@startup-api/cloudflare 0.3.2 → 0.4.1

package/src/auth/index.ts

@@ -2,8 +2,10 @@ import type { StartupAPIEnv } from '../StartupAPIEnv';
 
 import { CookieManager } from '../CookieManager';
 import { refreshEntitlements } from '../entitlements/service';
+import { renderAuthError } from './errorPage';
 import { computeRedirectBase, createProviders } from './providers';
 import type { ProviderConfigs } from './providers';
+import type { AuthContext, ExchangeResult, OAuthProvider } from './OAuthProvider';
 
 export async function handleAuth(
   request: Request,
@@ -25,21 +27,22 @@ export async function handleAuth(
   // Instantiate active providers
   const activeProviders = createProviders(env, redirectBase, providerConfigs);
 
+  const ctx: AuthContext = { request, env, url, redirectBase, authPath, usersPath, origin, cookieManager };
+
+  // Provider-specific auxiliary routes (e.g. the atproto client-metadata document).
+  for (const provider of activeProviders) {
+    const res = await provider.handleExtraRoute(ctx);
+    if (res) return res;
+  }
+
   // Handle Auth Start
   for (const provider of activeProviders) {
     if (provider.isMatch(path, authPath)) {
-      const returnUrl = url.searchParams.get('return_url');
-      const stateObj = {
-        nonce: Math.random().toString(36).substring(2),
-        return_url: returnUrl,
-      };
-      // Use robust base64 encoding for state
-      const state = btoa(unescape(encodeURIComponent(JSON.stringify(stateObj))))
-        .replace(/\+/g, '-')
-        .replace(/\//g, '_')
-        .replace(/=+$/, '');
-      const authUrl = provider.getAuthUrl(state);
-      return Response.redirect(authUrl, 302);
+      try {
+        return await provider.authorize(ctx);
+      } catch (e) {
+        return renderAuthError(e instanceof Error ? e.message : String(e), 500, usersPath);
+      }
     }
   }
 
@@ -47,207 +50,205 @@ export async function handleAuth(
   for (const provider of activeProviders) {
     if (provider.isCallback(path, authPath)) {
       console.log(`[Auth] Callback received for ${provider.name}`);
-      const code = url.searchParams.get('code');
-      if (!code) return new Response('Missing code', { status: 400 });
-
-      const stateBase64 = url.searchParams.get('state');
-      let returnUrl: string | null = null;
-      if (stateBase64) {
-        try {
-          // Robust base64 decoding
-          const base64 = stateBase64.replace(/-/g, '+').replace(/_/g, '/');
-          const stateJson = decodeURIComponent(escape(atob(base64)));
-          const stateObj = JSON.parse(stateJson);
-          returnUrl = stateObj.return_url;
-        } catch (e) {
-          console.error('Failed to parse state', e);
-        }
+      try {
+        const result = await provider.exchange(ctx);
+        return await finishLogin(provider, result, ctx);
+      } catch (e) {
+        const status = (e as { status?: number })?.status ?? 500;
+        return renderAuthError(e instanceof Error ? e.message : String(e), status, usersPath);
       }
+    }
+  }
 
-      try {
-        const token = await provider.getToken(code);
-        const profile = await provider.getUserProfile(token.access_token);
-
-        const systemStub = env.SYSTEM.get(env.SYSTEM.idFromName('global'));
-
-        // 1. Try to resolve existing user by credential
-        const credentialStub = env.CREDENTIAL.get(env.CREDENTIAL.idFromName(provider.name));
-        const resolveData = await credentialStub.get(profile.id);
-
-        let userIdStr: string | null = null;
-        let staleSessionId: string | null = null;
-
-        if (resolveData) {
-          userIdStr = resolveData.user_id;
-        } else {
-          // 2. Not found, check if user is already logged in (to link account)
-          const cookieHeader = request.headers.get('Cookie');
-          if (cookieHeader) {
-            const cookies = cookieHeader.split(';').reduce(
-              (acc, cookie) => {
-                const [key, value] = cookie.split('=').map((c) => c.trim());
-                if (key && value) acc[key] = value;
-                return acc;
-              },
-              {} as Record<string, string>,
-            );
-            const sessionCookieEncrypted = cookies['session_id'];
-            if (sessionCookieEncrypted) {
-              const sessionCookie = await cookieManager.decrypt(sessionCookieEncrypted);
-              if (sessionCookie && sessionCookie.includes(':')) {
-                const parts = sessionCookie.split(':');
-                staleSessionId = parts[0];
-                userIdStr = parts[1];
-              }
-            }
-          }
-        }
+  return new Response('Auth route not found', { status: 404 });
+}
 
-        if (userIdStr) {
-          // Verify user still exists (has a profile)
-          const userStub = env.USER.get(env.USER.idFromString(userIdStr));
-          const profileData = await userStub.getProfile();
-          if (Object.keys(profileData).length === 0) {
-            // User was deleted!
-            if (staleSessionId) {
-              try {
-                await userStub.deleteSession(staleSessionId);
-              } catch (_e) {
-                // ignore
-              }
-            }
-            userIdStr = null;
-          }
+/**
+ * Shared post-exchange login finalization, provider-agnostic: resolve or create the user, link the
+ * credential, fetch login-time entitlements, ensure a personal account exists, mint a session and set
+ * the session cookie. `result.setCookies` lets a provider emit additional cookies (e.g. clearing
+ * transient flow state).
+ */
+async function finishLogin(provider: OAuthProvider, result: ExchangeResult, ctx: AuthContext): Promise<Response> {
+  const { env, request, usersPath, origin, cookieManager } = ctx;
+  const { token, profile, returnUrl } = result;
+
+  const systemStub = env.SYSTEM.get(env.SYSTEM.idFromName('global'));
+
+  // 1. Try to resolve existing user by credential
+  const credentialStub = env.CREDENTIAL.get(env.CREDENTIAL.idFromName(provider.name));
+  const resolveData = await credentialStub.get(profile.id);
+
+  let userIdStr: string | null = null;
+  let staleSessionId: string | null = null;
+
+  if (resolveData) {
+    userIdStr = resolveData.user_id;
+  } else {
+    // 2. Not found, check if user is already logged in (to link account)
+    const cookieHeader = request.headers.get('Cookie');
+    if (cookieHeader) {
+      const cookies = cookieHeader.split(';').reduce(
+        (acc, cookie) => {
+          const [key, value] = cookie.split('=').map((c) => c.trim());
+          if (key && value) acc[key] = value;
+          return acc;
+        },
+        {} as Record<string, string>,
+      );
+      const sessionCookieEncrypted = cookies['session_id'];
+      if (sessionCookieEncrypted) {
+        const sessionCookie = await cookieManager.decrypt(sessionCookieEncrypted);
+        if (sessionCookie && sessionCookie.includes(':')) {
+          const parts = sessionCookie.split(':');
+          staleSessionId = parts[0];
+          userIdStr = parts[1];
         }
+      }
+    }
+  }
 
-        const isNewUser = !userIdStr;
-        const id = userIdStr ? env.USER.idFromString(userIdStr) : env.USER.newUniqueId();
-        const userStub = env.USER.get(id);
-        userIdStr = id.toString();
-
-        // Fetch and Store Avatar (Only for new users)
-        if (isNewUser && profile.picture) {
-          try {
-            const picRes = await fetch(profile.picture);
-            if (picRes.ok) {
-              const picBlob = await picRes.arrayBuffer();
-              await userStub.storeImage('avatar', picBlob, picRes.headers.get('Content-Type') || 'image/jpeg');
-              // Update profile.picture to point to our worker
-              profile.picture = usersPath + 'me/avatar';
-            }
-          } catch (e) {
-            console.error('Failed to fetch avatar', e);
-          }
+  if (userIdStr) {
+    // Verify user still exists (has a profile)
+    const userStub = env.USER.get(env.USER.idFromString(userIdStr));
+    const profileData = await userStub.getProfile();
+    if (Object.keys(profileData).length === 0) {
+      // User was deleted!
+      if (staleSessionId) {
+        try {
+          await userStub.deleteSession(staleSessionId);
+        } catch (_e) {
+          // ignore
         }
+      }
+      userIdStr = null;
+    }
+  }
 
-        // Register credential in provider-specific CredentialDO
-        await credentialStub.put({
-          user_id: userIdStr,
+  const isNewUser = !userIdStr;
+  const id = userIdStr ? env.USER.idFromString(userIdStr) : env.USER.newUniqueId();
+  const userStub = env.USER.get(id);
+  userIdStr = id.toString();
+
+  // Fetch and Store Avatar (Only for new users)
+  if (isNewUser && profile.picture) {
+    try {
+      const picRes = await fetch(profile.picture);
+      if (picRes.ok) {
+        const picBlob = await picRes.arrayBuffer();
+        await userStub.storeImage('avatar', picBlob, picRes.headers.get('Content-Type') || 'image/jpeg');
+        // Update profile.picture to point to our worker
+        profile.picture = usersPath + 'me/avatar';
+      }
+    } catch (e) {
+      console.error('Failed to fetch avatar', e);
+    }
+  }
+
+  // Register credential in provider-specific CredentialDO
+  await credentialStub.put({
+    user_id: userIdStr,
+    subject_id: profile.id,
+    access_token: token.access_token,
+    refresh_token: token.refresh_token,
+    expires_at: token.expires_in ? Date.now() + token.expires_in * 1000 : undefined,
+    scope: token.scope,
+    profile_data: profile,
+  });
+
+  // Register credential mapping in UserDO
+  await userStub.addCredential(provider.name, profile.id);
+
+  // Login-time entitlement fetch: providers that support entitlements (e.g. Patreon) get an
+  // initial entitlement snapshot now, so gating works even when no freshness mechanism is
+  // configured. Best-effort — never block or fail login on an entitlement error.
+  if (provider.supportsEntitlements()) {
+    try {
+      await refreshEntitlements(
+        env,
+        provider,
+        {
           subject_id: profile.id,
+          user_id: userIdStr,
           access_token: token.access_token,
           refresh_token: token.refresh_token,
           expires_at: token.expires_in ? Date.now() + token.expires_in * 1000 : undefined,
-          scope: token.scope,
+          scope: typeof token.scope === 'string' ? token.scope : undefined,
           profile_data: profile,
-        });
-
-        // Register credential mapping in UserDO
-        await userStub.addCredential(provider.name, profile.id);
-
-        // Login-time entitlement fetch: providers that support entitlements (e.g. Patreon) get an
-        // initial entitlement snapshot now, so gating works even when no freshness mechanism is
-        // configured. Best-effort — never block or fail login on an entitlement error.
-        if (provider.supportsEntitlements()) {
-          try {
-            await refreshEntitlements(
-              env,
-              provider,
-              {
-                subject_id: profile.id,
-                user_id: userIdStr,
-                access_token: token.access_token,
-                refresh_token: token.refresh_token,
-                expires_at: token.expires_in ? Date.now() + token.expires_in * 1000 : undefined,
-                scope: typeof token.scope === 'string' ? token.scope : undefined,
-                profile_data: profile,
-              },
-              'oauth',
-            );
-          } catch (e) {
-            console.error('[auth] Login-time entitlement fetch failed', e);
-          }
-        }
+        },
+        'oauth',
+      );
+    } catch (e) {
+      console.error('[auth] Login-time entitlement fetch failed', e);
+    }
+  }
 
-        // Register User in SystemDO index (Only for new users)
-        if (isNewUser) {
-          await userStub.updateProfile(profile);
-          await systemStub.registerUser({
-            id: userIdStr,
-            name: profile.name || userIdStr,
-            email: profile.email,
-            provider: provider.name,
-          });
-        }
+  // Register User in SystemDO index (Only for new users)
+  if (isNewUser) {
+    await userStub.updateProfile(profile);
+    await systemStub.registerUser({
+      id: userIdStr,
+      name: profile.name || userIdStr,
+      email: profile.email,
+      provider: provider.name,
+    });
+  }
 
-        // Ensure user has at least one account
-        const memberships = await userStub.getMemberships();
-
-        if (memberships.length === 0) {
-          // Create a personal account
-          const accountId = env.ACCOUNT.newUniqueId();
-          const accountStub = env.ACCOUNT.get(accountId);
-          const accountIdStr = accountId.toString();
-
-          // Initialize account info
-          await accountStub.updateInfo({
-            name: `${profile.name || userIdStr}'s Account`,
-            personal: true,
-          });
-
-          // Register Account in SystemDO
-          await systemStub.registerAccount({
-            id: accountIdStr,
-            name: `${profile.name || profile.id}'s Account`,
-            status: 'active',
-            plan: 'free',
-          });
-
-          // Add user as ADMIN to the account
-          await accountStub.addMember(id.toString(), 1);
-
-          // Add membership to user
-          await userStub.addMembership(accountIdStr, 1, true);
-        }
+  // Ensure user has at least one account
+  const memberships = await userStub.getMemberships();
+
+  if (memberships.length === 0) {
+    // Create a personal account
+    const accountId = env.ACCOUNT.newUniqueId();
+    const accountStub = env.ACCOUNT.get(accountId);
+    const accountIdStr = accountId.toString();
+
+    // Initialize account info
+    await accountStub.updateInfo({
+      name: `${profile.name || userIdStr}'s Account`,
+      personal: true,
+    });
+
+    // Register Account in SystemDO
+    await systemStub.registerAccount({
+      id: accountIdStr,
+      name: `${profile.name || profile.id}'s Account`,
+      status: 'active',
+      plan: 'free',
+    });
+
+    // Add user as ADMIN to the account
+    await accountStub.addMember(id.toString(), 1);
+
+    // Add membership to user
+    await userStub.addMembership(accountIdStr, 1, true);
+  }
 
-        // Create Session
-        const session = await userStub.createSession({ provider: provider.name });
-
-        // Set cookie and redirect
-        const encryptedSession = await cookieManager.encrypt(`${session.sessionId}:${userIdStr}`);
-        const headers = new Headers();
-        headers.set('Set-Cookie', `session_id=${encryptedSession}; Path=/; HttpOnly; Secure; SameSite=Lax`);
-
-        let redirectUrl = !isNewUser ? usersPath + 'profile.html' : '/';
-        if (returnUrl) {
-          try {
-            const parsedReturn = new URL(returnUrl, origin);
-            if (parsedReturn.origin === origin) {
-              redirectUrl = parsedReturn.toString();
-            }
-          } catch (_e) {
-            if (returnUrl.startsWith('/')) {
-              redirectUrl = returnUrl;
-            }
-          }
-        }
+  // Create Session
+  const session = await userStub.createSession({ provider: provider.name });
 
-        headers.set('Location', redirectUrl);
-        return new Response(null, { status: 302, headers });
-      } catch (e) {
-        return new Response(`Auth failed: ${e instanceof Error ? e.message : String(e)}`, { status: 500 });
+  // Set cookie and redirect
+  const encryptedSession = await cookieManager.encrypt(`${session.sessionId}:${userIdStr}`);
+  const headers = new Headers();
+  headers.set('Set-Cookie', `session_id=${encryptedSession}; Path=/; HttpOnly; Secure; SameSite=Lax`);
+  for (const cookie of result.setCookies ?? []) {
+    headers.append('Set-Cookie', cookie);
+  }
+
+  let redirectUrl = !isNewUser ? usersPath + 'profile.html' : '/';
+  if (returnUrl) {
+    try {
+      const parsedReturn = new URL(returnUrl, origin);
+      if (parsedReturn.origin === origin) {
+        redirectUrl = parsedReturn.toString();
+      }
+    } catch (_e) {
+      if (returnUrl.startsWith('/')) {
+        redirectUrl = returnUrl;
       }
     }
   }
 
-  return new Response('Auth route not found', { status: 404 });
+  headers.set('Location', redirectUrl);
+  return new Response(null, { status: 302, headers });
 }

package/src/auth/providers.ts

@@ -4,6 +4,7 @@ import { OAuthProvider } from './OAuthProvider';
 import { GoogleProvider } from './GoogleProvider';
 import { TwitchProvider } from './TwitchProvider';
 import { PatreonProvider } from './PatreonProvider';
+import { AtprotoProvider } from './AtprotoProvider';
 
 export type ProviderConfigs = Record<string, ProviderOptions>;
 
@@ -25,6 +26,7 @@ export function createProviders(env: StartupAPIEnv, redirectBase: string, provid
     GoogleProvider.create(env, redirectBase, providerConfigs.google),
     TwitchProvider.create(env, redirectBase, providerConfigs.twitch),
     PatreonProvider.create(env, redirectBase, providerConfigs.patreon),
+    AtprotoProvider.create(env, redirectBase, providerConfigs.atproto),
   ].filter((p): p is OAuthProvider => p !== null);
 }
 

package/src/createStartupAPI.ts

@@ -167,7 +167,7 @@ export function createStartupAPI(config: StartupAPIConfig = {}) {
       const isAccounts = subPath === 'accounts.html' || subPath === 'accounts';
 
       if (isProfile || isAccounts) {
-        return handleSSR(request, env, url, usersPath, cookieManager);
+        return handleSSR(request, env, url, usersPath, cookieManager, providerConfigs);
       }
     }
 
@@ -262,7 +262,7 @@ export function createStartupAPI(config: StartupAPIConfig = {}) {
 
     // Admin Routes
     if (url.pathname.startsWith(usersPath + 'admin/')) {
-      return handleAdmin(request, env, usersPath, cookieManager);
+      return handleAdmin(request, env, usersPath, cookieManager, providerConfigs);
     }
 
     // Intercept requests to usersPath and serve them from the public/users directory.
@@ -336,7 +336,7 @@ export function createStartupAPI(config: StartupAPIConfig = {}) {
         return denyResponse(decision, {
           usersPath,
           returnUrl,
-          activeProviders: getActiveProviders(env),
+          activeProviders: getActiveProviders(env, providerConfigs),
           authenticated,
           request,
           env,
@@ -345,7 +345,7 @@ export function createStartupAPI(config: StartupAPIConfig = {}) {
       }
 
       const response = await originFetch(newRequest);
-      const providers = getActiveProviders(env);
+      const providers = getActiveProviders(env, providerConfigs);
       return injectPowerStrip(response, usersPath, providers);
     }
 

package/src/handlers/admin.ts

@@ -1,6 +1,7 @@
 import { StartupAPIEnv } from '../StartupAPIEnv';
 import { CookieManager } from '../CookieManager';
 import { getUserFromSession, checkAndClearStaleSession, isAdmin, parseCookies, getActiveProviders } from './utils';
+import type { ProviderConfigs } from '../auth/providers';
 import { Plan } from '../billing/Plan';
 import { UserProfileSchema } from '../schemas/user';
 import { SystemAccountSchema, MemberSchema } from '../schemas/account';
@@ -11,6 +12,7 @@ export async function handleAdmin(
   env: StartupAPIEnv,
   usersPath: string,
   cookieManager: CookieManager,
+  providerConfigs: ProviderConfigs = {},
 ): Promise<Response> {
   const user = await getUserFromSession(request, env, cookieManager);
   if (!user || !isAdmin(user, env)) {
@@ -31,7 +33,7 @@ export async function handleAdmin(
     html = html.replace(/\{\{ssr:([a-z0-9_]+)\}\}/g, (match, key) => {
       const replacements: Record<string, string> = {
         plans_json: JSON.stringify(Plan.getAll()).replace(/"/g, '&quot;'),
-        providers: getActiveProviders(env).join(','),
+        providers: getActiveProviders(env, providerConfigs).join(','),
       };
       return replacements[key] !== undefined ? replacements[key] : match;
     });

package/src/handlers/ssr.ts

@@ -1,6 +1,8 @@
 import { StartupAPIEnv } from '../StartupAPIEnv';
 import { CookieManager } from '../CookieManager';
 import { getUserFromSession, checkAndClearStaleSession, isAdmin, getActiveProviders } from './utils';
+import type { ProviderConfigs } from '../auth/providers';
+import { ATMOSPHERE_MARK_PATH } from '../auth/atmosphereMark';
 import { Plan } from '../billing/Plan';
 
 export async function handleSSR(
@@ -9,6 +11,7 @@ export async function handleSSR(
   url: URL,
   usersPath: string,
   cookieManager: CookieManager,
+  providerConfigs: ProviderConfigs = {},
 ): Promise<Response> {
   const user = await getUserFromSession(request, env, cookieManager);
   if (!user) {
@@ -90,7 +93,7 @@ export async function handleSSR(
     // Prepare SSR values
     const replacements: Record<string, string> = {
       plans_json: JSON.stringify(Plan.getAll()).replace(/"/g, '&quot;'),
-      providers: getActiveProviders(env).join(','),
+      providers: getActiveProviders(env, providerConfigs).join(','),
       profile_json: JSON.stringify(data).replace(/"/g, '&quot;'),
       credentials_json: JSON.stringify(credentials).replace(/"/g, '&quot;'),
       profile_name: data.profile.name || 'Anonymous',
@@ -105,7 +108,7 @@ export async function handleSSR(
         : '',
       nav_account_display: account && (account.role === 1 || data.is_admin) ? 'display: block;' : 'display: none;',
       credentials_list_html: renderCredentialsList(credentials, data.credential?.provider),
-      link_credentials_html: renderLinkCredentialsList(getActiveProviders(env), url.href),
+      link_credentials_html: renderLinkCredentialsList(getActiveProviders(env, providerConfigs), url.href),
     };
 
     if (account) {
@@ -212,6 +215,8 @@ function getProviderIcon(provider: string): string {
     return '<svg viewBox="0 0 24 24" width="24" height="24" class="twitch-icon"><path d="M11.571 4.714h1.715v5.143H11.57zm4.715 0H18v5.143h-1.714zM6 0L1.714 4.286v15.428h5.143V24l4.286-4.286h3.428L22.286 12V0zm14.571 11.143l-3.428 3.428h-3.429l-3 3v-3H6.857V1.714h13.714z" fill="currentColor"/></svg>';
   } else if (provider === 'patreon') {
     return '<svg viewBox="0 0 24 24" width="24" height="24" class="patreon-icon"><path d="M14.82 2.41c3.96 0 7.18 3.24 7.18 7.21 0 3.96-3.22 7.18-7.18 7.18-3.97 0-7.21-3.22-7.21-7.18 0-3.97 3.24-7.21 7.21-7.21M2 21.6h3.5V2.41H2V21.6z" fill="currentColor"/></svg>';
+  } else if (provider === 'atproto') {
+    return `<svg viewBox="0 0 32 32" width="24" height="24" class="atproto-icon"><path fill-rule="evenodd" clip-rule="evenodd" d="${ATMOSPHERE_MARK_PATH}" fill="#4a8ad4"/></svg>`;
   }
   return '';
 }

package/src/handlers/utils.ts

@@ -1,7 +1,9 @@
 import { StartupAPIEnv } from '../StartupAPIEnv';
 import { CookieManager } from '../CookieManager';
+import { isAtprotoEnabled } from '../auth/AtprotoProvider';
+import type { ProviderConfigs } from '../auth/providers';
 
-export function getActiveProviders(env: StartupAPIEnv): string[] {
+export function getActiveProviders(env: StartupAPIEnv, providerConfigs: ProviderConfigs = {}): string[] {
   const providers: string[] = [];
   if (env.GOOGLE_CLIENT_ID && env.GOOGLE_CLIENT_SECRET) {
     providers.push('google');
@@ -12,6 +14,10 @@ export function getActiveProviders(env: StartupAPIEnv): string[] {
   if (env.PATREON_CLIENT_ID && env.PATREON_CLIENT_SECRET) {
     providers.push('patreon');
   }
+  // atproto has no env credentials; it is enabled via factory config or the ATPROTO_ENABLED env flag.
+  if (isAtprotoEnabled(providerConfigs.atproto, env)) {
+    providers.push('atproto');
+  }
   return providers;
 }
 

package/src/schemas/config.ts

@@ -28,6 +28,12 @@ export const ProviderOptionsSchema = z.object({
   scopes: z.union([z.string(), z.array(z.string())]).optional(),
   /** Patreon only: restrict entitlements to a single campaign id. */
   campaignId: z.string().optional(),
+  /** atproto only: display name advertised in the client-metadata document. Default: "StartupAPI". */
+  clientName: z.string().optional(),
+  /** atproto only: override the PLC directory used to resolve did:plc identities. Default: https://plc.directory. */
+  plcUrl: z.string().optional(),
+  /** atproto only: override the DNS-over-HTTPS resolver used for handle resolution. */
+  dohUrl: z.string().optional(),
   freshness: ProviderFreshnessSchema.optional(),
 });
 

package/worker-configuration.d.ts

@@ -1,5 +1,5 @@
 /* eslint-disable */
-// Generated by Wrangler by running `wrangler types` (hash: 38595a6a948093665f11cb1bc4cd28e8)
+// Generated by Wrangler by running `wrangler types` (hash: 21e6c5c76a7bbde8583fcbcc839c03e7)
 // Runtime types generated with workerd@1.20260120.0 2025-09-27 global_fetch_strictly_public
 declare namespace Cloudflare {
 	interface GlobalProps {
@@ -15,7 +15,6 @@ declare namespace Cloudflare {
 		ORIGIN_URL: "https://startup-api-demo-origin.sergeychernyshev.workers.dev/";
 		TWITCH_CLIENT_ID: "";
 		TWITCH_CLIENT_SECRET: "";
-		GITHUB_PROJECT_ID: string;
 		USER: DurableObjectNamespace<import("./src/index").UserDO>;
 		ACCOUNT: DurableObjectNamespace<import("./src/index").AccountDO>;
 		SYSTEM: DurableObjectNamespace<import("./src/index").SystemDO>;
@@ -36,7 +35,6 @@ declare namespace Cloudflare {
 		PATREON_CLIENT_ID: "";
 		PATREON_CLIENT_SECRET: "";
 		PATREON_WEBHOOK_SECRET: "";
-		GITHUB_PROJECT_ID: string;
 		USER: DurableObjectNamespace<import("./src/index").UserDO>;
 		ACCOUNT: DurableObjectNamespace<import("./src/index").AccountDO>;
 		SYSTEM: DurableObjectNamespace<import("./src/index").SystemDO>;
@@ -56,14 +54,12 @@ declare namespace Cloudflare {
 		PATREON_CLIENT_ID: "patreon-id";
 		PATREON_CLIENT_SECRET: "patreon-secret";
 		PATREON_WEBHOOK_SECRET: "whsec-test";
-		GITHUB_PROJECT_ID: string;
 		USER: DurableObjectNamespace<import("./src/index").UserDO>;
 		ACCOUNT: DurableObjectNamespace<import("./src/index").AccountDO>;
 		SYSTEM: DurableObjectNamespace<import("./src/index").SystemDO>;
 		CREDENTIAL: DurableObjectNamespace<import("./src/index").CredentialDO>;
 	}
 	interface Env {
-		GITHUB_PROJECT_ID: string;
 		IMAGE_STORAGE: R2Bucket;
 		ASSETS: Fetcher;
 		ENVIRONMENT?: "preview" | "" | "test";