@noteplanco/noteplan-mcp 1.1.23 → 1.1.25

package/dist/noteplan/unified-store.js

@@ -5,18 +5,26 @@ import * as fileWriter from './file-writer.js';
 import * as sqliteReader from './sqlite-reader.js';
 import * as sqliteWriter from './sqlite-writer.js';
 import * as frontmatter from './frontmatter-parser.js';
+import { extractTagsFromContent } from './markdown-parser.js';
 import { getTodayDateString, parseFlexibleDate } from '../utils/date-utils.js';
 import { matchFolder } from '../utils/folder-matcher.js';
 import { searchWithRipgrep, isRipgrepAvailable } from './ripgrep-search.js';
 import { fuzzySearch } from './fuzzy-search.js';
 import { parseFlexibleDateFilter, isDateInRange } from '../utils/date-filters.js';
 import { normalizeFilename } from '../utils/filename-normalize.js';
+import { isFolderAllowed, hasFolderAccessRules } from '../utils/folder-access.js';
+import { getBridgeClient } from '../transport/bridge-availability.js';
 // Cache ripgrep availability check
 let ripgrepAvailable = null;
 const LIST_NOTES_CACHE_TTL_MS = 5000;
 const LIST_FOLDERS_CACHE_TTL_MS = 15000;
+// Tag listing crosses the bridge for local tags (fast via NoteCache) and
+// then iterates every TeamSpace note's content via regex (slow). Cache
+// the merged result per scope so repeat calls within the TTL are instant.
+const LIST_TAGS_CACHE_TTL_MS = 60_000;
 const listNotesCache = new Map();
 const listFoldersCache = new Map();
+const listTagsCache = new Map();
 function getCachedValue(cache, key) {
     const entry = cache.get(key);
     if (!entry)
@@ -34,9 +42,10 @@ function setCachedValue(cache, key, value, ttlMs) {
     });
     return value;
 }
-function invalidateListingCaches() {
+export function invalidateListingCaches() {
     listNotesCache.clear();
     listFoldersCache.clear();
+    listTagsCache.clear();
 }
 function normalizeLocalFolderFilter(folder) {
     if (!folder)
@@ -60,13 +69,13 @@ function normalizeLocalFolderFilter(folder) {
  * Returns undefined when the input is undefined/empty (pass-through for optional params).
  * Throws when a non-empty value doesn't match any known space.
  */
-export function resolveSpaceId(space) {
+export async function resolveSpaceId(space) {
     if (!space)
         return undefined;
     const trimmed = space.trim();
     if (!trimmed)
         return undefined;
-    const spaces = sqliteReader.listSpaces();
+    const spaces = await sqliteReader.listSpaces();
     // Exact ID match takes priority (unambiguous)
     const idMatch = spaces.find((s) => s.id === trimmed);
     if (idMatch)
@@ -84,19 +93,30 @@ export function resolveSpaceId(space) {
     throw new Error(`Space not found: "${space}". Available spaces: ${available.length > 0 ? available.join(', ') : 'none'}`);
 }
 /**
- * Get a note by various identifiers
+ * Get a note by various identifiers. Outer wrapper applies the
+ * configured folder allow/deny rules — pretending the note doesn't
+ * exist if it sits inside a blocked folder, so the agent can't sneak
+ * around the filter via id/filename/date/title resolution.
  */
-export function getNote(options) {
+export async function getNote(options) {
+    const note = await getNoteUnchecked(options);
+    if (!note)
+        return null;
+    if (!isFolderAllowed(note.filename))
+        return null;
+    return note;
+}
+async function getNoteUnchecked(options) {
     const { id, title, filename, date } = options;
-    const space = resolveSpaceId(options.space);
+    const space = await resolveSpaceId(options.space);
     // If ID is specified, get directly (best for space notes)
     if (id) {
         const normalizedId = normalizeFilename(id);
-        const spaceNote = sqliteReader.getSpaceNote(normalizedId);
+        const spaceNote = await sqliteReader.getSpaceNote(normalizedId);
         if (spaceNote)
             return spaceNote;
         // Fallback: for local notes, id === filename
-        const localNote = fileReader.readNoteFile(normalizedId);
+        const localNote = await fileReader.readNoteFile(normalizedId);
         if (localNote)
             return localNote;
         return null;
@@ -105,7 +125,7 @@ export function getNote(options) {
     if (date) {
         const dateStr = parseFlexibleDate(date);
         if (space) {
-            return sqliteReader.getSpaceCalendarNote(dateStr, space);
+            return await sqliteReader.getSpaceCalendarNote(dateStr, space);
         }
         return fileReader.getCalendarNote(dateStr);
     }
@@ -113,46 +133,44 @@ export function getNote(options) {
     if (filename) {
         const normalizedFilename = normalizeFilename(filename.trim());
         if (space) {
-            const directSpaceNote = sqliteReader.getSpaceNote(normalizedFilename);
+            const directSpaceNote = await sqliteReader.getSpaceNote(normalizedFilename);
             if (directSpaceNote && directSpaceNote.spaceId === space) {
                 return directSpaceNote;
             }
-            const scopedSpaceNote = sqliteReader
-                .listSpaceNotes(space)
-                .find((note) => note.filename === normalizedFilename || note.id === normalizedFilename);
+            const scopedSpaceNote = (await sqliteReader.listSpaceNotes(space)).find((note) => note.filename === normalizedFilename || note.id === normalizedFilename);
             if (scopedSpaceNote) {
                 return scopedSpaceNote;
             }
         }
         // Check if it's a space filename
         if (normalizedFilename.includes('%%NotePlanCloud%%')) {
-            return sqliteReader.getSpaceNote(normalizedFilename);
+            return await sqliteReader.getSpaceNote(normalizedFilename);
         }
-        const localNote = fileReader.readNoteFile(normalizedFilename);
+        const localNote = await fileReader.readNoteFile(normalizedFilename);
         if (localNote)
             return localNote;
-        return sqliteReader.getSpaceNote(normalizedFilename);
+        return await sqliteReader.getSpaceNote(normalizedFilename);
     }
     // If title is specified, search by title
     if (title) {
         if (space) {
-            return sqliteReader.getSpaceNoteByTitle(title, space);
+            return await sqliteReader.getSpaceNoteByTitle(title, space);
         }
         // Try local first
-        const localNote = fileReader.getNoteByTitle(title);
+        const localNote = await fileReader.getNoteByTitle(title);
         if (localNote)
             return localNote;
         // Try space
-        return sqliteReader.getSpaceNoteByTitle(title);
+        return await sqliteReader.getSpaceNoteByTitle(title);
     }
     return null;
 }
 /**
  * List all notes, optionally filtered
  */
-export function listNotes(options = {}) {
+export async function listNotes(options = {}) {
     const { folder, type } = options;
-    const space = resolveSpaceId(options.space);
+    const space = await resolveSpaceId(options.space);
     const normalizedFolder = normalizeLocalFolderFilter(folder);
     const cacheKey = JSON.stringify({
         folder: normalizedFolder || '',
@@ -168,30 +186,37 @@ export function listNotes(options = {}) {
     // Get local notes
     if (!space) {
         if (!type || type === 'note') {
-            notes.push(...fileReader.listProjectNotes(normalizedFolder));
+            notes.push(...(await fileReader.listProjectNotes(normalizedFolder)));
         }
         if ((!type || type === 'calendar') && !hasFolderScope) {
-            notes.push(...fileReader.listCalendarNotes());
+            notes.push(...(await fileReader.listCalendarNotes()));
         }
     }
     // Get space notes
     if (space || !hasFolderScope) {
-        notes.push(...sqliteReader.listSpaceNotes(space));
+        let spaceNotes = await sqliteReader.listSpaceNotes(space);
+        if (space && hasFolderScope) {
+            const resolved = await sqliteReader.resolveSpaceFolder(space, normalizedFolder);
+            spaceNotes = resolved ? spaceNotes.filter((n) => n.folder === resolved.id) : [];
+        }
+        notes.push(...spaceNotes);
     }
-    // Sort by modified date (newest first)
-    notes.sort((a, b) => {
+    const accessFiltered = notes.filter((n) => isFolderAllowed(n.filename));
+    // Sort by modified date (newest first) AFTER folder filtering — no
+    // point sorting entries we're about to discard.
+    accessFiltered.sort((a, b) => {
         const dateA = a.modifiedAt?.getTime() || 0;
         const dateB = b.modifiedAt?.getTime() || 0;
         return dateB - dateA;
     });
-    return setCachedValue(listNotesCache, cacheKey, notes, LIST_NOTES_CACHE_TTL_MS);
+    return setCachedValue(listNotesCache, cacheKey, accessFiltered, LIST_NOTES_CACHE_TTL_MS);
 }
 /**
  * Search across all notes with enhanced options
  */
 export async function searchNotes(query, options = {}) {
     const { types, folder, limit = 50, fuzzy = false } = options;
-    const space = resolveSpaceId(options.space);
+    const space = await resolveSpaceId(options.space);
     const normalizedFolder = normalizeLocalFolderFilter(folder);
     const searchField = options.searchField ?? 'content';
     const effectiveTypes = searchField === 'content' ? types : (types ?? ['note']);
@@ -238,18 +263,18 @@ export async function searchNotes(query, options = {}) {
                         paths: searchPaths,
                         maxResults: limit * 2, // Get extra for filtering
                     });
-                    backend = 'ripgrep';
+                    backend = rgResult.backend;
                     partialResults = rgResult.partialResults;
                     if (rgResult.warning)
                         warnings.push(rgResult.warning);
-                    results.push(...convertRipgrepToSearchResults(rgResult.matches));
+                    results.push(...(await convertRipgrepToSearchResults(rgResult.matches)));
                 }
                 catch (error) {
                     console.error('Ripgrep search failed:', error);
                     backend = 'fallback';
                     warnings.push('ripgrep failed; using fallback local search');
                     // Fall back to simple search
-                    const localNotes = fileReader.searchLocalNotes(query, {
+                    const localNotes = await fileReader.searchLocalNotes(query, {
                         types: effectiveTypes,
                         folder: normalizedFolder,
                         limit: limit * 2,
@@ -261,7 +286,7 @@ export async function searchNotes(query, options = {}) {
                 backend = 'simple';
                 warnings.push('ripgrep unavailable; using fallback local search');
                 // Fallback to original search method
-                const localNotes = fileReader.searchLocalNotes(query, {
+                const localNotes = await fileReader.searchLocalNotes(query, {
                     types: effectiveTypes,
                     folder: normalizedFolder,
                     limit: limit * 2,
@@ -270,7 +295,7 @@ export async function searchNotes(query, options = {}) {
             }
         }
         // Search space notes
-        const spaceNotes = sqliteReader.searchSpaceNotesFTS(query, { spaceId: space, limit: limit * 2 });
+        const spaceNotes = await sqliteReader.searchSpaceNotesFTS(query, { spaceId: space, limit: limit * 2 });
         for (const note of spaceNotes) {
             results.push({
                 note,
@@ -278,18 +303,27 @@ export async function searchNotes(query, options = {}) {
                 score: 50, // Base score, will be enhanced below
             });
         }
+        // Space-only search: relabel backend so callers can tell whether the
+        // space query went through bridge or sqlite-direct. Local content
+        // search (ripgrep/fallback) didn't run in this branch.
+        if (space) {
+            backend = (await getBridgeClient()) ? 'bridge' : 'sqlite';
+        }
     }
     else {
         backend = 'simple';
         warnings.push(`searchField=${searchField} performs metadata matching on titles/filenames (not full-text content search).`);
-        const candidates = listNotes({
+        const candidates = (await listNotes({
             folder: normalizedFolder,
             space,
-        }).filter((note) => !effectiveTypes || effectiveTypes.includes(note.type));
+        })).filter((note) => !effectiveTypes || effectiveTypes.includes(note.type));
         results = candidates
             .map((note) => scoreMetadataMatch(note, query, searchField, options.caseSensitive === true))
             .filter((entry) => entry !== null);
     }
+    // Drop denied folders before any per-result work (frontmatter parsing,
+    // date math, scoring) — they're going out the window anyway.
+    results = results.filter((r) => isFolderAllowed(r.note.filename));
     // Apply date filters
     if (modifiedAfter || modifiedBefore || createdAfter || createdBefore) {
         results = results.filter((r) => {
@@ -493,7 +527,7 @@ function noteToSearchResult(note, query) {
 /**
  * Convert ripgrep matches to SearchResults
  */
-function convertRipgrepToSearchResults(matches) {
+async function convertRipgrepToSearchResults(matches) {
     // Group matches by file
     const byFile = new Map();
     for (const m of matches) {
@@ -503,7 +537,7 @@ function convertRipgrepToSearchResults(matches) {
     }
     const results = [];
     for (const [file, fileMatches] of byFile) {
-        const note = fileReader.readNoteFile(file);
+        const note = await fileReader.readNoteFile(file);
         if (note) {
             results.push({
                 note,
@@ -622,8 +656,38 @@ function calculateScore(note, matches, query) {
 /**
  * Create a new note with smart folder matching
  */
-export function createNote(title, content, options = {}) {
-    const { folder, space, createNewFolder = false } = options;
+export async function createNote(title, content, options = {}) {
+    const { folder, space, createNewFolder = false, filename, calendarDate } = options;
+    // Calendar-note path: short-circuit BEFORE the project-note logic so
+    // we don't pass a missing title through sanitizeFilename, which used
+    // to surface as `Cannot read properties of undefined (reading 'replace')`.
+    if (calendarDate) {
+        if (space) {
+            throw new Error('Calendar notes cannot live inside a TeamSpace via this tool — omit `space` and target the local Calendar folder.');
+        }
+        if (filename) {
+            throw new Error('Calendar notes derive their filename from the date — pass `date` instead of `filename`.');
+        }
+        const writtenFilename = await fileWriter.createCalendarNoteIfNew(calendarDate, content ?? '');
+        const note = await fileReader.readNoteFile(writtenFilename);
+        if (!note)
+            throw new Error('Failed to create calendar note');
+        invalidateListingCaches();
+        const calendarFolderResolution = {
+            requested: 'Calendar',
+            resolved: 'Calendar',
+            matched: true,
+            ambiguous: false,
+            score: 1,
+            alternatives: [],
+        };
+        return { note, folderResolution: calendarFolderResolution };
+    }
+    // Project- and space-note path requires a non-empty title; reject up
+    // front with a clear error rather than crashing in sanitizeFilename.
+    if (!title?.trim()) {
+        throw new Error('title is required for project notes. To create a calendar note instead, pass `date` (e.g. "2026-W16", "2026-05-07", "today").');
+    }
     // Initialize folder resolution info
     const folderResolution = {
         requested: folder,
@@ -654,10 +718,16 @@ export function createNote(title, content, options = {}) {
             }
         }
     }
-    const resolvedSpace = resolveSpaceId(space);
+    const resolvedSpace = await resolveSpaceId(space);
     if (resolvedSpace) {
-        const filename = sqliteWriter.createSpaceNote(resolvedSpace, title, effectiveContent);
-        const note = sqliteReader.getSpaceNote(filename);
+        // Space notes don't use filesystem filenames; the explicit-filename
+        // override is a local-note feature only. Surface that explicitly
+        // rather than silently dropping the parameter.
+        if (filename) {
+            throw new Error('filename is not supported for space notes — they are addressed by ID, not by filesystem path.');
+        }
+        const writtenFilename = sqliteWriter.createSpaceNote(resolvedSpace, title, effectiveContent);
+        const note = await sqliteReader.getSpaceNote(writtenFilename);
         if (!note)
             throw new Error('Failed to create space note');
         invalidateListingCaches();
@@ -666,7 +736,7 @@ export function createNote(title, content, options = {}) {
     // Smart folder matching for local notes
     let resolvedFolder = folder;
     if (folder && !createNewFolder) {
-        const folders = fileReader.listFolders();
+        const folders = await fileReader.listFolders();
         const match = matchFolder(folder, folders);
         if (match.matched && match.folder) {
             resolvedFolder = match.folder.path;
@@ -677,8 +747,8 @@ export function createNote(title, content, options = {}) {
             folderResolution.alternatives = match.alternatives.map((f) => f.path);
         }
     }
-    const filename = fileWriter.createProjectNote(title, effectiveContent, resolvedFolder);
-    const note = fileReader.readNoteFile(filename);
+    const writtenFilename = await fileWriter.createProjectNote(title, effectiveContent, resolvedFolder, filename);
+    const note = await fileReader.readNoteFile(writtenFilename);
     if (!note)
         throw new Error('Failed to create note');
     invalidateListingCaches();
@@ -687,23 +757,23 @@ export function createNote(title, content, options = {}) {
 /**
  * Update a note's content
  */
-export function updateNote(identifier, content, options = {}) {
-    const updateSpace = (spaceIdentifier) => {
-        const existing = sqliteReader.getSpaceNote(spaceIdentifier);
+export async function updateNote(identifier, content, options = {}) {
+    const updateSpace = async (spaceIdentifier) => {
+        const existing = await sqliteReader.getSpaceNote(spaceIdentifier);
         if (!existing) {
             throw new Error(`Note not found: ${spaceIdentifier}`);
         }
         const writeIdentifier = existing.id || spaceIdentifier;
         sqliteWriter.updateSpaceNote(writeIdentifier, content);
-        const note = sqliteReader.getSpaceNote(writeIdentifier);
+        const note = await sqliteReader.getSpaceNote(writeIdentifier);
         if (!note)
             throw new Error('Note not found after update');
         invalidateListingCaches();
         return note;
     };
-    const updateLocal = (localIdentifier) => {
-        fileWriter.updateNote(localIdentifier, content);
-        const note = fileReader.readNoteFile(localIdentifier);
+    const updateLocal = async (localIdentifier) => {
+        await fileWriter.updateNote(localIdentifier, content);
+        const note = await fileReader.readNoteFile(localIdentifier);
         if (!note)
             throw new Error('Note not found after update');
         invalidateListingCaches();
@@ -718,8 +788,8 @@ export function updateNote(identifier, content, options = {}) {
     if (identifier.includes('%%NotePlanCloud%%')) {
         return updateSpace(identifier);
     }
-    const localNote = fileReader.readNoteFile(identifier);
-    const spaceNote = sqliteReader.getSpaceNote(identifier);
+    const localNote = await fileReader.readNoteFile(identifier);
+    const spaceNote = await sqliteReader.getSpaceNote(identifier);
     if (localNote) {
         return updateLocal(localNote.filename);
     }
@@ -731,8 +801,8 @@ export function updateNote(identifier, content, options = {}) {
 /**
  * Delete a note
  */
-export function deleteNote(identifier) {
-    const note = getNoteByIdentifierOrThrow(identifier);
+export async function deleteNote(identifier) {
+    const note = await getNoteByIdentifierOrThrow(identifier);
     if (note.source === 'space') {
         const moved = sqliteWriter.deleteSpaceNote(note.id || note.filename);
         invalidateListingCaches();
@@ -743,7 +813,7 @@ export function deleteNote(identifier) {
             noteId: moved.noteId,
         };
     }
-    const trashedPath = fileWriter.deleteNote(note.filename);
+    const trashedPath = await fileWriter.deleteNote(note.filename);
     invalidateListingCaches();
     return {
         source: 'local',
@@ -751,8 +821,8 @@ export function deleteNote(identifier) {
         toIdentifier: trashedPath,
     };
 }
-function getNoteByIdentifierOrThrow(identifier, options = {}) {
-    const note = getNote({ id: identifier }) ?? getNote({ filename: identifier });
+async function getNoteByIdentifierOrThrow(identifier, options = {}) {
+    const note = (await getNote({ id: identifier })) ?? (await getNote({ filename: identifier }));
     if (!note) {
         throw new Error('Note not found');
     }
@@ -761,8 +831,8 @@ function getNoteByIdentifierOrThrow(identifier, options = {}) {
     }
     return note;
 }
-function getLocalProjectNoteOrThrow(identifier, action) {
-    const note = getNoteByIdentifierOrThrow(identifier);
+async function getLocalProjectNoteOrThrow(identifier, action) {
+    const note = await getNoteByIdentifierOrThrow(identifier);
     if (note.source !== 'local') {
         throw new Error(`${action} is currently supported for local notes only`);
     }
@@ -771,7 +841,7 @@ function getLocalProjectNoteOrThrow(identifier, action) {
     }
     return note;
 }
-function resolveSpaceMoveDestination(note, destinationFolder, options = {}) {
+async function resolveSpaceMoveDestination(note, destinationFolder, options = {}) {
     const query = destinationFolder.trim();
     if (!query) {
         throw new Error('Destination folder is required');
@@ -786,7 +856,7 @@ function resolveSpaceMoveDestination(note, destinationFolder, options = {}) {
             label: note.spaceId,
         };
     }
-    const folder = sqliteReader.resolveSpaceFolder(note.spaceId, query, { includeTrash: true });
+    const folder = await sqliteReader.resolveSpaceFolder(note.spaceId, query, { includeTrash: true });
     if (!folder?.id) {
         throw new Error(`Destination folder not found in space: ${destinationFolder}`);
     }
@@ -798,13 +868,13 @@ function resolveSpaceMoveDestination(note, destinationFolder, options = {}) {
         label: folder.path,
     };
 }
-export function previewMoveNote(identifier, destinationFolder) {
-    const note = getNoteByIdentifierOrThrow(identifier);
+export async function previewMoveNote(identifier, destinationFolder) {
+    const note = await getNoteByIdentifierOrThrow(identifier);
     if (note.source === 'space') {
         if (note.type !== 'note') {
             throw new Error('Moving calendar notes in TeamSpaces is not supported');
         }
-        const destination = resolveSpaceMoveDestination(note, destinationFolder);
+        const destination = await resolveSpaceMoveDestination(note, destinationFolder);
         return {
             note,
             fromFilename: note.filename,
@@ -813,20 +883,20 @@ export function previewMoveNote(identifier, destinationFolder) {
             destinationParentId: destination.id,
         };
     }
-    const preview = fileWriter.previewMoveLocalNote(note.filename, destinationFolder);
+    const preview = await fileWriter.previewMoveLocalNote(note.filename, destinationFolder);
     return {
         note,
         ...preview,
     };
 }
-export function moveNote(identifier, destinationFolder) {
-    const preview = previewMoveNote(identifier, destinationFolder);
+export async function moveNote(identifier, destinationFolder) {
+    const preview = await previewMoveNote(identifier, destinationFolder);
     if (preview.note.source === 'space') {
         if (!preview.note.id || !preview.destinationParentId) {
             throw new Error('Could not resolve TeamSpace move target');
         }
         sqliteWriter.moveSpaceNote(preview.note.id, preview.destinationParentId);
-        const movedNote = sqliteReader.getSpaceNote(preview.note.id);
+        const movedNote = await sqliteReader.getSpaceNote(preview.note.id);
         if (!movedNote) {
             throw new Error('Failed to read note after move');
         }
@@ -839,8 +909,8 @@ export function moveNote(identifier, destinationFolder) {
             destinationParentId: preview.destinationParentId,
         };
     }
-    const nextFilename = fileWriter.moveLocalNote(preview.note.filename, destinationFolder);
-    const movedNote = fileReader.readNoteFile(nextFilename);
+    const nextFilename = await fileWriter.moveLocalNote(preview.note.filename, destinationFolder);
+    const movedNote = await fileReader.readNoteFile(nextFilename);
     if (!movedNote) {
         throw new Error('Failed to read note after move');
     }
@@ -852,17 +922,17 @@ export function moveNote(identifier, destinationFolder) {
         destinationFolder: preview.destinationFolder,
     };
 }
-export function previewRestoreNote(identifier, destinationFolder) {
-    const note = getNoteByIdentifierOrThrow(identifier, { allowTrash: true });
+export async function previewRestoreNote(identifier, destinationFolder) {
+    const note = await getNoteByIdentifierOrThrow(identifier, { allowTrash: true });
     if (note.source === 'space') {
         if (!note.id) {
             throw new Error('Space note ID is required for restore');
         }
-        if (!sqliteReader.isSpaceNoteInTrash(note.id)) {
+        if (!await sqliteReader.isSpaceNoteInTrash(note.id)) {
             throw new Error('Note is not in TeamSpace @Trash');
         }
         const destination = destinationFolder
-            ? resolveSpaceMoveDestination(note, destinationFolder)
+            ? await resolveSpaceMoveDestination(note, destinationFolder)
             : { id: note.spaceId || '', label: note.spaceId || '' };
         if (!destination.id) {
             throw new Error('Could not resolve TeamSpace restore destination');
@@ -877,8 +947,8 @@ export function previewRestoreNote(identifier, destinationFolder) {
     if (note.type !== 'trash') {
         throw new Error('Local note is not in @Trash');
     }
-    const preview = fileWriter.previewRestoreLocalNoteFromTrash(note.filename, destinationFolder && destinationFolder.trim().length > 0 ? destinationFolder : 'Notes');
-    const restoredNote = fileReader.readNoteFile(preview.fromFilename);
+    const preview = await fileWriter.previewRestoreLocalNoteFromTrash(note.filename, destinationFolder && destinationFolder.trim().length > 0 ? destinationFolder : 'Notes');
+    const restoredNote = await fileReader.readNoteFile(preview.fromFilename);
     if (!restoredNote) {
         throw new Error('Failed to read local trash note');
     }
@@ -889,11 +959,11 @@ export function previewRestoreNote(identifier, destinationFolder) {
         toIdentifier: preview.toFilename,
     };
 }
-export function restoreNote(identifier, destinationFolder) {
-    const preview = previewRestoreNote(identifier, destinationFolder);
+export async function restoreNote(identifier, destinationFolder) {
+    const preview = await previewRestoreNote(identifier, destinationFolder);
     if (preview.source === 'space') {
         sqliteWriter.restoreSpaceNote(preview.fromIdentifier, preview.toIdentifier);
-        const restoredNote = sqliteReader.getSpaceNote(preview.fromIdentifier);
+        const restoredNote = await sqliteReader.getSpaceNote(preview.fromIdentifier);
         if (!restoredNote) {
             throw new Error('Failed to read TeamSpace note after restore');
         }
@@ -905,8 +975,8 @@ export function restoreNote(identifier, destinationFolder) {
             toIdentifier: preview.toIdentifier,
         };
     }
-    const restoredFilename = fileWriter.restoreLocalNoteFromTrash(preview.fromIdentifier, destinationFolder && destinationFolder.trim().length > 0 ? destinationFolder : 'Notes');
-    const restoredNote = fileReader.readNoteFile(restoredFilename);
+    const restoredFilename = await fileWriter.restoreLocalNoteFromTrash(preview.fromIdentifier, destinationFolder && destinationFolder.trim().length > 0 ? destinationFolder : 'Notes');
+    const restoredNote = await fileReader.readNoteFile(restoredFilename);
     if (!restoredNote) {
         throw new Error('Failed to read local note after restore');
     }
@@ -918,18 +988,18 @@ export function restoreNote(identifier, destinationFolder) {
         toIdentifier: preview.toIdentifier,
     };
 }
-export function previewRenameNoteFile(filename, newFilename, keepExtension = true) {
-    const note = getLocalProjectNoteOrThrow(filename, 'Rename note file');
-    const preview = fileWriter.previewRenameLocalNoteFile(note.filename, newFilename, keepExtension);
+export async function previewRenameNoteFile(filename, newFilename, keepExtension = true) {
+    const note = await getLocalProjectNoteOrThrow(filename, 'Rename note file');
+    const preview = await fileWriter.previewRenameLocalNoteFile(note.filename, newFilename, keepExtension);
     return {
         note,
         ...preview,
     };
 }
-export function renameNoteFile(filename, newFilename, keepExtension = true) {
-    const preview = previewRenameNoteFile(filename, newFilename, keepExtension);
-    const nextFilename = fileWriter.renameLocalNoteFile(filename, newFilename, keepExtension);
-    const renamedNote = fileReader.readNoteFile(nextFilename);
+export async function renameNoteFile(filename, newFilename, keepExtension = true) {
+    const preview = await previewRenameNoteFile(filename, newFilename, keepExtension);
+    const nextFilename = await fileWriter.renameLocalNoteFile(filename, newFilename, keepExtension);
+    const renamedNote = await fileReader.readNoteFile(nextFilename);
     if (!renamedNote) {
         throw new Error('Failed to read note after rename');
     }
@@ -940,8 +1010,8 @@ export function renameNoteFile(filename, newFilename, keepExtension = true) {
         toFilename: preview.toFilename,
     };
 }
-export function renameSpaceNote(identifier, newTitle) {
-    const note = getNoteByIdentifierOrThrow(identifier);
+export async function renameSpaceNote(identifier, newTitle) {
+    const note = await getNoteByIdentifierOrThrow(identifier);
     if (note.source !== 'space') {
         throw new Error('renameSpaceNote is for TeamSpace notes only');
     }
@@ -951,7 +1021,7 @@ export function renameSpaceNote(identifier, newTitle) {
     const fromTitle = note.title;
     const writeId = note.id || note.filename;
     sqliteWriter.updateSpaceNoteTitle(writeId, newTitle);
-    const renamedNote = sqliteReader.getSpaceNote(writeId);
+    const renamedNote = await sqliteReader.getSpaceNote(writeId);
     if (!renamedNote) {
         throw new Error('Failed to read note after rename');
     }
@@ -965,40 +1035,45 @@ export function renameSpaceNote(identifier, newTitle) {
 /**
  * Get today's daily note
  */
-export function getTodayNote(space) {
+export async function getTodayNote(space) {
     const dateStr = getTodayDateString();
     return getCalendarNote(dateStr, space);
 }
 /**
  * Get a calendar note by date
  */
-export function getCalendarNote(date, space) {
+export async function getCalendarNote(date, space) {
     const dateStr = parseFlexibleDate(date);
-    const resolvedSpace = resolveSpaceId(space);
+    const resolvedSpace = await resolveSpaceId(space);
     if (resolvedSpace) {
-        return sqliteReader.getSpaceCalendarNote(dateStr, resolvedSpace);
+        return await sqliteReader.getSpaceCalendarNote(dateStr, resolvedSpace);
     }
-    return fileReader.getCalendarNote(dateStr);
+    const note = await fileReader.getCalendarNote(dateStr);
+    if (!note)
+        return null;
+    if (!isFolderAllowed(note.filename))
+        return null;
+    return note;
 }
 /**
  * Ensure a calendar note exists, create if not
  */
-export function ensureCalendarNote(date, space) {
+export async function ensureCalendarNote(date, space) {
     const dateStr = parseFlexibleDate(date);
-    const resolvedSpace = resolveSpaceId(space);
+    const resolvedSpace = await resolveSpaceId(space);
     if (resolvedSpace) {
-        let note = sqliteReader.getSpaceCalendarNote(dateStr, resolvedSpace);
+        let note = await sqliteReader.getSpaceCalendarNote(dateStr, resolvedSpace);
         if (!note) {
             sqliteWriter.createSpaceCalendarNote(resolvedSpace, dateStr, '');
-            note = sqliteReader.getSpaceCalendarNote(dateStr, resolvedSpace);
+            note = await sqliteReader.getSpaceCalendarNote(dateStr, resolvedSpace);
             invalidateListingCaches();
         }
         if (!note)
             throw new Error('Failed to create space calendar note');
         return note;
     }
-    const filename = fileWriter.ensureCalendarNote(dateStr);
-    const note = fileReader.readNoteFile(filename);
+    const filename = await fileWriter.ensureCalendarNote(dateStr);
+    const note = await fileReader.readNoteFile(filename);
     if (!note)
         throw new Error('Failed to create calendar note');
     invalidateListingCaches();
@@ -1007,8 +1082,8 @@ export function ensureCalendarNote(date, space) {
 /**
  * Add content to today's note
  */
-export function addToToday(content, position = 'end', space) {
-    const note = ensureCalendarNote('today', space);
+export async function addToToday(content, position = 'end', space) {
+    const note = await ensureCalendarNote('today', space);
     let newContent;
     if (position === 'start') {
         const lines = note.content.split('\n');
@@ -1034,16 +1109,16 @@ export function addToToday(content, position = 'end', space) {
 /**
  * List all spaces
  */
-export function listSpaces() {
-    return sqliteReader.listSpaces();
+export async function listSpaces() {
+    return await sqliteReader.listSpaces();
 }
 // Keep old name for backwards compatibility
 export const listTeamspaces = listSpaces;
 /**
  * List folders with optional source/depth/query filtering
  */
-export function listFolders(options = {}) {
-    const resolvedSpace = resolveSpaceId(options.space);
+export async function listFolders(options = {}) {
+    const resolvedSpace = await resolveSpaceId(options.space);
     const { includeLocal = !resolvedSpace, includeSpaces = Boolean(resolvedSpace), query, maxDepth, parentPath, recursive = true, } = options;
     const space = resolvedSpace;
     const normalizedQuery = query?.trim().toLowerCase() || '';
@@ -1063,22 +1138,27 @@ export function listFolders(options = {}) {
     }
     const folders = [];
     if (includeLocal) {
-        folders.push(...fileReader.listFolders(maxDepth));
+        folders.push(...(await fileReader.listFolders(maxDepth)));
     }
     if (includeSpaces) {
-        folders.push(...sqliteReader.listSpaceFolders(space));
+        folders.push(...await sqliteReader.listSpaceFolders(space));
     }
     const deduped = folders.filter((folder, index, arr) => {
         const key = `${folder.source}:${folder.spaceId || ''}:${folder.path}`;
         return arr.findIndex((candidate) => `${candidate.source}:${candidate.spaceId || ''}:${candidate.path}` === key) === index;
     });
+    const accessFiltered = deduped.filter((folder) => {
+        if (folder.source !== 'local')
+            return true;
+        return isFolderAllowed(`Notes/${folder.path}`);
+    });
     let filtered = normalizedQuery
-        ? deduped.filter((folder) => {
+        ? accessFiltered.filter((folder) => {
             const path = folder.path.toLowerCase();
             const name = folder.name.toLowerCase();
             return path.includes(normalizedQuery) || name.includes(normalizedQuery);
         })
-        : deduped;
+        : accessFiltered;
     if (normalizedParentPath) {
         const parentPrefix = `${normalizedParentPath}/`;
         filtered = filtered.filter((folder) => {
@@ -1097,21 +1177,21 @@ export function listFolders(options = {}) {
     filtered.sort((a, b) => a.path.localeCompare(b.path));
     return setCachedValue(listFoldersCache, cacheKey, filtered, LIST_FOLDERS_CACHE_TTL_MS);
 }
-function resolveSpaceFolderReference(spaceId, reference, options = {}) {
+async function resolveSpaceFolderReference(spaceId, reference, options = {}) {
     const normalized = reference.trim();
     if (!normalized) {
         throw new Error('Folder reference is required');
     }
     const lower = normalized.toLowerCase();
     if (options.allowRoot === true && (lower === 'root' || lower === 'space-root' || normalized === spaceId)) {
-        const space = sqliteReader.listSpaces().find((candidate) => candidate.id === spaceId);
+        const space = (await sqliteReader.listSpaces()).find((candidate) => candidate.id === spaceId);
         return {
             id: spaceId,
             path: space?.name || spaceId,
             name: space?.name || spaceId,
         };
     }
-    const folder = sqliteReader.resolveSpaceFolder(spaceId, normalized, {
+    const folder = await sqliteReader.resolveSpaceFolder(spaceId, normalized, {
         includeTrash: options.includeTrash === true,
     });
     if (!folder?.id) {
@@ -1123,9 +1203,9 @@ function resolveSpaceFolderReference(spaceId, reference, options = {}) {
         name: folder.name,
     };
 }
-export function previewCreateFolder(options) {
+export async function previewCreateFolder(options) {
     if ('space' in options) {
-        const spaceId = resolveSpaceId(options.space.trim());
+        const spaceId = await resolveSpaceId(options.space.trim());
         if (!spaceId) {
             throw new Error('space is required');
         }
@@ -1135,8 +1215,8 @@ export function previewCreateFolder(options) {
         }
         const parent = options.parent?.trim();
         const destination = parent
-            ? resolveSpaceFolderReference(spaceId, parent, { allowRoot: true, includeTrash: true })
-            : resolveSpaceFolderReference(spaceId, spaceId, { allowRoot: true, includeTrash: true });
+            ? await resolveSpaceFolderReference(spaceId, parent, { allowRoot: true, includeTrash: true })
+            : await resolveSpaceFolderReference(spaceId, spaceId, { allowRoot: true, includeTrash: true });
         if (destination.name.toLowerCase() === '@trash') {
             throw new Error('Destination parent cannot be @Trash');
         }
@@ -1149,21 +1229,21 @@ export function previewCreateFolder(options) {
             parentId: destination.id,
         };
     }
-    const folder = fileWriter.previewCreateFolder(options.path);
+    const folder = await fileWriter.previewCreateFolder(options.path);
     return {
         source: 'local',
         path: folder,
         name: path.basename(folder),
     };
 }
-export function createFolder(options) {
-    const preview = previewCreateFolder(options);
+export async function createFolder(options) {
+    const preview = await previewCreateFolder(options);
     if ('space' in options) {
         if (preview.source !== 'space') {
             throw new Error('Invalid folder create state');
         }
         const createdId = sqliteWriter.createSpaceFolder(preview.spaceId, preview.name, preview.parentId);
-        const createdFolder = resolveSpaceFolderReference(preview.spaceId, createdId, {
+        const createdFolder = await resolveSpaceFolderReference(preview.spaceId, createdId, {
             allowRoot: false,
             includeTrash: true,
         });
@@ -1177,7 +1257,7 @@ export function createFolder(options) {
             parentId: preview.parentId,
         };
     }
-    const createdPath = fileWriter.createFolder(options.path);
+    const createdPath = await fileWriter.createFolder(options.path);
     invalidateListingCaches();
     return {
         source: 'local',
@@ -1185,24 +1265,24 @@ export function createFolder(options) {
         name: path.basename(createdPath),
     };
 }
-export function previewMoveFolder(options) {
+export async function previewMoveFolder(options) {
     if ('space' in options) {
-        const spaceId = resolveSpaceId(options.space.trim());
+        const spaceId = await resolveSpaceId(options.space.trim());
         if (!spaceId) {
             throw new Error('space is required');
         }
-        const source = resolveSpaceFolderReference(spaceId, options.source, {
+        const source = await resolveSpaceFolderReference(spaceId, options.source, {
             allowRoot: false,
             includeTrash: true,
         });
-        const destination = resolveSpaceFolderReference(spaceId, options.destination, {
+        const destination = await resolveSpaceFolderReference(spaceId, options.destination, {
             allowRoot: true,
             includeTrash: true,
         });
         if (destination.name.toLowerCase() === '@trash') {
             throw new Error('Destination folder cannot be @Trash');
         }
-        const counts = sqliteReader.countSpaceFolderContents(source.id);
+        const counts = await sqliteReader.countSpaceFolderContents(source.id);
         return {
             source: 'space',
             spaceId,
@@ -1214,9 +1294,9 @@ export function previewMoveFolder(options) {
             affectedFolderCount: counts.folderCount,
         };
     }
-    const preview = fileWriter.previewMoveLocalFolder(options.sourcePath, options.destinationFolder);
+    const preview = await fileWriter.previewMoveLocalFolder(options.sourcePath, options.destinationFolder);
     const fullPath = path.join(fileReader.getNotesPath(), preview.fromFolder);
-    const counts = fileReader.countNotesInDirectory(fullPath);
+    const counts = await fileReader.countNotesInDirectory(fullPath);
     return {
         source: 'local',
         fromPath: preview.fromFolder,
@@ -1226,14 +1306,14 @@ export function previewMoveFolder(options) {
         affectedFolderCount: counts.folderCount,
     };
 }
-export function moveFolder(options) {
-    const preview = previewMoveFolder(options);
+export async function moveFolder(options) {
+    const preview = await previewMoveFolder(options);
     if ('space' in options) {
         if (preview.source !== 'space') {
             throw new Error('Invalid folder move state');
         }
         sqliteWriter.moveSpaceFolder(preview.folderId, preview.destinationParentId);
-        const moved = resolveSpaceFolderReference(preview.spaceId, preview.folderId, {
+        const moved = await resolveSpaceFolderReference(preview.spaceId, preview.folderId, {
             allowRoot: false,
             includeTrash: true,
         });
@@ -1243,7 +1323,7 @@ export function moveFolder(options) {
             toPath: moved.path,
         };
     }
-    const moved = fileWriter.moveLocalFolder(options.sourcePath, options.destinationFolder);
+    const moved = await fileWriter.moveLocalFolder(options.sourcePath, options.destinationFolder);
     invalidateListingCaches();
     return {
         source: 'local',
@@ -1252,17 +1332,17 @@ export function moveFolder(options) {
         destinationFolder: moved.destinationFolder || options.destinationFolder,
     };
 }
-export function previewDeleteFolder(options) {
+export async function previewDeleteFolder(options) {
     if ('space' in options) {
-        const spaceId = resolveSpaceId(options.space.trim());
+        const spaceId = await resolveSpaceId(options.space.trim());
         if (!spaceId) {
             throw new Error('space is required');
         }
-        const source = resolveSpaceFolderReference(spaceId, options.source, {
+        const source = await resolveSpaceFolderReference(spaceId, options.source, {
             allowRoot: false,
             includeTrash: true,
         });
-        const counts = sqliteReader.countSpaceFolderContents(source.id);
+        const counts = await sqliteReader.countSpaceFolderContents(source.id);
         return {
             source: 'space',
             spaceId,
@@ -1273,9 +1353,9 @@ export function previewDeleteFolder(options) {
             affectedFolderCount: counts.folderCount,
         };
     }
-    const normalized = fileWriter.previewDeleteLocalFolder(options.path);
+    const normalized = await fileWriter.previewDeleteLocalFolder(options.path);
     const fullPath = path.join(fileReader.getNotesPath(), normalized);
-    const counts = fileReader.countNotesInDirectory(fullPath);
+    const counts = await fileReader.countNotesInDirectory(fullPath);
     return {
         source: 'local',
         fromPath: normalized,
@@ -1284,8 +1364,8 @@ export function previewDeleteFolder(options) {
         affectedFolderCount: counts.folderCount,
     };
 }
-export function deleteFolder(options) {
-    const preview = previewDeleteFolder(options);
+export async function deleteFolder(options) {
+    const preview = await previewDeleteFolder(options);
     if ('space' in options) {
         if (preview.source !== 'space') {
             throw new Error('Invalid folder delete state');
@@ -1300,7 +1380,7 @@ export function deleteFolder(options) {
             trashFolderId: deleted.trashFolderId,
         };
     }
-    const trashedPath = fileWriter.deleteLocalFolder(options.path);
+    const trashedPath = await fileWriter.deleteLocalFolder(options.path);
     invalidateListingCaches();
     return {
         source: 'local',
@@ -1308,13 +1388,13 @@ export function deleteFolder(options) {
         trashedPath,
     };
 }
-export function previewRenameFolder(options) {
+export async function previewRenameFolder(options) {
     if ('space' in options) {
-        const spaceId = resolveSpaceId(options.space.trim());
+        const spaceId = await resolveSpaceId(options.space.trim());
         if (!spaceId) {
             throw new Error('space is required');
         }
-        const source = resolveSpaceFolderReference(spaceId, options.source, {
+        const source = await resolveSpaceFolderReference(spaceId, options.source, {
             allowRoot: false,
             includeTrash: true,
         });
@@ -1334,21 +1414,21 @@ export function previewRenameFolder(options) {
             name: newName,
         };
     }
-    const preview = fileWriter.previewRenameLocalFolder(options.sourcePath, options.newName);
+    const preview = await fileWriter.previewRenameLocalFolder(options.sourcePath, options.newName);
     return {
         source: 'local',
         fromPath: preview.fromFolder,
         toPath: preview.toFolder,
     };
 }
-export function renameFolder(options) {
-    const preview = previewRenameFolder(options);
+export async function renameFolder(options) {
+    const preview = await previewRenameFolder(options);
     if ('space' in options) {
         if (preview.source !== 'space') {
             throw new Error('Invalid folder rename state');
         }
         const renamed = sqliteWriter.renameSpaceFolder(preview.folderId, preview.name);
-        const folder = resolveSpaceFolderReference(preview.spaceId, renamed.folderId, {
+        const folder = await resolveSpaceFolderReference(preview.spaceId, renamed.folderId, {
             allowRoot: false,
             includeTrash: true,
         });
@@ -1358,7 +1438,7 @@ export function renameFolder(options) {
             toPath: folder.path,
         };
     }
-    const renamed = fileWriter.renameLocalFolder(options.sourcePath, options.newName);
+    const renamed = await fileWriter.renameLocalFolder(options.sourcePath, options.newName);
     invalidateListingCaches();
     return {
         source: 'local',
@@ -1369,13 +1449,31 @@ export function renameFolder(options) {
 /**
  * List all tags
  */
-export function listTags(space) {
-    const resolvedSpace = resolveSpaceId(space);
+export async function listTags(space) {
+    const resolvedSpace = await resolveSpaceId(space);
+    const cacheKey = resolvedSpace ?? '__all__';
+    const cached = getCachedValue(listTagsCache, cacheKey);
+    if (cached)
+        return cached;
     const tags = new Set();
     if (!resolvedSpace) {
-        fileReader.extractAllTags().forEach((tag) => tags.add(tag));
+        if (hasFolderAccessRules()) {
+            // The fast paths (bridge tags endpoint, ripgrep) scan everything on
+            // disk and can't tell us which file a tag came from — so they would
+            // surface tag names that exist only inside a denied folder. Fall
+            // back to iterating filtered notes so the rules apply.
+            const notes = await listNotes();
+            for (const note of notes) {
+                for (const tag of extractTagsFromContent(note.content)) {
+                    tags.add(tag);
+                }
+            }
+        }
+        else {
+            (await fileReader.extractAllTags()).forEach((tag) => tags.add(tag));
+        }
     }
-    sqliteReader.extractSpaceTags(resolvedSpace).forEach((tag) => tags.add(tag));
-    return Array.from(tags).sort();
+    (await sqliteReader.extractSpaceTags(resolvedSpace)).forEach((tag) => tags.add(tag));
+    return setCachedValue(listTagsCache, cacheKey, Array.from(tags).sort(), LIST_TAGS_CACHE_TTL_MS);
 }
 //# sourceMappingURL=unified-store.js.map