@doubling/compound-sync 1.12.4 → 1.12.6

package/sync.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-
 /**
  * Bidirectional sync between Firestore files and local markdown files.
  * Uses Firebase client SDK with browser-based auth — no gcloud needed.
@@ -15,7 +14,6 @@
  *        node sync.js --version
  *        node sync.js --help
  */
-
 // DOU-208: Node 22+ ships its own CA bundle and does not consult the
 // macOS system trust store. Without NODE_EXTRA_CA_CERTS pointing at
 // /etc/ssl/cert.pem, fetch() to securetoken.googleapis.com fails
@@ -29,39 +27,30 @@
 // or a wrapper explicitly chose a different bundle).
 import { spawnSync as __dou208_spawnSync } from 'node:child_process';
 import { existsSync as __dou208_existsSync } from 'node:fs';
-if (!process.env.NODE_EXTRA_CA_CERTS) {
-  const __dou208_candidates = process.platform === 'darwin'
-    ? ['/etc/ssl/cert.pem']
-    : process.platform === 'linux'
-      ? ['/etc/ssl/certs/ca-certificates.crt', '/etc/pki/tls/certs/ca-bundle.crt']
-      : [];
-  for (const __dou208_candidate of __dou208_candidates) {
-    if (__dou208_existsSync(__dou208_candidate)) {
-      const __dou208_result = __dou208_spawnSync(
-        process.execPath,
-        process.argv.slice(1),
-        {
-          stdio: 'inherit',
-          env: { ...process.env, NODE_EXTRA_CA_CERTS: __dou208_candidate },
-        },
-      );
-      process.exit(__dou208_result.status ?? 1);
+if (!process.env['NODE_EXTRA_CA_CERTS']) {
+    const __dou208_candidates = process.platform === 'darwin'
+        ? ['/etc/ssl/cert.pem']
+        : process.platform === 'linux'
+            ? ['/etc/ssl/certs/ca-certificates.crt', '/etc/pki/tls/certs/ca-bundle.crt']
+            : [];
+    for (const __dou208_candidate of __dou208_candidates) {
+        if (__dou208_existsSync(__dou208_candidate)) {
+            const __dou208_result = __dou208_spawnSync(process.execPath, process.argv.slice(1), {
+                stdio: 'inherit',
+                env: { ...process.env, NODE_EXTRA_CA_CERTS: __dou208_candidate },
+            });
+            process.exit(__dou208_result.status ?? 1);
+        }
     }
-  }
-  // No candidate found (Windows, unusual Linux distro): fall through
-  // and let Node's bundled CA bundle handle TLS. The user can still
-  // set NODE_EXTRA_CA_CERTS manually for corporate cert chains.
+    // No candidate found (Windows, unusual Linux distro): fall through
+    // and let Node's bundled CA bundle handle TLS. The user can still
+    // set NODE_EXTRA_CA_CERTS manually for corporate cert chains.
 }
-
 import { initializeApp } from 'firebase/app';
 import { getAuth, initializeAuth, signInWithEmailAndPassword, signInWithCredential, GoogleAuthProvider } from 'firebase/auth';
-import {
-  getFirestore, collection, doc, getDocs, getDoc, setDoc, addDoc, updateDoc, deleteDoc,
-  query, where, onSnapshot
-} from 'firebase/firestore';
+import { getFirestore, collection, doc, getDocs, getDoc, query, where } from 'firebase/firestore';
 import { getStorage } from 'firebase/storage';
 import { initializeAppCheck, CustomProvider } from 'firebase/app-check';
-import chokidar from 'chokidar';
 import fs from 'fs';
 import path from 'path';
 import readline from 'readline';
@@ -69,99 +58,69 @@ import os from 'os';
 import http from 'http';
 import { exec } from 'child_process';
 import { fileURLToPath } from 'url';
-import {
-  pushFileToCloud,
-  deleteFileFromCloud,
-  pushFolderToCloud,
-  deleteFolderFromCloud,
-  readBlob,
-  readBlobAsText,
-  extFromPath,
-  isTextMimeType,
-  mimeTypeFromExt,
-} from './files.js';
-
 // Max file size enforced before upload. Mirrored in storage.rules.
 const MAX_UPLOAD_BYTES = 25 * 1024 * 1024;
 import { resolveConfigPath, loadConfig, saveConfig } from './config.js';
 import { makeFilePersistence, resolveAuthFilePath } from './auth-persistence.js';
 import { readPersistedRefreshToken, exchangeRefreshTokenForIdToken } from './pre-mint-app-check.js';
 import { setupAuthWithPreMint } from './setup-auth-with-pre-mint.js';
-import {
-  scopeFromLocalPath,
-  teamFolderName,
-  PRIVATE_FOLDER,
-  SHARED_WITH_ME_FOLDER,
-  SHARED_BY_ME_FOLDER,
-} from './paths.js';
-import { TeamRegistry } from './team-registry.js';
 import { startOrgSync } from './org-sync.js';
-
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
-
 // --- Firebase configs (same as the web app) ---
-
 const firebaseConfigs = {
-  'doubling-compound-sandbox': {
-    apiKey: "AIzaSyBnskQNh--bRaRN7tsVFbb01oll8OSdVH8",
-    authDomain: "doubling-compound-sandbox.firebaseapp.com",
-    projectId: "doubling-compound-sandbox",
-    storageBucket: "doubling-compound-sandbox.firebasestorage.app",
-    messagingSenderId: "83118259611",
-    appId: "1:83118259611:web:cf9cda61c9ecdc161b353e"
-  },
-  'doubling-compound-dev': {
-    apiKey: "AIzaSyBPKJqfy77_qmP_x9zOVzoHKuY8PHFCUm0",
-    authDomain: "doubling-compound-dev.firebaseapp.com",
-    projectId: "doubling-compound-dev",
-    storageBucket: "doubling-compound-dev.firebasestorage.app",
-    messagingSenderId: "967509355891",
-    appId: "1:967509355891:web:c253ebdb8205d3ef012906"
-  },
-  'doubling-compound-prod': {
-    apiKey: "AIzaSyDvnPV5dLxzubPE8pwq_S80gMsF8E97LaI",
-    authDomain: "compound.doubling.io",
-    projectId: "doubling-compound-prod",
-    storageBucket: "doubling-compound-prod.firebasestorage.app",
-    messagingSenderId: "831648925388",
-    appId: "1:831648925388:web:87550a55f807f2a2a1a469"
-  }
+    'doubling-compound-sandbox': {
+        apiKey: "AIzaSyBnskQNh--bRaRN7tsVFbb01oll8OSdVH8",
+        authDomain: "doubling-compound-sandbox.firebaseapp.com",
+        projectId: "doubling-compound-sandbox",
+        storageBucket: "doubling-compound-sandbox.firebasestorage.app",
+        messagingSenderId: "83118259611",
+        appId: "1:83118259611:web:cf9cda61c9ecdc161b353e"
+    },
+    'doubling-compound-dev': {
+        apiKey: "AIzaSyBPKJqfy77_qmP_x9zOVzoHKuY8PHFCUm0",
+        authDomain: "doubling-compound-dev.firebaseapp.com",
+        projectId: "doubling-compound-dev",
+        storageBucket: "doubling-compound-dev.firebasestorage.app",
+        messagingSenderId: "967509355891",
+        appId: "1:967509355891:web:c253ebdb8205d3ef012906"
+    },
+    'doubling-compound-prod': {
+        apiKey: "AIzaSyDvnPV5dLxzubPE8pwq_S80gMsF8E97LaI",
+        authDomain: "compound.doubling.io",
+        projectId: "doubling-compound-prod",
+        storageBucket: "doubling-compound-prod.firebasestorage.app",
+        messagingSenderId: "831648925388",
+        appId: "1:831648925388:web:87550a55f807f2a2a1a469"
+    }
 };
-
 // App Check token endpoints per environment
 const appCheckEndpoints = {
-  'doubling-compound-prod': 'https://mintappchecktoken-oaimzbv67a-uc.a.run.app',
-  'doubling-compound-dev': 'https://mintappchecktoken-molg2wq42a-uc.a.run.app',
-  'doubling-compound-sandbox': 'https://mintappchecktoken-pbpkn3igxa-uc.a.run.app',
+    'doubling-compound-prod': 'https://mintappchecktoken-oaimzbv67a-uc.a.run.app',
+    'doubling-compound-dev': 'https://mintappchecktoken-molg2wq42a-uc.a.run.app',
+    'doubling-compound-sandbox': 'https://mintappchecktoken-pbpkn3igxa-uc.a.run.app',
 };
-
 // --- Helpers ---
-
 function ask(question) {
-  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise(resolve => {
-    rl.question(question, answer => {
-      rl.close();
-      resolve(answer.trim());
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    return new Promise((resolve) => {
+        rl.question(question, (answer) => {
+            rl.close();
+            resolve(answer.trim());
+        });
     });
-  });
 }
-
 function expandHome(p) {
-  if (p.startsWith('~/')) return path.join(os.homedir(), p.slice(2));
-  return p;
+    if (p.startsWith('~/'))
+        return path.join(os.homedir(), p.slice(2));
+    return p;
 }
-
 function openBrowser(url) {
-  const cmd = process.platform === 'darwin' ? 'open' :
-    process.platform === 'win32' ? 'start' : 'xdg-open';
-  exec(`${cmd} "${url}"`);
+    const cmd = process.platform === 'darwin' ? 'open' :
+        process.platform === 'win32' ? 'start' : 'xdg-open';
+    exec(`${cmd} "${url}"`);
 }
-
-// --- Browser-based auth ---
-
 function buildLoginPage(fbConfig) {
-  return `<!DOCTYPE html>
+    return `<!DOCTYPE html>
 <html><head><meta charset="utf-8"><title>Compound Sync - Sign In</title>
 <style>
   body { font-family: -apple-system, system-ui, sans-serif; max-width: 400px; margin: 80px auto; text-align: center; }
@@ -258,240 +217,228 @@ window.emailSignIn = async function() {
 </script>
 </body></html>`;
 }
-
 function browserAuth(fbConfig) {
-  return new Promise((resolve, reject) => {
-    const server = http.createServer((req, res) => {
-      if (req.method === 'GET' && req.url === '/login') {
-        res.writeHead(200, { 'Content-Type': 'text/html' });
-        res.end(buildLoginPage(fbConfig));
-        return;
-      }
-
-      if (req.method === 'POST' && req.url === '/auth-callback') {
-        let body = '';
-        req.on('data', chunk => { body += chunk; });
-        req.on('end', () => {
-          res.writeHead(200, { 'Content-Type': 'text/plain' });
-          res.end('OK');
-          server.close();
-          resolve(JSON.parse(body));
+    return new Promise((resolve, reject) => {
+        const server = http.createServer((req, res) => {
+            if (req.method === 'GET' && req.url === '/login') {
+                res.writeHead(200, { 'Content-Type': 'text/html' });
+                res.end(buildLoginPage(fbConfig));
+                return;
+            }
+            if (req.method === 'POST' && req.url === '/auth-callback') {
+                let body = '';
+                req.on('data', (chunk) => { body += chunk; });
+                req.on('end', () => {
+                    res.writeHead(200, { 'Content-Type': 'text/plain' });
+                    res.end('OK');
+                    server.close();
+                    resolve(JSON.parse(body));
+                });
+                return;
+            }
+            res.writeHead(404);
+            res.end('Not found');
+        });
+        server.listen(0, () => {
+            const addr = server.address();
+            // After listen(0) succeeds, address() returns an AddressInfo
+            // object. If we get null (server closed mid-flight) or a string
+            // (unix socket path) something went wrong; fail loudly rather
+            // than hand the user a `http://localhost:0/login` URL that
+            // browsers reject and hangs the auth flow indefinitely.
+            if (typeof addr !== 'object' || !addr) {
+                server.close();
+                reject(new Error(`browserAuth: server.address() returned ${JSON.stringify(addr)}`));
+                return;
+            }
+            const url = `http://localhost:${addr.port}/login`;
+            console.log(`Opening browser for sign-in...`);
+            console.log(`If the browser doesn't open, visit: ${url}`);
+            openBrowser(url);
         });
-        return;
-      }
-
-      res.writeHead(404);
-      res.end('Not found');
-    });
-
-    server.listen(0, () => {
-      const port = server.address().port;
-      const url = `http://localhost:${port}/login`;
-      console.log(`Opening browser for sign-in...`);
-      console.log(`If the browser doesn't open, visit: ${url}`);
-      openBrowser(url);
     });
-  });
 }
-
-// --- Interactive setup ---
-
 async function setupConfig() {
-  console.log('');
-  console.log('Welcome to the Compound sync daemon! Let\'s set things up.');
-  console.log('');
-
-  // Default to prod; --env flag overrides for internal use
-  const projectId = envOverride || 'doubling-compound-prod';
-
-  const fbConfig = firebaseConfigs[projectId];
-
-  // Browser sign-in to discover orgs
-  console.log('');
-  const authResult = await browserAuth(fbConfig);
-  const app = initializeApp(fbConfig, 'setup');
-  const auth = getAuth(app);
-
-  // Initialize App Check before re-authenticating in Node.js
-  const appCheckUrl = appCheckEndpoints[projectId];
-  if (appCheckUrl && authResult.firebaseIdToken) {
-    await initAppCheckWithIdToken(app, appCheckUrl, authResult.firebaseIdToken);
-  }
-
-  const db = getFirestore(app);
-
-  let userCredential;
-  if (authResult.method === 'google') {
-    const credential = GoogleAuthProvider.credential(authResult.idToken, authResult.accessToken);
-    userCredential = await signInWithCredential(auth, credential);
-  } else {
-    userCredential = await signInWithEmailAndPassword(auth, authResult.email, authResult.password);
-  }
-
-  const userId = userCredential.user.uid;
-  const userEmail = userCredential.user.email;
-  console.log(`Signed in as ${userEmail}`);
-
-  // List available orgs for this user
-  console.log('');
-  console.log('Fetching your organizations...');
-  const membersSnapshot = await getDocs(
-    query(collection(db, 'orgMembers'), where('userId', '==', userId))
-  );
-
-  const orgIds = [];
-  membersSnapshot.forEach(doc => {
-    orgIds.push(doc.data().orgId);
-  });
-
-  if (orgIds.length === 0) {
-    console.error('No organizations found for your account.');
-    process.exit(1);
-  }
-
-  const orgs = [];
-  for (const orgId of orgIds) {
-    const orgDoc = await getDoc(doc(db, 'orgs', orgId));
-    if (orgDoc.exists()) {
-      orgs.push({ id: orgDoc.id, ...orgDoc.data() });
+    console.log('');
+    console.log('Welcome to the Compound sync daemon! Let\'s set things up.');
+    console.log('');
+    // Default to prod; --env flag overrides for internal use
+    const projectId = envOverride || 'doubling-compound-prod';
+    const fbConfig = firebaseConfigs[projectId];
+    if (!fbConfig) {
+        console.error(`Unknown project: ${projectId}`);
+        process.exit(1);
     }
-  }
-
-  console.log('');
-  console.log('Your organizations:');
-  orgs.forEach((org, i) => {
-    console.log(`  ${i + 1}. ${org.name}`);
-  });
-  console.log('');
-
-  let selectedIndices;
-  if (orgs.length === 1) {
-    const confirm = await ask(`Use "${orgs[0].name}"? [Y/n]: `) || 'y';
-    if (confirm.toLowerCase() !== 'y') process.exit(0);
-    selectedIndices = [0];
-  } else {
-    const choice = await ask(
-      `Select organizations to sync (e.g. "1,3" or "all") [1-${orgs.length}]: `,
-    );
-    if (choice.toLowerCase() === 'all') {
-      selectedIndices = orgs.map((_, i) => i);
-    } else {
-      selectedIndices = choice
-        .split(',')
-        .map(s => parseInt(s.trim(), 10) - 1)
-        .filter(i => Number.isInteger(i) && i >= 0 && i < orgs.length);
-      if (selectedIndices.length === 0) {
-        console.error('Invalid selection.');
+    // Browser sign-in to discover orgs
+    console.log('');
+    const authResult = await browserAuth(fbConfig);
+    const app = initializeApp(fbConfig, 'setup');
+    const auth = getAuth(app);
+    // Initialize App Check before re-authenticating in Node.js
+    const appCheckUrl = appCheckEndpoints[projectId];
+    if (appCheckUrl && authResult.firebaseIdToken) {
+        await initAppCheckWithIdToken(app, appCheckUrl, authResult.firebaseIdToken);
+    }
+    const db = getFirestore(app);
+    let userCredential;
+    if (authResult.method === 'google') {
+        const credential = GoogleAuthProvider.credential(authResult.idToken, authResult.accessToken);
+        userCredential = await signInWithCredential(auth, credential);
+    }
+    else {
+        userCredential = await signInWithEmailAndPassword(auth, authResult.email, authResult.password);
+    }
+    const userId = userCredential.user.uid;
+    const userEmail = userCredential.user.email;
+    console.log(`Signed in as ${userEmail}`);
+    // List available orgs for this user
+    console.log('');
+    console.log('Fetching your organizations...');
+    const membersSnapshot = await getDocs(query(collection(db, 'orgMembers'), where('userId', '==', userId)));
+    const orgIds = [];
+    membersSnapshot.forEach((d) => {
+        const orgId = d.data()['orgId'];
+        if (typeof orgId === 'string' && orgId)
+            orgIds.push(orgId);
+    });
+    if (orgIds.length === 0) {
+        console.error('No organizations found for your account.');
         process.exit(1);
-      }
     }
-  }
-
-  // Per-org local path
-  const orgEntries = [];
-  for (const idx of selectedIndices) {
-    const org = orgs[idx];
+    const orgs = [];
+    for (const orgId of orgIds) {
+        const orgDoc = await getDoc(doc(db, 'orgs', orgId));
+        if (orgDoc.exists()) {
+            const data = orgDoc.data();
+            const name = data['name'];
+            orgs.push({ id: orgDoc.id, name: typeof name === 'string' ? name : orgDoc.id });
+        }
+    }
     console.log('');
-    const defaultPath = path.join(os.homedir(), org.name + ' Workspace');
-    const localPath = await ask(
-      `Local sync folder for "${org.name}" [${defaultPath}]: `,
-    ) || defaultPath;
-    const resolvedPath = expandHome(localPath);
-
-    if (!fs.existsSync(resolvedPath)) {
-      const create = await ask(`"${resolvedPath}" doesn't exist. Create it? [Y/n]: `) || 'y';
-      if (create.toLowerCase() === 'y') {
-        fs.mkdirSync(resolvedPath, { recursive: true });
-        console.log('Created.');
-      } else {
-        process.exit(0);
-      }
+    console.log('Your organizations:');
+    orgs.forEach((org, i) => {
+        console.log(`  ${i + 1}. ${org.name}`);
+    });
+    console.log('');
+    let selectedIndices;
+    const firstOrg = orgs[0];
+    if (orgs.length === 1 && firstOrg) {
+        const confirm = await ask(`Use "${firstOrg.name}"? [Y/n]: `) || 'y';
+        if (confirm.toLowerCase() !== 'y')
+            process.exit(0);
+        selectedIndices = [0];
     }
-    orgEntries.push({ orgId: org.id, localPath: resolvedPath });
-  }
-
-  // Save config (no credentials stored). saveConfig creates parent dirs
-  // so paths like ~/.config/compound-sync/work.json work without manual mkdir.
-  saveConfig(CONFIG_PATH, { projectId, orgs: orgEntries });
-  console.log('');
-  console.log(`Config saved to ${CONFIG_PATH}`);
-  console.log('');
-
-  return {
-    projectId,
-    orgs: orgEntries,
-    _userId: userId,
-    _app: app,
-    _db: db,
-  };
+    else {
+        const choice = await ask(`Select organizations to sync (e.g. "1,3" or "all") [1-${orgs.length}]: `);
+        if (choice.toLowerCase() === 'all') {
+            selectedIndices = orgs.map((_, i) => i);
+        }
+        else {
+            selectedIndices = choice
+                .split(',')
+                .map((s) => parseInt(s.trim(), 10) - 1)
+                .filter((i) => Number.isInteger(i) && i >= 0 && i < orgs.length);
+            if (selectedIndices.length === 0) {
+                console.error('Invalid selection.');
+                process.exit(1);
+            }
+        }
+    }
+    // Per-org local path
+    const orgEntries = [];
+    for (const idx of selectedIndices) {
+        const org = orgs[idx];
+        if (!org)
+            continue;
+        console.log('');
+        const defaultPath = path.join(os.homedir(), org.name + ' Workspace');
+        const localPath = await ask(`Local sync folder for "${org.name}" [${defaultPath}]: `) || defaultPath;
+        const resolvedPath = expandHome(localPath);
+        if (!fs.existsSync(resolvedPath)) {
+            const create = await ask(`"${resolvedPath}" doesn't exist. Create it? [Y/n]: `) || 'y';
+            if (create.toLowerCase() === 'y') {
+                fs.mkdirSync(resolvedPath, { recursive: true });
+                console.log('Created.');
+            }
+            else {
+                process.exit(0);
+            }
+        }
+        orgEntries.push({ orgId: org.id, localPath: resolvedPath });
+    }
+    // Save config (no credentials stored). saveConfig creates parent dirs
+    // so paths like ~/.config/compound-sync/work.json work without manual mkdir.
+    saveConfig(CONFIG_PATH, { projectId, orgs: orgEntries });
+    console.log('');
+    console.log(`Config saved to ${CONFIG_PATH}`);
+    console.log('');
+    return {
+        projectId,
+        orgs: orgEntries,
+        _userId: userId,
+        _app: app,
+        _db: db,
+    };
 }
-
-// --- App Check (custom provider for CLI) ---
-
 // Fetch an App Check token using a Firebase ID token (before Node.js sign-in)
 async function fetchAppCheckToken(tokenEndpoint, firebaseIdToken) {
-  const response = await fetch(tokenEndpoint, {
-    method: 'POST',
-    headers: {
-      'Authorization': `Bearer ${firebaseIdToken}`,
-      'Content-Type': 'application/json',
-    },
-  });
-
-  if (!response.ok) {
-    const errBody = await response.text().catch(() => '');
-    console.error(`App Check token request failed (${response.status}): ${errBody}`);
-    throw new Error(`App Check token request failed: ${response.status}`);
-  }
-
-  return await response.json();
+    const response = await fetch(tokenEndpoint, {
+        method: 'POST',
+        headers: {
+            'Authorization': `Bearer ${firebaseIdToken}`,
+            'Content-Type': 'application/json',
+        },
+    });
+    if (!response.ok) {
+        const errBody = await response.text().catch(() => '');
+        console.error(`App Check token request failed (${response.status}): ${errBody}`);
+        throw new Error(`App Check token request failed: ${response.status}`);
+    }
+    return await response.json();
 }
-
 // Initialize App Check with a pre-fetched ID token (used on first sign-in)
 async function initAppCheckWithIdToken(app, tokenEndpoint, firebaseIdToken) {
-  console.log('Initializing App Check...');
-  // Pre-fetch the first token
-  const initial = await fetchAppCheckToken(tokenEndpoint, firebaseIdToken);
-  let cachedToken = {
-    token: initial.token,
-    expireTimeMillis: Date.now() + initial.ttlMillis,
-  };
-
-  const customProvider = new CustomProvider({
-    getToken: async () => {
-      // If token is still valid, return cached
-      if (cachedToken.expireTimeMillis > Date.now() + 60000) {
-        return cachedToken;
-      }
-      // Otherwise refresh — at this point the user should be signed in
-      const auth = getAuth(app);
-      const user = auth.currentUser;
-      if (!user) return cachedToken; // fallback
-      const idToken = await user.getIdToken();
-      const refreshed = await fetchAppCheckToken(tokenEndpoint, idToken);
-      cachedToken = {
-        token: refreshed.token,
-        expireTimeMillis: Date.now() + refreshed.ttlMillis,
-      };
-      return cachedToken;
-    },
-  });
-
-  initializeAppCheck(app, {
-    provider: customProvider,
-    isTokenAutoRefreshEnabled: true,
-  });
-  console.log('App Check initialized.');
+    console.log('Initializing App Check...');
+    // Pre-fetch the first token
+    const initial = await fetchAppCheckToken(tokenEndpoint, firebaseIdToken);
+    let cachedToken = {
+        token: initial.token,
+        expireTimeMillis: Date.now() + initial.ttlMillis,
+    };
+    const customProvider = new CustomProvider({
+        getToken: async () => {
+            // If token is still valid, return cached
+            if (cachedToken.expireTimeMillis > Date.now() + 60000) {
+                return cachedToken;
+            }
+            // Otherwise refresh — at this point the user should be signed in
+            const auth = getAuth(app);
+            const user = auth.currentUser;
+            if (!user)
+                return cachedToken; // fallback
+            const idToken = await user.getIdToken();
+            const refreshed = await fetchAppCheckToken(tokenEndpoint, idToken);
+            cachedToken = {
+                token: refreshed.token,
+                expireTimeMillis: Date.now() + refreshed.ttlMillis,
+            };
+            return cachedToken;
+        },
+    });
+    initializeAppCheck(app, {
+        provider: customProvider,
+        isTokenAutoRefreshEnabled: true,
+    });
+    console.log('App Check initialized.');
 }
-
 // Initialize App Check with an already-signed-in user (used during setup reuse)
 async function initAppCheck(app, auth, tokenEndpoint) {
-  const user = auth.currentUser;
-  if (!user) throw new Error('Not signed in');
-  const idToken = await user.getIdToken();
-  await initAppCheckWithIdToken(app, tokenEndpoint, idToken);
+    const user = auth.currentUser;
+    if (!user)
+        throw new Error('Not signed in');
+    const idToken = await user.getIdToken();
+    await initAppCheckWithIdToken(app, tokenEndpoint, idToken);
 }
-
 // --- Non-interactive account discovery (for the desktop app) ---
 //
 // Sign in (restoring a persisted session if present, else via the
@@ -502,97 +449,92 @@ async function initAppCheck(app, auth, tokenEndpoint) {
 // The desktop parses that to register the account and write its
 // per-account config. Exits when done.
 async function discoverOrgs(projectId) {
-  const fbConfig = firebaseConfigs[projectId];
-  if (!fbConfig) {
-    console.error(`Unknown project: ${projectId}`);
-    process.exit(1);
-  }
-
-  // Use the DEFAULT app name (not a named 'discover' app): Firebase
-  // derives its auth-persistence storage key from the app name, and the
-  // daemon reads the default-app key. A named app here would persist
-  // under a different key, so the daemon wouldn't find the session and
-  // would prompt for sign-in a second time. discover exits before the
-  // daemon block runs, so there's no app-name collision.
-  const app = initializeApp(fbConfig);
-  const authFilePath = resolveAuthFilePath({
-    authFileEnv: process.env.COMPOUND_AUTH_FILE,
-    homeDir: os.homedir(),
-    projectId,
-    accountKey: 'discover',
-  });
-  // Pre-mint App Check on the app, THEN initializeAuth. The ordering
-  // matters: see setup-auth-with-pre-mint.js for the call-order
-  // contract and why the 1.9.3 code (initializeAuth before pre-mint)
-  // raced the SDK's startup :lookup and lost.
-  const appCheckUrl = appCheckEndpoints[projectId];
-  const { auth } = await setupAuthWithPreMint(
-    { app, authFilePath, apiKey: fbConfig.apiKey, appCheckUrl },
-    {
-      readPersistedRefreshToken,
-      exchangeRefreshTokenForIdToken,
-      initAppCheckWithIdToken,
-      makeFilePersistence,
-      initializeAuth,
-    },
-  );
-
-  let userId;
-  let userEmail;
-
-  if (auth.currentUser) {
-    userId = auth.currentUser.uid;
-    userEmail = auth.currentUser.email;
-    // App Check is already initialized above when we had a persisted
-    // user; no need to re-init.
-  } else {
-    const authResult = await browserAuth(fbConfig);
-    if (appCheckUrl && authResult.firebaseIdToken) {
-      await initAppCheckWithIdToken(app, appCheckUrl, authResult.firebaseIdToken);
+    const fbConfig = firebaseConfigs[projectId];
+    if (!fbConfig) {
+        console.error(`Unknown project: ${projectId}`);
+        process.exit(1);
     }
-    let cred;
-    if (authResult.method === 'google') {
-      cred = await signInWithCredential(
-        auth,
-        GoogleAuthProvider.credential(authResult.idToken, authResult.accessToken),
-      );
-    } else {
-      cred = await signInWithEmailAndPassword(auth, authResult.email, authResult.password);
+    // Use the DEFAULT app name (not a named 'discover' app): Firebase
+    // derives its auth-persistence storage key from the app name, and the
+    // daemon reads the default-app key. A named app here would persist
+    // under a different key, so the daemon wouldn't find the session and
+    // would prompt for sign-in a second time. discover exits before the
+    // daemon block runs, so there's no app-name collision.
+    const app = initializeApp(fbConfig);
+    const authFilePath = resolveAuthFilePath({
+        authFileEnv: process.env['COMPOUND_AUTH_FILE'],
+        homeDir: os.homedir(),
+        projectId,
+        accountKey: 'discover',
+    });
+    // Pre-mint App Check on the app, THEN initializeAuth. The ordering
+    // matters: see setup-auth-with-pre-mint.js for the call-order
+    // contract and why the 1.9.3 code (initializeAuth before pre-mint)
+    // raced the SDK's startup :lookup and lost.
+    const appCheckUrl = appCheckEndpoints[projectId];
+    const { auth } = await setupAuthWithPreMint({ app, authFilePath, apiKey: fbConfig.apiKey, appCheckUrl }, {
+        readPersistedRefreshToken,
+        exchangeRefreshTokenForIdToken,
+        initAppCheckWithIdToken,
+        makeFilePersistence,
+        initializeAuth,
+    });
+    let userId;
+    let userEmail;
+    if (auth.currentUser) {
+        userId = auth.currentUser.uid;
+        userEmail = auth.currentUser.email;
+        // App Check is already initialized above when we had a persisted
+        // user; no need to re-init.
     }
-    userId = cred.user.uid;
-    userEmail = cred.user.email;
-  }
-
-  const db = getFirestore(app);
-  const snapshot = await getDocs(
-    query(collection(db, 'orgMembers'), where('userId', '==', userId)),
-  );
-  const orgIds = [];
-  snapshot.forEach(d => orgIds.push(d.data().orgId));
-  const orgs = [];
-  for (const orgId of orgIds) {
-    const orgDoc = await getDoc(doc(db, 'orgs', orgId));
-    if (orgDoc.exists()) orgs.push({ id: orgDoc.id, name: orgDoc.data().name });
-  }
-
-  console.log(`COMPOUND_DISCOVER ${JSON.stringify({ userId, email: userEmail, orgs })}`);
-  process.exit(0);
+    else {
+        const authResult = await browserAuth(fbConfig);
+        if (appCheckUrl && authResult.firebaseIdToken) {
+            await initAppCheckWithIdToken(app, appCheckUrl, authResult.firebaseIdToken);
+        }
+        let cred;
+        if (authResult.method === 'google') {
+            cred = await signInWithCredential(auth, GoogleAuthProvider.credential(authResult.idToken, authResult.accessToken));
+        }
+        else {
+            cred = await signInWithEmailAndPassword(auth, authResult.email, authResult.password);
+        }
+        userId = cred.user.uid;
+        userEmail = cred.user.email;
+    }
+    const db = getFirestore(app);
+    const snapshot = await getDocs(query(collection(db, 'orgMembers'), where('userId', '==', userId)));
+    const orgIds = [];
+    snapshot.forEach((d) => {
+        const orgId = d.data()['orgId'];
+        if (typeof orgId === 'string' && orgId)
+            orgIds.push(orgId);
+    });
+    const orgs = [];
+    for (const orgId of orgIds) {
+        const orgDoc = await getDoc(doc(db, 'orgs', orgId));
+        if (orgDoc.exists()) {
+            const name = orgDoc.data()['name'];
+            // Fall back to the org id when the doc has no usable `name`
+            // field; matches setupConfig's behavior and gives the desktop
+            // org picker something to render instead of a blank button.
+            orgs.push({ id: orgDoc.id, name: typeof name === 'string' && name ? name : orgDoc.id });
+        }
+    }
+    console.log(`COMPOUND_DISCOVER ${JSON.stringify({ userId, email: userEmail, orgs })}`);
+    process.exit(0);
 }
-
 // --- Config ---
-
 const args = process.argv.slice(2);
-
 // Handle --version and --help early so they short-circuit before any
 // Firebase init or browser-auth side effects.
 if (args.includes('--version') || args.includes('-v')) {
-  const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, 'package.json'), 'utf-8'));
-  console.log(pkg.version);
-  process.exit(0);
+    const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, 'package.json'), 'utf-8'));
+    console.log(pkg.version);
+    process.exit(0);
 }
-
 if (args.includes('--help') || args.includes('-h')) {
-  console.log(`compound-sync - Doubling Compound sync daemon
+    console.log(`compound-sync - Doubling Compound sync daemon
 
 Usage:
   compound-sync                  Start the daemon (interactive setup on first run)
@@ -603,164 +545,171 @@ Usage:
   compound-sync --help, -h       Print this help and exit
 
 More: https://github.com/Doubling-Inc/doubling-compound`);
-  process.exit(0);
+    process.exit(0);
 }
-
 let configFile = 'config.json';
 let forceSetup = false;
 let envOverride = null;
 let discoverMode = false;
 for (let i = 0; i < args.length; i++) {
-  if (args[i] === '--config' && args[i + 1]) { configFile = args[++i]; }
-  if (args[i] === '--setup') { forceSetup = true; }
-  if (args[i] === '--env' && args[i + 1]) { envOverride = `doubling-compound-${args[++i]}`; }
-  // Non-interactive account discovery for the desktop app: sign in
-  // (persisting credentials to COMPOUND_AUTH_FILE), print the user's
-  // orgs as a COMPOUND_DISCOVER JSON line, and exit. The desktop
-  // parses it to register the account and write its config.
-  if (args[i] === '--discover') { discoverMode = true; }
+    if (args[i] === '--config' && args[i + 1]) {
+        configFile = args[++i];
+    }
+    if (args[i] === '--setup') {
+        forceSetup = true;
+    }
+    if (args[i] === '--env' && args[i + 1]) {
+        envOverride = `doubling-compound-${args[++i]}`;
+    }
+    // Non-interactive account discovery for the desktop app: sign in
+    // (persisting credentials to COMPOUND_AUTH_FILE), print the user's
+    // orgs as a COMPOUND_DISCOVER JSON line, and exit. The desktop
+    // parses it to register the account and write its config.
+    if (args[i] === '--discover') {
+        discoverMode = true;
+    }
 }
-
 if (discoverMode) {
-  await discoverOrgs(envOverride || 'doubling-compound-prod');
-  // discoverOrgs exits the process.
+    await discoverOrgs(envOverride || 'doubling-compound-prod');
+    // discoverOrgs exits the process.
 }
-
 const CONFIG_PATH = resolveConfigPath(configFile, __dirname);
 let config = null;
 if (!forceSetup) {
-  try {
-    config = loadConfig(CONFIG_PATH);
-  } catch (err) {
-    console.error(`Failed to load ${CONFIG_PATH}: ${err.message}`);
-    process.exit(1);
-  }
+    try {
+        config = loadConfig(CONFIG_PATH);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Failed to load ${CONFIG_PATH}: ${msg}`);
+        process.exit(1);
+    }
 }
-
 // Interactive setup if no config exists or --setup was passed
 if (!config) {
-  config = await setupConfig();
+    config = await setupConfig();
 }
-
 // --- Initialize Firebase client SDK ---
-
-let app, db, userId;
-
-if (config._app) {
-  // Reuse app and auth from setup
-  app = config._app;
-  db = config._db;
-  userId = config._userId;
-
-  // Initialize App Check if endpoint exists for this env
-  const appCheckUrl = appCheckEndpoints[config.projectId];
-  if (appCheckUrl) {
-    const auth = getAuth(app);
-    await initAppCheck(app, auth, appCheckUrl);
-  }
-} else {
-  const fbConfig = firebaseConfigs[config.projectId];
-  if (!fbConfig) {
-    console.error(`Unknown project: ${config.projectId}`);
-    process.exit(1);
-  }
-
-  app = initializeApp(fbConfig);
-  db = getFirestore(app);
-
-  // File-backed auth persistence. A previously-signed-in session is
-  // restored here with no browser. The desktop app sets
-  // COMPOUND_AUTH_FILE per account; the CLI derives a per-(project,
-  // account) path under ~/.config/compound-sync. initializeAuth must
-  // run before any getAuth(app) for this app.
-  const authFilePath = resolveAuthFilePath({
-    authFileEnv: process.env.COMPOUND_AUTH_FILE,
-    homeDir: os.homedir(),
-    projectId: config.projectId,
-    accountKey: config.email || config.orgId,
-  });
-  // Pre-mint App Check on the app, THEN initializeAuth. The ordering
-  // matters: see setup-auth-with-pre-mint.js for the call-order
-  // contract and why the 1.9.3 code (initializeAuth before pre-mint)
-  // raced the SDK's startup :lookup and lost.
-  const appCheckUrl = appCheckEndpoints[config.projectId];
-  const { auth, appCheckPreMinted } = await setupAuthWithPreMint(
-    { app, authFilePath, apiKey: fbConfig.apiKey, appCheckUrl },
-    {
-      readPersistedRefreshToken,
-      exchangeRefreshTokenForIdToken,
-      initAppCheckWithIdToken,
-      makeFilePersistence,
-      initializeAuth,
-    },
-  );
-
-  if (auth.currentUser) {
-    // Silent re-auth: session restored from persisted credentials, no
-    // browser. App Check was already pre-minted above when we had a
-    // persisted user, so no need to re-init.
-    userId = auth.currentUser.uid;
-    if (appCheckUrl && !appCheckPreMinted) {
-      // Defensive: persisted user existed but pre-mint failed; still try
-      // to bring App Check up via the current user's ID token so the
-      // rest of the daemon's calls aren't blocked.
-      const idToken = await auth.currentUser.getIdToken();
-      await initAppCheckWithIdToken(app, appCheckUrl, idToken);
+// Type predicate: did setupConfig produce the "hot handles" result
+// (with _app/_db/_userId already initialized), or did we load a
+// vanilla NormalizedConfig from disk?
+function hasHotHandles(c) {
+    return '_app' in c;
+}
+let app;
+let db;
+let userId;
+if (hasHotHandles(config)) {
+    // Reuse app and auth from setup
+    app = config._app;
+    db = config._db;
+    userId = config._userId;
+    // Initialize App Check if endpoint exists for this env
+    const appCheckUrl = appCheckEndpoints[config.projectId];
+    if (appCheckUrl) {
+        const auth = getAuth(app);
+        await initAppCheck(app, auth, appCheckUrl);
     }
-    console.log(`Signed in (silent) as ${auth.currentUser.email || userId}`);
-  } else {
-    // First run for this account: interactive browser sign-in. The
-    // result is persisted, so later launches take the silent path.
-    console.log('');
-    const authResult = await browserAuth(fbConfig);
-
-    // Initialize App Check BEFORE signing in on the Node.js side, using
-    // the Firebase ID token from the browser.
-    if (appCheckUrl && authResult.firebaseIdToken) {
-      await initAppCheckWithIdToken(app, appCheckUrl, authResult.firebaseIdToken);
+}
+else {
+    const fbConfig = firebaseConfigs[config.projectId];
+    if (!fbConfig) {
+        console.error(`Unknown project: ${config.projectId}`);
+        process.exit(1);
     }
-
-    if (authResult.method === 'google') {
-      const credential = GoogleAuthProvider.credential(authResult.idToken, authResult.accessToken);
-      const cred = await signInWithCredential(auth, credential);
-      userId = cred.user.uid;
-      console.log(`Signed in as ${cred.user.email}`);
-    } else {
-      const cred = await signInWithEmailAndPassword(auth, authResult.email, authResult.password);
-      userId = cred.user.uid;
-      console.log(`Signed in as ${cred.user.email}`);
+    app = initializeApp(fbConfig);
+    db = getFirestore(app);
+    // File-backed auth persistence. A previously-signed-in session is
+    // restored here with no browser. The desktop app sets
+    // COMPOUND_AUTH_FILE per account; the CLI derives a per-(project,
+    // account) path under ~/.config/compound-sync. initializeAuth must
+    // run before any getAuth(app) for this app.
+    //
+    // accountKey: use the first org's id as a stable per-config
+    // discriminator. NormalizedConfig drops the legacy top-level `email`
+    // and `orgId` fields, so the prior `config.email || config.orgId`
+    // lookup collapsed to undefined and every CLI config under the same
+    // project collided on the same `<project>__default.json` auth file.
+    // The first org id is always present (normalizeConfig rejects empty
+    // orgs[]) and uniquely identifies a config across the multi-org
+    // schema. The desktop app overrides this entirely via
+    // COMPOUND_AUTH_FILE, so this only matters for the bare CLI path.
+    const accountKey = config.orgs[0]?.orgId;
+    const authFilePath = resolveAuthFilePath({
+        authFileEnv: process.env['COMPOUND_AUTH_FILE'],
+        homeDir: os.homedir(),
+        projectId: config.projectId,
+        accountKey,
+    });
+    // Pre-mint App Check on the app, THEN initializeAuth. The ordering
+    // matters: see setup-auth-with-pre-mint.js for the call-order
+    // contract and why the 1.9.3 code (initializeAuth before pre-mint)
+    // raced the SDK's startup :lookup and lost.
+    const appCheckUrl = appCheckEndpoints[config.projectId];
+    const { auth, appCheckPreMinted } = await setupAuthWithPreMint({ app, authFilePath, apiKey: fbConfig.apiKey, appCheckUrl }, {
+        readPersistedRefreshToken,
+        exchangeRefreshTokenForIdToken,
+        initAppCheckWithIdToken,
+        makeFilePersistence,
+        initializeAuth,
+    });
+    if (auth.currentUser) {
+        // Silent re-auth: session restored from persisted credentials, no
+        // browser. App Check was already pre-minted above when we had a
+        // persisted user, so no need to re-init.
+        userId = auth.currentUser.uid;
+        if (appCheckUrl && !appCheckPreMinted) {
+            // Defensive: persisted user existed but pre-mint failed; still try
+            // to bring App Check up via the current user's ID token so the
+            // rest of the daemon's calls aren't blocked.
+            const idToken = await auth.currentUser.getIdToken();
+            await initAppCheckWithIdToken(app, appCheckUrl, idToken);
+        }
+        console.log(`Signed in (silent) as ${auth.currentUser.email || userId}`);
+    }
+    else {
+        // First run for this account: interactive browser sign-in. The
+        // result is persisted, so later launches take the silent path.
+        console.log('');
+        const authResult = await browserAuth(fbConfig);
+        // Initialize App Check BEFORE signing in on the Node.js side, using
+        // the Firebase ID token from the browser.
+        if (appCheckUrl && authResult.firebaseIdToken) {
+            await initAppCheckWithIdToken(app, appCheckUrl, authResult.firebaseIdToken);
+        }
+        if (authResult.method === 'google') {
+            const credential = GoogleAuthProvider.credential(authResult.idToken, authResult.accessToken);
+            const cred = await signInWithCredential(auth, credential);
+            userId = cred.user.uid;
+            console.log(`Signed in as ${cred.user.email}`);
+        }
+        else {
+            const cred = await signInWithEmailAndPassword(auth, authResult.email, authResult.password);
+            userId = cred.user.uid;
+            console.log(`Signed in as ${cred.user.email}`);
+        }
     }
-  }
-
 }
-
 const USER_ID = userId;
 const storage = getStorage(app);
-
 // Read the bundled package version so the log line confirms which
 // daemon copy is actually running. Saves the "did the rebuild include
 // the fix?" diagnostic round-trip when a desktop bundle is mid-update.
-const __syncPkgVersion = JSON.parse(
-  fs.readFileSync(path.join(__dirname, 'package.json'), 'utf-8'),
-).version;
-
+const __syncPkgVersion = JSON.parse(fs.readFileSync(path.join(__dirname, 'package.json'), 'utf-8')).version;
 console.log(`Sync daemon starting (compound-sync ${__syncPkgVersion})...`);
 console.log(`  Env:      ${config.projectId}`);
 console.log(`  User:     ${USER_ID}`);
 console.log(`  Orgs:     ${config.orgs.length}`);
-
 // Per-org runtime, extracted to ./org-sync.js so it is importable and
 // testable against the emulator (DOU-156). Inject the module-level
 // db / storage / userId here.
 function setupOrgSync({ orgId, localPath }) {
-  return startOrgSync({ db, storage, userId: USER_ID, orgId, localPath: expandHome(localPath) });
+    return startOrgSync({ db, storage, userId: USER_ID, orgId, localPath: expandHome(localPath) });
 }
-
 // --- Main ---
-
 for (const orgEntry of config.orgs) {
-  await setupOrgSync(orgEntry);
+    await setupOrgSync(orgEntry);
 }
-
 console.log('');
 console.log('Sync running. Press Ctrl+C to stop.');
+//# sourceMappingURL=sync.js.map