astro-atmosphere-comments 0.1.1 → 0.3.0

package/locales/it.json

@@ -0,0 +1,78 @@
+{
+  "signIn.heading": "Accedi per commentare, mettere mi piace o ripubblicare",
+  "signIn.anyAccount": "Va bene qualsiasi {{atmosphereAccount}}, anche quello di {{bluesky}}: un solo account per un'intera rete di app aperte.",
+  "signIn.atmosphereAccount": "account Atmosphere",
+  "signIn.button": "Accedi con Atmosphere",
+  "signIn.matchingAccounts": "Account corrispondenti",
+  "signIn.privacy": "Darai l'approvazione sul sito del tuo account (quello di Bluesky, per la maggior parte delle persone); la tua password non viene mai condivisa qui. Non hai ancora un account? {{createAccount}}.",
+  "signIn.createAccount": "Crea un account Atmosphere gratuito",
+  "elsewhere.text": "Preferisci non accedere qui? {{link}} La tua risposta compare qui allo stesso modo, così come i mi piace e le ripubblicazioni.",
+  "elsewhere.link": "Rispondi su Bluesky →",
+  "actions.label": "Rispondi a questo post",
+  "actions.like": "Mi piace",
+  "actions.liked": "Ti piace",
+  "actions.repost": "Ripubblica",
+  "actions.reposted": "Ripubblicato",
+  "actions.quote": "Cita",
+  "composer.commentAs": "{{verb}} come {{handle}}",
+  "composer.comment": "Commenta",
+  "composer.quote": "Cita",
+  "composer.mentions": "Account da menzionare",
+  "composer.previewCaption": "Ecco come apparirà il tuo post",
+  "composer.now": "ora",
+  "composer.previewEmpty": "Il tuo testo appare qui.",
+  "composer.quoting": "Stai citando questo post sul tuo account",
+  "composer.replyingTo": "In risposta a {{name}}",
+  "composer.cancel": "Annulla",
+  "composer.signOut": "Esci",
+  "composer.postComment": "Pubblica commento",
+  "composer.postQuote": "Pubblica citazione",
+  "composer.charactersLeft_one": "Ne resta {{count}}",
+  "composer.charactersLeft_many": "Ne restano {{count}}",
+  "composer.charactersLeft_other": "Ne restano {{count}}",
+  "composer.posting": "Pubblicazione…",
+  "posted.comment": "Il tuo commento è pubblicato.",
+  "posted.quote": "La tua citazione è su Bluesky.",
+  "posted.see": "Vedila su Bluesky →",
+  "reactions.likes_one": "{{count}} mi piace",
+  "reactions.likes_many": "{{count}} mi piace",
+  "reactions.likes_other": "{{count}} mi piace",
+  "reactions.reposts_one": "{{count}} ripubblicazione",
+  "reactions.reposts_many": "{{count}} ripubblicazioni",
+  "reactions.reposts_other": "{{count}} ripubblicazioni",
+  "comment.author": "Autore",
+  "comment.viewOnBluesky": "vedi su Bluesky",
+  "comment.someone": "questo commento",
+  "comment.reply": "Rispondi",
+  "comment.replyTo": "Rispondi a {{name}}",
+  "comment.likeLabel": "Metti mi piace al commento di {{name}}",
+  "comment.repostLabel": "Ripubblica il commento di {{name}}",
+  "comment.delete": "Elimina",
+  "comment.deleteLabel": "Elimina il tuo commento",
+  "comment.deleteConfirm": "Eliminare questo commento da Bluesky?",
+  "comment.deleting": "Eliminazione…",
+  "comment.deleted": "Il tuo commento è stato eliminato.",
+  "comment.deletePermission": "Per eliminare i commenti qui, questo sito ha bisogno di un'altra autorizzazione dal tuo account. Puoi anche eliminarlo in qualsiasi app di Bluesky.",
+  "comment.continue": "Continua per approvare",
+  "comment.cancel": "Annulla",
+  "signInFirst.reply": "Accedi per rispondere.",
+  "signInFirst.like": "Accedi per mettere mi piace ai commenti.",
+  "signInFirst.repost": "Accedi per ripubblicare i commenti.",
+  "status.liked": "Ti piace.",
+  "status.likeRemoved": "Mi piace rimosso.",
+  "status.reposted": "Ripubblicato.",
+  "status.repostRemoved": "Ripubblicazione rimossa.",
+  "status.signedOut": "Sei uscito.",
+  "messages.signedIn": "Hai effettuato l'accesso. Puoi commentare, mettere mi piace o ripubblicare qui sopra.",
+  "messages.signInFailed": "L'accesso non è stato completato. Riprova.",
+  "messages.accountNotFound": "Non abbiamo trovato quell'account. Controlla l'handle e riprova.",
+  "messages.invalidHandle": "Non sembra un handle. Di solito è qualcosa come alice.bsky.social.",
+  "messages.signedOut": "Sei stato disconnesso. Accedi di nuovo.",
+  "messages.needsPermission": "Per eliminare i commenti qui, questo sito ha bisogno di un'altra autorizzazione dal tuo account.",
+  "messages.notAllowed": "Qui non si può fare.",
+  "messages.newPermissions": "Ora questo sito può anche mettere mi piace e ripubblicare per te, quindi ha di nuovo bisogno della tua autorizzazione. Accedi di nuovo.",
+  "messages.tooLong": "I post possono avere fino a {{max}} caratteri.",
+  "messages.tooMany": "Stai andando un po' veloce. Aspetta un minuto e riprova.",
+  "messages.error": "Non ha funzionato. Riprova.",
+  "credit": "Realizzato con {{link}}"
+}

package/locales/ja.json

@@ -0,0 +1,72 @@
+{
+  "signIn.heading": "ログインしてコメント、いいね、リポストする",
+  "signIn.anyAccount": "{{bluesky}}を含め、どの{{atmosphereAccount}}でも使えます。ひとつのアカウントで、オープンなアプリのネットワーク全体を利用できます。",
+  "signIn.atmosphereAccount": "Atmosphereアカウント",
+  "signIn.button": "Atmosphereでログイン",
+  "signIn.matchingAccounts": "一致するアカウント",
+  "signIn.privacy": "承認はご自身のアカウントのサイト（ほとんどの方はBluesky）で行います。パスワードがこのサイトに渡ることはありません。アカウントをお持ちでない方は{{createAccount}}。",
+  "signIn.createAccount": "無料のAtmosphereアカウントを作成",
+  "elsewhere.text": "ここでログインしたくない場合は、{{link}} 返信は同じようにここに表示されます。いいねやリポストも同様です。",
+  "elsewhere.link": "Blueskyで返信 →",
+  "actions.label": "この投稿に反応する",
+  "actions.like": "いいね",
+  "actions.liked": "いいね済み",
+  "actions.repost": "リポスト",
+  "actions.reposted": "リポスト済み",
+  "actions.quote": "引用",
+  "composer.commentAs": "{{handle}}として{{verb}}",
+  "composer.comment": "コメント",
+  "composer.quote": "引用",
+  "composer.mentions": "メンションするアカウント",
+  "composer.previewCaption": "投稿の表示イメージ",
+  "composer.now": "たった今",
+  "composer.previewEmpty": "ここに文章が表示されます。",
+  "composer.quoting": "ご自身のアカウントでこの投稿を引用します",
+  "composer.replyingTo": "{{name}}への返信",
+  "composer.cancel": "キャンセル",
+  "composer.signOut": "ログアウト",
+  "composer.postComment": "コメントを投稿",
+  "composer.postQuote": "引用を投稿",
+  "composer.charactersLeft_other": "残り{{count}}文字",
+  "composer.posting": "投稿中…",
+  "posted.comment": "コメントを投稿しました。",
+  "posted.quote": "引用をBlueskyに投稿しました。",
+  "posted.see": "Blueskyで見る →",
+  "reactions.likes_other": "{{count}}件のいいね",
+  "reactions.reposts_other": "{{count}}件のリポスト",
+  "comment.author": "作成者",
+  "comment.viewOnBluesky": "Blueskyで見る",
+  "comment.someone": "このコメント",
+  "comment.reply": "返信",
+  "comment.replyTo": "{{name}}に返信",
+  "comment.likeLabel": "{{name}}のコメントにいいね",
+  "comment.repostLabel": "{{name}}のコメントをリポスト",
+  "comment.delete": "削除",
+  "comment.deleteLabel": "コメントを削除",
+  "comment.deleteConfirm": "このコメントをBlueskyから削除しますか？",
+  "comment.deleting": "削除中…",
+  "comment.deleted": "コメントを削除しました。",
+  "comment.deletePermission": "ここでコメントを削除するには、このサイトにアカウントからの許可がもうひとつ必要です。Blueskyのアプリから削除することもできます。",
+  "comment.continue": "許可に進む",
+  "comment.cancel": "キャンセル",
+  "signInFirst.reply": "返信するにはログインしてください。",
+  "signInFirst.like": "コメントにいいねするにはログインしてください。",
+  "signInFirst.repost": "コメントをリポストするにはログインしてください。",
+  "status.liked": "いいねしました。",
+  "status.likeRemoved": "いいねを取り消しました。",
+  "status.reposted": "リポストしました。",
+  "status.repostRemoved": "リポストを取り消しました。",
+  "status.signedOut": "ログアウトしました。",
+  "messages.signedIn": "ログインしました。上からコメント、いいね、リポストができます。",
+  "messages.signInFailed": "ログインが完了しませんでした。もう一度お試しください。",
+  "messages.accountNotFound": "そのアカウントが見つかりませんでした。ハンドルを確認して、もう一度お試しください。",
+  "messages.invalidHandle": "ハンドルではないようです。通常は alice.bsky.social のような形式です。",
+  "messages.signedOut": "ログアウトされました。もう一度ログインしてください。",
+  "messages.needsPermission": "ここでコメントを削除するには、このサイトにアカウントからの許可がもうひとつ必要です。",
+  "messages.notAllowed": "ここではその操作はできません。",
+  "messages.newPermissions": "このサイトはいいねとリポストもできるようになったため、改めて許可が必要です。もう一度ログインしてください。",
+  "messages.tooLong": "投稿は{{max}}文字までです。",
+  "messages.tooMany": "操作が早すぎます。1分待ってから、もう一度お試しください。",
+  "messages.error": "うまくいきませんでした。もう一度お試しください。",
+  "credit": "{{link}}で動作しています"
+}

package/locales/nl.json

@@ -0,0 +1,75 @@
+{
+  "signIn.heading": "Log in om te reageren, te liken of te reposten",
+  "signIn.anyAccount": "Elk {{atmosphereAccount}} werkt, ook {{bluesky}}: één account voor een heel netwerk van open apps.",
+  "signIn.atmosphereAccount": "Atmosphere-account",
+  "signIn.button": "Inloggen met Atmosphere",
+  "signIn.matchingAccounts": "Overeenkomende accounts",
+  "signIn.privacy": "Je keurt dit goed op de site van je eigen account (voor de meeste mensen die van Bluesky); je wachtwoord wordt hier nooit gedeeld. Nog geen account? {{createAccount}}.",
+  "signIn.createAccount": "Maak gratis een Atmosphere-account",
+  "elsewhere.text": "Liever hier niet inloggen? {{link}} Je reactie verschijnt hier net zo goed, net als likes en reposts.",
+  "elsewhere.link": "Reageer op Bluesky →",
+  "actions.label": "Reageer op dit bericht",
+  "actions.like": "Liken",
+  "actions.liked": "Geliket",
+  "actions.repost": "Reposten",
+  "actions.reposted": "Gerepost",
+  "actions.quote": "Citeren",
+  "composer.commentAs": "{{verb}} als {{handle}}",
+  "composer.comment": "Reageren",
+  "composer.quote": "Citeren",
+  "composer.mentions": "Accounts om te noemen",
+  "composer.previewCaption": "Zo ziet je bericht eruit",
+  "composer.now": "nu",
+  "composer.previewEmpty": "Je tekst verschijnt hier.",
+  "composer.quoting": "Je citeert dit bericht met je eigen account",
+  "composer.replyingTo": "Reactie op {{name}}",
+  "composer.cancel": "Annuleren",
+  "composer.signOut": "Uitloggen",
+  "composer.postComment": "Reactie plaatsen",
+  "composer.postQuote": "Citaat plaatsen",
+  "composer.charactersLeft_one": "Nog {{count}} teken",
+  "composer.charactersLeft_other": "Nog {{count}} tekens",
+  "composer.posting": "Plaatsen…",
+  "posted.comment": "Je reactie is geplaatst.",
+  "posted.quote": "Je citaat staat op Bluesky.",
+  "posted.see": "Bekijk het op Bluesky →",
+  "reactions.likes_one": "{{count}} like",
+  "reactions.likes_other": "{{count}} likes",
+  "reactions.reposts_one": "{{count}} repost",
+  "reactions.reposts_other": "{{count}} reposts",
+  "comment.author": "Auteur",
+  "comment.viewOnBluesky": "bekijk op Bluesky",
+  "comment.someone": "deze reactie",
+  "comment.reply": "Reageren",
+  "comment.replyTo": "Reageer op {{name}}",
+  "comment.likeLabel": "De reactie van {{name}} liken",
+  "comment.repostLabel": "De reactie van {{name}} reposten",
+  "comment.delete": "Verwijderen",
+  "comment.deleteLabel": "Je reactie verwijderen",
+  "comment.deleteConfirm": "Deze reactie van Bluesky verwijderen?",
+  "comment.deleting": "Verwijderen…",
+  "comment.deleted": "Je reactie is verwijderd.",
+  "comment.deletePermission": "Om hier reacties te verwijderen, heeft deze site nog één toestemming van je account nodig. Je kunt hem ook in elke Bluesky-app verwijderen.",
+  "comment.continue": "Doorgaan om toe te staan",
+  "comment.cancel": "Annuleren",
+  "signInFirst.reply": "Log in om te reageren.",
+  "signInFirst.like": "Log in om reacties te liken.",
+  "signInFirst.repost": "Log in om reacties te reposten.",
+  "status.liked": "Geliket.",
+  "status.likeRemoved": "Like verwijderd.",
+  "status.reposted": "Gerepost.",
+  "status.repostRemoved": "Repost verwijderd.",
+  "status.signedOut": "Je bent uitgelogd.",
+  "messages.signedIn": "Je bent ingelogd. Je kunt hierboven reageren, liken of reposten.",
+  "messages.signInFailed": "Het inloggen is niet afgerond. Probeer het opnieuw.",
+  "messages.accountNotFound": "We konden dat account niet vinden. Controleer de handle en probeer het opnieuw.",
+  "messages.invalidHandle": "Dat lijkt geen handle. Meestal is het zoiets als alice.bsky.social.",
+  "messages.signedOut": "Je bent uitgelogd. Log opnieuw in.",
+  "messages.needsPermission": "Om hier reacties te verwijderen, heeft deze site nog één toestemming van je account nodig.",
+  "messages.notAllowed": "Dat kan hier niet.",
+  "messages.newPermissions": "Deze site kan nu ook voor je liken en reposten en heeft daarom opnieuw je toestemming nodig. Log opnieuw in.",
+  "messages.tooLong": "Berichten mogen maximaal {{max}} tekens lang zijn.",
+  "messages.tooMany": "Je gaat wel snel. Wacht een minuut en probeer het opnieuw.",
+  "messages.error": "Dat is niet gelukt. Probeer het opnieuw.",
+  "credit": "Mogelijk gemaakt door {{link}}"
+}

package/locales/pt.json

@@ -0,0 +1,78 @@
+{
+  "signIn.heading": "Entre para comentar, curtir ou repostar",
+  "signIn.anyAccount": "Qualquer {{atmosphereAccount}} funciona, inclusive a do {{bluesky}}: uma só conta para toda uma rede de apps abertos.",
+  "signIn.atmosphereAccount": "conta Atmosphere",
+  "signIn.button": "Entrar com Atmosphere",
+  "signIn.matchingAccounts": "Contas correspondentes",
+  "signIn.privacy": "Você vai aprovar isso no site da sua própria conta (o do Bluesky, para a maioria das pessoas); sua senha nunca é compartilhada aqui. Ainda não tem conta? {{createAccount}}.",
+  "signIn.createAccount": "Crie uma conta Atmosphere grátis",
+  "elsewhere.text": "Prefere não entrar aqui? {{link}} Sua resposta aparece aqui do mesmo jeito, assim como curtidas e reposts.",
+  "elsewhere.link": "Responda no Bluesky →",
+  "actions.label": "Responder a esta publicação",
+  "actions.like": "Curtir",
+  "actions.liked": "Curtido",
+  "actions.repost": "Repostar",
+  "actions.reposted": "Repostado",
+  "actions.quote": "Citar",
+  "composer.commentAs": "{{verb}} como {{handle}}",
+  "composer.comment": "Comentar",
+  "composer.quote": "Citar",
+  "composer.mentions": "Contas para mencionar",
+  "composer.previewCaption": "Como sua publicação vai ficar",
+  "composer.now": "agora",
+  "composer.previewEmpty": "Seu texto aparece aqui.",
+  "composer.quoting": "Citando esta publicação na sua própria conta",
+  "composer.replyingTo": "Respondendo a {{name}}",
+  "composer.cancel": "Cancelar",
+  "composer.signOut": "Sair",
+  "composer.postComment": "Publicar comentário",
+  "composer.postQuote": "Publicar citação",
+  "composer.charactersLeft_one": "Resta {{count}}",
+  "composer.charactersLeft_many": "Restam {{count}}",
+  "composer.charactersLeft_other": "Restam {{count}}",
+  "composer.posting": "Publicando…",
+  "posted.comment": "Seu comentário foi publicado.",
+  "posted.quote": "Sua citação está no Bluesky.",
+  "posted.see": "Ver no Bluesky →",
+  "reactions.likes_one": "{{count}} curtida",
+  "reactions.likes_many": "{{count}} curtidas",
+  "reactions.likes_other": "{{count}} curtidas",
+  "reactions.reposts_one": "{{count}} repost",
+  "reactions.reposts_many": "{{count}} reposts",
+  "reactions.reposts_other": "{{count}} reposts",
+  "comment.author": "Autor",
+  "comment.viewOnBluesky": "ver no Bluesky",
+  "comment.someone": "este comentário",
+  "comment.reply": "Responder",
+  "comment.replyTo": "Responder a {{name}}",
+  "comment.likeLabel": "Curtir o comentário de {{name}}",
+  "comment.repostLabel": "Repostar o comentário de {{name}}",
+  "comment.delete": "Excluir",
+  "comment.deleteLabel": "Excluir seu comentário",
+  "comment.deleteConfirm": "Excluir este comentário do Bluesky?",
+  "comment.deleting": "Excluindo…",
+  "comment.deleted": "Seu comentário foi excluído.",
+  "comment.deletePermission": "Para excluir comentários aqui, este site precisa de mais uma permissão da sua conta. Você também pode excluí-lo em qualquer app do Bluesky.",
+  "comment.continue": "Continuar para aprovar",
+  "comment.cancel": "Cancelar",
+  "signInFirst.reply": "Entre para responder.",
+  "signInFirst.like": "Entre para curtir comentários.",
+  "signInFirst.repost": "Entre para repostar comentários.",
+  "status.liked": "Curtido.",
+  "status.likeRemoved": "Curtida removida.",
+  "status.reposted": "Repostado.",
+  "status.repostRemoved": "Repost removido.",
+  "status.signedOut": "Você saiu.",
+  "messages.signedIn": "Você entrou. Pode comentar, curtir ou repostar acima.",
+  "messages.signInFailed": "A entrada não foi concluída. Tente de novo.",
+  "messages.accountNotFound": "Não encontramos essa conta. Confira o identificador e tente de novo.",
+  "messages.invalidHandle": "Isso não parece um identificador. Normalmente é algo como alice.bsky.social.",
+  "messages.signedOut": "Você foi desconectado. Entre de novo.",
+  "messages.needsPermission": "Para excluir comentários aqui, este site precisa de mais uma permissão da sua conta.",
+  "messages.notAllowed": "Isso não pode ser feito aqui.",
+  "messages.newPermissions": "Este site agora também pode curtir e repostar por você, então precisa da sua permissão de novo. Entre de novo.",
+  "messages.tooLong": "As publicações podem ter até {{max}} caracteres.",
+  "messages.tooMany": "Você está indo rápido demais. Espere um minuto e tente de novo.",
+  "messages.error": "Não deu certo. Tente de novo.",
+  "credit": "Feito com {{link}}"
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "astro-atmosphere-comments",
-  "version": "0.1.1",
+  "version": "0.3.0",
   "description": "Atmosphere Comments for Astro: Bluesky comments, likes, reposts and quote posts for Astro sites; readers sign in with their Atmosphere (AT Protocol) account and respond without leaving the page.",
   "type": "module",
   "license": "MIT",
@@ -31,7 +31,7 @@
   },
   "types": "./index.d.ts",
   "bin": {
-    "astro-atmosphere-comments": "./bin/cli.mjs"
+    "astro-atmosphere-comments": "bin/cli.mjs"
   },
   "files": [
     "index.mjs",
@@ -42,6 +42,7 @@
     "lib",
     "routes",
     "assets",
+    "locales",
     "README.md",
     "CHANGELOG.md",
     "LICENSE"

package/routes/delete.ts

@@ -0,0 +1,41 @@
+// Deletes one of the signed-in reader's own comments: a post of theirs that
+// is a reply somewhere under one of the site's announcements. Nothing else,
+// even though the permission behind it covers all of the reader's posts.
+// Body: { post }. Readers who haven't allowed deleting yet get
+// "needs-permission", and the page offers to ask their account host for it.
+import type { APIRoute } from "astro";
+import { json } from "../lib/http";
+import { allows, deleteRecord, isPostUri, isSitePost, postsAsReader, rateLimit, reader } from "../lib/reader";
+import { forgetThread } from "../lib/thread";
+
+const tooMany = rateLimit(10, 60);
+
+export const POST: APIRoute = async ({ request, url, cookies }) => {
+  const signedIn = await reader(request, url, cookies);
+  if (signedIn instanceof Response) return signedIn;
+
+  let body: { post?: unknown };
+  try {
+    body = await request.json();
+  } catch {
+    return json({ error: "bad-request" }, 400);
+  }
+  const { post } = body;
+  if (!isPostUri(post) || !post.startsWith(`at://${signedIn.did}/`)) return json({ error: "not-allowed" }, 400);
+  if (!allows(signedIn, "app.bsky.feed.post", "delete")) return json({ error: "needs-permission" }, 403);
+  if (tooMany(signedIn.did)) return json({ error: "too-many" }, 429);
+
+  try {
+    const [view] = await postsAsReader(signedIn.session, [post]);
+    if (!view) return json({ error: "not-found" }, 404);
+    // Only a reply under one of the site's announcements, never a post of its own.
+    const root = view.record?.reply?.root?.uri;
+    if (!isSitePost(root)) return json({ error: "not-allowed" }, 400);
+    await deleteRecord(signedIn, view.uri);
+    forgetThread(root);
+    return json({ deleted: view.uri });
+  } catch (error) {
+    console.warn("[atmosphere] delete failed:", error instanceof Error ? error.message : error);
+    return json({ error: "post-failed" }, 502);
+  }
+};

package/routes/login.ts

@@ -3,7 +3,7 @@
 // approve this site's request to post comments for them.
 import type { APIRoute } from "astro";
 import { safeReturnPath, withStatus } from "../lib/http";
-import { oauthClient, SCOPE } from "../lib/oauth";
+import { DELETE_SCOPE, oauthClient, SCOPE } from "../lib/oauth";
 
 export const POST: APIRoute = async ({ request, url, redirect }) => {
   const form = await request.formData();
@@ -19,7 +19,9 @@ export const POST: APIRoute = async ({ request, url, redirect }) => {
   try {
     const client = await oauthClient(url.origin);
     const authorizeUrl = await client.authorize(handle, {
-      scope: SCOPE,
+      // The delete route sends readers back here (with permission=delete) when
+      // they first delete a comment and haven't allowed that yet.
+      scope: form.get("permission") === "delete" ? `${SCOPE} ${DELETE_SCOPE}` : SCOPE,
       state: JSON.stringify({ returnTo }),
     });
     return redirect(authorizeUrl.href, 303);

package/routes/typeahead.ts

@@ -1,6 +1,10 @@
-// Suggestions for an @mention as the reader types (?q=start of a handle or
-// name), from Bluesky's public typeahead search. Only for signed-in readers,
-// so it can't be used as a free search proxy; avatars come through this site.
+// Account suggestions as the reader types (?q=start of a handle or name), from
+// Bluesky's public typeahead search: for @mentions in the comment box, and for
+// the handle box when signing in, so readers can see they've found the right
+// account. Avatars come through this site. Signed-in readers are limited per
+// account; everyone else per address, with an overall cap as well (behind a
+// proxy every visitor may share one address), so the site can't be used to
+// flood Bluesky's search. Answers are remembered for a minute.
 import type { APIRoute } from "astro";
 import { json } from "../lib/http";
 import { rateLimit } from "../lib/reader";
@@ -8,24 +12,50 @@ import settings from "../lib/settings";
 import { rememberAvatar } from "../lib/avatars";
 import { signedInDid } from "../lib/visitor";
 
-const tooMany = rateLimit(60, 1200);
+const perReader = rateLimit(60, 1200);
+const perAddress = rateLimit(30, 300);
+const signedOutOverall = rateLimit(300, 6000);
 
-export const GET: APIRoute = async ({ url, cookies }) => {
+type Actor = { did: string; handle: string; displayName?: string; avatar?: string };
+const recent = new Map<string, { actors: Actor[]; at: number }>();
+const REMEMBER_MS = 60 * 1000;
+const MAX_REMEMBERED = 500;
+
+async function search(q: string): Promise<Actor[]> {
+  const key = q.toLowerCase();
+  const known = recent.get(key);
+  if (known && Date.now() - known.at < REMEMBER_MS) return known.actors;
+  const response = await fetch(
+    `https://public.api.bsky.app/xrpc/app.bsky.actor.searchActorsTypeahead?q=${encodeURIComponent(q)}&limit=6`,
+    { signal: AbortSignal.timeout(4000) },
+  );
+  if (!response.ok) return [];
+  const actors = ((await response.json()) as { actors?: Actor[] }).actors ?? [];
+  if (recent.size >= MAX_REMEMBERED) recent.delete(recent.keys().next().value!);
+  recent.set(key, { actors, at: Date.now() });
+  return actors;
+}
+
+export const GET: APIRoute = async ({ url, cookies, clientAddress }) => {
+  const q = (url.searchParams.get("q") ?? "").trim().replace(/^@/, "");
   const did = await signedInDid(cookies);
-  if (!did) return json({ error: "signed-out" }, 401);
-  const q = (url.searchParams.get("q") ?? "").trim();
-  if (!q || q.length > 64 || /[\s<>"]/.test(q)) return json({ actors: [] });
-  if (tooMany(did)) return json({ error: "too-many" }, 429);
+  // One letter is enough for an @mention; signing in needs two.
+  if (!q || (!did && q.length < 2) || q.length > 64 || /[\s<>"]/.test(q)) return json({ actors: [] });
+
+  if (did) {
+    if (perReader(did)) return json({ error: "too-many" }, 429);
+  } else {
+    let address = "unknown";
+    try {
+      address = clientAddress;
+    } catch {
+      // Some adapters can't tell; the overall cap still applies.
+    }
+    if (perAddress(address) || signedOutOverall("all")) return json({ error: "too-many" }, 429);
+  }
+
   try {
-    const response = await fetch(
-      `https://public.api.bsky.app/xrpc/app.bsky.actor.searchActorsTypeahead?q=${encodeURIComponent(q)}&limit=6`,
-      { signal: AbortSignal.timeout(4000) },
-    );
-    if (!response.ok) return json({ actors: [] });
-    const data = (await response.json()) as {
-      actors?: { did: string; handle: string; displayName?: string; avatar?: string }[];
-    };
-    const actors = (data.actors ?? []).map((actor) => {
+    const actors = (await search(q)).map((actor) => {
       if (actor.avatar) rememberAvatar(actor.did, actor.avatar);
       return {
         handle: actor.handle,