feat(storage): purge soft-deleted buckets

[designcode]

Summary

Adds the destructive counterpart of restoreBucket / tigris buckets restore: permanently destroying a soft-deleted bucket before its retention period expires.

• @tigrisdata/storage: purgeBucket(name, { config }) → { bucket, purged: true }. Sends DeleteBucket with X-Tigris-Force-Hard-Delete: true (new TigrisHeaders.FORCE_HARD_DELETE), the gateway's hard-delete path for buckets in the soft-delete state; it refuses a live bucket (InvalidArgument: bucket is not in soft-delete state) rather than deleting it, and the gateway's message is passed through unwrapped.
• tigris buckets purge <name,...> (alias pg): the buckets delete batch pattern — one confirmation naming every bucket ("… It/They can no longer be restored."), each purged in turn, failures reported per bucket without stopping the rest, non-zero exit if any failed; --yes/--force skip the prompt; --format json gives { action: 'purged', names, errors }. Listed under Basics next to restore.

$ tigris buckets purge old-bucket
? Permanently destroy soft-deleted bucket 'old-bucket'? It can no longer be restored. › yes
✔ Bucket 'old-bucket' purged
→ tigris buckets list --deleted   List the remaining soft-deleted buckets

Test plan

• Storage integration tests in the softDelete block: soft-delete → purge → gone from both the deleted and live listings; purging a live bucket returns the "soft-delete state" error and leaves it in place
• CLI unit tests for the handler (confirmation text single/batch, order + JSON, partial failure → exit 1, declined → Aborted, missing name); specs-completeness passes
• Verified live against the gateway on a soft-deleted bucket
• tsc, Biome, README regenerated

🤖 Generated with Claude Code

---

Note

Medium Risk
Introduces irreversible bucket destruction, but the gateway should refuse live buckets and the CLI requires explicit confirmation unless --yes is used.

Overview
Adds the destructive counterpart to soft-deleted bucket restore: permanently remove buckets that are already in the soft-delete state before retention expires.

@tigrisdata/storage exposes purgeBucket, which issues S3 DeleteBucket with the new X-Tigris-Force-Hard-Delete header (TigrisHeaders.FORCE_HARD_DELETE). The gateway is expected to hard-delete only soft-deleted buckets and reject live ones.

CLI adds tigris buckets purge (alias pg): supports one or more bucket names, interactive confirmation (or --yes / --force), per-bucket errors without stopping the batch, JSON output, and non-zero exit on any failure. Specs, README, and changesets are updated; storage integration and CLI unit tests cover success, rejection of non–soft-deleted buckets, and batch/partial-failure behavior.

^{Reviewed by Cursor Bugbot for commit b1d9870. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Confidence Score: 5/5

[Medium risk] Adds permanent bucket deletion feature to storage and CLI.

This PR appears safe to merge; no actionable issues were found.

What we checked:

• Batch names reach the handler: The dispatcher splits positional arguments marked multiple into trimmed names before calling the handler.

Summary

Adds permanent deletion of soft-deleted buckets through purgeBucket and tigris buckets purge.

• The SDK sends the hard-delete header and returns gateway errors unchanged.
• The CLI confirms the named buckets, supports batches, and reports partial failures.
• Tests cover successful purge, live-bucket rejection, confirmation, and batch results.

_{Reviews (1) · Last reviewed commit: "feat(storage): purge soft-deleted bucket..." · Reviewed by Greptile}