rtfx.pro

artifacts-server

Private, access-gated hosting for landing pages and HTML/Claude artifacts, running entirely on Cloudflare Workers. A public product site at / (plus /docs, /signup and /login) explains the product and lets people start on the Free plan. Sign-in is app-owned and passwordless: rtfx.pro emails a one-time code or magic link, then a host-only rtfx_session keeps the browser signed in. One dashboard at /admin handles publishing, sharing and the gallery of everything shared with you. Artifacts — single HTML files or multi-file static bundles — are published from a web dashboard, a CLI, or an agent session (Claude Code, Hermes). With per-artifact permissions and versioning.

• 🤖 Agent-native publishing — Claude Code, a native MCP server, Hermes, the CLI and the HTTP API all take the same path a human takes; no separate, weaker agent route. See plugins/rtfx and docs/MCP.md.
• 👥 Access by identity first — each artifact is private, shared with named people, or open to all signed-in users. Unauthorized and non-existent both return 404.
• 🔗 Revocable share links — for someone who will not have an account, create a capability URL for exactly one artifact, optionally expiring in 1–365 days. Only a hash is stored.
• 🕓 Versioning — every re-publish is a new immutable version; roll back within your plan's retention window (free keeps the last 5; paid plans keep everything).
• 📈 Views log + read receipts — see who viewed each artifact, when, which version, and from where, with an email the first time each named recipient opens it.
• 🏢 Workspaces & roles — artifacts belong to an account with owner/admin/member/viewer roles; instance privilege is re-derived from config, never read from a table.
• 🔗 Canonical workspace addresses — every workspace has an address (generated as w-xxxxxxxx; a paid workspace can claim a custom one) and every artifact link is rtfx.pro/ / — e.g. rtfx.pro/yogev/q3-board-report. It is the only URL the product shows or returns: the viewer renders on the app host and frames the sandboxed content origin, which is never an address. Old a.rtfx.pro/ / links redirect browsers to it. A path on the app host, not a custom domain.
• 🌐 Public product site — /, /docs, /signup, /login, /privacy and /terms are reachable by anyone, with SEO metadata, sitemap.xml, robots.txt and llms.txt; everything else needs an identity.
• 🔒 Access-gated dashboard — app-owned email OTP/magic-link sign-in for /admin and the API; the app stores no passwords.
• 🖼️ One dashboard — publish and manage under Artifacts; everything shared with you under Gallery. Same shell, same nav, same brand.
• 🔑 API tokens — hashed bearer tokens for server-to-server publishing (Hermes Cloud, CI), scoped, owner-bound and revocable.
• ☁️ All Cloudflare — Worker + R2 (files) + D1 (metadata). No servers, no database to run.

Stack: TypeScript · Hono · Cloudflare Workers / R2 / D1 / Email Sending · Lemon Squeezy

Not built yet, and deliberately not implied anywhere in the copy: per-link passwords, custom domains for artifacts (branded workspace addresses are a path on the app host, not your own hostname), comments/approvals, a public gallery of artifacts, usage-based billing, and per-seat billing beyond the fixed seats included in each plan. Access is by identity first; share links are separate capability URLs with optional expiry and immediate revocation. The competitive reasoning, and the full table-stakes-vs-differentiators split, is in docs/POSITIONING.md. The public site is one page: rtfx.pro — connect the MCP server, then publish, share, delete.

---

How it works

                    /, /docs, /signup, /login and legal pages (public)

│ Browser / CLI ─────────────────────────┼──────────────────────────▶ Worker (Hono) ┌──────── app-owned email OTP / magic link ───────┐ │ │ rtfx_session cookie + users/accounts tables │────┘ └─────────────────────────────────────────────────┘ files · /admin · /api │ ┌───────────────────────┬────────────────────┐ │ ▼ ▼ ▼ │ R2 (files at D1 (metadata: Email + │ /v /…) artifacts, grants, billing │ versions, sessions) webhooks │

• `/`, `/signup`, `/login`, `/docs`, `/privacy`, `/terms`, `robots.txt`, `sitemap.xml` and `llms.txt` are public product/crawler pages.
• rtfx.pro sessions authenticate dashboard/API/artifact requests with a signed rtfx_session cookie created after email-code or magic-link verification.
• The Worker authorizes per-artifact (who sees what), serves the current version of each artifact, renders the public site and the dashboard, and exposes a JSON API.
• R2 stores files under /v /…; D1 stores metadata.

See docs/ARCHITECTURE.md for details.

Prerequisites

• Node.js 18+
• A Cloudflare account with a domain (zone) on the account (you'll serve from a hostname you control, plus a separate content hostname if you want the same isolation as rtfx.pro).
• Cloudflare Workers, R2, D1 and Email Sending enabled.
• npx wrangler login (authorizes Workers/R2/D1/deploy)

Quick deploy

git clone https://github.com/yogevgab/artifacts-server.git

cd artifacts-server npm install npx wrangler login

npm run setup

npm run setup is the simple, single-hostname path: it creates the R2 bucket + D1 database, applies the schema, fills the basic Worker config, deploys, and leaves you to add production-only choices such as a separate content hostname, Email Sending, billing secrets and legal values. For a multi-hostname deployment like rtfx.pro, use docs/SELF_HOSTING.md plus the manual steps below instead of relying on the setup script.

When it finishes, configure Email Sending and SESSION_SECRET, then open https:// /signup or /login to create the first account. ADMIN_EMAILS in wrangler.jsonc decides who gets platform-admin rights.

Manual deployment

Step-by-step without the setup script

Deploying with a separate content-only hostname (multiple routes entries, e.g.

app + content-host isolation)? npm run setup only supports a single hostname —

see docs/DEPLOY_RTFX.md for a worked example runbook.

npm install

npx wrangler login

1. Storage

npx wrangler r2 bucket create artifacts-files npx wrangler d1 create artifacts-meta # copy the database_id into wrangler.jsonc npx wrangler d1 execute artifacts-meta --remote --file schema.sql

2. Edit wrangler.jsonc: set route patterns to your app/content hostnames,

ADMIN_EMAILS, PUBLIC_BASE_URL, CONTENT_HOSTNAMES and the database_id.

3. Required secrets / mail

npx wrangler secret put SESSION_SECRET

Optional, only if selling paid plans:

npx wrangler secret put LEMONSQUEEZY_WEBHOOK_SECRET

4. Deploy (creates the custom domains)

npx wrangler deploy

Email Sending is required for sign-in. Enable it for the domain, verify SPF/DKIM/DMARC, and keep MAIL_FROM inside the Worker send_email.allowed_sender_addresses. The app sends a one-time code or magic link, then issues its own host-only rtfx_session cookie. Fresh deployments do not need Cloudflare Access.

Configuration

All config lives in wrangler.jsonc (vars) plus one secret. See the comments there.

Usage

Public product site

https:// / — public, no login required. Positions the product, covers use cases and differentiators, and collects /waitlist access requests. Its two CTAs are deliberately distinct: Request access (for people without an account) and Sign in (/login, for people with one). /docs is the public documentation page (publishing, Claude Code/Hermes, the access model, #why-rtfx, FAQ). See docs/PUBLIC_SITE.md for the SEO/crawler surface and the copy rules, and docs/POSITIONING.md for what the copy may claim.

Sign-in

https:// /login — public, app-owned sign-in. It emails a one-time code or magic link, verifies it, then sets a host-only rtfx_session cookie. It renders signed-out, already signed-in and paused-account states. There is no password auth and no Cloudflare Access dependency in a fresh deployment.

Dashboard

https:// /admin — publish artifacts, manage per-artifact access, upload new versions / roll back, and (admins only) manage people. Every user, admins included, sees only the artifacts they own or belong to; platform admins get no access to other people's artifact content, versions, view log, access list or share links. The Platform section (super admin) lists every artifact as metadata only (owner, size, counts, dates) and offers an audited abuse-delete. The Gallery section at /admin/gallery is filtered to what each viewer may *open* — what they own plus what has been shared with them. /gallery is kept as a redirect into it; visiting it signed out goes to /login.

People (user management)

Admin-only, in the dashboard and at /api/users. The app owns identity with signed sessions and stores account/user state in D1:

The Worker re-derives platform privilege from config, never from a user-writable table. Lifecycle actions can pause/re-enable/remove accounts and revoke API tokens, but API tokens are refused from user-management routes entirely.

CLI

export ARTIFACTS_URL=https://<your-domain>

One credential: the artifact commands go to /api/machine/…, which authenticates

this bearer token and nothing else.

export RTFX_API_TOKEN=

node cli/artifacts.mjs publish ./page.html --slug my-page --title "My Page" node cli/artifacts.mjs publish ./site/ --slug demo --title "Demo" # a folder is zipped n