one host: the custom domain, not Cloudflare's dev endpoint

pub-*.r2.dev is the development endpoint -- rate-limited, not intended
for production, and switchable off in the bucket settings. The manifest
has named storage.functionstr.com as base_url all along, so the page
loaded from one host and then silently moved to the other the moment the
runtime fetch landed. Now both are the custom domain.

CORS is live for tools.functionstore.xyz, so that fetch is no longer a
no-op: it upgrades the buttons from the latest/ alias to the release the
manifest pins, and keeps /get/'s picker current between deploys. The
comments saying it was blocked are updated -- they describe the old world.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: function-store

.github/workflows/website.yml

@@ -94,7 +94,7 @@ jobs:
         continue-on-error: true
         run: |
           live=$(curl -sf --max-time 15 -A 'fnstools-ci' \
-            https://pub-8001b4bd92174be7a4544571b53f23da.r2.dev/fnstools/manifest.json \
+            https://storage.functionstr.com/fnstools/manifest.json \
             | node -e "let s='';process.stdin.on('data',d=>s+=d).on('end',()=>{try{console.log(JSON.parse(s).release||'')}catch{console.log('')}})")
           site=$(grep -o 'fnstools/v[^/]*/' index.html | head -1 | sed 's|fnstools/||; s|/$||')
           if [ -n "$live" ] && [ -n "$site" ] && [ "$live" != "$site" ]; then

website/README.md

@@ -217,11 +217,16 @@ manifest *at paste time* from inside TouchDesigner via `requests`, and
 resolves every artifact and hash from that. A `/get/` page built months ago
 still installs the current release; only the picker's package list can lag.
 
-The page also tries to refresh hrefs at runtime, but **that fetch is
-blocked**: neither the r2.dev bucket nor `storage.functionstr.com` sends an
-`Access-Control-Allow-Origin` header. Enabling CORS would let the browser
-upgrade hrefs from `latest/` to the pinned release, and would keep the
-picker's list current between deploys.
+The page also refreshes hrefs at runtime, and **that fetch now works**: the
+bucket sends `Access-Control-Allow-Origin` for `tools.functionstore.xyz`.
+The browser upgrades hrefs from `latest/` to the pinned release, so
+visitors get reproducible URLs, and `/get/`'s picker list stays current
+between deploys. If the fetch ever fails the static `latest/` hrefs still
+resolve.
+
+Everything is served from the custom domain `storage.functionstr.com`, not
+the `pub-*.r2.dev` development endpoint — the latter is rate-limited, not
+intended for production, and can be switched off in the bucket settings.
 
 The bootstrap artifact is `FNSTools.tox`, renamed from
 `FunctionStore_tools_2025.tox` in the v3.0.0 redesign. The filename is a

website/index.html

@@ -349,7 +349,7 @@
       <a href="#credits">Credits</a>
       <a href="https://patreon.com/function_store" target="_blank" rel="noopener">Patreon</a>
       <a class="btn btn-secondary" href="https://github.com/function-store/FunctionStore_tools" target="_blank" rel="noopener">GitHub</a>
-      <a class="btn btn-primary js-fns-download" href="https://pub-8001b4bd92174be7a4544571b53f23da.r2.dev/fnstools/latest/FNSTools.tox" download>Get FNSTools →</a>
+      <a class="btn btn-primary js-fns-download" href="https://storage.functionstr.com/fnstools/latest/FNSTools.tox" download>Get FNSTools →</a>
     </nav>
   </div>
 </header>
@@ -364,7 +364,7 @@ <h1 class="hero-title">TouchDesigner,<br />minus the busywork.</h1>
       Take the whole toolkit or pick the three tools you actually want.
     </p>
     <div class="hero-cta">
-      <a class="btn btn-primary btn-lg js-fns-download" href="https://pub-8001b4bd92174be7a4544571b53f23da.r2.dev/fnstools/latest/FNSTools.tox" download>Get FNSTools →</a>
+      <a class="btn btn-primary btn-lg js-fns-download" href="https://storage.functionstr.com/fnstools/latest/FNSTools.tox" download>Get FNSTools →</a>
       <a class="btn btn-secondary btn-lg" href="/docs/">Read the docs</a>
     </div>
     <ul class="hero-meta">
@@ -402,8 +402,8 @@ <h3>Drop one <code>.tox</code></h3>
           arrives empty — it carries the installer, the updater and nothing else yet.
           The container you drop <em>is</em> the install target.
         </p>
-        <a class="btn btn-primary js-fns-download" href="https://pub-8001b4bd92174be7a4544571b53f23da.r2.dev/fnstools/latest/FNSTools.tox" download>Download</a>
-        <p class="path-note">Already have a toolkit container? Grab the <a class="js-fns-installer" href="https://pub-8001b4bd92174be7a4544571b53f23da.r2.dev/fnstools/latest/FNS_Installer.tox" download>bare installer</a> instead (~14 KB).</p>
+        <a class="btn btn-primary js-fns-download" href="https://storage.functionstr.com/fnstools/latest/FNSTools.tox" download>Download</a>
+        <p class="path-note">Already have a toolkit container? Grab the <a class="js-fns-installer" href="https://storage.functionstr.com/fnstools/latest/FNS_Installer.tox" download>bare installer</a> instead (~14 KB).</p>
         <p class="path-note">No download at all: <a href="/get/">pick your tools online</a> and paste one line into the Textport — it fetches and verifies everything itself.</p>
       </div>
       <div class="path">
@@ -861,7 +861,7 @@ <h2 style="font-size: clamp(28px, 3.6vw, 36px); font-weight: 700; letter-spacing
       One <code>.tox</code>, then pick what you need. It is free, and it takes about a minute.
     </p>
     <div class="hero-cta">
-      <a class="btn btn-primary btn-lg js-fns-download" href="https://pub-8001b4bd92174be7a4544571b53f23da.r2.dev/fnstools/latest/FNSTools.tox" download>Get FNSTools →</a>
+      <a class="btn btn-primary btn-lg js-fns-download" href="https://storage.functionstr.com/fnstools/latest/FNSTools.tox" download>Get FNSTools →</a>
       <a class="btn btn-secondary btn-lg" href="/docs/">Read the docs</a>
     </div>
   </div>
@@ -883,14 +883,13 @@ <h2 style="font-size: clamp(28px, 3.6vw, 36px); font-weight: 700; letter-spacing
 </footer>
 
 <script>
-  // Keep the download buttons pointed at the newest published release.
+  // Upgrade the download buttons from latest/ to the pinned release.
   //
-  // This is a bonus pass, not the mechanism: the build already stamped the
-  // release into these hrefs. The r2.dev bucket currently serves no
-  // Access-Control-Allow-Origin header, so this fetch is blocked by the
-  // browser and quietly does nothing — enabling CORS on the bucket would
-  // make the page self-refresh between deploys. Either way the static hrefs
-  // point at a release that exists.
+  // The bucket sends Access-Control-Allow-Origin for this site, so this
+  // fetch succeeds and visitors get reproducible URLs -- the exact bytes
+  // the manifest names, rather than an alias that moves under them. It is
+  // an upgrade, not the mechanism: if it ever fails the static hrefs below
+  // still resolve, because latest/ is always a release that exists.
   //
   // The static hrefs point at latest/, the mutable human aliases upload.py
   // publishes beside each release -- so a release never leaves the download
@@ -899,7 +898,7 @@ <h2 style="font-size: clamp(28px, 3.6vw, 36px); font-weight: 700; letter-spacing
   // every href to the release the manifest names, which is the reproducible
   // URL. Until the bucket sends CORS the static latest/ href is what serves.
   (function () {
-    var BASE = 'https://pub-8001b4bd92174be7a4544571b53f23da.r2.dev/fnstools';
+    var BASE = 'https://storage.functionstr.com/fnstools';
     var BOOTSTRAP = 'FNSTools.tox';
     var INSTALLER = 'FNS_Installer.tox';
 

website/tools/build-site.mjs

@@ -30,7 +30,7 @@ const OUT = path.join(WEB, 'docs');
 const SITE = 'https://tools.functionstore.xyz';
 const GH = 'https://github.com/function-store/FunctionStore_tools';
 // Rolling pointer published by packaging/publish.py; base_url in manifest.json.
-const BUCKET = 'https://pub-8001b4bd92174be7a4544571b53f23da.r2.dev/fnstools';
+const BUCKET = 'https://storage.functionstr.com/fnstools';
 const EDIT_BASE = `${GH}/blob/main/packaging/docs`;
 
 const problems = [];