@batalabs/virlow-mcp-core 3.116.1 → 3.117.0

package/dist/cjs/notes.js

@@ -7,6 +7,7 @@ const attrs_js_1 = require("./attrs.js");
 const attrs_extract_js_1 = require("./attrs-extract.js");
 const entity_registry_js_1 = require("./entity-registry.js");
 const vault_js_1 = require("./vault.js");
+const keyring_js_1 = require("./keyring.js");
 /** Hard ceiling on how many notes searchNotes() will decrypt+scan in a
  * single call. Keeps a single search bounded even for very large accounts;
  * `truncated` tells the caller when the account holds more than this. Also
@@ -222,10 +223,14 @@ class NotesService {
      * the same pre-edit row and the second write would silently clobber the
      * first's change. Mirrors MemoryStore's enqueue()/mutationChain pattern. */
     mutationChain = Promise.resolve();
-    constructor(api, vault) {
+    /** Opens shared workspaces' keys for this unlock. Public so the attachment
+     * service built next to this one shares it rather than opening them twice. */
+    keyring;
+    constructor(api, vault, keyring) {
         this.api = api;
         this.vault = vault;
         this.vault.onLock = () => this.handleLock();
+        this.keyring = keyring ?? new keyring_js_1.WorkspaceKeyring(api, vault);
     }
     handleLock() {
         this.decryptCache.clear();
@@ -252,18 +257,22 @@ class NotesService {
         const notHidden = notes.filter((row) => row.hidden !== true && !isSystemNote(row));
         // Folders the user has not opened to AI tools are filtered here rather
         // than at the API, so the count of what was withheld can be reported.
-        const visible = notHidden.filter((row) => exposure.allows(row.folderId) && !(0, exposure_js_1.isSharedNote)(row));
+        const exposed = notHidden.filter((row) => exposure.allows(row.folderId));
         const withheld = {
             inClosedFolders: notHidden.filter((row) => row.folderId !== null && !exposure.allows(row.folderId)).length,
             unfiled: notHidden.filter((row) => row.folderId === null).length,
         };
-        const shared = notHidden.filter((row) => exposure.allows(row.folderId) && (0, exposure_js_1.isSharedNote)(row)).length;
+        // A note in a shared workspace whose key does not open here is left out
+        // and counted, never opened with the account key.
+        const keyed = await Promise.all(exposed.map(async (row) => ({ row, rowKey: await this.keyForRowOrNull(key, row, exposure) })));
+        const visible = keyed.filter((entry) => entry.rowKey !== null);
+        const shared = keyed.length - visible.length;
         // Only when there are any, so the usual case reads exactly as before.
         if (shared > 0)
             Object.assign(withheld, { shared });
-        const mapped = await Promise.all(visible.map(async (row) => {
+        const mapped = await Promise.all(visible.map(async ({ row, rowKey }) => {
             // One note that cannot be decrypted here must not fail the whole page.
-            const title = await this.decryptRow(key, row).then((fields) => fields.title, () => '(cannot be opened here)');
+            const title = await this.decryptRow(rowKey, row).then((fields) => fields.title, () => '(cannot be opened here)');
             return {
                 id: row.id,
                 title,
@@ -305,19 +314,23 @@ class NotesService {
         });
         const exposure = await this.exposure();
         const notHidden = notes.filter((row) => row.hidden !== true && !isSystemNote(row));
-        const visible = notHidden.filter((row) => exposure.allows(row.folderId) && !(0, exposure_js_1.isSharedNote)(row));
+        const exposed = notHidden.filter((row) => exposure.allows(row.folderId));
         const withheld = {
-            inClosedFolders: notHidden.length - visible.length,
+            inClosedFolders: notHidden.length - exposed.length,
         };
-        const rows = await Promise.all(visible.map(async (row) => {
-            const attrs = await this.decodeAttrsFor(key, row);
+        const keyed = await Promise.all(exposed.map(async (row) => ({ row, rowKey: await this.keyForRowOrNull(key, row, exposure) })));
+        const visible = keyed.filter((entry) => entry.rowKey !== null);
+        if (keyed.length > visible.length)
+            withheld.shared = keyed.length - visible.length;
+        const rows = await Promise.all(visible.map(async ({ row, rowKey }) => {
+            const attrs = await this.decodeAttrsFor(rowKey, row);
             const values = {};
             for (const def of defs) {
                 values[def.id] = (0, attrs_js_1.formatProp)(def, attrs?.props?.[def.id]);
             }
             return {
                 id: row.id,
-                title: await this.decryptTitleFor(key, row),
+                title: await this.decryptTitleFor(rowKey, row),
                 values,
             };
         }));
@@ -351,10 +364,9 @@ class NotesService {
         // not read this folder, and knowing the id does not change that.
         const exposure = await this.exposure();
         this.requireExposed(exposure, row.folderId, id);
-        if ((0, exposure_js_1.isSharedNote)(row))
-            throw (0, exposure_js_1.sharedNoteError)(id);
-        const { title, content } = await this.decryptRow(key, row);
-        const attrs = await this.decodeAttrsFor(key, row);
+        const rowKey = await this.keyForRowOrThrow(key, row, exposure);
+        const { title, content } = await this.decryptRow(rowKey, row);
+        const attrs = await this.decodeAttrsFor(rowKey, row);
         return { id: row.id, title, content, folderId: row.folderId, attrs };
     }
     async createNote(title, content, folderId, type) {
@@ -362,8 +374,15 @@ class NotesService {
         // Same guard as updateNote(): captured before the encrypt await so a
         // lock landing mid-create is caught before the write, not after.
         const startEpoch = this.epoch;
+        // A note made in a shared workspace is under the workspace's current key,
+        // as the API requires; everywhere else under the account key.
+        let choice = { key, keyVersion: null, ownerId: null };
+        if (folderId) {
+            const { folders } = await this.api.listFolders();
+            choice = await this.keyring.forWrite(key, (await this.exposureOf(folders)).workspaceOf(folderId));
+        }
         const salt = (0, virlow_crypto_1.bytesToBase64)(crypto.getRandomValues(new Uint8Array(32)));
-        const { encryptedTitle, encryptedContent, iv } = await (0, virlow_crypto_1.encryptNoteFields)(key, title, content);
+        const { encryptedTitle, encryptedContent, iv } = await (0, virlow_crypto_1.encryptNoteFields)(choice.key, title, content);
         if (this.epoch !== startEpoch) {
             throw lockedError();
         }
@@ -379,6 +398,8 @@ class NotesService {
             body.folderId = folderId;
         if (type !== undefined)
             body.type = type;
+        if (choice.keyVersion !== null)
+            body.keyVersion = choice.keyVersion;
         const row = await this.api.createNote(body);
         this.invalidateVisibleRows();
         return { id: row.id };
@@ -396,12 +417,11 @@ class NotesService {
             }
             const exposure = await this.exposure();
             this.requireExposed(exposure, existingRow.folderId, id);
-            if ((0, exposure_js_1.isSharedNote)(existingRow))
-                throw (0, exposure_js_1.sharedNoteError)(id);
-            const current = await this.decryptRow(key, existingRow);
+            const rowKey = await this.keyForRowOrThrow(key, existingRow, exposure);
+            const current = await this.decryptRow(rowKey, existingRow);
             const title = changes.title ?? current.title;
             const content = changes.content ?? current.content;
-            const prevAttrs = (await this.decodeAttrsFor(key, existingRow)) ?? (0, attrs_js_1.emptyAttrs)();
+            const prevAttrs = (await this.decodeAttrsFor(rowKey, existingRow)) ?? (0, attrs_js_1.emptyAttrs)();
             const props = { ...prevAttrs.props };
             for (const [propKey, value] of Object.entries(changes.props ?? {})) {
                 if (value === null) {
@@ -428,24 +448,18 @@ class NotesService {
                 updated: new Date().toISOString(),
                 ...(changes.aliases !== undefined ? { aliases: changes.aliases } : {}),
             };
-            const encryptedAttrs = await this.encodeAttrsChecked(key, attrs, id);
             // A props-or-aliases-only edit leaves the body exactly as it was, so it
             // sends only the attrs blob. Re-encrypting the unchanged title and
             // content would rewrite the row's ciphertext (and its IV and salt) for
             // no reason: pure work, a bigger request, a pointless revision, and one
             // more chance for an unrelated failure to corrupt a body nobody asked
-            // to change.
-            const body = { encryptedAttrs };
-            if (changes.title !== undefined || changes.content !== undefined) {
-                const salt = (0, virlow_crypto_1.bytesToBase64)(crypto.getRandomValues(new Uint8Array(32)));
-                const { encryptedTitle, encryptedContent, iv } = await (0, virlow_crypto_1.encryptNoteFields)(key, title, content);
-                body.title = '[ENCRYPTED]';
-                body.content = '[ENCRYPTED]';
-                body.encryptedTitle = encryptedTitle;
-                body.encryptedContent = encryptedContent;
-                body.iv = iv;
-                body.salt = salt;
-            }
+            // to change. The exception is a shared note under an older key version:
+            // see sealNoteWrite().
+            const body = await this.sealNoteWrite(key, existingRow, exposure, {
+                attrs,
+                body: changes.title !== undefined || changes.content !== undefined ? { title, content } : undefined,
+                current,
+            });
             if (this.epoch !== startEpoch) {
                 throw lockedError();
             }
@@ -468,14 +482,19 @@ class NotesService {
     async backlinks(id) {
         const key = this.requireSession();
         const startEpoch = this.epoch;
-        const rows = await this.listVisibleRows();
+        const exposure = await this.exposure();
+        const rows = await this.listVisibleRows(exposure);
         const result = [];
         for (const row of rows) {
             if (row.id === id)
                 continue;
-            const attrs = await this.decodeAttrsFor(key, row);
+            // A shared note whose key does not open here is not a source.
+            const rowKey = await this.keyForRowOrNull(key, row, exposure);
+            if (rowKey === null)
+                continue;
+            const attrs = await this.decodeAttrsFor(rowKey, row);
             if (attrs?.links.includes(id)) {
-                result.push({ id: row.id, title: await this.decryptTitleFor(key, row) });
+                result.push({ id: row.id, title: await this.decryptTitleFor(rowKey, row) });
             }
         }
         if (this.epoch !== startEpoch) {
@@ -531,10 +550,7 @@ class NotesService {
                 ...schema,
                 home: { ...schema.home, widgets: stamped, previous: kept },
             };
-            const encryptedSchema = await this.encodeSchemaChecked(key, next, folderId);
-            if (this.epoch !== startEpoch)
-                throw lockedError();
-            await this.api.updateFolder(folderId, { encryptedSchema });
+            await this.writeSchema(key, folder, next, startEpoch);
             return stamped;
         });
     }
@@ -576,10 +592,7 @@ class NotesService {
             if (created === undefined) {
                 throw new Error(`Could not define property "${name}" in folder ${folderId}.`);
             }
-            const encryptedSchema = await this.encodeSchemaChecked(key, next, folderId);
-            if (this.epoch !== startEpoch)
-                throw lockedError();
-            await this.api.updateFolder(folderId, { encryptedSchema });
+            await this.writeSchema(key, folder, next, startEpoch);
             return created;
         });
     }
@@ -611,10 +624,9 @@ class NotesService {
             }
             const row = await this.api.getNote(noteId);
             const { folders } = await this.api.listFolders();
-            const exposure = this.exposureOf(folders);
+            const exposure = await this.exposureOf(folders);
             this.requireExposed(exposure, row.folderId, noteId);
-            if ((0, exposure_js_1.isSharedNote)(row))
-                throw (0, exposure_js_1.sharedNoteError)(noteId);
+            const rowKey = await this.keyForRowOrThrow(key, row, exposure);
             const folder = folders.find((f) => f.id === row.folderId);
             if (folder === undefined) {
                 // Narrowing: requireExposed() above only passes for a folder that is
@@ -627,7 +639,7 @@ class NotesService {
             // The attrs blob is built and size-checked before anything is written,
             // so a note whose properties would not fit never costs the folder an
             // orphan option.
-            const prevAttrs = (await this.decodeAttrsFor(key, row)) ?? (0, attrs_js_1.emptyAttrs)();
+            const prevAttrs = (await this.decodeAttrsFor(rowKey, row)) ?? (0, attrs_js_1.emptyAttrs)();
             const props = { ...prevAttrs.props };
             for (const [propId, value] of Object.entries(patch)) {
                 if (value === null) {
@@ -640,7 +652,10 @@ class NotesService {
             // `v` and every unknown field come from prevAttrs, so a blob written by
             // a newer client survives this round trip (see updateNote()).
             const attrs = { ...prevAttrs, props, updated: new Date().toISOString() };
-            const encryptedAttrs = await this.encodeAttrsChecked(key, attrs, noteId);
+            const body = await this.sealNoteWrite(key, row, exposure, {
+                attrs,
+                current: () => this.decryptRow(rowKey, row),
+            });
             if (newOptions.size > 0) {
                 let nextSchema = schema;
                 for (const [defId, added] of newOptions) {
@@ -649,14 +664,11 @@ class NotesService {
                         options: [...(def?.options ?? []), ...added],
                     });
                 }
-                const encryptedSchema = await this.encodeSchemaChecked(key, nextSchema, folder.id);
-                if (this.epoch !== startEpoch)
-                    throw lockedError();
-                await this.api.updateFolder(folder.id, { encryptedSchema });
+                await this.writeSchema(key, folder, nextSchema, startEpoch);
             }
             if (this.epoch !== startEpoch)
                 throw lockedError();
-            await this.api.updateNote(noteId, { encryptedAttrs });
+            await this.api.updateNote(noteId, body);
             this.invalidateVisibleRows();
             return { attrs, applied };
         });
@@ -678,13 +690,17 @@ class NotesService {
             for (const row of notes) {
                 if (row.hidden === true || isSystemNote(row))
                     continue;
-                if (!exposure.allows(row.folderId) || (0, exposure_js_1.isSharedNote)(row))
+                if (!exposure.allows(row.folderId))
                     continue;
                 if (scanned >= exports.SEARCH_SCAN_CAP)
                     break scan;
                 scanned++;
-                // A note that cannot be decrypted here is skipped, not fatal to the search.
-                const fields = await this.decryptRow(key, row).catch(() => null);
+                // A note that cannot be decrypted here (a shared note whose key does
+                // not open, a corrupt row) is skipped, not fatal to the search.
+                const rowKey = await this.keyForRowOrNull(key, row, exposure);
+                if (rowKey === null)
+                    continue;
+                const fields = await this.decryptRow(rowKey, row).catch(() => null);
                 if (fields === null)
                     continue;
                 const { title, content } = fields;
@@ -716,11 +732,16 @@ class NotesService {
         // exempt from the destination check: root is never exposed either way,
         // so it can only ever reduce what's visible, never leak it.
         this.requireExposed(exposure, existingRow.folderId, id);
-        if ((0, exposure_js_1.isSharedNote)(existingRow))
-            throw (0, exposure_js_1.sharedNoteError)(id);
         if (folderId !== null) {
             this.requireExposed(exposure, folderId, id);
         }
+        // In or out of a shared workspace, or between two, changes which key the
+        // note is under; the API refuses it, and only the app's sharing flow
+        // re-encrypts. Said here, before the request, in words that name it.
+        if (this.workspaceOfRow(existingRow, exposure) !== exposure.workspaceOf(folderId)) {
+            throw new Error(`Note ${id} cannot be moved in or out of a shared workspace here: that changes its encryption. ` +
+                'Use Move to workspace in the Virlow app.');
+        }
         await this.api.updateNote(id, { folderId });
         this.invalidateVisibleRows();
     }
@@ -729,8 +750,6 @@ class NotesService {
         const existingRow = await this.api.getNote(id);
         const exposure = await this.exposure();
         this.requireExposed(exposure, existingRow.folderId, id);
-        if ((0, exposure_js_1.isSharedNote)(existingRow))
-            throw (0, exposure_js_1.sharedNoteError)(id);
         await this.api.updateNote(id, { starred });
         this.invalidateVisibleRows();
     }
@@ -739,8 +758,6 @@ class NotesService {
         const existingRow = await this.api.getNote(id);
         const exposure = await this.exposure();
         this.requireExposed(exposure, existingRow.folderId, id);
-        if ((0, exposure_js_1.isSharedNote)(existingRow))
-            throw (0, exposure_js_1.sharedNoteError)(id);
         await this.api.updateNote(id, { archived });
         this.invalidateVisibleRows();
     }
@@ -749,20 +766,18 @@ class NotesService {
         const existingRow = await this.api.getNote(id);
         const exposure = await this.exposure();
         this.requireExposed(exposure, existingRow.folderId, id);
-        if ((0, exposure_js_1.isSharedNote)(existingRow))
-            throw (0, exposure_js_1.sharedNoteError)(id);
         await this.api.updateNote(id, { deleted: true });
         this.invalidateVisibleRows();
     }
     async listFolders() {
-        this.requireSession();
+        const key = this.requireSession();
         const { folders } = await this.api.listFolders();
-        const exposure = (0, exposure_js_1.computeExposure)(folders);
+        const exposure = await this.exposureOf(folders);
         const visible = folders.filter((f) => exposure.allows(f.id));
         return {
             // Names are withheld along with contents: a folder the user has not
             // opened should not be inventoried either, only counted.
-            folders: visible.map((f) => ({ id: f.id, name: f.name, parentId: f.parentId })),
+            folders: await Promise.all(visible.map(async (f) => ({ id: f.id, name: await this.folderName(key, f), parentId: f.parentId }))),
             withheld: folders.length - visible.length,
         };
     }
@@ -773,10 +788,19 @@ class NotesService {
         const { folders } = await this.api.listFolders();
         return this.exposureOf(folders);
     }
+    /** Who is unlocked: the account whose consent the exposure rule asks for. */
+    viewerId() {
+        return this.vault.session.userId;
+    }
     /** The same computation for a caller that already has the folder list and
      * needs a folder out of it as well as the exposure (the property tools do:
      * a folder's schema and its exposure come from the same row). */
-    exposureOf(folders) {
+    async exposureOf(folders) {
+        // A folder in a shared workspace someone else owns is open only by this
+        // member's own switch, never the row's shared one (exposure.ts,
+        // isForeignFolder); that needs to know who owns each workspace.
+        const viewerId = this.viewerId();
+        const workspaceOwners = await this.keyring.workspaceOwners(folders);
         // Everything computeExposure() actually reads, in list order. Any change
         // to it changes which notes are visible, so it invalidates the paged row
         // cache keyed on this string. The key travels on the exposure object
@@ -784,9 +808,16 @@ class NotesService {
         // and a field would let the second one's key be stamped onto rows the
         // first one filtered under a different exposure.
         const key = folders
-            .map((f) => `${f.id}/${f.parentId ?? ''}/${f.mcpEnabled ? 1 : 0}/${f.kind ?? ''}`)
+            .map((f) => `${f.id}/${f.parentId ?? ''}/${f.mcpEnabled ? 1 : 0}/${f.mcpEnabledForMember ? 1 : 0}/${f.kind ?? ''}` +
+            `/${f.userId ?? ''}/${f.workspaceId ?? ''}/${f.workspaceId ? (workspaceOwners.get(f.workspaceId) ?? '') : ''}`)
             .join('|');
-        return { ...(0, exposure_js_1.computeExposure)(folders), key };
+        const workspaces = new Map(folders.map((f) => [f.id, f.workspaceId ?? null]));
+        return {
+            ...(0, exposure_js_1.computeExposure)(folders, { viewerId, workspaceOwners }),
+            key: `${viewerId}#${key}`,
+            workspaceOf: (folderId) => (folderId === null ? null : (workspaces.get(folderId) ?? null)),
+            hasFolder: (folderId) => workspaces.has(folderId),
+        };
     }
     /** Throws unless `folderId` is exposed to MCP. Every method that reads or
      * mutates a specific note (by id) must call this — knowing a note's id is
@@ -797,10 +828,184 @@ class NotesService {
         }
     }
     async createFolder(name, parentId) {
-        this.requireSession();
+        const key = this.requireSession();
+        const startEpoch = this.epoch;
+        if (parentId) {
+            // Inside a shared workspace a folder's name is under the workspace key;
+            // the server only ever sees the placeholder.
+            const { folders } = await this.api.listFolders();
+            const parent = folders.find((f) => f.id === parentId);
+            const workspaceId = parent?.workspaceId ?? null;
+            if (workspaceId) {
+                const choice = await this.keyring.forWrite(key, workspaceId, { atLeast: parent?.keyVersion ?? null });
+                if (choice.keyVersion === null)
+                    throw new Error('A shared workspace folder needs its workspace key.');
+                const encryptedName = await (0, virlow_crypto_1.encryptStringBlob)(choice.key, name);
+                if (this.epoch !== startEpoch)
+                    throw lockedError();
+                const folder = await this.api.createFolder('[ENCRYPTED]', parentId, undefined, {
+                    encryptedName,
+                    keyVersion: choice.keyVersion,
+                });
+                return { id: folder.id };
+            }
+        }
         const folder = await this.api.createFolder(name, parentId);
         return { id: folder.id };
     }
+    /** A folder's name as the person sees it: a shared folder's is under the
+     * workspace key (its `name` column only says "[ENCRYPTED]"). One that does
+     * not open is called what the app calls it. */
+    async folderName(accountKey, folder) {
+        if (folder.keyVersion === null || folder.keyVersion === undefined || !folder.encryptedName) {
+            return folder.name;
+        }
+        try {
+            return await (0, virlow_crypto_1.decryptStringBlob)(await this.keyForFolder(accountKey, folder), folder.encryptedName);
+        }
+        catch {
+            return 'Shared workspace';
+        }
+    }
+    /** The shared workspace a note is in: from its own folder field when the
+     * server sent one, else from the folder list. Null for a personal note. */
+    workspaceOfRow(row, exposure) {
+        const listed = exposure.workspaceOf(row.folderId);
+        const sent = row.folder?.workspaceId;
+        // The note's own folder field and the folder list come from the same
+        // server and must agree. One that disagrees is what pointing a note at
+        // another workspace's key would look like, so the note is not opened.
+        if (sent !== undefined &&
+            row.folderId !== null &&
+            exposure.hasFolder(row.folderId) &&
+            (sent ?? null) !== listed) {
+            throw new Error(`Note ${row.id}: the server gave two different workspaces for it, so it was not opened. ` +
+                'Open it in the Virlow app.');
+        }
+        return sent ?? listed;
+    }
+    /** The key a note's ciphertext is under: the account key for a personal
+     * note, the workspace key at the note's version for a shared one. Throws
+     * when a shared note's key does not open; never falls back. */
+    keyForRowOrThrow(accountKey, row, exposure) {
+        if (!(0, exposure_js_1.isSharedNote)(row))
+            return Promise.resolve(accountKey);
+        return Promise.resolve()
+            .then(() => this.keyring.forRead(accountKey, row.keyVersion, this.workspaceOfRow(row, exposure)))
+            .catch((err) => {
+            if (err instanceof vault_js_1.LockedError)
+                throw err;
+            throw (0, exposure_js_1.sharedNoteError)(row.id, err);
+        });
+    }
+    /** The same, as null instead of a throw, for scans that skip what they
+     * cannot open. A lock is not a note that cannot be opened: it propagates,
+     * so a scan cut short by one fails rather than reporting skipped notes. */
+    keyForRowOrNull(accountKey, row, exposure) {
+        return this.keyForRowOrThrow(accountKey, row, exposure).catch((err) => {
+            if (err instanceof vault_js_1.LockedError)
+                throw err;
+            return null;
+        });
+    }
+    /** The key a folder's name and schema are under. */
+    keyForFolder(accountKey, folder) {
+        if (folder.keyVersion === null || folder.keyVersion === undefined)
+            return Promise.resolve(accountKey);
+        return this.keyring.forRead(accountKey, folder.keyVersion, folder.workspaceId);
+    }
+    /**
+     * The ciphertext half of a note write: attrs, plus title and content when
+     * they changed, all under the key the note's place uses now (a shared
+     * workspace's current version, with that version sent along) and never the
+     * account key for a note in a shared workspace.
+     *
+     * The row has one key version for all of its ciphertext, and the API sets it
+     * from the write. So when the version changes (a rotation since the note was
+     * last saved, or a note the owner's sharing run has not reached yet), the
+     * unchanged title and content are re-encrypted as well; sending only the
+     * attrs would leave them under a key the row no longer names.
+     */
+    async sealNoteWrite(accountKey, row, exposure, input) {
+        const workspaceId = this.workspaceOfRow(row, exposure);
+        if ((0, exposure_js_1.isSharedNote)(row) && !workspaceId) {
+            throw (0, exposure_js_1.sharedNoteError)(row.id, new keyring_js_1.NoWorkspaceKeyError());
+        }
+        // Never under an older version than the row already is (a rollback).
+        const choice = await this.keyring
+            .forWrite(accountKey, workspaceId, { atLeast: row.keyVersion ?? null })
+            .catch((err) => {
+            // Only fixed text reaches the caller (see describeKeyFailure).
+            if (err instanceof vault_js_1.LockedError || err instanceof keyring_js_1.WriteRefusedError || !workspaceId)
+                throw err;
+            throw (0, exposure_js_1.sharedNoteError)(row.id, err);
+        });
+        if ((0, exposure_js_1.isSharedNote)(row) && (choice.keyVersion === null || choice.key === accountKey)) {
+            // Unreachable through forWrite(); kept so no future path can do it.
+            throw new Error(`Note ${row.id} is in a shared workspace and is never written with the account key.`);
+        }
+        if (!(0, exposure_js_1.isSharedNote)(row) && choice.keyVersion !== null) {
+            this.requireOwnedForRekey(choice, `Note ${row.id}`);
+        }
+        const body = {
+            encryptedAttrs: await this.encodeAttrsChecked(choice.key, input.attrs, row.id),
+        };
+        const rekey = choice.keyVersion !== (row.keyVersion ?? null);
+        const fields = input.body ??
+            (rekey ? (typeof input.current === 'function' ? await input.current() : input.current) : undefined);
+        if (fields !== undefined) {
+            const salt = (0, virlow_crypto_1.bytesToBase64)(crypto.getRandomValues(new Uint8Array(32)));
+            const { encryptedTitle, encryptedContent, iv } = await (0, virlow_crypto_1.encryptNoteFields)(choice.key, fields.title, fields.content);
+            body.title = '[ENCRYPTED]';
+            body.content = '[ENCRYPTED]';
+            body.encryptedTitle = encryptedTitle;
+            body.encryptedContent = encryptedContent;
+            body.iv = iv;
+            body.salt = salt;
+        }
+        if (choice.keyVersion !== null)
+            body.keyVersion = choice.keyVersion;
+        return body;
+    }
+    /**
+     * Moving ciphertext from the account key to a workspace key is what the
+     * owner's sharing run does. For anyone else, a server that says a personal
+     * row is now in a workspace could otherwise have it re-encrypted under a key
+     * that server handed out, so it is refused unless this account owns the
+     * workspace.
+     */
+    requireOwnedForRekey(choice, what) {
+        if (choice.ownerId !== this.viewerId()) {
+            throw new Error(`${what} is still under your own key but the server places it in a shared workspace you do not own, ` +
+                'so it was not re-encrypted. Open it in the Virlow app.');
+        }
+    }
+    /**
+     * Writes a folder's schema under the key its place uses now. In a shared
+     * workspace the folder's name shares the row's key version, so a folder
+     * still under an older version has its name re-encrypted in the same write.
+     */
+    async writeSchema(accountKey, folder, schema, startEpoch) {
+        const choice = await this.keyring.forWrite(accountKey, folder.workspaceId ?? null, {
+            atLeast: folder.keyVersion ?? null,
+        });
+        if (choice.keyVersion !== null && (folder.keyVersion ?? null) === null && (folder.encryptedSchema || folder.encryptedName)) {
+            this.requireOwnedForRekey(choice, `Folder ${folder.id}`);
+        }
+        const update = {
+            encryptedSchema: await this.encodeSchemaChecked(choice.key, schema, folder.id),
+        };
+        if (choice.keyVersion !== null) {
+            update.keyVersion = choice.keyVersion;
+            if (folder.encryptedName && folder.keyVersion !== choice.keyVersion) {
+                const name = await (0, virlow_crypto_1.decryptStringBlob)(await this.keyForFolder(accountKey, folder), folder.encryptedName);
+                update.encryptedName = await (0, virlow_crypto_1.encryptStringBlob)(choice.key, name);
+            }
+        }
+        if (this.epoch !== startEpoch)
+            throw lockedError();
+        await this.api.updateFolder(folder.id, update);
+    }
     /** Decrypt (with per-unlock caching) or pass through a legacy plaintext
      * row. Legacy rows (no encryptedTitle) carry their real content directly
      * in the plaintext title/content columns. */
@@ -884,7 +1089,7 @@ class NotesService {
                 // get_backlinks and the web disagreed about the same vault.
                 if (row.archived === true)
                     continue;
-                if (!exp.allows(row.folderId) || (0, exposure_js_1.isSharedNote)(row))
+                if (!exp.allows(row.folderId))
                     continue;
                 rows.push(row);
                 if (rows.length >= exports.SEARCH_SCAN_CAP) {
@@ -918,13 +1123,17 @@ class NotesService {
         for (const row of rows) {
             if (row.id === excludeId)
                 continue;
-            // Mentions are best effort: a note that cannot be decrypted here is left
-            // out rather than failing the save that asked for them.
-            const title = await this.decryptTitleFor(key, row).catch(() => null);
+            // Mentions are best effort: a note that cannot be decrypted here (a
+            // shared note whose key does not open, a corrupt row) is left out
+            // rather than failing the save that asked for them.
+            const rowKey = await this.keyForRowOrNull(key, row, exposure);
+            if (rowKey === null)
+                continue;
+            const title = await this.decryptTitleFor(rowKey, row).catch(() => null);
             if (title === null)
                 continue;
             entries.push({ id: row.id, title });
-            const attrs = await this.decodeAttrsFor(key, row).catch(() => null);
+            const attrs = await this.decodeAttrsFor(rowKey, row).catch(() => null);
             for (const alias of attrs?.aliases ?? []) {
                 entries.push({ id: row.id, title: alias });
             }
@@ -940,7 +1149,7 @@ class NotesService {
         if (folder === undefined) {
             throw new Error(`There is no folder ${folderId}. Run list_folders to see the folders exposed to MCP.`);
         }
-        if (!this.exposureOf(folders).allows(folder.id)) {
+        if (!(await this.exposureOf(folders)).allows(folder.id)) {
             throw new Error(`Folder ${folderId} is not exposed to MCP. Turn on "Expose to MCP" in that folder's ` +
                 'settings in the Virlow app to access it here.');
         }
@@ -949,7 +1158,7 @@ class NotesService {
     /** Decode (with per-unlock caching) a folder's property definitions. A
      * folder that has never had any decodes to an empty schema rather than
      * null, so every caller can treat the two the same way. */
-    async decodeSchemaFor(key, folder) {
+    async decodeSchemaFor(accountKey, folder) {
         if (!folder.encryptedSchema)
             return (0, attrs_js_1.emptySchema)();
         const cacheKey = `${folder.id}:${folder.encryptedSchema}`;
@@ -957,6 +1166,15 @@ class NotesService {
         if (cached)
             return cached;
         const startEpoch = this.epoch;
+        // A shared folder's schema is under its workspace's key. One that does
+        // not open is refused, not read as empty: writing an empty schema back
+        // would erase the workspace's properties for everyone.
+        const key = await this.keyForFolder(accountKey, folder).catch((err) => {
+            if (err instanceof vault_js_1.LockedError)
+                throw err;
+            throw new Error(`Folder ${folder.id} is in a shared workspace whose key could not be opened here ` +
+                `(${(0, keyring_js_1.describeKeyFailure)(err)}). Open it in the Virlow app instead.`);
+        });
         const schema = (await (0, attrs_js_1.decodeSchema)(key, folder.encryptedSchema)) ?? (0, attrs_js_1.emptySchema)();
         // Same guard as decryptRow(): a decode still in flight when the vault
         // locks resolves for its own caller but never seeds the next session.

package/dist/cjs/signer-file.d.ts

@@ -0,0 +1,21 @@
+import { type SignerMemory } from './keyring.js';
+/**
+ * Remembered signing keys in a small JSON file per account, for the local
+ * CLI: the connector's counterpart of the web app's `virlow.knownSigners`
+ * localStorage entry. The keys are public, so the file is not encrypted; what
+ * matters is that it outlives the process, so a granter's key that changes
+ * between runs is refused rather than trusted afresh. The file name is a hash
+ * of the account id, not the id itself.
+ *
+ * `get` reads the file each time, so a pin another process (a second CLI)
+ * wrote is seen. `remember` is a compare-and-set under a lock file: it reads
+ * the file again inside the lock and throws KeyChangedError if a different
+ * key is already pinned, never overwriting it.
+ *
+ * A missing or unreadable file starts empty (first use), and a failed write
+ * keeps the key in memory for this run, as the web does in private mode.
+ */
+export declare function fileSignerMemory(opts: {
+    dir: string;
+    userId: string;
+}): SignerMemory;