One URL
Publish returns url, the complete unguessable capability URL that opens without login. Its hostname is the 32-character capability ID under agent-paste.sh. It is the Artifact itself, not an app viewer or redirect.
https://0123456789abcdef0123456789abcdef.agent-paste.sh/There is no iframe, sandbox, Access Link wrapper, private viewer URL, or separate visibility command. Send url to the recipient.
Revisions
Publishing with the existing artifact_id creates a new Revision and repoints the same hostname. Refreshing the URL shows the latest Published Revision.
Security boundary
The 32-character hostname contains 128 bits of random entropy and acts as the bearer locator. The content Worker validates its manifest, signed authorization, expiry, denylist, and requested path before serving encrypted R2 bytes.