socketduct 0.1.25 → 0.1.27

package/test/integration/initial-target-recovery.test.js

@@ -1,16 +1,15 @@
-import assert from "node:assert/strict"
+import {describe, expect, it} from "@velocious/testing"
 import {createConnection, createServer} from "node:net"
-import test from "node:test"
+import {mkdtemp, rm} from "node:fs/promises"
+import {tmpdir} from "node:os"
+import {join} from "node:path"
+import {EventEmitter} from "node:events"
 
 import {InMemoryUserStore, login, TokenStore} from "../../src/auth/user-store.js"
 import {connectSocketduct} from "../../src/client/socketduct-socket.js"
 import {encodeCompactData, encodeFrame, FrameDecoder} from "../../src/protocol/frame.js"
 import {startTcpRelay} from "../../src/proxy/tcp-relay.js"
 import {SessionStore} from "../../src/sessions/session.js"
-import {mkdtemp, rm} from "node:fs/promises"
-import {tmpdir} from "node:os"
-import {join} from "node:path"
-import {EventEmitter} from "node:events"
 
 /** @typedef {ReturnType<FrameDecoder["push"]>[number]} DecodedFrame */
 
@@ -148,371 +147,371 @@ class HangingTargetSocket extends EventEmitter {
   }
 }
 
-test("authenticated create stays pending without an error and the same request succeeds when the target starts", async () => {
-  const targetPort = await reservePort()
-  const {sessions, token, tokens} = await authenticatedStores()
-  const relay = await startTcpRelay({
-    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
-    handshakeTimeoutMs: 10,
-    initialTargetRetryDelayMs: 30,
-    initialTargetRetryMaxDelayMs: 30,
-    sessions,
-    tokens
-  })
-  const tunnel = createConnection({host: "127.0.0.1", port: relay.port})
-  const collector = collectFrames(tunnel, new FrameDecoder({compactDirection: "target-to-client"}))
-  const targetServer = createServer((socket) => socket.on("data", (chunk) => socket.write(chunk)))
-  try {
-    await waitConnect(tunnel)
-    tunnel.write(encodeFrame({
-      type: "session.create", token: token.value, name: "pending-create", identifier: "pending-create",
-      target: {host: "127.0.0.1", port: targetPort}, framing: [2]
-    }))
-
-    await waitUntil(() => sessions.get("pending-create") !== undefined)
-    assert.equal(sessions.get("pending-create")?.state, "creating")
-    await waitUntil(() => relay.status().targetRetryTimers === 1)
-    assert.equal(collector.frames.length, 0, "initial refusal must not announce or emit an error")
+describe("initial target recovery", () => {
+  it("authenticated create stays pending without an error and the same request succeeds when the target starts", async () => {
+    const targetPort = await reservePort()
+    const {sessions, token, tokens} = await authenticatedStores()
+    const relay = await startTcpRelay({
+      authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+      handshakeTimeoutMs: 10,
+      initialTargetRetryDelayMs: 30,
+      initialTargetRetryMaxDelayMs: 30,
+      sessions,
+      tokens
+    })
+    const tunnel = createConnection({host: "127.0.0.1", port: relay.port})
+    const collector = collectFrames(tunnel, new FrameDecoder({compactDirection: "target-to-client"}))
+    const targetServer = createServer((socket) => socket.on("data", (chunk) => socket.write(chunk)))
+    try {
+      await waitConnect(tunnel)
+      tunnel.write(encodeFrame({
+        type: "session.create", token: token.value, name: "pending-create", identifier: "pending-create",
+        target: {host: "127.0.0.1", port: targetPort}, framing: [2]
+      }))
 
-    // Deliberately cross the shorter authentication deadline while a retry is pending.
-    await new Promise((resolve) => setTimeout(resolve, 15))
-    assert.equal(collector.frames.some((frame) => frame.header.code === "HANDSHAKE_TIMEOUT"), false)
+      await waitUntil(() => sessions.get("pending-create") !== undefined)
+      expect(sessions.get("pending-create")?.state).toBe("creating")
+      await waitUntil(() => relay.status().targetRetryTimers === 1)
+      expect(collector.frames.length).toBe(0) // initial refusal must not announce or emit an error
 
-    await listen(targetServer, targetPort)
-    const created = await collector.waitFor((frame) => frame.header.type === "session.created")
-    assert.equal(created.header.identifier, "pending-create")
-    assert.equal(created.header.state, "active")
-    assert.equal(sessions.get("pending-create")?.state, "active")
-    assert.equal(collector.frames.filter((frame) => frame.header.type === "session.created").length, 1)
-  } finally {
-    tunnel.destroy()
-    await relay.close()
-    await closeServer(targetServer)
-  }
-})
+      // Deliberately cross the shorter authentication deadline while a retry is pending.
+      await new Promise((resolve) => setTimeout(resolve, 15))
+      expect(collector.frames.some((frame) => frame.header.code === "HANDSHAKE_TIMEOUT")).toBe(false)
 
-test("SocketductSocket does not deliver queued application bytes before readiness", async () => {
-  const targetPort = await reservePort()
-  const spoolDirectory = await mkdtemp(join(tmpdir(), "socketduct-initial-readiness-"))
-  const {sessions, token, tokens} = await authenticatedStores()
-  const relay = await startTcpRelay({
-    authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
-    initialTargetRetryDelayMs: 10,
-    initialTargetRetryMaxDelayMs: 20,
-    sessions,
-    tokens
+      await listen(targetServer, targetPort)
+      const created = await collector.waitFor((frame) => frame.header.type === "session.created")
+      expect(created.header.identifier).toBe("pending-create")
+      expect(created.header.state).toBe("active")
+      expect(sessions.get("pending-create")?.state).toBe("active")
+      expect(collector.frames.filter((frame) => frame.header.type === "session.created").length).toBe(1)
+    } finally {
+      tunnel.destroy()
+      await relay.close()
+      await closeServer(targetServer)
+    }
   })
-  let clientConnected = false
-  let bytesBeforeConnect = 0
-  const targetServer = createServer((socket) => {
-    socket.on("data", (chunk) => {
-      if (!clientConnected) bytesBeforeConnect += chunk.length
-      socket.write(chunk)
+
+  it("SocketductSocket does not deliver queued application bytes before readiness", async () => {
+    const targetPort = await reservePort()
+    const spoolDirectory = await mkdtemp(join(tmpdir(), "socketduct-initial-readiness-"))
+    const {sessions, token, tokens} = await authenticatedStores()
+    const relay = await startTcpRelay({
+      authorizeTarget: ({target}) => target.host === "127.0.0.1" && target.port === targetPort,
+      initialTargetRetryDelayMs: 10,
+      initialTargetRetryMaxDelayMs: 20,
+      sessions,
+      tokens
     })
-  })
-  const client = connectSocketduct({
-    relay: {host: "127.0.0.1", port: relay.port, token: token.value},
-    sessionName: "queued-before-ready",
-    spoolDirectory,
-    target: {host: "127.0.0.1", port: targetPort}
-  })
-  client.on("error", () => {})
-  client.once("connect", () => { clientConnected = true })
-  client.write("queued-application-bytes")
-  try {
-    await waitUntil(() => relay.status().targetRetryTimers === 1)
-    assert.equal(client.connecting, true)
-    assert.equal(bytesBeforeConnect, 0)
-    await listen(targetServer, targetPort)
-    const echoed = await new Promise((resolve, reject) => {
-      const timer = setTimeout(() => reject(new Error("timed out waiting for queued echo")), 1_000)
-      client.once("data", (chunk) => {
-        clearTimeout(timer)
-        resolve(chunk.toString("utf8"))
+    let clientConnected = false
+    let bytesBeforeConnect = 0
+    const targetServer = createServer((socket) => {
+      socket.on("data", (chunk) => {
+        if (!clientConnected) bytesBeforeConnect += chunk.length
+        socket.write(chunk)
       })
     })
-    assert.equal(echoed, "queued-application-bytes")
-    assert.equal(bytesBeforeConnect, 0)
-  } finally {
-    client.destroy()
-    await relay.close()
-    await closeServer(targetServer)
-    await rm(spoolDirectory, {recursive: true, force: true})
-  }
-})
+    const client = connectSocketduct({
+      relay: {host: "127.0.0.1", port: relay.port, token: token.value},
+      sessionName: "queued-before-ready",
+      spoolDirectory,
+      target: {host: "127.0.0.1", port: targetPort}
+    })
+    client.on("error", () => {})
+    client.once("connect", () => { clientConnected = true })
+    client.write("queued-application-bytes")
+    try {
+      await waitUntil(() => relay.status().targetRetryTimers === 1)
+      expect(client.connecting).toBe(true)
+      expect(bytesBeforeConnect).toBe(0)
+      await listen(targetServer, targetPort)
+      const echoed = await new Promise((resolve, reject) => {
+        const timer = setTimeout(() => reject(new Error("timed out waiting for queued echo")), 1_000)
+        client.once("data", (chunk) => {
+          clearTimeout(timer)
+          resolve(chunk.toString("utf8"))
+        })
+      })
+      expect(echoed).toBe("queued-application-bytes")
+      expect(bytesBeforeConnect).toBe(0)
+    } finally {
+      client.destroy()
+      await relay.close()
+      await closeServer(targetServer)
+      await rm(spoolDirectory, {recursive: true, force: true})
+    }
+  })
 
-test("relay rejects stream frames while an authenticated create is not ready", async () => {
-  const targetPort = await reservePort()
-  const {sessions, token, tokens} = await authenticatedStores()
-  const relay = await startTcpRelay({
-    authorizeTarget: () => true,
-    initialTargetRetryDelayMs: 50,
-    initialTargetRetryMaxDelayMs: 50,
-    sessions,
-    tokens
+  it("relay rejects stream frames while an authenticated create is not ready", async () => {
+    const targetPort = await reservePort()
+    const {sessions, token, tokens} = await authenticatedStores()
+    const relay = await startTcpRelay({
+      authorizeTarget: () => true,
+      initialTargetRetryDelayMs: 50,
+      initialTargetRetryMaxDelayMs: 50,
+      sessions,
+      tokens
+    })
+    const tunnel = createConnection({host: "127.0.0.1", port: relay.port})
+    const collector = collectFrames(tunnel, new FrameDecoder({compactDirection: "target-to-client"}))
+    try {
+      await waitConnect(tunnel)
+      tunnel.write(encodeFrame({
+        type: "session.create", token: token.value, name: "premature-data", identifier: "premature-data",
+        target: {host: "127.0.0.1", port: targetPort}, framing: [2]
+      }))
+      await waitUntil(() => sessions.get("premature-data") !== undefined)
+      tunnel.write(encodeCompactData({sequence: 4, payload: Buffer.from("nope")}))
+      const violation = await collector.waitFor((frame) => frame.header.type === "error")
+      expect(violation.header.code).toBe("PROTOCOL_VIOLATION")
+      expect(violation.header.retryable).toBe(false)
+      await waitUntil(() => sessions.get("premature-data") === undefined)
+    } finally {
+      tunnel.destroy()
+      await relay.close()
+    }
   })
-  const tunnel = createConnection({host: "127.0.0.1", port: relay.port})
-  const collector = collectFrames(tunnel, new FrameDecoder({compactDirection: "target-to-client"}))
-  try {
+
+  it("closing an unannounced tunnel deletes it and stale work cannot activate a reused identifier", async () => {
+    const targetPort = await reservePort()
+    const {sessions, token, tokens} = await authenticatedStores()
+    const relay = await startTcpRelay({
+      authorizeTarget: () => true,
+      initialTargetRetryDelayMs: 50,
+      initialTargetRetryMaxDelayMs: 50,
+      sessions,
+      tokens
+    })
+    const tunnel = createConnection({host: "127.0.0.1", port: relay.port})
+    let targetConnections = 0
+    const targetServer = createServer(() => { targetConnections += 1 })
     await waitConnect(tunnel)
     tunnel.write(encodeFrame({
-      type: "session.create", token: token.value, name: "premature-data", identifier: "premature-data",
+      type: "session.create", token: token.value, name: "cancel-pending", identifier: "cancel-pending",
       target: {host: "127.0.0.1", port: targetPort}, framing: [2]
     }))
-    await waitUntil(() => sessions.get("premature-data") !== undefined)
-    tunnel.write(encodeCompactData({sequence: 4, payload: Buffer.from("nope")}))
-    const violation = await collector.waitFor((frame) => frame.header.type === "error")
-    assert.equal(violation.header.code, "PROTOCOL_VIOLATION")
-    assert.equal(violation.header.retryable, false)
-    await waitUntil(() => sessions.get("premature-data") === undefined)
-  } finally {
+    await waitUntil(() => relay.status().targetRetryTimers === 1)
     tunnel.destroy()
-    await relay.close()
-  }
-})
+    await waitClose(tunnel)
+    await waitUntil(() => relay.status().sessions === 0)
+    expect(sessions.get("cancel-pending")).toBeUndefined()
+    expect(relay.status()).toEqual({
+      activeTunnels: 0, activeTargets: 0, sessions: 0, attachedSessions: 0,
+      detachedSessions: 0, bufferedTargetBytes: 0, targetConnectionAttempts: 0, targetRetryTimers: 0
+    })
 
-test("closing an unannounced tunnel deletes it and stale work cannot activate a reused identifier", async () => {
-  const targetPort = await reservePort()
-  const {sessions, token, tokens} = await authenticatedStores()
-  const relay = await startTcpRelay({
-    authorizeTarget: () => true,
-    initialTargetRetryDelayMs: 50,
-    initialTargetRetryMaxDelayMs: 50,
-    sessions,
-    tokens
-  })
-  const tunnel = createConnection({host: "127.0.0.1", port: relay.port})
-  let targetConnections = 0
-  const targetServer = createServer(() => { targetConnections += 1 })
-  await waitConnect(tunnel)
-  tunnel.write(encodeFrame({
-    type: "session.create", token: token.value, name: "cancel-pending", identifier: "cancel-pending",
-    target: {host: "127.0.0.1", port: targetPort}, framing: [2]
-  }))
-  await waitUntil(() => relay.status().targetRetryTimers === 1)
-  tunnel.destroy()
-  await waitClose(tunnel)
-  await waitUntil(() => relay.status().sessions === 0)
-  assert.equal(sessions.get("cancel-pending"), undefined)
-  assert.deepEqual(relay.status(), {
-    activeTunnels: 0, activeTargets: 0, sessions: 0, attachedSessions: 0,
-    detachedSessions: 0, bufferedTargetBytes: 0, targetConnectionAttempts: 0, targetRetryTimers: 0
+    const replacementTunnel = createConnection({host: "127.0.0.1", port: relay.port})
+    const replacementCollector = collectFrames(replacementTunnel, new FrameDecoder({compactDirection: "target-to-client"}))
+    try {
+      await listen(targetServer, targetPort)
+      await waitConnect(replacementTunnel)
+      replacementTunnel.write(encodeFrame({
+        type: "session.create", token: token.value, name: "replacement", identifier: "cancel-pending",
+        target: {host: "127.0.0.1", port: targetPort}, framing: [2]
+      }))
+      await replacementCollector.waitFor((frame) => frame.header.type === "session.created")
+      expect(sessions.get("cancel-pending")?.state).toBe("active")
+      expect(targetConnections).toBe(1)
+    } finally {
+      replacementTunnel.destroy()
+      await relay.close()
+      await closeServer(targetServer)
+    }
   })
 
-  const replacementTunnel = createConnection({host: "127.0.0.1", port: relay.port})
-  const replacementCollector = collectFrames(replacementTunnel, new FrameDecoder({compactDirection: "target-to-client"}))
-  try {
-    await listen(targetServer, targetPort)
-    await waitConnect(replacementTunnel)
-    replacementTunnel.write(encodeFrame({
-      type: "session.create", token: token.value, name: "replacement", identifier: "cancel-pending",
-      target: {host: "127.0.0.1", port: targetPort}, framing: [2]
-    }))
-    await replacementCollector.waitFor((frame) => frame.header.type === "session.created")
-    assert.equal(sessions.get("cancel-pending")?.state, "active")
-    assert.equal(targetConnections, 1)
-  } finally {
-    replacementTunnel.destroy()
+  it("relay close cancels all pending target attempts, retry timers, and creating sessions", async () => {
+    const targetPort = await reservePort()
+    const {sessions, token, tokens} = await authenticatedStores()
+    const relay = await startTcpRelay({
+      authorizeTarget: () => true,
+      initialTargetRetryDelayMs: 100,
+      initialTargetRetryMaxDelayMs: 100,
+      sessions,
+      tokens
+    })
+    const tunnels = Array.from({length: 3}, (_, index) => {
+      const tunnel = createConnection({host: "127.0.0.1", port: relay.port})
+      tunnel.once("connect", () => tunnel.write(encodeFrame({
+        type: "session.create", token: token.value, name: `relay-close-${index}`, identifier: `relay-close-${index}`,
+        target: {host: "127.0.0.1", port: targetPort}, framing: [2]
+      })))
+      tunnel.on("error", () => {})
+      return tunnel
+    })
+    await waitUntil(() => relay.status().targetRetryTimers === tunnels.length)
     await relay.close()
-    await closeServer(targetServer)
-  }
-})
-
-test("relay close cancels all pending target attempts, retry timers, and creating sessions", async () => {
-  const targetPort = await reservePort()
-  const {sessions, token, tokens} = await authenticatedStores()
-  const relay = await startTcpRelay({
-    authorizeTarget: () => true,
-    initialTargetRetryDelayMs: 100,
-    initialTargetRetryMaxDelayMs: 100,
-    sessions,
-    tokens
+    expect(relay.status().targetRetryTimers).toBe(0)
+    expect(relay.status().targetConnectionAttempts).toBe(0)
+    expect(relay.status().sessions).toBe(0)
+    for (let index = 0; index < tunnels.length; index += 1) {
+      expect(sessions.get(`relay-close-${index}`)).toBeUndefined()
+    }
   })
-  const tunnels = Array.from({length: 3}, (_, index) => {
+
+  it("target closure after announcement is terminal and never starts target recovery", async () => {
+    let targetConnections = 0
+    /** @type {import('node:net').Socket | undefined} */
+    let targetSocket
+    const targetServer = createServer((socket) => {
+      targetConnections += 1
+      targetSocket = socket
+      socket.on("error", () => {})
+    })
+    const targetPort = await listen(targetServer)
+    const {sessions, token, tokens} = await authenticatedStores()
+    const relay = await startTcpRelay({
+      authorizeTarget: () => true,
+      initialTargetRetryDelayMs: 10,
+      initialTargetRetryMaxDelayMs: 20,
+      sessions,
+      tokens
+    })
     const tunnel = createConnection({host: "127.0.0.1", port: relay.port})
-    tunnel.once("connect", () => tunnel.write(encodeFrame({
-      type: "session.create", token: token.value, name: `relay-close-${index}`, identifier: `relay-close-${index}`,
-      target: {host: "127.0.0.1", port: targetPort}, framing: [2]
-    })))
-    tunnel.on("error", () => {})
-    return tunnel
+    const collector = collectFrames(tunnel, new FrameDecoder({compactDirection: "target-to-client"}))
+    try {
+      await waitConnect(tunnel)
+      tunnel.write(encodeFrame({
+        type: "session.create", token: token.value, name: "terminal-target", identifier: "terminal-target",
+        target: {host: "127.0.0.1", port: targetPort}, framing: [2]
+      }))
+      await collector.waitFor((frame) => frame.header.type === "session.created")
+      expect(targetSocket !== undefined).toBeTruthy()
+      if (!targetSocket) throw new Error("expected targetSocket")
+      targetSocket.destroy()
+      await collector.waitFor((frame) => frame.header.type === "session.close" || frame.header.code === "TARGET_CLOSED")
+      expect(relay.status().targetRetryTimers).toBe(0)
+      expect(targetConnections).toBe(1)
+      await new Promise((resolve) => setTimeout(resolve, 50))
+      expect(targetConnections).toBe(1) // an announced target must never reconnect
+    } finally {
+      tunnel.destroy()
+      await relay.close()
+      await closeServer(targetServer)
+    }
   })
-  await waitUntil(() => relay.status().targetRetryTimers === tunnels.length)
-  await relay.close()
-  assert.equal(relay.status().targetRetryTimers, 0)
-  assert.equal(relay.status().targetConnectionAttempts, 0)
-  assert.equal(relay.status().sessions, 0)
-  for (let index = 0; index < tunnels.length; index += 1) {
-    assert.equal(sessions.get(`relay-close-${index}`), undefined)
-  }
-})
 
-test("target closure after announcement is terminal and never starts target recovery", async () => {
-  let targetConnections = 0
-  /** @type {import('node:net').Socket | undefined} */
-  let targetSocket
-  const targetServer = createServer((socket) => {
-    targetConnections += 1
-    targetSocket = socket
-    socket.on("error", () => {})
-  })
-  const targetPort = await listen(targetServer)
-  const {sessions, token, tokens} = await authenticatedStores()
-  const relay = await startTcpRelay({
-    authorizeTarget: () => true,
-    initialTargetRetryDelayMs: 10,
-    initialTargetRetryMaxDelayMs: 20,
-    sessions,
-    tokens
+  it("repeated pending creates and aborts return to a zero-resource baseline", async () => {
+    const targetPort = await reservePort()
+    const {sessions, token, tokens} = await authenticatedStores()
+    const relay = await startTcpRelay({
+      authorizeTarget: () => true,
+      initialTargetRetryDelayMs: 20,
+      initialTargetRetryMaxDelayMs: 20,
+      sessions,
+      tokens
+    })
+    try {
+      for (let index = 0; index < 5; index += 1) {
+        const identifier = `bounded-pending-${index}`
+        const tunnel = createConnection({host: "127.0.0.1", port: relay.port})
+        tunnel.on("error", () => {})
+        await waitConnect(tunnel)
+        tunnel.write(encodeFrame({
+          type: "session.create", token: token.value, name: identifier, identifier,
+          target: {host: "127.0.0.1", port: targetPort}, framing: [2]
+        }))
+        await waitUntil(() => relay.status().targetRetryTimers === 1)
+        tunnel.destroy()
+        await waitClose(tunnel)
+        await waitUntil(() => relay.status().sessions === 0)
+        expect(sessions.get(identifier)).toBeUndefined()
+        expect(relay.status().targetRetryTimers).toBe(0)
+        expect(relay.status().targetConnectionAttempts).toBe(0)
+      }
+    } finally {
+      await relay.close()
+    }
   })
-  const tunnel = createConnection({host: "127.0.0.1", port: relay.port})
-  const collector = collectFrames(tunnel, new FrameDecoder({compactDirection: "target-to-client"}))
-  try {
-    await waitConnect(tunnel)
-    tunnel.write(encodeFrame({
-      type: "session.create", token: token.value, name: "terminal-target", identifier: "terminal-target",
-      target: {host: "127.0.0.1", port: targetPort}, framing: [2]
-    }))
-    await collector.waitFor((frame) => frame.header.type === "session.created")
-    assert.ok(targetSocket !== undefined)
-    targetSocket.destroy()
-    await collector.waitFor((frame) => frame.header.type === "session.close" || frame.header.code === "TARGET_CLOSED")
-    assert.equal(relay.status().targetRetryTimers, 0)
-    assert.equal(targetConnections, 1)
-    await new Promise((resolve) => setTimeout(resolve, 50))
-    assert.equal(targetConnections, 1, "an announced target must never reconnect")
-  } finally {
-    tunnel.destroy()
-    await relay.close()
-    await closeServer(targetServer)
-  }
-})
 
-test("repeated pending creates and aborts return to a zero-resource baseline", async () => {
-  const targetPort = await reservePort()
-  const {sessions, token, tokens} = await authenticatedStores()
-  const relay = await startTcpRelay({
-    authorizeTarget: () => true,
-    initialTargetRetryDelayMs: 20,
-    initialTargetRetryMaxDelayMs: 20,
-    sessions,
-    tokens
-  })
-  try {
-    for (let index = 0; index < 5; index += 1) {
-      const identifier = `bounded-pending-${index}`
-      const tunnel = createConnection({host: "127.0.0.1", port: relay.port})
-      tunnel.on("error", () => {})
+  it("a hanging initial target attempt times out, is destroyed, and enters normal backoff", async () => {
+    const {sessions, token, tokens} = await authenticatedStores()
+    /** @type {HangingTargetSocket[]} */
+    const attempts = []
+    const relay = await startTcpRelay({
+      authorizeTarget: () => true,
+      createTargetConnection: () => {
+        const attempt = new HangingTargetSocket()
+        attempts.push(attempt)
+        return /** @type {import('node:net').Socket} */ (/** @type {unknown} */ (attempt))
+      },
+      initialTargetConnectTimeoutMs: 10,
+      initialTargetRetryDelayMs: 10,
+      initialTargetRetryMaxDelayMs: 10,
+      sessions,
+      tokens
+    })
+    const tunnel = createConnection({host: "127.0.0.1", port: relay.port})
+    try {
       await waitConnect(tunnel)
       tunnel.write(encodeFrame({
-        type: "session.create", token: token.value, name: identifier, identifier,
-        target: {host: "127.0.0.1", port: targetPort}, framing: [2]
+        type: "session.create", token: token.value, name: "hanging-target", identifier: "hanging-target",
+        target: {host: "fixed-target.invalid", port: 2375}, framing: [2]
       }))
-      await waitUntil(() => relay.status().targetRetryTimers === 1)
+      await waitUntil(() => attempts.length === 2)
+      expect(attempts[0]?.destroyCount).toBe(1)
+      expect(attempts[0]?.listenerCount("connect")).toBe(0)
+      expect(attempts[0]?.listenerCount("error")).toBe(0)
+      expect(attempts[0]?.listenerCount("close")).toBe(0)
+      expect(relay.status().targetConnectionAttempts).toBe(1)
+      expect(sessions.get("hanging-target")?.state).toBe("creating")
+
       tunnel.destroy()
-      await waitClose(tunnel)
+      await relay.closeActiveTunnel()
       await waitUntil(() => relay.status().sessions === 0)
-      assert.equal(sessions.get(identifier), undefined)
-      assert.equal(relay.status().targetRetryTimers, 0)
-      assert.equal(relay.status().targetConnectionAttempts, 0)
+      expect(attempts[1]?.destroyCount).toBe(1)
+      expect(attempts[1]?.listenerCount("connect")).toBe(0)
+      expect(attempts[1]?.listenerCount("error")).toBe(0)
+      expect(attempts[1]?.listenerCount("close")).toBe(0)
+      expect(relay.status()).toEqual({
+        activeTunnels: 0, activeTargets: 0, sessions: 0, attachedSessions: 0,
+        detachedSessions: 0, bufferedTargetBytes: 0, targetConnectionAttempts: 0, targetRetryTimers: 0
+      })
+    } finally {
+      tunnel.destroy()
+      await relay.close()
     }
-  } finally {
-    await relay.close()
-  }
-})
+  })
 
-test("a hanging initial target attempt times out, is destroyed, and enters normal backoff", async () => {
-  const {sessions, token, tokens} = await authenticatedStores()
-  /** @type {HangingTargetSocket[]} */
-  const attempts = []
-  const relay = await startTcpRelay({
-    authorizeTarget: () => true,
-    createTargetConnection: () => {
-      const attempt = new HangingTargetSocket()
-      attempts.push(attempt)
-      return /** @type {import('node:net').Socket} */ (/** @type {unknown} */ (attempt))
-    },
-    initialTargetConnectTimeoutMs: 10,
-    initialTargetRetryDelayMs: 10,
-    initialTargetRetryMaxDelayMs: 10,
-    sessions,
-    tokens
+  it("relay validates the initial target connect timeout before opening resources", async () => {
+    const {sessions, tokens} = await authenticatedStores()
+    await expect(startTcpRelay({
+      authorizeTarget: () => true,
+      initialTargetConnectTimeoutMs: 0,
+      sessions,
+      tokens
+    })).rejects.toThrow(/initialTargetConnectTimeoutMs must be a positive integer/)
   })
-  const tunnel = createConnection({host: "127.0.0.1", port: relay.port})
-  try {
+
+  it("relay close cancels a hanging target attempt and its connect timeout", async () => {
+    const {sessions, token, tokens} = await authenticatedStores()
+    /** @type {HangingTargetSocket[]} */
+    const attempts = []
+    const relay = await startTcpRelay({
+      authorizeTarget: () => true,
+      createTargetConnection: () => {
+        const attempt = new HangingTargetSocket()
+        attempts.push(attempt)
+        return /** @type {import('node:net').Socket} */ (/** @type {unknown} */ (attempt))
+      },
+      initialTargetConnectTimeoutMs: 60_000,
+      sessions,
+      tokens
+    })
+    const tunnel = createConnection({host: "127.0.0.1", port: relay.port})
+    tunnel.on("error", () => {})
     await waitConnect(tunnel)
     tunnel.write(encodeFrame({
-      type: "session.create", token: token.value, name: "hanging-target", identifier: "hanging-target",
+      type: "session.create", token: token.value, name: "relay-close-hanging", identifier: "relay-close-hanging",
       target: {host: "fixed-target.invalid", port: 2375}, framing: [2]
     }))
-    await waitUntil(() => attempts.length === 2)
-    assert.equal(attempts[0]?.destroyCount, 1)
-    assert.equal(attempts[0]?.listenerCount("connect"), 0)
-    assert.equal(attempts[0]?.listenerCount("error"), 0)
-    assert.equal(attempts[0]?.listenerCount("close"), 0)
-    assert.equal(relay.status().targetConnectionAttempts, 1)
-    assert.equal(sessions.get("hanging-target")?.state, "creating")
+    await waitUntil(() => attempts.length === 1)
 
-    tunnel.destroy()
-    await relay.closeActiveTunnel()
-    await waitUntil(() => relay.status().sessions === 0)
-    assert.equal(attempts[1]?.destroyCount, 1)
-    assert.equal(attempts[1]?.listenerCount("connect"), 0)
-    assert.equal(attempts[1]?.listenerCount("error"), 0)
-    assert.equal(attempts[1]?.listenerCount("close"), 0)
-    assert.deepEqual(relay.status(), {
-      activeTunnels: 0, activeTargets: 0, sessions: 0, attachedSessions: 0,
-      detachedSessions: 0, bufferedTargetBytes: 0, targetConnectionAttempts: 0, targetRetryTimers: 0
-    })
-  } finally {
-    tunnel.destroy()
     await relay.close()
-  }
-})
-
-test("relay validates the initial target connect timeout before opening resources", async () => {
-  const {sessions, tokens} = await authenticatedStores()
-  await assert.rejects(
-    () => startTcpRelay({
-      authorizeTarget: () => true,
-      initialTargetConnectTimeoutMs: 0,
-      sessions,
-      tokens
-    }),
-    /initialTargetConnectTimeoutMs must be a positive integer/
-  )
-})
-
-test("relay close cancels a hanging target attempt and its connect timeout", async () => {
-  const {sessions, token, tokens} = await authenticatedStores()
-  /** @type {HangingTargetSocket[]} */
-  const attempts = []
-  const relay = await startTcpRelay({
-    authorizeTarget: () => true,
-    createTargetConnection: () => {
-      const attempt = new HangingTargetSocket()
-      attempts.push(attempt)
-      return /** @type {import('node:net').Socket} */ (/** @type {unknown} */ (attempt))
-    },
-    initialTargetConnectTimeoutMs: 60_000,
-    sessions,
-    tokens
+    expect(attempts[0]?.destroyCount).toBe(1)
+    expect(attempts[0]?.listenerCount("connect")).toBe(0)
+    expect(attempts[0]?.listenerCount("error")).toBe(0)
+    expect(attempts[0]?.listenerCount("close")).toBe(0)
+    expect(relay.status().targetConnectionAttempts).toBe(0)
+    expect(relay.status().targetRetryTimers).toBe(0)
+    expect(relay.status().sessions).toBe(0)
   })
-  const tunnel = createConnection({host: "127.0.0.1", port: relay.port})
-  tunnel.on("error", () => {})
-  await waitConnect(tunnel)
-  tunnel.write(encodeFrame({
-    type: "session.create", token: token.value, name: "relay-close-hanging", identifier: "relay-close-hanging",
-    target: {host: "fixed-target.invalid", port: 2375}, framing: [2]
-  }))
-  await waitUntil(() => attempts.length === 1)
-
-  await relay.close()
-  assert.equal(attempts[0]?.destroyCount, 1)
-  assert.equal(attempts[0]?.listenerCount("connect"), 0)
-  assert.equal(attempts[0]?.listenerCount("error"), 0)
-  assert.equal(attempts[0]?.listenerCount("close"), 0)
-  assert.equal(relay.status().targetConnectionAttempts, 0)
-  assert.equal(relay.status().targetRetryTimers, 0)
-  assert.equal(relay.status().sessions, 0)
 })