Skip the boring parts. Build your Cloudflare Workers app.
CFast is a collection of composable TypeScript libraries that make building production-ready web applications on Cloudflare Workers with React Router fast, secure, and enjoyable. It is opinionated where it matters and invisible where it doesn't.
CFast is built around a specific, proven stack:
- Runtime: Cloudflare Workers
- Framework: React Router v7+ (file-based routing)
- Database: Cloudflare D1 via Drizzle ORM
- Auth: Better Auth (magic email + passkeys)
- Email: Mailgun via react-email
- Storage: Cloudflare R2
- UI: Plugin-based (ships with MUI Joy UI)
| Package | Description |
|---|---|
@cfast/env |
Type-safe Cloudflare bindings with runtime validation |
@cfast/permissions |
Isomorphic permission system with Drizzle-native row-level access control |
@cfast/auth |
Authentication: magic email, passkeys, role management, impersonation |
@cfast/db |
Permission-aware Drizzle queries for D1 |
@cfast/storage |
Schema-driven file uploads to R2 with multipart support |
| Package | Description |
|---|---|
@cfast/actions |
Multi-action routes and permission-aware action definitions |
@cfast/ui |
Permission-aware component wrappers (ActionButton, PermissionGate) |
@cfast/forms |
Auto-generated forms from Drizzle schema |
@cfast/pagination |
Cursor-based, offset-based pagination and infinite scroll |
@cfast/admin |
Auto-generated admin UI from your Drizzle schema |
@cfast/email |
Plugin-based email with react-email rendering |
| Package | Description |
|---|---|
create-cfast |
Scaffold a fully wired project in seconds |
-
Permissions are first-class. Define them once. Enforce on the server. Reflect in the UI. Compose across actions. The developer writes the permission rules and the business logic, and never touches permission plumbing again.
-
The database drives the UI. Your Drizzle schema is the source of truth. Forms, admin panels, and CRUD interfaces are derived from it, customizable but never written from scratch.
-
Common patterns, not configuration. Multi-action routes, infinite scroll, pagination, magic-link auth, role management. These aren't novel problems. They're solved once, correctly, and you import them.
-
Isomorphic by design. Permission checks, validation, and data types work identically on client and server. The button knows it should be disabled before the request is ever made.
npm create cfast@latest my-appMIT
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?v=4){kind=small}