Marketplace: public read API for the product site #922

Parent

#913 · #18

What to build

The product site (deepseekbot.botharness.ai) can depend on a stable, versioned, unauthenticated JSON API (for example under /v1/) for list, search and detail — the same contract the harness uses. Responses carry CORS headers allowing https://deepseekbot.botharness.ai and its local dev origin (other origins get no CORS grant) and short public cache headers. Paste, report and admin endpoints are not part of this public contract. The site's /market and /en/market pages are built separately in BotHarness/deepseekbot-site against this API.

Acceptance criteria

• List, search and detail are served under a versioned path with documented response shapes.
• Allowed origins receive CORS headers (including preflight); disallowed origins do not.
• Public cache headers are set on read responses; hidden entries are never served.
• Contract tests at the Worker boundary assert shapes, CORS and cache headers.
• The API contract is documented where the site thread can reference it.

Blocked by

• Marketplace: browse sorting, cursor paging, FTS5 search and topic filter #918
• Marketplace: Bot detail view with rendered README #919