{"_id":"s3-guardian","_rev":"15-cf4539a0094dcf9bd769551c039a0ff7","name":"s3-guardian","dist-tags":{"latest":"2.0.1"},"versions":{"0.1.0":{"name":"s3-guardian","version":"0.1.0","keywords":["aws","s3","multipart-upload","finops","cloud-cost","cli"],"author":"","license":"MIT","_id":"s3-guardian@0.1.0","maintainers":[{"name":"plamkatawee","email":"nita45207@gmail.com"}],"bin":{"s3-guardian":"dist/cli.js"},"dist":{"shasum":"8ee3fd28a6f036ff9876bd3a50b43304ab51dd3d","tarball":"https://registry.npmjs.org/s3-guardian/-/s3-guardian-0.1.0.tgz","fileCount":29,"integrity":"sha512-1jKBaL43WU+dCtTVnYLj0MRtz507rRWvcyITqyLC5qObd7fnw7FzN27Y88GiXjNsyrb634SwB2eEnLyZldbBFg==","signatures":[{"sig":"MEUCIF0TMF/EDVHtV5F2a8JOkrSQ8j61y1jAk+Hf0Dq+ovHYAiEAjVmk7mDnaDymURX8ulJUSPmG11KDR5XW9JX12/vVsrI=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":73422},"type":"module","gitHead":"b309cf208cc628fb1b24756d979828a690baddd5","scripts":{"test":"vitest run","build":"tsc","start":"node ./dist/cli.js","typecheck":"tsc --noEmit","test:watch":"vitest","prepublishOnly":"npm test && npm run build"},"_npmUser":{"name":"plamkatawee","email":"nita45207@gmail.com"},"_npmVersion":"11.11.0","description":"Local-first zero-runtime-dependency CLI to scan, quantify, and safely clean up zombie S3 multipart uploads","directories":{},"_nodeVersion":"25.8.1","dependencies":{"@aws-sdk/client-s3":"^3.758.0"},"_hasShrinkwrap":false,"devDependencies":{"vitest":"^3.0.7","typescript":"^5.7.3","@types/node":"^22.13.9","aws-sdk-client-mock":"^4.1.0"},"_npmOperationalInternal":{"tmp":"tmp/s3-guardian_0.1.0_1789893233955_0.5136177001938593","host":"s3://npm-registry-packages-npm-production"}},"0.2.0":{"name":"s3-guardian","version":"0.2.0","keywords":["aws","s3","multipart-upload","finops","cloud-cost","cli"],"author":"","license":"MIT","_id":"s3-guardian@0.2.0","maintainers":[{"name":"plamkatawee","email":"nita45207@gmail.com"}],"bin":{"s3-guardian":"dist/cli.js"},"dist":{"shasum":"2deac8a5c4d5b1c3f5146868f5a8e61287a3f9d7","tarball":"https://registry.npmjs.org/s3-guardian/-/s3-guardian-0.2.0.tgz","fileCount":32,"integrity":"sha512-HPvKYzUNAPPj7f+H50e6wJ5fZdo7OI/3TdqIezk03mhccCdVnsiUPr4qlAA5B1+gHnNiIZV4FnIp5/mdge37Zg==","signatures":[{"sig":"MEQCIHkxzPxAdzd05v0snioGNxAKwoNW3T0OyRgjMnY3a82NAiBu/RLiYlFuZIHKF9Vx8DELWX8ZamteR6ND+S0SlpegEw==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEUCIBQEcmN/xQ0ESZlCaqkK3KE/PphJr7+aIWzE9/wxm0GdAiEAu1WBMOelcbU/YxhcOv644L+VkP2oOWDQ6TAwRRBVeDs=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":102762},"type":"module","gitHead":"0b8e33fb44c95d80dde0f3254e088f0a17705d7d","scripts":{"test":"vitest run","build":"tsc","start":"node ./dist/cli.js","typecheck":"tsc --noEmit","test:watch":"vitest","prepublishOnly":"npm test && npm run build"},"_npmUser":{"name":"plamkatawee","email":"nita45207@gmail.com"},"_npmVersion":"11.11.0","description":"Local-first zero-runtime-dependency CLI to scan, quantify, and safely clean up zombie S3 multipart uploads","directories":{},"_nodeVersion":"25.8.1","dependencies":{"@aws-sdk/client-s3":"^3.758.0"},"_hasShrinkwrap":false,"devDependencies":{"vitest":"^3.0.7","typescript":"^5.7.3","@types/node":"^22.13.9","aws-sdk-client-mock":"^4.1.0"},"_npmOperationalInternal":{"tmp":"tmp/s3-guardian_0.2.0_1789897029919_0.4963632987461759","host":"s3://npm-registry-packages-npm-production"}},"0.3.0":{"name":"s3-guardian","version":"0.3.0","keywords":["aws","s3","multipart-upload","finops","cloud-cost","cli"],"author":"","license":"MIT","_id":"s3-guardian@0.3.0","maintainers":[{"name":"plamkatawee","email":"nita45207@gmail.com"}],"bin":{"s3-guardian":"dist/cli.js"},"dist":{"shasum":"7080e1bdce9b3ce5c71eddc98688f9afe811e24e","tarball":"https://registry.npmjs.org/s3-guardian/-/s3-guardian-0.3.0.tgz","fileCount":44,"integrity":"sha512-RY1uLgz5d5zPKYIrgqjf+Lfak7kmL8/CBShC/tRzZCiPb6n/mAY7adKDTjqjb63UrBeyrYWAlm6x/TlEEN/F8A==","signatures":[{"sig":"MEYCIQDODT4WVg3OKYvcYG29Vg98l6OuKYQYffkyp+bkpH3GFQIhAP++pKXVMz2XQJQWAS5tMPPfJU327WoFuOhTSeQNwjKO","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEUCIQDF9r7xqntKAM75XwC2mNiMWfGB6I5tIkrKfDVGAuAtfgIgVviw82OZDWhFR9cfSBH4TFC1G3cEaHnWp0pQ8+X9LbA=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":162097},"type":"module","gitHead":"534f8e3c802a89de2c68ae19e4449315f3c93671","scripts":{"test":"vitest run","build":"tsc","start":"node ./dist/cli.js","typecheck":"tsc --noEmit","test:watch":"vitest","prepublishOnly":"npm test && npm run build"},"_npmUser":{"name":"plamkatawee","email":"nita45207@gmail.com"},"_npmVersion":"11.11.0","description":"Local-first zero-runtime-dependency CLI to scan, quantify, and safely clean up zombie S3 multipart uploads","directories":{},"_nodeVersion":"25.8.1","dependencies":{"@aws-sdk/client-s3":"^3.758.0"},"_hasShrinkwrap":false,"devDependencies":{"vitest":"^3.0.7","typescript":"^5.7.3","@types/node":"^22.13.9","aws-sdk-client-mock":"^4.1.0"},"_npmOperationalInternal":{"tmp":"tmp/s3-guardian_0.3.0_1789899906497_0.12914400980794172","host":"s3://npm-registry-packages-npm-production"}},"0.4.0":{"name":"s3-guardian","version":"0.4.0","keywords":["aws","s3","multipart-upload","finops","cloud-cost","cli"],"author":"","license":"MIT","_id":"s3-guardian@0.4.0","maintainers":[{"name":"plamkatawee","email":"nita45207@gmail.com"}],"bin":{"s3-guardian":"dist/cli.js"},"dist":{"shasum":"5787d43d9226e4c777388be4ca6faf509399f12f","tarball":"https://registry.npmjs.org/s3-guardian/-/s3-guardian-0.4.0.tgz","fileCount":50,"integrity":"sha512-rRCNdbr+de5mA5dGEBLkFNH0HzaaKWA8lXSltwbLY8XQ/zo3khw0eNNQRXU7blHGc8fXyF2PcHQdo5oiVS2VrQ==","signatures":[{"sig":"MEYCIQCvPi8qUlTFtN8ZlmKupdojqL9PXmKcNJpEa4bJJp/sLwIhALphhTbwMxS9h+WxMSBA1xG+RVs5Vyd1gtNTH2Lut24M","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEUCIEVsp3XGBvMwfpRNYMf2carbs7CcWUYV7TKz/vghWpbeAiEAhckqvR7P5zLSAFiV7fdScXe8FoJZePKj1hVVESos7sA=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":191777},"type":"module","gitHead":"b4892b4fc339a288da7ec705cfe61bcf0335b254","scripts":{"test":"vitest run","build":"tsc","start":"node ./dist/cli.js","typecheck":"tsc --noEmit","test:watch":"vitest","prepublishOnly":"npm test && npm run build"},"_npmUser":{"name":"plamkatawee","email":"nita45207@gmail.com"},"_npmVersion":"11.11.0","description":"Local-first zero-runtime-dependency CLI to scan, quantify, and safely clean up zombie S3 multipart uploads","directories":{},"_nodeVersion":"25.8.1","dependencies":{"@aws-sdk/client-s3":"^3.758.0"},"_hasShrinkwrap":false,"devDependencies":{"vitest":"^3.0.7","typescript":"^5.7.3","@types/node":"^22.13.9","aws-sdk-client-mock":"^4.1.0"},"_npmOperationalInternal":{"tmp":"tmp/s3-guardian_0.4.0_1789900875853_0.9377327703022367","host":"s3://npm-registry-packages-npm-production"}},"0.7.0":{"name":"s3-guardian","version":"0.7.0","keywords":["aws","s3","multipart-upload","finops","cloud-cost","cli"],"author":"","license":"MIT","_id":"s3-guardian@0.7.0","maintainers":[{"name":"plamkatawee","email":"nita45207@gmail.com"}],"bin":{"s3-guardian":"dist/cli.js"},"dist":{"shasum":"725cb4b1f61f7193e5fc8bf34303ef360f0cceb8","tarball":"https://registry.npmjs.org/s3-guardian/-/s3-guardian-0.7.0.tgz","fileCount":74,"integrity":"sha512-vdSXU82amlYcvxhkQdNNAiUOv5O+vH6sCliaKuXVvyktHuk6n+uIR6c20ozIU28ps1F6zT59wiXabAvABuTawA==","signatures":[{"sig":"MEYCIQC4qwZ75EXEPohlrH4ivSpgzI2P3doUPtPWZDRvmwjDegIhAMnQE1JSXHPnHMSn2U52RYTdZrtLu+GNKXVW7knSrPdZ","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEUCIHPPqgedEysJVq2Bcx9mvINTT/NWWsD0Ck5TUlUOZkpWAiEApjnK00u3uERuwPU+TXeaAZnp7E+XtQQkJj1ksdOa11w=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":352817},"type":"module","gitHead":"4a8b10e5f51e7ec3c5a529041508a062d85a8d26","scripts":{"test":"vitest run","build":"tsc","start":"node ./dist/cli.js","typecheck":"tsc --noEmit","test:watch":"vitest","prepublishOnly":"npm test && npm run build"},"_npmUser":{"name":"plamkatawee","email":"nita45207@gmail.com"},"_npmVersion":"11.11.0","description":"Local-first zero-runtime-dependency CLI to scan, quantify, and safely clean up zombie S3 multipart uploads","directories":{},"_nodeVersion":"25.8.1","dependencies":{"@aws-sdk/client-s3":"^3.758.0","@aws-sdk/client-sts":"^3.1136.0","@aws-sdk/client-organizations":"^3.1136.0"},"_hasShrinkwrap":false,"devDependencies":{"vitest":"^3.0.7","typescript":"^5.7.3","@types/node":"^22.13.9","aws-sdk-client-mock":"^4.1.0"},"_npmOperationalInternal":{"tmp":"tmp/s3-guardian_0.7.0_1789905803190_0.4688577424613687","host":"s3://npm-registry-packages-npm-production"}},"0.8.0":{"name":"s3-guardian","version":"0.8.0","keywords":["aws","s3","multipart-upload","finops","cloud-cost","cli"],"author":"","license":"MIT","_id":"s3-guardian@0.8.0","maintainers":[{"name":"plamkatawee","email":"nita45207@gmail.com"}],"bin":{"s3-guardian":"dist/cli.js"},"dist":{"shasum":"1e4e455b5e62c9b529cd4384f6e1f4d90ede2ab0","tarball":"https://registry.npmjs.org/s3-guardian/-/s3-guardian-0.8.0.tgz","fileCount":83,"integrity":"sha512-S5r/04CmBwsPphdVglSP/VLc4imT86U+cspRTC2fta5Iq/eLVXCjCSBGpgRna3LxwYOgx1jrf/D9KG1E2lzFCQ==","signatures":[{"sig":"MEUCIAtijHzErlVi/EekyTjjpmIQtdU+HEdkTEKhT7vo9PBYAiEA/1l/p6+99fiufC7g5E4XMg6qdRIjsveA8U1morSELDo=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEYCIQCM2rmFxQf5LZnqq0gJn37HtSeTcC2bHtBdz83JsdO5dAIhAMMFEx6JOJBEOZSByq37QIkd4gPB9HvbIyT9B8Y/6HyA","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":380488},"type":"module","gitHead":"08ac1041a4ff2962449502f880f16a2a8f3bb9ee","scripts":{"test":"vitest run","build":"tsc","start":"node ./dist/cli.js","typecheck":"tsc --noEmit","test:watch":"vitest","prepublishOnly":"npm test && npm run build"},"_npmUser":{"name":"plamkatawee","email":"nita45207@gmail.com"},"_npmVersion":"11.11.0","description":"Local-first zero-runtime-dependency CLI to scan, quantify, and safely clean up zombie S3 multipart uploads","directories":{},"_nodeVersion":"25.8.1","dependencies":{"@aws-sdk/client-s3":"^3.758.0","@aws-sdk/client-sts":"^3.1136.0","@aws-sdk/client-organizations":"^3.1136.0"},"_hasShrinkwrap":false,"devDependencies":{"vitest":"^3.0.7","typescript":"^5.7.3","@types/node":"^22.13.9","aws-sdk-client-mock":"^4.1.0"},"_npmOperationalInternal":{"tmp":"tmp/s3-guardian_0.8.0_1789907012805_0.11226378853271557","host":"s3://npm-registry-packages-npm-production"}},"1.0.0":{"name":"s3-guardian","version":"1.0.0","keywords":["aws","s3","multipart-upload","finops","cloud-cost","cli"],"author":"","license":"MIT","_id":"s3-guardian@1.0.0","maintainers":[{"name":"plamkatawee","email":"nita45207@gmail.com"}],"bin":{"s3-guardian":"dist/cli.js"},"dist":{"shasum":"7008db29e2271b52f6638a8d1e80eb4782651680","tarball":"https://registry.npmjs.org/s3-guardian/-/s3-guardian-1.0.0.tgz","fileCount":90,"integrity":"sha512-1wpKQF2iLKXrluwMPFF7T+bBQfVTFvJS8p+GKs2aV97/uN85Vh7hP7lACfyv/J5KKBu4ajQnFdJFHf5np0jpOw==","signatures":[{"sig":"MEYCIQD7Ioy20YhXDzeYTAL7WwGzgqrUS+9rtht/SdGci1qzbQIhAPhDQS5iirCgso9PJzUk7YJelHMo8mXFA4W1AlB6FW/m","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEUCIFhgZsWfky2nh5j9OrDL6MjsnaQlFwgWPKBpOpGlDTrgAiEA19UfbVFTmnlRlt1GQZYcRNV5uYyZhWsJ/+PebaQAbUY=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":506522},"type":"module","gitHead":"39464cd4c95b3e9e78cf1809d8a9dea534ed5bf4","scripts":{"test":"vitest run","build":"tsc","start":"node ./dist/cli.js","build:sea":"npm run build && node --experimental-sea-config sea-config.json","typecheck":"tsc --noEmit","test:watch":"vitest","prepublishOnly":"npm test && npm run build"},"_npmUser":{"name":"plamkatawee","email":"nita45207@gmail.com"},"_npmVersion":"11.11.0","description":"Local-first zero-runtime-dependency CLI to scan, quantify, and safely clean up zombie S3 multipart uploads","directories":{},"_nodeVersion":"25.8.1","dependencies":{"@aws-sdk/client-s3":"^3.758.0","@aws-sdk/client-sts":"^3.1136.0","@aws-sdk/client-organizations":"^3.1136.0"},"_hasShrinkwrap":false,"devDependencies":{"vitest":"^3.0.7","typescript":"^5.7.3","@types/node":"^22.13.9","aws-sdk-client-mock":"^4.1.0"},"_npmOperationalInternal":{"tmp":"tmp/s3-guardian_1.0.0_1789907714141_0.6437700947022225","host":"s3://npm-registry-packages-npm-production"}},"1.0.1":{"name":"s3-guardian","version":"1.0.1","keywords":["aws","s3","multipart-upload","finops","cloud-cost","cli"],"author":"","license":"MIT","_id":"s3-guardian@1.0.1","maintainers":[{"name":"plamkatawee","email":"nita45207@gmail.com"}],"bin":{"s3-guardian":"dist/cli.js"},"dist":{"shasum":"ac2b5f9c190f227d214048836f9451cf46b25d31","tarball":"https://registry.npmjs.org/s3-guardian/-/s3-guardian-1.0.1.tgz","fileCount":90,"integrity":"sha512-UI6Gh/d6IZe4RBmV04e1qEt2pUmY1f59WAqKPPwAy6BQvPHcaF+/X1IW3SAyq9RJfshfuw+X7Vm812I5tK3cUA==","signatures":[{"sig":"MEUCIQCHUQVQ5Gf7ooXtTG/QeU+3BoSIj/yaNWtpmDbRSRqHVwIgJqSbrW5wT/iTLhPHUNC+fmvLExtDxh2GcblVFwhk3wQ=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEUCIFs6Sm3RjRgvoiq+ZS0TGAZB4s3QVAdLo9EcV3f5RSe0AiEAhF8PiCGBLbBG22Dy/QjvBuqZvzIvUYBtcVwGX3ffYjg=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":506485},"type":"module","gitHead":"47a72e42df79f510f0cd490738b1d83e36c4aa8c","scripts":{"test":"vitest run","build":"tsc","start":"node ./dist/cli.js","build:sea":"npm run build && node --experimental-sea-config sea-config.json","test:live":"tsx scripts/live-e2e.ts","typecheck":"tsc --noEmit","test:watch":"vitest","prepublishOnly":"npm test && npm run build"},"_npmUser":{"name":"plamkatawee","email":"nita45207@gmail.com"},"_npmVersion":"11.11.0","description":"Local-first zero-runtime-dependency CLI to scan, quantify, and safely clean up zombie S3 multipart uploads","directories":{},"_nodeVersion":"25.8.1","dependencies":{"@aws-sdk/client-s3":"^3.758.0","@aws-sdk/client-sts":"^3.1136.0","@aws-sdk/client-organizations":"^3.1136.0"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.23.15","vitest":"^3.0.7","typescript":"^5.7.3","@types/node":"^22.13.9","aws-sdk-client-mock":"^4.1.0"},"_npmOperationalInternal":{"tmp":"tmp/s3-guardian_1.0.1_1789909091327_0.6907623508551672","host":"s3://npm-registry-packages-npm-production"}},"1.2.0":{"name":"s3-guardian","version":"1.2.0","keywords":["aws","s3","multipart-upload","finops","cloud-cost","cli"],"author":"","license":"MIT","_id":"s3-guardian@1.2.0","maintainers":[{"name":"plamkatawee","email":"nita45207@gmail.com"}],"bin":{"s3-guardian":"dist/cli.js"},"dist":{"shasum":"f4a07ccba717f94a44e160efe12ee0bc1eab2ddc","tarball":"https://registry.npmjs.org/s3-guardian/-/s3-guardian-1.2.0.tgz","fileCount":108,"integrity":"sha512-s+yWOsa5rjCAcfoirtxjlGzENZ8ugN3Bl/xzWQbUBBPcKXmz4cpq6k689+6wvJsdXa7p+oqcMeTxuS9BO1Uaeg==","signatures":[{"sig":"MEQCIAPdRFchue6Cu++PO6vgK9h3VFn7GxdbAGtFsNTC1kQ1AiBZaVb5A/WZ2hMN881vVEKbaGzPgBL9KLeLaKdSbG2Mow==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEQCIDwYD9MgzS5+8/cvTnxjUCuXWXeC4aU/obU1AwKcUBb9AiAGwVIML8XwycNY5GHwjTdWBDXs/FjQPcmKvz3buw3XGg==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":646374},"type":"module","gitHead":"357e56ac5b108dd9c8f2df1cd892e1d97e2ad0ac","scripts":{"test":"vitest run","build":"tsc","start":"node ./dist/cli.js","build:sea":"npm run build && node --experimental-sea-config sea-config.json","test:live":"tsx scripts/live-e2e.ts","typecheck":"tsc --noEmit","test:watch":"vitest","prepublishOnly":"npm test && npm run build"},"_npmUser":{"name":"plamkatawee","email":"nita45207@gmail.com"},"_npmVersion":"11.11.0","description":"Local-first zero-runtime-dependency CLI to scan, quantify, and safely clean up zombie S3 multipart uploads","directories":{},"_nodeVersion":"25.8.1","dependencies":{"@aws-sdk/client-s3":"^3.758.0","@aws-sdk/client-sts":"^3.1136.0","@aws-sdk/client-organizations":"^3.1136.0"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.23.15","vitest":"^3.0.7","typescript":"^5.7.3","@types/node":"^22.13.9","aws-sdk-client-mock":"^4.1.0"},"_npmOperationalInternal":{"tmp":"tmp/s3-guardian_1.2.0_1789915402774_0.8333663033900354","host":"s3://npm-registry-packages-npm-production"}},"1.4.0":{"name":"s3-guardian","version":"1.4.0","keywords":["aws","s3","multipart-upload","finops","cloud-cost","cli"],"author":"","license":"MIT","_id":"s3-guardian@1.4.0","maintainers":[{"name":"plamkatawee","email":"nita45207@gmail.com"}],"bin":{"s3-guardian":"dist/cli.js"},"dist":{"shasum":"dafe9875f532caa4b5fb7bd2ce618662a6a50043","tarball":"https://registry.npmjs.org/s3-guardian/-/s3-guardian-1.4.0.tgz","fileCount":129,"integrity":"sha512-onQh23yQbyczAbs7PAAeKfpwX/rdzw5OdBi9ChVg3nC5nOaTY4KBb5AsyN+jM6+mXFbDGEOxLvOxGraOIiKmlg==","signatures":[{"sig":"MEUCIQCym1aU+cZ+I1D8Dc34BX39rS8IsXZLokinnRor7u7N3AIgO5WJ/GffzZnazbJSTiW8llI4GgcnYnmkAfCHw9aDKWY=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEUCIQDwidOOH3oNPopMkfXkAxs2PTZ2mgUTTCKo/xAannBOxwIgBDSAH4I0qbd9FHxanMmKdwxcmxhaULgv+kYIqJcIdJ4=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":775182},"type":"module","gitHead":"f655a7135255eba901e2eae12ab5582604d81172","scripts":{"test":"vitest run","build":"tsc","start":"node ./dist/cli.js","build:sea":"npm run build && node --experimental-sea-config sea-config.json","test:live":"tsx scripts/live-e2e.ts","typecheck":"tsc --noEmit","test:watch":"vitest","prepublishOnly":"npm test && npm run build"},"_npmUser":{"name":"plamkatawee","email":"nita45207@gmail.com"},"_npmVersion":"11.11.0","description":"Local-first zero-runtime-dependency CLI to scan, quantify, and safely clean up zombie S3 multipart uploads","directories":{},"_nodeVersion":"25.8.1","dependencies":{"@aws-sdk/client-s3":"^3.758.0","@aws-sdk/client-sts":"^3.1136.0","@aws-sdk/client-organizations":"^3.1136.0"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.23.15","vitest":"^3.0.7","typescript":"^5.7.3","@types/node":"^22.13.9","aws-sdk-client-mock":"^4.1.0"},"_npmOperationalInternal":{"tmp":"tmp/s3-guardian_1.4.0_1789917528247_0.581331257914667","host":"s3://npm-registry-packages-npm-production"}},"1.5.0":{"name":"s3-guardian","version":"1.5.0","keywords":["aws","s3","multipart-upload","finops","cloud-cost","cli"],"author":"","license":"MIT","_id":"s3-guardian@1.5.0","maintainers":[{"name":"plamkatawee","email":"nita45207@gmail.com"}],"bin":{"s3-guardian":"dist/cli.js"},"dist":{"shasum":"09db4fffdc2272aa729f22490da2cd6016b99050","tarball":"https://registry.npmjs.org/s3-guardian/-/s3-guardian-1.5.0.tgz","fileCount":138,"integrity":"sha512-mGOKwPOZQUat58Aeu0NiP/2hetudx1WynASixK1FIbSd4qr5sPxU2P028/iF9voXFbqDzhippX4nqmkDc2QA2w==","signatures":[{"sig":"MEYCIQCFdwDRtyb/1XaKDzHQOpExrNDn2ZVxMjbNVLgEhdLXpwIhAOAjRsf/aBTcAvDAPScNMbeqWcRFRb0y7cNzH+igomEo","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEUCIQD+6eerVntsGC2al54YcnBcqXACPJ+oaq5VP6Osp0hnzQIgQDoudYz6HvKo+E/nflQCuz5977bTfcZzqQLw9eTm2kU=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":837752},"type":"module","gitHead":"62caaddf1c599b542cbfc41c21ad6431427122f9","scripts":{"test":"vitest run","build":"tsc","start":"node ./dist/cli.js","build:sea":"npm run build && node --experimental-sea-config sea-config.json","test:live":"tsx scripts/live-e2e.ts","typecheck":"tsc --noEmit","test:watch":"vitest","prepublishOnly":"npm test && npm run build"},"_npmUser":{"name":"plamkatawee","email":"nita45207@gmail.com"},"_npmVersion":"11.11.0","description":"Local-first zero-runtime-dependency CLI to scan, quantify, and safely clean up zombie S3 multipart uploads","directories":{},"_nodeVersion":"25.8.1","dependencies":{"@aws-sdk/client-s3":"^3.758.0","@aws-sdk/client-sts":"^3.1136.0","@aws-sdk/client-organizations":"^3.1136.0"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.23.15","vitest":"^3.0.7","typescript":"^5.7.3","@types/node":"^22.13.9","aws-sdk-client-mock":"^4.1.0"},"_npmOperationalInternal":{"tmp":"tmp/s3-guardian_1.5.0_1789918499207_0.4197022666054413","host":"s3://npm-registry-packages-npm-production"}},"1.6.0":{"name":"s3-guardian","version":"1.6.0","keywords":["aws","s3","multipart-upload","finops","cloud-cost","cli"],"author":"","license":"MIT","_id":"s3-guardian@1.6.0","maintainers":[{"name":"plamkatawee","email":"nita45207@gmail.com"}],"bin":{"s3-guardian":"dist/cli.js"},"dist":{"shasum":"ce05d91cb9126f628dcc6650ad5732d79dcb9e50","tarball":"https://registry.npmjs.org/s3-guardian/-/s3-guardian-1.6.0.tgz","fileCount":153,"integrity":"sha512-RdrNthBPBPNh07/E8debUPXUzdQNd0lySdoVahb4xI+zG0Nf1YBeyDdiHPi+F5bfdFj6A8JhcECJrcqYmaDa+A==","signatures":[{"sig":"MEQCIGKYiWKGV2Vv8Htk5mmV12PZe9+qZIuaR71BnJOKYUggAiAf7z+IOO5x9KYBS7n5XL32a4O3MlPVJgJfvw15IaNPXg==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEYCIQCHtHY1CuOwlasnPELRjFgfRdyo4u4jTMFhQ4NLlCBhXgIhAIyJTKBgkivTOtqYvnV4XcrcyV7IVen7CX6GmX4YZjX3","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":925441},"type":"module","gitHead":"f7a711025a458351da6e34cfd218a1416ff4b299","scripts":{"test":"vitest run","build":"tsc","start":"node ./dist/cli.js","build:sea":"npm run build && node --experimental-sea-config sea-config.json","test:live":"tsx scripts/live-e2e.ts","typecheck":"tsc --noEmit","test:watch":"vitest","prepublishOnly":"npm test && npm run build"},"_npmUser":{"name":"plamkatawee","email":"nita45207@gmail.com"},"_npmVersion":"11.11.0","description":"Local-first zero-runtime-dependency CLI to scan, quantify, and safely clean up zombie S3 multipart uploads","directories":{},"_nodeVersion":"25.8.1","dependencies":{"@aws-sdk/client-s3":"^3.758.0","@aws-sdk/client-sts":"^3.1136.0","@aws-sdk/client-organizations":"^3.1136.0"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.23.15","vitest":"^3.0.7","typescript":"^5.7.3","@types/node":"^22.13.9","aws-sdk-client-mock":"^4.1.0"},"_npmOperationalInternal":{"tmp":"tmp/s3-guardian_1.6.0_1789922920859_0.14157214448774558","host":"s3://npm-registry-packages-npm-production"}},"1.9.0":{"name":"s3-guardian","version":"1.9.0","keywords":["aws","s3","multipart-upload","finops","cloud-cost","cli"],"author":"","license":"MIT","_id":"s3-guardian@1.9.0","maintainers":[{"name":"plamkatawee","email":"nita45207@gmail.com"}],"bin":{"s3-guardian":"dist/cli.js"},"dist":{"shasum":"a66d1982dadf8e301ed15f3bea512eb747d2ffc3","tarball":"https://registry.npmjs.org/s3-guardian/-/s3-guardian-1.9.0.tgz","fileCount":201,"integrity":"sha512-5bVoTg1MmTBG13vs265JqELZCy/n1aSV2JsfFe+nt5MVAnaXaCQUcxOmh98ovevk2IswrtvvQdfQPIzJDe9kMw==","signatures":[{"sig":"MEQCIARNEZdLzTUzlwskoLVHrxraZcyqivWPWTNBkMQKiwBNAiAJ6ilY3q9UngvC/fBCRYWJvNFBCy1oPFFtYLiIvMmO4g==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEUCIQDH2JF/kboUvBF/6db4TM7E52sMdEllY9XAZWOypL7l5wIgE4ZPc1clKLsRrES16ezIulLUjq/P4YCVmdyEeQcn/Ic=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":1182582},"type":"module","gitHead":"55a674cdbbeb6f31089b55c25f17f7d10d92ac1f","scripts":{"test":"vitest run","build":"tsc","start":"node ./dist/cli.js","build:sea":"npm run build && node --experimental-sea-config sea-config.json","test:live":"tsx scripts/live-e2e.ts","typecheck":"tsc --noEmit","test:watch":"vitest","prepublishOnly":"npm test && npm run build"},"_npmUser":{"name":"plamkatawee","email":"nita45207@gmail.com"},"_npmVersion":"11.11.0","description":"Local-first zero-runtime-dependency CLI to scan, quantify, and safely clean up zombie S3 multipart uploads","directories":{},"_nodeVersion":"25.8.1","dependencies":{"@aws-sdk/client-s3":"^3.758.0","@aws-sdk/client-sts":"^3.1136.0","@aws-sdk/client-organizations":"^3.1136.0"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.23.15","vitest":"^3.0.7","typescript":"^5.7.3","@types/node":"^22.13.9","aws-sdk-client-mock":"^4.1.0"},"_npmOperationalInternal":{"tmp":"tmp/s3-guardian_1.9.0_1789933312909_0.3082696975850734","host":"s3://npm-registry-packages-npm-production"}},"2.0.0":{"name":"s3-guardian","version":"2.0.0","keywords":["aws","s3","multipart-upload","finops","cloud-cost","cli"],"author":"","license":"MIT","_id":"s3-guardian@2.0.0","maintainers":[{"name":"plamkatawee","email":"nita45207@gmail.com"}],"bin":{"s3-guardian":"dist/cli.js"},"dist":{"shasum":"e44e9afd15c18143e4ef52ba204c37dcb2ef5a90","tarball":"https://registry.npmjs.org/s3-guardian/-/s3-guardian-2.0.0.tgz","fileCount":215,"integrity":"sha512-k4pAswrPl8D8vVhqWopYUqX1YMqOBpOrWd3QJzTLJOJvgteqJuVA5fIw179Srw2z3/s78M6y4jMpVruChq/hCQ==","signatures":[{"sig":"MEUCIQDUzJX7FtBaeF9o3a+UIOr1q1eow6Cm1TM2NnrBEKgL+AIgFv2d2NEAw4n5YT8yCgg+lE1A0Z531FlkrMUPTBbo+VI=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEYCIQDklCEMVKO5hNvWy8LkA5c2P/h4yluMJjdsNXd04ELrDQIhAPEgfIxirpp5WXvNqDvAPe7jhXoehO3oqsU7TcblBIJ6","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":102886726},"type":"module","gitHead":"a485ee20520a619240d9fbca030b252623f73e36","scripts":{"test":"vitest run","build":"tsc","start":"node ./dist/cli.js","build:sea":"node scripts/build-sea.mjs","test:live":"tsx scripts/live-e2e.ts","typecheck":"tsc --noEmit","test:watch":"vitest","build:bundle":"esbuild src/cli.ts --bundle --platform=node --target=node20 --format=cjs --outfile=dist/bundle.cjs","prepublishOnly":"npm test && npm run build"},"_npmUser":{"name":"plamkatawee","email":"nita45207@gmail.com"},"_npmVersion":"11.11.0","description":"Local-first zero-runtime-dependency CLI to scan, quantify, and safely clean up zombie S3 multipart uploads","directories":{},"_nodeVersion":"25.8.1","dependencies":{"@aws-sdk/client-s3":"^3.758.0","@aws-sdk/client-sts":"^3.1136.0","@aws-sdk/client-organizations":"^3.1136.0"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.23.15","vitest":"^3.0.7","esbuild":"^0.28.2","postject":"^1.0.0-alpha.6","typescript":"^5.7.3","@types/node":"^22.13.9","aws-sdk-client-mock":"^4.1.0"},"_npmOperationalInternal":{"tmp":"tmp/s3-guardian_2.0.0_1789935395874_0.4649518202653893","host":"s3://npm-registry-packages-npm-production"}},"2.0.1":{"_id":"s3-guardian@2.0.1","bin":{"s3-guardian":"dist/cli.js"},"dist":{"shasum":"002e81b10657b474fb0b42645955dc335e981248","tarball":"https://registry.npmjs.org/s3-guardian/-/s3-guardian-2.0.1.tgz","fileCount":215,"integrity":"sha512-ih7lbmS2MVa3gTeZ4jsAoyl+TKYT09Gb9FmK4xc4U5FAslMHzD0VJ9/zPpL3FUlrewjkFnkW3xg305VaH11JDw==","signatures":[{"sig":"MEQCIERdGQpoKe0gTaGqizzjflQ9aib5T3wtmQvfck7MOUR8AiAiVw3nmkyMy101EF9ifHdrgpcmHCl7K5OPrXhdnfzMaA==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIB5l8S9KcY1bNrS/Vv9YsH2rIj/9JoapD7AWFH9bB6S5AiEApxJLISeoWMcGmCrcIKnZft0/h5dG1Aux+FE9/4AzpKQ="}],"unpackedSize":102896120},"name":"s3-guardian","type":"module","author":"","gitHead":"8fefdca39c88dbde0a1b7d50789ab2114fe290d8","license":"MIT","scripts":{"test":"vitest run","build":"tsc","start":"node ./dist/cli.js","build:sea":"node scripts/build-sea.mjs","test:live":"tsx scripts/live-e2e.ts","typecheck":"tsc --noEmit","test:watch":"vitest","build:bundle":"esbuild src/cli.ts --bundle --platform=node --target=node20 --format=cjs --outfile=dist/bundle.cjs","prepublishOnly":"npm test && npm run build","test:enterprise":"tsx scripts/enterprise-e2e.ts"},"version":"2.0.1","_npmUser":{"name":"plamkatawee","email":"nita45207@gmail.com"},"keywords":["aws","s3","multipart-upload","finops","cloud-cost","cli"],"_npmVersion":"11.11.0","description":"Local-first zero-runtime-dependency CLI to scan, quantify, and safely clean up zombie S3 multipart uploads","directories":{},"maintainers":[{"name":"plamkatawee","email":"nita45207@gmail.com"}],"_nodeVersion":"25.8.1","dependencies":{"@aws-sdk/client-s3":"^3.758.0","@aws-sdk/client-sts":"^3.1136.0","@aws-sdk/client-organizations":"^3.1136.0"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.23.15","vitest":"^3.0.7","esbuild":"^0.28.2","postject":"^1.0.0-alpha.6","typescript":"^5.7.3","@types/node":"^22.13.9","aws-sdk-client-mock":"^4.1.0"},"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/s3-guardian_2.0.1_1789938274372_0.27890240237515873"}}},"time":{"created":"2026-09-20T08:33:53.779Z","modified":"2026-09-20T21:04:35.197Z","0.1.0":"2026-09-20T08:33:54.064Z","0.2.0":"2026-09-20T09:37:10.010Z","0.3.0":"2026-09-20T10:25:06.601Z","0.4.0":"2026-09-20T10:41:15.948Z","0.7.0":"2026-09-20T12:03:23.358Z","0.8.0":"2026-09-20T12:23:32.908Z","1.0.0":"2026-09-20T12:35:14.248Z","1.0.1":"2026-09-20T12:58:11.419Z","1.2.0":"2026-09-20T14:43:22.868Z","1.4.0":"2026-09-20T15:18:48.369Z","1.5.0":"2026-09-20T15:34:59.290Z","1.6.0":"2026-09-20T16:48:40.959Z","1.9.0":"2026-09-20T19:41:53.008Z","2.0.0":"2026-09-20T20:16:36.452Z","2.0.1":"2026-09-20T21:04:35.034Z"},"license":"MIT","keywords":["aws","s3","multipart-upload","finops","cloud-cost","cli"],"description":"Local-first zero-runtime-dependency CLI to scan, quantify, and safely clean up zombie S3 multipart uploads","maintainers":[{"name":"plamkatawee","email":"nita45207@gmail.com"}],"readme":"# s3-guardian\n\n[![npm version](https://img.shields.io/badge/npm-v2.0.0-blue.svg)](https://www.npmjs.com/package/s3-guardian)\n[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)\n[![Runtime Dependencies](https://img.shields.io/badge/dependencies-0%20(AWS%20SDK%20v3%20only)-success.svg)](https://github.com/x7ssss/s3-guardian)\n[![Node Version](https://img.shields.io/badge/node-%3E%3D20.0.0-brightgreen.svg)](https://nodejs.org/)\n\nEnterprise-grade autonomous cloud storage governance platform and CLI to detect, quantify, and safely clean up abandoned multipart uploads, noncurrent object versions, and lifecycle transition traps across AWS S3 and multi-cloud S3 stores (Cloudflare R2, Wasabi, Backblaze B2, MinIO, Ceph).\n\n---\n\n## Autonomous Sovereign Operator State Machine\n\n`s3-guardian v2.0.0` introduces the **Autonomous Sovereign Operator**, a continuous 9-phase daemon engine running autonomous storage governance:\n\n```\n┌─────────────┐     ┌──────────────┐     ┌─────────────────────┐\n│  DISCOVERY  │ ──▶ │ POLICY_MATCH │ ──▶ │ BLAST_RADIUS_AUDIT  │\n└─────────────┘     └──────────────┘     └──────────┬──────────┘\n                                                    │\n       ┌────────────────────────────────────────────┘\n       ▼\n┌─────────────┐     ┌────────────────┐     ┌──────────────┐\n│ CANARY_TEST │ ──▶ │ CIRCUIT_VERIFY │ ──▶ │ BULK_EXECUTE │\n└─────────────┘     └────────────────┘     └───────┬──────┘\n                                                   │\n       ┌───────────────────────────────────────────┘\n       ▼\n┌─────────────┐     ┌─────────────┐     ┌───────┐\n│  AUDIT_LOG  │ ──▶ │ UNDO_EXPORT │ ──▶ │ SLEEP │ ──(next epoch)──▶ [DISCOVERY]\n└─────────────┘     └─────────────┘     └───────┘\n```\n\n1. **DISCOVERY**: Paginates targets across accounts/buckets with cursor resumption.\n2. **POLICY_MATCH**: Evaluates discovered inventory against declarative policy engine (YAML subset).\n3. **BLAST_RADIUS_AUDIT**: Simulates relative mutation ceiling ($\\le 5\\%$), Object Lock (`COMPLIANCE`/`GOVERNANCE`), and replication divergence.\n4. **CANARY_TEST**: Dispatches isolated canary deletion probe before bulk mutation.\n5. **CIRCUIT_VERIFY**: Verifies circuit breaker state; halts immediately if error rates spiked.\n6. **BULK_EXECUTE**: Bounded concurrency worker pool draining mutation queue.\n7. **AUDIT_LOG**: Streaming JSONL append to immutable audit ledger.\n8. **UNDO_EXPORT**: Generates cryptographic `UndoManifest` and SOC 2 / ISO 27001 `DeletionCertificate`.\n9. **SLEEP**: High-resolution monotonic sleep subtracting epoch run duration; resets circuit breaker half-open probes.\n10. **HALTED**: Safety state entered if safety gates trip, preventing catastrophic fleet mutations.\n\n---\n\n## The Problem\n\n1. **Invisible Multipart Bloat (\"Zombie Uploads\"):**\n   When multipart uploads terminate abnormally (network drops, container preemption, client crashes), the uploaded byte parts remain in S3 indefinitely. They **never** appear in `ListObjectsV2` or the AWS Console, yet accrue baseline S3 Standard storage charges ($0.023/GB/month) forever.\n2. **Versioning Bleed & Ghost Delete Markers:**\n   Version-enabled buckets silently accumulate millions of noncurrent versions and Expired Object Delete Markers (EODMs), degrading listing latency and accumulating immense financial waste.\n3. **Drift-Prone Direct API Mutations:**\n   Blindly overwriting S3 lifecycle rules with manual API calls destroys existing Terraform and CloudFormation state. `s3-guardian` is **GitOps-first**, generating clean IaC code by default.\n4. **Glacier & Standard-IA Small-Object Transition Traps:**\n   S3 Standard-IA, One Zone-IA, and Glacier Instant Retrieval (GIR) enforce a 128 KiB minimum billable size floor. Glacier Flexible Retrieval (GFR) and Deep Archive (GDA) charge 40 KiB metadata overhead per object (8 KiB at Standard rate + 32 KiB at Glacier rate). Unconstrained transition rules lacking `ObjectSizeGreaterThan` filters force sub-128 KiB objects into archive tiers, increasing ongoing monthly storage costs up to 70x and charging $0.01–$0.05/1k transition request fees.\n\n---\n\n## Core Enterprise Invariants\n\n- **Zero Third-Party Runtime Dependencies:** Runs purely on Node.js 20+ built-ins (`node:crypto`, `node:readline`, `node:util`) and official modular AWS SDK clients (`@aws-sdk/client-s3`, `@aws-sdk/client-sts`, `@aws-sdk/client-organizations`).\n- **Autonomous Circuit Breaker & Zero-Allocation Ring Buffer:** Scoped per (bucket, operation). Tracks error rates in $O(1)$ time with zero GC churn using a pre-allocated `Float32Array` ring buffer. Trips to `OPEN` on 3 consecutive 403s, halves concurrency on 503s (burst trips on $\\ge 3$ in 5s or $>10\\%$ moving error rate), and quarantines on 400 BadDigest.\n- **Pre-Flight Canary Verification Gate:** Runs isolated deletions on up to 10 oldest targets with `HeadObject` probe verification before admitting the remaining fleet batch loop.\n- **Relative Mutation Ceiling:** Caps autonomous deletions to $\\le 5\\%$ of total bucket inventory (or 1,000 objects absolute fallback) to prevent catastrophic accidental wipeouts.\n- **Destructive Operations Safety Gate:** `apply` strictly requires an immutable, cryptographically verified `plan.json` file and the explicit `--confirm` flag.\n- **Pre-Flight Blast Radius Engine:** Simulates mutation safety before making any destructive API calls:\n  - Blocks deletions under Object Lock `COMPLIANCE` mode.\n  - Requires `--bypass-governance` for `GOVERNANCE` mode (never sends bypass headers on non-locked buckets).\n  - Guards against replication divergence under CRR/SRR via `--acknowledge-replication-divergence`.\n  - Hard-blocks state and ingestion pipeline prefixes (`checkpoints/`, `_wal/`, `iceberg/`, `terraform/`, `state/`).\n  - Guards against active pipeline churn (<24h age) unless explicitly overridden.\n- **RFC 8785 Cryptographic Plan Integrity:** Plans are canonicalized via RFC 8785 (JCS) and signed with a SHA-256 target hash. Tampered or modified plan files are rejected immediately.\n- **Forensic CloudTrail Traceability:** Captures and outputs `$metadata.requestId` (`x-amz-request-id`) and `$metadata.extendedRequestId` (`x-amz-id-2`) for audit correlation.\n- **Node Single Executable Application (SEA):** Configured for self-contained, dependency-free binary compilation via `sea-config.json`.\n\n---\n\n## Installation\n\n### Run via npx (Zero Install)\n```bash\nnpx s3-guardian --help\n```\n\n### Install Globally\n```bash\nnpm install -g s3-guardian\n```\n\n### Single Executable Application (SEA)\nDownload pre-built, self-contained standalone binaries (zero Node.js runtime required) from GitHub Releases for:\n- Linux (`x86_64`, `aarch64`)\n- macOS (`x86_64`, `arm64` Apple Silicon)\n- Windows (`x64`)\n\nOr compile locally for your current host platform:\n```bash\nnpm run build:sea\n# Generates dist/s3-guardian (or dist/s3-guardian.exe on Windows)\n./dist/s3-guardian --version\n```\n\n### Air-Gapped Trust Stores (`NODE_EXTRA_CA_CERTS`)\nIn air-gapped or private cloud environments with corporate intercepting proxies or custom internal Root CAs, point `NODE_EXTRA_CA_CERTS` to your PEM bundle:\n```bash\nexport NODE_EXTRA_CA_CERTS=/etc/ssl/certs/corporate-root-ca.pem\ns3-guardian operate --all-buckets\n```\n`s3-guardian` dynamically registers all PEM certificates into Node's secure context and HTTPS agent on initialization.\n\n---\n\n## Commands & Usage Guide\n\n### 1. `operate`: Autonomous Sovereign Operator (v2.0.0)\n\nExecutes continuous 9-phase autonomous storage governance state machine:\n\n```bash\n# Continuous fleet governance with 1-hour intervals and 5% mutation ceiling\ns3-guardian operate --interval 1h --max-blast-radius 5\n\n# Continuous governance governed by declarative policy document\ns3-guardian operate --policy ./corporate-storage-policy.yaml\n\n# Single bucket one-shot dry-run epoch with JSON metrics output\ns3-guardian operate my-bucket --once --dry-run --json\n\n# Run against S3-compatible private cloud (MinIO / Ceph)\ns3-guardian operate my-bucket --endpoint https://s3.internal.lan --force-path-style\n```\n\n### 2. `scan`: Read-Only Inspection\n\nInspect incomplete multipart uploads without modifying bucket state:\n\n```bash\n# Scan a single bucket (older than 7 days by default)\ns3-guardian scan my-bucket\n\n# Include noncurrent versions and expired delete markers\ns3-guardian scan my-bucket --include-versions\n\n# Scan all buckets in the AWS account (fleet mode)\ns3-guardian scan --all-buckets\n\n# Sweep all member accounts in an AWS Organization\ns3-guardian scan --org --role-name OrganizationAccountAccessRole\n\n# Custom age threshold, prefix, and JSON output\ns3-guardian scan my-bucket --older-than 14 --prefix logs/ --json\n```\n\n### 2. `plan`: Deterministic, Cryptographic Planning\n\nGenerates a reviewable, immutable Schema 1.3 `plan.json` embedding RFC 8785 SHA-256 target verification and blast radius audit summary:\n\n```bash\n# Generate plan for zombie multipart uploads\ns3-guardian plan my-bucket --out plan.json --older-than 7\n\n# Generate plan including versioning waste\ns3-guardian plan my-bucket --include-versions --out plan.json\n\n# Generate fleet-wide plan\ns3-guardian plan --all-buckets --out fleet-plan.json\n```\n\nExample `plan.json` (Schema 1.3):\n```json\n{\n  \"schemaVersion\": \"1.3\",\n  \"generatedAt\": \"2026-09-20T12:00:00.000Z\",\n  \"bucket\": \"production-data-lake\",\n  \"endpoint\": null,\n  \"olderThanDays\": 7,\n  \"totalZombieUploads\": 1,\n  \"totalStrandedBytes\": 10737418240,\n  \"estimatedMonthlyWasteUSD\": 0.23,\n  \"planHash\": \"3f8a4e9b72c1d0e5f6a8b7c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a8b7c6d5e4\",\n  \"blastRadiusAudit\": {\n    \"bucket\": \"production-data-lake\",\n    \"riskLevel\": \"LOW\",\n    \"isBlocked\": false,\n    \"findings\": []\n  },\n  \"uploads\": [\n    {\n      \"key\": \"raw/events/2026-09-01.parquet\",\n      \"uploadId\": \"mpu-xyz-987\",\n      \"initiated\": \"2026-09-01T04:00:00.000Z\",\n      \"partsCount\": 64,\n      \"bytes\": 10737418240,\n      \"storageClass\": \"STANDARD\",\n      \"lifecycleStatus\": \"UNPROTECTED\"\n    }\n  ]\n}\n```\n\n### 3. `apply`: Safe Execution\n\nExecutes aborts and version deletions defined in the plan with cryptographic integrity verification, pre-flight safety checks, and bounded concurrency:\n\n```bash\n# Execute plan (strictly requires --confirm)\ns3-guardian apply --plan plan.json --confirm\n\n# Bypass Object Lock GOVERNANCE mode retention (when authorized)\ns3-guardian apply --plan plan.json --confirm --bypass-governance\n\n# Acknowledge replication divergence for replicated buckets\ns3-guardian apply --plan plan.json --confirm --acknowledge-replication-divergence\n\n# Allow deletion of items modified within 24 hours\ns3-guardian apply --plan plan.json --confirm --allow-active-churn\n```\n\n### 4. `remediate`: GitOps-First Lifecycle Policies\n\nGenerates non-destructive, drift-free Infrastructure as Code snippets to permanently automate MPU cleanup:\n\n```bash\n# Generate Terraform HCL configuration snippet\ns3-guardian remediate my-bucket --format terraform\n\n# Generate CloudFormation YAML template\ns3-guardian remediate my-bucket --format cloudformation --out-iac lifecycle.yaml\n\n# Fleet remediation for all unprotected buckets\ns3-guardian remediate --all-buckets --format terraform --out-iac main.tf\n\n# Opt-in direct API mutation (atomic Read-Modify-Write preserving all existing rules)\ns3-guardian remediate my-bucket --danger-direct-api-apply --days 7\n```\n\n### 5. `lens`: Zero-Data-Plane Storage Lens Triage\n\nTriages macroscopic metrics directly from local or S3 Storage Lens export CSV files without issuing a single object-level API call:\n\n```bash\n# Triage top offending buckets from local CSV export\ns3-guardian lens ./storage-lens-export.csv --top 10\n\n# Stream export directly from S3\ns3-guardian lens s3://audit-bucket/StorageLens/report.csv --min-waste-usd 50.00\n```\n\n### 6. `audit-transitions`: Lifecycle Transition Trap Auditor\n\nAudits S3 lifecycle configuration rules for dangerous unconstrained transitions targeting Infrequent Access or Glacier classes without a 128 KiB minimum size filter:\n\n```bash\n# Audit a single bucket's lifecycle transition rules\ns3-guardian audit-transitions my-data-bucket\n\n# Audit all buckets across the account\ns3-guardian audit-transitions --all-buckets\n\n# Include transition audit during standard scan\ns3-guardian scan my-data-bucket --audit-transitions\n\n# Machine-readable JSON output\ns3-guardian audit-transitions my-data-bucket --json\n```\n\nTerminal Output Table:\n```\nRule ID                     Target Tier     Days    Min Size Filter     Small-Object Risk   Est. Penalty/Mo   Status\n-------------------------------------------------------------------------------------------------------------------------\narchive-raw-telemetry       GLACIER         30      None (0 B)          HIGH (< 128 KiB)    $42.50/mo         TRAP DETECTED\n```\n\nActionable remediation snippets with `object_size_greater_than = 131072` (128 KiB) are automatically emitted to remediate the small-object trap.\n\n---\n\n### 7. `daemon`: Continuous In-Process Governance Daemon\n\nRuns continuous, automated FinOps and storage governance sweeps without external daemon managers (no `pm2`, no `node-cron`). Built purely on native Node.js 20+ runtime primitives.\n\n#### Core Capabilities:\n- **Drift-Free Monotonic Scheduler:** Calculates loop duration using `process.hrtime.bigint()` and dynamically adjusts sleep interval (`Math.max(0, intervalMs - lastRunDurationMs)`) to eliminate timing drift under heavy API load.\n- **Single-Instance Atomic PID Lockfile:** Writes process PID to `${os.tmpdir()}/s3-guardian-<target>.lock` with atomic `{ flag: 'wx' }`. Automatically detects and reclaims stale locks if the previous process terminated abnormally.\n- **Signal-Safe Graceful Shutdown:** Traps `SIGINT` (Ctrl+C) and `SIGTERM`, allowing in-flight network batches to complete before process exit, and cleanly unlinks lockfiles.\n- **Memory Safety & Resource Monitoring:** Tracks `process.memoryUsage()` (heap used and RSS) on every iteration to guarantee zero memory leaks over long-running deployments.\n- **Continuous Webhook Alerting:** Dispatches real-time summary notifications to Slack, Discord, PagerDuty, or Webhook endpoints after each iteration.\n\n#### CLI Usage Examples:\n\n```bash\n# Continuous fleet scan every 1 hour (default)\ns3-guardian scan --all-buckets --daemon\n\n# Continuous single-bucket monitoring every 30 minutes with Slack alerts\ns3-guardian scan my-bucket --daemon --interval 30m --webhook-url https://hooks.slack.com/services/...\n\n# Continuous lifecycle transition trap monitoring every 12 hours\ns3-guardian audit-transitions --all-buckets --daemon --interval 12h\n\n# Execute exactly one iteration in daemon harness (validates lockfile, pipeline, and metrics)\ns3-guardian scan --all-buckets --once\n```\n\n#### systemd Service Configuration (`/etc/systemd/system/s3-guardian.service`):\n\n```ini\n[Unit]\nDescription=s3-guardian Continuous Storage Governance Daemon\nAfter=network.target\n\n[Service]\nType=simple\nUser=s3guardian\nGroup=s3guardian\nEnvironment=AWS_REGION=us-east-1\nEnvironment=NODE_ENV=production\nExecStart=/usr/local/bin/s3-guardian scan --all-buckets --daemon --interval 6h --webhook-url https://hooks.slack.com/services/XXX\nRestart=on-failure\nRestartSec=30s\nKillMode=mixed\nTimeoutStopSec=60s\n\n[Install]\nWantedBy=multi-user.target\n```\n\n#### Docker / Container Deployment:\n\n```dockerfile\nFROM node:20-alpine\nWORKDIR /app\nRUN npm install -g s3-guardian\nUSER node\nENTRYPOINT [\"s3-guardian\"]\nCMD [\"scan\", \"--all-buckets\", \"--daemon\", \"--interval\", \"1h\"]\n```\n\n---\n\n### 8. `drift`: Terraform Lifecycle Drift Detection & Git Patch Generation\n\nDetects discrepancies between deployed AWS S3 lifecycle rules and local Terraform Infrastructure as Code definitions (`.tf` source files or `terraform.tfstate` state files). Automatically generates standard POSIX unified diffs directly applicable via `git apply`.\n\n#### Core Capabilities:\n- **Terraform State (v4) Parsing:** Ingests `terraform.tfstate` to extract `aws_s3_bucket_lifecycle_configuration` and legacy `aws_s3_bucket` managed lifecycle rules without requiring a Terraform binary or network state lock.\n- **Direct HCL Source Inspection:** Analyzes local `.tf` files to identify missing rule blocks, threshold drifts, and missing safety filters.\n- **POSIX Unified Diff Patches:** Emits standard `--- a/path\\n+++ b/path` unified diffs inserting missing `abort_incomplete_multipart_upload` blocks, version expirations, and `object_size_greater_than = 131072` transition trap filters.\n- **Automated In-Place Patching:** When invoked with `--write`, atomically patches the local `.tf` file in place, achieving GitOps-first remediation with zero manual syntax errors.\n- **Ghost Rule Flagging:** Identifies rules with Tag filters attached to MPU abort actions (which AWS S3 silently ignores).\n\n#### CLI Usage Examples:\n\n```bash\n# Compare live S3 bucket against local Terraform source file\ns3-guardian drift my-bucket --tf-file main.tf\n\n# Compare live S3 bucket against terraform.tfstate JSON\ns3-guardian drift my-bucket --tfstate terraform.tfstate\n\n# Preview POSIX unified diff patch directly to stdout\ns3-guardian drift my-bucket --tf-file main.tf --patch\n\n# Apply patch directly to the .tf file in place\ns3-guardian drift my-bucket --tf-file main.tf --write\n\n# Output machine-readable JSON drift report for CI/CD pipelines\ns3-guardian drift my-bucket --tfstate terraform.tfstate --json\n```\n\nTerminal Output Table:\n```\nBucket                      Resource Type                             IaC State    Live State   Drift Status\n--------------------------------------------------------------------------------------------------------------------\nproduction-data-lake        aws_s3_bucket_lifecycle_configuration    1 Rule(s)    2 Rule(s)    ❌ DRIFT_DETECTED\n\nDrift Details & Safety Gaps (2):\n  - Unmanaged rule in AWS S3: 'ad-hoc-manual-rule' (present in live cloud but missing in IaC)\n  - Safety gap: Transition rule 'archive-tier' lacks object_size_greater_than >= 128 KiB filter (small-object penalty trap)\n\n💡 Tip: Run `s3-guardian drift production-data-lake --tf-file main.tf --patch` to view unified diff patch, or `--write` to apply automatically.\n```\n\n---\n\n## Multi-Cloud Provider Hardening (v1.4.0)\n\n`s3-guardian` automatically adapts to cross-cloud S3-compatible object storage backends via endpoint URL regex matching or explicit `--provider` specification:\n\n```bash\n# Explicit provider specification\ns3-guardian scan my-bucket --provider r2\ns3-guardian scan my-bucket --provider wasabi --endpoint https://s3.wasabisys.com\ns3-guardian scan my-bucket --provider minio --endpoint http://localhost:9000\n\n# Detected provider is displayed in the CLI banner:\n# [Provider: Cloudflare R2]\n# [Provider: Wasabi]\n# [Provider: MinIO]\n```\n\n### Supported Providers & Automated Quirks\n\n| Provider | Endpoint Pattern | Native Quirks Applied |\n| :--- | :--- | :--- |\n| **AWS S3** | `*.amazonaws.com` (or default) | Standard virtual-hosted routing, full SDK checksum support |\n| **Cloudflare R2** | `*.r2.cloudflarestorage.com`, `*.r2.dev` | Sets `requestChecksumCalculation: \"WHEN_REQUIRED\"`, default region `auto`; middleware strips unsupported `x-amz-sdk-checksum-algorithm` and `x-amz-checksum-crc32` headers |\n| **Wasabi** | `*.wasabisys.com` | Strict 90-day minimum retention guard (`--force-wasabi-early-delete` required for targets < 90 days) |\n| **Backblaze B2** | `*.backblazeb2.com` | Automatic path-style addressing (`forcePathStyle: true`) |\n| **MinIO** | `:9000`, `minio.*`, `localhost:9000` | Path-style addressing; deserializer middleware catches HTTP 405 MethodNotAllowed and yields safe fallback responses |\n| **Ceph RADOS GW**| `:7480`, `*.ceph.*` | Path-style addressing; middleware suppresses HTTP 405 MethodNotAllowed for unsupported extension queries |\n| **Custom S3** | Custom endpoint URL | Standard S3 compatibility fallback |\n\n### Wasabi 90-Day Retention Guard\nWasabi enforces a **90-day minimum retention charge** on stored data. Prematurely deleting objects or incomplete multipart uploads younger than 90 days results in Timed Deleted Storage charges.\n- `s3-guardian` pre-flight blast radius simulation inspects target timestamps when `provider === \"wasabi\"`.\n- Targets `< 90` days old trip `HIGH_WASABI_RETENTION_RISK` and abort `apply`:\n  `⚠️ Wasabi charges 90 days minimum retention. Deleting objects < 90 days old triggers Timed Deleted Storage fees.`\n- To bypass when early deletion is intended, pass `--force-wasabi-early-delete`.\n\n---\n\n### 11. `dashboard` (TUI): Interactive Fleet Storage Governance Navigator\n\nA terminal UI dashboard powered purely by native Node.js 20+ ANSI escape codes and alternate screen buffer hygiene. Browse buckets, inspect stranded storage, expand the detail inspector drawer, and generate remediation plans on the fly.\n\n```bash\n# Launch interactive dashboard across all fleet buckets\ns3-guardian dashboard\n\n# Or use the concise alias\ns3-guardian tui\n\n# Initialize instant zero data-plane triage from Storage Lens CSV export\ns3-guardian dashboard --lens s3://my-inventory-bucket/lens/daily-export.csv\ns3-guardian dashboard --lens /path/to/local-storage-lens-report.csv\n\n# Multi-cloud & custom endpoints\ns3-guardian dashboard --provider minio --endpoint http://localhost:9000\n```\n\n#### Hotkey Controls\n\n| Hotkey | Action | Description |\n| :--- | :--- | :--- |\n| `↑` / `k` | **Navigate Up** | Move cursor up in the bucket list (with auto-scroll clamping) |\n| `↓` / `j` | **Navigate Down** | Move cursor down in the bucket list |\n| `Enter` | **Detail Inspector** | Expand/collapse selected bucket drawer (region, provider, oldest upload date, EODM count, lifecycle rule status, ghost rules) |\n| `p` | **Create Plan** | Asynchronously generate an immutable, RFC 8785 signed `plan-<bucket>.json` in the background |\n| `r` | **Refresh** | Asynchronously re-scan fleet metrics across accounts and regions without freezing the UI |\n| `q` / `Esc` / `Ctrl+C` | **Quit** | Cleanly exit dashboard and restore primary terminal screen buffer |\n\n#### Terminal Hygiene & CI Safety\n- **Clean Alternate Screen Buffer:** `s3-guardian` switches to the terminal's alternate screen buffer (`\\x1b[?1049h`) and hides the cursor (`\\x1b[?25l`). On exit or interrupt signals (`SIGINT`, `SIGTERM`, `uncaughtException`), it unconditionally restores the primary screen buffer (`\\x1b[?1049l`) and re-enables cursor visibility (`\\x1b[?25h`).\n- **Non-TTY Protection:** If launched in headless CI pipelines or piped commands without an interactive TTY (`!process.stdin.isTTY`), the dashboard cleanly halts with exit code 2 and prompts:\n  `Error: Interactive dashboard requires an interactive terminal (TTY). Run 's3-guardian scan --all-buckets' for non-interactive / CI environments.`\n\n---\n\n## Append-Only State Ledger, Streaming Compaction & Audit History (v1.7.0)\n\n`s3-guardian` records every diagnostic and mutative decision as a linearizable, strictly-typed JSONL event in `${stateDir}/audit.jsonl`:\n\n```bash\n# Compact active audit.jsonl into compressed snapshot (snapshots/snapshot-<timestamp>.json.gz)\ns3-guardian state compact\n\n# Compact state and mirror the compressed snapshot to a designated S3 audit bucket\ns3-guardian state compact --s3-mirror my-enterprise-audit-bucket\n\n# Inspect historical remediation and FinOps metrics for a specific bucket\ns3-guardian state history production-data-lake\n\n# Output machine-readable JSON history report\ns3-guardian state history production-data-lake --json\n```\n\n### Key Capabilities & Invariants\n- **Append-Only Serialization:** `AuditLogWriter` serializes events through an internal promise queue, preventing interleaved writes under concurrency, and respects write stream backpressure (`drain`).\n- **Zero-Memory Streaming Compaction:** `Compactor.compactAuditLog` streams `audit.jsonl` line-by-line via `node:readline`, maintaining a strict $< 50\\text{ MB}$ RSS memory footprint regardless of log size. High-volume `DISCOVERY` lines are pruned while preserving per-bucket FinOps totals.\n- **Atomic Multi-Step State Rotation:** Rotates active `audit.jsonl` to `audit.jsonl.rotating.<timestamp>`, immediately initializes a clean empty `audit.jsonl`, compresses aggregates into `snapshots/snapshot-<timestamp>.json.gz`, and unlinks the rotated file upon commit.\n- **Windows NTFS Safety (`writeAtomic`):** Writes temporary files to the same directory, flushes data with `fd.sync()`, and retries with exponential backoff + full jitter (up to 3s) on transient `EPERM`/`EBUSY` locks before skipping unsupported directory fsync on Windows.\n\n---\n\n## Cryptographic Rollback Engine, Soft Delete Re-hydration & SOC 2 Certificates (v1.8.0)\n\n### 12. `rollback`: Cryptographic State Inversion with Remote Drift Verification\nInverts reversible mutations (lifecycle configuration updates, bucket tagging updates, soft delete markers) recorded in an `UndoManifest`. Computes live remote state hashes via RFC 8785 canonical JSON and SHA-256, halting on divergence unless `--force` is passed:\n\n```bash\n# Verify live remote state and rollback mutation\ns3-guardian rollback .s3-guardian/undo/undo-my-bucket-2026-09-20T17-00-00.json\n\n# Force rollback execution despite live remote state drift\ns3-guardian rollback .s3-guardian/undo/undo-my-bucket-2026-09-20T17-00-00.json --force\n\n# Output machine-readable JSON restoration summary\ns3-guardian rollback .s3-guardian/undo/undo-my-bucket-2026-09-20T17-00-00.json --json\n```\n\n### 13. `certificate`: SOC 2 CC6.8 / ISO 27001 A.8.10 Deletion Certificates\nDisplays and validates unforgeable deletion certificates generated at the conclusion of permanent object version purges and aborted multipart uploads:\n\n```bash\n# View formatted compliance certificate with item ledger\ns3-guardian certificate .s3-guardian/certificates/deletion-certificate-my-bucket-2026-09-20T17-00-00.json\n\n# Export raw JSON certificate for compliance archiving\ns3-guardian certificate .s3-guardian/certificates/deletion-certificate-my-bucket-2026-09-20T17-00-00.json --json\n```\n\n### 14. `rehydrate`: Soft Delete Tombstone Popping\nSafely un-deletes soft-deleted items by permanently removing latest Delete Markers (`IsLatest === true`) using `DeleteObjectsCommand` with `Quiet: true`, elevating the previous data version to active status:\n\n```bash\n# Simulate soft delete rehydration without deleting markers (dry run)\ns3-guardian rehydrate my-bucket --dry-run\n\n# Rehydrate all soft-deleted objects in the bucket\ns3-guardian rehydrate my-bucket\n\n# Rehydrate delete markers matching an ISO 8601 or interval threshold\ns3-guardian rehydrate my-bucket --older-than 2026-08-01T00:00:00Z --json\n```\n\n---\n\n## Declarative Storage Policy Engine & Precedence Hierarchy (v1.9.0)\n\nDefine centralized, declarative storage lifecycle rules using native JSON or the zero-dependency Guardian YAML subset:\n\n```yaml\nschemaVersion: \"1\"\npolicyId: enterprise-standard-lifecycle\nscope:\n  level: BUCKET_TAG\n  priority: 100\ndefaults:\n  action: AUTO_REMEDIATE\n  mpuAbortDays: 7d\nrules:\n  - id: cleanup-temp-uploads\n    match:\n      object:\n        prefix: tmp/\n    expirationDays: 7d\n  - id: archive-production-data\n    match:\n      object:\n        prefix: data/\n        tags:\n          RetentionTier: Archive\n        minSizeKb: 128KiB\n    transitions:\n      - days: 30d\n        storageClass: STANDARD_IA\n      - days: 90d\n        storageClass: GLACIER\n    expirationDays: 365d\n```\n\n### Key Capabilities:\n- **Zero-Dependency YAML/JSON Subset Parser:** Line tokenization, indentation tracking (tabs strictly rejected), human durations (`7d`, `24h`), and human sizes (`128KiB`, `1MiB`).\n- **Precedence Hierarchy:** `OBJECT_TAG (40)` > `BUCKET_TAG (30)` > `ACCOUNT (25)` > `OU (20)` > `GLOBAL (10)`. Leaf-level property merging with provenance tracking.\n- **Fail-Safe Action Mode:** Most restrictive wins: `MONITOR_ONLY (1)` < `PLAN_ONLY (2)` < `AUTO_REMEDIATE (3)`.\n- **Static FinOps Safety Guards:** Enforces 128 KiB minimum transition size floor, MPU churn guard ($\\ge 7$d), tag/MPU contradiction separation, and Glacier ($\\ge 90$d) / Deep Archive ($\\ge 180$d) early deletion penalties.\n\n### CLI Usage Examples:\n\n```bash\n# Statically validate policy syntax and FinOps safety guards\ns3-guardian policy validate policy.yaml\n\n# Generate live plan preview with leaf merge and provenance tracking\ns3-guardian policy plan my-bucket --policy policy.yaml --out plan.json\n\n# Apply compiled lifecycle configuration to AWS S3 with UndoManifest\ns3-guardian policy apply my-bucket --policy policy.yaml --confirm\n\n# Audit declarative policy compliance across fleet buckets\ns3-guardian scan --all-buckets --policy policy.yaml\n```\n\n---\n\n## Full CLI Reference\n\n| Flag | Type | Default | Description |\n| :--- | :--- | :--- | :--- |\n| `policy validate <file>` | command | — | Statically validate JSON or Guardian YAML subset policy document |\n| `policy plan <bucket>` | command | — | Evaluate bucket tags, resolve precedence, and output preview |\n| `policy apply <bucket>` | command | — | Apply compiled configuration and write UndoManifest (requires `--confirm`) |\n| `--policy <file>` | string | — | Path to declarative storage policy file (JSON or YAML subset) |\n| `rollback <manifest>` | command | — | Invert mutation from UndoManifest with RFC 8785 state verification |\n| `certificate <cert>` | command | — | Format and display SOC 2 / ISO 27001 immutable deletion certificate |\n| `rehydrate <bucket>` | command | — | Safely pop Delete Markers to un-delete and restore hidden data versions |\n| `--force` | flag | `false` | Force rollback execution even if remote state has diverged |\n| `--dry-run` | flag | `false` | Simulate soft delete rehydration without deleting Delete Markers |\n| `state compact` | command | — | Compact active audit log into compressed snapshot and rotate log |\n| `state history <bucket>` | command | — | View synthesized historical FinOps metrics and audit events for a bucket |\n| `--state-dir <path>` | string | `.s3-guardian` | Path to persistent state directory for audit ledger and snapshots |\n| `--s3-mirror <bucket>` | string | — | S3 bucket destination to mirror compressed state snapshots |\n| `dashboard` / `tui` | command | — | Interactive terminal dashboard for fleet storage governance |\n| `--lens <source>` | string | — | Initialize dashboard triage or run macroscopic ranking from Storage Lens CSV export |\n| `--provider <name>` | string | auto | Target S3 provider (`aws`, `r2`, `wasabi`, `b2`, `minio`, `ceph`, `custom`) |\n| `--force-wasabi-early-delete` | flag | `false` | Bypass Wasabi 90-day retention guard for uploads/versions < 90 days old |\n| `--tf-file <path>` | string | — | Target Terraform `.tf` source file to compare against |\n| `--tfstate <path>` | string | — | Target `terraform.tfstate` JSON file |\n| `--patch` | flag | `false` | Output POSIX unified diff patch directly to stdout |\n| `--write` | flag | `false` | Atomically update the target `.tf` file in-place with patch applied |\n| `--daemon` | flag | `false` | Continuous in-process daemon execution mode |\n| `--interval <duration>` | string | `1h` | Interval between daemon runs (`10s`, `30m`, `1h`, `12h`, `24h`) |\n| `--once` | flag | `false` | Run exactly one iteration in daemon harness (validates lock & metrics) |\n| `--older-than <days>` | number | `7` | Age threshold in days for multipart uploads and versions |\n| `--include-versions` | flag | `false` | Scan and plan for noncurrent versions and expired delete markers |\n| `--audit-transitions` | flag | `false` | Audit lifecycle transitions for Glacier/IA small-object traps during scan |\n| `--out <file>` | string | `plan.json` | Destination path for plan output file |\n| `--plan <file>` | string | — | Path to plan file to execute |\n| `--confirm` | flag | `false` | Explicit confirmation required for destructive apply |\n| `--bypass-governance` | flag | `false` | Bypass S3 Object Lock GOVERNANCE mode retention |\n| `--bypass-mutation-ceiling` | flag | `false` | Bypass relative bucket mutation ceiling safety check (default <= 5%) |\n| `--no-canary` | flag | `false` | Skip pre-flight canary verification probe |\n| `--max-deletion-percent <pct>` | number | `5` | Custom relative mutation ceiling percentage (e.g. 10 for 10%) |\n| `--acknowledge-replication-divergence` | flag | `false` | Acknowledge replica divergence on CRR/SRR replicated buckets |\n| `--allow-active-churn` | flag | `false` | Allow deletion of uploads or versions modified within 24 hours |\n| `--all-buckets` | flag | `false` | Fleet mode: scan or remediate across all account buckets |\n| `--org` | flag | `false` | Multi-account sweep across AWS Organizations accounts |\n| `--role-name <name>` | string | `OrganizationAccountAccessRole` | IAM role assumed into member accounts |\n| `--accounts <ids>` | string | — | Comma-separated target AWS account IDs |\n| `--account-concurrency <n>` | number | `5` | Concurrent member account workers (max 5) |\n| `--endpoint <url>` | string | — | Custom endpoint URL for MinIO, Cloudflare R2, LocalStack |\n| `--force-path-style` | flag | `false` | Enable S3 path-style addressing |\n| `--max-waste-usd <amount>`| number | — | Policy gate: exit code 1 if total monthly waste exceeds threshold |\n| `--fail-on-unprotected` | flag | `false` | Policy gate: exit code 1 if any bucket lacks an MPU lifecycle rule |\n| `--format <fmt>` | string | `table` | Output format: `table`, `json`, `github`, `terraform`, `cloudformation` |\n| `--danger-direct-api-apply`| flag | `false` | Direct API mutation applying lifecycle rule to S3 |\n| `--webhook-url <url>` | string | — | Dispatch alerts to Slack, Discord, PagerDuty, or generic webhooks |\n| `--notify-always` | flag | `false` | Bypass alert circuit breaker ($0.00 waste suppression) |\n| `--checkpoint <s3-uri>` | string | — | S3 URI for resumable fleet scanning across execution limits |\n\n---\n\n## SemVer 2.0 Exit Code Contract\n\n`s3-guardian v2.0.0` establishes a strict, stable exit code contract across all CLI subcommands, operators, and CI/CD pipelines:\n\n| Exit Code | Classification | SemVer Contract Description |\n| :--- | :--- | :--- |\n| `0` | `SUCCESS` | Successful execution; scan clean, plan generated, apply completed, or policies satisfied |\n| `1` | `CONFIG_ARG_ERROR` | CLI configuration, syntax, or argument error (invalid duration, missing required bucket/manifest) |\n| `2` | `AUTH_IAM_ERROR` | Authentication failure, IAM AccessDenied, Organizations discovery failure, or STS AssumeRole rejection |\n| `3` | `POLICY_VIOLATION` | Declarative policy rule violation, policy validation invariant breach, `--max-waste-usd` exceeded, or unapproved IaC drift |\n| `4` | `CIRCUIT_CANARY_BLAST_RADIUS` | Circuit breaker tripped (OPEN), canary verification probe failed, relative blast radius ceiling breached, or Wasabi 90-day retention guard triggered |\n| `5` | `FS_STATE_ERROR` | Local or remote filesystem / state store corruption, unreadable state file, or I/O failure |\n| `6` | `NETWORK_TIMEOUT` | Network connection refused, DNS timeout, socket timeout (`ETIMEDOUT`), or AWS SDK `TimeoutError` |\n\n---\n\n## Production Safety Matrix\n\n| Threat / Invariant | Risk Level | Defense Mechanism | Override Flag |\n| :--- | :--- | :--- | :--- |\n| **Object Lock COMPLIANCE** | `CRITICAL_BLOCKED` | Hard abort before sending API calls. Deletions strictly forbidden. | None (Immutable) |\n| **Object Lock GOVERNANCE** | `HIGH` | Verified via `GetObjectLockConfiguration`. Header withheld unless verified. | `--bypass-governance` |\n| **Proportional Mutation Ceiling** | `POLICY_VIOLATION` | Caps deletions to <= 5% of bucket inventory (or 1,000 objects fallback). | `--bypass-mutation-ceiling` |\n| **Canary Verification Gate Failure** | `POLICY_VIOLATION` | 10 oldest targets pre-flight probed via HeadObject before batch execution. | `--no-canary` |\n| **Circuit Breaker (403 Cliff)** | `OPEN` | Trips immediately after 3 consecutive AccessDenied errors to prevent IAM hammering. | Fix IAM permissions |\n| **Circuit Breaker (503 Throttling)** | `ADAPTIVE` | Halves concurrency; trips to OPEN on burst (>= 3 in 5s) or >10% sustained error rate. | Automatic backoff |\n| **Circuit Breaker (400 BadDigest)** | `QUARANTINE` | Immediate trip to OPEN and bucket quarantine on checksum mismatch / integrity corruption. | Investigate corruption |\n| **Replication Divergence** | `HIGH` | Detects CRR/SRR rules via `GetBucketReplication`. Prevents replica drift. | `--acknowledge-replication-divergence` |\n| **Protected State Prefixes** | `CRITICAL_BLOCKED` | Hard-blocks `checkpoints/`, `_wal/`, `iceberg/`, `manifests/`, `state/`. | None (Immutable) |\n| **Protected Bucket Tags** | `CRITICAL_BLOCKED` | Excludes `s3-guardian:ignore=true`, `Backup=true`, `Protection=locked`. | Remove tag in AWS |\n| **Active Pipeline Churn** | `HIGH` | Blocks deletion of uploads or versions initiated within 24 hours. | `--allow-active-churn` |\n| **Wasabi Early Deletion Guard** | `HIGH` | Blocks deletion of objects or uploads < 90 days old to avoid Timed Deleted fees. | `--force-wasabi-early-delete` |\n| **Plan Tampering** | `POLICY_VIOLATION` | RFC 8785 JCS canonicalization with SHA-256 target hash verification. | Re-generate plan |\n| **S3 503 Throttling** | Handled | Exponential backoff with full jitter (Decorrelated Jitter). | Automatic |\n\n---\n\n## License\n\nMIT © Google Antigravity & contributors.\n\n","readmeFilename":"README.md"}