Use Hono JWT verification for Extensions assertions

[admdly]

Summary

• Replace the custom JWT parsing and Web Crypto verification with Hono's pinned HS256 JWT verifier.
• Keep a small assertion-profile validator for the Extensions issuer, audience, purpose, version, subject, lifetime, and clock-skew rules.
• Require integer NumericDate claims in the assertion profile.
• Accept the current and previous signing secrets during rotation.
• Document the rotation procedure and local previous-secret configuration.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	api	781d22c	Commit Preview URL Branch Preview URL	Aug 05 2026, 06:13 PM

[cubic-dev-ai]

No issues found across 4 files

<sub>Requires human review: Introduces acceptance of a previous signing secret for key rotation, altering authentication policy and requiring human review to verify the rotation scheme and security implications.

Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 2 files (changes from recent commits).

<sub>Requires human review: Replaces core authentication logic, adds a previous-secret rotation mechanism (ASSERTION_SIGNING_SECRET_PREVIOUS), and enforces stricter claim validation. These security and operational changes require human review to confirm correctness and assess risk.

Re-trigger cubic</sub>