One URL
Publish returns url. It opens without login, and its hostname is the 23-character artifact ID under agent-paste.link. Send it to the recipient as is.
https://01234-56789-abcde-fghjd.agent-paste.link/Revisions
Pass the artifact ID or full URL to --artifact-id to update the same website. Updates require Workspace access; the URL alone grants read only.
Security boundary
The hostname carries at least 95 bits of random entropy and is the only credential a reader needs. The content Worker checks the manifest, signed authorization, expiry, denylist, and requested path before serving encrypted R2 bytes.