alchemy 2.0.0-beta.50 → 2.0.0-beta.52

package/src/Cloudflare/Workers/Worker.ts

@@ -1,12 +1,14 @@
 import type * as cf from "@cloudflare/workers-types";
 import * as workers from "@distilled.cloud/cloudflare/workers";
 import * as zones from "@distilled.cloud/cloudflare/zones";
+import type { ConfigError } from "effect/Config";
 import * as Config from "effect/Config";
 import * as Context from "effect/Context";
 import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import * as Path from "effect/Path";
+import * as Predicate from "effect/Predicate";
 import * as Redacted from "effect/Redacted";
 import * as Schedule from "effect/Schedule";
 import * as crypto from "node:crypto";
@@ -30,7 +32,6 @@ import {
   readAssets,
   uploadAssets,
   type Assets,
-  type AssetsConfig,
   type AssetsProps,
 } from "./Assets.ts";
 import { getCompatibility } from "./Compatibility.ts";
@@ -98,20 +99,12 @@ export const isWorkerEvent = (value: any): value is WorkerEvent =>
  * When hash is provided, it's used directly for diffing instead of computing from directory contents.
  * This is useful when integrating with Build resources that produce a deterministic hash.
  */
-export interface AssetsWithHash {
-  /**
-   * Path to the assets directory.
-   */
-  path: string;
+export interface AssetsWithHash extends AssetsProps {
   /**
    * Pre-computed hash of the assets. When provided, this hash is used for diffing
    * to determine if the worker needs to be redeployed.
    */
   hash: string;
-  /**
-   * Optional assets configuration.
-   */
-  config?: AssetsConfig;
 }
 
 export interface WorkerObservability extends Exclude<
@@ -165,7 +158,7 @@ export type WorkerBindingProps = {
     | Effect.Effect<WorkerBindingResource, any, any>;
 };
 
-type NormalizedBindings<
+export type NormalizedBindings<
   Bindings extends WorkerBindingProps = {},
   AssetsConfig extends WorkerAssetsConfig | undefined = undefined,
 > = {
@@ -286,26 +279,33 @@ export interface WorkerProps<
   /**
    * Options for the local dev server that runs this Worker under `alchemy dev`.
    * Each Worker is served on its own port.
+   *
+   * Set to `false` to skip starting a local Worker entirely — useful when an
+   * external dev server (e.g. one spawned via `Build.DevCommand`) is
+   * serving the content this Worker would otherwise host.
    */
-  dev?: {
-    /**
-     * Host the local dev server binds to.
-     * @default "localhost"
-     */
-    host?: string;
-    /**
-     * Port the local dev server listens on. If the port is unavailable, the
-     * next free port is used unless {@link strictPort} is `true`.
-     * @default 1337
-     */
-    port?: number;
-    /**
-     * When `true`, fail instead of falling back to another port if {@link port}
-     * is already in use.
-     * @default false
-     */
-    strictPort?: boolean;
-  };
+  dev?:
+    | false
+    | string
+    | {
+        /**
+         * Host the local dev server binds to.
+         * @default "localhost"
+         */
+        host?: string;
+        /**
+         * Port the local dev server listens on. If the port is unavailable,
+         * the next free port is used unless {@link strictPort} is `true`.
+         * @default 1337
+         */
+        port?: number;
+        /**
+         * When `true`, fail instead of falling back to another port if
+         * {@link port} is already in use.
+         * @default false
+         */
+        strictPort?: boolean;
+      };
 }
 
 export type Worker<Bindings extends WorkerBindings = any> = Resource<
@@ -708,7 +708,11 @@ export const Worker: Platform<
     id: string,
     props:
       | InputProps<WorkerProps<Bindings, Assets>>
-      | Effect.Effect<InputProps<WorkerProps<Bindings, Assets>>, never, Req>,
+      | Effect.Effect<
+          InputProps<WorkerProps<Bindings, Assets>>,
+          ConfigError,
+          Req
+        >,
   ): Effect.Effect<
     Worker<{
       [binding in keyof NormalizedBindings<
@@ -1124,15 +1128,9 @@ export const LiveWorkerProvider = () =>
           return undefined;
         }
 
-        if (
-          typeof assets === "object" &&
-          "path" in assets &&
-          "hash" in assets
-        ) {
-          return yield* readAssets({
-            directory: assets.path as string,
-            config: assets.config,
-          });
+        if (typeof assets === "object" && "hash" in assets) {
+          const { hash: _, ...config } = assets;
+          return yield* readAssets(config);
         }
 
         // Handle string path or AssetsProps
@@ -1181,7 +1179,7 @@ export const LiveWorkerProvider = () =>
                           typeof Redacted.value(value) === "string"
                         ? Redacted.value(value)
                         : Config.isConfig(value) || Effect.isEffect(value)
-                          ? yield* value
+                          ? yield* value as Effect.Effect<any>
                           : undefined,
                   ];
                 }),
@@ -1203,11 +1201,10 @@ export const LiveWorkerProvider = () =>
           [
             assetsDirectory
               ? readAssets({
+                  ...(props.assets && typeof props.assets !== "string"
+                    ? props.assets
+                    : undefined),
                   directory: assetsDirectory,
-                  config:
-                    typeof props.assets === "object" && "config" in props.assets
-                      ? props.assets.config
-                      : undefined,
                 })
               : Effect.succeed(undefined),
             serverBundle
@@ -1293,6 +1290,15 @@ export const LiveWorkerProvider = () =>
           })),
         );
 
+      const normalizePrebuiltAssets = (
+        assets: WorkerProps["assets"],
+        output: Worker["Attributes"] | undefined,
+      ) => {
+        if (!Predicate.hasProperty(assets, "hash")) return undefined;
+        const { directory: _, hash, ...config } = assets;
+        return { config, hash, skip: hash === output?.hash?.assets };
+      };
+
       const putWorker = Effect.fnUntraced(function* (
         id: string,
         news: WorkerProps,
@@ -1311,28 +1317,14 @@ export const LiveWorkerProvider = () =>
         // entirely and tell Cloudflare to keep the assets it already
         // has bound to this script. The disk read is the expensive
         // part; the script PUT happens either way.
-        const previousAssetsHash = output?.hash?.assets;
-        const precomputedAssetsHash =
-          news.assets &&
-          typeof news.assets === "object" &&
-          "path" in news.assets &&
-          "hash" in news.assets
-            ? (news.assets.hash as string)
-            : undefined;
-        const assetsConfigFromProps =
-          news.assets &&
-          typeof news.assets === "object" &&
-          "config" in news.assets
-            ? news.assets.config
-            : undefined;
-        const skipAssetsRead =
-          precomputedAssetsHash !== undefined &&
-          precomputedAssetsHash === previousAssetsHash;
+        const prebuiltAssets = normalizePrebuiltAssets(news.assets, output);
         const {
           assets,
           bundle,
           hash: preparedHash,
-        } = yield* prepareAssetsAndBundle(id, news, { skipAssetsRead });
+        } = yield* prepareAssetsAndBundle(id, news, {
+          skipAssetsRead: prebuiltAssets?.skip,
+        });
         // When the caller supplied a precomputed hash (e.g. via
         // `Build.Command`), store *that* hash in output state so the
         // next diff can short-circuit by comparing it directly. The
@@ -1341,7 +1333,7 @@ export const LiveWorkerProvider = () =>
         // build-input hash and will never match it on the next pass.
         const hash = {
           ...preparedHash,
-          assets: precomputedAssetsHash ?? preparedHash.assets,
+          assets: prebuiltAssets?.hash ?? preparedHash.assets,
         } satisfies Worker["Attributes"]["hash"];
         const metadataBindings = bindings.flatMap((b) => b.data.bindings ?? []);
         const expectedDurableObjectClassNames =
@@ -1350,16 +1342,14 @@ export const LiveWorkerProvider = () =>
           | workers.PutScriptRequest["metadata"]["assets"]
           | undefined;
         let keepAssets = false;
-        if (skipAssetsRead) {
+        if (prebuiltAssets?.skip) {
           // Hash matched what's already on Cloudflare: keep the
           // existing asset manifest and skip the upload session.
           yield* Effect.logInfo(
             `Cloudflare Worker update: assets unchanged for ${name}, keeping existing`,
           );
           keepAssets = true;
-          metadataAssets = assetsConfigFromProps
-            ? { config: assetsConfigFromProps }
-            : undefined;
+          metadataAssets = { config: prebuiltAssets.config };
           metadataBindings.push({
             type: "assets",
             name: "ASSETS",
@@ -1372,7 +1362,7 @@ export const LiveWorkerProvider = () =>
           // disk). In that case still keep the existing manifest and
           // skip the upload session — Cloudflare's content-addressed
           // session would no-op on every byte anyway.
-          if (assets.hash === previousAssetsHash) {
+          if (assets.hash === prebuiltAssets?.hash) {
             yield* Effect.logInfo(
               `Cloudflare Worker update: assets unchanged for ${name}, keeping existing`,
             );
@@ -1759,12 +1749,9 @@ export const LiveWorkerProvider = () =>
           if (!props.assets) {
             return false;
           }
-          const assetsHash =
-            typeof props.assets === "object" &&
-            "path" in props.assets &&
-            "hash" in props.assets
-              ? (props.assets.hash as string)
-              : undefined;
+          const assetsHash = Predicate.hasProperty(props.assets, "hash")
+            ? props.assets.hash
+            : undefined;
           if (assetsHash === undefined) {
             return true;
           }
@@ -1802,12 +1789,9 @@ export const LiveWorkerProvider = () =>
         // assume the assets changed; `putWorker` will read once,
         // hash, and use `keepAssets` if it turns out nothing actually
         // changed.
-        const assetsHash =
-          typeof props.assets === "object" &&
-          "path" in props.assets &&
-          "hash" in props.assets
-            ? (props.assets.hash as string)
-            : undefined;
+        const assetsHash = Predicate.hasProperty(props.assets, "hash")
+          ? props.assets.hash
+          : undefined;
         if (assetsHash === undefined) {
           return true;
         }
@@ -1976,7 +1960,7 @@ export const LiveWorkerProvider = () =>
               // @distilled.cloud/cloudflare versions that haven't picked
               // up the patch yet.
               Effect.retry({
-                while: (e: any) =>
+                while: (e) =>
                   e._tag === "InternalServerError" ||
                   e._tag === "UnknownCloudflareError",
                 schedule: Schedule.exponential(1000).pipe(

package/src/Cloudflare/Workers/WorkerAsyncBindings.ts

@@ -20,10 +20,12 @@ import { isKVNamespace } from "../KV/KVNamespace.ts";
 import { isQueue } from "../Queue/Queue.ts";
 import { isR2Bucket } from "../R2/R2Bucket.ts";
 import { isRateLimit } from "../RateLimit/RateLimit.ts";
+import { isSecret } from "../SecretsStore/Secret.ts";
 import { isVectorizeIndex } from "../Vectorize/VectorizeIndex.ts";
 import { isAssets } from "./Assets.ts";
 import { isDurableObjectNamespaceLike } from "./DurableObjectNamespace.ts";
 import { isDynamicWorkerLoader } from "./DynamicWorkerLoader.ts";
+import { isVersionMetadata } from "./VersionMetadata.ts";
 import type { WorkerBindingProps } from "./Worker.ts";
 import { isWorker, type Worker, type WorkerProps } from "./Worker.ts";
 import type { WorkerBinding, WorkerBindingResource } from "./WorkerBinding.ts";
@@ -210,6 +212,18 @@ const toBinding = (
       name: bindingName,
       indexName: binding.indexName,
     };
+  } else if (isSecret(binding)) {
+    return {
+      type: "secrets_store_secret",
+      name: bindingName,
+      secretName: binding.secretName,
+      storeId: binding.storeId,
+    };
+  } else if (isVersionMetadata(binding)) {
+    return {
+      type: "version_metadata",
+      name: bindingName,
+    };
   } else if (isDynamicWorkerLoader(binding)) {
     return {
       type: "worker_loader",

package/src/Cloudflare/Workers/WorkerBinding.ts

@@ -18,10 +18,12 @@ import type { KVNamespace } from "../KV/KVNamespace.ts";
 import type { Queue } from "../Queue/Queue.ts";
 import type { R2Bucket } from "../R2/R2Bucket.ts";
 import type { RateLimit } from "../RateLimit/RateLimit.ts";
+import type { Secret } from "../SecretsStore/Secret.ts";
 import type { VectorizeIndex } from "../Vectorize/VectorizeIndex.ts";
 import type { Assets } from "./Assets.ts";
 import type { DurableObjectNamespaceLike } from "./DurableObjectNamespace.ts";
 import type { DynamicWorkerLoader } from "./DynamicWorkerLoader.ts";
+import type { VersionMetadata } from "./VersionMetadata.ts";
 import { makeRpcStub } from "./Rpc.ts";
 import { isWorker, Worker, WorkerEnvironment } from "./Worker.ts";
 
@@ -55,8 +57,10 @@ export type WorkerBindingResource =
   | Images
   | Hyperdrive
   | VectorizeIndex
+  | Secret
   | Worker
   | DynamicWorkerLoader
+  | VersionMetadata
   | DurableObjectNamespaceLike<any>;
 
 export type WorkerBindings = {

package/src/Cloudflare/Workers/Workflow.ts

@@ -3,6 +3,7 @@ import type { ConfigError } from "effect/Config";
 import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import { AlchemyContext } from "../../AlchemyContext.ts";
+import { ExecutionContext } from "../../ExecutionContext.ts";
 import { ALCHEMY_PHASE } from "../../Phase.ts";
 import type { PlatformServices } from "../../Platform.ts";
 import * as Provider from "../../Provider.ts";
@@ -100,8 +101,18 @@ export const sleepUntil = (
  * from inside workflow steps via `yield* WorkerEnvironment` — the type must
  * reflect that or `yield* WorkerEnvironment` fails to type-check inside a
  * body even though it succeeds at runtime.
+ *
+ * `ExecutionContext` (scope + cache) is provided per run-invocation by
+ * `WorkflowBridge.run` and threaded into every `task` via the surrounding
+ * body context, so `@binding` helpers that need it (e.g. `Drizzle.postgres`)
+ * resolve their per-run resources inside workflow steps just as they do in a
+ * Worker `fetch`/`queue` handler.
  */
-export type WorkflowRunServices = WorkflowEvent | WorkflowStep | WorkerServices;
+export type WorkflowRunServices =
+  | WorkflowEvent
+  | WorkflowStep
+  | WorkerServices
+  | ExecutionContext;
 
 export type WorkflowServices = WorkflowRunServices | PlatformServices;
 

package/src/Cloudflare/Workers/WorkflowBridge.ts

@@ -1,11 +1,17 @@
+import * as Cause from "effect/Cause";
 import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import * as Layer from "effect/Layer";
+import * as Scope from "effect/Scope";
+import { ExecutionContext } from "../../ExecutionContext.ts";
+import { isScopeEjected } from "./HttpServer.ts";
+import { getWorkerExport } from "./WorkerBridge.ts";
 import {
   WorkflowEvent as WorkflowEventService,
   type WorkflowExport,
   type WorkflowImpl,
   WorkflowStep,
 } from "./Workflow.ts";
-import { getWorkerExport } from "./WorkerBridge.ts";
 
 /**
  * Create a WorkflowBridge class that extends `WorkflowEntrypoint` and
@@ -52,15 +58,50 @@ export const makeWorkflowBridge =
 
       async run(event: any, step: any): Promise<unknown> {
         const fn = await this.fn;
-        return Effect.runPromise(
+        // Each run-invocation gets a fresh ExecutionContext (scope + cache),
+        // following the same per-invocation-scope pattern as
+        // `WorkerBridge.processEvent`. `task` threads this into every step via
+        // the surrounding body context, so `@binding` helpers that need it
+        // (e.g. `Drizzle.postgres`) resolve their per-run resources inside
+        // workflow steps. The same scope is also provided as the ambient
+        // `Scope` service, matching the Worker and Durable Object bridges.
+        const scope = Scope.makeUnsafe();
+        const exit = await Effect.runPromiseExit(
           fn(event.payload).pipe(
-            Effect.provideService(
-              WorkflowEventService,
-              wrapWorkflowEvent(event),
+            Effect.provide(
+              Layer.succeed(
+                WorkflowEventService,
+                wrapWorkflowEvent(event),
+              ).pipe(
+                Layer.provideMerge(
+                  Layer.succeed(WorkflowStep, wrapWorkflowStep(step)),
+                ),
+                Layer.provideMerge(
+                  Layer.succeed(ExecutionContext, { scope, cache: {} }),
+                ),
+                Layer.provideMerge(Layer.succeed(Scope.Scope, scope)),
+              ),
             ),
-            Effect.provideService(WorkflowStep, wrapWorkflowStep(step)),
           ) as Effect.Effect<unknown>,
         );
+        // Settle the run's resources with its real exit, unless a binding
+        // ejected the scope to outlive the invocation. The workflow runtime has
+        // no `waitUntil` to detach cleanup to, so close inline — a failing
+        // finalizer (e.g. a pg pool `end()` on a dropped connection) is logged
+        // and ignored so it can't mask the run's outcome.
+        if (!isScopeEjected(scope)) {
+          await Scope.close(scope, exit).pipe(
+            Effect.ignoreCause({
+              log: "Warn",
+              message: "Workflow run scope close failed",
+            }),
+            Effect.runPromise,
+          );
+        }
+        if (Exit.isSuccess(exit)) {
+          return exit.value;
+        }
+        throw Cause.squash(exit.cause);
       }
     };
 

package/src/Cloudflare/Workers/index.ts

@@ -2,6 +2,7 @@ export * from "./Assets.ts";
 export * from "./ConfigProvider.ts";
 export * from "./CronEventSource.ts";
 export * from "./DurableObjectBridge.ts";
+export * from "./DurableObjectChatPersistence.ts";
 export * from "./DurableObjectNamespace.ts";
 export * from "./DurableObjectState.ts";
 export * from "./DurableObjectStorage.ts";
@@ -15,6 +16,8 @@ export * from "./Rpc.ts";
 export * from "./RpcDurableObjectNamespace.ts";
 export * from "./RpcWorker.ts";
 export * from "./ScheduledEvents.ts";
+export * from "./VersionMetadata.ts";
+export * from "./VersionMetadataBinding.ts";
 export * from "./WebSocket.ts";
 export * from "./Worker.ts";
 export * from "./WorkerBinding.ts";

package/src/Cloudflare/index.ts

@@ -17,6 +17,7 @@ export * from "./Providers.ts";
 export * from "./Queue/index.ts";
 export * from "./R2/index.ts";
 export * from "./RateLimit/index.ts";
+export * from "./Ruleset/index.ts";
 export * from "./SecretsStore/index.ts";
 export * from "./StateStore/index.ts";
 export * from "./Tunnel/index.ts";

package/src/Deploy.ts

@@ -1,3 +1,4 @@
+import type { ConfigError } from "effect/Config";
 import * as Effect from "effect/Effect";
 import type * as Scope from "effect/Scope";
 import { AlchemyContext } from "./AlchemyContext.ts";
@@ -14,7 +15,7 @@ export const deploy = <A>({
   scope,
   force,
 }: {
-  stack: StackEffect<CompiledStack<A>, Stage | AlchemyContext>;
+  stack: StackEffect<CompiledStack<A>, ConfigError, Stage | AlchemyContext>;
   stage: string;
   dev?: boolean;
   /** See {@link evalStack} — when set, scoped resources outlive `deploy`. */

package/src/Destroy.ts

@@ -1,3 +1,4 @@
+import type { ConfigError } from "effect/Config";
 import { Effect } from "effect";
 import type * as Scope from "effect/Scope";
 import type { AlchemyContext } from "./AlchemyContext.ts";
@@ -13,7 +14,7 @@ export const destroy = ({
   dev,
   scope,
 }: {
-  stack: StackEffect<CompiledStack, Stage | AlchemyContext>;
+  stack: StackEffect<CompiledStack, ConfigError, Stage | AlchemyContext>;
   stage: string;
   dev?: boolean;
   /** See {@link evalStack} — when set, scoped resources outlive `destroy`. */

package/src/Diff.ts

@@ -1,4 +1,5 @@
 import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
 import type { Input } from "./Input.ts";
 import * as Output from "./Output.ts";
 import type { BindingNode } from "./Plan.ts";
@@ -119,6 +120,12 @@ export const deepEqual = (
 
 const canonicalize = (value: unknown, stripNullish: boolean): unknown => {
   if (stripNullish && value == null) return undefined;
+  if (Redacted.isRedacted(value)) {
+    return {
+      _tag: "Redacted",
+      value: Redacted.value(value),
+    };
+  }
   if (Array.isArray(value)) {
     return value.map((v) => canonicalize(v, stripNullish));
   }

package/src/Drizzle/Postgres.ts

@@ -25,19 +25,20 @@ import { proxyChain } from "../Util/proxy-chain.ts";
  * });
  * ```
  *
- * Behind the scenes the actual connect work is wrapped in `Effect.cached`,
- * so the pool is built at most once per JS realm. Yielding the
- * connection string is also deferred until first query, so deploy /
- * plan-time invocations (where `WorkerEnvironment` isn't provided)
- * never trigger a real connection attempt.
+ * The connect work is deferred until the first query and memoized on the
+ * current `ExecutionContext` (`ctx.cache`), so the pool is built at most
+ * once per execution — a Worker `fetch`/`queue`/`scheduled` event or a
+ * Workflow run — and reused across every query and `task` step in that
+ * execution. Yielding the connection string is likewise deferred, so
+ * deploy / plan-time invocations (where `WorkerEnvironment` isn't
+ * provided) never trigger a real connection attempt.
  *
- * The PgClient pool is built against an isolated, never-closing `Scope`
- * so it outlives whatever scope this helper is yielded under. In a
- * Cloudflare Worker the surrounding `Cloudflare.Worker` runs init
- * inside `Effect.scoped`, which closes after returning the exports
- * object — without an isolated scope, the pool's `end` finalizer
- * would fire there and every subsequent request would see "Cannot
- * use a pool after end".
+ * The pool is built against the execution's `Scope` (`ctx.scope`), so its
+ * `end` finalizer fires when that scope closes — when the request / run
+ * settles, not when the `Cloudflare.Worker` init scope closes. Init runs
+ * inside `Effect.scoped` and closes after returning the exports object;
+ * building lazily against `ctx.scope` (rather than that init scope) is
+ * what keeps later requests from seeing "Cannot use a pool after end".
  *
  * @binding
  */

package/src/Drizzle/Schema.ts

@@ -1,7 +1,7 @@
-import * as crypto from "node:crypto";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Path from "effect/Path";
+import * as crypto from "node:crypto";
 import { isResolved } from "../Diff.ts";
 import * as Provider from "../Provider.ts";
 import { Resource } from "../Resource.ts";
@@ -9,6 +9,10 @@ import type { Providers } from "./Providers.ts";
 
 export type Dialect = "postgres" | "mysql" | "sqlite";
 
+type DrizzleSnapshot = {
+  id?: string;
+};
+
 export type SchemaProps = {
   /**
    * Path to the schema module, relative to the current working directory.
@@ -41,7 +45,7 @@ export type Schema = Resource<
   "Drizzle.Schema",
   SchemaProps,
   {
-    /** Absolute path to the migrations directory. */
+    /** Path to the migrations directory, relative to the current working directory. */
     out: string;
     /**
      * sha256 of the latest snapshot.json. Stable across deploys when the
@@ -113,6 +117,12 @@ export const SchemaProvider = () =>
       const resolveOut = (p: SchemaProps) =>
         path.resolve(process.cwd(), p.out ?? "./migrations");
 
+      // The `out` attribute is exposed as a path relative to the current
+      // working directory so that persisted state stays portable across
+      // machines/checkouts. Internal filesystem ops always use the absolute
+      // `resolveOut` form.
+      const relativeOut = (abs: string) => path.relative(process.cwd(), abs);
+
       const resolveSchema = (p: SchemaProps) =>
         path.resolve(process.cwd(), p.schema);
 
@@ -164,7 +174,10 @@ export const SchemaProvider = () =>
             const exists = yield* fs.exists(snapshotPath);
             if (!exists) continue;
             const text = yield* fs.readFileString(snapshotPath);
-            return { snapshot: JSON.parse(text) as unknown, hash: sha(text) };
+            return {
+              snapshot: JSON.parse(text) as DrizzleSnapshot,
+              hash: sha(text),
+            };
           }
           return undefined;
         });
@@ -181,13 +194,14 @@ export const SchemaProvider = () =>
           const dialect = props.dialect ?? "postgres";
           const kit = yield* loadKit(dialect);
           const schemaModule = yield* loadSchemaModule(props);
+          const prevEntry = yield* readLatestSnapshot(out);
           const cur = yield* Effect.tryPromise({
-            try: () => kit.generateDrizzleJson(schemaModule),
+            try: () =>
+              kit.generateDrizzleJson(schemaModule, prevEntry?.snapshot.id),
             catch: (cause) =>
               new Error(`drizzle-kit generateDrizzleJson failed: ${cause}`),
           });
 
-          const prevEntry = yield* readLatestSnapshot(out);
           // For the initial migration, drizzle-kit needs an *empty* snapshot
           // produced by `generateDrizzleJson({})`, not a bare `{}` — the
           // snapshot has internal fields (`ddl`, etc.) that the differ reads.
@@ -233,7 +247,7 @@ export const SchemaProvider = () =>
           const migrations = yield* listMigrationDirs(out);
           const latest = yield* readLatestSnapshot(out);
           return {
-            out,
+            out: relativeOut(out),
             snapshotHash: latest?.hash ?? sha(JSON.stringify(cur)),
             migrations,
           };
@@ -248,8 +262,12 @@ export const SchemaProvider = () =>
           // `schema.out` as an unresolved Output during plan and cascade
           // into spurious updates of their own.
           const { sqlStatements } = yield* detectDrift(news);
-          if (sqlStatements.length === 0) return undefined;
-          return { action: "update" } as const;
+          // Originally `output.out` was an absolute path, which is not portable.
+          // So, we trigger an update to migrate existing resources.
+          // This is safe because `regenerate` is idempotent.
+          return sqlStatements.length > 0 || path.isAbsolute(output.out)
+            ? { action: "update" }
+            : undefined;
         }),
         read: Effect.fn(function* ({ olds, output }) {
           if (!output) return undefined;
@@ -259,7 +277,7 @@ export const SchemaProvider = () =>
           const latest = yield* readLatestSnapshot(out);
           const migrations = yield* listMigrationDirs(out);
           return {
-            out,
+            out: relativeOut(out),
             snapshotHash: latest?.hash ?? output.snapshotHash,
             migrations,
           };