"""Private bootstrap: URL PAIRING_CREDENTIAL AUTH_OUTPUT. Never publish its inputs/output."""
import urllib.request,urllib.parse,json,hashlib,base64,sys,re,http.cookiejar,os
base=sys.argv[1]; token=sys.argv[2]
session=None
jar=http.cookiejar.CookieJar(); op=urllib.request.build_opener(urllib.request.HTTPCookieProcessor(jar))
def req(path,data,auth=None,form=False):
 global session
 b=urllib.parse.urlencode(data).encode() if form else json.dumps(data).encode()
 h={'Content-Type':'application/x-www-form-urlencoded' if form else 'application/json','Accept':'application/json, text/event-stream'}
 if session:h['MCP-Session-Id']=session
 if auth:h['Authorization']='Bearer '+auth
 try:
  with op.open(urllib.request.Request(base+path,b,h)) as r:
   session=r.headers.get('MCP-Session-Id',session)
   t=r.read().decode(); return json.loads(t) if not t.startswith('event:') else json.loads(next(x[6:] for x in t.splitlines() if x.startswith('data: ')))
 except urllib.error.HTTPError as e: raise Exception(str(e.code)+' '+e.read().decode())
req('/api/auth/browser-session',{'credential':token})
pair=req('/api/auth/pairing-token',{'access':'full-access','label':'Evidence client'})
redirect='http://127.0.0.1:12345/callback'; verifier='evidence-verifier-'+'x'*48
reg=req('/oauth/mcp/register',{'client_name':'Evidence client','redirect_uris':[redirect]})
a={'response_type':'code','client_id':reg['client_id'],'redirect_uri':redirect,'code_challenge':base64.urlsafe_b64encode(hashlib.sha256(verifier.encode()).digest()).decode().rstrip('='),'code_challenge_method':'S256','resource':base+'/mcp'}
d=req('/oauth/mcp/decision',{'authorization':a,'decision':{'_tag':'pairing-code','access':'full-access','code':pair['credential']}})
code=urllib.parse.parse_qs(urllib.parse.urlparse(d['redirectTo']).query)['code'][0]
t=req('/oauth/mcp/token',{'grant_type':'authorization_code','code':code,'client_id':reg['client_id'],'redirect_uri':redirect,'code_verifier':verifier,'resource':base+'/mcp'},form=True)
auth=t['access_token']
open(sys.argv[3],'w').write(auth)