bash-atproto v4 (massive changelog below!)

- bap_resolveDID was renamed to bap_getDID. It also no longer calls to a resolve server in favor of resolving the handle itself. (DNS and HTTPS are performed in that order)
- bap_getKeys no longer uses $savedPDS. It instead opts to resolve the PDS from the specified identifier, or from the third parameter (new!).
- bap_getKeys and bap_refreshKeys now load data from the obtained JWT after a successful login/refresh. It is unnecessary to manually manage $savedDID now. $savedPDS is only needed when working with an account on a PDS that isn't it's "blessed" one.
- bap_findPDS has been removed as it is unnecessary with the bap_getKeys changes.
- bap_postToBluesky was removed. Use bapBsky_createPost with bap-bsky.sh instead.
- $bap_dryRun variable was added. Set it to 1 to see all records that would normally be posted.
- bap_resolveDID (the new one) was split from bap_resolvePDS, and it prints the DID doc.
- The check to see if the account is active in bap_getKeys and bap_refreshKeys can be skipped by setting $bap_disableOptionalChecks to 1.
- bap_generateDatetime to get an atproto datetime of the current date and time
- bap_postRecord can set rkey and whether to validate the record against the lexicon
- bap_getDID now verifies the DID exists if it was manually specified
- bap_prepareImage now uses exiftool instead of imagemagick for calculating dimensions. It should be able to process videos under certain conditions.
- bash-atproto now depends on dig.
- Fixed issue with generating datetimes on non-GNU systems (Closes #5)

bap-bsky v2 changes:
- Removed bapBsky_cyorAddLabel as it has been replaced by bapBsky_cyorAddSelfLabels
- bapBsky_prepareVideo was renamed to bapBsky_prepareVideoIndirect, now only accepts mp4 videos, and scrubs metadata
- Removed compatibility stubs
- CYOR commands that fetch posts now require login. They also now respect threadgates and won't work if there's a block relationship.
- bapBsky_cyorGetReplyRoot was renamed to bapBskyInternal_cyorGetReplyRoot and now always runs after bapBsky_cyorAddReply
- bap-bsky now calls the AppView API set in bapBsky_bskyAppViewDID (default Bluesky) for some requests
- bapBsky_getPost fetches a Bluesky post with auth
- bapBsky_getProfile fetches a Bluesky profile with auth
- bapBsky_verifyActor creates a verification record
- bapBsky_followActor follows an actor or ensures an actor is being followed
- bapBsky_likePost likes a post or ensures it has been liked (does not use via yet)
- bapBsky_submitPost now passes through arguments for the bap_postRecord changes
- createdAt is no longer added automatically if already present in the record
- Now uses bap_generateDatetime

bap-extra v2 changes:
- New bapExt_bskyCancelActor which creates an app.bsky.graph.cancellation record (see cred.blue/canceler)
- Removed bapExt_fastLogin as bap_getKeys acts like it now
- bapExt_checkDeps now checks for dig

bap-sprk v2.1 changes:
- Now uses bap_generateDatetime
- bapSprk_submitPost now passes through arguments for the bap_postRecord changes
- bapSprk_cyorAddReply can make the post being worked on a reply

README.md

···
 
 Functions built into `bash-atproto.sh`
 
-* Resolving a handle to did:plc/did:web - `bap_didInit`
-* Resolving an account's PDS from the DID - `bap_findPDS`
+* Fetch a record from URI - `bap_getRecord`
+* Resolving a handle to did:plc/did:web - `bap_getDID`
+* Resolving the DID doc for a DID - `bap_resolveDID`
+* Resolving a handle from a DID - `bap_resolveHandle`
+* Resolving an account's PDS from the DID - `bap_resolvePDS`
 * Creating and closing sessions on the PDS - `bap_getKeys` and `bap_closeSession`
 * Saving and loading a secrets file (contains your access and refresh tokens) - `bap_saveSecrets` and `bap_loadSecrets`
 * Extracting account and token information from the access token - (automatic)
 * Refreshing tokens - `bap_refreshKeys`
+* Minting service auth tokens - `bap_getServiceAuth`
 * Prepare an image, stripping EXIF data and (if needed) resizing it for a set file size and dimensions - `bap_prepareImage`
 * Uploading blobs - `bap_uploadBlobToPDS`
 * Working with records:
···
   * Prepare an image for upload - `bapBsky_prepareImage`
   * Add an image - `bapBsky_cyorAddImage`
   * Add a video - `bapBsky_cyorAddVideo`
+  * Add an embed - `bapBsky_cyorAddExternalEmbed`
   * Set language - `bapBsky_cyorAddLangs`
   * Add tags - `bapBsky_cyorAddTags`
   * Add self-labels - `bapBsky_cyorAddSelfLabels`
···
 
 ## Dependencies
 
-bash-atproto requires cURL 7.76 or later and jq 1.7 or later. Posting images and video additionally requires `imagemagick`, `exiftool`, `uuidgen` and `file`.
+bash-atproto requires `curl` 7.76 or later, `jq` 1.7 or later and `dig`. Posting images and video additionally requires `imagemagick`, `exiftool`, `uuidgen` and `file`.
 
 ## Basic usage
 
-bash-atproto is loaded with `source bash-atproto.sh`. From there, most operations will require you to sign-in to an atproto account, which can be done in three functions:
+bash-atproto is loaded with `source bash-atproto.sh`. From there, most operations will require you to sign-in to an atproto account, which can be done in one function:
 
-1. `bap_didInit <did or handle>` which will resolve your handle to a DID
-2. `bap_findPDS $savedDID` which will retrieve the account's PDS for use
-3. `bap_getKeys $savedDID <password>` to log in. The access and refresh tokens are saved in memory and can be written to disk with `bap_saveSecrets <file>`. It is recommended you use an App Password to log in rather than a normal password.
+* `bap_getKeys <did or handle> <password>`
+
+The access and refresh tokens are saved in memory and can be written to disk with `bap_saveSecrets <file>`. It is recommended you use an App Password to log in rather than a normal password.
 
 You may need to load additional scripts to handle other tasks. For example, to post to Bluesky, you will need to `source bap-bsky.sh`.
 
···
 bash-atproto is mainly meant for use as a component for bash scripts that want to use the AT Protocol, but it by itself can be used as a simple atproto client for the command line. The following commands will log in to your PDS, create a Bluesky post and then log out:
 
 1. `source bash-atproto.sh`
-2. `bap_didInit <your did or handle>`
-3. `bap_findPDS $savedDID`
-4. `bap_getKeys $savedDID <app password>`
-5. `bap_postToBluesky "Hello, World!" en`
-6. `bap_closeSession`
+2. `source bap-bsky.sh`
+3. `bap_getKeys <your did or handle> <app password>`
+4. `bapBsky_createPost "Hello, World!" en`
+5. `bap_closeSession`
 
 ## License
 

bap-bsky.sh

···
 # SPDX-License-Identifier: MIT
 # bap-bsky.sh: the bash-atproto functions pertaining to Bluesky Social.
 if [ -z "$bap_internalVersion" ]; then >&2 echo "bash-atproto not loaded?"; return 127; fi
-if [ "$bap_internalVersion" != "3" ] || ! [ "$bap_internalMinorVer" -ge "3" ]; then >&2 echo "Incorrect bash-atproto version"; return 1; fi
+if [ "$bap_internalVersion" != "4" ] || ! [ "$bap_internalMinorVer" -ge "-1" ]; then >&2 echo "Incorrect bash-atproto version"; return 1; fi
 
-bapBsky_internalVersion=1
-bapBsky_internalMinorVer=4
-bapBsky_allowLegacyPre2=1
+bapBsky_internalVersion=2
+bapBsky_internalMinorVer=0
+bapBsky_bskyAppViewDID=did:web:api.bsky.app#bsky_appview
+bapBsky_lumiURL=video.bsky.app
 
 function bapBskyErr () {
    >&2 echo "bap-bsky: $*"
···
 function bapBskyEcho () {
    if [ ! "$bap_verbosity" -ge 1 ]; then return 0; fi
    echo "bap-bsky: $*"
+}
+
+function bapBskyErrVerb () {
+   if [ ! "$bap_verbosity" -ge 2 ]; then return 0; fi
+   >&2 echo "bap-bsky: $*"
 }
 
 function bapBsky_cyorInit () {
···
    bapCYOR_add height $4 .embed$l.aspectRatio
 }
 
-# (porn, sexual, nudity), graphic-media
-function bapBsky_cyorAddLabel () {
-   if [ "$bapBsky_allowLegacyPre2" != "1" ]; then >&2 echo "${FUNCNAME[0]}: command not found"; return 127; fi
-   bapBskyErr "warn: function ${FUNCNAME[0]} is deprecated. use bapBsky_cyorAddSelfLabels instead"
-   if [ -z "$2" ]; then bapBskyErr "error: Required argument missing"; return 1; fi
-   bapCYOR_str \$type com.atproto.label.defs#selfLabels .labels
-   # can you use multiple labels like this?
-   bapCYOR_str val $2 .labels.values.[$1]
-}
-
-function bapBsky_cyorGetReplyRoot () {
+function bapBskyInternal_cyorGetReplyRoot () {
    if [ -z "$1" ]; then bapBskyErr "error: Required argument missing"; return 1; fi
-   bapBsky_temp=$(bap_getRecord $1) || return $?
-   if echo $bapBsky_temp | jq -re '.value.reply.root.uri' > /dev/null; then
+   bapBsky_temp=$(bapBsky_getPost "$1" -e) || return $?
+   if echo $bapBsky_temp | jq -re '.record.reply.root.uri' > /dev/null; then
       # copy values
-      bapCYOR_str uri $(echo $bapBsky_temp | jq -re '.value.reply.root.uri') .reply.root
-      bapCYOR_str cid $(echo $bapBsky_temp | jq -re '.value.reply.root.cid') .reply.root
+      bapCYOR_str uri $(echo $bapBsky_temp | jq -re '.record.reply.root.uri') .reply.root
+      bapCYOR_str cid $(echo $bapBsky_temp | jq -re '.record.reply.root.cid') .reply.root
+   elif [ -z "$bapBsky_temp" ]; then
+      bapBskyErr "failed to resolve post"
+      return 1
    else
       # we just wasted time and bandwidth!
       bapCYOR_str uri $(echo $bapBsky_temp | jq -re '.uri') .reply.root
···
 
 function bapBsky_cyorAddReply () {
    if [ -z "$1" ]; then bapBskyErr "error: Required argument missing"; return 1; fi
-   bapBsky_temp=$(bap_getRecord $1) || return $?
+   local bapBsky_temp bapBsky_tempPost=$bap_cyorRecord
+   bapBsky_temp=$(bapBsky_getPost "$1" -e) || return $?
+   if [ "$(echo $bapBsky_temp | jq -r .viewer.replyDisabled)" = "true" ]; then bapBskyErr "specified post disallows replies"; return 2; fi
    bapCYOR_str uri $(echo $bapBsky_temp | jq -re '.uri') .reply.parent
    bapCYOR_str cid $(echo $bapBsky_temp | jq -re '.cid') .reply.parent
-   if ! echo $bap_cyorRecord | jq -re '.reply.root' > /dev/null; then bapBsky_cyorGetReplyRoot $1 || return $?; fi
+   bapBskyInternal_cyorGetReplyRoot $1 || { bap_cyorRecord=$bapBsky_tempPost; return 1; }
    return 0
 }
 
···
    return 0
 }
 
+# (porn, sexual, nudity), graphic-media
 function bapBsky_cyorAddSelfLabels () {
    if [ -z "$1" ]; then bapBskyErr "error: Required argument missing"; return 1; fi
    bapCYOR_str \$type com.atproto.label.defs#selfLabels .labels
···
 function bapBsky_cyorAddQuote () {
    if [ -z "$1" ]; then bapBskyErr "error: Required argument missing"; return 1; fi
    local bapBsky_temp cyorTemp l
-   bapBsky_temp=$(bap_getRecord $1) || return $?
-   case "$(echo $bap_cyorRecord | jq -r .embed.[\"\$type\"])" in
+   bapBsky_temp=$(bapBsky_getPost "$1" -e) || return $?
+   if [ "$(echo $bapBsky_temp | jq -r .viewer.embeddingDisabled)" = "true" ]; then bapBskyErr "specified post disallows quotes"; return 2; fi
+   case "$(echo $bap_cyorRecord | jq -r .record.embed.[\"\$type\"])" in
       "null")
          bapCYOR_str \$type "app.bsky.embed.record" .embed;;
       "app.bsky.embed.record");;
···
 }
 
 function bapBsky_submitPost () {
-   bapCYOR_str createdAt $(date -u +%Y-%m-%dT%H:%M:%S.%3NZ)
-   bap_postRecord "$bap_cyorRecord" || return $?
+   if ! echo $bap_cyorRecord | jq -re .createdAt > /dev/null; then bapCYOR_str createdAt $(bap_generateDatetime); fi
+   bapBskyErrVerb "submitting record..."
+   bap_postRecord "$bap_cyorRecord" "$1" "$2" || return $?
    bap_cyorRecord=
    uri=$(echo $bap_result | jq -r .uri)
    cid=$(echo $bap_result | jq -r .cid)
···
    return 0
 }
 
-
 function bapBsky_createRepost () { # arguments 1 is uri, 2 is cid. error codes same as postToBluesky
    if [ -z "$2" ]; then bapBskyErr "fatal: Required argument missing"; return 1; fi
+   if [ "$bapBsky_skipRepostChecks" != "1" ]; then
+     bapBsky_temp=$(bapBsky_getPost "$1" -e) || return $?
+     if [ "$(echo $bapBsky_temp | jq -r .viewer.repost)" != "null" ]; then bapBskyErr "you already reposted this post!"; return 0; fi
+   fi
    bap_cyorRecord=
    bapCYOR_str \$type app.bsky.feed.repost
    bapCYOR_str cid $2 .subject
    bapCYOR_str uri $1 .subject
+   if [ "$3" = "--no-create" ]; then declare -g bap_cyorRecord=$bap_cyorRecord; return 0; fi
    bapBsky_submitPost || return $?
    bapBskyEcho "Repost record at $uri"
    return 0
···
 }
 
 function bapBsky_prepareVideoIndirect () {
-   bapBsky_prepareVideo "$@"
-   return $?
-}
-
-function bapBsky_prepareVideo () {
-   # stub, will actually talk to bluesky video service in the future
    # $1 is file
    # $2 is mime (like bap_postBlobToPDS)
    if [ -z "$2" ]; then bapBskyErr "fatal: Required argument missing"; return 1; fi
-   if [ "$2" != "video/mp4" ]; then if [ "$bapBsky_allowLegacyPre2" != "1" ]; then bapBskyErr "videos must be mp4"; return 1; else bapBskyErr "warning: videos are only supposed to be mp4. this will be blocked in a future version"; fi; fi
+   if [ "$2" != "video/mp4" ]; then bapBskyErr "videos must be mp4"; fi
    bapBsky_checkVideo "$1" || return $?
+   # bap_prepareImage "$1" 100000000 2147483647 2147483647
    local uuid=$(uuidgen)
-   if [ "$bapBsky_allowLegacyPre2" != "1" ]; then
-      exiftool -all= "$1" -o "/tmp/$uuid.mp4" || return $?
-   else
-      cp "$1" "/tmp/$uuid.mp4" || return $?
-   fi
+   exiftool -all= "$1" -o "/tmp/$uuid.mp4" || return $?
    bap_postBlobToPDS "/tmp/$uuid.mp4" "$2" || { bapBskyErr "warning: video upload failed"; rm "/tmp/$uuid.mp4"; return 1; }
    rm "/tmp/$uuid.mp4"
    bap_imageWidth=$(exiftool -ImageWidth -s3 $1)
    bap_imageHeight=$(exiftool -ImageHeight -s3 $1)
-   bapBskyEcho 'video "posted"'
+   bapBskyEcho 'uploaded video'
    return 0
 }
 
 function bapBsky_getVideoLimits () {
    # TODO: figure out atproto-proxy for Lumi
    local bap_result bapBsky_temp
-   bapBsky_temp=$(bap_getServiceAuth did:web:video.bsky.app "" app.bsky.video.getUploadLimits) || return $?
-   bap_result=$(curl --fail-with-body -s -A "$bap_curlUserAgent" -H "Authorization: Bearer $bapBsky_temp" "https://video.bsky.app/xrpc/app.bsky.video.getUploadLimits")
-   bapInternal_errorCheck $? bapBsky_videoLimits "fatal: failed to get video limits" || return $?
+   bapBsky_temp=$(bap_getServiceAuth did:web:$bapBsky_lumiURL "" app.bsky.video.getUploadLimits) || return $?
+   bap_result=$(curl --fail-with-body -s -A "$bap_curlUserAgent" -H "Authorization: Bearer $bapBsky_temp" "https://$bapBsky_lumiURL/xrpc/app.bsky.video.getUploadLimits")
+   bapInternal_errorCheck $? bapBsky_getvideoLimits "fatal: failed to get video limits" || return $?
    if [ "$1" = "--raw" ]; then echo $bap_result; else
       if [ "$(echo $bap_result | jq -r .canUpload)" != "true" ]; then echo $bap_result | jq -r .message; return 1; fi
       echo $bap_result | jq -r .message
···
    fi
 }
 
+# function bapBsky_videoUpload () {
+#    local bap_resultcode
+#    bap_result=$(curl --fail-with-body -s -A "$bap_curlUserAgent" -X POST -H "Authorization: Bearer $1" -H "Content-Type: $3" --data-binary @"$2" "https://$bapBsky_lumiURL/xrpc/app.bsky.video.uploadVideo")
+#    bap_resultcode=$?
+#    # BskyVideo can throw HTTP 409 if it's already done, check for that
+#    if [ "$(echo $bap_result | jq -r .jobStatus.error)" = "already_exists" ]; then bap_resultcode=0; fi
+#    bapInternal_errorCheck $bap_resultcode bapBsky_videoUpload "fatal: failed to upload video" || return $?
+#    # give job id stuff
+#    bapBsky_jobId=$(echo "$bap_result" | jq -r .jobStatus.jobId)
+#    return 0
+# }
+#
+# function bapBsky_videoStatus () {
+#    # no auth needed?
+#    curl --fail-with-body -s -A "$bap_curlUserAgent" "https://$bapBsky_lumiURL/xrpc/app.bsky.video.getJobStatus?jobId=$1"
+# }
+
+function bapBsky_prepareVideo () {
+#    if [ -z "$2" ]; then bapBskyErr "fatal: Required argument missing"; return 1; fi
+#    bapBsky_checkVideo "$1" || return $?
+#    local bapBsky_temp
+#    #bapBsky_temp=$(bap_getServiceAuth did:web:video.bsky.app 900 com.atproto.server.uploadBlob) || return $?
+#    bapBsky_temp=$(bap_getServiceAuth did:web:$(echo $savedPDS | sed 's|https://||g') 900 com.atproto.server.uploadBlob) || return $?
+#    bapBsky_videoUpload "$bapBsky_temp" "$1" "$2" || return $?
+#    while :; do
+#       bapBsky_temp=$(bapBsky_videoStatus "$bapBsky_jobId" | jq -r '.jobStatus.state') || { bapBskyErr "unexpected response from videoStatus"; return 1; }
+#       if [ "$bapBsky_temp" = "JOB_STATUS_COMPLETED" ]; then break; fi
+#       if [ "$bapBsky_temp" = "JOB_STATUS_FAILED" ]; then bapBskyErr "the video failed to process"; return 1; fi
+#       sleep 1
+#    done
+#    bap_postedBlob=$(echo $bapBsky_temp | jq -r .jobStatus.blob)
+#    bap_postedMime="video/mp4"
+#    bap_imageWidth=$(exiftool -ImageWidth -s3 $1)
+#    bap_imageHeight=$(exiftool -ImageHeight -s3 $1)
+#    return 0
+   bapBskyErr "function not implemented. try using bapBsky_prepareVideoIndirect"
+   return 1
+}
+
 function bapBsky_postVideo () {
    # param:
    # 1-5 - see bapBsky_cyorAddVideo
···
    return 0
 }
 
-# Compatibility stubs
-# Legacy scripts need to load bap-bsky.sh to use them.
-
-function bapBsky_stubWarn () {
-   if [ "${FUNCNAME[1]}" != "bap_postToBluesky" ] && [ "$bapBsky_allowLegacyPre2" != "1" ]; then >&2 echo "${FUNCNAME[1]}: command not found"; return 127; fi
-   bapBskyErr "warn: function ${FUNCNAME[1]} was renamed. call $1 instead"
-   if [ "${FUNCNAME[1]}" != "bap_postToBluesky" ]; then bapBskyErr "warn: this compatibility stub is deprecated and will be removed in a future version"; fi
+function bapBsky_verifyActor () {
+  if [ -z "$1" ]; then bapBskyErr "error: Required argument missing"; return 1; fi
+  local bap_cyorRecord bapBsky_temp bapBsky_temp2
+  bapBsky_temp2=$(bap_getDID "$1") || return $?
+  bapBsky_temp=$(bap_getRecord at://$bapBsky_temp2/app.bsky.actor.profile/self) || { bapBskyErr "failed to resolve profile for verification"; return 1; }
+  bap_cyorRecord=
+  bapCYOR_str \$type "app.bsky.graph.verification"
+  bapCYOR_str handle "$(bap_resolveHandle "$bapBsky_temp2")"
+  bapCYOR_str subject "$bapBsky_temp2"
+  bapCYOR_str displayName "$(echo $bapBsky_temp | jq -r .value.displayName)"
+  if [ "$2" = "--no-create" ]; then declare -g bap_cyorRecord=$bap_cyorRecord; return 0; fi
+  bapBsky_submitPost || return $?
+  bapBskyEcho "verified $(echo $bapBsky_temp | jq -r .value.displayName)"
+  return 0
 }
 
-function bapCYOR_bskypost () {
-   bapBsky_stubWarn bapBsky_cyorInit || return $?
-   bapBsky_cyorInit
-   return $?
+function bapBsky_getProfile () {
+  if [ -z "$savedAccess" ]; then bapBskyErr "needs auth!"; return 1; fi
+  if ! bapInternal_validateDID "$1" 2>/dev/null && ! bapInternal_validateHandle "$1" 2>/dev/null; then bapBskyErr "bad identifier"; return 1; fi
+  local bap_result
+  bap_result=$(curl --fail-with-body -s -A "$bap_curlUserAgent" -H "Authorization: Bearer $savedAccess" -H "atproto-proxy: $bapBsky_bskyAppViewDID" "$savedPDS/xrpc/app.bsky.actor.getProfile?actor=$1")
+  bapInternal_errorCheck $? bapBsky_getProfile "failed to get profile for $1" || return $?
+  echo "$bap_result"
+  return 0
 }
 
-# This replaces the bash-atproto native function
-function bap_postToBluesky () {
-   bapBsky_stubWarn bapBsky_createPost
-   bapBsky_createPost "$@"
-   return $?
-}
-
-function bap_repostToBluesky () {
-   bapBsky_stubWarn bapBsky_createRepost || return $?
-   bapBsky_createRepost $*
-   return $?
-}
-
-function bap_prepareImageForBluesky () {
-   bapBsky_stubWarn bapBsky_prepareImage || return $?
-   bapBsky_prepareImage "$@"
-   return $?
-}
-
-function bap_postImageToBluesky () {
-   bapBsky_stubWarn bapBsky_postImage || return $?
-   bapBsky_postImage "$@"
-   return $?
-}
-
-function bap_checkVideoForBluesky () {
-   bapBsky_stubWarn bapBsky_checkVideo || return $?
-   bapBsky_checkVideo "$@"
-   return $?
+function bapBsky_followActor () {
+  if [ -z "$1" ]; then bapBskyErr "error: Required argument missing"; return 1; fi
+  local bap_cyorRecord= bapBsky_temp
+  bapBsky_temp=$(bapBsky_getProfile "$1") || return $?
+  if [ "$(echo $bapBsky_temp | jq -r .viewer.blockedBy)" = "true" ]; then bapBskyErr "can't follow: $(echo $bapBsky_temp | jq -r .displayName) is blocking you!"; return 2; fi
+  if [ "$(echo $bapBsky_temp | jq -r .viewer.blockingByList)" != "null" ]; then bapBskyErr "can't follow: you are blocking $(echo $bapBsky_temp | jq -r .displayName) by list $(echo $bapBsky_temp | jq -r .viewer.blockingByList.name)!"; return 3; fi
+  if [ "$(echo $bapBsky_temp | jq -r .viewer.blocking)" != "null" ]; then bapBskyErr "can't follow: you are blocking $(echo $bapBsky_temp | jq -r .displayName)!"; return 3; fi
+  if [ "$(echo $bapBsky_temp | jq -r .viewer.following)" != "null" ]; then bapBskyErr "already following $(echo $bapBsky_temp | jq -r .displayName)"; return 0; fi
+  if [ "$(echo $bapBsky_temp | jq -r .did)" = "$savedDID" ]; then bapBskyErr "you can't follow yourself!"; return 1; fi
+  bapCYOR_str \$type "app.bsky.graph.follow"
+  bapCYOR_str subject "$(bap_getDID "$1" || return 1)"
+  if [ "$2" = "--no-create" ]; then declare -g bap_cyorRecord=$bap_cyorRecord; return 0; fi
+  bapBsky_submitPost || return $?
+  bapBskyEcho "now following $(echo $bapBsky_temp | jq -r .displayName)"
+  return 0
 }
 
-function bap_prepareVideoForBluesky () {
-   bapBsky_stubWarn bapBsky_prepareVideo || return $?
-   bapBsky_prepareVideo "$@"
-   return $?
+function bapBsky_getPost () {
+  if [ -z "$savedAccess" ]; then bapBskyErr "needs auth!"; return 1; fi
+  if [ "$(echo $1 | cut -d '/' -f 4)" != "app.bsky.feed.post" ]; then bapBskyErr "this is not a post!"; return 1; fi
+  local bap_result
+  bapBskyErrVerb "looking up post..."
+  bap_result=$(curl --fail-with-body -s -A "$bap_curlUserAgent" -H "Authorization: Bearer $savedAccess" -H "atproto-proxy: $bapBsky_bskyAppViewDID" "$savedPDS/xrpc/app.bsky.feed.getPosts?uris=$(echo -n $1 | jq -s -R -r @uri)")
+  bapInternal_errorCheck $? bapBsky_getPost "failed to get post with uri $1" || return $?
+  echo "$bap_result" | jq -r .posts.[0]
+  if [ "$bap_result" = "null" ] && [ "$2" = "-e" ]; then bapBskyErr "failed to resolve post. it may not exist or there may be a blocking relationship."; return 2; fi
+  return 0
 }
 
-function bap_postVideoToBluesky () {
-   bapBsky_stubWarn bapBsky_postVideo || return $?
-   bapBsky_postVideo "$@"
-   return $?
+function bapBsky_likePost () {
+  if [ -z "$1" ]; then bapBskyErr "error: Required argument missing"; return 1; fi
+  local bap_cyorRecord= bapBsky_temp
+  bapBsky_temp=$(bapBsky_getPost "$1" -e) || return $?
+  if [ "$(echo $bapBsky_temp | jq -r .viewer.like)" != "null" ]; then bapBskyErr "you already liked this post!"; return 0; fi
+  bapCYOR_str \$type "app.bsky.feed.like"
+  bapCYOR_str cid "$(echo $bapBsky_temp | jq -r .cid)" .subject
+  bapCYOR_str uri "$(echo $bapBsky_temp | jq -r .uri)" .subject
+  if [ "$2" = "--no-create" ]; then declare -g bap_cyorRecord=$bap_cyorRecord; return 0; fi
+  bapBsky_submitPost || return $?
 }

bap-extra.sh

···
 # SPDX-License-Identifier: MIT
 # bap-extra.sh: Other functions that might be useful
 if [ -z "$bap_internalVersion" ]; then >&2 echo "bash-atproto not loaded?"; return 127; fi
-if [ "$bap_internalVersion" != "3" ] || ! [ "$bap_internalMinorVer" -ge "1" ]; then >&2 echo "Incorrect bash-atproto version"; return 1; fi
+if [ "$bap_internalVersion" != "4" ] || ! [ "$bap_internalMinorVer" -ge "-1" ]; then >&2 echo "Incorrect bash-atproto version"; return 1; fi
 
-bapExt_internalVersion=1
+bapExt_internalVersion=2
 bapExt_internalMinorVer=1
 
 function bapExtErr () {
-    >&2 echo "bap-extra: $*"
+  >&2 echo "bap-extra: $*"
 }
 
 function bapExtEcho () {
-    if [ ! "$bap_verbosity" -ge 1 ]; then return 0; fi
-    echo "bap-extra: $*"
+  if [ ! "$bap_verbosity" -ge 1 ]; then return 0; fi
+  echo "bap-extra: $*"
 }
 
 function bapExt_authWithATFileCreds () {
-    # Auth with atfile credentials for your convenience
-    if [ -f  "$HOME/.config/atfile.env" ]; then while IFS= read -r line; do declare -g "$line"; done < "$HOME/.config/atfile.env"
-    else bapExtErr "no ATFile credentials file to load!"; return 1; fi
-    if [ -z "$ATFILE_USERNAME" ] || [ -z "$ATFILE_PASSWORD" ]; then bapExtErr "ATFile credentials not found!"; fi
-    bap_findPDS $(bap_resolveDID $ATFILE_USERNAME) || { bapExtErr "Couldn't resolve PDS!"; return 1; }
-    bap_getKeys $ATFILE_USERNAME $ATFILE_PASSWORD || { bapExtErr "Couldn't log in with ATFile credentials!"; return 1; }
-    bapInternal_loadFromJwt
-    ATFILE_USERNAME= ATFILE_PASSWORD=
-    bapExtEcho "Auth successful. Use bap_closeSession when done"
-    return 0
-}
-
-function bapExt_fastLogin () {
-  if [ "$2" = "" ]; then bapExtErr "Required argument missing"; return 1; fi
-  bap_findPDS $(bap_resolveDID $1) || return $?
-  bap_getKeys $(bap_resolveDID $1) $2 || return $?
-  bapInternal_loadFromJwt
+  # Auth with atfile credentials for your convenience
+  if [ -f  "$HOME/.config/atfile.env" ]; then while IFS= read -r line; do declare -g "$line"; done < "$HOME/.config/atfile.env"
+  else bapExtErr "no ATFile credentials file to load!"; return 1; fi
+  if [ -z "$ATFILE_USERNAME" ] || [ -z "$ATFILE_PASSWORD" ]; then bapExtErr "ATFile credentials not found!"; fi
+  bap_getKeys "$ATFILE_USERNAME" "$ATFILE_PASSWORD" || { bapExtErr "Couldn't log in with ATFile credentials!"; return 1; }
+  ATFILE_USERNAME= ATFILE_PASSWORD=
+  bapExtEcho "Auth successful. Use bap_closeSession when done"
   return 0
 }
 
···
   if ! type uuidgen >/dev/null 2>&1; then problem=2; bapExtErr "missing uuidgen"; fi
   if ! type jq >/dev/null 2>&1; then problem=1; bapExtErr "missing jq"; fi
   if ! type curl >/dev/null 2>&1; then problem=1; bapExtErr "missing curl"; fi
+  if ! type dig >/dev/null 2>&1; then problem=1; bapExtErr "missing dig"; fi
   # if you can load this function, you have bash
 
   case "$problem" in
···
      bapExtEcho "There are no bash-atproto dependency issues on this system.";;
   esac
 }
+
+function bapExt_bskyCancelActor () {
+  if [ -z "$1" ]; then bapExtErr "error: Required argument missing"; return 1; fi
+  local bap_cyorRecord bapExt_temp bapExt_temp2
+  bapExt_temp2=$(bap_getDID "$1") || return $?
+  bapExt_temp=$(bap_getRecord at://$bapExt_temp2/app.bsky.actor.profile/self) || { bapExtErr "failed to resolve profile for cancelation"; return 1; }
+  bap_cyorRecord=
+  bapCYOR_str \$type "app.bsky.graph.cancellation"
+  bapCYOR_str handle "$(bap_resolveHandle "$bapExt_temp2")"
+  bapCYOR_str subject "$bapExt_temp2"
+  bapCYOR_str displayName "$(echo $bapExt_temp | jq -r .value.displayName)"
+  bapCYOR_str createdAt $(bap_generateDatetime)
+  bap_postRecord "$bap_cyorRecord" || return $?
+  uri=$(echo $bap_result | jq -r .uri)
+  cid=$(echo $bap_result | jq -r .cid)
+  bapExtEcho "canceled $(echo $bapExt_temp | jq -r .value.displayName)"
+}

bap-sprk.sh

···
 # The PDS is not capable of verifying Spark lexicon at the moment, be careful!
 # This code has not been thoroughly tested. Use at your own risk!
 if [ -z "$bap_internalVersion" ]; then >&2 echo "bash-atproto not loaded?"; return 127; fi
-if [ "$bap_internalVersion" != "3" ] || ! [ "$bap_internalMinorVer" -ge "0" ]; then >&2 echo "Incorrect bash-atproto version"; return 1; fi
+if [ "$bap_internalVersion" != "4" ] || ! [ "$bap_internalMinorVer" -ge "-1" ]; then >&2 echo "Incorrect bash-atproto version"; return 1; fi
 
 
 bapSprk_internalVersion=2
-bapSprk_internalMinorVer=0
+bapSprk_internalMinorVer=1
 
 function bapSprk_err () {
     >&2 echo "bap-sprk: $*"
···
 }
 
 function bapSprk_submitPost () {
-   bapCYOR_str createdAt $(date -u +%Y-%m-%dT%H:%M:%S.%3NZ)
-   bap_postRecord "$bap_cyorRecord" || return $?
+   bapCYOR_str createdAt $(bap_generateDatetime)
+   bap_postRecord "$bap_cyorRecord" "$1" "$2" || return $?
    bap_cyorRecord=
    uri=$(echo $bap_result | jq -r .uri)
    cid=$(echo $bap_result | jq -r .cid)
···
     bapSprk_echo "Posted record at $uri"
     return 0
 }
+
+function bapSprkInternal_cyorGetReplyRoot () {
+   if [ -z "$1" ]; then bapSprkErr "error: Required argument missing"; return 1; fi
+   bapSprk_temp=$(bap_getRecord $1) || return $?
+   if echo $bapSprk_temp | jq -re '.value.reply.root.uri' > /dev/null; then
+      # copy values
+      bapCYOR_str uri $(echo $bapSprk_temp | jq -re '.value.reply.root.uri') .reply.root
+      bapCYOR_str cid $(echo $bapSprk_temp | jq -re '.value.reply.root.cid') .reply.root
+   else
+      # we just wasted time and bandwidth!
+      bapCYOR_str uri $(echo $bapSprk_temp | jq -re '.uri') .reply.root
+      bapCYOR_str cid $(echo $bapSprk_temp | jq -re '.cid') .reply.root
+   fi
+   return 0
+}
+
+function bapSprk_cyorAddReply () {
+   if [ -z "$1" ]; then bapSprkErr "error: Required argument missing"; return 1; fi
+   bapSprk_temp=$(bap_getRecord $1) || return $?
+   bapCYOR_str uri $(echo $bapSprk_temp | jq -re '.uri') .reply.parent
+   bapCYOR_str cid $(echo $bapSprk_temp | jq -re '.cid') .reply.parent
+   bapSprkInternal_cyorGetReplyRoot $1
+   return 0
+}

bash-atproto.sh

···
 #!/bin/bash
 # SPDX-License-Identifier: MIT
-bap_internalVersion=3
-bap_internalMinorVer=3
+bap_internalVersion=4
+bap_internalMinorVer=-1
 
 # you can change these
 bap_plcDirectory=https://plc.directory
-bap_handleResolveURL=https://public.api.bsky.app
-bap_curlUserAgent="curl/$(curl -V | awk 'NR==1{print $2}') bash-atproto/$bap_internalVersion.$bap_internalMinorVer-$(git -C $(dirname $BASH_SOURCE) -c safe.directory=$(cd $(dirname $BASH_SOURCE); pwd) describe --always --dirty)"
+bap_curlUserAgent="curl/$(curl -V | awk 'NR==1{print $2}') bash-atproto/$bap_internalVersion.$bap_internalMinorVer-$(git -C $(dirname $BASH_SOURCE) -c safe.directory=$(cd $(dirname $BASH_SOURCE); pwd) describe --always --dirty 2>/dev/null)"
 bap_chmodSecrets=1
 bap_verbosity=1
+bap_disableOptionalChecks=0
 
 function baperr () {
    >&2 echo "bash-atproto: $*"
···
    savedAccessExpiry="$(echo $bap_jwt | jq -r .exp)"
 }
 
+function bapInternal_verifyStatus () {
+   if [ "$bap_disableOptionalChecks" = "1" ]; then return 0; fi
+   if [ "$(echo $bap_result | jq -r .active)" = "false" ]; then
+      baperr "warning: account is inactive"
+      if [ -n "$(echo $bap_result | jq -r .status)" ]; then baperr "pds said: $(echo $bap_result | jq -r .status)"; else baperr "no reason was given for the account not being active"; fi
+      return 115
+   fi
+}
+
 function bap_loadSecrets () {
    if [[ -f $1 ]]; then while IFS= read -r line; do declare -g "$line"; done < "$1"
    bap_decodeJwt "$savedAccess" || return 1
···
    esac
 }
 
-function bapInternal_verifyStatus () {
-   if [ "$(echo $bap_result | jq -r .active)" = "false" ]; then
-      baperr "warning: account is inactive"
-      if [ -n "$(echo $bap_result | jq -r .status)" ]; then baperr "pds said: $(echo $bap_result | jq -r .status)"; else baperr "no reason was given for the account not being active"; fi
-      return 115
-   fi
-}
-
 function bapInternal_validateDID () {
    if ! [[ "$1" =~ ^did:[a-z]+:[a-zA-Z0-9._:%-]*[a-zA-Z0-9._-]$ ]]; then baperr "fatal: input not a did"; return 1; fi
    return 0
 }
 
+function bapInternal_validateHandle () {
+   if ! [[ "$1" =~ ^([a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?$ ]]; then baperr "fatal: input not a handle"; return 1; fi
+   return 0
+}
+
 function bap_getKeys () { # 1: failure 2: user error
    if [ -z "$2" ]; then baperr "No app password was passed"; return 2; fi
+   local lSavedPDS=$3
+   if [ -z "$lSavedPDS" ]; then lSavedPDS=$(bap_resolvePDS $(bap_getDID "$1")) || return $?; fi
    bapecho 'fetching keys'
-   bap_result=$(curl --fail-with-body -s -A "$bap_curlUserAgent" -X POST -H 'Content-Type: application/json' -d "{ \"identifier\": \"$1\", \"password\": \"$2\" }" "$savedPDS/xrpc/com.atproto.server.createSession")
+   bap_result=$(curl --fail-with-body -s -A "$bap_curlUserAgent" -X POST -H 'Content-Type: application/json' -d "{ \"identifier\": \"$1\", \"password\": \"$2\" }" "$lSavedPDS/xrpc/com.atproto.server.createSession")
    bapInternal_errorCheck $? bap_getKeys "fatal: failed to authenticate" || return $?
    bapecho secured the keys!
    savedAccess=$(echo $bap_result | jq -r .accessJwt)
···
    # we don't care about the handle
    bap_decodeJwt $savedAccess
    if [ "$(echo $bap_jwt | jq -r .scope)" = "com.atproto.access" ]; then baperr "warning: this is not an app password"; fi
+   bapInternal_loadFromJwt
    bapInternal_verifyStatus || return $?
    return 0
 }
···
    savedAccess=$(echo $bap_result | jq -r .accessJwt)
    savedRefresh=$(echo $bap_result | jq -r .refreshJwt)
    bap_decodeJwt $savedAccess
+   bapInternal_loadFromJwt
    bapInternal_verifyStatus || return $?
    return 0
 }
···
 
 function bapInternal_finalizeRecord () {
    if ! jq -e . >/dev/null <<<"$1"; then baperr "can't finalize: JSON parse error"; return 1; fi
-   bap_finalRecord="{\"collection\": $(echo $1 | jq -c '.["$type"]'), \"repo\": \"$savedDID\", \"record\": $1}"
+   local bap_temp
+   if [ "$2" = "true" ]; then bap_temp=", \"validate\": true"; fi
+   if [ "$2" = "false" ]; then bap_temp=", \"validate\": false"; fi
+   if [ -n "$3" ]; then bap_temp="$bap_temp, \"rkey\": \"$3\""; fi
+   bap_finalRecord="{\"collection\": $(echo $1 | jq -c '.["$type"]'), \"repo\": \"$savedDID\", \"record\": $1$bap_temp}"
    if ! jq -e . >/dev/null <<<"$1"; then baperr "finalize: JSON parse error"; return 1; fi
    return 0
 }
 
 function bap_postRecord () {
-   bapInternal_finalizeRecord "$1" || { baperr "not posting because finalize failed"; return 1; }
+   bapInternal_finalizeRecord "$1" "$2" "$3"|| { baperr "not posting because finalize failed"; return 1; }
+   if [ "$bap_dryRun" = "1" ]; then
+      bapecho "The following $(echo "$bap_finalRecord" | jq -r '.record.["$type"]') record would be sent to the PDS:"
+      echo "$bap_finalRecord" | jq
+      return 1
+   fi
    bap_result=$(curl --fail-with-body -s -A "$bap_curlUserAgent" -X POST -H "Authorization: Bearer $savedAccess" -H 'Content-Type: application/json' -d "$bap_finalRecord" "$savedPDS/xrpc/com.atproto.repo.createRecord")
    bapInternal_errorCheck $? bap_postRecord "failed to post record" || return $?
    return 0
 }
 
-function bap_postToBluesky () { #1: exception 2: refresh required
-   if [ -z "$1" ]; then baperr "fatal: No argument given to post"; return 1; fi
-   bap_cyorRecord='{"$type":"app.bsky.feed.post"}'
-   bapCYOR_str text "$1"
-   if [ -n "$2" ]; then bapCYOR_add langs "[\"$2\"]"; fi
-   bapCYOR_str createdAt $(date -u +%Y-%m-%dT%H:%M:%S.%3NZ)
-   bap_postRecord "$bap_cyorRecord" || return $?
-   uri=$(echo $bap_result | jq -r .uri)
-   cid=$(echo $bap_result | jq -r .cid)
-   bapecho "Posted record at $uri"
-   return 0
-}
-
 function bapInternal_resizeImage () {
+   if ! [[ "$mimetemp" =~ ^image ]]; then baperr "can't resize non-pictures"; return 2; fi
    bapecho "need to resize image"
    convert /tmp/bash-atproto/$workfile -resize $1x$2 /tmp/bash-atproto/new-$workfile
    if ! [ "$?" = "0" ]; then baperr "fatal: convert failed!"; rm /tmp/bash-atproto/$workfile 2>/dev/null; return 1; fi
···
 }
 
 function bapInternal_compressImage () {
+   if ! [[ "$mimetemp" =~ ^image ]]; then baperr "can't compress non-pictures"; return 2; fi
    bapecho "image is too big, trying to compress"
    convert /tmp/bash-atproto/$workfile -define jpeg:extent=$1 /tmp/bash-atproto/new-${workfile%.*}.jpg
    if [[ ! "$?" = "0" ]] || [[ $(stat -c %s /tmp/bash-atproto/new-${workfile%.*}.jpg) -gt $1 ]]; then baperr "fatal: error compressing image"; rm /tmp/bash-atproto/$workfile /tmp/bash-atproto/new-${workfile%.*}.jpg; return 1; fi
···
    if [ -z "$4" ]; then baperr "fatal: not enough parameters"; return 1; fi
    if [ ! -f "$1" ]; then baperr "fatal: image not found"; return 1; fi
    mkdir /tmp/bash-atproto 2>/dev/null
+   local workfile mimetemp
    workfile=$(uuidgen)."${1##*.}"
+   mimetemp=$(file --mime-type -b $bap_preparedImage) || return 1
    cp "$1" /tmp/bash-atproto/$workfile
    exiftool -all= /tmp/bash-atproto/$workfile -overwrite_original
    if ! [ "$?" = "0" ]; then baperr "fatal: exiftool failed!"; rm /tmp/bash-atproto/$workfile 2>/dev/null; return 1; fi
-   if [[ $(identify -format '%w' /tmp/bash-atproto/$workfile) -gt $3 ]] || [[ $(identify -format '%h' /tmp/bash-atproto/$workfile) -gt $4 ]]; then
-      bapInternal_resizeImage $3 $4
-      if ! [ "$?" = "0" ]; then return 1; fi
+   if [[ $(exiftool -ImageWidth -s3 /tmp/bash-atproto/$workfile) -gt $3 ]] || [[ $(exiftool -ImageHeight -s3 /tmp/bash-atproto/$workfile) -gt $4 ]]; then
+      bapInternal_resizeImage $3 $4 || return 1
    fi
    if [[ $(stat -c %s /tmp/bash-atproto/$workfile) -gt $2 ]]; then
-      bapInternal_compressImage $2
-      if ! [ "$?" = "0" ]; then return 1; fi
+      bapInternal_compressImage $2 || return 1
    fi
    bapecho "image preparation successful"
    bap_preparedImage=/tmp/bash-atproto/$workfile
    bap_preparedMime=$(file --mime-type -b $bap_preparedImage)
    bap_preparedSize=$(stat -c %s $bap_preparedImage)
-   bap_imageWidth=$(identify -format '%w' $bap_preparedImage)
-   bap_imageHeight=$(identify -format '%h' $bap_preparedImage)
+   bap_imageWidth=$(exiftool -ImageWidth -s3 $bap_preparedImage)
+   bap_imageHeight=$(exiftool -ImageHeight -s3 $bap_preparedImage)
    return 0
 }
 
···
    return 0
 }
 
-function bap_resolvePDS () {
+function bap_resolveDID () {
    if [ -z "$1" ]; then baperr "fatal: no did specified"; return 1; fi
    bapInternal_validateDID "$1" || return 1
    case "$(echo $1 | cut -d ':' -f 2)" in
···
       return 1
       ;;
    esac
-   bap_resolve=$(echo $bap_result | jq -re .service)
-   if ! [ "$?" = "0" ]; then baperr "fatal: failed to parse DID document"; return 1; fi
+   echo "$bap_result"
+   return 0
+}
+
+function bap_resolvePDS () {
+   bap_resolve=$(bap_resolveDID "$1" | jq -re .service) || { baperr "fatal: failed to parse DID document"; return 1; }
    iter=0
    while read -r id; do
       if ! [ "$id" = "#atproto_pds" ]; then
···
    return 0
 }
 
-function bap_findPDS () {
-   savedPDS=$(bap_resolvePDS $1)
-   if [ -z "$savedPDS" ]; then baperr "fatal: PDS not found in DID document"; return 1; fi
+function bap_resolveHandle () {
+   if ! bapInternal_validateDID "$1" 2> /dev/null; then baperr "fatal: specify did as first parameter"; return 1; fi
+   local bap_temp bap_temp2
+   bap_temp=$(bap_resolveDID "$1") || return $?
+   bap_temp2=$(echo $bap_temp | jq -re ".alsoKnownAs.[0]" | cut -d '/' -f 3)
+   if ! bapInternal_validateHandle "$bap_temp2" 2> /dev/null; then baperr "fatal: did doc returned invalid handle: $bap_temp2"; return 1; fi
+   echo $bap_temp2
    return 0
 }
 
-function bap_resolveDID () {
+function bap_getDID () {
    if [ -z "$1" ]; then baperr "specify identifier as first parameter"; return 1; fi
    if bapInternal_validateDID $1 2> /dev/null; then
+   if [ "$bap_disableOptionalChecks" != "1" ]; then bap_resolveDID "$1" > /dev/null || return $?; fi
    echo $1
    return 0
 
-   elif [[ "$1" =~ ^([a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?$ ]]; then
-      baperrverb "Looking up handle from $bap_handleResolveURL"
-      bap_temp=$(curl -s -A "$bap_curlUserAgent" -G --data-urlencode "handle=$1" "$bap_handleResolveURL/xrpc/com.atproto.identity.resolveHandle" | jq -re .did)
-      if [ "$?" != "0" ]; then
-         baperr "Error obtaining DID from API"
-         return 2
+   elif bapInternal_validateHandle $1 2> /dev/null; then
+      baperrverb "Looking up handle from DNS"
+      local bap_temp
+      bap_temp=$(dig -t txt _atproto."$1" +short | cut -d '=' -f 2 | tr -d '"')
+      if ! bapInternal_validateDID "$bap_temp" 2>/dev/null; then
+         baperrverb "Looking up handle from website"
+         bap_temp=$(curl -s -A "$bap_curlUserAgent" "https://$1/.well-known/atproto-did")
+         if [ "$?" != "0" ] || ! bapInternal_validateDID "$bap_temp" 2>/dev/null; then
+            baperr "Error resolving handle"
+            return 2
+         fi
       fi
       echo $bap_temp
       return 0
-
    else
       baperr "fatal: input not a handle or did"
       return 1
-
    fi
-   # should not get here
-   return 1
 }
 
 function bap_didInit () {
-   savedDID=$(bap_resolveDID "$1") || return $?
+   savedDID=$(bap_getDID "$1") || return $?
    bapecho "Using DID: $savedDID"
    return 0
 }
 
 function bap_getRecord () {
+   local bap_result
    # get did of user
    if [ "$bap_verbosity" -ge "2" ]; then >&2 echo -n "bash-atproto: fetching did..."; fi
-   bap_temp[0]=$(bap_resolveDID $(echo $1 | cut -d '/' -f 3)) || { baperr "failed to fetch did of record creator"; return 1; }
+   bap_temp[0]=$(bap_getDID $(echo $1 | cut -d '/' -f 3)) || { baperr "failed to fetch did of record creator"; return 1; }
    # get their pds
    if [ "$bap_verbosity" -ge "2" ]; then >&2 echo -n "pds..."; fi
    bap_temp[1]=$(bap_resolvePDS ${bap_temp[0]}) || { baperr "failed to fetch pds of record creator"; return 1; }
    # get the post
-   if [ "$bap_verbosity" -ge "2" ]; then >&2 echo -n "post..."; fi
+   if [ "$bap_verbosity" -ge "2" ]; then >&2 echo -n "record..."; fi
    bap_result=$(curl -s --fail-with-body -A "$bap_curlUserAgent" -G --data-urlencode "repo=${bap_temp[0]}" --data-urlencode "collection=$(echo $1 | cut -d '/' -f 4)" --data-urlencode "rkey=$(echo $1 | cut -d '/' -f 5)" ${bap_temp[1]}/xrpc/com.atproto.repo.getRecord) || { bapInternal_errorCheck $? bap_getRecord "failed to fetch record"; return 1; }
+   if [ "$bap_verbosity" -ge "2" ]; then >&2 echo "ok"; fi
    echo $bap_result
-   baperrverb "ok"
-   bap_result=
    return 0
 }
 
···
    bap_result=
    return 0
 }
+
+function bap_generateDatetime () {
+   local bap_temp
+   bap_temp=$(date -u +%Y-%m-%dT%H:%M:%S.%3NZ)
+   # if date doesn't support sub-second precision, just fake it lol
+   if ! [[ "$(echo $bap_temp | cut -d '.' -f 2 | cut -c -3)"  =~ ^[0-9]+$ ]]; then bap_temp=$(date -u +%Y-%m-%dT%H:%M:%S.$(echo 00$((RANDOM % 999)) | grep -o '...$')Z); fi
+   if ! [[ $bap_temp =~ ^[0-9]{4}-[01][0-9]-[0-3][0-9]T[0-2][0-9]:[0-6][0-9]:[0-6][0-9](.[0-9]{1,20})?(Z|([+-][0-2][0-9]:[0-5][0-9]))$ ]]; then baperr "generated datetime is invalid"; return 1; fi
+   echo "$bap_temp"
+   return 0
+}

docs/HOWTO.md

···
 ## Log in
 
 1. `source bash-atproto.sh`
-2. `bap_didInit <your handle or did>`
-3. `bap_findPDS $savedDID`
-4. `bap_getKeys $savedDID <app password>`
+2. `bap_getKeys <did or handle> <app password> <your PDS, optional>`
 
 The access and refresh tokens are stored in memory. You can write them to disk with `bap_saveSecrets <file name>` and load them with `bap_loadSecrets`. After obtaining the tokens, information about the account is fetched from the access token and loading from the tokens won't require any further account information.
 
···
 You can also set the post in progress to be a quote post with `bapBsky_cyorAddQuote`. It takes an AT URI as input just like replies.
 
 Note: Quote posts with media have a different structure for the media in question. The native `bapBsky_cyorAddImage` and `bapBsky_cyorAddVideo` functions handle this transparently, but you'll need to keep that in mind if you manually edit the JSON.
+
+### Embeds
+
+Link embeds are great, and you can add one with `bapBsky_cyorAddExternalEmbed`. There are two ways to use this function, depending on whether you want a thumbnail or not:
+
+1. Link and text only: `bapBsky_cyorAddExternalEmbed <URL> <title> <description>`
+
+2. With a thumbnail: `bapBsky_cyorAddExternalEmbed <URL> <title> <description> $bap_postedBlob $bap_postedMime $bap_postedSize`
+
+Note that if you're using a thumbnail, you need to mind the dimensions that the client app expects. For example, most link thumbnails should be 2000x1050, and YouTube embeds are 2000x1500, have black bars on the top and bottom, and are cropped by the client.
 
 ### Adding (hidden hash)tags