import argparse, datetime, hashlib, base64, json, pathlib, time, urllib.request, urllib.error
p=argparse.ArgumentParser();p.add_argument('origin');p.add_argument('side');p.add_argument('commit');p.add_argument('--out',required=True);a=p.parse_args()
out=pathlib.Path(a.out)/ (a.side+'-'+datetime.datetime.now(datetime.timezone.utc).strftime('%Y%m%dT%H%M%SZ'));out.mkdir(parents=True)
start=time.monotonic(); lines=[]; cast=[json.dumps({'version':2,'width':110,'height':55,'timestamp':int(time.time()),'title':'Six HTTPS callbacks: '+a.side,'env':{'TERM':'xterm-256color'}})]
def emit(s):
 print(s,flush=True);time.sleep(0.15);lines.append(s);cast.append(json.dumps([round(time.monotonic()-start,6),'o',s+'\r\n']))
class NoRedirect(urllib.request.HTTPRedirectHandler):
 def redirect_request(self,*args,**kwargs):return None
opener=urllib.request.build_opener(NoRedirect)
def request(path,body=None):
 req=urllib.request.Request(a.origin+path,data=None if body is None else json.dumps(body).encode(),headers={} if body is None else {'Content-Type':'application/json'})
 try:r=opener.open(req)
 except urllib.error.HTTPError as e:r=e
 return r.code,dict(r.headers),r.read().decode()
emit('REAL SERVER HTTP RECORDING | '+a.side.upper());emit('Commit: '+a.commit)
emit('Environment: Linux; isolated fresh database; no copied data; no credentials')
emit('Transport: loopback HTTP; external callbacks are HTTPS; synthetic OAuth client')
metadata={'client_name':'Six Callback Evidence','redirect_uris':['https://callback.example.com/oauth/'+str(i) for i in range(1,7)],'grant_types':['authorization_code'],'response_types':['code'],'token_endpoint_auth_method':'none'}
emit('\n1. POST /oauth/mcp/register');emit('Client: '+metadata['client_name']);emit('Callbacks (same six on both sides):');[emit('  '+u) for u in metadata['redirect_uris']];emit('grant_types=[authorization_code]; response_types=[code]; auth_method=none')
status,headers,body=request('/oauth/mcp/register',metadata);emit('HTTP '+str(status)); data=json.loads(body)
if 'client_id' not in data:emit(json.dumps(data,indent=2));emit('\n2. Authorization cannot start: registration returned no client_id.')
else:
 client=data.pop('client_id');emit('client_id: [returned; signature omitted from public evidence]');emit('Registered callback count: '+str(len(data['redirect_uris'])));emit('token_endpoint_auth_method: '+data['token_endpoint_auth_method'])
 params={'client_id':client,'response_type':'code','redirect_uri':metadata['redirect_uris'][0],'code_challenge':base64.urlsafe_b64encode(hashlib.sha256(b'evidence-verifier-0123456789012345678901234567890123456789').digest()).decode().rstrip('='),'code_challenge_method':'S256','state':'synthetic-evidence','resource':a.origin+'/mcp'}
 import urllib.parse
 emit('\n2. GET /oauth/mcp/authorize (registered callback 1; PKCE S256)')
 code,h,b=request('/oauth/mcp/authorize?'+urllib.parse.urlencode(params));emit('HTTP '+str(code));loc=h.get('location',h.get('Location',''));emit('Location: '+loc.split('?')[0]+'?[OAuth parameters omitted]')
 emit('\n3. POST /oauth/mcp/approval (same authorization parameters; no session)')
 code,h,b=request('/oauth/mcp/approval',params);emit('HTTP '+str(code));result=json.loads(b)
 if 'environmentHost' in result:result['environmentHost']='[isolated loopback server]'
 emit(json.dumps(result,indent=2))
 (out/'private-authorization-url.txt').write_text(a.origin+loc)
emit('\nEnd of recorded HTTP interaction. No Spark account or T3 Connect used.')
(out/'transcript.txt').write_text('\n'.join(lines)+'\n');(out/'recording.cast').write_text('\n'.join(cast)+'\n');print('Saved recording and transcript.',flush=True)