#!/usr/bin/env python3
"""
web_archive.py - Capture and archive web pages to ATProto with IPFS pinning.

Creates signed, timestamped records of web page captures on your PDS.
Each capture includes an IPFS CID (content-addressed identifier) and a PDS blob.

Supports two modes:
  - Single capture: archive one URL as a `systems.witchcraft.archive.capture` record
  - Bundle capture: archive a page + all its subresources (CSS, JS, images) as a
    `systems.witchcraft.archive.bundle` record containing a MASL-shaped manifest
    with CID-addressed resources (MASL spec: https://dasl.ing/masl.html)

Usage:
    python web_archive.py <url>                    # Archive a URL (single capture)
    python web_archive.py <url> --bundle           # Archive URL + subresources as MASL bundle
    python web_archive.py --list [--limit N]       # List recent captures
    python web_archive.py --verify <rkey>          # Re-fetch and verify CID
    python web_archive.py --search <query>         # Search captures by URL/title
"""

import argparse
import hashlib
import json
import mimetypes
import os
import re
import sys
from datetime import datetime, timezone
from urllib.parse import urljoin, urlparse

import requests
from multiformats import CID, multihash


# --- config ---

PDS = os.environ.get("ATP_PDS_URL", "https://bsky.social")
ATP_HANDLE = os.environ.get("ATP_HANDLE", "")
ATP_PASSWORD = os.environ.get("ATP_PASSWORD", "")
COLLECTION_CAPTURE = "systems.witchcraft.archive.capture"
COLLECTION_BUNDLE = "ing.dasl.masl"
COLLECTION_MASL_LEGACY = COLLECTION_BUNDLE  # consolidated

# Max subresources to fetch per bundle (safety limit)
MAX_SUBRESOURCES = 100
# Max size per individual resource (10MB)
MAX_RESOURCE_SIZE = 10 * 1024 * 1024
# Allowed subresource schemes
ALLOWED_SCHEMES = {"http", "https"}


# --- auth ---

def get_session():
    handle = ATP_HANDLE
    password = ATP_PASSWORD

    if not handle or not password:
        print("error: set ATP_HANDLE and ATP_PASSWORD environment variables")
        print("  export ATP_PDS_URL=https://your.pds.example.com")
        print("  export ATP_HANDLE=your.handle")
        print("  export ATP_PASSWORD=your-app-password")
        sys.exit(1)

    resp = requests.post(f"{PDS}/xrpc/com.atproto.server.createSession",
        json={"identifier": handle, "password": password})
    resp.raise_for_status()
    return resp.json()


# --- fetch ---

def fetch_page(url):
    """Fetch a URL and return (html_bytes, title, final_url, word_count, status_code)."""
    headers = {
        "User-Agent": "WebArchive/1.0 (ATProto web archiver)"
    }
    resp = requests.get(url, headers=headers, timeout=30, allow_redirects=True)
    resp.raise_for_status()
    html_bytes = resp.content
    html = html_bytes.decode("utf-8", errors="replace")
    final_url = resp.url

    # Extract title
    title_match = re.search(r"<title[^>]*>(.*?)</title>", html, re.IGNORECASE | re.DOTALL)
    title = title_match.group(1).strip() if title_match else ""
    title = title.replace("&amp;", "&").replace("&lt;", "<").replace("&gt;", ">")
    title = title.replace("&#39;", "'").replace("&quot;", '"')
    title = title[:256]

    # Word count from text extraction
    text = re.sub(r"<script[^>]*>.*?</script>", "", html, flags=re.DOTALL | re.IGNORECASE)
    text = re.sub(r"<style[^>]*>.*?</style>", "", text, flags=re.DOTALL | re.IGNORECASE)
    text = re.sub(r"<[^>]+>", " ", text)
    text = re.sub(r"\s+", " ", text).strip()
    word_count = len(text.split())

    return html_bytes, title, final_url, word_count, resp.status_code


def fetch_resource(url):
    """Fetch a subresource. Returns (bytes, content_type, final_url) or None on failure."""
    headers = {
        "User-Agent": "WebArchive/1.0 (ATProto web archiver)"
    }
    try:
        resp = requests.get(url, headers=headers, timeout=20, allow_redirects=True,
                           stream=True)
        resp.raise_for_status()

        # Check size before downloading full body
        content_length = resp.headers.get("content-length")
        if content_length and int(content_length) > MAX_RESOURCE_SIZE:
            print(f"    skip (too large: {int(content_length):,} bytes): {url[:80]}")
            return None

        content = resp.content
        if len(content) > MAX_RESOURCE_SIZE:
            print(f"    skip (too large: {len(content):,} bytes): {url[:80]}")
            return None

        content_type = resp.headers.get("content-type", "application/octet-stream")
        # Strip charset/params from content-type for MASL
        content_type = content_type.split(";")[0].strip()
        return content, content_type, resp.url
    except Exception as e:
        print(f"    skip (error: {e}): {url[:80]}")
        return None


def extract_subresource_urls(html, base_url):
    """Extract URLs of subresources (CSS, JS, images, fonts) from HTML."""
    urls = {}  # url -> expected type hint

    # CSS: <link rel="stylesheet" href="...">
    for m in re.finditer(r'<link[^>]+rel=["\']stylesheet["\'][^>]+href=["\']([^"\']+)["\']', html, re.IGNORECASE):
        urls[m.group(1)] = "text/css"
    for m in re.finditer(r'<link[^>]+href=["\']([^"\']+)["\'][^>]+rel=["\']stylesheet["\']', html, re.IGNORECASE):
        urls[m.group(1)] = "text/css"

    # JS: <script src="...">
    for m in re.finditer(r'<script[^>]+src=["\']([^"\']+)["\']', html, re.IGNORECASE):
        urls[m.group(1)] = "application/javascript"

    # Images: <img src="...">, <source srcset="...">
    for m in re.finditer(r'<img[^>]+src=["\']([^"\']+)["\']', html, re.IGNORECASE):
        urls[m.group(1)] = "image/*"
    for m in re.finditer(r'<source[^>]+srcset=["\']([^"\']+)["\']', html, re.IGNORECASE):
        # srcset can have multiple URLs with widths
        for part in m.group(1).split(","):
            src = part.strip().split()[0]
            if src:
                urls[src] = "image/*"

    # Favicons and other <link> with href
    for m in re.finditer(r'<link[^>]+href=["\']([^"\']+)["\'][^>]*>', html, re.IGNORECASE):
        href = m.group(1)
        if href not in urls:
            # Check if it's an icon or other resource
            tag = m.group(0).lower()
            if 'rel="icon"' in tag or "rel='icon'" in tag or 'rel="apple-touch-icon"' in tag:
                urls[href] = "image/*"

    # CSS @import and url() in inline <style>
    for style_match in re.finditer(r'<style[^>]*>(.*?)</style>', html, re.DOTALL | re.IGNORECASE):
        style_content = style_match.group(1)
        for m in re.finditer(r'url\(["\']?([^"\')\s]+)["\']?\)', style_content):
            url_val = m.group(1)
            if not url_val.startswith("data:"):
                urls[url_val] = "application/octet-stream"
        for m in re.finditer(r'@import\s+["\']([^"\']+)["\']', style_content):
            urls[m.group(1)] = "text/css"

    # Resolve relative URLs and filter
    resolved = {}
    base_parsed = urlparse(base_url)
    for url, type_hint in urls.items():
        if url.startswith("data:") or url.startswith("#") or url.startswith("javascript:"):
            continue
        absolute = urljoin(base_url, url)
        parsed = urlparse(absolute)
        # Only same-origin resources (MASL paths must start with /)
        if parsed.scheme in ALLOWED_SCHEMES and parsed.netloc == base_parsed.netloc:
            path = parsed.path or "/"
            if path not in resolved:
                resolved[path] = (absolute, type_hint)

    return resolved


def compute_cid(content_bytes):
    """Compute IPFS CIDv1 (raw codec, sha2-256) for content bytes."""
    digest = hashlib.sha256(content_bytes).digest()
    mh = multihash.wrap(digest, "sha2-256")
    cid = CID("base32", 1, "raw", mh)
    return str(cid)


def hash_content(content_bytes):
    """SHA-256 hash of content bytes."""
    return hashlib.sha256(content_bytes).hexdigest()


def pin_to_ipfs(content_bytes, filename="capture.html", content_type="text/html"):
    """Pin content to local IPFS node. Returns (cid, pinned)."""
    try:
        resp = requests.post("http://127.0.0.1:5001/api/v0/add",
            files={"file": (filename, content_bytes, content_type)},
            params={"pin": "true", "cid-version": "1", "raw-leaves": "false"},
            timeout=30)
        resp.raise_for_status()
        data = resp.json()
        return data["Hash"], True
    except Exception as e:
        return compute_cid(content_bytes), False


def upload_blob(session, content_bytes, content_type="text/html"):
    """Upload content as a blob to the PDS. Returns blob ref."""
    try:
        resp = requests.post(f"{PDS}/xrpc/com.atproto.repo.uploadBlob",
            headers={
                "Authorization": f"Bearer {session['accessJwt']}",
                "Content-Type": content_type,
            },
            data=content_bytes,
            timeout=60)
        resp.raise_for_status()
        return resp.json().get("blob")
    except Exception as e:
        print(f"    warning: blob upload failed ({e})")
        return None


def announce_ipfs_content(cid):
    """Announce content to IPFS DHT so it's discoverable on public gateways."""
    try:
        resp = requests.post("http://127.0.0.1:5001/api/v0/routing/provide",
            params={"arg": cid},
            timeout=60)
        return resp.status_code == 200
    except:
        return False


# --- atproto records ---

def create_capture(session, url, final_url, title, cid, content_hash, word_count,
                   html_size, pinned=False, blob_ref=None):
    """Create a single-page archive capture record."""
    now = datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")

    record = {
        "$type": COLLECTION_CAPTURE,
        "url": url,
        "capturedAt": now,
        "ipfsCid": cid,
        "contentHash": f"sha256:{content_hash}",
        "title": title,
        "wordCount": word_count,
        "htmlSize": html_size,
        "pinned": pinned,
    }

    if final_url != url:
        record["finalUrl"] = final_url
    if blob_ref:
        record["htmlBlob"] = blob_ref

    resp = requests.post(f"{PDS}/xrpc/com.atproto.repo.createRecord",
        headers={"Authorization": f"Bearer {session['accessJwt']}"},
        json={
            "repo": session["did"],
            "collection": COLLECTION_CAPTURE,
            "record": record,
        })
    resp.raise_for_status()
    return resp.json()


def create_bundle_record(session, name, url, resources_map, blobs_map,
                         captured_at, archive_meta=None):
    """Create an ing.dasl.masl record on ATProto (Web Tiles format).

    Uses MASL bundle format with archive metadata namespaced under
    systems.witchcraft.archive.

    resources_map: dict of path -> {src: blob_ref, content-type: str}
    blobs_map:     dict of path -> blob_ref (kept for compat, merged into resources)
    archive_meta:  dict with url, capturedAt, title, etc.
    """
    # Merge blob refs into resources (MASL format: resources[path].src = blob ref)
    merged_resources = {}
    for path, res_data in resources_map.items():
        entry = dict(res_data) if isinstance(res_data, dict) else {"src": res_data}
        if path in blobs_map:
            entry["src"] = blobs_map[path]
        merged_resources[path] = entry

    record = {
        "$type": COLLECTION_BUNDLE,
        # MASL required fields at top level
        "name": name,
        "resources": merged_resources,
    }

    # Archive metadata namespaced
    archive_ns = {
        "url": archive_meta.get("url", url) if archive_meta else url,
        "title": archive_meta.get("title", name) if archive_meta else name,
        "capturedAt": captured_at,
    }
    if archive_meta:
        for key in ["wordCount", "totalSize", "resourceCount",
                     "rootIpfsCid", "contentHash", "pinned", "finalUrl"]:
            if key in archive_meta:
                archive_ns[key] = archive_meta[key]
    record["systems.witchcraft.archive"] = archive_ns

    resp = requests.post(f"{PDS}/xrpc/com.atproto.repo.createRecord",
        headers={"Authorization": f"Bearer {session['accessJwt']}"},
        json={
            "repo": session["did"],
            "collection": COLLECTION_BUNDLE,
            "record": record,
        })
    resp.raise_for_status()
    return resp.json()


# --- commands ---

def cmd_archive(url, no_ipfs=False, no_blob=False):
    """Archive a single URL."""
    print(f"fetching {url}...")
    html_bytes, title, final_url, word_count, status = fetch_page(url)
    content_hash = hash_content(html_bytes)
    html_size = len(html_bytes)

    if not no_ipfs:
        print(f"  pinning to IPFS...")
        cid, pinned = pin_to_ipfs(html_bytes)
        if pinned:
            announce_ipfs_content(cid)
    else:
        cid = compute_cid(html_bytes)
        pinned = False

    print(f"  title: {title[:80]}")
    print(f"  final url: {final_url}")
    print(f"  cid: {cid}")
    print(f"  pinned: {'yes' if pinned else 'no (local CID only)'}")
    print(f"  hash: sha256:{content_hash[:16]}...")
    print(f"  size: {html_size:,} bytes, ~{word_count:,} words")

    session = get_session()

    blob_ref = None
    if not no_blob:
        print(f"  uploading blob to PDS...")
        blob_ref = upload_blob(session, html_bytes)
        if blob_ref:
            print(f"  blob uploaded!")

    result = create_capture(session, url, final_url, title, cid, content_hash,
                           word_count, html_size, pinned=pinned, blob_ref=blob_ref)
    uri = result.get("uri", "")
    rkey = uri.split("/")[-1] if uri else "?"

    print(f"\ncaptured! {uri}")
    print(f"  view: https://pdsls.dev/at/{session['did']}/{COLLECTION_CAPTURE}/{rkey}")
    return uri


def cmd_bundle(url, no_ipfs=False, max_resources=MAX_SUBRESOURCES):
    """Archive a URL + all its subresources as a MASL bundle."""
    print(f"fetching {url}...")
    html_bytes, title, final_url, word_count, status = fetch_page(url)
    html = html_bytes.decode("utf-8", errors="replace")
    html_size = len(html_bytes)

    print(f"  title: {title[:80]}")
    print(f"  size: {html_size:,} bytes, ~{word_count:,} words")

    # Extract subresource URLs
    print(f"\nscanning for subresources...")
    subresource_urls = extract_subresource_urls(html, final_url)
    print(f"  found {len(subresource_urls)} same-origin subresources")

    if len(subresource_urls) > max_resources:
        print(f"  capping at {max_resources} (use --max-resources to change)")
        # Keep only the first N
        subresource_urls = dict(list(subresource_urls.items())[:max_resources])

    # Fetch all subresources
    print(f"\nfetching subresources...")
    resources = {}  # path -> (bytes, content_type, ipfs_cid)

    for path, (abs_url, type_hint) in subresource_urls.items():
        result = fetch_resource(abs_url)
        if result:
            res_bytes, content_type, _ = result
            print(f"    ok ({len(res_bytes):,}b {content_type}): {path}")
            resources[path] = (res_bytes, content_type)

    # Phase 2: Scan fetched CSS files for url() references (fonts, images, etc)
    css_extra_urls = {}
    for path, (res_bytes, content_type) in list(resources.items()):
        if "css" in content_type:
            css_text = res_bytes.decode("utf-8", errors="replace")
            css_base = urljoin(final_url, path)
            for m in re.finditer(r'url\(["\']?([^"\')\s]+)["\']?\)', css_text):
                url_val = m.group(1)
                if url_val.startswith("data:"):
                    continue
                abs_url = urljoin(css_base, url_val)
                parsed = urlparse(abs_url)
                base_parsed = urlparse(final_url)
                if parsed.scheme in ALLOWED_SCHEMES:
                    css_path = parsed.path or "/"
                    if css_path not in resources and css_path not in css_extra_urls:
                        css_extra_urls[css_path] = (abs_url, "application/octet-stream")

    if css_extra_urls:
        print(f"\n  found {len(css_extra_urls)} extra resources from CSS url() refs")
        for path, (abs_url, _) in css_extra_urls.items():
            if len(resources) >= max_resources:
                break
            result = fetch_resource(abs_url)
            if result:
                res_bytes, content_type, _ = result
                print(f"    ok ({len(res_bytes):,}b {content_type}): {path}")
                resources[path] = (res_bytes, content_type)

    print(f"\n  fetched {len(resources)} total subresources")

    # Get session for blob uploads
    session = get_session()

    # Process root page
    print(f"\nprocessing root page...")
    if not no_ipfs:
        root_cid, root_pinned = pin_to_ipfs(html_bytes)
        if root_pinned:
            announce_ipfs_content(root_cid)
    else:
        root_cid = compute_cid(html_bytes)
        root_pinned = False

    root_blob = upload_blob(session, html_bytes, "text/html")
    if not root_blob:
        print("  ERROR: failed to upload root page blob, aborting")
        sys.exit(1)

    print(f"  root cid: {root_cid} (pinned: {root_pinned})")

    # Build MASL resources map (CID strings) and blobs map (ATProto blob refs)
    # MASL spec: src should be a CID link, not a blob ref
    resources_map = {
        "/": {
            "src": root_cid,
            "content-type": "text/html",
        }
    }
    blobs_map = {
        "/": root_blob,
    }

    # Process subresources
    total_pinned = 1 if root_pinned else 0
    total_blobs = 1
    total_bytes = html_size
    failed_blobs = 0

    for path, (res_bytes, content_type) in resources.items():
        total_bytes += len(res_bytes)

        # Pin to IPFS
        if not no_ipfs:
            res_cid, res_pinned = pin_to_ipfs(res_bytes,
                filename=path.split("/")[-1] or "resource",
                content_type=content_type)
            if res_pinned:
                total_pinned += 1
                announce_ipfs_content(res_cid)
        else:
            res_cid = compute_cid(res_bytes)

        # Upload blob to PDS
        blob_ref = upload_blob(session, res_bytes, content_type)
        if blob_ref:
            total_blobs += 1
            resources_map[path] = {
                "src": res_cid,
                "content-type": content_type,
            }
            blobs_map[path] = blob_ref
        else:
            failed_blobs += 1
            print(f"    blob failed: {path}")

    print(f"\n  resources: {len(resources_map)} ({total_blobs} blobs, {total_pinned} pinned)")
    print(f"  total size: {total_bytes:,} bytes")
    if failed_blobs:
        print(f"  failed blobs: {failed_blobs}")

    # Build archive metadata (namespaced per MASL spec)
    now = datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
    archive_meta = {
        "url": url,
        "capturedAt": now,
        "title": title,
        "wordCount": word_count,
        "totalSize": total_bytes,
        "resourceCount": len(resources_map),
        "rootIpfsCid": root_cid,
        "contentHash": f"sha256:{hash_content(html_bytes)}",
        "pinned": total_pinned > 0,
    }
    if final_url != url:
        archive_meta["finalUrl"] = final_url

    # Create bundle record
    print(f"\ncreating archive bundle record...")
    bundle_name = title or urlparse(url).netloc
    result = create_bundle_record(session, bundle_name, url,
                                  resources_map, blobs_map,
                                  now, archive_meta=archive_meta)
    uri = result.get("uri", "")
    rkey = uri.split("/")[-1] if uri else "?"

    print(f"\nbundled! {uri}")
    print(f"  view: https://pdsls.dev/at/{session['did']}/{COLLECTION_BUNDLE}/{rkey}")
    print(f"  resources: {len(resources_map)} files, {total_bytes:,} bytes total")
    print(f"  root IPFS: ipfs://{root_cid}")
    return uri


def cmd_list(limit, collection=None):
    """List recent captures from either or both collections."""
    session = get_session()
    all_records = []

    collections = ([COLLECTION_CAPTURE, COLLECTION_BUNDLE]
                   if not collection else [collection])

    for coll in collections:
        try:
            resp = requests.get(f"{PDS}/xrpc/com.atproto.repo.listRecords",
                headers={"Authorization": f"Bearer {session['accessJwt']}"},
                params={
                    "repo": session["did"],
                    "collection": coll,
                    "limit": limit,
                    "reverse": True,
                })
            resp.raise_for_status()
            for rec in resp.json().get("records", []):
                rec["_collection"] = coll
                all_records.append(rec)
        except:
            pass

    if not all_records:
        print("no captures yet")
        return

    # Sort by captured time (newest first)
    def sort_key(r):
        val = r.get("value", {})
        meta = val.get("systems.witchcraft.archive", {})
        return meta.get("capturedAt", val.get("capturedAt", ""))
    all_records.sort(key=sort_key, reverse=True)

    for rec in all_records[:limit]:
        val = rec.get("value", {})
        rkey = rec["uri"].split("/")[-1]
        coll = rec["_collection"]
        is_bundle = coll in (COLLECTION_BUNDLE, COLLECTION_MASL_LEGACY)

        if is_bundle:
            meta = val.get("systems.witchcraft.archive", {})
            title = val.get("name", meta.get("title", "(untitled)"))[:60]
            url = meta.get("url", "")[:60]
            captured = meta.get("capturedAt", "")[:19]
            cid = meta.get("rootIpfsCid", "")
            res_count = meta.get("resourceCount", len(val.get("resources", {})))
            total_size = meta.get("totalSize", 0)
            tag = f"[BUNDLE {res_count} files, {total_size:,}b]"
        else:
            title = val.get("title", "(untitled)")[:60]
            url = val.get("url", "")[:60]
            captured = val.get("capturedAt", "")[:19]
            cid = val.get("ipfsCid", val.get("cid", ""))
            tag = "[single]"

        print(f"  [{rkey}] {captured} {tag}")
        print(f"    {title}")
        print(f"    {url}")
        if cid:
            print(f"    ipfs://{cid}")
        print()


def cmd_verify(rkey):
    """Verify a capture's hash against current page content."""
    session = get_session()

    # Try all collections
    rec = None
    for coll in [COLLECTION_CAPTURE, COLLECTION_BUNDLE]:
        try:
            resp = requests.get(f"{PDS}/xrpc/com.atproto.repo.getRecord",
                headers={"Authorization": f"Bearer {session['accessJwt']}"},
                params={"repo": session["did"], "collection": coll, "rkey": rkey})
            resp.raise_for_status()
            rec = resp.json()
            rec["_collection"] = coll
            break
        except:
            continue

    if not rec:
        print(f"capture {rkey} not found in any collection")
        return

    val = rec.get("value", {})
    is_bundle = rec["_collection"] in (COLLECTION_BUNDLE, COLLECTION_MASL_LEGACY)

    if is_bundle:
        meta = val.get("systems.witchcraft.archive", {})
        url = meta.get("finalUrl", meta.get("url", ""))
        stored_cid = meta.get("rootIpfsCid", "")
        stored_hash = meta.get("contentHash", "")
        captured_at = meta.get("capturedAt", "")
    else:
        url = val.get("finalUrl", val.get("url", ""))
        stored_cid = val.get("ipfsCid", val.get("cid", ""))
        stored_hash = val.get("contentHash", "")
        captured_at = val.get("capturedAt", "")

    print(f"verifying capture {rkey} ({'bundle' if is_bundle else 'single'})...")
    print(f"  url: {url}")
    print(f"  captured: {captured_at}")
    if stored_cid:
        print(f"  stored cid: {stored_cid}")
    print(f"  stored hash: {stored_hash}")

    print(f"\nre-fetching {url}...")
    html_bytes, _, _, _, _ = fetch_page(url)
    current_hash = f"sha256:{hash_content(html_bytes)}"
    current_cid = compute_cid(html_bytes)

    if stored_cid:
        print(f"  current cid: {current_cid}")
    print(f"  current hash: {current_hash}")

    match = (stored_cid == current_cid) if stored_cid else (stored_hash == current_hash)
    if match:
        print("\n  MATCH - page content unchanged since capture")
    else:
        print("\n  MISMATCH - page has changed since capture!")
        print("  (this is expected for dynamic pages)")


def cmd_search(query):
    """Search captures by URL or title."""
    session = get_session()
    query_lower = query.lower()
    matches = []

    for coll in [COLLECTION_CAPTURE, COLLECTION_BUNDLE]:
        try:
            resp = requests.get(f"{PDS}/xrpc/com.atproto.repo.listRecords",
                headers={"Authorization": f"Bearer {session['accessJwt']}"},
                params={"repo": session["did"], "collection": coll, "limit": 100})
            resp.raise_for_status()
            for rec in resp.json().get("records", []):
                val = rec.get("value", {})
                if coll in (COLLECTION_BUNDLE, COLLECTION_MASL_LEGACY):
                    meta = val.get("systems.witchcraft.archive", {})
                    url = meta.get("url", "").lower()
                    title = val.get("name", meta.get("title", "")).lower()
                else:
                    url = val.get("url", "").lower()
                    title = val.get("title", "").lower()
                if query_lower in url or query_lower in title:
                    rec["_collection"] = coll
                    matches.append(rec)
        except:
            pass

    if not matches:
        print(f"no captures matching '{query}'")
        return

    print(f"found {len(matches)} capture(s):")
    for rec in matches:
        val = rec.get("value", {})
        rkey = rec["uri"].split("/")[-1]
        coll = rec["_collection"]
        is_bundle = coll == COLLECTION_BUNDLE

        if is_bundle:
            meta = val.get("systems.witchcraft.archive", {})
            title = val.get("name", meta.get("title", ""))[:60]
            url = meta.get("url", "")
            res_count = meta.get("resourceCount", 0)
            print(f"  [{rkey}] [BUNDLE {res_count} files] {title}")
        else:
            title = val.get("title", "")[:60]
            url = val.get("url", "")
            print(f"  [{rkey}] {title}")
        print(f"    {url}")
        print()


# --- main ---

def main():
    parser = argparse.ArgumentParser(
        description="Archive web pages to ATProto with IPFS pinning and MASL bundles")
    parser.add_argument("url", nargs="?", help="URL to archive")
    parser.add_argument("--bundle", action="store_true",
        help="Archive URL + subresources as MASL bundle")
    parser.add_argument("--list", action="store_true", help="List recent captures")
    parser.add_argument("--limit", type=int, default=20, help="Number of captures to list")
    parser.add_argument("--verify", metavar="RKEY",
        help="Verify a capture's hash against current page")
    parser.add_argument("--search", metavar="QUERY",
        help="Search captures by URL or title")
    parser.add_argument("--no-ipfs", action="store_true",
        help="Skip IPFS pinning (compute CID locally only)")
    parser.add_argument("--no-blob", action="store_true",
        help="Skip PDS blob upload (single mode only)")
    parser.add_argument("--max-resources", type=int, default=MAX_SUBRESOURCES,
        help=f"Max subresources to fetch for bundles (default: {MAX_SUBRESOURCES})")

    args = parser.parse_args()

    if args.list:
        cmd_list(args.limit)
    elif args.verify:
        cmd_verify(args.verify)
    elif args.search:
        cmd_search(args.search)
    elif args.url:
        if args.bundle:
            cmd_bundle(args.url, no_ipfs=args.no_ipfs, max_resources=args.max_resources)
        else:
            cmd_archive(args.url, no_ipfs=args.no_ipfs, no_blob=args.no_blob)
    else:
        parser.print_help()


if __name__ == "__main__":
    main()