# Publish generated work with Artifactory Make a generated file or static HTML entrypoint with supporting files live. No MCP installation or signup is required. Anonymous artifacts expire 24 hours after reservation. A creator can use the private management link to set a viewing password, replace files, delete the artifact or sign in with an email code and claim it. Claiming preserves the viewer URL and removes anonymous expiry, subject to account limits. ## Runtime and network The agent must be able to export/read the actual generated file bytes and send outbound HTTP requests. A skill does not grant those permissions. A chat-only or restricted browsing environment may require exporting the file to an environment with these capabilities. Do not claim every ChatGPT, Claude or Codex mode is supported just because HTTP is available. The optional helper needs Node.js 22 or newer, file read/write access and outbound access to https://app.sharework.app. All upload destinations are on that app origin. Downloads and verification use https://sharework.app; browser viewers redirect to an artifact-specific subdomain under that content hostname. Allow those destinations in the actual agent environment. Local loopback URLs only work from an environment that can reach the local Workers servers. ## Optional portable helper Download https://app.sharework.app/publish.mjs and inspect it before running. It has no package dependencies. From the directory containing the generated files: node /path/to/publish.mjs --origin https://app.sharework.app --state /private/path/publication.json report.html assets/style.css List explicit files only, with the viewable entrypoint first. Keep the private state outside the artifact. Use relative paths with letters, numbers, dots, underscores and hyphens. No directory recursion or folder UI is needed. For a single document, provide just that file. The helper prints JSON with status, viewerUrl, expiresAt and managementUrl. Its output and state contain a secret management link: keep them in the creator's private conversation and never embed them in the artifact, public logs or shared screenshots. Protect local state with OS file permissions, especially on Windows where POSIX modes are not a complete access policy. Rerun the same command with unchanged bytes and the same state file to resume. Uploads and finalization retry transient failures at most three times. Reservation is never automatically retried. If its response is lost, state records an unknown outcome and stops; preserve that state and explain that limitation to the creator before starting a new publication. An interrupted process may leave a .lock or .tmp sibling: check that no publisher is running before removing either. A completed state reports the recorded publication, not a new live-access check. Retrieve the viewer independently before claiming it is currently accessible. ## Direct HTTP protocol Base: https://app.sharework.app 1. POST /api/artifacts with JSON {"entrypoint":"report.html","files":[{"path":"report.html","contentType":"text/html","size":32,"sha256":"LOWERCASE_SHA256_OF_EXACT_BYTES"}]}. Compute the actual size and digest; the example values are placeholders. An optional password field sets initial viewing protection, 8 to 128 characters. 2. Save the 201 response privately before uploading. It includes id, viewerUrl, expiresAt, managementUrl and uploads as {path,url} pairs. The management URL fragment is the bearer token. The viewer is unavailable until finalization. 3. PUT exact bytes to each returned URL with Authorization: Bearer . Successful uploads return 204. Do not send authority to a different origin or follow redirects with it. 4. POST /api/artifacts/{id}/finalize with the same bearer. A 200 response confirms publication. Repeating this finalization is safe; repeating reservation creates another artifact. 5. Independently retrieve viewerUrl. For a non-HTML entrypoint, append ?raw=1 to compare the original bytes. Do not infer success solely from an agent message. Current configured caps: 16 files, 1048576 bytes per file, 4194304 bytes per artifact. Supported entrypoints: HTML, Markdown, text, PDF, PNG/JPEG/SVG/GIF/WebP/ICO images and MP4/WebM/Ogg video. CSS, JavaScript and WOFF/WOFF2 are supporting files. Native video codec support depends on the browser; there is no transcoding or server-side execution. Errors include 400 invalid input, 403 wrong authority, 409 missing uploads/conflicting update/account limit, 410 expiry, 413 upload cap, 422 byte/digest mismatch, 429 rate limit and 503 unavailable or publishing disabled. Preserve the reservation on failures. Never print success for a rejected request. ## Creator response Return the shareable viewer URL, the exact expiry from expiresAt, and the separate private management/claim link. Explain: "Share only the viewer URL. Use your management link to set a viewing password or sign in and keep this artifact." Neither action is required to publish. An expiresAt value of null means the artifact is kept in an account. ## Management and accounts GET /api/artifacts/{id} with management bearer returns metadata. POST /api/artifacts/{id}/updates with a complete replacement manifest returns upload destinations and finalizeUrl. Upload all replacement bytes and finalize; the old version stays live until success. Preserve the original viewer URL and expiry. Retry the same finalization after a lost response. PUT /api/artifacts/{id}/password with {"password":"new password"} sets/replaces viewing protection; null removes it. DELETE /api/artifacts/{id} stops serving it. Viewer passwords never grant editing rights. Open managementUrl for browser controls. Account sign-in uses Content-Type: application/json. POST /api/auth/email-otp/send-verification-otp with {"email":"you@example.com","type":"sign-in"}, then POST /api/auth/sign-in/email-otp with {"email":"you@example.com","otp":"123456"}, replacing 123456 with the code supplied by its recipient. The field is named otp, not code. Keep the returned account session token private. POST /api/artifacts/{id}/claim with account bearer and X-Management-Token: claims the artifact. GET /api/account/artifacts lists owned artifacts and caps. Owners can POST /api/artifacts/{id}/management-link to replace retained management authority. Sign-out revokes the current account session. Hosted publishing is enabled in this environment. Hosted email delivery still requires release configuration; local development has a loopback-only test inbox for automated tests.