fix(infra): stop alchemy forcing an update on observability destinations

[Makisuo]

Every us prd deploy since #1448 (alchemy beta.83) fails on workers-observability-logs / workers-observability-traces with Forbidden: Authentication error, so the api Worker is left on the old revision (the post-deploy check reports a partial deploy).

beta.83's ObservabilityDestination.diff returns update whenever stored state holds destinationConf as a plain string (state from older versions), to re-read it as Redacted. The reconcile that follows lists the account's destinations, which the deploy token is not allowed to do. On beta.81 these resources diffed to noop.

This patches that one-time migration out of alchemy (src + lib), so unchanged destinations are noop again. The stored destinationConf stays a plain string, which nothing in Maple reads.

Alternative: give the prd deploy token read access to Workers Observability destinations and drop this patch.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[maple-review-bot]

Maple review

🟢 Confidence 8/10 · likely safe to merge
Hunks and lockfile wiring check out, but patch application against the published tarball cannot be exercised without a network install.
_{quality 100/100 · no findings · tests not needed · risk medium}

A bun patch removes alchemy beta.83's one-time destinationConf migration in ObservabilityDestination.diff, so unchanged prd destinations diff to noop again instead of triggering a reconcile the deploy token may not perform. Contained and safe to merge.

• Patch drops the plain-string destinationConf migration from alchemy's ObservabilityDestination.diff
• Patch registered for alchemy@2.0.0-beta.83 in package.json and bun.lock

Before merge

• Manual · Re-run the us prd deploy (bun run alchemy:deploy:prd) and confirm the post-deploy check no longer reports a partial deploy

What was checked

• Both hunks are arithmetically consistent (12 old / 6 new lines, 3 context lines each side) and target existing files under lib/ and src/
• The removed branch was the only plain-string path to update; dataset, URL and header drift still precede it
• Nothing in Maple reads destinationConf; assetWorkerObservability reads only .slug (packages/infra/src/cloudflare/observability.ts:54)

_{05e8320 · Updated on every push. Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: f4a8024b-e733-4b91-b843-63d920ace0eb

📥 Commits

Reviewing files that changed from the base of the PR and between 2102433 and 05e8320.

⛔ Files ignored due to path filters: 1

• bun.lock is excluded by !**/*.lock

📒 Files selected for processing: 2

• package.json
• patches/alchemy@2.0.0-beta.83.patch

 ____________________________________________________________________________________
< Half-Life 3 could have been released by now, but I'm too busy reviewing your code. >
 ------------------------------------------------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[maple-review-bot]

Merged with 1 step from "Before merge" still open. If it is done, tick it on the review comment; if not, now is the time.

• Manual · Re-run the us prd deploy (bun run alchemy:deploy:prd) and confirm the post-deploy check no longer reports a partial deploy