feat: ts/packages/cloudflare-hub, a Worker deployment of a hub node - #14

turbo runs workspace-wide, so the renamed ts-verify job already linted/typechecked/tested the hub; adding the _build step also exercises its wrangler deploy --dry-run bundle validation. README's Implementations section records the hub alongside core.

… relayed a frame

The pull-based for-await over receive() parks on a pure-JS waiter, and workerd's hang detection cancels any plain-Worker request whose promise chain does that -- so the old entry logged "the Workers runtime canceled this request because it detected that your Worker's code had hung" once per connection and relayed zero frames, while looking alive (the socket-level listeners still fired, and wrangler deploy --dry-run passed because bundling executes nothing). A Durable Object is the documented home for exactly this lifetime shape: the DO class is defined in the entrypoint (wrangler resolves the binding against the entrypoint's own exports) and owns the hub state, accepting each upgrade's server socket and driving the hub per connection; the default export becomes a thin router forwarding upgrades to the single named instance. The SQLite-backed class per current wrangler guidance makes hibernation available as a follow-up without a migration later.

The transport adapter loses its now-dead listen/acceptPair factory (the DO drives wrapWebSocket directly) and keeps the Connection contract as its whole surface. scripts/live-check.mjs drives two genuine WebSocket clients through gossip -> relay-connect -> relay-inbound -> bidirectional relay-data against wrangler dev -- the check dry-run bundling cannot make -- verified passing three consecutive runs with zero hang-cancellation errors in the dev log. Plain-JS scripts join the eslint ignores (no TS project to type them against); .wrangler/ joins .gitignore.

…rings both ways

A rejecting receive iteration (undecodable bytes or a non-binary message -- the adapter's own hostile-input behaviour) used to reject handleConnection, which the entry voids: an unhandled rejection on every hostile client. The rejection is the disconnect signal and the adapter already closed the socket, so handleConnection now treats it exactly like a clean end: registry and pairing cleanup run identically.

A second relay-connect from the same initiator used to overwrite only the initiator-side pairing entry, leaving the old target's side live: the old target's relay-data kept flowing to the initiator on a pipe the initiator believed was its new pairing -- mis-attributed traffic in the exact role the package exists to serve. A new relay-connect now tears any pairing either side already belongs to down in both directions before installing the new one.

Tests grow accordingly, with FakeWebSocket extracted to a shared helper: the rejection-cleanup path, the stale-pairing case (B's data must not reach A after A re-pairs to C), text-message and send-after-close handling on the adapter, a byte-identical re-encode assertion, and -- the seam where the entry bug hid -- hub tests driving the real wrapWebSocket adapter rather than fakes alone, including hostile bytes closing only the offending connection.

The teardown only covered the same-role entries: a connection already the TARGET of one pairing (X->A) that then initiated its own (A->B) kept X's pipe half-alive -- X's relay-data kept flowing to A on what A believed was its pipe with B -- and symmetrically for a target holding its own outbound pipe. The teardown is now a single forgetPairingsOf helper removing every pairing a connection belongs to in either role, both directions of each, applied to both the initiator and the target before installing a new pairing; forgetConnection reuses the same helper. Cross-role tests pin both directions: an old opposite-end's data arrives nowhere after either re-pair shape.

…check claim

The adapter and wrangler.toml headers still referenced src/durable-hub.ts, folded into src/worker.ts when the Durable Object class moved into the entrypoint. The README's verification prose now states what the live check proves structurally (exits non-zero naming the failing step on regression) rather than a point-in-time run count. Also pins the identity adapter's unsupported-alg behaviour with a test: an unimplemented COSE algorithm throws loudly rather than mis-verifying.