Upload a dist folder and seconds later it is serving on a *.pageband.com subdomain. No account, no CI, no config file.

Why it collapsed into one Worker#

The original design put the frontend on Cloudflare Pages and the API in a separate Worker. That plan died halfway through on a single fact: Pages does not support wildcard custom domains, and a wildcard is the entire point of this product.

So three roles ended up inside one Worker — the marketing page, the publish API, and every site users publish — dispatched by Host. That is not a preference for simplicity; it is the only shape available.

Ten milliseconds#

A free-plan Worker gets 10ms of CPU and 50 subrequests per invocation. A real dist has hundreds of files, which rules out the obvious design of shipping a zip to the server and unpacking it there: the unzip alone would blow the CPU budget, and writing files one by one would blow the subrequest limit.

So the unzip happens in the browser. The frontend expands the archive, then PUTs each file straight into R2, six at a time. Each Worker invocation does exactly one thing — verify a signature, hand a stream to R2. CPU time stops scaling with file count.

A password instead of an account#

There is no login. A successful publish returns a one-time password; next time you pass project name + subdomain + password to overwrite, and the server stores only a salted hash.

One decision here looks like laziness: the hash is a single round of SHA-256, not bcrypt or argon2. The reason is that the server generates the password, at roughly 93 bits of entropy. A slow KDF exists to protect human-chosen passwords from offline cracking, and at this entropy cracking is already infeasible — the slow hash would just consume most of that 10ms budget. The moment users are allowed to pick their own password, that reasoning stops holding.

What it costs#

The publish path cannot be tested automatically. There is a human-verification challenge on the page, so a script can never hold a valid token, and the 14 end-to-end assertions covering a full publish are skipped — covered by a manual regression pass instead. That is the price of being both account-free and not trivially farmable by bots.

The second cost lands on the client: unzipping and concurrent uploads both run on the user's machine, so a few-hundred-megabyte dist makes the tab stutter. The server's CPU budget was saved by moving that work, not by removing it.