refactor: move the api to its own subdomain

The Worker answered under the site's path, which meant the API depended on
a zone route and shared a hostname with the static site. It now serves
/v1/* on api.sudonotes.com — a Workers custom domain, so the hostname
brings its own DNS instead of needing a route added beside it.

Nothing is released yet, so the old /api/v1/* paths are dropped outright
rather than kept alongside.

Author: dariomory

README.md

@@ -121,7 +121,7 @@ in the archive is needed.
 | --- | --- |
 | `core/` | `sudonotes-core` — the note format: frontmatter, filenames, links, paste splitting. Pure Rust, no filesystem, and it compiles to WebAssembly so a browser build can share it. |
 | `app/` | The desktop app. React front end in `src/`, Tauri and the filesystem in `src-tauri/`. |
-| `worker/` | The Cloudflare Worker behind `sudonotes.com/api/*`, which holds the AI provider key. |
+| `worker/` | The Cloudflare Worker behind `api.sudonotes.com`, which holds the AI provider key. |
 | `site/` | sudonotes.com — Astro, static. |
 
 The split between `core/` and `app/src-tauri/` is deliberate and worth

app/src-tauri/src/ai.rs

@@ -18,7 +18,7 @@ const SETTINGS_FILE: &str = "settings.json";
 /// The device id, which is not a secret and is not vault-specific.
 const DEVICE_FILE: &str = "device.txt";
 const DEFAULT_ANALYZER_MODEL: &str = "deepseek-chat";
-const API_BASE: &str = "https://sudonotes.com/api/v1";
+const API_BASE: &str = "https://api.sudonotes.com/v1";
 
 const TAG_VOCABULARY: &[&str] = &[
     "feedback",

site/README.md

@@ -55,7 +55,7 @@ Static output, so anything that serves files works. On Cloudflare the site and
 the API share the `sudonotes.com` origin:
 
 - the site is served from `dist/` (Workers Static Assets or Pages),
-- `sudonotes.com/api/*` routes to the Worker in `../worker`.
+- The API is a separate Worker on `api.sudonotes.com`; this build does not route it.
 
 The two deploy independently. Nothing on this site calls the API — it is all
 static — so the order does not matter.

worker/README.md

@@ -1,6 +1,6 @@
 # sudonotes API
 
-The Cloudflare Worker behind `https://sudonotes.com/api/v1/*`. It holds the
+The Cloudflare Worker behind `https://api.sudonotes.com/v1/*`. It holds the
 provider key so the apps never do, and it is the only thing standing between a
 free feature and an unbounded bill.
 
@@ -71,9 +71,8 @@ rotating it invalidates every issued device id. Then:
 npx wrangler deploy
 ```
 
-Add the route `sudonotes.com/api/*` to the Worker in the Cloudflare dashboard,
-and create a Turnstile widget for `app.sudonotes.com` whose secret is the one
-above.
+Point `api.sudonotes.com` at the Worker as a custom domain, and create a
+Turnstile widget for `app.sudonotes.com` whose secret is the one above.
 
 ## Locally
 

worker/src/index.ts

@@ -274,13 +274,13 @@ export default {
     }
 
     try {
-      if (url.pathname === "/api/v1/chat/completions" && request.method === "POST") {
+      if (url.pathname === "/v1/chat/completions" && request.method === "POST") {
         return await handleChat(request, env, ctx);
       }
-      if (url.pathname === "/api/v1/models" && request.method === "GET") {
+      if (url.pathname === "/v1/models" && request.method === "GET") {
         return await handleModels(request, env);
       }
-      if (url.pathname === "/api/v1/device" && request.method === "POST") {
+      if (url.pathname === "/v1/device" && request.method === "POST") {
         const headers = corsHeaders(origin, env);
         const ip = request.headers.get("CF-Connecting-IP");
         if (ip) {

worker/test/api.spec.ts

@@ -5,7 +5,7 @@ import { mintDevice, readDevice } from "../src/auth";
 import worker from "../src/index";
 
 const APP = "https://app.sudonotes.com";
-const API = "https://sudonotes.com/api/v1/chat/completions";
+const API = "https://api.sudonotes.com/v1/chat/completions";
 
 /** What the stubbed network should do for this test. */
 let upstream: () => Response;
@@ -108,12 +108,12 @@ describe("routing and CORS", () => {
   });
 
   it("404s an unknown path", async () => {
-    const response = await call({ method: "GET", body: undefined }, "https://sudonotes.com/api/v1/nope");
+    const response = await call({ method: "GET", body: undefined }, "https://api.sudonotes.com/v1/nope");
     expect(response.status).toBe(404);
   });
 
   it("serves the model catalog verbatim for the browser", async () => {
-    const response = await call({ method: "GET", body: undefined, headers: { Origin: APP } }, "https://sudonotes.com/api/v1/models");
+    const response = await call({ method: "GET", body: undefined, headers: { Origin: APP } }, "https://api.sudonotes.com/v1/models");
     expect(response.status).toBe(200);
     expect(response.headers.get("Access-Control-Allow-Origin")).toBe(APP);
     // The desktop client parses models.dev's own shape, so it must survive intact.

worker/wrangler.jsonc

@@ -4,11 +4,11 @@
   "main": "src/index.ts",
   "compatibility_date": "2026-08-01",
   "compatibility_flags": ["nodejs_compat"],
-  // The desktop app calls https://sudonotes.com/api/v1 (ai.rs API_BASE), so the
-  // zone must route /api/* here rather than to the static site Worker. That
-  // route is added out of band: the deploy token has no Workers Routes
-  // permission on the zone, and declaring it here disables workers.dev as a
-  // side effect, which would take the API down when the route then fails.
+  // The app calls https://api.sudonotes.com/v1 (ai.rs API_BASE). That hostname
+  // is attached to this Worker as a custom domain, which is configured out of
+  // band rather than here: declaring routes in this file turns workers.dev off
+  // as a side effect, and losing that fallback while a route is misconfigured
+  // leaves the API with no reachable hostname at all.
   "workers_dev": true,
   "observability": {
     "enabled": true,