Pairing

import { randomBytes, createHash } from "node:crypto";
import { readFile } from "node:fs/promises";
import { homedir } from "node:os";

const b64url = (b: Buffer) =>
  b.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");

// Step 1. Keep the verifier in memory until the exchange. Never log it.
const verifier = b64url(randomBytes(32));
const challenge = b64url(createHash("sha256").update(verifier).digest());

// Step 2. Open the deep link. The parameters are on the URL scheme page.
const params = new URLSearchParams({
  client: "My Editor on macbook-pro",
  challenge,
  redirect: "http://127.0.0.1:7391/callback",
  scopes: "readWrite",
});
await openUrl(`tablepro://integrations/pair?${params}`); // however your host opens a URL

// Step 3. Your callback receives ?code=<uuid>, or ?error=denied when the user says no.
export async function exchange(code: string): Promise<string> {
  const handshakePath = `${homedir()}/Library/Application Support/TablePro/mcp-handshake.json`;
  const { port } = JSON.parse(await readFile(handshakePath, "utf8"));

  const res = await fetch(`http://127.0.0.1:${port}/v1/integrations/exchange`, {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ code, code_verifier: verifier }),
  });
  if (!res.ok) throw new Error(`pairing failed: ${res.status}`);

  const { token } = await res.json();
  return token; // Step 4. Straight into the Keychain, never a plain file.
}