Prisma.Bucket reference

Bucket

Source: src/Prisma/Bucket.ts

A Prisma Object Store bucket inside a Prisma project.

Project, name, and branch changes replace the bucket because the Management API has no bucket update operation. Destroying this resource deletes the bucket, its objects, and any remaining access keys — the Management API cascades the deletion server-side.

Bucket: Creating a Bucket

const bucket = yield* Prisma.Bucket("uploads", {
  project,
  name: "uploads",
});

Bucket: Accessing a Bucket

const key = yield* Prisma.BucketAccessKey("uploads-key", {
  bucket,
  role: "read_write",
});

BucketAccessKey

Source: src/Prisma/BucketAccessKey.ts

An access key for a Prisma Object Store bucket, yielding S3 credentials.

Prisma returns the secret access key only in the create response, so Alchemy stores it as a Redacted value and treats persisted state as authoritative: once created, the secret is never re-read from the API. Changing the bucket, name, or role replaces the key with fresh credentials.

BucketAccessKey: Creating a Bucket Access Key

const key = yield* Prisma.BucketAccessKey("uploads-key", {
  bucket,
  role: "read_write",
});

BucketAccessKey: Binding to Platforms

const app = yield* Prisma.Compute("api", {
  project,
  path: "./apps/api",
  env: {
    S3_ENDPOINT: key.endpoint,
    S3_BUCKET: key.bucketName,
    S3_ACCESS_KEY_ID: key.accessKeyId,
    S3_SECRET_ACCESS_KEY: key.secretAccessKey,
  },
});

ReadBucket

Source: src/Prisma/ReadBucket.ts

Bind a Prisma Object Store Bucket to a Prisma Compute app, AWS Lambda Function, or Cloudflare Worker with read-only access, and obtain the typed runtime client.

Binding creates a read-scoped Prisma.BucketAccessKey for the bucket and carries its S3 credentials into the host environment, so the caller never handles a credential themselves.

Provide ReadBucketBinding on the host implementation.

Prisma bucket keys carry one of two coarse roles, read and read_write. This binding mints the read one, so the credential it puts in the host environment cannot write, and ReadBucketClient exposes no write operations either.

ReadBucket: Binding a Bucket

export default Prisma.Compute(
  "api",
  { project, main: import.meta.filename },
  Effect.gen(function* () {
    const uploads = yield* Prisma.ReadBucket(bucket);

    return {
      fetch: Effect.gen(function* () {
        const object = yield* uploads.get("reports/2026.json");
        return yield* HttpServerResponse.json(
          object === null ? null : yield* object.json(),
        );
      }),
    };
  }).pipe(Effect.provide(Prisma.ReadBucketBinding)),
);

ReadWriteBucket

Source: src/Prisma/ReadWriteBucket.ts

Bind a Prisma Object Store Bucket to a Prisma Compute app, AWS Lambda Function, or Cloudflare Worker with read and write access, and obtain the typed runtime client.

Binding creates a read-write Prisma.BucketAccessKey for the bucket and carries its S3 credentials into the host environment, so the caller never handles a credential themselves.

Provide ReadWriteBucketBinding on the host implementation.

Use ReadBucket instead where read-only access is enough: Prisma bucket keys have a read role, so that binding’s credential genuinely cannot write.

ReadWriteBucket: Binding a Bucket

export default Prisma.Compute(
  "api",
  { project, main: import.meta.filename },
  Effect.gen(function* () {
    const uploads = yield* Prisma.ReadWriteBucket(bucket);

    return {
      fetch: Effect.gen(function* () {
        yield* uploads.put("hits", "1");
        const object = yield* uploads.get("hits");
        return yield* HttpServerResponse.text(
          object === null ? "" : yield* object.text(),
        );
      }),
    };
  }).pipe(Effect.provide(Prisma.ReadWriteBucketBinding)),
);

WriteBucket

Source: src/Prisma/WriteBucket.ts

Bind a Prisma Object Store Bucket to a Prisma Compute app, AWS Lambda Function, or Cloudflare Worker with write access, and obtain the typed runtime client.

Binding creates a Prisma.BucketAccessKey for the bucket and carries its S3 credentials into the host environment, so the caller never handles a credential themselves.

Provide WriteBucketBinding on the host implementation.

Role caveat. Prisma bucket keys carry one of two coarse roles, read and read_write; there is no write-only role. This binding therefore mints a read_write key, and the credential it puts in the host environment can also read. The write-only contract is enforced client-side — WriteBucketClient exposes no read operations — and becomes a server-side boundary if Prisma grows a write-only role.

WriteBucket: Binding a Bucket

export default Prisma.Compute(
  "api",
  { project, main: import.meta.filename },
  Effect.gen(function* () {
    const uploads = yield* Prisma.WriteBucket(bucket);

    return {
      fetch: Effect.gen(function* () {
        yield* uploads.put("reports/2026.json", JSON.stringify({ ok: true }), {
          contentType: "application/json",
        });
        return yield* HttpServerResponse.empty({ status: 204 });
      }),
    };
  }).pipe(Effect.provide(Prisma.WriteBucketBinding)),
);