marketing: source PostHog key from wrangler vars (match cloud)

Add PUBLIC_POSTHOG_KEY to apps/marketing/wrangler.toml [vars] and bridge the PUBLIC_ vars into the build in astro.config.mjs via wrangler unstable_readConfig, mirroring how apps/cloud reads its wrangler.jsonc vars. The public project key is now the committed single source of truth, inlined into the client bundle at build (and also a runtime binding), instead of a gitignored .env.

Author: RhysSullivan

apps/marketing/astro.config.mjs

@@ -1,18 +1,38 @@
 // @ts-check
+import { fileURLToPath } from "node:url";
 import { defineConfig } from "astro/config";
+import { unstable_readConfig } from "wrangler";
 
 import tailwindcss from "@tailwindcss/vite";
 import react from "@astrojs/react";
 
 import cloudflare from "@astrojs/cloudflare";
 
+// Single source of truth for public build-time vars: wrangler.toml `[vars]`.
+// Mirrors apps/cloud, which reads its wrangler.jsonc vars the same way. The
+// PUBLIC_ ones are inlined into the client bundle via Vite `define`, so the
+// browser PostHog SDK gets the key at build time; they also remain runtime
+// Worker bindings.
+const wranglerPublicDefine = () => {
+  const config = unstable_readConfig(
+    { config: fileURLToPath(new URL("./wrangler.toml", import.meta.url)) },
+    { hideWarnings: true },
+  );
+  return Object.fromEntries(
+    Object.entries(config.vars ?? {})
+      .filter(([key]) => key.startsWith("PUBLIC_"))
+      .map(([key, value]) => [`import.meta.env.${key}`, JSON.stringify(value)]),
+  );
+};
+
 // https://astro.build/config
 export default defineConfig({
   site: "https://executor.sh",
   output: "server",
   integrations: [react()],
   vite: {
     plugins: [tailwindcss()],
+    define: wranglerPublicDefine(),
   },
 
   adapter: cloudflare(),

apps/marketing/wrangler.toml

@@ -1,3 +1,10 @@
 name = "executor-marketing"
 compatibility_date = "2026-04-22"
 compatibility_flags = ["nodejs_compat"]
+
+# Public build-time vars, the single source of truth. astro.config.mjs reads the
+# PUBLIC_ ones from here and inlines them into the client bundle (same approach
+# apps/cloud uses with its wrangler.jsonc vars). phc_ is a public PostHog project
+# key, shipped in client JS by design, so it belongs in committed config.
+[vars]
+PUBLIC_POSTHOG_KEY = "phc_nNLrNMALpRsfrEkZovUkfMxYbcJvHnsJHeoSPavprgLL"