Investigate: April 2026 AWS bill spike (~$700, suspect S3 egress from registry publishes)

Context

April 2026 AWS bill came in around $700 — significantly higher than baseline. Working hypothesis: S3 data transfer (egress) from publishing packages to our private registry, since publish frequency has been high across the ecosystem.

What to investigate

1. Cost Explorer breakdown by service — confirm S3 is the dominant line, not surprise EC2/CloudFront/data-transfer-out elsewhere.
2. S3 by bucket — which bucket is doing the most egress? The registry bucket should be the suspect.
3. S3 by usage type — separate DataTransfer-Out-Bytes from Requests-Tier1/2. Egress is what scales with downloads, requests scale with publish count.
4. Cross-reference with publish frequency — count npm publish / pantry releases in April. If 10x last month, we found it.
5. Object size audit — any tarballs >50MB pushed to the registry would inflate egress on every download. (.pantryignore was added to ts-countries for exactly this reason.)

Why this matters

Even if April turns out to be a one-off, we don't have a shared answer to "what's costing us money this month." That's the gap the cost-reporting CLI (separate issue) closes — but this issue is the one-time forensic dig that confirms or refutes the registry-egress hypothesis and tells us where to look first when the CLI gets built.

Acceptance

• Root cause identified and posted in this issue (with a CSV/screenshot from Cost Explorer)
• If registry egress confirmed: short-term mitigation logged (CDN in front of registry? bigger pantryignore sweep? colder storage class for old versions?)
• Findings feed into the cost-reporting CLI scope (linked issue)