@prisma/cli 3.0.0-dev.129.1 → 3.0.0-dev.131.1

package/README.md

@@ -76,6 +76,8 @@ The beta package exposes `prisma-cli` so it can coexist with the existing
 | `project` | List projects, show the resolved project, and manage project environment variables. |
 | `git` | Connect or disconnect a project from a GitHub repository. |
 | `branch` | List Prisma branches for the resolved project. |
+| `database` | Create, inspect, and remove Prisma Postgres databases and their connection strings. |
+| `bucket` | Create, list, and delete Tigris object-store buckets and their access keys. |
 | `app` | Build, run, deploy, inspect, open, stream logs, promote, roll back, and remove apps. |
 
 Common examples:

package/dist/adapters/mock-api.js

@@ -227,6 +227,79 @@ var MockApi = class MockApi {
 			connectionString
 		};
 	}
+	listBucketsForProject(projectId, branchName) {
+		return (this.data.buckets ?? []).filter((bucket) => bucket.projectId === projectId && (!branchName || this.data.branches.find((branch) => branch.id === bucket.branchId && branch.name === branchName)));
+	}
+	getBucket(bucketId) {
+		return (this.data.buckets ?? []).find((bucket) => bucket.id === bucketId);
+	}
+	createBucket(input) {
+		this.data.buckets ??= [];
+		let branchId = null;
+		if (input.branchGitName) {
+			const branch = this.data.branches.find((b) => b.projectId === input.projectId && b.name === input.branchGitName);
+			if (!branch) return;
+			branchId = branch.id;
+		}
+		const bucket = {
+			id: `bkt_${this.data.buckets.length + 1e3}`,
+			projectId: input.projectId,
+			branchId,
+			name: input.name ?? `bucket-${this.data.buckets.length + 1e3}`,
+			status: "ready",
+			createdAt: "2026-06-09T00:00:00.000Z"
+		};
+		this.data.buckets.push(bucket);
+		return bucket;
+	}
+	deleteBucket(bucketId) {
+		this.data.buckets ??= [];
+		this.data.bucketKeys ??= [];
+		const bucket = this.getBucket(bucketId);
+		if (!bucket) return;
+		this.data.buckets = this.data.buckets.filter((candidate) => candidate.id !== bucketId);
+		this.data.bucketKeys = this.data.bucketKeys.filter((key) => key.bucketId !== bucketId);
+		return bucket;
+	}
+	listBucketKeys(bucketId) {
+		return (this.data.bucketKeys ?? []).filter((key) => key.bucketId === bucketId);
+	}
+	createBucketKey(input) {
+		const bucket = this.getBucket(input.bucketId);
+		if (!bucket) return;
+		this.data.bucketKeys ??= [];
+		const secretAccessKey = `secret-${input.bucketId}-${this.data.bucketKeys.length + 1}`;
+		const accessKeyId = `AKIA${input.bucketId.toUpperCase().replace(/_/g, "")}${this.data.bucketKeys.length + 1}`;
+		const endpoint = `https://fly.storage.tigris.dev`;
+		const bucketName = bucket.name;
+		const key = {
+			id: `bkey_${this.data.bucketKeys.length + 1e3}`,
+			bucketId: input.bucketId,
+			name: input.name ?? `key-${this.data.bucketKeys.length + 1e3}`,
+			role: input.role,
+			valueHint: `${accessKeyId.slice(0, 8)}...`,
+			createdAt: "2026-06-09T00:00:00.000Z",
+			secretAccessKey,
+			accessKeyId,
+			endpoint,
+			bucketName
+		};
+		this.data.bucketKeys.push(key);
+		return {
+			key,
+			secretAccessKey,
+			accessKeyId,
+			endpoint,
+			bucketName
+		};
+	}
+	deleteBucketKey(bucketId, keyId) {
+		this.data.bucketKeys ??= [];
+		const key = (this.data.bucketKeys ?? []).find((candidate) => candidate.id === keyId && candidate.bucketId === bucketId);
+		if (!key) return;
+		this.data.bucketKeys = this.data.bucketKeys.filter((candidate) => candidate.id !== keyId);
+		return key;
+	}
 };
 //#endregion
 export { MockApi };

package/dist/cli2.js

@@ -9,6 +9,7 @@ import "./shell/prompt.js";
 import { createAppCommand } from "./commands/app/index.js";
 import { createAuthCommand } from "./commands/auth/index.js";
 import { createBranchCommand } from "./commands/branch/index.js";
+import { createBucketCommand } from "./commands/bucket/index.js";
 import { createBuildCommand } from "./commands/build/index.js";
 import { createDatabaseCommand } from "./commands/database/index.js";
 import { getCliName, getCliVersion } from "./lib/version.js";
@@ -67,6 +68,7 @@ function createProgram(runtime) {
 	program.addCommand(createBranchCommand(runtime));
 	program.addCommand(createBuildCommand(runtime));
 	program.addCommand(createDatabaseCommand(runtime));
+	program.addCommand(createBucketCommand(runtime));
 	program.addCommand(createAppCommand(runtime));
 	return program;
 }

package/dist/commands/bucket/index.js

@@ -0,0 +1,121 @@
+import { attachCommandDescriptor } from "../../shell/command-meta.js";
+import { addCompactGlobalFlags, addGlobalFlags } from "../../shell/global-flags.js";
+import { configureRuntimeCommand } from "../../shell/runtime.js";
+import { runCommand } from "../../shell/command-runner.js";
+import { runBucketCreate, runBucketDelete, runBucketKeyCreate, runBucketKeyDelete, runBucketKeyList, runBucketList } from "../../controllers/bucket.js";
+import { renderBucketCreate, renderBucketDelete, renderBucketKeyCreate, renderBucketKeyCreateStdout, renderBucketKeyDelete, renderBucketKeyList, renderBucketList, serializeBucketCreate, serializeBucketDelete, serializeBucketKeyCreate, serializeBucketKeyDelete, serializeBucketKeyList, serializeBucketList } from "../../presenters/bucket.js";
+import { Command, Option } from "commander";
+//#region src/commands/bucket/index.ts
+function createBucketCommand(runtime) {
+	const bucket = attachCommandDescriptor(configureRuntimeCommand(new Command("bucket"), runtime), "bucket");
+	addCompactGlobalFlags(bucket);
+	bucket.addCommand(createBucketListCommand(runtime));
+	bucket.addCommand(createBucketCreateCommand(runtime));
+	bucket.addCommand(createBucketDeleteCommand(runtime));
+	bucket.addCommand(createBucketKeyCommand(runtime));
+	return bucket;
+}
+function addProjectAndBranchOptions(command) {
+	return command.addOption(new Option("--project <id-or-name>", "Project id or name")).addOption(new Option("--branch <git-name>", "Branch git name"));
+}
+function createBucketListCommand(runtime) {
+	const command = attachCommandDescriptor(configureRuntimeCommand(new Command("list"), runtime), "bucket.list");
+	addProjectAndBranchOptions(command);
+	addGlobalFlags(command);
+	command.action(async (options) => {
+		const projectRef = options.project;
+		const branchName = options.branch;
+		await runCommand(runtime, "bucket.list", options, (context) => runBucketList(context, {
+			projectRef,
+			branchName
+		}), {
+			renderHuman: (context, descriptor, result) => renderBucketList(context, descriptor, result),
+			renderJson: (result) => serializeBucketList(result)
+		});
+	});
+	return command;
+}
+function createBucketCreateCommand(runtime) {
+	const command = attachCommandDescriptor(configureRuntimeCommand(new Command("create"), runtime), "bucket.create");
+	command.addOption(new Option("--name <name>", "Bucket display name (auto-generated if omitted)"));
+	addProjectAndBranchOptions(command);
+	addGlobalFlags(command);
+	command.action(async (options) => {
+		const projectRef = options.project;
+		const branchName = options.branch;
+		const name = options.name;
+		await runCommand(runtime, "bucket.create", options, (context) => runBucketCreate(context, {
+			projectRef,
+			branchName,
+			name
+		}), {
+			renderHuman: (context, descriptor, result) => renderBucketCreate(context, descriptor, result),
+			renderJson: (result) => serializeBucketCreate(result)
+		});
+	});
+	return command;
+}
+function createBucketDeleteCommand(runtime) {
+	const command = attachCommandDescriptor(configureRuntimeCommand(new Command("delete"), runtime), "bucket.delete");
+	command.argument("<bucketId>", "Bucket id");
+	addGlobalFlags(command);
+	command.action(async (bucketId, options) => {
+		await runCommand(runtime, "bucket.delete", options, (context) => runBucketDelete(context, bucketId), {
+			renderHuman: (context, descriptor, result) => renderBucketDelete(context, descriptor, result),
+			renderJson: (result) => serializeBucketDelete(result)
+		});
+	});
+	return command;
+}
+function createBucketKeyCommand(runtime) {
+	const key = attachCommandDescriptor(configureRuntimeCommand(new Command("key"), runtime), "bucket.key");
+	addCompactGlobalFlags(key);
+	key.addCommand(createBucketKeyListCommand(runtime));
+	key.addCommand(createBucketKeyCreateCommand(runtime));
+	key.addCommand(createBucketKeyDeleteCommand(runtime));
+	return key;
+}
+function createBucketKeyListCommand(runtime) {
+	const command = attachCommandDescriptor(configureRuntimeCommand(new Command("list"), runtime), "bucket.key.list");
+	command.argument("<bucketId>", "Bucket id");
+	addGlobalFlags(command);
+	command.action(async (bucketId, options) => {
+		await runCommand(runtime, "bucket.key.list", options, (context) => runBucketKeyList(context, bucketId), {
+			renderHuman: (context, descriptor, result) => renderBucketKeyList(context, descriptor, result),
+			renderJson: (result) => serializeBucketKeyList(result)
+		});
+	});
+	return command;
+}
+function createBucketKeyCreateCommand(runtime) {
+	const command = attachCommandDescriptor(configureRuntimeCommand(new Command("create"), runtime), "bucket.key.create");
+	command.argument("<bucketId>", "Bucket id").addOption(new Option("--role <role>", "Access role (default: read_write)").choices(["read", "read_write"])).addOption(new Option("--name <name>", "Key display name (auto-generated if omitted)"));
+	addGlobalFlags(command);
+	command.action(async (bucketId, options) => {
+		const role = options.role;
+		const name = options.name;
+		await runCommand(runtime, "bucket.key.create", options, (context) => runBucketKeyCreate(context, bucketId, {
+			role,
+			name
+		}), {
+			renderStdout: (context, descriptor, result) => renderBucketKeyCreateStdout(context, descriptor, result),
+			renderHuman: (context, descriptor, result) => renderBucketKeyCreate(context, descriptor, result),
+			renderJson: (result) => serializeBucketKeyCreate(result)
+		});
+	});
+	return command;
+}
+function createBucketKeyDeleteCommand(runtime) {
+	const command = attachCommandDescriptor(configureRuntimeCommand(new Command("delete"), runtime), "bucket.key.delete");
+	command.argument("<bucketId>", "Bucket id").argument("<keyId>", "Key id");
+	addGlobalFlags(command);
+	command.action(async (bucketId, keyId, options) => {
+		await runCommand(runtime, "bucket.key.delete", options, (context) => runBucketKeyDelete(context, bucketId, keyId), {
+			renderHuman: (context, descriptor, result) => renderBucketKeyDelete(context, descriptor, result),
+			renderJson: (result) => serializeBucketKeyDelete(result)
+		});
+	});
+	return command;
+}
+//#endregion
+export { createBucketCommand };

package/dist/controllers/bucket.js

@@ -0,0 +1,265 @@
+import { CliError, authRequiredError, workspaceRequiredError } from "../shell/errors.js";
+import { projectResolutionErrorToCliError, resolveProjectTarget } from "../lib/project/resolution.js";
+import { requireComputeAuth } from "../lib/auth/guard.js";
+import { requireAuthenticatedAuthState } from "./auth.js";
+import { listFixtureWorkspaceProjects, listRealWorkspaceProjects } from "./project.js";
+import { createManagementBucketProvider, normalizeBucket, normalizeKey } from "../lib/bucket/provider.js";
+//#region src/controllers/bucket.ts
+function isRealMode(context) {
+	return !context.runtime.fixturePath && !context.runtime.env.PRISMA_CLI_MOCK_FIXTURE_PATH;
+}
+async function runBucketList(context, flags) {
+	const { provider, target } = await requireBucketContext(context, flags, "bucket list");
+	const buckets = await provider.listBuckets({
+		projectId: target.project.id,
+		branchName: flags.branchName,
+		signal: context.runtime.signal
+	});
+	return {
+		command: "bucket.list",
+		result: {
+			projectId: target.project.id,
+			projectName: target.project.name,
+			branchName: flags.branchName ?? null,
+			verboseContext: target,
+			buckets
+		},
+		warnings: [],
+		nextSteps: []
+	};
+}
+async function runBucketCreate(context, flags) {
+	const { provider, target } = await requireBucketContext(context, flags, "bucket create");
+	const bucket = await provider.createBucket({
+		projectId: target.project.id,
+		name: flags.name?.trim() || void 0,
+		branchGitName: flags.branchName,
+		signal: context.runtime.signal
+	});
+	return {
+		command: "bucket.create",
+		result: {
+			projectId: target.project.id,
+			projectName: target.project.name,
+			verboseContext: target,
+			bucket
+		},
+		warnings: [],
+		nextSteps: []
+	};
+}
+async function runBucketDelete(context, bucketId) {
+	const id = bucketId.trim();
+	if (!id) throw new CliError({
+		code: "USAGE_ERROR",
+		domain: "bucket",
+		summary: "Bucket id required",
+		why: "Bucket deletion needs a bucket id.",
+		fix: "Pass the bucket id to delete.",
+		exitCode: 2,
+		nextSteps: ["prisma-cli bucket list"]
+	});
+	await (await requireBucketProviderOnly(context)).deleteBucket(id, { signal: context.runtime.signal });
+	return {
+		command: "bucket.delete",
+		result: { bucket: { id } },
+		warnings: [],
+		nextSteps: []
+	};
+}
+async function runBucketKeyList(context, bucketId) {
+	const id = bucketId.trim();
+	if (!id) throw new CliError({
+		code: "USAGE_ERROR",
+		domain: "bucket",
+		summary: "Bucket id required",
+		why: "Bucket key listing needs a bucket id.",
+		fix: "Pass the bucket id.",
+		exitCode: 2,
+		nextSteps: ["prisma-cli bucket list"]
+	});
+	return {
+		command: "bucket.key.list",
+		result: {
+			bucketId: id,
+			keys: await (await requireBucketProviderOnly(context)).listKeys(id, { signal: context.runtime.signal })
+		},
+		warnings: [],
+		nextSteps: []
+	};
+}
+async function runBucketKeyCreate(context, bucketId, flags) {
+	const id = bucketId.trim();
+	if (!id) throw new CliError({
+		code: "USAGE_ERROR",
+		domain: "bucket",
+		summary: "Bucket id required",
+		why: "Bucket key creation needs a bucket id.",
+		fix: "Pass the bucket id.",
+		exitCode: 2,
+		nextSteps: ["prisma-cli bucket list"]
+	});
+	const role = resolveKeyRole(flags.role);
+	const created = await (await requireBucketProviderOnly(context)).createKey({
+		bucketId: id,
+		name: flags.name?.trim() || void 0,
+		role,
+		signal: context.runtime.signal
+	});
+	return {
+		command: "bucket.key.create",
+		result: {
+			bucketId: id,
+			key: created.key,
+			secretAccessKey: created.secretAccessKey,
+			accessKeyId: created.accessKeyId,
+			endpoint: created.endpoint,
+			bucketName: created.bucketName
+		},
+		warnings: [],
+		nextSteps: []
+	};
+}
+async function runBucketKeyDelete(context, bucketId, keyId) {
+	const bktId = bucketId.trim();
+	const kId = keyId.trim();
+	if (!bktId || !kId) throw new CliError({
+		code: "USAGE_ERROR",
+		domain: "bucket",
+		summary: "Bucket id and key id required",
+		why: "Bucket key deletion needs both a bucket id and a key id.",
+		fix: "Pass the bucket id and key id.",
+		exitCode: 2,
+		nextSteps: ["prisma-cli bucket key list <bucketId>"]
+	});
+	await (await requireBucketProviderOnly(context)).deleteKey(bktId, kId, { signal: context.runtime.signal });
+	return {
+		command: "bucket.key.delete",
+		result: { key: { id: kId } },
+		warnings: [],
+		nextSteps: []
+	};
+}
+async function resolveBucketProvider(context) {
+	if (isRealMode(context)) {
+		const client = await requireComputeAuth(context.runtime.env, context.runtime.signal);
+		if (!client) throw authRequiredError();
+		return createManagementBucketProvider(client);
+	}
+	return createFixtureBucketProvider(context);
+}
+async function requireBucketContext(context, flags, commandName) {
+	const workspace = (await requireAuthenticatedAuthState(context)).workspace;
+	if (!workspace) throw workspaceRequiredError();
+	if (isRealMode(context)) {
+		const client = await requireComputeAuth(context.runtime.env, context.runtime.signal);
+		if (!client) throw authRequiredError();
+		const targetResult = await resolveProjectTarget({
+			context,
+			workspace,
+			explicitProject: flags.projectRef,
+			listProjects: () => listRealWorkspaceProjects(client, workspace, context.runtime.signal),
+			commandName
+		});
+		if (targetResult.isErr()) throw projectResolutionErrorToCliError(targetResult.error);
+		return {
+			provider: createManagementBucketProvider(client),
+			target: targetResult.value
+		};
+	}
+	const targetResult = await resolveProjectTarget({
+		context,
+		workspace,
+		explicitProject: flags.projectRef,
+		listProjects: async () => listFixtureWorkspaceProjects(context, workspace),
+		commandName
+	});
+	if (targetResult.isErr()) throw projectResolutionErrorToCliError(targetResult.error);
+	return {
+		provider: createFixtureBucketProvider(context),
+		target: targetResult.value
+	};
+}
+async function requireBucketProviderOnly(context) {
+	await requireAuthenticatedAuthState(context);
+	return resolveBucketProvider(context);
+}
+function createFixtureBucketProvider(context) {
+	return {
+		async listBuckets(options) {
+			return context.api.listBucketsForProject(options.projectId, options.branchName).map((bucket) => normalizeBucket(bucket));
+		},
+		async createBucket(options) {
+			const created = context.api.createBucket({
+				projectId: options.projectId,
+				name: options.name,
+				branchGitName: options.branchGitName
+			});
+			if (!created) throw branchNotFoundError(options.branchGitName ?? "");
+			return normalizeBucket(created);
+		},
+		async deleteBucket(bucketId) {
+			if (!context.api.deleteBucket(bucketId)) throw bucketNotFoundError(bucketId);
+		},
+		async listKeys(bucketId) {
+			if (!context.api.getBucket(bucketId)) throw bucketNotFoundError(bucketId);
+			return context.api.listBucketKeys(bucketId).map((key) => normalizeKey(key));
+		},
+		async createKey(options) {
+			const created = context.api.createBucketKey({
+				bucketId: options.bucketId,
+				name: options.name,
+				role: options.role
+			});
+			if (!created) throw bucketNotFoundError(options.bucketId);
+			return {
+				key: normalizeKey(created.key),
+				secretAccessKey: created.secretAccessKey,
+				accessKeyId: created.accessKeyId,
+				endpoint: created.endpoint,
+				bucketName: created.bucketName
+			};
+		},
+		async deleteKey(bucketId, keyId) {
+			if (!context.api.deleteBucketKey(bucketId, keyId)) throw keyNotFoundError(keyId, bucketId);
+		}
+	};
+}
+function resolveKeyRole(role) {
+	return role === "read" ? "read" : "read_write";
+}
+function branchNotFoundError(branchGitName) {
+	return new CliError({
+		code: "BRANCH_NOT_FOUND",
+		domain: "bucket",
+		summary: "Branch not found",
+		why: `No branch matched "${branchGitName}" in the resolved project.`,
+		fix: "Pass a branch git name from prisma-cli branch list.",
+		exitCode: 1,
+		nextSteps: ["prisma-cli branch list"]
+	});
+}
+function bucketNotFoundError(bucketId) {
+	return new CliError({
+		code: "BUCKET_NOT_FOUND",
+		domain: "bucket",
+		summary: "Bucket not found",
+		why: `No bucket matched "${bucketId}".`,
+		fix: "Pass a bucket id from prisma-cli bucket list.",
+		exitCode: 1,
+		nextSteps: ["prisma-cli bucket list"]
+	});
+}
+function keyNotFoundError(keyId, bucketId) {
+	return new CliError({
+		code: "BUCKET_KEY_NOT_FOUND",
+		domain: "bucket",
+		summary: "Bucket key not found",
+		why: `No key matched "${keyId}" for bucket "${bucketId}".`,
+		fix: "Pass a key id from prisma-cli bucket key list <bucketId>.",
+		exitCode: 1,
+		nextSteps: [`prisma-cli bucket key list ${bucketId}`]
+	});
+}
+//#endregion
+export { runBucketCreate, runBucketDelete, runBucketKeyCreate, runBucketKeyDelete, runBucketKeyList, runBucketList };

package/dist/lib/bucket/provider.js

@@ -0,0 +1,139 @@
+import { CliError } from "../../shell/errors.js";
+//#region src/lib/bucket/provider.ts
+function createManagementBucketProvider(client) {
+	return {
+		async listBuckets(options) {
+			const buckets = [];
+			let cursor;
+			while (true) {
+				const result = await client.GET("/v1/buckets", {
+					params: { query: {
+						projectId: options.projectId,
+						branchGitName: options.branchName,
+						cursor
+					} },
+					signal: options.signal
+				});
+				if (result.error || !result.data) throw bucketApiError("Failed to list buckets", result.response, result.error);
+				const data = result.data;
+				buckets.push(...data.data);
+				if (!data.pagination.hasMore || !data.pagination.nextCursor) break;
+				cursor = data.pagination.nextCursor;
+			}
+			return buckets.map(normalizeBucket);
+		},
+		async createBucket(options) {
+			const result = await client.POST("/v1/buckets", {
+				body: {
+					projectId: options.projectId,
+					...options.name ? { name: options.name } : {},
+					...options.branchGitName ? { branchGitName: options.branchGitName } : {}
+				},
+				signal: options.signal
+			});
+			if (result.error || !result.data) throw bucketApiError("Failed to create bucket", result.response, result.error);
+			const data = result.data;
+			return normalizeBucket(data.data);
+		},
+		async deleteBucket(bucketId, options) {
+			const result = await client.DELETE("/v1/buckets/{bucketId}", {
+				params: { path: { bucketId } },
+				signal: options?.signal
+			});
+			if (result.error) throw bucketApiError("Failed to delete bucket", result.response, result.error);
+		},
+		async listKeys(bucketId, options) {
+			const keys = [];
+			let cursor;
+			while (true) {
+				const result = await client.GET("/v1/buckets/{bucketId}/keys", {
+					params: {
+						path: { bucketId },
+						query: { cursor }
+					},
+					signal: options?.signal
+				});
+				if (result.error || !result.data) throw bucketApiError("Failed to list bucket keys", result.response, result.error);
+				const data = result.data;
+				keys.push(...data.data);
+				if (!data.pagination.hasMore || !data.pagination.nextCursor) break;
+				cursor = data.pagination.nextCursor;
+			}
+			return keys.map(normalizeKey);
+		},
+		async createKey(options) {
+			const result = await client.POST("/v1/buckets/{bucketId}/keys", {
+				params: { path: { bucketId: options.bucketId } },
+				body: {
+					role: options.role,
+					...options.name ? { name: options.name } : {}
+				},
+				signal: options.signal
+			});
+			if (result.error || !result.data) throw bucketApiError("Failed to create bucket key", result.response, result.error);
+			const raw = result.data.data;
+			const secretAccessKey = raw.secretAccessKey;
+			const accessKeyId = raw.accessKeyId;
+			const endpoint = raw.endpoint;
+			const bucketName = raw.bucketName;
+			if (!secretAccessKey || !accessKeyId || !endpoint || !bucketName) throw new CliError({
+				code: "BUCKET_KEY_SECRET_MISSING",
+				domain: "bucket",
+				summary: "Created bucket key did not return credentials",
+				why: "Bucket key credentials are one-time-view secrets, but the Management API did not include them in this create response.",
+				fix: "Create another bucket key and store the returned credentials immediately.",
+				exitCode: 1,
+				nextSteps: [`prisma-cli bucket key create ${options.bucketId}`]
+			});
+			return {
+				key: normalizeKey(raw),
+				secretAccessKey,
+				accessKeyId,
+				endpoint,
+				bucketName
+			};
+		},
+		async deleteKey(bucketId, keyId, options) {
+			const result = await client.DELETE("/v1/buckets/{bucketId}/keys/{keyId}", {
+				params: { path: {
+					bucketId,
+					keyId
+				} },
+				signal: options?.signal
+			});
+			if (result.error) throw bucketApiError("Failed to delete bucket key", result.response, result.error);
+		}
+	};
+}
+function normalizeBucket(raw) {
+	return {
+		id: raw.id,
+		name: raw.name,
+		status: raw.status,
+		branchId: raw.branchId,
+		createdAt: raw.createdAt
+	};
+}
+function normalizeKey(raw) {
+	return {
+		id: raw.id,
+		name: raw.name,
+		role: raw.role,
+		valueHint: raw.valueHint,
+		createdAt: raw.createdAt
+	};
+}
+function bucketApiError(summary, response, error) {
+	const status = response?.status ?? 0;
+	return new CliError({
+		code: error?.error?.code ?? "BUCKET_API_ERROR",
+		domain: "bucket",
+		summary,
+		why: error?.error?.message ?? `The Management API returned status ${status || "unknown"}.`,
+		fix: error?.error?.hint ?? "Re-run with --trace for the underlying API response details.",
+		exitCode: 1,
+		nextSteps: []
+	});
+}
+//#endregion
+export { createManagementBucketProvider, normalizeBucket, normalizeKey };

package/dist/presenters/bucket.js

@@ -0,0 +1,174 @@
+import { formatDescriptorLabel } from "../shell/command-meta.js";
+import { formatColumns, renderSummaryLine } from "../shell/ui.js";
+import { renderMutate, serializeList } from "../output/patterns.js";
+import { renderResolvedProjectContextBlock, stripVerboseContext } from "./verbose-context.js";
+//#region src/presenters/bucket.ts
+function renderBucketList(context, descriptor, result) {
+	const ui = context.ui;
+	const lines = [`${ui.strong(formatDescriptorLabel(descriptor))} ${ui.dim("→")} ${ui.dim("Listing object-store buckets for the resolved project.")}`, ""];
+	const rail = ui.dim("│");
+	lines.push(`${rail}  ${ui.accent("project:")}  ${result.projectName}`);
+	if (result.branchName) lines.push(`${rail}  ${ui.accent("branch:")}   ${result.branchName}`);
+	lines.push(rail);
+	if (result.buckets.length === 0) {
+		lines.push(`${rail}  ${ui.dim("No buckets found.")}`);
+		lines.push(...renderResolvedProjectContextBlock(context.ui, result.verboseContext));
+		return lines;
+	}
+	const rows = result.buckets.map((bucket) => [
+		bucket.name,
+		bucket.id,
+		bucket.status,
+		bucket.branchId ?? "unscoped",
+		bucket.createdAt
+	]);
+	const widths = [
+		Math.max(4, ...rows.map((row) => row[0].length)),
+		Math.max(2, ...rows.map((row) => row[1].length)),
+		Math.max(6, ...rows.map((row) => row[2].length)),
+		Math.max(6, ...rows.map((row) => row[3].length)),
+		Math.max(7, ...rows.map((row) => row[4].length))
+	];
+	lines.push(`${rail}  ${ui.accent(formatColumns([
+		"Name",
+		"Id",
+		"Status",
+		"Branch",
+		"Created"
+	], widths))}`);
+	for (const row of rows) lines.push(`${rail}  ${formatColumns(row, widths)}`);
+	lines.push(...renderResolvedProjectContextBlock(context.ui, result.verboseContext));
+	return lines;
+}
+function serializeBucketList(result) {
+	return {
+		context: {
+			project: result.projectName,
+			...result.branchName ? { branch: result.branchName } : {}
+		},
+		items: result.buckets.map((bucket) => ({
+			name: bucket.name,
+			id: bucket.id,
+			status: bucket.status
+		})),
+		count: result.buckets.length,
+		projectId: result.projectId,
+		branchName: result.branchName,
+		buckets: result.buckets
+	};
+}
+function renderBucketCreate(context, _descriptor, result) {
+	const ui = context.ui;
+	return ["Creating bucket...", renderSummaryLine(ui, "success", `Created bucket "${result.bucket.name}" in ${formatBucketTarget(result.projectName, result.bucket.branchId)}.`)];
+}
+function serializeBucketCreate(result) {
+	return stripVerboseContext(result);
+}
+function renderBucketDelete(context, descriptor, result) {
+	return renderMutate({
+		title: "Deleting object-store bucket.",
+		descriptor,
+		context: [{
+			key: "bucket",
+			value: result.bucket.id,
+			tone: "dim"
+		}],
+		operationDescription: "Deleting bucket",
+		operationCount: 1,
+		details: ["Bucket and all its access keys were removed."]
+	}, context.ui);
+}
+function serializeBucketDelete(result) {
+	return { bucket: result.bucket };
+}
+function renderBucketKeyList(context, descriptor, result) {
+	const ui = context.ui;
+	const lines = [`${ui.strong(formatDescriptorLabel(descriptor))} ${ui.dim("→")} ${ui.dim("Listing access keys for bucket.")}`, ""];
+	const rail = ui.dim("│");
+	lines.push(`${rail}  ${ui.accent("bucket:")}  ${result.bucketId}`);
+	lines.push(rail);
+	if (result.keys.length === 0) {
+		lines.push(`${rail}  ${ui.dim("No keys found.")}`);
+		return lines;
+	}
+	const rows = result.keys.map((key) => [
+		key.name,
+		key.id,
+		key.role,
+		key.valueHint,
+		key.createdAt
+	]);
+	const widths = [
+		Math.max(4, ...rows.map((row) => row[0].length)),
+		Math.max(2, ...rows.map((row) => row[1].length)),
+		Math.max(4, ...rows.map((row) => row[2].length)),
+		Math.max(4, ...rows.map((row) => row[3].length)),
+		Math.max(7, ...rows.map((row) => row[4].length))
+	];
+	lines.push(`${rail}  ${ui.accent(formatColumns([
+		"Name",
+		"Id",
+		"Role",
+		"Hint",
+		"Created"
+	], widths))}`);
+	for (const row of rows) lines.push(`${rail}  ${formatColumns(row, widths)}`);
+	return lines;
+}
+function serializeBucketKeyList(result) {
+	return {
+		...serializeList({
+			context: { bucket: result.bucketId },
+			items: result.keys.map((key) => ({
+				noun: "key",
+				label: key.name,
+				id: key.id,
+				status: null
+			}))
+		}),
+		bucketId: result.bucketId,
+		keys: result.keys
+	};
+}
+function renderBucketKeyCreateStdout(_context, _descriptor, result) {
+	return [
+		`S3_ENDPOINT=${result.endpoint}`,
+		`S3_ACCESS_KEY_ID=${result.accessKeyId}`,
+		`S3_SECRET_ACCESS_KEY=${result.secretAccessKey}`,
+		`S3_BUCKET=${result.bucketName}`
+	];
+}
+function renderBucketKeyCreate(context, _descriptor, result) {
+	const ui = context.ui;
+	return [
+		"Creating bucket key...",
+		renderSummaryLine(ui, "success", `Created key "${result.key.name}" for bucket "${result.bucketName}".`),
+		"  The credentials below are shown once — copy them now.",
+		"  Set these environment variables to use this bucket:"
+	];
+}
+function serializeBucketKeyCreate(result) {
+	return result;
+}
+function renderBucketKeyDelete(context, descriptor, result) {
+	return renderMutate({
+		title: "Deleting bucket access key.",
+		descriptor,
+		context: [{
+			key: "key",
+			value: result.key.id,
+			tone: "dim"
+		}],
+		operationDescription: "Deleting bucket key",
+		operationCount: 1,
+		details: ["The access key was revoked and removed."]
+	}, context.ui);
+}
+function serializeBucketKeyDelete(result) {
+	return { key: result.key };
+}
+function formatBucketTarget(projectName, branchId) {
+	return branchId ? `${projectName} / ${branchId}` : projectName;
+}
+//#endregion
+export { renderBucketCreate, renderBucketDelete, renderBucketKeyCreate, renderBucketKeyCreateStdout, renderBucketKeyDelete, renderBucketKeyList, renderBucketList, serializeBucketCreate, serializeBucketDelete, serializeBucketKeyCreate, serializeBucketKeyDelete, serializeBucketKeyList, serializeBucketList };

package/dist/shell/command-meta.js

@@ -249,6 +249,105 @@ const DESCRIPTORS = [
 			"prisma-cli database connection create db_123"
 		]
 	},
+	{
+		id: "bucket",
+		path: ["prisma", "bucket"],
+		description: "Manage object-store buckets for a project",
+		examples: [
+			"prisma-cli bucket list",
+			"prisma-cli bucket create",
+			"prisma-cli bucket key create bkt_123"
+		]
+	},
+	{
+		id: "bucket.list",
+		path: [
+			"prisma",
+			"bucket",
+			"list"
+		],
+		description: "List object-store buckets for the resolved project",
+		examples: [
+			"prisma-cli bucket list",
+			"prisma-cli bucket list --branch preview",
+			"prisma-cli bucket list --json"
+		]
+	},
+	{
+		id: "bucket.create",
+		path: [
+			"prisma",
+			"bucket",
+			"create"
+		],
+		description: "Create an object-store bucket",
+		examples: [
+			"prisma-cli bucket create",
+			"prisma-cli bucket create --name my-store",
+			"prisma-cli bucket create --branch preview --json"
+		]
+	},
+	{
+		id: "bucket.delete",
+		path: [
+			"prisma",
+			"bucket",
+			"delete"
+		],
+		description: "Delete a bucket and all its access keys",
+		examples: ["prisma-cli bucket delete bkt_123"]
+	},
+	{
+		id: "bucket.key",
+		path: [
+			"prisma",
+			"bucket",
+			"key"
+		],
+		description: "Manage access keys for an object-store bucket",
+		examples: [
+			"prisma-cli bucket key list bkt_123",
+			"prisma-cli bucket key create bkt_123",
+			"prisma-cli bucket key delete bkt_123 bkey_456"
+		]
+	},
+	{
+		id: "bucket.key.list",
+		path: [
+			"prisma",
+			"bucket",
+			"key",
+			"list"
+		],
+		description: "List access keys for a bucket",
+		examples: ["prisma-cli bucket key list bkt_123", "prisma-cli bucket key list bkt_123 --json"]
+	},
+	{
+		id: "bucket.key.create",
+		path: [
+			"prisma",
+			"bucket",
+			"key",
+			"create"
+		],
+		description: "Create a bucket access key and print its one-time credentials",
+		examples: [
+			"prisma-cli bucket key create bkt_123",
+			"prisma-cli bucket key create bkt_123 --role read",
+			"prisma-cli bucket key create bkt_123 --name ci-key --role read_write"
+		]
+	},
+	{
+		id: "bucket.key.delete",
+		path: [
+			"prisma",
+			"bucket",
+			"key",
+			"delete"
+		],
+		description: "Revoke and delete a bucket access key",
+		examples: ["prisma-cli bucket key delete bkt_123 bkey_456"]
+	},
 	{
 		id: "git",
 		path: ["prisma", "git"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prisma/cli",
-  "version": "3.0.0-dev.129.1",
+  "version": "3.0.0-dev.131.1",
   "description": "Command-line interface for the Prisma Developer Platform.",
   "type": "module",
   "bin": {
@@ -46,7 +46,7 @@
     "@clack/prompts": "^1.5.0",
     "@prisma/compute-sdk": "0.34.0",
     "@prisma/credentials-store": "^7.8.0",
-    "@prisma/management-api-sdk": "^1.46.0",
+    "@prisma/management-api-sdk": "^1.50.0",
     "better-result": "^2.9.2",
     "colorette": "^2.0.20",
     "commander": "^14.0.3",