r2 bill hit $214 from class a operations because i list the bucket per request Bill Breakdown

Short-term tourniquet before you rewrite anything: cache the listing.

const key = new Request(`https://cache.local/list/${prefix}`)
let res = await caches.default.match(key)
if (!res) {
  res = new Response(JSON.stringify(await listPrefix(prefix)), {
    headers: { 'cache-control': 'max-age=60' }
  })
  ctx.waitUntil(caches.default.put(key, res.clone()))
}

Sixty seconds of staleness on a gallery is nothing and it removes about 99% of the operations immediately. You can then do the database version properly instead of at 2am.

Be aware the edge cache is per-location, so a 60s TTL across many colos is not one call a minute globally, it is one call a minute per colo that gets traffic. Still a ~99% cut, just not 100%.

The mental model that fixes this permanently: object storage is a place to put bytes, not a place to ask questions. Any question - what exists, what changed, what belongs to this user - is a database query.

What that looks like concretely:

• one row per object in D1 (or Postgres, whatever you have): key, size, content type, owner, created_at, plus whatever you want to filter on.
• writes go through your code, so you insert the row in the same request that does the PUT.
• the gallery reads the DB. R2 is only ever touched to serve or store the actual bytes.
• a nightly reconciliation job lists the bucket once and fixes drift, because drift will happen.

That nightly job is one Class A operation per 1,000 objects, once a day. Your 47 million becomes something like 3,000 a month.

The pricing asymmetry is the thing to burn into memory: Class A (writes and lists) costs more than ten times what Class B (reads) costs. Any design where a read path triggers a Class A op is going to be expensive, and it will be expensive in proportion to your traffic, which is exactly the wrong direction.

While you are auditing, remember PUT, COPY and POST are also Class A. The other common way people generate a surprise bill is an idempotent-looking sync that re-uploads unchanged files because it compares timestamps instead of content hashes. Every no-op sync is a full-price write.

If you have anything on a schedule that "makes sure the bucket matches", go read it now.

If you go the D1 route, put an index on (owner_id, created_at desc) from the start and store the key rather than a full URL. Signed URLs expire, keys do not, and you will want to change your delivery layer at some point without rewriting every row.

I thought R2's whole pitch was no request charges - the entire point is that you only pay for storage and the egress is free. Are you sure this is not something else on the invoice mislabelled?

"the bucket is the source of truth" is one of those sentences that is architecturally beautiful and financially expensive.