feat(website): serve the site at nostream.dev and redirect every other host to it

[chappie-daemon]

The site's canonical origin moves to https://nostream.dev. Previews stay on ema.tnsor.network — a broken PR build must never sit on the domain that is the project's public face.

What changes

file	change
wrangler.jsonc	custom domain → nostream.dev
wrangler.router.jsonc	binds nostream.dev, www.nostream.dev, keeps ema.tnsor.network; adds vars.CANONICAL_HOST
worker/router.ts	http → 301 https; non-canonical host → 301 canonical
astro.config.mjs, README.md, package.json	domain updated
build-social-card.mjs + both PNGs	card regenerated with nostream.dev
deploy-website.yml	SITE_URL + CANONICAL_HOST, the worker gets --var
deploy-website-preview.yml	previews keep the preview origin, with the reason written down

Redirect policy

• http:// anything → 301 to the same URL over https, previews included
• a non-canonical host → 301 to nostream.dev, keeping path and query
• preview paths are exempt from the host redirect — they are served from their own domain

Three defects found by exercising the worker, fixed here

1. Response.redirect re-encodes an encoded path: /docs/a%20b → /docs/a%2520b, a path that does not exist. The redirect writes its own Location.
2. The first draft 301'd ema.tnsor.network/preview/888/ to nostream.dev/preview/888/.
3. The same draft treated a port-carrying host as canonical and issued no redirect.

Measured after the fixes:

https upgrade                301 https://nostream.dev/docs/x
http on www                  301 https://www.nostream.dev/
www→apex keeps encoded path  301 https://nostream.dev/docs/a%20b?y=1
stale domain to canonical    301 https://nostream.dev/about
preview untouched            200 -
canonical served             200 -

Verification

• pnpm run build → 14 pages, canonical/og:url/og:image all https://nostream.dev, no ema.tnsor.network left in dist/
• wrangler deploy --dry-run bundles with env.CANONICAL_HOST ("nostream.dev") bound
• card headers still 1200×630 and 1280×640

Needs Cloudflare-side setup, not code

1. the nostream.dev zone must exist before the deploy binds it
2. Always Use HTTPS on the zone is the edge-level version of the same redirect; the worker's own 301 covers the case where it is off
3. the repo's Homepage field is still http://ema.tnsor.network — a settings change, not a file

[changeset-bot]

🦋 Changeset detected

Latest commit: 3860762

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
nostream-website	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

🧹 Site preview for this PR was deleted (PR closed).

[greptile-apps]

Confidence Score: 4/5

[High impact] Changes website domain and adds host-based routing logic.

Do not merge until preview requests stop looping between the preview and production domains.

Findings

1.  Previews redirect forever ▶

Summary

Moves the public website to https://nostream.dev and adds redirects from other hosts.

• The website redirects other hosts to nostream.dev and keeps previews on their own domain.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A["ema.tnsor.network/preview/888/"] -->|"301: non-canonical host"| B["nostream.dev/preview/888/"]
  B -->|"301: preview on production"| A

Loading

_{Reviews (3) · Last reviewed commit: "fix(website): no redirect loop with no c..." · Reviewed by Greptile}