@doubling/compound-sync 1.7.1 → 1.9.5

package/sync.js

@@ -48,6 +48,8 @@ import {
 const MAX_UPLOAD_BYTES = 25 * 1024 * 1024;
 import { resolveConfigPath, loadConfig, saveConfig } from './config.js';
 import { makeFilePersistence, resolveAuthFilePath } from './auth-persistence.js';
+import { readPersistedRefreshToken, exchangeRefreshTokenForIdToken } from './pre-mint-app-check.js';
+import { setupAuthWithPreMint } from './setup-auth-with-pre-mint.js';
 import {
   scopeFromLocalPath,
   teamFolderName,
@@ -56,6 +58,7 @@ import {
   SHARED_BY_ME_FOLDER,
 } from './paths.js';
 import { TeamRegistry } from './team-registry.js';
+import { startOrgSync } from './org-sync.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
@@ -452,6 +455,93 @@ async function initAppCheck(app, auth, tokenEndpoint) {
   await initAppCheckWithIdToken(app, tokenEndpoint, idToken);
 }
 
+// --- Non-interactive account discovery (for the desktop app) ---
+//
+// Sign in (restoring a persisted session if present, else via the
+// browser handoff), persisting credentials to COMPOUND_AUTH_FILE so
+// later launches are silent, then list the user's orgs and print a
+// single machine-readable line:
+//   COMPOUND_DISCOVER {"userId":..,"email":..,"orgs":[{"id":..,"name":..}]}
+// The desktop parses that to register the account and write its
+// per-account config. Exits when done.
+async function discoverOrgs(projectId) {
+  const fbConfig = firebaseConfigs[projectId];
+  if (!fbConfig) {
+    console.error(`Unknown project: ${projectId}`);
+    process.exit(1);
+  }
+
+  // Use the DEFAULT app name (not a named 'discover' app): Firebase
+  // derives its auth-persistence storage key from the app name, and the
+  // daemon reads the default-app key. A named app here would persist
+  // under a different key, so the daemon wouldn't find the session and
+  // would prompt for sign-in a second time. discover exits before the
+  // daemon block runs, so there's no app-name collision.
+  const app = initializeApp(fbConfig);
+  const authFilePath = resolveAuthFilePath({
+    authFileEnv: process.env.COMPOUND_AUTH_FILE,
+    homeDir: os.homedir(),
+    projectId,
+    accountKey: 'discover',
+  });
+  // Pre-mint App Check on the app, THEN initializeAuth. The ordering
+  // matters: see setup-auth-with-pre-mint.js for the call-order
+  // contract and why the 1.9.3 code (initializeAuth before pre-mint)
+  // raced the SDK's startup :lookup and lost.
+  const appCheckUrl = appCheckEndpoints[projectId];
+  const { auth } = await setupAuthWithPreMint(
+    { app, authFilePath, apiKey: fbConfig.apiKey, appCheckUrl },
+    {
+      readPersistedRefreshToken,
+      exchangeRefreshTokenForIdToken,
+      initAppCheckWithIdToken,
+      makeFilePersistence,
+      initializeAuth,
+    },
+  );
+
+  let userId;
+  let userEmail;
+
+  if (auth.currentUser) {
+    userId = auth.currentUser.uid;
+    userEmail = auth.currentUser.email;
+    // App Check is already initialized above when we had a persisted
+    // user; no need to re-init.
+  } else {
+    const authResult = await browserAuth(fbConfig);
+    if (appCheckUrl && authResult.firebaseIdToken) {
+      await initAppCheckWithIdToken(app, appCheckUrl, authResult.firebaseIdToken);
+    }
+    let cred;
+    if (authResult.method === 'google') {
+      cred = await signInWithCredential(
+        auth,
+        GoogleAuthProvider.credential(authResult.idToken, authResult.accessToken),
+      );
+    } else {
+      cred = await signInWithEmailAndPassword(auth, authResult.email, authResult.password);
+    }
+    userId = cred.user.uid;
+    userEmail = cred.user.email;
+  }
+
+  const db = getFirestore(app);
+  const snapshot = await getDocs(
+    query(collection(db, 'orgMembers'), where('userId', '==', userId)),
+  );
+  const orgIds = [];
+  snapshot.forEach(d => orgIds.push(d.data().orgId));
+  const orgs = [];
+  for (const orgId of orgIds) {
+    const orgDoc = await getDoc(doc(db, 'orgs', orgId));
+    if (orgDoc.exists()) orgs.push({ id: orgDoc.id, name: orgDoc.data().name });
+  }
+
+  console.log(`COMPOUND_DISCOVER ${JSON.stringify({ userId, email: userEmail, orgs })}`);
+  process.exit(0);
+}
+
 // --- Config ---
 
 const args = process.argv.slice(2);
@@ -482,10 +572,21 @@ More: https://github.com/Doubling-Inc/doubling-compound`);
 let configFile = 'config.json';
 let forceSetup = false;
 let envOverride = null;
+let discoverMode = false;
 for (let i = 0; i < args.length; i++) {
   if (args[i] === '--config' && args[i + 1]) { configFile = args[++i]; }
   if (args[i] === '--setup') { forceSetup = true; }
   if (args[i] === '--env' && args[i + 1]) { envOverride = `doubling-compound-${args[++i]}`; }
+  // Non-interactive account discovery for the desktop app: sign in
+  // (persisting credentials to COMPOUND_AUTH_FILE), print the user's
+  // orgs as a COMPOUND_DISCOVER JSON line, and exit. The desktop
+  // parses it to register the account and write its config.
+  if (args[i] === '--discover') { discoverMode = true; }
+}
+
+if (discoverMode) {
+  await discoverOrgs(envOverride || 'doubling-compound-prod');
+  // discoverOrgs exits the process.
 }
 
 const CONFIG_PATH = resolveConfigPath(configFile, __dirname);
@@ -541,18 +642,31 @@ if (config._app) {
     projectId: config.projectId,
     accountKey: config.email || config.orgId,
   });
-  const auth = initializeAuth(app, { persistence: makeFilePersistence(authFilePath) });
-  await auth.authStateReady();
-
+  // Pre-mint App Check on the app, THEN initializeAuth. The ordering
+  // matters: see setup-auth-with-pre-mint.js for the call-order
+  // contract and why the 1.9.3 code (initializeAuth before pre-mint)
+  // raced the SDK's startup :lookup and lost.
   const appCheckUrl = appCheckEndpoints[config.projectId];
+  const { auth, appCheckPreMinted } = await setupAuthWithPreMint(
+    { app, authFilePath, apiKey: fbConfig.apiKey, appCheckUrl },
+    {
+      readPersistedRefreshToken,
+      exchangeRefreshTokenForIdToken,
+      initAppCheckWithIdToken,
+      makeFilePersistence,
+      initializeAuth,
+    },
+  );
 
   if (auth.currentUser) {
     // Silent re-auth: session restored from persisted credentials, no
-    // browser. App Check (custom provider) mints its token from a
-    // fresh ID token, which the refresh-token flow obtains without a
-    // browser.
+    // browser. App Check was already pre-minted above when we had a
+    // persisted user, so no need to re-init.
     userId = auth.currentUser.uid;
-    if (appCheckUrl) {
+    if (appCheckUrl && !appCheckPreMinted) {
+      // Defensive: persisted user existed but pre-mint failed; still try
+      // to bring App Check up via the current user's ID token so the
+      // rest of the daemon's calls aren't blocked.
       const idToken = await auth.currentUser.getIdToken();
       await initAppCheckWithIdToken(app, appCheckUrl, idToken);
     }
@@ -586,466 +700,23 @@ if (config._app) {
 const USER_ID = userId;
 const storage = getStorage(app);
 
-console.log(`Sync daemon starting...`);
+// Read the bundled package version so the log line confirms which
+// daemon copy is actually running. Saves the "did the rebuild include
+// the fix?" diagnostic round-trip when a desktop bundle is mid-update.
+const __syncPkgVersion = JSON.parse(
+  fs.readFileSync(path.join(__dirname, 'package.json'), 'utf-8'),
+).version;
+
+console.log(`Sync daemon starting (compound-sync ${__syncPkgVersion})...`);
 console.log(`  Env:      ${config.projectId}`);
 console.log(`  User:     ${USER_ID}`);
 console.log(`  Orgs:     ${config.orgs.length}`);
 
-// Per-org runtime: each org gets its own closure with isolated state
-// (LOCAL_PATH, filesRef, teams map, debounce sets, watcher, listeners).
-// This keeps two orgs' sync logic from interfering with each other.
-async function setupOrgSync({ orgId, localPath: rawLocalPath }) {
-  const LOCAL_PATH = expandHome(rawLocalPath);
-  const filesRef = collection(db, `orgs/${orgId}/files`);
-
-  const lastKnownUpdate = new Map();
-  const suppressLocal = new Set();
-  // Per-team Firestore-listener unsubscribe handles, keyed by teamId.
-  // The TeamRegistry's onSetup populates this; onTeardown calls and
-  // drops the entry so a removed teamspace stops pulling files.
-  const teamUnsubscribers = new Map();
-  // Hoisted forward-decl: setupTeam closes over handleFirestoreChange,
-  // which is defined later in this function. Wired below.
-  let setupTeam = () => {};
-  function teardownTeam(teamId, teamData) {
-    const unsub = teamUnsubscribers.get(teamId);
-    if (unsub) {
-      try { unsub(); } catch (e) { /* ignore */ }
-      teamUnsubscribers.delete(teamId);
-      const folder = teamData && teamData.name ? teamFolderName(teamData.name) : teamId;
-      console.log(`  [${orgId}]   Stopped listening: ${folder}`);
-    }
-  }
-  const teamRegistry = new TeamRegistry({
-    onSetup: (teamId, teamData) => setupTeam(teamId, teamData),
-    onTeardown: teardownTeam,
-  });
-  // scopeFromLocalPath expects a Map<teamName, teamId>; the registry
-  // exposes one matching that shape.
-  const teamIdsByName = teamRegistry.teamIdsByName;
-
-  console.log('');
-  console.log(`  [${orgId}] Local: ${LOCAL_PATH}`);
-
-  function ensureDir(filePath) {
-    const dir = path.dirname(filePath);
-    if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
-  }
-
-  function updateSharedByMeSymlink(fileDoc, realPath) {
-    const sharedWith = fileDoc.sharedWith || [];
-    const symlinkPath = path.join(LOCAL_PATH, SHARED_BY_ME_FOLDER, fileDoc.path);
-
-    if (sharedWith.length > 0) {
-      ensureDir(symlinkPath);
-      const relativeTo = path.relative(path.dirname(symlinkPath), realPath);
-      try {
-        if (fs.existsSync(symlinkPath) || fs.lstatSync(symlinkPath).isSymbolicLink()) {
-          fs.unlinkSync(symlinkPath);
-        }
-      } catch (e) { /* doesn't exist */ }
-      try {
-        fs.symlinkSync(relativeTo, symlinkPath);
-        console.log(`  [${orgId}] [symlink] ${fileDoc.path} → Shared by Me/`);
-      } catch (e) {
-        if (e.code !== 'EEXIST') console.error(`  [${orgId}] Symlink error: ${e.message}`);
-      }
-    } else {
-      try {
-        if (fs.lstatSync(symlinkPath).isSymbolicLink()) {
-          fs.unlinkSync(symlinkPath);
-          console.log(`  [${orgId}] [symlink] removed Shared by Me/${fileDoc.path}`);
-        }
-      } catch (e) { /* doesn't exist */ }
-    }
-  }
-
-  // Static (user-level) folders. Team folders are created per-team by
-  // setupTeam below as soon as the registry sees each teamspace.
-  function ensureFolderStructure() {
-    const privatePath = path.join(LOCAL_PATH, PRIVATE_FOLDER);
-    if (!fs.existsSync(privatePath)) fs.mkdirSync(privatePath, { recursive: true });
-
-    const sharedWithMePath = path.join(LOCAL_PATH, SHARED_WITH_ME_FOLDER);
-    if (!fs.existsSync(sharedWithMePath)) fs.mkdirSync(sharedWithMePath, { recursive: true });
-
-    const sharedByMePath = path.join(LOCAL_PATH, SHARED_BY_ME_FOLDER);
-    if (!fs.existsSync(sharedByMePath)) fs.mkdirSync(sharedByMePath, { recursive: true });
-  }
-
-  ensureFolderStructure();
-
-  async function handleFirestoreChange(change, getLocalPath) {
-    const data = change.doc.data();
-    const docPath = data.path;
-    if (!docPath) return;
-
-    const localFilePath = getLocalPath(data);
-    const trackingKey = `${data.scope || 'team'}:${docPath}`;
-    const isFolder = data.type === 'folder';
-
-    if (change.type === 'removed') {
-      if (isFolder) {
-        // Best-effort directory removal. The daemon's own file-delete
-        // events should have cleared all children by the time we get
-        // here; if not, rmdirSync throws ENOTEMPTY and we keep the
-        // directory rather than risk losing data the user hasn't seen.
-        try {
-          suppressLocal.add(localFilePath);
-          fs.rmdirSync(localFilePath);
-          console.log(`  [${orgId}] [firestore → local] RMDIR ${docPath}`);
-          setTimeout(() => suppressLocal.delete(localFilePath), 1000);
-        } catch (err) {
-          suppressLocal.delete(localFilePath);
-          if (err.code !== 'ENOENT' && err.code !== 'ENOTEMPTY') {
-            console.error(`  [${orgId}] [firestore → local] RMDIR ${docPath} failed: ${err.message}`);
-          }
-        }
-      } else if (fs.existsSync(localFilePath)) {
-        console.log(`  [${orgId}] [firestore → local] DELETE ${docPath}`);
-        suppressLocal.add(localFilePath);
-        fs.unlinkSync(localFilePath);
-        setTimeout(() => suppressLocal.delete(localFilePath), 1000);
-      }
-      lastKnownUpdate.delete(trackingKey);
-      return;
-    }
-
-    const remoteUpdated = data.updatedAt || data.createdAt || '';
-    const lastKnown = lastKnownUpdate.get(trackingKey);
-    if (lastKnown && lastKnown >= remoteUpdated) return;
-
-    if (isFolder) {
-      // Folder docs mirror to a local directory. No blob, no content
-      // comparison; if the directory doesn't exist yet, create it.
-      if (!fs.existsSync(localFilePath)) {
-        suppressLocal.add(localFilePath);
-        fs.mkdirSync(localFilePath, { recursive: true });
-        console.log(`  [${orgId}] [firestore → local] MKDIR ${docPath}`);
-        setTimeout(() => suppressLocal.delete(localFilePath), 1000);
-      }
-      lastKnownUpdate.set(trackingKey, remoteUpdated);
-      return;
-    }
-
-    if (fs.existsSync(localFilePath)) {
-      const localMtime = fs.statSync(localFilePath).mtime.toISOString();
-      if (localMtime > remoteUpdated) return;
-    }
-
-    const action = change.type === 'added' ? 'CREATE' : 'UPDATE';
-    console.log(`  [${orgId}] [firestore → local] ${action} ${docPath} (${data.scope || 'team'})`);
-    ensureDir(localFilePath);
-    suppressLocal.add(localFilePath);
-
-    const ext = extFromPath(docPath);
-    if (isTextMimeType(data.mimeType)) {
-      const content = await readBlobAsText({
-        storage,
-        orgId,
-        fileId: change.doc.id,
-        ext,
-      });
-      fs.writeFileSync(localFilePath, content || '', 'utf-8');
-    } else {
-      const bytes = await readBlob({
-        storage,
-        orgId,
-        fileId: change.doc.id,
-        ext,
-      });
-      fs.writeFileSync(localFilePath, bytes);
-    }
-    lastKnownUpdate.set(trackingKey, remoteUpdated);
-    setTimeout(() => suppressLocal.delete(localFilePath), 1000);
-  }
-
-  // Set up per-team resources: mkdir the local folder, register the
-  // Firestore listener for that team's files. Wired into the
-  // TeamRegistry; called once per teamspace as it appears.
-  setupTeam = (teamId, teamData) => {
-    const teamFolder = teamFolderName(teamData.name);
-    const teamPath = path.join(LOCAL_PATH, teamFolder);
-    if (!fs.existsSync(teamPath)) fs.mkdirSync(teamPath, { recursive: true });
-
-    const q = query(filesRef, where('scope', '==', 'team'), where('teamId', '==', teamId));
-    const unsubscribe = onSnapshot(q, snapshot => {
-      snapshot.docChanges().forEach(change => {
-        handleFirestoreChange(change, data =>
-          path.join(LOCAL_PATH, teamFolder, data.path),
-        ).catch(err => console.error(`  [${orgId}] Firestore change handler error:`, err && err.message));
-      });
-    }, err => console.error(`  [${orgId}] Team "${teamFolder}" listener error:`, err));
-
-    teamUnsubscribers.set(teamId, unsubscribe);
-    console.log(`  [${orgId}]   Listening: ${teamFolder}`);
-  };
-
-  // Live listener on the teams collection. Initial snapshot bootstraps
-  // the known teamspaces; subsequent changes pick up new/renamed/
-  // removed teamspaces without restarting the daemon. We await the
-  // first snapshot so the local watcher sees a populated teamIdsByName
-  // before it tries to route any addDir/add events.
-  await new Promise((resolve, reject) => {
-    let firstSnapshotResolved = false;
-    onSnapshot(collection(db, `orgs/${orgId}/teams`), (snapshot) => {
-      snapshot.docChanges().forEach((change) => {
-        teamRegistry.applyChange({
-          type: change.type,
-          id: change.doc.id,
-          data: change.doc.data(),
-        });
-      });
-      if (!firstSnapshotResolved) {
-        firstSnapshotResolved = true;
-        console.log(`  [${orgId}] Teams: ${teamRegistry.names().join(', ') || 'none'}`);
-        resolve();
-      }
-    }, (err) => {
-      console.error(`  [${orgId}] Teams listener error:`, err);
-      if (!firstSnapshotResolved) {
-        firstSnapshotResolved = true;
-        reject(err);
-      }
-    });
-  });
-
-  function startFirestoreListeners() {
-    console.log(`  [${orgId}] Starting Firestore listeners...`);
-
-    if (USER_ID) {
-      const privateQ = query(filesRef, where('scope', '==', 'private'), where('ownerId', '==', USER_ID));
-      onSnapshot(privateQ, snapshot => {
-        snapshot.docChanges().forEach(change => {
-          const data = change.doc.data();
-          const realPath = path.join(LOCAL_PATH, PRIVATE_FOLDER, data.path);
-
-          handleFirestoreChange(change, () => realPath)
-            .catch(err => console.error(`  [${orgId}] Firestore change handler error:`, err && err.message));
-
-          if (change.type !== 'removed') {
-            updateSharedByMeSymlink(data, realPath);
-          } else {
-            const symlinkPath = path.join(LOCAL_PATH, SHARED_BY_ME_FOLDER, data.path);
-            try { fs.lstatSync(symlinkPath); fs.unlinkSync(symlinkPath); } catch (e) { /* ok */ }
-          }
-        });
-      }, err => console.error(`  [${orgId}] Private files listener error:`, err));
-      console.log(`  [${orgId}]   Listening: Private files + Shared by Me symlinks`);
-
-      // scope=='private' is required: Firestore rules only grant
-      // sharedWith-based reads on private files, so the query must
-      // constrain scope or the whole listen is denied (rules are not
-      // filters). See tests/rules.test.js "shared-with-me query".
-      const sharedQ = query(
-        filesRef,
-        where('scope', '==', 'private'),
-        where('sharedWith', 'array-contains', USER_ID),
-      );
-      onSnapshot(sharedQ, snapshot => {
-        snapshot.docChanges().forEach(change => {
-          const data = change.doc.data();
-          if (data.ownerId === USER_ID) return;
-          handleFirestoreChange(change, () =>
-            path.join(LOCAL_PATH, SHARED_WITH_ME_FOLDER, data.path),
-          ).catch(err => console.error(`  [${orgId}] Firestore change handler error:`, err && err.message));
-        });
-      }, err => console.error(`  [${orgId}] Shared with me listener error:`, err));
-      console.log(`  [${orgId}]   Listening: Shared with Me`);
-    }
-  }
-
-  async function pushToFirestore(filePath, data, mimeType) {
-    const { scope, teamId, docPath } = scopeFromLocalPath(filePath, LOCAL_PATH, teamIdsByName);
-    const trackingKey = `${scope}:${docPath}`;
-    const now = new Date().toISOString();
-    lastKnownUpdate.set(trackingKey, now);
-
-    const result = await pushFileToCloud({
-      filesRef,
-      storage,
-      orgId,
-      userId: USER_ID,
-      scope,
-      teamId,
-      docPath,
-      data,
-      mimeType,
-      now,
-    });
-
-    if (result.action === 'created') {
-      console.log(`  [${orgId}] [local → firestore] CREATE ${docPath} (${scope}, ${mimeType})`);
-    } else if (result.action === 'updated') {
-      console.log(`  [${orgId}] [local → firestore] UPDATE ${docPath} (${scope})`);
-    }
-    if (result.storageError) {
-      console.error(`  [${orgId}] [storage] upload failed for ${docPath}: ${result.storageError.message}`);
-    }
-  }
-
-  async function deleteFromFirestore(filePath) {
-    const { scope, teamId, docPath } = scopeFromLocalPath(filePath, LOCAL_PATH, teamIdsByName);
-    const trackingKey = `${scope}:${docPath}`;
-    lastKnownUpdate.delete(trackingKey);
-
-    const result = await deleteFileFromCloud({
-      filesRef,
-      storage,
-      orgId,
-      userId: USER_ID,
-      scope,
-      teamId,
-      docPath,
-    });
-
-    if (result.action === 'deleted') {
-      console.log(`  [${orgId}] [local → firestore] DELETE ${docPath} (${scope})`);
-    }
-  }
-
-  // Determine whether a local path corresponds to a syncable directory.
-  // Excludes the scope-root directories themselves (Private, Shared
-  // with Me, Shared by Me, and the per-team roots) since those are
-  // managed by ensureFolderStructure, not the user.
-  function isSyncableLocalDir(rel) {
-    if (!rel) return false;
-    if (rel === PRIVATE_FOLDER || rel === SHARED_WITH_ME_FOLDER || rel === SHARED_BY_ME_FOLDER) {
-      return false;
-    }
-    if (rel.startsWith(SHARED_WITH_ME_FOLDER + path.sep)) return false;
-    if (rel.startsWith(SHARED_BY_ME_FOLDER + path.sep)) return false;
-    const parts = rel.split(path.sep);
-    // A bare team root (e.g. "Engineering Teamspace") corresponds to
-    // the scope root, not a subdirectory. Skip these.
-    if (parts.length === 1 && parts[0].endsWith(' Teamspace')) return false;
-    return true;
-  }
-
-  async function pushDirToFirestore(dirPath) {
-    const { scope, teamId, docPath } = scopeFromLocalPath(dirPath, LOCAL_PATH, teamIdsByName);
-    if (!docPath) return; // scope root
-    const trackingKey = `${scope}:${docPath}`;
-    const now = new Date().toISOString();
-    lastKnownUpdate.set(trackingKey, now);
-
-    const result = await pushFolderToCloud({
-      filesRef,
-      scope,
-      teamId,
-      userId: USER_ID,
-      docPath,
-      now,
-    });
-
-    if (result.action === 'ensured' && result.folderId) {
-      console.log(`  [${orgId}] [local → firestore] FOLDER ${docPath} (${scope})`);
-    }
-  }
-
-  async function deleteDirFromFirestore(dirPath) {
-    const { scope, teamId, docPath } = scopeFromLocalPath(dirPath, LOCAL_PATH, teamIdsByName);
-    if (!docPath) return;
-    const trackingKey = `${scope}:${docPath}`;
-    lastKnownUpdate.delete(trackingKey);
-
-    const result = await deleteFolderFromCloud({
-      filesRef,
-      scope,
-      teamId,
-      userId: USER_ID,
-      docPath,
-    });
-
-    if (result.action === 'deleted') {
-      console.log(`  [${orgId}] [local → firestore] RMFOLDER ${docPath} (${scope})`);
-    }
-  }
-
-  function handleLocalChange(filePath) {
-    if (suppressLocal.has(filePath)) return;
-
-    const rel = path.relative(LOCAL_PATH, filePath);
-    if (rel.startsWith(SHARED_WITH_ME_FOLDER + path.sep)) return;
-    if (rel.startsWith(SHARED_BY_ME_FOLDER + path.sep)) return;
-
-    let stat;
-    try {
-      stat = fs.statSync(filePath);
-    } catch (err) {
-      return; // disappeared between event and read
-    }
-    if (!stat.isFile()) return;
-    if (stat.size > MAX_UPLOAD_BYTES) {
-      console.error(`  [${orgId}] [skip] ${rel} exceeds ${MAX_UPLOAD_BYTES} byte cap (${stat.size} bytes)`);
-      return;
-    }
-
-    const ext = extFromPath(rel);
-    const mimeType = mimeTypeFromExt(ext);
-    // Text files: read as a UTF-8 string so future text-aware features
-    // (line-level diffing, conflict markers) can work. Binary files:
-    // read as a Buffer so bytes round-trip without corruption.
-    const data = isTextMimeType(mimeType)
-      ? fs.readFileSync(filePath, 'utf-8')
-      : fs.readFileSync(filePath);
-    pushToFirestore(filePath, data, mimeType).catch(err =>
-      console.error(`  [${orgId}] Push error: ${err.message}`)
-    );
-  }
-
-  function handleLocalDirAdded(dirPath) {
-    if (suppressLocal.has(dirPath)) return;
-    const rel = path.relative(LOCAL_PATH, dirPath);
-    if (!isSyncableLocalDir(rel)) return;
-    pushDirToFirestore(dirPath).catch(err =>
-      console.error(`  [${orgId}] Folder push error for ${rel}: ${err.message}`)
-    );
-  }
-
-  function handleLocalDirRemoved(dirPath) {
-    if (suppressLocal.has(dirPath)) return;
-    const rel = path.relative(LOCAL_PATH, dirPath);
-    if (!isSyncableLocalDir(rel)) return;
-    deleteDirFromFirestore(dirPath).catch(err =>
-      console.error(`  [${orgId}] Folder delete error for ${rel}: ${err.message}`)
-    );
-  }
-
-  function startLocalWatcher() {
-    console.log(`  [${orgId}] Watching local files...`);
-
-    const watcher = chokidar.watch(LOCAL_PATH, {
-      ignored: [
-        /(^|[\/\\])\./,
-        /node_modules/,
-        /\.csv$/,
-        /\.py$/,
-        /index\.html$/,
-      ],
-      persistent: true,
-      ignoreInitial: false,
-      followSymlinks: false,
-      awaitWriteFinish: {
-        stabilityThreshold: 500,
-        pollInterval: 100,
-      },
-    });
-
-    watcher.on('add', filePath => handleLocalChange(filePath));
-    watcher.on('change', filePath => handleLocalChange(filePath));
-    watcher.on('unlink', filePath => {
-      if (suppressLocal.has(filePath)) return;
-      deleteFromFirestore(filePath).catch(err => console.error(`  [${orgId}] Delete error: ${err.message}`));
-    });
-    watcher.on('addDir', dirPath => handleLocalDirAdded(dirPath));
-    watcher.on('unlinkDir', dirPath => handleLocalDirRemoved(dirPath));
-
-    watcher.on('ready', () => console.log(`  [${orgId}] Local watcher ready.`));
-  }
-
-  startFirestoreListeners();
-  startLocalWatcher();
+// Per-org runtime, extracted to ./org-sync.js so it is importable and
+// testable against the emulator (DOU-156). Inject the module-level
+// db / storage / userId here.
+function setupOrgSync({ orgId, localPath }) {
+  return startOrgSync({ db, storage, userId: USER_ID, orgId, localPath: expandHome(localPath) });
 }
 
 // --- Main ---