@keystrokehq/hosting 0.1.12 → 0.1.14

package/dist/index.cjs

@@ -4397,8 +4397,11 @@ function superRefine(fn, params) {
 function number(params) {
 	return /* @__PURE__ */ _coercedNumber(ZodNumber, params);
 }
-//#endregion
-//#region ../shared/dist/index.mjs
+new Set([
+	"hello",
+	"greeting",
+	"greet"
+]);
 /** Auth, session, and account-entry URL segments. */
 const AUTH_ACCOUNT_SLUGS = [
 	"2fa",
@@ -4510,6 +4513,7 @@ const PRODUCT_SLUGS = [
 	"execution",
 	"executions",
 	"explore",
+	"forms",
 	"get-started",
 	"history",
 	"inbox",
@@ -5377,6 +5381,8 @@ const storedRouteManifestEntryV2Schema = discriminatedUnion("kind", [
 		moduleFile: string(),
 		sourceHash: string().optional(),
 		schedule: string(),
+		/** IANA timezone for schedule wall-clock fields. When omitted, UTC. */
+		timezone: string().optional(),
 		name: requiredDisplayTextSchema,
 		description: requiredDisplayTextSchema
 	}),
@@ -5385,7 +5391,9 @@ const storedRouteManifestEntryV2Schema = discriminatedUnion("kind", [
 		pollId: string(),
 		attachmentIds: array(string()),
 		moduleFile: string(),
-		schedule: string()
+		schedule: string(),
+		/** IANA timezone for schedule wall-clock fields. When omitted, UTC. */
+		timezone: string().optional()
 	}),
 	object({
 		kind: literal("cron-schedule"),
@@ -5394,6 +5402,8 @@ const storedRouteManifestEntryV2Schema = discriminatedUnion("kind", [
 		moduleFile: string(),
 		sourceHash: string().optional(),
 		schedule: string(),
+		/** IANA timezone for schedule wall-clock fields. When omitted, UTC. */
+		timezone: string().optional(),
 		/** Static cron payload from `defineCronSource({ payload })` — omitted when the source has none. */
 		payload: unknown().optional(),
 		name: requiredDisplayTextSchema,
@@ -5438,6 +5448,8 @@ const AutoTopupSummarySchema = object({
 const PlanLimitsSchema = object({
 	includedStorageGb: number$1(),
 	concurrencyLimit: number$1(),
+	/** Max non-deleted projects; enforced on create only. */
+	maxProjects: number$1(),
 	agentTimeoutMs: number$1(),
 	workflowTimeoutMs: number$1(),
 	pollTimeoutMs: number$1(),
@@ -5451,8 +5463,15 @@ const PlanLimitsSchema = object({
 object({
 	planKey: string(),
 	subscriptionStatus: subscriptionStatusSchema,
+	/** Remaining plan-bucket balance this period (µc). */
 	planCreditMicroCredits: number$1(),
+	/** Remaining prepaid balance (µc). Never expires. */
 	prepaidCreditMicroCredits: number$1(),
+	/**
+	* Resolved monthly plan allotment (µc) — override ?? preset. Powers the
+	* credit-usage progress denominator (`used = allotment − remaining`).
+	*/
+	monthlyCreditMicroCredits: number$1(),
 	periodStart: isoDateTime$6.nullable(),
 	periodEnd: isoDateTime$6.nullable(),
 	autoTopup: AutoTopupSummarySchema,
@@ -5695,7 +5714,8 @@ object({
 });
 const NewChannelBindingInputSchema = object({
 	channelId: string().min(1),
-	channelName: string().min(1),
+	/** Display name. When omitted or equal to `channelId`, the server resolves it from Slack. */
+	channelName: string().min(1).optional(),
 	channelKind: ChannelBindingKindSchema.optional(),
 	mode: ChannelListenModeSchema.optional(),
 	subscribeOnMention: boolean().optional()
@@ -5757,12 +5777,13 @@ const AppAuthKindSchema = _enum([
 	"api_key",
 	"keystroke"
 ]);
-/** Composio auth scheme for API-key style connections. */
+/** Composio auth scheme for API-key / no-auth style connections. */
 const AppCredentialSchemeSchema = _enum([
 	"API_KEY",
 	"BEARER_TOKEN",
 	"BASIC",
-	"BASIC_WITH_JWT"
+	"BASIC_WITH_JWT",
+	"NO_AUTH"
 ]);
 /**
 * Where app metadata and execution are sourced (e.g. native, composio, pipedream, custom).
@@ -5804,6 +5825,7 @@ object({
 		"graphql"
 	]).default("custom"),
 	url: string().url().optional(),
+	logo: string().url().optional(),
 	authKind: AppAuthKindSchema.optional(),
 	fields: optionalCredentialFieldsSchema.optional(),
 	credentialScheme: AppCredentialSchemeSchema.optional(),
@@ -5839,6 +5861,7 @@ object({
 	authKind: AppAuthKindSchema,
 	source: AppSourceSchema,
 	url: string().url().nullable().optional(),
+	logo: string().url().nullable().optional(),
 	credentialFields: optionalCredentialFieldsSchema.optional(),
 	credentialScheme: AppCredentialSchemeSchema.optional(),
 	oauthScopes: array(OAuthScopeOptionSchema).optional(),
@@ -5875,12 +5898,14 @@ object({
 	/** Endpoint URL for MCP, OpenAPI, or GraphQL custom apps. */
 	url: string().url().nullable().optional(),
 	/** True when the app has a non-empty credential field template. */
-	hasCredentialFields: boolean().optional()
+	hasCredentialFields: boolean().optional(),
+	/** Composio auth scheme — present for API-key and NO_AUTH apps so the picker can choose a flow. */
+	credentialScheme: AppCredentialSchemeSchema.optional()
 }).extend({
 	oauthScopes: array(OAuthScopeOptionSchema),
 	/** Custom api_key apps — vault field template for connect UI and sync. */
 	credentialFields: AppCredentialFieldsSchema.optional(),
-	/** Composio auth scheme when credentialFields are present. */
+	/** Composio auth scheme for API-key or NO_AUTH connections. */
 	credentialScheme: AppCredentialSchemeSchema.optional(),
 	/** When present, the app supports agent gateway bindings (external channels). */
 	gateway: AppGatewaySchema.optional()
@@ -5997,8 +6022,12 @@ const AppCredentialScopeSchema = _enum([
 	"project",
 	"organization"
 ]);
-/** How the credential was connected (OAuth vs manual api-key entry). */
-const AppCredentialConnectionKindSchema = _enum(["oauth", "manual"]);
+/** How the credential was connected (OAuth, manual api-key entry, or no-auth). */
+const AppCredentialConnectionKindSchema = _enum([
+	"oauth",
+	"manual",
+	"none"
+]);
 /** Connect-dialog permission preset for OAuth scope selection. */
 const OAuthPermissionModeSchema = _enum(["default", "restricted"]);
 const optionalTimestamp$1 = string().optional();
@@ -6092,12 +6121,39 @@ CredentialTargetsFieldsSchema.extend({
 		message: "OAuth credentials are created via the OAuth callback",
 		path: ["connectionKind"]
 	});
+	if (input.connectionKind === "none" && input.value) ctx.addIssue({
+		code: "custom",
+		message: "value is not allowed for no-auth connections",
+		path: ["value"]
+	});
 });
 object({
 	label: string().trim().min(1).optional(),
 	isDefault: boolean().optional(),
-	value: credentialSecretValueSchema.optional()
-}).refine((input) => input.label !== void 0 || input.isDefault !== void 0 || input.value !== void 0, { message: "At least one field is required" });
+	value: credentialSecretValueSchema.optional(),
+	/** Move this credential to a different scope in place. */
+	scope: AppCredentialScopeSchema.optional(),
+	/** Required when `scope` is `project`. */
+	projectSlug: string().trim().min(1).optional()
+}).superRefine((input, ctx) => {
+	if (!(input.label !== void 0 || input.isDefault !== void 0 || input.value !== void 0 || input.scope !== void 0)) ctx.addIssue({
+		code: "custom",
+		message: "At least one field is required"
+	});
+	if (input.scope === "project" && !input.projectSlug) ctx.addIssue({
+		code: "custom",
+		message: "projectSlug is required when scope is project",
+		path: ["projectSlug"]
+	});
+	if (input.scope !== "project" && input.projectSlug !== void 0) ctx.addIssue({
+		code: "custom",
+		message: "projectSlug is only valid when scope is project",
+		path: ["projectSlug"]
+	});
+});
+CredentialTargetsFieldsSchema.omit({ credentialInstanceId: true }).superRefine((input, ctx) => {
+	if (!hasCredentialTarget(input)) addMissingCredentialTargetIssue(ctx);
+});
 object({
 	limit: number().int().min(1).max(200).optional(),
 	cursor: string().min(1).optional()
@@ -6199,11 +6255,46 @@ object({
 		"org-deletion",
 		"contact",
 		"enterprise-upgrade",
-		"verification"
+		"verification",
+		"slack-connect"
 	]),
 	message: string().trim().max(5e3).optional()
 });
 object({ ok: literal(true) });
+const TemplateKindSchema = _enum([
+	"agent",
+	"workflow",
+	"both"
+]);
+object({
+	kind: TemplateKindSchema,
+	title: string().min(1),
+	description: string().min(1),
+	tags: array(string().min(1)).default([]),
+	requiredApps: array(string().min(1)).default([])
+});
+object({
+	slug: string().min(1),
+	kind: TemplateKindSchema,
+	title: string().min(1),
+	description: string().min(1),
+	tags: array(string()),
+	requiredApps: array(string()),
+	updatedAt: string().datetime()
+}).extend({ files: record(string(), string()) });
+object({
+	slug: string().min(1),
+	files: record(string(), string())
+});
+object({
+	slug: string().min(1),
+	kind: TemplateKindSchema,
+	title: string().min(1),
+	description: string().min(1),
+	tags: array(string()).default([]),
+	requiredApps: array(string()).default([]),
+	files: record(string(), string())
+});
 const MarketingContactCompanySizeSchema = _enum([
 	"1-10",
 	"11-50",
@@ -6228,7 +6319,14 @@ const ValidationErrorDetailSchema = object({
 const ErrorResponseCodeSchema = OrganizationSlugErrorCodeSchema.or(_enum([
 	"needs_org_selection",
 	"org_unverified",
-	"connector_unavailable"
+	"connector_unavailable",
+	"invalid_url",
+	"url_not_allowed",
+	"url_unreachable",
+	"upstream_http_error",
+	"spec_too_large",
+	"spec_parse_error",
+	"invalid_openapi"
 ]));
 object({
 	error: string(),
@@ -6265,6 +6363,12 @@ const ChatAttachmentInputSchema = object({
 	mediaType: string().min(1),
 	filename: string().optional()
 });
+object({
+	type: literal("file"),
+	mediaType: string().min(1),
+	url: string().min(1),
+	filename: string().optional()
+});
 object({
 	contentType: string().min(1),
 	filename: string().min(1),
@@ -6345,12 +6449,7 @@ object({
 	params: array(unknown()).default([]),
 	method: string().min(1).optional()
 });
-object({ migrations: array(object({
-	sql: array(string().min(1)),
-	hash: string().min(1),
-	folderMillis: number$1()
-})) });
-object({ results: array(object({ rows: array(unknown()) })) });
+object({ rows: array(unknown()) });
 const RunSourceKindSchema = _enum([
 	"api",
 	"trigger",
@@ -6380,6 +6479,10 @@ object({
 	description: string().nullable().optional(),
 	type: AgentTriggerTypeSchema,
 	schedule: string().nullable(),
+	/** IANA timezone for schedule wall-clock fields. Null when omitted (evaluates in UTC). */
+	timezone: string().nullable(),
+	/** ISO timestamptz of the next scheduled fire. Null for webhooks / unset. */
+	nextRunAt: string().nullable(),
 	endpoint: string().nullable(),
 	origin: AgentTriggerOriginSchema,
 	prompt: string().nullable(),
@@ -6395,6 +6498,7 @@ const HistoryRunStatusSchema = _enum([
 	"running",
 	"sleeping",
 	"waiting_hook",
+	"waiting_children",
 	"completed",
 	"failed",
 	"canceled"
@@ -6535,6 +6639,26 @@ const HistoryAgentCompactionEventSchema = object({
 	retainedTailEstimate: number$1().optional(),
 	durable: boolean()
 });
+/** Compact abnormal prompt-finish diagnostics from `agent_end` (optional on older events). */
+const HistoryAgentPromptFinishEventSchema = object({
+	seq: number$1(),
+	createdAt: string(),
+	promptId: string().optional(),
+	outcome: _enum([
+		"completed",
+		"error",
+		"aborted"
+	]),
+	finishReason: string().nullable(),
+	rawFinishReason: string().optional(),
+	stepCount: number$1(),
+	maxSteps: number$1(),
+	hitStepLimit: boolean(),
+	error: object({
+		name: string().optional(),
+		message: string()
+	}).optional()
+});
 const HistoryRunDetailSchema = discriminatedUnion("kind", [HistoryWorkflowRunDetailSchema, object({
 	kind: literal("agent"),
 	runId: string(),
@@ -6562,6 +6686,8 @@ const HistoryRunDetailSchema = discriminatedUnion("kind", [HistoryWorkflowRunDet
 	messages: array(record(string(), unknown())),
 	/** Sanitized context-compaction markers for the conversation timeline. */
 	compactionEvents: array(HistoryAgentCompactionEventSchema).default([]),
+	/** Abnormal prompt-finish diagnostics from `agent_end` (missing on historical events). */
+	promptFinishEvents: array(HistoryAgentPromptFinishEventSchema).default([]),
 	trace: HistoryTraceSchema.nullable(),
 	ranAs: HistoryRunActorSchema.nullable().optional(),
 	usage: HistoryRunUsageSchema.nullable().optional()
@@ -6579,6 +6705,7 @@ const WorkflowRunStatusSchema = _enum([
 	"running",
 	"sleeping",
 	"waiting_hook",
+	"waiting_children",
 	"completed",
 	"failed",
 	"canceled"
@@ -6599,6 +6726,7 @@ _enum([
 	"sleep_completed",
 	"hook_created",
 	"hook_resumed",
+	"child_dispatched",
 	"run_completed",
 	"run_failed",
 	"run_canceled"
@@ -6804,6 +6932,7 @@ object({
 	* log. Defaulted so older servers remain compatible.
 	*/
 	compactionEvents: array(HistoryAgentCompactionEventSchema).default([]),
+	promptFinishEvents: array(HistoryAgentPromptFinishEventSchema).default([]),
 	trace: TraceResponseSchema.nullable()
 });
 const SlackGatewayModeSchema = _enum([
@@ -7058,6 +7187,10 @@ object({
 	webhookUrl: string().nullable(),
 	/** Cron expression or poll cadence label (cron/poll triggers only). */
 	schedule: string().nullable(),
+	/** IANA timezone for schedule wall-clock fields. Null when omitted (evaluates in UTC). */
+	timezone: string().nullable(),
+	/** ISO timestamptz of the next scheduled fire. Null for webhooks / unset. */
+	nextRunAt: string().nullable(),
 	/** Workflows + agents currently bound to this source. */
 	assignments: array(TriggerAssignmentSchema),
 	lastFiredAt: string().nullable(),
@@ -7098,6 +7231,8 @@ const TriggerOverviewInputSchema = object({
 	description: string().nullable(),
 	type: TriggerTypeSchema,
 	schedule: string().nullable(),
+	/** IANA timezone for schedule wall-clock fields. Null/omitted → UTC. */
+	timezone: string().nullable().optional(),
 	sourcePath: string(),
 	sourceContents: string(),
 	assignments: array(TriggerAssignmentSchema)
@@ -7283,6 +7418,13 @@ object({
 	uploadUrl: url(),
 	storageKey: string().min(1)
 });
+object({ contentType: string().trim().min(1) });
+object({
+	uploadUrl: url(),
+	storageKey: string().min(1)
+});
+object({ storageKey: string().min(1) });
+object({ logo: url() });
 const UserInterfaceThemeSchema = _enum([
 	"system",
 	"light",
@@ -7463,90 +7605,6 @@ object({
 	lastOpenedAt: string().min(1),
 	lastModifiedAt: string().min(1)
 });
-const isoDateTime = string().datetime();
-const sha256Hex = string().regex(/^[a-f0-9]{64}$/, "Expected a lowercase hex sha256 digest");
-/**
-* A single entry in a deploy's file tree, as served to the dashboard. Carries
-* no contents: `id` is a stable, path-derived handle used for selection and
-* `?file=` deep links; `hash` is the content address used to fetch the bytes
-* lazily and to cache them immutably in the browser.
-*/
-const ProjectFileSummarySchema = object({
-	id: string(),
-	path: string().min(1),
-	hash: sha256Hex
-});
-/** Maps a runtime resource slug (agent/workflow/skill) to its source file path. */
-const ProjectSourceResourceRefSchema = object({
-	slug: string().min(1),
-	path: string().min(1)
-});
-const ProjectSourceResourcesSchema = object({
-	agents: array(ProjectSourceResourceRefSchema).default([]),
-	workflows: array(ProjectSourceResourceRefSchema).default([]),
-	skills: array(ProjectSourceResourceRefSchema).default([])
-});
-const emptyResources = () => ({
-	agents: [],
-	workflows: [],
-	skills: []
-});
-object({
-	artifactId: string().nullable(),
-	files: array(ProjectFileSummarySchema),
-	resources: ProjectSourceResourcesSchema.default(emptyResources())
-});
-object({
-	path: string().min(1),
-	contents: string(),
-	hash: sha256Hex
-});
-object({ blobs: array(object({
-	hash: sha256Hex,
-	size: number$1().int().nonnegative()
-})) });
-object({ uploads: array(object({
-	hash: sha256Hex,
-	url: string().url()
-})) });
-object({ files: array(object({
-	path: string().min(1),
-	hash: sha256Hex
-})) });
-object({
-	ok: literal(true),
-	fileCount: number$1().int().nonnegative()
-});
-object({
-	files: array(object({
-		id: string(),
-		path: string().min(1),
-		hash: sha256Hex
-	})),
-	generatedAt: isoDateTime
-});
-/** A single source file returned by the bulk active-source download endpoint. */
-const DownloadActiveProjectSourceFileSchema = object({
-	path: string().min(1),
-	contents: string()
-});
-object({
-	artifactId: string(),
-	files: array(DownloadActiveProjectSourceFileSchema)
-});
-object({
-	projectId: string(),
-	artifactId: string(),
-	pulledAt: string().datetime()
-});
-object({ files: array(object({
-	id: string(),
-	path: string().min(1)
-})) });
-object({ files: array(object({
-	id: string(),
-	path: string().min(1)
-})) });
 /** Whether the overview is still being produced or finished. */
 const WorkflowOverviewStatusSchema = _enum(["generating", "ready"]);
 /** One phase of the guided-tour overview. */
@@ -7571,7 +7629,8 @@ const WorkflowInputFieldTypeSchema = _enum([
 	"boolean",
 	"enum",
 	"object",
-	"array"
+	"array",
+	"file"
 ]);
 const WorkflowInputFieldSchema = lazy(() => object({
 	key: string(),
@@ -7586,6 +7645,8 @@ const WorkflowInputFieldSchema = lazy(() => object({
 		number$1(),
 		boolean()
 	]).optional(),
+	minimum: number$1().optional(),
+	maximum: number$1().optional(),
 	children: array(WorkflowInputFieldSchema).optional(),
 	format: string().optional()
 }));
@@ -7785,6 +7846,159 @@ const WorkflowCanvasCredentialBindingSchema = union([
 	})
 ]);
 record(string(), array(WorkflowCanvasCredentialBindingSchema));
+const FormControlSchema = _enum([
+	"input",
+	"textarea",
+	"select",
+	"radio",
+	"stepper",
+	"slider",
+	"checkbox",
+	"switch"
+]);
+const FormFieldConfigEntrySchema = object({
+	label: string().trim().min(1).max(120).optional(),
+	helpText: string().trim().min(1).max(300).optional(),
+	placeholder: string().trim().min(1).max(200).optional(),
+	control: FormControlSchema.optional()
+});
+const FormFieldConfigSchema = record(string(), FormFieldConfigEntrySchema);
+const PublicFormFieldSchema = WorkflowInputFieldSchema.and(object({
+	control: FormControlSchema.optional(),
+	helpText: string().optional()
+}));
+const PublishedFormSchema = object({
+	id: string().min(1),
+	workflowId: string().min(1),
+	workflowSlug: string().min(1),
+	enabled: boolean(),
+	title: string().min(1).nullable(),
+	description: string().min(1).nullable(),
+	fieldConfig: FormFieldConfigSchema,
+	publicUrl: string().url(),
+	createdAt: string().min(1),
+	updatedAt: string().min(1)
+});
+object({
+	id: string().min(1),
+	projectId: string().min(1),
+	workflowSlug: string().min(1),
+	enabled: boolean(),
+	title: string().min(1).nullable(),
+	description: string().min(1).nullable(),
+	fieldConfig: FormFieldConfigSchema,
+	publicUrl: string().url(),
+	createdAt: string().min(1),
+	updatedAt: string().min(1)
+});
+PublishedFormSchema.nullable();
+object({
+	enabled: boolean().optional(),
+	title: string().trim().min(1).max(120).nullable().optional(),
+	description: string().trim().min(1).max(500).nullable().optional(),
+	fieldConfig: FormFieldConfigSchema.optional()
+});
+object({
+	title: string().min(1),
+	description: string().nullable(),
+	fields: array(PublicFormFieldSchema),
+	branding: object({
+		organizationName: string().min(1),
+		projectName: string().min(1),
+		logoLightUrl: string().url().nullable(),
+		logoDarkUrl: string().url().nullable(),
+		logoHeightPx: number$1().int().positive()
+	})
+});
+object({
+	values: record(string(), unknown()),
+	website: string().max(200).optional()
+});
+object({ ok: literal(true) });
+const isoDateTime = string().datetime();
+const sha256Hex = string().regex(/^[a-f0-9]{64}$/, "Expected a lowercase hex sha256 digest");
+/**
+* A single entry in a deploy's file tree, as served to the dashboard. Carries
+* no contents: `id` is a stable, path-derived handle used for selection and
+* `?file=` deep links; `hash` is the content address used to fetch the bytes
+* lazily and to cache them immutably in the browser.
+*/
+const ProjectFileSummarySchema = object({
+	id: string(),
+	path: string().min(1),
+	hash: sha256Hex
+});
+/** Maps a runtime resource slug (agent/workflow/skill) to its source file path. */
+const ProjectSourceResourceRefSchema = object({
+	slug: string().min(1),
+	path: string().min(1)
+});
+const ProjectSourceResourcesSchema = object({
+	agents: array(ProjectSourceResourceRefSchema).default([]),
+	workflows: array(ProjectSourceResourceRefSchema).default([]),
+	skills: array(ProjectSourceResourceRefSchema).default([])
+});
+const emptyResources = () => ({
+	agents: [],
+	workflows: [],
+	skills: []
+});
+object({
+	artifactId: string().nullable(),
+	files: array(ProjectFileSummarySchema),
+	resources: ProjectSourceResourcesSchema.default(emptyResources())
+});
+object({
+	path: string().min(1),
+	contents: string(),
+	hash: sha256Hex
+});
+object({ blobs: array(object({
+	hash: sha256Hex,
+	size: number$1().int().nonnegative()
+})) });
+object({ uploads: array(object({
+	hash: sha256Hex,
+	url: string().url()
+})) });
+object({ files: array(object({
+	path: string().min(1),
+	hash: sha256Hex
+})) });
+object({
+	ok: literal(true),
+	fileCount: number$1().int().nonnegative()
+});
+object({
+	files: array(object({
+		id: string(),
+		path: string().min(1),
+		hash: sha256Hex
+	})),
+	generatedAt: isoDateTime
+});
+/** A single source file returned by the bulk active-source download endpoint. */
+const DownloadActiveProjectSourceFileSchema = object({
+	path: string().min(1),
+	contents: string()
+});
+object({
+	artifactId: string(),
+	files: array(DownloadActiveProjectSourceFileSchema)
+});
+object({
+	projectId: string(),
+	artifactId: string(),
+	pulledAt: string().datetime()
+});
+object({ files: array(object({
+	id: string(),
+	path: string().min(1)
+})) });
+object({ files: array(object({
+	id: string(),
+	path: string().min(1)
+})) });
 record(string(), unknown());
 //#endregion
 //#region src/runtime.ts
@@ -7836,10 +8050,22 @@ const RUNTIME_ENV_KEYS = [
 	"REDIS_URL",
 	"KEYSTROKE_QUEUE_PREFIX"
 ];
+/**
+* Observability ingest config for org workers (PostHog error tracking + crash reports).
+* Ingest tokens only — never forward `POSTHOG_API_KEY` (management) into workers.
+*/
+const OBSERVABILITY_ENV_KEYS = [
+	"POSTHOG_PROJECT_TOKEN",
+	"POSTHOG_HOST",
+	"POSTHOG_FLUSH_MODE",
+	"KEYSTROKE_ENVIRONMENT",
+	"KEYSTROKE_RELEASE"
+];
 /** Env keys that must never be forwarded into untrusted org workers. */
 const FORBIDDEN_WORKER_ENV_KEYS = [
 	"BETTER_AUTH_SECRET",
 	"DATABASE_URL",
+	"POSTHOG_API_KEY",
 	"POSTGRES_PASSWORD",
 	"PLATFORM_WORKER_TOKEN",
 	"STRIPE_SECRET_KEY",
@@ -7883,6 +8109,11 @@ function buildRuntimeEnv(source, artifacts, database, extraEnv) {
 		if (!value) continue;
 		entries.set(key, value);
 	}
+	for (const key of OBSERVABILITY_ENV_KEYS) {
+		const value = source[key]?.trim();
+		if (!value) continue;
+		entries.set(key, value);
+	}
 	if (!extraEnv) for (const key of PROVIDER_ENV_KEYS) {
 		const value = source[key]?.trim();
 		if (value) entries.set(key, value);