astro-atmosphere-comments 0.4.2 → 0.5.0

package/lib/reader.ts

@@ -1,130 +0,0 @@
-// What every action needs: a request from this site, a signed-in reader, and
-// an OAuth session with all the permissions in SCOPE. Readers who signed in
-// before the site asked for more (likes and reposts were added later) are
-// asked to sign in again rather than meeting a confusing failure.
-import type { OAuthSession } from "@atproto/oauth-client-node";
-import type { AstroCookies } from "astro";
-import { fromThisSite, json } from "./http";
-import { oauthClient, SCOPE } from "./oauth";
-import settings from "./settings";
-import { signedInDid, signOut } from "./visitor";
-
-export type Reader = { did: string; session: OAuthSession; scopes: string[] };
-
-const APPVIEW_PROXY = "did:web:api.bsky.app#bsky_appview";
-const POST_URI = /^at:\/\/(did:[a-z0-9]+:[a-zA-Z0-9._:%-]+)\/app\.bsky\.feed\.post\/([a-zA-Z0-9._~-]+)$/;
-
-/** The reader, or the Response to send instead. */
-export async function reader(request: Request, url: URL, cookies: AstroCookies): Promise<Reader | Response> {
-  // Requests that change something must come from a page on this site.
-  // Browsers leave Origin off same-site GETs, and a GET only reads (other
-  // sites' scripts can't send the SameSite cookie or read the answer).
-  if (request.method !== "GET") {
-    if (!fromThisSite(request, url)) return json({ error: "forbidden" }, 403);
-    if (!request.headers.get("content-type")?.startsWith("application/json")) return json({ error: "bad-request" }, 415);
-  }
-  const did = await signedInDid(cookies);
-  if (!did) return json({ error: "signed-out" }, 401);
-  try {
-    const session = await (await oauthClient(url.origin)).restore(did);
-    // Compared by permission name ("repo:app.bsky.feed.like"), since a host
-    // may write the parameters after it differently.
-    const scopes = (await session.getTokenInfo(false)).scope.split(" ");
-    const granted = scopes.map((part) => part.split("?")[0]);
-    if (!SCOPE.split(" ").every((part) => granted.includes(part.split("?")[0]))) {
-      await signOut(cookies);
-      return json({ error: "new-permissions" }, 401);
-    }
-    return { did, session, scopes };
-  } catch {
-    // The grant has expired or been revoked: the reader needs to sign in again.
-    await signOut(cookies);
-    return json({ error: "signed-out" }, 401);
-  }
-}
-
-/**
- * Whether the reader's grant allows `action` on records of `collection`: a
- * repo permission for that collection (or all of them) listing the action,
- * or listing no actions, which means all of them.
- */
-export function allows(reader: Reader, collection: string, action: string): boolean {
-  return reader.scopes.some((scope) => {
-    const [name, query = ""] = scope.split("?");
-    if (name !== `repo:${collection}` && name !== "repo:*") return false;
-    const actions = new URLSearchParams(query).getAll("action");
-    return !actions.length || actions.includes(action);
-  });
-}
-
-/** True for a post by one of the site's own accounts (an announcement). */
-export function isSitePost(uri: unknown): uri is string {
-  const match = typeof uri === "string" ? POST_URI.exec(uri) : null;
-  return !!match && settings.allowedAuthors.includes(match[1]);
-}
-
-export const isPostUri = (uri: unknown): uri is string => typeof uri === "string" && POST_URI.test(uri);
-
-/** True for one of the site's announcements, or a comment somewhere under one. */
-export const inSiteThread = (view: PostView): boolean =>
-  isSitePost(view.uri) || isSitePost(view.record?.reply?.root?.uri);
-
-export type PostView = {
-  uri: string;
-  cid: string;
-  record?: { reply?: { root?: { uri?: string } } };
-  viewer?: { like?: string; repost?: string };
-};
-
-/** Posts as the reader sees them (including whether they've liked or reposted them). */
-export async function postsAsReader(session: OAuthSession, uris: string[]): Promise<PostView[]> {
-  const views: PostView[] = [];
-  // Bluesky answers for at most 25 posts at a time.
-  for (let start = 0; start < uris.length; start += 25) {
-    const query = uris
-      .slice(start, start + 25)
-      .map((uri) => `uris=${encodeURIComponent(uri)}`)
-      .join("&");
-    const response = await session.fetchHandler(`/xrpc/app.bsky.feed.getPosts?${query}`, {
-      headers: { "atproto-proxy": APPVIEW_PROXY },
-    });
-    if (!response.ok) throw new Error(`getPosts ${response.status}`);
-    views.push(...(((await response.json()) as { posts?: PostView[] }).posts ?? []));
-  }
-  return views;
-}
-
-export async function createRecord(reader: Reader, collection: string, record: Record<string, unknown>) {
-  const response = await reader.session.fetchHandler("/xrpc/com.atproto.repo.createRecord", {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ repo: reader.did, collection, record }),
-  });
-  if (!response.ok) throw new Error(`createRecord ${response.status} ${await response.text().catch(() => "")}`);
-  return (await response.json()) as { uri: string; cid: string };
-}
-
-/** Deletes one of the reader's own records, given its AT URI. */
-export async function deleteRecord(reader: Reader, uri: string) {
-  const [, repo, collection, rkey] = uri.match(/^at:\/\/([^/]+)\/([^/]+)\/([^/]+)$/) ?? [];
-  if (repo !== reader.did || !collection || !rkey) throw new Error("not the reader's record");
-  const response = await reader.session.fetchHandler("/xrpc/com.atproto.repo.deleteRecord", {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ repo: reader.did, collection, rkey }),
-  });
-  if (!response.ok) throw new Error(`deleteRecord ${response.status}`);
-}
-
-/** A simple per-account limit: at most `perMinute` a minute and `perHour` an hour. */
-export function rateLimit(perMinute: number, perHour: number) {
-  const recent = new Map<string, number[]>();
-  return (did: string): boolean => {
-    const now = Date.now();
-    const times = (recent.get(did) ?? []).filter((time) => now - time < 60 * 60 * 1000);
-    recent.set(did, times);
-    if (times.length >= perHour || times.filter((time) => now - time < 60 * 1000).length >= perMinute) return true;
-    times.push(now);
-    return false;
-  };
-}

package/lib/store.ts

@@ -1,46 +0,0 @@
-// Small file-based stores for sign-in data, one JSON file per key.
-//
-// They hold OAuth tokens, so the folder and files are readable only by the
-// site's own user (0700 / 0600), and file names are hashes, never handles or
-// cookie values. Set ATMOSPHERE_DATA_DIR to a folder outside the release, so
-// deploys don't sign everyone out (default: .data/atmosphere in the project).
-import { createHash } from "node:crypto";
-import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
-import path from "node:path";
-import { getSecret } from "astro:env/server";
-
-const root = path.resolve(getSecret("ATMOSPHERE_DATA_DIR") || ".data/atmosphere");
-
-const fileFor = (folder: string, key: string) =>
-  path.join(root, folder, `${createHash("sha256").update(key).digest("hex")}.json`);
-
-type Stored<V> = { value: V; expiresAt?: number };
-
-export function fileStore<V>(folder: string, lifetimeMs?: number) {
-  return {
-    async get(key: string): Promise<V | undefined> {
-      try {
-        const stored = JSON.parse(await readFile(fileFor(folder, key), "utf8")) as Stored<V>;
-        if (stored.expiresAt && stored.expiresAt < Date.now()) {
-          await rm(fileFor(folder, key), { force: true });
-          return undefined;
-        }
-        return stored.value;
-      } catch {
-        return undefined;
-      }
-    },
-    async set(key: string, value: V): Promise<void> {
-      const file = fileFor(folder, key);
-      await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
-      const stored: Stored<V> = { value, ...(lifetimeMs && { expiresAt: Date.now() + lifetimeMs }) };
-      // Write then rename, so a crash never leaves half a file.
-      const temporary = `${file}.${process.pid}.tmp`;
-      await writeFile(temporary, JSON.stringify(stored), { mode: 0o600 });
-      await rename(temporary, file);
-    },
-    async del(key: string): Promise<void> {
-      await rm(fileFor(folder, key), { force: true });
-    },
-  };
-}

package/lib/visitor.ts

@@ -1,42 +0,0 @@
-// Who is signed in on this browser.
-//
-// The cookie holds only a random value. The server keeps which account that
-// value belongs to, so signing out really ends it, and the cookie is useless
-// to anyone who copies it after that. HttpOnly keeps it away from page
-// scripts; SameSite=Lax lets it come back with the reader from their account
-// host (a top-level navigation) but not with other sites' form posts.
-import { randomBytes } from "node:crypto";
-import type { AstroCookies } from "astro";
-import { fileStore } from "./store";
-
-const COOKIE = "atmosphere_session";
-const LIFETIME_MS = 60 * 24 * 60 * 60 * 1000; // 60 days
-
-type Visitor = { did: string; signedInAt: string };
-
-const visitors = fileStore<Visitor>("visitors", LIFETIME_MS);
-
-export async function signIn(cookies: AstroCookies, url: URL, did: string): Promise<void> {
-  const token = randomBytes(32).toString("base64url");
-  await visitors.set(token, { did, signedInAt: new Date().toISOString() });
-  cookies.set(COOKIE, token, {
-    path: "/",
-    httpOnly: true,
-    sameSite: "lax",
-    secure: url.protocol === "https:",
-    maxAge: LIFETIME_MS / 1000,
-  });
-}
-
-/** The signed-in account's DID, if any. */
-export async function signedInDid(cookies: AstroCookies): Promise<string | undefined> {
-  const token = cookies.get(COOKIE)?.value;
-  if (!token || token.length > 100) return undefined;
-  return (await visitors.get(token))?.did;
-}
-
-export async function signOut(cookies: AstroCookies): Promise<void> {
-  const token = cookies.get(COOKIE)?.value;
-  if (token && token.length <= 100) await visitors.del(token);
-  cookies.delete(COOKIE, { path: "/" });
-}

package/routes/callback.ts

@@ -1,30 +0,0 @@
-// The reader's account host sends them back here after they approve (or
-// decline) this site's request. On success they are signed in on this site
-// and returned to the post they were reading.
-import type { APIRoute } from "astro";
-import { safeReturnPath, withStatus } from "../lib/http";
-import { oauthClient } from "../lib/oauth";
-import { signIn } from "../lib/visitor";
-
-function returnPathFrom(state: unknown): string {
-  try {
-    return safeReturnPath((JSON.parse(String(state)) as { returnTo?: unknown }).returnTo);
-  } catch {
-    return "/";
-  }
-}
-
-export const GET: APIRoute = async ({ url, cookies, redirect }) => {
-  try {
-    const client = await oauthClient(url.origin);
-    const { session, state } = await client.callback(url.searchParams);
-    await signIn(cookies, url, session.did);
-    return redirect(withStatus(returnPathFrom(state), "signed-in"), 303);
-  } catch (error) {
-    // The reader declined, took too long, or something went wrong. The
-    // library's error still carries our state, so they can go back.
-    const state = (error as { state?: unknown }).state;
-    console.warn("[atmosphere] sign-in failed:", error instanceof Error ? error.message : error);
-    return redirect(withStatus(returnPathFrom(state), "sign-in-failed"), 303);
-  }
-};

package/routes/comment.ts

@@ -1,97 +0,0 @@
-// Posts as the signed-in reader, to their own account:
-// - a comment: a reply to the post's announcement (`root`), or to one of the
-//   comments under it (`parent`);
-// - a quote post (`quote: true`): their own post quoting the announcement.
-import { AtpAgent, RichText } from "@atproto/api";
-import type { APIRoute } from "astro";
-import { json } from "../lib/http";
-import { profileFor, publicProfile } from "../lib/profile";
-import { createRecord, isPostUri, isSitePost, postsAsReader, rateLimit, reader } from "../lib/reader";
-import { forgetThread } from "../lib/thread";
-
-const MAX_GRAPHEMES = 300; // Bluesky's limit for a post
-
-const tooMany = rateLimit(5, 30);
-const publicAgent = new AtpAgent({ service: "https://public.api.bsky.app" });
-const graphemes = new Intl.Segmenter();
-
-export const POST: APIRoute = async ({ request, url, cookies }) => {
-  const signedIn = await reader(request, url, cookies);
-  if (signedIn instanceof Response) return signedIn;
-
-  let body: { text?: unknown; root?: unknown; parent?: unknown; quote?: unknown };
-  try {
-    body = await request.json();
-  } catch {
-    return json({ error: "bad-request" }, 400);
-  }
-
-  const text = typeof body.text === "string" ? body.text.trim() : "";
-  const length = [...graphemes.segment(text)].length;
-  if (!length) return json({ error: "empty" }, 400);
-  if (length > MAX_GRAPHEMES) return json({ error: "too-long" }, 400);
-
-  // Only this site's own announcements (and comments under them) can be
-  // replied to or quoted from here.
-  const root = body.root;
-  if (!isSitePost(root)) return json({ error: "not-allowed" }, 400);
-  const quote = body.quote === true;
-  const parent = !quote && body.parent !== undefined && body.parent !== root ? body.parent : undefined;
-  if (parent !== undefined && !isPostUri(parent)) return json({ error: "not-allowed" }, 400);
-
-  if (tooMany(signedIn.did)) return json({ error: "too-many" }, 429);
-
-  let posts;
-  try {
-    posts = await postsAsReader(signedIn.session, parent ? [root, parent] : [root]);
-  } catch {
-    return json({ error: "unavailable" }, 502);
-  }
-  const rootPost = posts.find((post) => post.uri === root);
-  const parentPost = parent ? posts.find((post) => post.uri === parent) : rootPost;
-  if (!rootPost || !parentPost) return json({ error: "not-found" }, 404);
-  // A comment being replied to must belong to this announcement's thread.
-  if (parent && parentPost.record?.reply?.root?.uri !== root) return json({ error: "not-allowed" }, 400);
-
-  // Links, @mentions and #tags become proper links, as in the Bluesky app.
-  const richText = new RichText({ text });
-  try {
-    await richText.detectFacets(publicAgent);
-  } catch {
-    richText.detectFacetsWithoutResolution();
-  }
-
-  const record = {
-    $type: "app.bsky.feed.post",
-    text: richText.text,
-    ...(richText.facets?.length && { facets: richText.facets }),
-    ...(quote
-      ? { embed: { $type: "app.bsky.embed.record", record: { uri: rootPost.uri, cid: rootPost.cid } } }
-      : {
-          reply: {
-            root: { uri: rootPost.uri, cid: rootPost.cid },
-            parent: { uri: parentPost.uri, cid: parentPost.cid },
-          },
-        }),
-    createdAt: new Date().toISOString(),
-  };
-
-  let created;
-  try {
-    created = await createRecord(signedIn, "app.bsky.feed.post", record);
-  } catch (error) {
-    console.warn("[atmosphere] post failed:", error instanceof Error ? error.message : error);
-    return json({ error: "post-failed" }, 502);
-  }
-  forgetThread(root);
-  const profile = await profileFor(signedIn.did);
-  return json({
-    uri: created.uri,
-    url: `https://bsky.app/profile/${profile.handle}/post/${created.uri.split("/").pop()}`,
-    text: richText.text,
-    author: publicProfile(profile),
-    createdAt: record.createdAt,
-    quote,
-    parent: parent ?? null,
-  });
-};

package/routes/delete.ts

@@ -1,41 +0,0 @@
-// Deletes one of the signed-in reader's own comments: a post of theirs that
-// is a reply somewhere under one of the site's announcements. Nothing else,
-// even though the permission behind it covers all of the reader's posts.
-// Body: { post }. Readers who haven't allowed deleting yet get
-// "needs-permission", and the page offers to ask their account host for it.
-import type { APIRoute } from "astro";
-import { json } from "../lib/http";
-import { allows, deleteRecord, isPostUri, isSitePost, postsAsReader, rateLimit, reader } from "../lib/reader";
-import { forgetThread } from "../lib/thread";
-
-const tooMany = rateLimit(10, 60);
-
-export const POST: APIRoute = async ({ request, url, cookies }) => {
-  const signedIn = await reader(request, url, cookies);
-  if (signedIn instanceof Response) return signedIn;
-
-  let body: { post?: unknown };
-  try {
-    body = await request.json();
-  } catch {
-    return json({ error: "bad-request" }, 400);
-  }
-  const { post } = body;
-  if (!isPostUri(post) || !post.startsWith(`at://${signedIn.did}/`)) return json({ error: "not-allowed" }, 400);
-  if (!allows(signedIn, "app.bsky.feed.post", "delete")) return json({ error: "needs-permission" }, 403);
-  if (tooMany(signedIn.did)) return json({ error: "too-many" }, 429);
-
-  try {
-    const [view] = await postsAsReader(signedIn.session, [post]);
-    if (!view) return json({ error: "not-found" }, 404);
-    // Only a reply under one of the site's announcements, never a post of its own.
-    const root = view.record?.reply?.root?.uri;
-    if (!isSitePost(root)) return json({ error: "not-allowed" }, 400);
-    await deleteRecord(signedIn, view.uri);
-    forgetThread(root);
-    return json({ deleted: view.uri });
-  } catch (error) {
-    console.warn("[atmosphere] delete failed:", error instanceof Error ? error.message : error);
-    return json({ error: "post-failed" }, 502);
-  }
-};

package/routes/follow.ts

@@ -1,71 +0,0 @@
-// Following one of the site's own accounts (allowedAuthors) as the signed-in
-// reader, or unfollowing it. Nothing else can be followed through the site.
-// GET ?subject=<did>: { following }. POST { subject, on }: follows or
-// unfollows. Readers who haven't allowed following yet get "needs-permission",
-// and the page sends them to approve it.
-import type { APIRoute } from "astro";
-import { json } from "../lib/http";
-import { allows, createRecord, deleteRecord, rateLimit, reader } from "../lib/reader";
-import settings from "../lib/settings";
-
-const tooMany = rateLimit(10, 60);
-
-// Whether the reader follows `subject`: the follow record's address, or "".
-// From Bluesky's public AppView, so no extra permission is needed to know.
-async function followRecord(readerDid: string, subject: string): Promise<string> {
-  const query = new URLSearchParams({ actor: readerDid, others: subject });
-  const response = await fetch(`https://public.api.bsky.app/xrpc/app.bsky.graph.getRelationships?${query}`, {
-    signal: AbortSignal.timeout(5000),
-  });
-  if (!response.ok) throw new Error(`getRelationships ${response.status}`);
-  const data = (await response.json()) as { relationships?: Array<{ did?: string; following?: string }> };
-  return data.relationships?.find((relationship) => relationship.did === subject)?.following ?? "";
-}
-
-export const GET: APIRoute = async ({ request, url, cookies }) => {
-  const subject = url.searchParams.get("subject") ?? "";
-  if (!settings.allowedAuthors.includes(subject)) return json({ error: "not-allowed" }, 400);
-  const signedIn = await reader(request, url, cookies);
-  if (signedIn instanceof Response) return signedIn;
-  try {
-    return json({ following: !!(await followRecord(signedIn.did, subject)) });
-  } catch {
-    return json({ error: "unavailable" }, 502);
-  }
-};
-
-export const POST: APIRoute = async ({ request, url, cookies }) => {
-  const signedIn = await reader(request, url, cookies);
-  if (signedIn instanceof Response) return signedIn;
-
-  let body: { subject?: unknown; on?: unknown };
-  try {
-    body = await request.json();
-  } catch {
-    return json({ error: "bad-request" }, 400);
-  }
-  const { subject, on } = body;
-  // Only the site's own accounts, and never yourself.
-  if (typeof subject !== "string" || !settings.allowedAuthors.includes(subject) || subject === signedIn.did || typeof on !== "boolean") {
-    return json({ error: "not-allowed" }, 400);
-  }
-  if (!allows(signedIn, "app.bsky.graph.follow", on ? "create" : "delete")) return json({ error: "needs-permission" }, 403);
-  if (tooMany(signedIn.did)) return json({ error: "too-many" }, 429);
-
-  try {
-    const existing = await followRecord(signedIn.did, subject);
-    if (on && !existing) {
-      await createRecord(signedIn, "app.bsky.graph.follow", {
-        $type: "app.bsky.graph.follow",
-        subject,
-        createdAt: new Date().toISOString(),
-      });
-    } else if (!on && existing) {
-      await deleteRecord(signedIn, existing);
-    }
-    return json({ following: on });
-  } catch (error) {
-    console.warn("[atmosphere] follow failed:", error instanceof Error ? error.message : error);
-    return json({ error: "post-failed" }, 502);
-  }
-};

package/routes/jwks.json.ts

@@ -1,13 +0,0 @@
-// The public half of the site's signing key, so account hosts can check that
-// requests claiming to come from this site really do.
-import type { APIRoute } from "astro";
-import { privateKey } from "../lib/oauth";
-
-export const GET: APIRoute = async () => {
-  try {
-    const key = await privateKey();
-    return Response.json({ keys: [key.publicJwk] }, { headers: { "Cache-Control": "public, max-age=600" } });
-  } catch {
-    return new Response("Not configured", { status: 404 });
-  }
-};

package/routes/login.ts

@@ -1,58 +0,0 @@
-// Starts signing in: the reader typed their handle (or DID) into the comment
-// box. Their own account host is found from it, and they are sent there to
-// approve this site's request to post comments for them.
-import type { APIRoute } from "astro";
-import { safeReturnPath, withStatus } from "../lib/http";
-import { DELETE_SCOPE, FOLLOW_SCOPE, oauthClient, SCOPE } from "../lib/oauth";
-import { signedInDid } from "../lib/visitor";
-
-// The extra permissions a reader can add: deleting their comments, following.
-const EXTRA_SCOPES: Record<string, string> = { delete: DELETE_SCOPE, follow: FOLLOW_SCOPE };
-
-export const POST: APIRoute = async ({ request, url, redirect, cookies }) => {
-  const form = await request.formData();
-  const returnTo = safeReturnPath(form.get("returnTo"));
-  const handle = String(form.get("handle") ?? "")
-    .trim()
-    .replace(/^@/, "")
-    .toLowerCase();
-  if (!handle || handle.length > 253 || !/^(did:[a-z0-9:._%-]+|[a-z0-9.-]+\.[a-z0-9-]+)$/.test(handle)) {
-    return redirect(withStatus(returnTo, "invalid-handle"), 303);
-  }
-
-  try {
-    const client = await oauthClient(url.origin);
-    // A new approval replaces the old one, so keep any extra permission the
-    // reader already gave (asking to follow mustn't take away deleting).
-    const extras = new Set<string>();
-    const wanted = String(form.get("permission") ?? "");
-    if (EXTRA_SCOPES[wanted]) extras.add(EXTRA_SCOPES[wanted]);
-    const did = await signedInDid(cookies);
-    if (did) {
-      try {
-        const granted = (await (await client.restore(did, false)).getTokenInfo(false)).scope.split(" ").map((scope) => {
-          const [name, query = ""] = scope.split("?");
-          return { name, actions: new URLSearchParams(query).getAll("action") };
-        });
-        // As in allows() (lib/reader.ts): no actions listed means all of them.
-        const has = (collection: string, action: string) =>
-          granted.some(({ name, actions }) => (name === `repo:${collection}` || name === "repo:*") && (!actions.length || actions.includes(action)));
-        if (has("app.bsky.feed.post", "delete")) extras.add(DELETE_SCOPE);
-        if (has("app.bsky.graph.follow", "create")) extras.add(FOLLOW_SCOPE);
-      } catch {
-        // Not signed in any more: just what's asked for.
-      }
-    }
-    const authorizeUrl = await client.authorize(handle, {
-      // The page sends readers back here with permission=delete or =follow
-      // the first time they delete a comment or follow, if they haven't
-      // allowed that yet.
-      scope: [SCOPE, ...extras].join(" "),
-      state: JSON.stringify({ returnTo }),
-    });
-    return redirect(authorizeUrl.href, 303);
-  } catch (error) {
-    console.warn("[atmosphere] sign-in could not start:", error instanceof Error ? error.message : error);
-    return redirect(withStatus(returnTo, "account-not-found"), 303);
-  }
-};

package/routes/logout.ts

@@ -1,20 +0,0 @@
-// Signs the reader out on this site and asks their host to cancel this
-// site's permission to post for them.
-import type { APIRoute } from "astro";
-import { fromThisSite, json } from "../lib/http";
-import { oauthClient } from "../lib/oauth";
-import { signedInDid, signOut } from "../lib/visitor";
-
-export const POST: APIRoute = async ({ request, url, cookies }) => {
-  if (!fromThisSite(request, url)) return json({ error: "forbidden" }, 403);
-  const did = await signedInDid(cookies);
-  await signOut(cookies);
-  if (did) {
-    try {
-      await (await oauthClient(url.origin)).revoke(did);
-    } catch (error) {
-      console.warn("[atmosphere] revoke failed:", error instanceof Error ? error.message : error);
-    }
-  }
-  return json({ signedIn: false });
-};

package/routes/me.ts

@@ -1,12 +0,0 @@
-// Who is signed in on this browser, for the comment box.
-import type { APIRoute } from "astro";
-import { json } from "../lib/http";
-import { profileFor, publicProfile } from "../lib/profile";
-import { signedInDid } from "../lib/visitor";
-
-export const GET: APIRoute = async ({ cookies }) => {
-  const did = await signedInDid(cookies);
-  if (!did) return json({ signedIn: false });
-  const profile = await profileFor(did);
-  return json({ signedIn: true, ...publicProfile(profile) });
-};

package/routes/react.ts

@@ -1,48 +0,0 @@
-// Likes or reposts a post (the site's announcement, or a comment under it) as
-// the signed-in reader, or takes that back.
-// Body: { post, kind: "like" | "repost", on: boolean }.
-import type { APIRoute } from "astro";
-import { json } from "../lib/http";
-import { createRecord, deleteRecord, inSiteThread, isPostUri, isSitePost, postsAsReader, rateLimit, reader } from "../lib/reader";
-import { forgetThread } from "../lib/thread";
-
-const tooMany = rateLimit(20, 120);
-const COLLECTIONS = { like: "app.bsky.feed.like", repost: "app.bsky.feed.repost" } as const;
-
-export const POST: APIRoute = async ({ request, url, cookies }) => {
-  const signedIn = await reader(request, url, cookies);
-  if (signedIn instanceof Response) return signedIn;
-
-  let body: { post?: unknown; kind?: unknown; on?: unknown };
-  try {
-    body = await request.json();
-  } catch {
-    return json({ error: "bad-request" }, 400);
-  }
-  const { post, kind, on } = body;
-  if (!isPostUri(post) || (kind !== "like" && kind !== "repost") || typeof on !== "boolean") {
-    return json({ error: "bad-request" }, 400);
-  }
-  if (tooMany(signedIn.did)) return json({ error: "too-many" }, 429);
-
-  try {
-    const [view] = await postsAsReader(signedIn.session, [post]);
-    if (!view) return json({ error: "not-found" }, 404);
-    if (!inSiteThread(view)) return json({ error: "not-allowed" }, 400);
-    const existing = kind === "like" ? view.viewer?.like : view.viewer?.repost;
-    if (on && !existing) {
-      await createRecord(signedIn, COLLECTIONS[kind], {
-        $type: COLLECTIONS[kind],
-        subject: { uri: view.uri, cid: view.cid },
-        createdAt: new Date().toISOString(),
-      });
-    } else if (!on && existing) {
-      await deleteRecord(signedIn, existing);
-    }
-    forgetThread(isSitePost(view.uri) ? view.uri : (view.record?.reply?.root?.uri ?? ""));
-    return json({ kind, on });
-  } catch (error) {
-    console.warn(`[atmosphere] ${kind} failed:`, error instanceof Error ? error.message : error);
-    return json({ error: "post-failed" }, 502);
-  }
-};

package/routes/state.ts

@@ -1,24 +0,0 @@
-// Whether the signed-in reader has liked or reposted the announcement and the
-// comments under it, so the buttons start in the right state.
-// ?post=<uri>&post=<uri>… (at most 100); posts outside the site's threads
-// are left out of the answer.
-import type { APIRoute } from "astro";
-import { json } from "../lib/http";
-import { inSiteThread, isPostUri, postsAsReader, reader } from "../lib/reader";
-
-export const GET: APIRoute = async ({ request, url, cookies }) => {
-  const uris = [...new Set(url.searchParams.getAll("post"))].filter(isPostUri).slice(0, 100);
-  if (!uris.length) return json({ error: "bad-request" }, 400);
-  const signedIn = await reader(request, url, cookies);
-  if (signedIn instanceof Response) return signedIn;
-  try {
-    const views = await postsAsReader(signedIn.session, uris);
-    const posts: Record<string, { liked: boolean; reposted: boolean }> = {};
-    for (const view of views) {
-      if (inSiteThread(view)) posts[view.uri] = { liked: !!view.viewer?.like, reposted: !!view.viewer?.repost };
-    }
-    return json({ posts });
-  } catch {
-    return json({ error: "unavailable" }, 502);
-  }
-};