Add extensions API v2 with submissions and auth

AGENTS.md

@@ -43,6 +43,12 @@
 - Local secrets go in `.dev.vars` (for example `GITHUB_TOKEN="..."`).
 - Bindings for D1/KV are defined in `wrangler.jsonc`; keep names aligned with `CloudflareBindings`.
 - Use Wrangler secrets for production tokens instead of committing them.
+- `ASSERTION_SIGNING_SECRET`: HMAC key the extensions v2 API uses to verify short-lived
+  bearer assertions minted by the extensions site (`src/lib/auth/bearer-assertion.ts`).
+  Not sent over the wire — only signs/verifies server-side in each Worker. Add
+  `ASSERTION_SIGNING_SECRET="..."` to `.dev.vars` for local dev; set via
+  `wrangler secret put ASSERTION_SIGNING_SECRET` in production, matching the value
+  configured in the extensions site's Worker.
 
 ## Stats API v1
 

package.json

@@ -9,6 +9,10 @@
     "format": "prettier --write .",
     "format:check": "prettier --check .",
     "init:db": "npx tsx src/services/central-alerts/v1/scripts/init-db.ts",
+    "migrate:extensions-v2:local": "wrangler d1 migrations apply DB_EXTENSIONS --local",
+    "migrate:extensions-v2:remote": "wrangler d1 migrations apply DB_EXTENSIONS --remote",
+    "migrate:extensions-v2:list:local": "wrangler d1 migrations list DB_EXTENSIONS --local",
+    "migrate:extensions-v2:list:remote": "wrangler d1 migrations list DB_EXTENSIONS --remote",
     "lint": "eslint",
     "lint:fix": "eslint --fix",
     "test": "vitest run",
@@ -18,11 +22,14 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
+    "@hono/zod-openapi": "^1.5.1",
     "@octokit/graphql": "^9.0.3",
     "@octokit/request": "^10.0.2",
+    "@scalar/hono-api-reference": "^0.11.11",
     "badge-maker": "^6.0.0",
     "hono": "^4.11.4",
-    "semver": "^7.7.2"
+    "semver": "^7.7.2",
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@cloudflare/vitest-pool-workers": "0.18.6",

src/app/index.ts

@@ -3,6 +3,7 @@ import { contextStorage } from "hono/context-storage";
 import { HTTPException } from "hono/http-exception";
 import centralAlertsV1 from "../services/central-alerts/v1";
 import extensionsV1 from "../services/extensions/v1";
+import extensionsV2 from "../services/extensions/v2";
 import versionsV1 from "../services/versions/v1";
 import statsV1 from "../services/stats/v1";
 import { platformMiddleware } from "../lib/middleware";
@@ -21,6 +22,7 @@ app.use("*", async (c, next) => {
 
 app.route("/central-alerts/v1", centralAlertsV1);
 app.route("/extensions/v1", extensionsV1);
+app.route("/extensions/v2", extensionsV2);
 app.route("/versions/v1", versionsV1);
 app.route("/stats/v1", statsV1);