocket = tlsConnect({
+      host: "127.0.0.1",
+      port: relay.port,
+      ca: readFileSync(certs.caCertFile),
+      rejectUnauthorized: false
+    })
 
-  unauthorizedSocket.destroy()
-  await relay.close()
-  await rm(certDir, {recursive: true, force: true})
-})
+    let dataReceived = false
+    unauthorizedSocket.on("data", () => { dataReceived = true })
 
-test("TLS relay with mTLS accepts client with valid certificate", async () => {
-  const certDir = mkdtempSync(join(tmpdir(), "socketduct-mtls-accept-"))
-  const certs = generateTestCertificates(certDir)
+    await new Promise((resolve) => {
+      unauthorizedSocket.once("error", () => resolve("error"))
+      unauthorizedSocket.once("close", () => resolve("close"))
+    })
 
-  const echoServer = createServer((socket) => {
-    socket.on("data", (chunk) => socket.write(chunk))
-  })
-  const targetPort = await listen(echoServer)
-
-  const users = new InMemoryUserStore()
-  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
-  await users.createUser({username: "kasper", password: "correct horse battery staple"})
-  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
-
-  const relay = await startTcpRelay({
-    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
-    tokens,
-    sessions: new SessionStore({now: () => 1000}),
-    tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile, clientCaFile: certs.caCertFile}
-  })
+    expect(dataReceived).toBe(false)
 
-  const clientSocket = tlsConnect({
-    host: "127.0.0.1",
-    port: relay.port,
-    ca: readFileSync(certs.caCertFile),
-    cert: readFileSync(certs.clientCertFile),
-    key: readFileSync(certs.clientKeyFile),
-    rejectUnauthorized: true
+    unauthorizedSocket.destroy()
+    await relay.close()
+    await rm(certDir, {recursive: true, force: true})
   })
 
-  const decoder = new FrameDecoder()
-  await waitConnect(clientSocket)
+  it("TLS relay with mTLS accepts client with valid certificate", async () => {
+    const certDir = mkdtempSync(join(tmpdir(), "socketduct-mtls-accept-"))
+    const certs = generateTestCertificates(certDir)
 
-  const sessionPromise = new Promise((resolve) => {
-    clientSocket.on("data", (chunk) => {
-      for (const frame of decoder.push(chunk)) {
-        if (frame.header.type === "session.created" || frame.header.type === "error") {
-          resolve(frame.header)
-        }
-      }
+    const echoServer = createServer((socket) => {
+      socket.on("data", (chunk) => socket.write(chunk))
+    })
+    const targetPort = await listen(echoServer)
+
+    const users = new InMemoryUserStore()
+    const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+    await users.createUser({username: "kasper", password: "correct horse battery staple"})
+    const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+
+    const relay = await startTcpRelay({
+      authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+      tokens,
+      sessions: new SessionStore({now: () => 1000}),
+      tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile, clientCaFile: certs.caCertFile}
     })
-  })
 
-  clientSocket.write(encodeFrame({
-    type: "session.create",
-    token: token.value,
-    name: "mtls-session",
-    target: {host: "127.0.0.1", port: targetPort},
-    framing: [2]
-  }))
+    const clientSocket = tlsConnect({
+      host: "127.0.0.1",
+      port: relay.port,
+      ca: readFileSync(certs.caCertFile),
+      cert: readFileSync(certs.clientCertFile),
+      key: readFileSync(certs.clientKeyFile),
+      rejectUnauthorized: true
+    })
 
-  const response = await sessionPromise
-  assert.equal(/** @type {{type: string}} */ (response).type, "session.created")
+    const decoder = new FrameDecoder()
+    await waitConnect(clientSocket)
 
-  clientSocket.destroy()
-  await relay.close()
-  await new Promise((resolve, reject) => {
-    echoServer.close((error) => {
-      if (error) {
-        reject(error)
-        return
-      }
-      resolve(undefined)
+    const sessionPromise = new Promise((resolve) => {
+      clientSocket.on("data", (chunk) => {
+        for (const frame of decoder.push(chunk)) {
+          if (frame.header.type === "session.created" || frame.header.type === "error") {
+            resolve(frame.header)
+          }
+        }
+      })
     })
-  })
-  await rm(certDir, {recursive: true, force: true})
-})
 
-test("TLS relay with mTLS requires certificate from the configured client CA (handshake completes, server closes)", async () => {
-  const certDir = mkdtempSync(join(tmpdir(), "socketduct-mtls-wrong-ca-"))
-  const wrongCertDir = mkdtempSync(join(tmpdir(), "socketduct-mtls-wrong-ca-alt-"))
-  const certs = generateTestCertificates(certDir)
-  const wrongCerts = generateTestCertificates(wrongCertDir)
-
-  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
-  const relay = await startTcpRelay({
-    authorizeTarget: () => true,
-    tokens,
-    sessions: new SessionStore({now: () => 1000}),
-    tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile, clientCaFile: certs.caCertFile}
+    clientSocket.write(encodeFrame({
+      type: "session.create",
+      token: token.value,
+      name: "mtls-session",
+      target: {host: "127.0.0.1", port: targetPort},
+      framing: [2]
+    }))
+
+    const response = await sessionPromise
+    expect(/** @type {{type: string}} */ (response).type).toBe("session.created")
+
+    clientSocket.destroy()
+    await relay.close()
+    await new Promise((resolve, reject) => {
+      echoServer.close((error) => {
+        if (error) {
+          reject(error)
+          return
+        }
+        resolve(undefined)
+      })
+    })
+    await rm(certDir, {recursive: true, force: true})
   })
 
-  const clientSocket = tlsConnect({
-    host: "127.0.0.1",
-    port: relay.port,
-    ca: readFileSync(certs.caCertFile),
-    cert: readFileSync(wrongCerts.clientCertFile),
-    key: readFileSync(wrongCerts.clientKeyFile),
-    rejectUnauthorized: false
-  })
+  it("TLS relay with mTLS requires certificate from the configured client CA (handshake completes, server closes)", async () => {
+    const certDir = mkdtempSync(join(tmpdir(), "socketduct-mtls-wrong-ca-"))
+    const wrongCertDir = mkdtempSync(join(tmpdir(), "socketduct-mtls-wrong-ca-alt-"))
+    const certs = generateTestCertificates(certDir)
+    const wrongCerts = generateTestCertificates(wrongCertDir)
 
-  let dataReceived = false
-  clientSocket.on("data", () => { dataReceived = true })
+    const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+    const relay = await startTcpRelay({
+      authorizeTarget: () => true,
+      tokens,
+      sessions: new SessionStore({now: () => 1000}),
+      tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile, clientCaFile: certs.caCertFile}
+    })
 
-  await new Promise((resolve) => {
-    clientSocket.once("error", () => resolve("error"))
-    clientSocket.once("close", () => resolve("close"))
-  })
+    const clientSocket = tlsConnect({
+      host: "127.0.0.1",
+      port: relay.port,
+      ca: readFileSync(certs.caCertFile),
+      cert: readFileSync(wrongCerts.clientCertFile),
+      key: readFileSync(wrongCerts.clientKeyFile),
+      rejectUnauthorized: false
+    })
 
-  assert.equal(dataReceived, false, "client with wrong-CA certificate must not receive data from the relay")
+    let dataReceived = false
+    clientSocket.on("data", () => { dataReceived = true })
 
-  clientSocket.destroy()
-  await relay.close()
-  await rm(certDir, {recursive: true, force: true})
-  await rm(wrongCertDir, {recursive: true, force: true})
-})
+    await new Promise((resolve) => {
+      clientSocket.once("error", () => resolve("error"))
+      clientSocket.once("close", () => resolve("close"))
+    })
 
-test("Plaintext client is rejected by TLS relay (no plaintext protocol reply)", async () => {
-  const certDir = mkdtempSync(join(tmpdir(), "socketduct-wrong-trust-"))
-  const certs = generateTestCertificates(certDir)
+    expect(dataReceived).toBe(false)
 
-  const echoServer = createServer((socket) => {
-    socket.on("data", (chunk) => socket.write(chunk))
-  })
-  const targetPort = await listen(echoServer)
-
-  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
-  const relay = await startTcpRelay({
-    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
-    tokens,
-    sessions: new SessionStore({now: () => 1000}),
-    tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile}
+    clientSocket.destroy()
+    await relay.close()
+    await rm(certDir, {recursive: true, force: true})
+    await rm(wrongCertDir, {recursive: true, force: true})
   })
 
-  const plainSocket = createConnection({host: "127.0.0.1", port: relay.port})
-  await waitConnect(plainSocket)
-  plainSocket.write("GET / HTTP/1.1\r\n\r\n")
+  it("Plaintext client is rejected by TLS relay (no plaintext protocol reply)", async () => {
+    const certDir = mkdtempSync(join(tmpdir(), "socketduct-wrong-trust-"))
+    const certs = generateTestCertificates(certDir)
 
-  let dataReceived = false
-  plainSocket.on("data", () => { dataReceived = true })
+    const echoServer = createServer((socket) => {
+      socket.on("data", (chunk) => socket.write(chunk))
+    })
+    const targetPort = await listen(echoServer)
+
+    const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+    const relay = await startTcpRelay({
+      authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+      tokens,
+      sessions: new SessionStore({now: () => 1000}),
+      tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile}
+    })
 
-  await new Promise((resolve) => {
-    plainSocket.once("close", () => resolve("close"))
-    plainSocket.once("error", () => resolve("error"))
-  })
+    const plainSocket = createConnection({host: "127.0.0.1", port: relay.port})
+    await waitConnect(plainSocket)
+    plainSocket.write("GET / HTTP/1.1\r\n\r\n")
 
-  assert.equal(dataReceived, false, "plaintext client must not receive any protocol reply from a TLS relay")
+    let dataReceived = false
+    plainSocket.on("data", () => { dataReceived = true })
 
-  plainSocket.destroy()
-  await relay.close()
-  await new Promise((resolve, reject) => {
-    echoServer.close((error) => {
-      if (error) {
-        reject(error)
-        return
-      }
-      resolve(undefined)
+    await new Promise((resolve) => {
+      plainSocket.once("close", () => resolve("close"))
+      plainSocket.once("error", () => resolve("error"))
     })
-  })
-  await rm(certDir, {recursive: true, force: true})
-})
 
-test("Edge with TLS reconnects and replays spooled data after relay tunnel drop", async () => {
-  const certDir = mkdtempSync(join(tmpdir(), "socketduct-edge-tls-replay-"))
-  const certs = generateTestCertificates(certDir)
+    expect(dataReceived).toBe(false)
 
-  const tempDir = await mkdtemp(join(tmpdir(), "socketduct-edge-tls-replay-spool-"))
-  const echoServer = createServer((socket) => {
-    socket.on("data", (chunk) => socket.write(chunk))
-  })
-  const targetPort = await listen(echoServer)
-
-  const users = new InMemoryUserStore()
-  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
-  await users.createUser({username: "kasper", password: "correct horse battery staple"})
-  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
-
-  const relay = await startTcpRelay({
-    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
-    tokens,
-    sessions: new SessionStore({now: () => 1000}),
-    resumeWindowMs: 1_000,
-    tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile}
-  })
-
-  const edge = await startTcpEdge({
-    relayHost: "127.0.0.1",
-    relayPort: relay.port,
-    token: token.value,
-    sessionName: "edge-tls-replay",
-    spool: new SessionSpool({rootDir: tempDir}),
-    reconnectDelayMs: 10,
-    target: {host: "127.0.0.1", port: targetPort},
-    tls: {caFile: certs.caCertFile, rejectUnauthorized: true}
+    plainSocket.destroy()
+    await relay.close()
+    await new Promise((resolve, reject) => {
+      echoServer.close((error) => {
+        if (error) {
+          reject(error)
+          return
+        }
+        resolve(undefined)
+      })
+    })
+    await rm(certDir, {recursive: true, force: true})
   })
 
-  const appSocket = createConnection({host: "127.0.0.1", port: edge.port})
-  await waitConnect(appSocket)
-  appSocket.write("tls-first")
-  assert.equal((await readOnce(appSocket)).toString("utf8"), "tls-first")
+  it("Edge with TLS reconnects and replays spooled data after relay tunnel drop", async () => {
+    const certDir = mkdtempSync(join(tmpdir(), "socketduct-edge-tls-replay-"))
+    const certs = generateTestCertificates(certDir)
 
-  relay.closeActiveTunnel()
-  appSocket.write("tls-second")
-  assert.equal((await readOnce(appSocket)).toString("utf8"), "tls-second")
-
-  appSocket.destroy()
-  await edge.close()
-  await relay.close()
-  await new Promise((resolve, reject) => {
-    echoServer.close((error) => {
-      if (error) {
-        reject(error)
-        return
-      }
-      resolve(undefined)
+    const tempDir = await mkdtemp(join(tmpdir(), "socketduct-edge-tls-replay-spool-"))
+    const echoServer = createServer((socket) => {
+      socket.on("data", (chunk) => socket.write(chunk))
+    })
+    const targetPort = await listen(echoServer)
+
+    const users = new InMemoryUserStore()
+    const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+    await users.createUser({username: "kasper", password: "correct horse battery staple"})
+    const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+
+    const relay = await startTcpRelay({
+      authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+      tokens,
+      sessions: new SessionStore({now: () => 1000}),
+      resumeWindowMs: 1_000,
+      tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile}
     })
-  })
-  await rm(tempDir, {recursive: true, force: true})
-  await rm(certDir, {recursive: true, force: true})
-})
 
-test("SocketductSocket with valid mTLS client cert is accepted by mTLS relay", async () => {
-  const certDir = mkdtempSync(join(tmpdir(), "socketduct-mtls-socket-accept-"))
-  const certs = generateTestCertificates(certDir)
+    const edge = await startTcpEdge({
+      relayHost: "127.0.0.1",
+      relayPort: relay.port,
+      token: token.value,
+      sessionName: "edge-tls-replay",
+      spool: new SessionSpool({rootDir: tempDir}),
+      reconnectDelayMs: 10,
+      target: {host: "127.0.0.1", port: targetPort},
+      tls: {caFile: certs.caCertFile, rejectUnauthorized: true}
+    })
 
-  const tempDir = await mkdtemp(join(tmpdir(), "socketduct-mtls-socket-spool-"))
-  const echoServer = createServer((socket) => {
-    socket.on("data", (chunk) => socket.write(chunk))
-  })
-  const targetPort = await listen(echoServer)
-
-  const users = new InMemoryUserStore()
-  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
-  await users.createUser({username: "kasper", password: "correct horse battery staple"})
-  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
-
-  const relay = await startTcpRelay({
-    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
-    tokens,
-    sessions: new SessionStore({now: () => 1000}),
-    tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile, clientCaFile: certs.caCertFile}
+    const appSocket = createConnection({host: "127.0.0.1", port: edge.port})
+    await waitConnect(appSocket)
+    appSocket.write("tls-first")
+    expect((await readOnce(appSocket)).toString("utf8")).toBe("tls-first")
+
+    relay.closeActiveTunnel()
+    appSocket.write("tls-second")
+    expect((await readOnce(appSocket)).toString("utf8")).toBe("tls-second")
+
+    appSocket.destroy()
+    await edge.close()
+    await relay.close()
+    await new Promise((resolve, reject) => {
+      echoServer.close((error) => {
+        if (error) {
+          reject(error)
+          return
+        }
+        resolve(undefined)
+      })
+    })
+    await rm(tempDir, {recursive: true, force: true})
+    await rm(certDir, {recursive: true, force: true})
   })
 
-  const socket = new SocketductSocket({
-    relayHost: "127.0.0.1",
-    relayPort: relay.port,
-    token: token.value,
-    sessionName: "mtls-socket",
-    target: {host: "127.0.0.1", port: targetPort},
-    spool: new SessionSpool({rootDir: tempDir}),
-    reconnectDelayMs: 50,
-    tls: {
-      caFile: certs.caCertFile,
-      certFile: certs.clientCertFile,
-      keyFile: certs.clientKeyFile,
-      rejectUnauthorized: true
-    }
-  })
+  it("SocketductSocket with valid mTLS client cert is accepted by mTLS relay", async () => {
+    const certDir = mkdtempSync(join(tmpdir(), "socketduct-mtls-socket-accept-"))
+    const certs = generateTestCertificates(certDir)
 
-  socket.connect()
-  await new Promise((resolve, reject) => {
-    socket.once("error", reject)
-    socket.once("connect", () => {
-      socket.off("error", reject)
-      resolve(undefined)
+    const tempDir = await mkdtemp(join(tmpdir(), "socketduct-mtls-socket-spool-"))
+    const echoServer = createServer((socket) => {
+      socket.on("data", (chunk) => socket.write(chunk))
+    })
+    const targetPort = await listen(echoServer)
+
+    const users = new InMemoryUserStore()
+    const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+    await users.createUser({username: "kasper", password: "correct horse battery staple"})
+    const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+
+    const relay = await startTcpRelay({
+      authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+      tokens,
+      sessions: new SessionStore({now: () => 1000}),
+      tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile, clientCaFile: certs.caCertFile}
     })
-  })
-
-  socket.write("mtls-test")
-  assert.equal((await readOnce(socket)).toString("utf8"), "mtls-test")
 
-  socket.destroy()
-  await relay.close()
-  await new Promise((resolve, reject) => {
-    echoServer.close((error) => {
-      if (error) {
-        reject(error)
-        return
+    const socket = new SocketductSocket({
+      relayHost: "127.0.0.1",
+      relayPort: relay.port,
+      token: token.value,
+      sessionName: "mtls-socket",
+      target: {host: "127.0.0.1", port: targetPort},
+      spool: new SessionSpool({rootDir: tempDir}),
+      reconnectDelayMs: 50,
+      tls: {
+        caFile: certs.caCertFile,
+        certFile: certs.clientCertFile,
+        keyFile: certs.clientKeyFile,
+        rejectUnauthorized: true
       }
-      resolve(undefined)
     })
-  })
-  await rm(tempDir, {recursive: true, force: true})
-  await rm(certDir, {recursive: true, force: true})
-})
 
-test("SocketductSocket without client cert is rejected by mTLS relay (connect never fires)", async () => {
-  const certDir = mkdtempSync(join(tmpdir(), "socketduct-mtls-no-cert-"))
-  const certs = generateTestCertificates(certDir)
+    socket.connect()
+    await new Promise((resolve, reject) => {
+      socket.once("error", reject)
+      socket.once("connect", () => {
+        socket.off("error", reject)
+        resolve(undefined)
+      })
+    })
 
-  const tempDir = await mkdtemp(join(tmpdir(), "socketduct-mtls-no-cert-spool-"))
-  const echoServer = createServer((socket) => {
-    socket.on("data", (chunk) => socket.write(chunk))
-  })
-  const targetPort = await listen(echoServer)
-
-  const users = new InMemoryUserStore()
-  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
-  await users.createUser({username: "kasper", password: "correct horse battery staple"})
-  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
-
-  const relay = await startTcpRelay({
-    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
-    tokens,
-    sessions: new SessionStore({now: () => 1000}),
-    tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile, clientCaFile: certs.caCertFile}
-  })
+    socket.write("mtls-test")
+    expect((await readOnce(socket)).toString("utf8")).toBe("mtls-test")
 
-  const socket = new SocketductSocket({
-    relayHost: "127.0.0.1",
-    relayPort: relay.port,
-    token: token.value,
-    sessionName: "mtls-no-cert",
-    target: {host: "127.0.0.1", port: targetPort},
-    spool: new SessionSpool({rootDir: tempDir}),
-    reconnectDelayMs: 1000,
-    tls: {
-      caFile: certs.caCertFile,
-      rejectUnauthorized: true
-    }
+    socket.destroy()
+    await relay.close()
+    await new Promise((resolve, reject) => {
+      echoServer.close((error) => {
+        if (error) {
+          reject(error)
+          return
+        }
+        resolve(undefined)
+      })
+    })
+    await rm(tempDir, {recursive: true, force: true})
+    await rm(certDir, {recursive: true, force: true})
   })
 
-  socket.connect()
+  it("SocketductSocket without client cert is rejected by mTLS relay (connect never fires)", async () => {
+    const certDir = mkdtempSync(join(tmpdir(), "socketduct-mtls-no-cert-"))
+    const certs = generateTestCertificates(certDir)
 
-  let connectFired = false
-  let dataReceived = false
-  socket.on("connect", () => { connectFired = true })
-  socket.on("data", () => { dataReceived = true })
-
-  const error = await new Promise((resolve) => { socket.once("error", resolve) })
-  assert.ok(error instanceof Error, "expected error when mTLS client cert is missing")
-  assert.equal(connectFired, false, "connect must not fire when mTLS client cert is missing")
-  assert.equal(dataReceived, false, "no data must be exchanged without a valid mTLS client cert")
+    const tempDir = await mkdtemp(join(tmpdir(), "socketduct-mtls-no-cert-spool-"))
+    const echoServer = createServer((socket) => {
+      socket.on("data", (chunk) => socket.write(chunk))
+    })
+    const targetPort = await listen(echoServer)
+
+    const users = new InMemoryUserStore()
+    const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+    await users.createUser({username: "kasper", password: "correct horse battery staple"})
+    const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+
+    const relay = await startTcpRelay({
+      authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+      tokens,
+      sessions: new SessionStore({now: () => 1000}),
+      tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile, clientCaFile: certs.caCertFile}
+    })
 
-  socket.destroy()
-  await relay.close()
-  await new Promise((resolve, reject) => {
-    echoServer.close((error) => {
-      if (error) {
-        reject(error)
-        return
+    const socket = new SocketductSocket({
+      relayHost: "127.0.0.1",
+      relayPort: relay.port,
+      token: token.value,
+      sessionName: "mtls-no-cert",
+      target: {host: "127.0.0.1", port: targetPort},
+      spool: new SessionSpool({rootDir: tempDir}),
+      reconnectDelayMs: 1000,
+      tls: {
+        caFile: certs.caCertFile,
+        rejectUnauthorized: true
       }
-      resolve(undefined)
     })
-  })
-  await rm(tempDir, {recursive: true, force: true})
-  await rm(certDir, {recursive: true, force: true})
-})
 
-test("SocketductSocket with wrong server CA is rejected during TLS handshake (connect never fires)", async () => {
-  const certDir = mkdtempSync(join(tmpdir(), "socketduct-wrong-server-ca-"))
-  const wrongCertDir = mkdtempSync(join(tmpdir(), "socketduct-wrong-server-ca-alt-"))
-  const certs = generateTestCertificates(certDir)
-  const wrongCerts = generateTestCertificates(wrongCertDir)
-
-  const tempDir = await mkdtemp(join(tmpdir(), "socketduct-wrong-server-ca-spool-"))
-  const echoServer = createServer((socket) => {
-    socket.on("data", (chunk) => socket.write(chunk))
-  })
-  const targetPort = await listen(echoServer)
-
-  const users = new InMemoryUserStore()
-  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
-  await users.createUser({username: "kasper", password: "correct horse battery staple"})
-  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
-
-  const relay = await startTcpRelay({
-    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
-    tokens,
-    sessions: new SessionStore({now: () => 1000}),
-    tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile}
-  })
-
-  const socket = connectSocketduct({
-    relay: {host: "127.0.0.1", port: relay.port, token: token.value},
-    sessionName: "wrong-server-ca",
-    target: {host: "127.0.0.1", port: targetPort},
-    spoolDirectory: tempDir,
-    reconnect: {initialDelayMs: 1000},
-    tls: {
-      caFile: wrongCerts.caCertFile,
-      rejectUnauthorized: true
-    }
+    socket.connect()
+
+    let connectFired = false
+    let dataReceived = false
+    socket.on("connect", () => { connectFired = true })
+    socket.on("data", () => { dataReceived = true })
+
+    const error = await new Promise((resolve) => { socket.once("error", resolve) })
+    expect(error instanceof Error).toBeTruthy()
+    expect(connectFired).toBe(false)
+    expect(dataReceived).toBe(false)
+
+    socket.destroy()
+    await relay.close()
+    await new Promise((resolve, reject) => {
+      echoServer.close((error) => {
+        if (error) {
+          reject(error)
+          return
+        }
+        resolve(undefined)
+      })
+    })
+    await rm(tempDir, {recursive: true, force: true})
+    await rm(certDir, {recursive: true, force: true})
   })
 
-  let connectFired = false
-  let dataReceived = false
-  socket.on("connect", () => { connectFired = true })
-  socket.on("data", () => { dataReceived = true })
+  it("SocketductSocket with wrong server CA is rejected during TLS handshake (connect never fires)", async () => {
+    const certDir = mkdtempSync(join(tmpdir(), "socketduct-wrong-server-ca-"))
+    const wrongCertDir = mkdtempSync(join(tmpdir(), "socketduct-wrong-server-ca-alt-"))
+    const certs = generateTestCertificates(certDir)
+    const wrongCerts = generateTestCertificates(wrongCertDir)
 
-  const error = await new Promise((resolve) => { socket.once("error", resolve) })
-  assert.ok(error instanceof Error, "expected error when server CA is untrusted")
-  assert.equal(connectFired, false, "connect must not fire when server CA is untrusted")
-  assert.equal(dataReceived, false, "no data must be exchanged with an untrusted server CA")
+    const tempDir = await mkdtemp(join(tmpdir(), "socketduct-wrong-server-ca-spool-"))
+    const echoServer = createServer((socket) => {
+      socket.on("data", (chunk) => socket.write(chunk))
+    })
+    const targetPort = await listen(echoServer)
+
+    const users = new InMemoryUserStore()
+    const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+    await users.createUser({username: "kasper", password: "correct horse battery staple"})
+    const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+
+    const relay = await startTcpRelay({
+      authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+      tokens,
+      sessions: new SessionStore({now: () => 1000}),
+      tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile}
+    })
 
-  socket.destroy()
-  await relay.close()
-  await new Promise((resolve, reject) => {
-    echoServer.close((error) => {
-      if (error) {
-        reject(error)
-        return
+    const socket = connectSocketduct({
+      relay: {host: "127.0.0.1", port: relay.port, token: token.value},
+      sessionName: "wrong-server-ca",
+      target: {host: "127.0.0.1", port: targetPort},
+      spoolDirectory: tempDir,
+      reconnect: {initialDelayMs: 1000},
+      tls: {
+        caFile: wrongCerts.caCertFile,
+        rejectUnauthorized: true
       }
-      resolve(undefined)
     })
-  })
-  await rm(tempDir, {recursive: true, force: true})
-  await rm(certDir, {recursive: true, force: true})
-  await rm(wrongCertDir, {recursive: true, force: true})
-})
-
-test("TcpEdge with mTLS client cert connects to mTLS relay and forwards data", async () => {
-  const certDir = mkdtempSync(join(tmpdir(), "socketduct-tcp-edge-mtls-"))
-  const certs = generateTestCertificates(certDir)
 
-  const tempDir = await mkdtemp(join(tmpdir(), "socketduct-tcp-edge-mtls-spool-"))
-  const echoServer = createServer((socket) => {
-    socket.on("data", (chunk) => socket.write(chunk))
-  })
-  const targetPort = await listen(echoServer)
-
-  const users = new InMemoryUserStore()
-  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
-  await users.createUser({username: "kasper", password: "correct horse battery staple"})
-  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
-
-  const relay = await startTcpRelay({
-    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
-    tokens,
-    sessions: new SessionStore({now: () => 1000}),
-    tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile, clientCaFile: certs.caCertFile}
+    let connectFired = false
+    let dataReceived = false
+    socket.on("connect", () => { connectFired = true })
+    socket.on("data", () => { dataReceived = true })
+
+    const error = await new Promise((resolve) => { socket.once("error", resolve) })
+    expect(error instanceof Error).toBeTruthy()
+    expect(connectFired).toBe(false)
+    expect(dataReceived).toBe(false)
+
+    socket.destroy()
+    await relay.close()
+    await new Promise((resolve, reject) => {
+      echoServer.close((error) => {
+        if (error) {
+          reject(error)
+          return
+        }
+        resolve(undefined)
+      })
+    })
+    await rm(tempDir, {recursive: true, force: true})
+    await rm(certDir, {recursive: true, force: true})
+    await rm(wrongCertDir, {recursive: true, force: true})
   })
 
-  const edge = await startTcpEdge({
-    relayHost: "127.0.0.1",
-    relayPort: relay.port,
-    token: token.value,
-    sessionName: "tcp-edge-mtls",
-    spool: new SessionSpool({rootDir: tempDir}),
-    target: {host: "127.0.0.1", port: targetPort},
-    reconnectDelayMs: 50,
-    tls: {
-      caFile: certs.caCertFile,
-      certFile: certs.clientCertFile,
-      keyFile: certs.clientKeyFile,
-      rejectUnauthorized: true
-    }
-  })
+  it("TcpEdge with mTLS client cert connects to mTLS relay and forwards data", async () => {
+    const certDir = mkdtempSync(join(tmpdir(), "socketduct-tcp-edge-mtls-"))
+    const certs = generateTestCertificates(certDir)
 
-  const appSocket = createConnection({host: "127.0.0.1", port: edge.port})
-  await waitConnect(appSocket)
-  appSocket.write("tcp-edge-mtls")
-  assert.equal((await readOnce(appSocket)).toString("utf8"), "tcp-edge-mtls")
+    const tempDir = await mkdtemp(join(tmpdir(), "socketduct-tcp-edge-mtls-spool-"))
+    const echoServer = createServer((socket) => {
+      socket.on("data", (chunk) => socket.write(chunk))
+    })
+    const targetPort = await listen(echoServer)
+
+    const users = new InMemoryUserStore()
+    const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+    await users.createUser({username: "kasper", password: "correct horse battery staple"})
+    const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+
+    const relay = await startTcpRelay({
+      authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+      tokens,
+      sessions: new SessionStore({now: () => 1000}),
+      tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile, clientCaFile: certs.caCertFile}
+    })
 
-  appSocket.destroy()
-  await edge.close()
-  await relay.close()
-  await new Promise((resolve, reject) => {
-    echoServer.close((error) => {
-      if (error) {
-        reject(error)
-        return
+    const edge = await startTcpEdge({
+      relayHost: "127.0.0.1",
+      relayPort: relay.port,
+      token: token.value,
+      sessionName: "tcp-edge-mtls",
+      spool: new SessionSpool({rootDir: tempDir}),
+      target: {host: "127.0.0.1", port: targetPort},
+      reconnectDelayMs: 50,
+      tls: {
+        caFile: certs.caCertFile,
+        certFile: certs.clientCertFile,
+        keyFile: certs.clientKeyFile,
+        rejectUnauthorized: true
       }
-      resolve(undefined)
     })
-  })
-  await rm(tempDir, {recursive: true, force: true})
-  await rm(certDir, {recursive: true, force: true})
-})
-
-test("TLS SocketductSocket reconnects cleanly when relay closes connection after TLS handshake but before session response", async () => {
-  const certDir = mkdtempSync(join(tmpdir(), "socketduct-tls-pre-session-close-"))
-  const certs = generateTestCertificates(certDir)
 
-  const tempDir = await mkdtemp(join(tmpdir(), "socketduct-tls-pre-session-close-spool-"))
-  const echoServer = createServer((socket) => {
-    socket.on("data", (chunk) => socket.write(chunk))
-  })
-  const targetPort = await listen(echoServer)
-
-  const users = new InMemoryUserStore()
-  const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
-  await users.createUser({username: "kasper", password: "correct horse battery staple"})
-  const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
-
-  const relay = await startTcpRelay({
-    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
-    tokens,
-    sessions: new SessionStore({now: () => 1000}),
-    tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile}
+    const appSocket = createConnection({host: "127.0.0.1", port: edge.port})
+    await waitConnect(appSocket)
+    appSocket.write("tcp-edge-mtls")
+    expect((await readOnce(appSocket)).toString("utf8")).toBe("tcp-edge-mtls")
+
+    appSocket.destroy()
+    await edge.close()
+    await relay.close()
+    await new Promise((resolve, reject) => {
+      echoServer.close((error) => {
+        if (error) {
+          reject(error)
+          return
+        }
+        resolve(undefined)
+      })
+    })
+    await rm(tempDir, {recursive: true, force: true})
+    await rm(certDir, {recursive: true, force: true})
   })
 
-  const socket = connectSocketduct({
-    relay: {host: "127.0.0.1", port: relay.port, token: token.value},
-    sessionName: "tls-pre-session-close",
-    target: {host: "127.0.0.1", port: targetPort},
-    spoolDirectory: tempDir,
-    reconnect: {initialDelayMs: 25},
-    tls: {
-      caFile: certs.caCertFile,
-      rejectUnauthorized: true
-    }
-  })
+  it("TLS SocketductSocket reconnects cleanly when relay closes connection after TLS handshake but before session response", async () => {
+    const certDir = mkdtempSync(join(tmpdir(), "socketduct-tls-pre-session-close-"))
+    const certs = generateTestCertificates(certDir)
 
-  let errorEmitted = false
-  socket.on("error", () => { errorEmitted = true })
-
-  let connectCount = 0
-  socket.on("connect", () => { connectCount += 1 })
-
-  // Force-close the relay tunnel after the TLS handshake completes
-  // but before any protocol frame is exchanged. The relay's
-  // secureConnection event fires synchronously inside setupTunnel
-  // — which adds the socket to the tunnel set — so closeActiveTunnel
-  // destroys it before any data event can process session.create.
-  // This proves the vulnerable pre-session branch: the first TLS
-  // connection reaches secureConnect yet is closed before the client
-  // receives session.created / session.resumed.
-  socket.connect()
-  await new Promise((resolve) => {
-    relay.server.once("secureConnection", () => {
-      relay.closeActiveTunnel()
-      resolve(undefined)
+    const tempDir = await mkdtemp(join(tmpdir(), "socketduct-tls-pre-session-close-spool-"))
+    const echoServer = createServer((socket) => {
+      socket.on("data", (chunk) => socket.write(chunk))
+    })
+    const targetPort = await listen(echoServer)
+
+    const users = new InMemoryUserStore()
+    const tokens = new TokenStore({now: () => 1000, tokenTtlMs: 60_000})
+    await users.createUser({username: "kasper", password: "correct horse battery staple"})
+    const token = await login(users, tokens, {username: "kasper", password: "correct horse battery staple"})
+
+    const relay = await startTcpRelay({
+      authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+      tokens,
+      sessions: new SessionStore({now: () => 1000}),
+      tls: {certFile: certs.serverCertFile, keyFile: certs.serverKeyFile}
     })
-  })
 
-  assert.equal(socket.pending, true, "socket must still be pending after pre-session forced close")
+    const socket = connectSocketduct({
+      relay: {host: "127.0.0.1", port: relay.port, token: token.value},
+      sessionName: "tls-pre-session-close",
+      target: {host: "127.0.0.1", port: targetPort},
+      spoolDirectory: tempDir,
+      reconnect: {initialDelayMs: 25},
+      tls: {
+        caFile: certs.caCertFile,
+        rejectUnauthorized: true
+      }
+    })
 
-  // The socket must not be destroyed with an error; it must reconnect
-  // and deliver data on the later connection. "connect" fires only on
-  // the first successful session creation; reconnects emit "ready".
-  await new Promise((resolve, reject) => {
-    const timeout = setTimeout(() => reject(new Error("Timed out waiting for TLS reconnect")), 5000)
-    const onConnect = () => {
-      clearTimeout(timeout)
-      cleanup()
-      resolve(undefined)
-    }
-    const onReady = () => {
-      clearTimeout(timeout)
-      cleanup()
-      resolve(undefined)
-    }
-    const onError = (/** @type {Error} */ err) => {
-      clearTimeout(timeout)
-      cleanup()
-      reject(err)
-    }
-    const cleanup = () => {
-      socket.off("connect", onConnect)
-      socket.off("ready", onReady)
-      socket.off("error", onError)
-    }
-    socket.on("connect", onConnect)
-    socket.on("ready", onReady)
-    socket.on("error", onError)
-  })
+    let errorEmitted = false
+    socket.on("error", () => { errorEmitted = true })
+
+    let connectCount = 0
+    socket.on("connect", () => { connectCount += 1 })
+
+    // Force-close the relay tunnel after the TLS handshake completes
+    // but before any protocol frame is exchanged. The relay's
+    // secureConnection event fires synchronously inside setupTunnel
+    // — which adds the socket to the tunnel set — so closeActiveTunnel
+    // destroys it before any data event can process session.create.
+    // This proves the vulnerable pre-session branch: the first TLS
+    // connection reaches secureConnect yet is closed before the client
+    // receives session.created / session.resumed.
+    socket.connect()
+    await new Promise((resolve) => {
+      relay.server.once("secureConnection", () => {
+        relay.closeActiveTunnel()
+        resolve(undefined)
+      })
+    })
+
+    expect(socket.pending).toBe(true)
+
+    // The socket must not be destroyed with an error; it must reconnect
+    // and deliver data on the later connection. "connect" fires only on
+    // the first successful session creation; reconnects emit "ready".
+    await new Promise((resolve, reject) => {
+      const timeout = setTimeout(() => reject(new Error("Timed out waiting for TLS reconnect")), 5000)
+      const onConnect = () => {
+        clearTimeout(timeout)
+        cleanup()
+        resolve(undefined)
+      }
+      const onReady = () => {
+        clearTimeout(timeout)
+        cleanup()
+        resolve(undefined)
+      }
+      const onError = (/** @type {Error} */ err) => {
+        clearTimeout(timeout)
+        cleanup()
+        reject(err)
+      }
+      const cleanup = () => {
+        socket.off("connect", onConnect)
+        socket.off("ready", onReady)
+        socket.off("error", onError)
+      }
+      socket.on("connect", onConnect)
+      socket.on("ready", onReady)
+      socket.on("error", onError)
+    })
 
-  assert.equal(errorEmitted, false, "no error must emit when TLS connection closes before session response")
-  assert.ok(connectCount >= 1, "connect must have fired at least once")
+    expect(errorEmitted).toBe(false)
+    expect(connectCount).toBeGreaterThanOrEqual(1)
 
-  socket.write("tls-pre-session-reconnect")
-  assert.equal((await readOnce(socket)).toString("utf8"), "tls-pre-session-reconnect")
+    socket.write("tls-pre-session-reconnect")
+    expect((await readOnce(socket)).toString("utf8")).toBe("tls-pre-session-reconnect")
 
-  socket.destroy()
-  await relay.close()
-  await new Promise((resolve, reject) => {
-    echoServer.close((error) => {
-      if (error) {
-        reject(error)
-        return
-      }
-      resolve(undefined)
+    socket.destroy()
+    await relay.close()
+    await new Promise((resolve, reject) => {
+      echoServer.close((error) => {
+        if (error) {
+          reject(error)
+          return
+        }
+        resolve(undefined)
+      })
     })
+    await rm(tempDir, {recursive: true, force: true})
+    await rm(certDir, {recursive: true, force: true})
   })
-  await rm(tempDir, {recursive: true, force: true})
-  await rm(certDir, {recursive: true, force: true})
 })