@fortemi/core 2026.7.5 → 2026.7.8

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 import { PGlite } from '@electric-sql/pglite';
+import { ProbeReport } from '@bytecask/core';
 import { z, ZodType } from 'zod';
 export { AiwgIndexSchemaValidationResult, getAiwgFortemiIndexExportSchema, validateAiwgFortemiIndexExportSchema, validateAiwgFortemiProjectedRecordSchema } from './aiwg-index-schema.js';
 
@@ -390,34 +391,233 @@ declare class PGliteWorkerStorageBackendFactory implements StorageBackendFactory
 }
 
 /**
- * Content-addressable blob storage.
+ * Content-addressed attachment-byte storage — the Fortemi `BlobStore` seam.
  *
- * Path format: blobs/{dir1}/{dir2}/{hash}
- *   dir1 = first 2 hex chars of hash
- *   dir2 = next 2 hex chars of hash
- *   filename = full hash
+ * The store computes the key: `put(bytes)` BLAKE3-hashes the payload and
+ * returns the canonical checksum encoding `blake3:<64-char lowercase hex>`
+ * (server convention; ADR-012 D1/D3). Every method at this seam speaks that
+ * canonical encoding — the bare-hex ⇄ prefixed conversions live in
+ * `shard/blob-sidecar.ts` helpers and inside the bytecask adapter here, and
+ * nowhere else.
  *
- * Two implementations are provided:
- *   - OpfsBlobStore  — Origin Private File System (Chrome/Edge 86+)
- *   - IdbBlobStore   — IndexedDB fallback (Firefox, Safari)
+ * Lifecycle authority (ADR-013 D2): canonical attachment manifests decide
+ * which bytes are live. `reconcile(liveChecksums)` hands that authoritative
+ * set to the store; `gc()` physically removes only unreferenced,
+ * age-thresholded objects. Internal refcounts are an implementation detail,
+ * never a source of truth.
  *
- * Use createBlobStore() to get the best available implementation.
- * Export MemoryBlobStore for use in tests.
+ * Implementations:
+ *   - `createBlobStore()`  — `@bytecask/core` behind a dynamic import
+ *     (IndexedDB tier by default, OPFS opt-in, memory fallback). Zero bundle
+ *     cost until the first byte operation (ADR-012 D6).
+ *   - `createLazyBlobStore()` — synchronous facade that defers the dynamic
+ *     import until the first method call (what `FortemiProvider` wires).
+ *   - `MemoryBlobStore`    — dependency-free in-process implementation for
+ *     tests and the no-persistence tier.
+ */
+
+type BlobBackendKind = 'idb' | 'opfs' | 'memory';
+interface BlobStoreDiagnostics {
+    /** The storage tier actually serving bytes. */
+    backend: BlobBackendKind;
+    /** Tier-probe outcome from `@bytecask/core` (null for memory/test stores). */
+    probe: ProbeReport | null;
+}
+interface BlobReconcileOptions {
+    /** Physically remove unreferenced objects now instead of leaving them for gc(). */
+    removeUnreferenced?: boolean;
+}
+interface BlobReconcileResult {
+    /** Live checksums whose bytes are present. */
+    referenced: number;
+    /** Live checksums whose bytes are absent — the reference-only set. */
+    missing: string[];
+    /** Stored checksums not in the live set — GC candidates. */
+    unreferenced: string[];
+    /** Objects physically removed (only when `removeUnreferenced`). */
+    removed: number;
+    bytesFreed: number;
+}
+interface BlobGcOptions {
+    /** Collect only unreferenced objects at least this old (ms). Default 0. */
+    minAgeMs?: number;
+}
+interface BlobGcResult {
+    collected: number;
+    bytesFreed: number;
+}
+/**
+ * The Fortemi attachment-byte seam. All checksums are the canonical
+ * `blake3:<hex>` encoding stored in `attachment_blob.content_hash` and shard
+ * projection records.
  */
 interface BlobStore {
-    write(hash: string, data: Uint8Array): Promise<void>;
-    read(hash: string): Promise<Uint8Array | null>;
-    remove(hash: string): Promise<void>;
-    exists(hash: string): Promise<boolean>;
+    /** Store bytes, return their canonical checksum. Idempotent (content-addressed). */
+    put(bytes: Uint8Array): Promise<string>;
+    /** Fetch bytes by canonical checksum; null when absent (reference-only). */
+    read(checksum: string): Promise<Uint8Array | null>;
+    /** True when the bytes for this checksum are physically present. */
+    has(checksum: string): Promise<boolean>;
+    /**
+     * Reconcile stored bytes against the authoritative live-checksum set
+     * derived from canonical attachment manifests (ADR-013 D4).
+     */
+    reconcile(liveChecksums: Iterable<string>, opts?: BlobReconcileOptions): Promise<BlobReconcileResult>;
+    /** Physically remove unreferenced, age-thresholded objects. */
+    gc(opts?: BlobGcOptions): Promise<BlobGcResult>;
+    /** Selected backend + probe report, for capability/diagnostic surfaces. */
+    diagnostics(): Promise<BlobStoreDiagnostics>;
+    close(): Promise<void>;
 }
 declare class MemoryBlobStore implements BlobStore {
-    private store;
-    write(hash: string, data: Uint8Array): Promise<void>;
-    read(hash: string): Promise<Uint8Array | null>;
-    remove(hash: string): Promise<void>;
-    exists(hash: string): Promise<boolean>;
+    private now;
+    private entries;
+    constructor(now?: () => number);
+    put(bytes: Uint8Array): Promise<string>;
+    read(checksum: string): Promise<Uint8Array | null>;
+    has(checksum: string): Promise<boolean>;
+    reconcile(liveChecksums: Iterable<string>, opts?: BlobReconcileOptions): Promise<BlobReconcileResult>;
+    gc(opts?: BlobGcOptions): Promise<BlobGcResult>;
+    diagnostics(): Promise<BlobStoreDiagnostics>;
+    close(): Promise<void>;
+}
+interface CreateBlobStoreOptions {
+    /** Force a tier; omit to probe IndexedDB → OPFS → memory (measured default). */
+    backend?: BlobBackendKind;
+    /** Injectable IDBFactory for tests (fake-indexeddb). Defaults to the global. */
+    indexedDB?: IDBFactory;
+    /** Skip the one-shot migration of the pre-bytecask blob layout. */
+    migrateLegacy?: boolean;
+}
+/**
+ * Construct the bytecask-backed BlobStore for one archive namespace.
+ *
+ * `@bytecask/core` is reached only through a dynamic `import()` here, so
+ * hosts that never touch attachment bytes never load it. The namespace is a
+ * function of `archiveName` alone — identical in DB-free and PGlite modes.
+ *
+ * Tiering: IndexedDB by default (measured default per bytecask's C3
+ * benchmark), memory fallback when IndexedDB is unavailable. The OPFS opt-in
+ * tier arrives with the upstream `createBlobStore()` factory switch
+ * (`@bytecask/core` 2026.7.2); requesting it now fails loudly rather than
+ * silently falling back.
+ */
+declare function createBlobStore(archiveName: string, options?: CreateBlobStoreOptions): Promise<BlobStore>;
+/**
+ * Synchronous facade over {@link createBlobStore}: construction is free, the
+ * dynamic import happens on the first byte operation. This is what
+ * `FortemiProvider` wires so hosts that never touch attachment bytes never
+ * pay for the substrate (ADR-012 D6).
+ */
+declare function createLazyBlobStore(archiveName: string, options?: CreateBlobStoreOptions): BlobStore;
+
+/**
+ * Signed Knowledge-Shard verification (#324, ADR-014).
+ *
+ * Authenticity — as distinct from the consistency the in-archive checksums
+ * provide (SEC7) — comes from an Ed25519 signature over a canonical payload
+ * that commits to the manifest digest and the referenced blob-byte digests.
+ * Verification is pure and side-effect-free; it runs BEFORE any record or
+ * blob mutation (ADR-013 D6 / ADR-014 D3). Bytecask never sees keys.
+ */
+
+declare const SIGNATURE_ENTRY = "signature.json";
+declare const SIGNING_ENVELOPE_VERSION = "1";
+declare const SIGNING_ALGORITHM = "ed25519";
+interface ShardSigner {
+    key_id: string;
+    algorithm: typeof SIGNING_ALGORITHM;
+    /** Raw 32-byte Ed25519 public key, base64url. */
+    public_key: string;
+}
+/** The signed payload (never contains its own signature — ADR-014 D2). */
+interface ShardSigningPayload {
+    format_version: typeof SIGNING_ENVELOPE_VERSION;
+    signer: ShardSigner;
+    /** SHA-256 hex of the canonical manifest.json bytes. */
+    manifest_digest: string;
+    /** Sorted bare-hex BLAKE3 digests of referenced sidecar blobs. */
+    blob_digests: string[];
+}
+/** `signature.json` archive entry: the payload plus its base64url signature. */
+interface ShardSignatureEnvelope extends ShardSigningPayload {
+    signature: string;
+}
+interface TrustedKey {
+    key_id: string;
+    /** Raw 32-byte Ed25519 public key, base64url. */
+    public_key: string;
+    revoked?: boolean;
+}
+interface ShardTrustStore {
+    resolve(keyId: string): TrustedKey | null | Promise<TrustedKey | null>;
+}
+/** In-memory allowlist trust store seeded from `{ key_id, public_key }` entries. */
+declare class AllowlistTrustStore implements ShardTrustStore {
+    private keys;
+    constructor(keys: TrustedKey[]);
+    resolve(keyId: string): TrustedKey | null;
+    /** Mark a key revoked without removing it (still resolvable, verdict `revoked`). */
+    revoke(keyId: string): void;
+}
+type ShardSignatureVerdict = {
+    ok: true;
+    keyId: string;
+} | {
+    ok: false;
+    reason: 'unsigned';
+} | {
+    ok: false;
+    reason: 'malformed';
+    detail: string;
+} | {
+    ok: false;
+    reason: 'unknown-signer';
+    keyId: string;
+} | {
+    ok: false;
+    reason: 'revoked';
+    keyId: string;
+} | {
+    ok: false;
+    reason: 'bad-signature';
+    keyId: string;
+} | {
+    ok: false;
+    reason: 'content-mismatch';
+    detail: string;
+} | {
+    ok: false;
+    reason: 'unsupported';
+};
+/** True when this runtime's WebCrypto verifies Ed25519 (ADR-014 D1). */
+declare function isShardSigningSupported(): Promise<boolean>;
+/** Sorted bare-hex BLAKE3 digests of the sidecar blobs present in the archive. */
+declare function sidecarBlobDigests(files: Map<string, Uint8Array>): string[];
+interface VerifyShardSignatureInput {
+    files: Map<string, Uint8Array>;
+    trustStore: ShardTrustStore;
+}
+/**
+ * Verify a shard's Ed25519 signature over its canonical payload. Pure: reads
+ * archive bytes, resolves the key, checks the signature and the
+ * manifest/blob-digest commitments. No persistence, no mutation.
+ */
+declare function verifyShardSignature(input: VerifyShardSignatureInput): Promise<ShardSignatureVerdict>;
+interface SignShardInput {
+    files: Map<string, Uint8Array>;
+    keyId: string;
+    /** Ed25519 private key (raw 32-byte seed or PKCS8), imported by the caller. */
+    privateKey: CryptoKey;
+    /** Raw 32-byte public key, base64url — embedded in the envelope + trust store. */
+    publicKey: string;
 }
-declare function createBlobStore(archiveName: string): BlobStore;
+/**
+ * Produce the `signature.json` envelope for an assembled archive `files` map.
+ * The caller adds the returned bytes to the archive under {@link SIGNATURE_ENTRY}
+ * (excluded from manifest.checksums — it post-dates the manifest).
+ */
+declare function signShard(input: SignShardInput): Promise<Uint8Array>;
 
 /**
  * Shard format types — matches the fortemi server matric-shard specification.
@@ -533,6 +733,19 @@ interface ImportOptions {
      * bytes. Absent → attachments import as reference-only metadata (unchanged).
      */
     blobStore?: BlobStore;
+    /**
+     * Publisher-provenance policy for signed shards (#324, ADR-014):
+     * - `require` — reject unsigned or bad-signature shards (default when a
+     *   `trustStore` is supplied);
+     * - `prefer` — verify signed shards; import unsigned ones with a warning;
+     *   still reject a present-but-invalid signature;
+     * - `trusted-local-only` — ignore signatures (own-export import).
+     * When both `trustStore` and this are omitted, verification is skipped
+     * entirely (checksum-only, unchanged behavior).
+     */
+    verifySignature?: 'require' | 'prefer' | 'trusted-local-only';
+    /** Trust store resolving signer key_id → public key (required for `require`/`prefer`). */
+    trustStore?: ShardTrustStore;
 }
 type ImportProgressPhase = 'unpack' | 'validate' | 'collections' | 'notes' | 'skos' | 'templates' | 'links' | 'provenance' | 'embedding_sets' | 'embedding_configs' | 'embeddings' | 'embedding_set_members' | 'graph' | 'communities' | 'index';
 interface ImportProgress {
@@ -577,6 +790,7 @@ interface ShardNote {
     title: string | null;
     original_content: string;
     revised_content: string | null;
+    metadata?: Record<string, unknown> | null;
     collection_id?: string | null;
     attachments?: ShardAttachmentProjection[];
     /** @deprecated Legacy React shard field name. Use `attachments`. */
@@ -621,23 +835,31 @@ interface ShardLink {
     id: string;
     from_note_id: string;
     to_note_id: string | null;
-    to_url: string | null;
+    /** Optional for legacy React shards exported before URL links existed. */
+    to_url?: string | null;
     kind: string;
     score: number | null;
     created_at: string;
-    metadata: Record<string, unknown> | null;
+    /** Optional for legacy React shards exported before link metadata existed. */
+    metadata?: Record<string, unknown> | null;
 }
-/** Embedding set as serialized in the shard JSON array. */
+/**
+ * Embedding set as serialized in the shard JSON array.
+ *
+ * Fields beyond id/model/dimension are optional for backward compatibility:
+ * legacy React shards omit them and import falls back to the same defaults
+ * `embeddingSetFromShard` applies (name → model, is_system → false, …).
+ */
 interface ShardEmbeddingSet {
     id: string;
-    name: string;
-    slug: string | null;
-    description: string | null;
-    purpose: string | null;
-    document_count: number;
-    embedding_count: number;
-    is_system: boolean;
-    keywords: string[];
+    name?: string;
+    slug?: string | null;
+    description?: string | null;
+    purpose?: string | null;
+    document_count?: number;
+    embedding_count?: number;
+    is_system?: boolean;
+    keywords?: string[];
     model: string;
     dimension: number;
     kind?: 'physical' | 'filter' | 'virtual';
@@ -657,9 +879,12 @@ interface ShardEmbeddingSetMember {
     note_id: string;
     /** Legacy React shard field; new exports use server membership metadata instead. */
     embedding_id?: string;
-    membership_type: string;
-    added_at: string;
-    added_by: string | null;
+    /** Optional for legacy React shards; import defaults to 'materialized'. */
+    membership_type?: string;
+    /** Optional for legacy React shards; import falls back to the manifest timestamp. */
+    added_at?: string;
+    /** Optional for legacy React shards; import defaults to NULL. */
+    added_by?: string | null;
 }
 /** Embedding config as serialized in the shard JSON array. */
 interface ShardEmbeddingConfig {
@@ -672,14 +897,21 @@ interface ShardEmbeddingConfig {
     chunk_overlap: number;
     is_default: boolean;
 }
-/** Embedding as serialized in the shard JSONL. */
+/**
+ * Embedding as serialized in the shard JSONL.
+ *
+ * Server metadata fields (`chunk_index`, `text`, `model`) are optional for
+ * backward compatibility: legacy React shards exported before migration 0016
+ * carry only `id`, `note_id`, `embedding_set_id`, `vector`, `created_at`.
+ * Import normalizes absent metadata to schema defaults (0, '', NULL).
+ */
 interface ShardEmbedding {
     id: string;
     note_id: string;
-    chunk_index: number;
-    text: string;
+    chunk_index?: number;
+    text?: string;
     vector: number[];
-    model: string;
+    model?: string;
     /** React shard extension used to preserve local embedding-set scoping. */
     embedding_set_id?: string;
     /** React shard extension used to preserve local creation ordering. */
@@ -743,79 +975,6 @@ interface ShardArtifactFreshness {
     };
 }
 
-/**
- * LinksRepository — bidirectional note link management.
- *
- * Responsibilities:
- * - Create typed links between notes with duplicate prevention
- * - Soft-delete links
- * - Query outbound, inbound, and backlinks for a note
- */
-
-interface LinkRow {
-    id: string;
-    source_note_id: string;
-    target_note_id: string;
-    link_type: string;
-    confidence: number | null;
-    created_at: Date;
-    updated_at: Date | null;
-    deleted_at: Date | null;
-}
-declare class LinksRepository {
-    private db;
-    constructor(db: DatabaseClient);
-    create(sourceNoteId: string, targetNoteId: string, linkType?: string): Promise<LinkRow>;
-    get(id: string): Promise<LinkRow>;
-    listForNote(noteId: string): Promise<{
-        outbound: LinkRow[];
-        inbound: LinkRow[];
-    }>;
-    getBacklinks(noteId: string): Promise<string[]>;
-    delete(id: string): Promise<void>;
-}
-
-/**
- * CollectionsRepository — folder/category management for notes.
- *
- * Responsibilities:
- * - Create, read, update, and soft-delete collections
- * - Prevent circular parent references
- * - Assign and unassign notes from collections
- * - Return flat list and shallow tree views
- */
-
-interface CollectionRow {
-    id: string;
-    name: string;
-    description: string | null;
-    parent_id: string | null;
-    position: number;
-    created_at: Date;
-    updated_at: Date;
-    deleted_at: Date | null;
-}
-interface CollectionCreateInput {
-    name: string;
-    description?: string;
-    parent_id?: string;
-}
-declare class CollectionsRepository {
-    private db;
-    constructor(db: DatabaseClient);
-    create(input: CollectionCreateInput): Promise<CollectionRow>;
-    get(id: string): Promise<CollectionRow>;
-    list(): Promise<CollectionRow[]>;
-    listTree(): Promise<Array<CollectionRow & {
-        children: CollectionRow[];
-    }>>;
-    update(id: string, fields: Partial<Pick<CollectionRow, 'name' | 'description' | 'parent_id' | 'position'>>): Promise<CollectionRow>;
-    delete(id: string): Promise<void>;
-    assignNote(collectionId: string, noteId: string): Promise<void>;
-    unassignNote(collectionId: string, noteId: string): Promise<void>;
-    getNotesInCollection(collectionId: string): Promise<string[]>;
-}
-
 /**
  * Field mapper — converts between browser schema and shard (server) schema.
  *
@@ -836,6 +995,7 @@ interface BrowserNoteExport {
     deleted_at: Date | string | null;
     original_content: string;
     revised_content: string | null;
+    ai_metadata?: Record<string, unknown> | null;
     collection_id?: string | null;
     attachments?: ShardAttachmentProjection[];
     tags: string[];
@@ -844,8 +1004,15 @@ interface BrowserNoteExport {
 declare function noteToShard(note: BrowserNoteExport): ShardNote;
 /** Convert a shard note back to browser-insertable format. */
 declare function noteFromShard(shard: ShardNote): BrowserNoteExport;
-/** Convert a browser link to shard format. */
-declare function linkToShard(link: LinkRow): ShardLink;
+/** Convert a browser link to shard format (accepts SQL rows or canonical ISO-string records). */
+declare function linkToShard(link: {
+    id: string;
+    source_note_id: string;
+    target_note_id: string;
+    link_type: string;
+    confidence: number | null;
+    created_at: Date | string;
+}): ShardLink;
 /** Convert a browser URL-target link row to shard format. */
 declare function urlLinkToShard(link: {
     id: string;
@@ -867,8 +1034,14 @@ declare function linkFromShard(shard: ShardLink): {
     created_at: string;
     metadata: Record<string, unknown> | null;
 };
-/** Convert a browser collection to shard format. */
-declare function collectionToShard(collection: CollectionRow, noteCount?: number): ShardCollection;
+/** Convert a browser collection to shard format (accepts SQL rows or canonical ISO-string records). */
+declare function collectionToShard(collection: {
+    id: string;
+    name: string;
+    description: string | null;
+    parent_id: string | null;
+    created_at: Date | string;
+}, noteCount?: number): ShardCollection;
 /** Convert a shard collection back to browser-insertable format. */
 declare function collectionFromShard(shard: ShardCollection): {
     id: string;
@@ -975,7 +1148,7 @@ declare function embeddingFromShard(shard: ShardEmbedding): {
     chunk_index: number;
     text: string;
     vector: string;
-    model: string;
+    model: string | null;
     created_at: string | null;
 };
 declare function skosSchemeToShard(scheme: {
@@ -1632,6 +1805,34 @@ declare function createRoutes(): RouteHandler[];
  */
 declare function matchRoute(routes: RouteHandler[], request: Request, url: URL): RouteHandler | null;
 
+/**
+ * One-shot migration of the pre-bytecask blob layout into the new store.
+ *
+ * The legacy layout (shipped through v2026.7.x) was:
+ *   - IndexedDB: database `fortemi-<archive>-blobs`, object store `blobs`,
+ *     values keyed by the full checksum string (`blake3:<hex>`, historically
+ *     also `sha256:<hex>`).
+ *   - OPFS: directory `fortemi-<archive>-blobs/<h0h1>/<h2h3>/<checksum>`.
+ *
+ * Migration re-`put()`s every payload — the new store recomputes BLAKE3, so
+ * legacy `sha256:`-keyed entries converge to canonical keys for free
+ * (ADR-012 D3). The legacy source is deleted only after every entry migrated
+ * without error; any failure leaves it untouched for the next attempt.
+ */
+
+/** Outcome of one migration attempt (for diagnostics/logging). */
+interface LegacyMigrationReport {
+    migrated: number;
+    /** Migration aborted without deleting the legacy source. */
+    failed: boolean;
+}
+/**
+ * Migrate any legacy blob layout for `archiveName` into `target`, then delete
+ * the legacy source. Failures are contained: the legacy data stays in place
+ * and the new store keeps whatever was already re-put (idempotent on retry).
+ */
+declare function migrateLegacyBlobStore(archiveName: string, target: BlobStore, indexedDbFactory?: IDBFactory): Promise<LegacyMigrationReport>;
+
 /**
  * Shared postMessage protocol types for the PGlite worker.
  *
@@ -1967,6 +2168,13 @@ interface NoteCreateInput {
     visibility?: string;
     tags?: string[];
     archive_id?: string;
+    /**
+     * Explicit primary key. When omitted a UUIDv7 is minted (the default). Supply
+     * this only for deterministic seeding or cross-instance identity — e.g. two
+     * in-browser databases that must agree on a shared note's id so a shard swap
+     * can dedupe it under the `skip` conflict strategy.
+     */
+    id?: string;
 }
 interface NoteUpdateInput {
     title?: string;
@@ -2446,6 +2654,79 @@ declare class TagsRepository {
     }>>;
 }
 
+/**
+ * CollectionsRepository — folder/category management for notes.
+ *
+ * Responsibilities:
+ * - Create, read, update, and soft-delete collections
+ * - Prevent circular parent references
+ * - Assign and unassign notes from collections
+ * - Return flat list and shallow tree views
+ */
+
+interface CollectionRow {
+    id: string;
+    name: string;
+    description: string | null;
+    parent_id: string | null;
+    position: number;
+    created_at: Date;
+    updated_at: Date;
+    deleted_at: Date | null;
+}
+interface CollectionCreateInput {
+    name: string;
+    description?: string;
+    parent_id?: string;
+}
+declare class CollectionsRepository {
+    private db;
+    constructor(db: DatabaseClient);
+    create(input: CollectionCreateInput): Promise<CollectionRow>;
+    get(id: string): Promise<CollectionRow>;
+    list(): Promise<CollectionRow[]>;
+    listTree(): Promise<Array<CollectionRow & {
+        children: CollectionRow[];
+    }>>;
+    update(id: string, fields: Partial<Pick<CollectionRow, 'name' | 'description' | 'parent_id' | 'position'>>): Promise<CollectionRow>;
+    delete(id: string): Promise<void>;
+    assignNote(collectionId: string, noteId: string): Promise<void>;
+    unassignNote(collectionId: string, noteId: string): Promise<void>;
+    getNotesInCollection(collectionId: string): Promise<string[]>;
+}
+
+/**
+ * LinksRepository — bidirectional note link management.
+ *
+ * Responsibilities:
+ * - Create typed links between notes with duplicate prevention
+ * - Soft-delete links
+ * - Query outbound, inbound, and backlinks for a note
+ */
+
+interface LinkRow {
+    id: string;
+    source_note_id: string;
+    target_note_id: string;
+    link_type: string;
+    confidence: number | null;
+    created_at: Date;
+    updated_at: Date | null;
+    deleted_at: Date | null;
+}
+declare class LinksRepository {
+    private db;
+    constructor(db: DatabaseClient);
+    create(sourceNoteId: string, targetNoteId: string, linkType?: string): Promise<LinkRow>;
+    get(id: string): Promise<LinkRow>;
+    listForNote(noteId: string): Promise<{
+        outbound: LinkRow[];
+        inbound: LinkRow[];
+    }>;
+    getBacklinks(noteId: string): Promise<string[]>;
+    delete(id: string): Promise<void>;
+}
+
 /**
  * SkosRepository — SKOS taxonomy management (schemes, concepts, relations).
  *
@@ -2603,19 +2884,19 @@ declare const CaptureKnowledgeInputSchema: z.ZodObject<{
     }, {
         content: string;
         title?: string | undefined;
-        format?: "markdown" | "plain" | "html" | undefined;
         tags?: string[] | undefined;
+        format?: "markdown" | "plain" | "html" | undefined;
     }>, "many">>;
     template: z.ZodOptional<z.ZodString>;
     variables: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
 }, "strip", z.ZodTypeAny, {
     source: string;
     format: "markdown" | "plain" | "html";
-    visibility: "private" | "shared" | "public";
+    visibility: "private" | "public" | "shared";
     action: "create" | "bulk_create" | "from_template";
     title?: string | undefined;
-    archive_id?: string | undefined;
     tags?: string[] | undefined;
+    archive_id?: string | undefined;
     content?: string | undefined;
     notes?: {
         format: "markdown" | "plain" | "html";
@@ -2629,16 +2910,16 @@ declare const CaptureKnowledgeInputSchema: z.ZodObject<{
     action: "create" | "bulk_create" | "from_template";
     source?: string | undefined;
     title?: string | undefined;
-    archive_id?: string | undefined;
-    format?: "markdown" | "plain" | "html" | undefined;
-    visibility?: "private" | "shared" | "public" | undefined;
     tags?: string[] | undefined;
+    format?: "markdown" | "plain" | "html" | undefined;
+    archive_id?: string | undefined;
+    visibility?: "private" | "public" | "shared" | undefined;
     content?: string | undefined;
     notes?: {
         content: string;
         title?: string | undefined;
-        format?: "markdown" | "plain" | "html" | undefined;
         tags?: string[] | undefined;
+        format?: "markdown" | "plain" | "html" | undefined;
     }[] | undefined;
     template?: string | undefined;
     variables?: Record<string, string> | undefined;
@@ -2688,14 +2969,14 @@ declare const SearchInputSchema: z.ZodObject<{
     limit: number;
     offset: number;
     include_facets: boolean;
-    mode: "auto" | "text" | "semantic" | "hybrid";
+    mode: "text" | "auto" | "semantic" | "hybrid";
     query: string;
     source?: string | undefined;
+    tags?: string[] | undefined;
     format?: "markdown" | "plain" | "html" | undefined;
-    visibility?: "private" | "shared" | "public" | undefined;
+    visibility?: "private" | "public" | "shared" | undefined;
     is_starred?: boolean | undefined;
     is_archived?: boolean | undefined;
-    tags?: string[] | undefined;
     collection_id?: string | undefined;
     date_from?: Date | undefined;
     date_to?: Date | undefined;
@@ -2704,18 +2985,18 @@ declare const SearchInputSchema: z.ZodObject<{
 }, {
     query: string;
     source?: string | undefined;
+    tags?: string[] | undefined;
     format?: "markdown" | "plain" | "html" | undefined;
-    visibility?: "private" | "shared" | "public" | undefined;
+    visibility?: "private" | "public" | "shared" | undefined;
     is_starred?: boolean | undefined;
     is_archived?: boolean | undefined;
-    tags?: string[] | undefined;
     limit?: number | undefined;
     offset?: number | undefined;
     collection_id?: string | undefined;
     date_from?: Date | undefined;
     date_to?: Date | undefined;
     include_facets?: boolean | undefined;
-    mode?: "auto" | "text" | "semantic" | "hybrid" | undefined;
+    mode?: "text" | "auto" | "semantic" | "hybrid" | undefined;
     embeddingSetId?: string | undefined;
     query_embedding?: number[] | undefined;
 }>;
@@ -2795,20 +3076,20 @@ declare const ListNotesInputSchema: z.ZodObject<{
     collection_id: z.ZodOptional<z.ZodString>;
     include_deleted: z.ZodOptional<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
-    sort: "created_at" | "updated_at" | "title";
+    sort: "updated_at" | "title" | "created_at";
     limit: number;
     offset: number;
     order: "asc" | "desc";
+    tags?: string[] | undefined;
     is_starred?: boolean | undefined;
     is_archived?: boolean | undefined;
-    tags?: string[] | undefined;
     include_deleted?: boolean | undefined;
     collection_id?: string | undefined;
 }, {
-    sort?: "created_at" | "updated_at" | "title" | undefined;
+    tags?: string[] | undefined;
+    sort?: "updated_at" | "title" | "created_at" | undefined;
     is_starred?: boolean | undefined;
     is_archived?: boolean | undefined;
-    tags?: string[] | undefined;
     limit?: number | undefined;
     offset?: number | undefined;
     order?: "asc" | "desc" | undefined;
@@ -2851,16 +3132,16 @@ declare const ManageCollectionsInputSchema: z.ZodObject<{
     note_id: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     action: "create" | "delete" | "list" | "assign" | "unassign" | "list_tree";
+    name?: string | undefined;
     collection_id?: string | undefined;
     note_id?: string | undefined;
-    name?: string | undefined;
     description?: string | undefined;
     parent_id?: string | undefined;
 }, {
     action: "create" | "delete" | "list" | "assign" | "unassign" | "list_tree";
+    name?: string | undefined;
     collection_id?: string | undefined;
     note_id?: string | undefined;
-    name?: string | undefined;
     description?: string | undefined;
     parent_id?: string | undefined;
 }>;
@@ -2959,11 +3240,13 @@ declare function manageCapabilities(capabilityManager: CapabilityManager, rawInp
  * AttachmentsRepository — attach and retrieve binary files linked to notes.
  *
  * Responsibilities:
- * - Content-addressed blob deduplication via SHA-256 hash
+ * - Content-addressed blob deduplication via the store-computed BLAKE3 hash
  * - Store blob metadata in DatabaseClient (attachment_blob table)
- * - Store binary data in a BlobStore implementation
+ * - Store binary data in a BlobStore implementation (bytes-first ordering)
  * - Create/soft-delete attachment records linked to notes
  * - List active attachments for a note
+ * - Reconcile/GC blob bytes against the canonical manifest live set
+ *   (ADR-013 D2/D4: manifests are the sole lifecycle authority)
  */
 
 interface AttachmentRow {
@@ -3001,11 +3284,16 @@ declare class AttachmentsRepository {
     /**
      * Attach a binary file to a note.
      *
-     * If a blob with the same BLAKE3 content hash already exists, the existing
-     * blob row is reused (deduplication). Otherwise a new blob row is inserted
-     * and the raw bytes are written to the BlobStore. The BLAKE3 `content_hash`
-     * (`blake3:<hex>`) matches the server convention and is the key used by the
-     * portable Knowledge-Shard byte sidecar.
+     * Bytes are written first (`put()` is idempotent — content addressing makes
+     * replays safe), then the metadata rows commit (ADR-013 D5). A crash
+     * between the two leaves an unreferenced blob that reconcile/gc sweeps —
+     * never a manifest without recoverable state. The store-computed BLAKE3
+     * `content_hash` (`blake3:<hex>`) matches the server convention and is the
+     * key used by the portable Knowledge-Shard byte sidecar.
+     *
+     * If a blob row with the same content hash already exists, it is reused
+     * (deduplication) — re-putting the bytes also heals a previously
+     * reference-only blob whose bytes went missing.
      *
      * Returns the newly created AttachmentRow.
      */
@@ -3017,9 +3305,16 @@ declare class AttachmentsRepository {
     get(id: string): Promise<AttachmentRow>;
     /**
      * Retrieve the raw binary data for an attachment.
-     * Returns null if the blob cannot be found in the BlobStore.
+     * Returns null when the bytes are not present — the attachment is then in
+     * the recoverable reference-only state (metadata intact, bytes
+     * re-hydratable from a shard sidecar or a re-attach of the same content).
      */
     getBlob(attachmentId: string): Promise<Uint8Array | null>;
+    /**
+     * True when the attachment's bytes are physically present in the BlobStore.
+     * False means reference-only (recoverable), not an error.
+     */
+    hasBlob(attachmentId: string): Promise<boolean>;
     /**
      * List active (non-deleted) attachments for a note.
      * Ordered by position ascending, then created_at ascending.
@@ -3027,9 +3322,29 @@ declare class AttachmentsRepository {
     list(noteId: string): Promise<AttachmentRow[]>;
     /**
      * Soft-delete an attachment by setting deleted_at to the current timestamp.
-     * The underlying blob row and BlobStore data are not removed.
+     * The blob row is untouched and no bytes are removed inline — physical
+     * removal happens only through deferred `reconcileBlobs()`/`gcBlobs()`
+     * against the canonical live set (ADR-013 D4).
      */
     delete(id: string): Promise<void>;
+    /**
+     * The authoritative live-checksum set: content hashes referenced by at
+     * least one non-deleted attachment. This — not any refcount — decides
+     * which bytes are reachable.
+     */
+    liveBlobChecksums(): Promise<string[]>;
+    /**
+     * Reconcile the BlobStore against the canonical live set (startup, after
+     * quota events, after interrupted writes). `missing` lists reference-only
+     * checksums; `unreferenced` lists GC candidates.
+     */
+    reconcileBlobs(opts?: BlobReconcileOptions): Promise<BlobReconcileResult>;
+    /**
+     * Deferred, age-thresholded physical removal of unreachable bytes.
+     * Runs a reconcile first so GC always acts on current manifest truth.
+     */
+    gcBlobs(opts?: BlobGcOptions): Promise<BlobGcResult>;
+    private blobChecksumOf;
 }
 
 declare const ManageAttachmentsInputSchema: z.ZodObject<{
@@ -3842,6 +4157,12 @@ declare function sha256Hex(data: Uint8Array): Promise<string>;
  * checked against the whole archive (see `prefetchShard`'s `expectedSha256`,
  * which is real integrity because the hash arrives on a separate channel).
  *
+ * The signed-manifest path is now implemented: `verifyShardSignature`
+ * (`shard-signature.ts`, #324/ADR-014) authenticates publisher provenance via
+ * an Ed25519 signature over the manifest digest + blob-digest set, and
+ * `importShard` runs it BEFORE any record or blob mutation. These in-archive
+ * checksums remain the consistency layer *inside* that verified boundary.
+ *
  * @returns Object with `valid` flag and list of failed filenames.
  */
 declare function validateChecksums(checksums: Record<string, string>, files: Map<string, Uint8Array>): Promise<{
@@ -4237,6 +4558,16 @@ interface AiwgIndexValidationResult {
     errors: string[];
     counts: Partial<Record<string, number>>;
 }
+interface AiwgKnowledgeShardOptions {
+    createdAt?: string;
+    matricVersion?: string;
+    /**
+     * Include React-native SKOS and provenance component files. The default
+     * portable profile keeps those projections in lossless note metadata so the
+     * shard remains importable by the current Fortemi server.
+     */
+    includeNativeRichComponents?: boolean;
+}
 interface AiwgChunkedIndexValidationResult {
     valid: boolean;
     errors: string[];
@@ -4527,7 +4858,499 @@ declare function aiwgFortemiIndexToCommunityGraph(index: AiwgFortemiIndexExport,
         nodes: string[];
     }[];
 };
+/**
+ * Convert the static AIWG/Fortemi v2 index contract into a portable Knowledge
+ * Shard. Every note retains the complete source envelope and record in metadata,
+ * so the native note/link/SKOS/provenance projections are reversible.
+ */
+declare function aiwgFortemiIndexToKnowledgeShard(index: AiwgFortemiIndexExport, options?: AiwgKnowledgeShardOptions): Promise<Uint8Array>;
+/**
+ * Recover the exact AIWG index envelope and records embedded by
+ * {@link aiwgFortemiIndexToKnowledgeShard}.
+ */
+declare function aiwgFortemiIndexFromKnowledgeShard(bytes: Uint8Array): AiwgFortemiIndexExport;
+
+/**
+ * Canonical RecordStore contract — the writable structured-record layer that
+ * exists independently of PGlite (#323, ADR-013 D3).
+ *
+ * Records mirror the browser SQL rows one-to-one (same field names, ISO-8601
+ * timestamp strings) so the optional PGlite projection is a row-for-row
+ * replay of the change journal — rebuildable at any time without touching
+ * canonical records or attachment bytes.
+ */
+interface NoteRecord0 {
+    id: string;
+    archive_id: string | null;
+    title: string | null;
+    format: string;
+    source: string;
+    visibility: string;
+    revision_mode: string;
+    is_starred: boolean;
+    is_pinned: boolean;
+    is_archived: boolean;
+    created_at: string;
+    updated_at: string;
+    deleted_at: string | null;
+}
+interface NoteOriginalRecord {
+    id: string;
+    note_id: string;
+    content: string;
+    content_hash: string;
+    created_at: string;
+}
+interface NoteRevisedCurrentRecord {
+    /** Keyed by note id (mirrors the SQL PK `note_id`). */
+    id: string;
+    content: string;
+    ai_metadata: unknown | null;
+    generation_count: number;
+    model: string | null;
+    is_user_edited: boolean;
+    updated_at: string;
+}
+interface NoteTagRecord {
+    id: string;
+    note_id: string;
+    tag: string;
+    created_at: string;
+}
+interface LinkRecord0 {
+    id: string;
+    source_note_id: string;
+    target_note_id: string;
+    link_type: string;
+    created_at: string;
+    deleted_at: string | null;
+}
+interface CollectionRecord {
+    id: string;
+    name: string;
+    description: string | null;
+    created_at: string;
+    updated_at: string;
+    deleted_at: string | null;
+}
+interface CollectionNoteRecord {
+    id: string;
+    collection_id: string;
+    note_id: string;
+    created_at: string;
+}
+interface AttachmentRecord {
+    id: string;
+    note_id: string;
+    blob_id: string;
+    document_type_id: string | null;
+    mime_type: string | null;
+    extracted_text: string | null;
+    filename: string;
+    display_name: string | null;
+    position: number;
+    created_at: string;
+    deleted_at: string | null;
+}
+interface AttachmentBlobRecord {
+    id: string;
+    content_hash: string;
+    size_bytes: number;
+    created_at: string;
+}
+/** Collection name → record type. The store is generic over this map. */
+interface RecordCollections {
+    note: NoteRecord0;
+    note_original: NoteOriginalRecord;
+    note_revised_current: NoteRevisedCurrentRecord;
+    note_tag: NoteTagRecord;
+    link: LinkRecord0;
+    collection: CollectionRecord;
+    collection_note: CollectionNoteRecord;
+    attachment: AttachmentRecord;
+    attachment_blob: AttachmentBlobRecord;
+}
+type RecordCollectionName = keyof RecordCollections;
+declare const RECORD_COLLECTIONS: readonly RecordCollectionName[];
+/**
+ * One committed mutation. Journal entries carry the full record snapshot so
+ * the PGlite projection (and any other consumer) can replay mutations without
+ * re-reading canonical state, and so a rebuild has a total order to follow.
+ */
+interface JournalEntry {
+    /** Monotonically increasing commit sequence (assigned by the store). */
+    seq: number;
+    /** ISO-8601 commit timestamp. */
+    ts: string;
+    op: 'put' | 'delete';
+    collection: RecordCollectionName;
+    id: string;
+    /** Snapshot for `put`; absent for `delete`. */
+    record?: RecordCollections[RecordCollectionName];
+}
+/**
+ * What the canonical record tier can and cannot serve, reported explicitly
+ * (never emulated badly). Advanced capabilities may require the optional
+ * PGlite projection (ADR-013 D3).
+ */
+interface RecordStoreCapabilities {
+    crud: true;
+    journal: true;
+    /** Bounded substring scan over titles/content — not ranked FTS. */
+    boundedTextScan: true;
+    fullTextSearch: false;
+    vectorSearch: false;
+    sqlJoins: false;
+}
+declare const RECORD_STORE_CAPABILITIES: RecordStoreCapabilities;
+interface RecordListOptions {
+    /** Maximum records returned (applied after filtering). */
+    limit?: number;
+}
+/**
+ * The writable canonical structured-record store. Implementations MUST make
+ * each `put`/`remove` an atomic commit of the record mutation plus its
+ * journal entry (the recoverable commit protocol): a torn write leaves
+ * neither, never one without the other.
+ */
+interface RecordStore {
+    get<C extends RecordCollectionName>(collection: C, id: string): Promise<RecordCollections[C] | null>;
+    /** Insert or replace one record, journaled atomically. */
+    put<C extends RecordCollectionName>(collection: C, record: RecordCollections[C]): Promise<JournalEntry>;
+    /** Hard-remove one record, journaled atomically (soft-delete is a field upstream). */
+    remove(collection: RecordCollectionName, id: string): Promise<JournalEntry>;
+    /** All records of a collection (insertion order not guaranteed). */
+    list<C extends RecordCollectionName>(collection: C, opts?: RecordListOptions): Promise<RecordCollections[C][]>;
+    /** Journal entries with `seq > sinceSeq`, ascending. */
+    journalSince(sinceSeq: number, limit?: number): Promise<JournalEntry[]>;
+    /** Highest committed sequence (0 when empty). */
+    headSeq(): Promise<number>;
+    readonly capabilities: RecordStoreCapabilities;
+    close(): Promise<void>;
+}
+
+/**
+ * In-memory RecordStore — the test/SSR tier of the canonical record layer.
+ * Same commit semantics as the durable store: record + journal move together.
+ */
+
+declare class MemoryRecordStore implements RecordStore {
+    readonly capabilities: RecordStoreCapabilities;
+    private collections;
+    private journal;
+    private seq;
+    private table;
+    get<C extends RecordCollectionName>(collection: C, id: string): Promise<RecordCollections[C] | null>;
+    put<C extends RecordCollectionName>(collection: C, record: RecordCollections[C]): Promise<JournalEntry>;
+    remove(collection: RecordCollectionName, id: string): Promise<JournalEntry>;
+    list<C extends RecordCollectionName>(collection: C, opts?: RecordListOptions): Promise<RecordCollections[C][]>;
+    journalSince(sinceSeq: number, limit?: number): Promise<JournalEntry[]>;
+    headSeq(): Promise<number>;
+    close(): Promise<void>;
+}
+
+/**
+ * Durable canonical RecordStore over IndexedDB (#323, ADR-013 D3).
+ *
+ * One database per archive namespace: `fortemi-<archive>-records`. Object
+ * stores: one per record collection (keyPath `id`), plus `journal`
+ * (autoIncrement `seq`) and `meta` (schema version).
+ *
+ * Recoverable commit protocol (ADR-013 D5): every mutation writes the record
+ * change AND its journal entry in a single IndexedDB transaction, so a torn
+ * write commits neither. The journal `seq` is the total order the optional
+ * PGlite projection consumes.
+ *
+ * Schema evolution: `meta.schemaVersion` records the logical record-schema
+ * version; `migrate` hooks run inside the version-change transaction when the
+ * database structure grows. Additive-only, mirroring the SQL migration
+ * discipline.
+ */
+
+/** Logical record-schema version stored in `meta` (independent of DB_VERSION). */
+declare const RECORD_SCHEMA_VERSION = 1;
+interface CreateRecordStoreOptions {
+    /** Injectable factory for tests (fake-indexeddb). Defaults to the global. */
+    indexedDB?: IDBFactory;
+}
+declare class IdbRecordStore implements RecordStore {
+    private db;
+    readonly capabilities: RecordStoreCapabilities;
+    private constructor();
+    static open(archiveName: string, options?: CreateRecordStoreOptions): Promise<IdbRecordStore>;
+    private ensureSchemaVersion;
+    get<C extends RecordCollectionName>(collection: C, id: string): Promise<RecordCollections[C] | null>;
+    put<C extends RecordCollectionName>(collection: C, record: RecordCollections[C]): Promise<JournalEntry>;
+    remove(collection: RecordCollectionName, id: string): Promise<JournalEntry>;
+    list<C extends RecordCollectionName>(collection: C, opts?: RecordListOptions): Promise<RecordCollections[C][]>;
+    journalSince(sinceSeq: number, limit?: number): Promise<JournalEntry[]>;
+    headSeq(): Promise<number>;
+    close(): Promise<void>;
+}
+/** Open the durable canonical record store for one archive namespace. */
+declare function createRecordStore(archiveName: string, options?: CreateRecordStoreOptions): Promise<IdbRecordStore>;
+
+/**
+ * Canonical notes repository — DB-free note/tag/link/collection workflows
+ * over the RecordStore (#323). Mirrors the SQL repositories' semantics
+ * (UUIDv7 ids, immutable note_original, mutable note_revised_current,
+ * soft-delete everywhere) so the PGlite projection replay is row-for-row.
+ *
+ * Query tier: id/recent/tag/link/collection lookups plus a bounded substring
+ * text scan. Ranked FTS, vectors, and complex joins are explicitly NOT
+ * served here — `store.capabilities` reports the boundary (ADR-013 D3).
+ */
+
+interface CanonicalNoteCreateInput {
+    id?: string;
+    title?: string;
+    content: string;
+    format?: string;
+    source?: string;
+    visibility?: string;
+}
+interface CanonicalNoteUpdateInput {
+    title?: string;
+    content?: string;
+    format?: string;
+    visibility?: string;
+    is_starred?: boolean;
+    is_pinned?: boolean;
+    is_archived?: boolean;
+}
+interface CanonicalNoteView {
+    note: NoteRecord0;
+    original_content: string;
+    revised_content: string;
+    tags: string[];
+}
+declare class CanonicalNotesRepository {
+    private store;
+    constructor(store: RecordStore);
+    create(input: CanonicalNoteCreateInput): Promise<CanonicalNoteView>;
+    get(noteId: string): Promise<CanonicalNoteView | null>;
+    update(noteId: string, input: CanonicalNoteUpdateInput): Promise<CanonicalNoteView>;
+    /** Soft-delete: sets `deleted_at`; the record (and history) remains. */
+    softDelete(noteId: string): Promise<void>;
+    restore(noteId: string): Promise<void>;
+    /** Non-deleted notes, most recently updated first. */
+    listRecent(limit?: number): Promise<NoteRecord0[]>;
+    /**
+     * Bounded substring scan over title + revised content (case-insensitive).
+     * This is deliberately not ranked FTS — see `store.capabilities`.
+     */
+    searchText(query: string, limit?: number): Promise<NoteRecord0[]>;
+    addTag(noteId: string, tag: string): Promise<void>;
+    removeTag(noteId: string, tag: string): Promise<void>;
+    notesByTag(tag: string): Promise<NoteRecord0[]>;
+    createLink(sourceNoteId: string, targetNoteId: string, linkType?: string): Promise<LinkRecord0>;
+    softDeleteLink(linkId: string): Promise<void>;
+    /** Active links touching a note (either direction). */
+    linksOf(noteId: string): Promise<LinkRecord0[]>;
+    createCollection(name: string, description?: string): Promise<CollectionRecord>;
+    addNoteToCollection(collectionId: string, noteId: string): Promise<void>;
+    notesInCollection(collectionId: string): Promise<NoteRecord0[]>;
+}
+
+/**
+ * Canonical attachments repository — DB-free attachment manifests over the
+ * RecordStore, bytes through the Bytecask BlobStore (#323, ADR-013 D2/D4/D5).
+ *
+ * Same lifecycle semantics as the SQL-backed AttachmentsRepository: bytes
+ * first (idempotent put), then manifest commit; soft-delete never removes
+ * bytes inline; the manifest-derived live set drives reconcile/gc; missing
+ * bytes are the recoverable reference-only state.
+ */
+
+interface CanonicalAttachInput {
+    noteId: string;
+    data: Uint8Array;
+    filename: string;
+    mimeType?: string;
+    extractedText?: string;
+    displayName?: string;
+}
+declare class CanonicalAttachmentsRepository {
+    private store;
+    private blobStore;
+    constructor(store: RecordStore, blobStore: BlobStore);
+    /** Bytes-first attach (ADR-013 D5); dedupes on the store-computed hash. */
+    attach(input: CanonicalAttachInput): Promise<AttachmentRecord>;
+    get(id: string): Promise<AttachmentRecord>;
+    /** Null when bytes are absent — the recoverable reference-only state. */
+    getBlob(attachmentId: string): Promise<Uint8Array | null>;
+    hasBlob(attachmentId: string): Promise<boolean>;
+    list(noteId: string): Promise<AttachmentRecord[]>;
+    /** Soft-delete the manifest; bytes are only swept via reconcile/gc. */
+    delete(id: string): Promise<void>;
+    /** Authoritative live set: hashes referenced by non-deleted manifests. */
+    liveBlobChecksums(): Promise<string[]>;
+    /** Startup / post-quota reconciliation against canonical manifests (ADR-013 D4). */
+    reconcileBlobs(opts?: BlobReconcileOptions): Promise<BlobReconcileResult>;
+    /** Deferred reachability-based blob GC. */
+    gcBlobs(opts?: BlobGcOptions): Promise<BlobGcResult>;
+    private checksumOf;
+}
+
+/**
+ * PGlite attachment projection (#320, ADR-013 D3).
+ *
+ * Projects canonical attachment state (RecordStore) into the optional PGlite
+ * `attachment_blob` / `attachment` tables. Properties:
+ *
+ * - Idempotent: every row upserts on its primary key; re-running with the
+ *   same canonical state changes nothing.
+ * - Rebuildable: dropping the projection rows and re-projecting yields
+ *   equivalent query results — the canonical records are the source of truth.
+ * - Derived refcounts: `attachment_blob.reference_count` is recomputed from
+ *   live manifests on every projection pass; it is never lifecycle authority
+ *   and no trigger touches it.
+ * - Bytes never enter PGlite; only metadata is projected.
+ */
+
+interface AttachmentProjectionResult {
+    blobs: number;
+    attachments: number;
+}
+/**
+ * Project all canonical attachment records into PGlite. Safe to run at any
+ * time: startup, after journal consumption, or as a full rebuild after the
+ * projection was dropped.
+ *
+ * The parent `note` rows must already exist in the projection (note
+ * projection is the #323 cycle-2 surface); this function owns only the
+ * attachment tables.
+ */
+declare function projectAttachments(db: DatabaseClient, store: RecordStore): Promise<AttachmentProjectionResult>;
+/**
+ * Drop the attachment projection rows (test/rebuild support). Canonical
+ * records and Bytecask bytes are untouched — this is the "PGlite can be
+ * dropped and rebuilt" invariant made executable.
+ */
+declare function dropAttachmentProjection(db: DatabaseClient): Promise<void>;
+
+/**
+ * PGlite record projection — notes tier (#323 cycle 2, ADR-013 D3).
+ *
+ * Projects canonical note / tag / link / collection state (RecordStore) into
+ * the optional PGlite tables, completing the projection the attachment tier
+ * (#320, attachment-projection.ts) deferred to this cycle. Properties:
+ *
+ * - Idempotent: rows upsert on their primary keys; re-running with the same
+ *   canonical state changes nothing.
+ * - Rebuildable: dropping the projection rows and re-projecting yields
+ *   equivalent query results — canonical records are the source of truth.
+ * - Reconciling: canonically hard-removed rows (note_tag, collection_note)
+ *   are deleted from the projection so parity holds after removals, not just
+ *   after inserts.
+ * - Bytes never enter PGlite; `projectRecords` composes this pass with the
+ *   attachment projection for a full canonical → PGlite rebuild.
+ */
+
+interface NoteProjectionResult {
+    notes: number;
+    tags: number;
+    links: number;
+    collections: number;
+    memberships: number;
+}
+interface RecordProjectionResult extends NoteProjectionResult {
+    attachments: AttachmentProjectionResult;
+}
+/**
+ * Project all canonical note-tier records into PGlite. Safe to run at any
+ * time: startup, after journal consumption, or as a full rebuild after the
+ * projection was dropped. Parent rows land before children (note before
+ * note_original / tags / links / memberships) so FKs hold.
+ */
+declare function projectNotes(db: DatabaseClient, store: RecordStore): Promise<NoteProjectionResult>;
+/**
+ * Full canonical → PGlite projection: note tier, then attachment tier
+ * (parents before children). This is the "PGlite is a derived, rebuildable
+ * projection" invariant (#322 acceptance) made executable.
+ */
+declare function projectRecords(db: DatabaseClient, store: RecordStore): Promise<RecordProjectionResult>;
+/**
+ * Drop the note-tier projection rows (test/rebuild support). Canonical
+ * records are untouched. Callers must drop dependent projections first
+ * (attachments via `dropAttachmentProjection`, plus any embedding/SKOS rows
+ * created outside the canonical tier) so FKs allow the deletes.
+ */
+declare function dropNoteProjection(db: DatabaseClient): Promise<void>;
+
+/**
+ * Writable non-PGlite `DataBackend` over the canonical RecordStore
+ * (#323 cycle 2, ADR-013 D3) — the record tier in the backend seam.
+ *
+ * Fills the seam's historical gap: the static shard backend is read-only and
+ * the PGlite backend needs a database. This adapter serves the canonical
+ * repositories' full write surface plus the bounded read tier (id / recent /
+ * tag / link lookups and a bounded substring scan) with instant startup.
+ *
+ * Capability boundary, reported honestly: `semantic: 'none'` (no vectors) and
+ * search is a bounded scan, not ranked FTS. SKOS concepts and provenance
+ * edges are not part of the canonical record collections, so `conceptsOf` /
+ * `provenanceOf` are deliberately absent — callers feature-detect via the
+ * optional methods rather than receiving silently empty emulations.
+ * `merge: true` is served by `importShardToRecords` (record-shard.ts).
+ */
+
+interface RecordBackendOptions {
+    id?: string;
+}
+interface RecordBackendManageNoteResult {
+    action: string;
+    note_id: string;
+    note?: CanonicalNoteView;
+}
+/**
+ * Wrap a canonical `RecordStore` as a writable `DataBackend`. Reads and
+ * writes delegate to `CanonicalNotesRepository`; `manageNote` accepts the
+ * same Zod-validated input as the PGlite tool (update / delete / restore /
+ * archive / unarchive / star / unstar).
+ */
+declare function createRecordBackend(store: RecordStore, options?: RecordBackendOptions): DataBackend;
+
+/**
+ * DB-free Knowledge Shard export/import over the canonical RecordStore
+ * (#323 cycle 2, ADR-013 D3/D6) — the same `.shard` archive format as the
+ * PGlite pipeline (`shard/shard-export.ts` / `shard/shard-import.ts`), built
+ * from and applied to canonical records with zero PGlite.
+ *
+ * Capability boundary (reported, never emulated): the canonical tier holds
+ * notes, tags, note-to-note links, collections, and attachment manifests.
+ * Shard components outside that set (templates, embeddings, SKOS, provenance,
+ * graph/community artifacts, URL links) are skipped on import with explicit
+ * warnings, and are never emitted on export.
+ *
+ * Atomicity: manifest, version, signature (ADR-014 verify-before-persist),
+ * and checksum validation all run BEFORE any record or byte is written, and
+ * `error`-strategy conflicts are pre-scanned so a conflicting archive writes
+ * nothing. Each record commit is then individually atomic and journaled; an
+ * interrupted import leaves a recoverable prefix that a re-import with
+ * `conflictStrategy: 'skip'` completes idempotently.
+ */
+
+/**
+ * Export canonical records as a `.shard` archive (Uint8Array), format-parity
+ * with the PGlite `exportShard`. Honored options: `collectionId` / `tag`
+ * filters, `clusterNotesSize`, and the portable byte sidecar
+ * (`includeBlobs` + `blobStore`). Embedding options are inert — the canonical
+ * tier stores no embeddings, so there is nothing to include.
+ */
+declare function exportShardFromRecords(store: RecordStore, options?: ExportOptions): Promise<Uint8Array>;
+/**
+ * Import a `.shard` archive into the canonical RecordStore (and optionally
+ * hydrate attachment bytes into a Bytecask BlobStore) with zero PGlite.
+ *
+ * Honors `conflictStrategy` (`skip` default / `replace` / `error` — `error`
+ * conflicts are pre-scanned so nothing is written), the ADR-014
+ * `verifySignature`/`trustStore` policy, and byte-sidecar hydration via
+ * `blobStore`. Components the canonical tier cannot persist are skipped with
+ * explicit warnings and reported under `skipped`.
+ */
+declare function importShardToRecords(store: RecordStore, data: Uint8Array | ArrayBuffer, options?: ImportOptions): Promise<ImportResult>;
 
-declare const VERSION = "2026.7.5";
+declare const VERSION = "2026.7.8";
 
-export { AIWG_SCAN_REQUIRED_FIELDS, type AiwgChunkedIndexBuildOptions, type AiwgChunkedIndexBuildResult, type AiwgChunkedIndexDetailLoader, type AiwgChunkedIndexLoadOptions, type AiwgChunkedIndexLoader, type AiwgChunkedIndexProgress, type AiwgChunkedIndexProgressPhase, type AiwgChunkedIndexQueryOptions, type AiwgChunkedIndexQueryResult, type AiwgChunkedIndexValidationResult, type AiwgFortemiAttachmentReference, type AiwgFortemiBinarySource, type AiwgFortemiChunk, type AiwgFortemiChunkDetailRef, type AiwgFortemiChunkManifest, type AiwgFortemiChunkPart, type AiwgFortemiChunkPartRef, type AiwgFortemiIndexExport, type AiwgFortemiIndexExportSchemaVersion, type AiwgFortemiProjectedRecord, type AiwgFortemiProvenance, type AiwgFortemiProvenanceEvent, type AiwgFortemiRecord, type AiwgFortemiRecordEmbedding, type AiwgFortemiRecordSchemaVersion, type AiwgFortemiRecordSource, type AiwgFortemiRecordType, type AiwgFortemiRelationship, type AiwgFortemiRelationshipDirection, type AiwgFortemiSearchProjection, type AiwgFortemiSkosConcept, type AiwgFortemiSkosRelation, type AiwgFortemiSkosRelationType, type AiwgHeadlessEmbeddingBackend, type AiwgIndexController, type AiwgIndexControllerListener, type AiwgIndexControllerSnapshot, type AiwgIndexGraphOptions, type AiwgIndexQueryMatch, type AiwgIndexQueryOptions, type AiwgIndexQueryRankedItem, type AiwgIndexQueryResult, type AiwgIndexQueryWeights, type AiwgIndexValidationResult, type AiwgPrivacyClassification, type AiwgPrivacyFilterOptions, type AiwgProvenanceConfidence, type AiwgRelationshipDirection, type AiwgRelationshipEdgeSummary, type AiwgRelationshipNodeSummary, type AiwgRelationshipQueryOptions, type AiwgRelationshipSetOperation, type AiwgRelationshipSetOptions, type AiwgRelationshipSetResult, type AiwgRelationshipTraversalOptions, type AiwgRelationshipTraversalResult, type AiwgReviewAction, type AiwgReviewDecision, type AiwgReviewDecisionExport, type AiwgReviewInput, type AiwgStaticDuplicatePair, type AiwgStaticEmbeddingRecord, type AiwgStaticEmbeddingSet, type AiwgStaticHybridQueryOptions, type AiwgStaticSemanticQueryOptions, type AiwgStaticSemanticResult, type ArchiveInfo, ArchiveManager, type AttachInput, type AttachmentBlobRow, type AttachmentRow, AttachmentsRepository, type BackendCandidate, type BackendCapabilities, type BackendConcept, type BackendLink, type BackendListOptions, type BackendNote, type BackendNoteFull, type BackendProvenanceEdge, type BackendRequest, type BackendSearchHit, type BackendSearchQueryOptions, type BackendSearchResult, type BackendSelection, type BackendSemanticTier, type BackendStartupCost, type BlobStore, type BridgeCapability, type BridgeProviderInfo, type BrowserNoteExport, type BuildAiwgStaticEmbeddingSetOptions, CURRENT_MIGRATION_HEAD, CURRENT_SHARD_VERSION, type CapabilityInfo, CapabilityManager, type CapabilityName, type CapabilityState, type CaptureKnowledgeInput, CaptureKnowledgeInputSchema, type CaptureKnowledgeResult, type CollectionCreateInput, type CollectionRow, CollectionsRepository, CommunitiesRepository, type CommunityAssignmentView, type CommunityCreateInput, type CommunityFilterDefinition, type CommunityGraph, type CommunityOptions, type CommunitySourceDescriptor, type CommunitySourceType, type CommunitySummary, type CompletionRequest, type CompletionResponse, type ConditionResult, type ConflictStrategy, type CooldownConfig, type CooldownEvent, type CosineSemanticProviderOptions, type CreatePGliteOptions, type CspDirectiveName, type CspDirectives, type CspViolationReport, DB_SNAPSHOT_SCHEMA_VERSION, type DataBackend, type DatabaseClient, type DbSnapshot, type DbSnapshotCompat, type DbSnapshotCompression, type DbSnapshotExpectations, type DbSnapshotMeta, type DbSnapshotSource, DbSnapshotVersionError, type DiscoveredProvider, type DiscoveryOptions, type DumpDbSnapshotOptions, type DumpableDb, EMBED_REQUEST_KIND, EMBED_RESPONSE_KIND, type EmbedFunction, type EmbedRequest, type EmbedRequestMessage, type EmbedResponse, type EmbedResponseMessage, type EmbedTransportPort, type EmbedWorkerOptions, type EmbeddingCompatibilityPolicy, type EmbeddingSetCreateInput, type EmbeddingSetCriteria, type EmbeddingSetDescriptor, type EmbeddingSetEmbeddingInput, type EmbeddingSetFreshness, type EmbeddingSetKind, type EmbeddingSetMode, type EmbeddingSetRow, type EmbeddingSetSelector, EmbeddingSetsRepository, type EnqueueJobInput, type ErrorCategory, type EventMap, type ExportOptions, FORTEMI_COMPATIBILITY_PATH, FORTEMI_COMPATIBILITY_STATES, FORTEMI_REQUIRED_COMPATIBILITY_CAPABILITIES, type FallbackEvent, FallbackRouter, type FallbackRouterConfig, type FetchFortemiCompatibilityOptions, type FortemiBridge, type FortemiBridgeCapabilities, type FortemiBridgeHost, type FortemiCompatibilityCapability, type FortemiCompatibilityResponse, type FortemiCompatibilityState, type FortemiCompatibilityValidationResult, type FortemiConfig, type FortemiCore, type FortemiInferenceRouter, type FortemiRequiredCompatibilityCapability, type FortemiSecretStore, type FortemiToolDefinition, FortemiToolManifest, type GetNoteInput, GetNoteInputSchema, type GpuCapabilities, type GraphCommunity, type GraphEdge, type GraphNode, GraphRepository, type IDisposable, type ImportCounts, type ImportOptions, type ImportProgress, type ImportProgressPhase, type ImportResult, type InferenceCapabilities, type InferenceProvider, JOB_CAPABILITIES, JOB_PRIORITIES, type JobQueueOptions, JobQueueWorker, type JobStatus, type JobType, LOCAL_ENDPOINTS, type LinkRow, LinksRepository, type ListNotesInput, ListNotesInputSchema, type LlmCapabilityOptions, type LlmCompleteFn, type LoadedPluginScript, type LocalEndpoint, type ManageArchiveInput, ManageArchiveInputSchema, type ManageArchiveResult, type ManageAttachmentsInput, ManageAttachmentsInputSchema, type ManageAttachmentsResult, type ManageCapabilitiesInput, ManageCapabilitiesInputSchema, type ManageCapabilitiesResult, type ManageCollectionsInput, ManageCollectionsInputSchema, type ManageCollectionsResult, type ManageLinksInput, ManageLinksInputSchema, type ManageLinksResult, type ManageNoteInput, ManageNoteInputSchema, type ManageNoteResult, type ManageTagsInput, ManageTagsInputSchema, type ManageTagsResult, MemoryBlobStore, type Migration, MigrationRunner, type ModelCategory, type ModelFitResult, type ModelInfo, type NoteCreateInput, type NoteFull, type NoteListOptions, type NoteRevision, type NoteSkosTag, type NoteSummary, type NoteUpdateInput, NotesRepository, OpenAICompatibleProvider, type OpenAIProviderConfig, type OpenShardOptions, type PGliteBackendOptions, PGliteStorageBackend, PGliteStorageBackendFactory, PGliteWorkerClient, PGliteWorkerStorageBackend, PGliteWorkerStorageBackendFactory, type PGliteWorkerStorageBackendFactoryOptions, type PaginatedResult, type PersistenceMode, type PluginCspOptions, type PluginScriptDescriptor, type PluginScriptPolicy, type PrefetchOptions, type PrefetchResult, type ProbeResult, type ProbeStatus, type ProvenanceEdge, ProvenanceRepository, type ProviderCapabilities, ProviderRegistry, type ProviderTier, type QueryExecutor, type QueryResult, type RecommendedTier, type RecordProvenanceInput, type RemoteBackendConfig, type RemoteBackendPaths, type ResolvedEmbeddingRow, type ResolvedEmbeddingSet, type RestoreDbSnapshotOptions, type RouteHandler, SHARD_FORMAT, SUPPORTED_PGLITE_VERSION, type SWRegistrationResult, type SearchFacets, type SearchInput, SearchInputSchema, type SearchOptions, SearchRepository, type SearchResponse, type SearchResult, type ShardBackendOptions, type ShardClusterRef, type ShardCollection, type ShardComponent, type ShardComponentStore, type ShardEmbedding, type ShardEmbeddingConfig, type ShardEmbeddingSet, type ShardEmbeddingSetMember, type ShardLayout, type ShardLink, type ShardListOptions, type ShardManifest, type ShardNote, type ShardNoteFull, type ShardNoteSkosTag, type ShardProvenanceEdge, type ShardReader, type ShardReaderNote, type ShardReaderSource, type ShardSchemaValidationResult, type ShardSearchOptions, type ShardSearchRankedNote, type ShardSearchResult, type ShardSearchWeights, type ShardSkosConcept, type ShardSkosRelation, type ShardSkosScheme, type ShardTag, type ShardTemplate, type SimilarityGraphCacheKey, type SimilarityGraphOptions, type SimilarityGraphRequest, type SimilarityGraphResult, type SkosConcept, type SkosRelation, SkosRepository, type SkosScheme, type StaticSemanticProvider, type StorageBackend, type StorageBackendFactory, type StorageOpenRequest, type StorageTopology, type StreamChunk, TagsRepository, TransactionProxy, TypedEventBus, VERSION, type VectorEntry, type VirtualEmbeddingSetDefinition, type VirtualEmbeddingSetSource, type VirtualEmbeddingSetValidationError, type VirtualMaterializationPolicy, type VramTier, type WorkerRequest, type WorkerResponse, aiRevisionHandler, aiwgFortemiIndexToCommunityGraph, allMigrations, appendPluginScript, assertAiwgFortemiChunkManifest, assertAiwgFortemiChunkPart, assertAiwgFortemiIndexExport, assertAiwgStaticEmbeddingSet, assertShardComponentRecord, buildAiwgChunkedIndex, buildAiwgStaticEmbeddingSet, buildNoteConditions, buildPluginCsp, captureKnowledge, chunkText, classifyError, classifyModel, clearPrefetchedShard, collectionFromShard, collectionToShard, computeBlobHash, computeHash, computeSri, conceptTaggingHandler, cosineSimilarity, createAiwgFetchChunkLoader, createAiwgFetchDetailLoader, createAiwgIndexController, createAiwgReviewDecisionExport, createBlobStore, createCosineSemanticProvider, createCspReportHandler, createFortemi, createLegacyProvider, createPGliteBackend, createPGliteInstance, createRemoteBackend, createRoutes, createShardBackend, createWorkerEmbedFunction, defaultStorageBackendFactory, detectCommunities, detectGpuCapabilities, detectInferenceCapabilities, discoverLocalProviders, dumpDbSnapshot, embeddingConfigToShard, embeddingFromShard, embeddingGenerationHandler, embeddingSetFromShard, embeddingSetMemberToShard, embeddingSetToShard, embeddingToShard, enqueueFullWorkflow, enqueueJob, enqueueNoteCreationJobs, estimateModelFit, estimateVramMB, estimateVramTier, exportShard, fetchAndValidateFortemiCompatibility, fetchPluginScript, filterAiwgRecordsByPrivacy, findAiwgStaticDuplicatePairs, formatFortemiCompatibilitySummary, fortemiCompatibilityUrl, fortemiManifest, fromPrefetched, generateId, getAiwgFortemiFacets, getEmbedFunction, getFortemiBridge, getFortemiSecretStore, getJobQueueStatus, getKnowledgeShardSchema, getLlmFunction, getNote, getPrefetchedSha256, handleEmbedRequests, hasFortemiSecureSecrets, importShard, isPluginScriptAllowed, isShardPrefetched, linkFromShard, linkToShard, linkingHandler, listNotes, manageArchive, manageAttachments, manageCapabilities, manageCollections, manageLinks, manageNote, manageTags, matchRoute, noteFromShard, noteSkosTagToShard, noteToShard, openShard, packTarGz, parseCspReport, prefetchShard, provenanceEdgeToShard, queryAiwgFortemiIndex, queryAiwgHybridIndex, queryAiwgSemanticIndex, registerLlmCapability, registerSemanticCapability, registerSemanticCapabilityWorker, registerServiceWorker, restoreDbSnapshot, searchTool, selectBackend, selectLlmModel, setEmbedFunction, setLlmFunction, sha256Hex, skosConceptToShard, skosRelationToShard, skosSchemeToShard, suggestTags, tagsToShard, templateToShard, titleGenerationHandler, unpackTarGz, unregisterLlmCapability, unregisterSemanticCapability, urlLinkToShard, validateAiwgFortemiChunkManifest, validateAiwgFortemiChunkPart, validateAiwgFortemiIndexExport, validateAiwgStaticEmbeddingSet, validateChecksums, validateFortemiCompatibilityResponse, validateShardArchive, validateShardComponentRecord, validateShardManifest, verifyDbSnapshotMeta, verifySri };
+export { AIWG_SCAN_REQUIRED_FIELDS, type AiwgChunkedIndexBuildOptions, type AiwgChunkedIndexBuildResult, type AiwgChunkedIndexDetailLoader, type AiwgChunkedIndexLoadOptions, type AiwgChunkedIndexLoader, type AiwgChunkedIndexProgress, type AiwgChunkedIndexProgressPhase, type AiwgChunkedIndexQueryOptions, type AiwgChunkedIndexQueryResult, type AiwgChunkedIndexValidationResult, type AiwgFortemiAttachmentReference, type AiwgFortemiBinarySource, type AiwgFortemiChunk, type AiwgFortemiChunkDetailRef, type AiwgFortemiChunkManifest, type AiwgFortemiChunkPart, type AiwgFortemiChunkPartRef, type AiwgFortemiIndexExport, type AiwgFortemiIndexExportSchemaVersion, type AiwgFortemiProjectedRecord, type AiwgFortemiProvenance, type AiwgFortemiProvenanceEvent, type AiwgFortemiRecord, type AiwgFortemiRecordEmbedding, type AiwgFortemiRecordSchemaVersion, type AiwgFortemiRecordSource, type AiwgFortemiRecordType, type AiwgFortemiRelationship, type AiwgFortemiRelationshipDirection, type AiwgFortemiSearchProjection, type AiwgFortemiSkosConcept, type AiwgFortemiSkosRelation, type AiwgFortemiSkosRelationType, type AiwgHeadlessEmbeddingBackend, type AiwgIndexController, type AiwgIndexControllerListener, type AiwgIndexControllerSnapshot, type AiwgIndexGraphOptions, type AiwgIndexQueryMatch, type AiwgIndexQueryOptions, type AiwgIndexQueryRankedItem, type AiwgIndexQueryResult, type AiwgIndexQueryWeights, type AiwgIndexValidationResult, type AiwgKnowledgeShardOptions, type AiwgPrivacyClassification, type AiwgPrivacyFilterOptions, type AiwgProvenanceConfidence, type AiwgRelationshipDirection, type AiwgRelationshipEdgeSummary, type AiwgRelationshipNodeSummary, type AiwgRelationshipQueryOptions, type AiwgRelationshipSetOperation, type AiwgRelationshipSetOptions, type AiwgRelationshipSetResult, type AiwgRelationshipTraversalOptions, type AiwgRelationshipTraversalResult, type AiwgReviewAction, type AiwgReviewDecision, type AiwgReviewDecisionExport, type AiwgReviewInput, type AiwgStaticDuplicatePair, type AiwgStaticEmbeddingRecord, type AiwgStaticEmbeddingSet, type AiwgStaticHybridQueryOptions, type AiwgStaticSemanticQueryOptions, type AiwgStaticSemanticResult, AllowlistTrustStore, type ArchiveInfo, ArchiveManager, type AttachInput, type AttachmentBlobRecord, type AttachmentBlobRow, type AttachmentProjectionResult, type AttachmentRecord, type AttachmentRow, AttachmentsRepository, type BackendCandidate, type BackendCapabilities, type BackendConcept, type BackendLink, type BackendListOptions, type BackendNote, type BackendNoteFull, type BackendProvenanceEdge, type BackendRequest, type BackendSearchHit, type BackendSearchQueryOptions, type BackendSearchResult, type BackendSelection, type BackendSemanticTier, type BackendStartupCost, type BlobBackendKind, type BlobGcOptions, type BlobGcResult, type BlobReconcileOptions, type BlobReconcileResult, type BlobStore, type BlobStoreDiagnostics, type BridgeCapability, type BridgeProviderInfo, type BrowserNoteExport, type BuildAiwgStaticEmbeddingSetOptions, CURRENT_MIGRATION_HEAD, CURRENT_SHARD_VERSION, type CanonicalAttachInput, CanonicalAttachmentsRepository, type CanonicalNoteCreateInput, type CanonicalNoteUpdateInput, type CanonicalNoteView, CanonicalNotesRepository, type CapabilityInfo, CapabilityManager, type CapabilityName, type CapabilityState, type CaptureKnowledgeInput, CaptureKnowledgeInputSchema, type CaptureKnowledgeResult, type CollectionCreateInput, type CollectionNoteRecord, type CollectionRecord, type CollectionRow, CollectionsRepository, CommunitiesRepository, type CommunityAssignmentView, type CommunityCreateInput, type CommunityFilterDefinition, type CommunityGraph, type CommunityOptions, type CommunitySourceDescriptor, type CommunitySourceType, type CommunitySummary, type CompletionRequest, type CompletionResponse, type ConditionResult, type ConflictStrategy, type CooldownConfig, type CooldownEvent, type CosineSemanticProviderOptions, type CreateBlobStoreOptions, type CreatePGliteOptions, type CreateRecordStoreOptions, type CspDirectiveName, type CspDirectives, type CspViolationReport, DB_SNAPSHOT_SCHEMA_VERSION, type DataBackend, type DatabaseClient, type DbSnapshot, type DbSnapshotCompat, type DbSnapshotCompression, type DbSnapshotExpectations, type DbSnapshotMeta, type DbSnapshotSource, DbSnapshotVersionError, type DiscoveredProvider, type DiscoveryOptions, type DumpDbSnapshotOptions, type DumpableDb, EMBED_REQUEST_KIND, EMBED_RESPONSE_KIND, type EmbedFunction, type EmbedRequest, type EmbedRequestMessage, type EmbedResponse, type EmbedResponseMessage, type EmbedTransportPort, type EmbedWorkerOptions, type EmbeddingCompatibilityPolicy, type EmbeddingSetCreateInput, type EmbeddingSetCriteria, type EmbeddingSetDescriptor, type EmbeddingSetEmbeddingInput, type EmbeddingSetFreshness, type EmbeddingSetKind, type EmbeddingSetMode, type EmbeddingSetRow, type EmbeddingSetSelector, EmbeddingSetsRepository, type EnqueueJobInput, type ErrorCategory, type EventMap, type ExportOptions, FORTEMI_COMPATIBILITY_PATH, FORTEMI_COMPATIBILITY_STATES, FORTEMI_REQUIRED_COMPATIBILITY_CAPABILITIES, type FallbackEvent, FallbackRouter, type FallbackRouterConfig, type FetchFortemiCompatibilityOptions, type FortemiBridge, type FortemiBridgeCapabilities, type FortemiBridgeHost, type FortemiCompatibilityCapability, type FortemiCompatibilityResponse, type FortemiCompatibilityState, type FortemiCompatibilityValidationResult, type FortemiConfig, type FortemiCore, type FortemiInferenceRouter, type FortemiRequiredCompatibilityCapability, type FortemiSecretStore, type FortemiToolDefinition, FortemiToolManifest, type GetNoteInput, GetNoteInputSchema, type GpuCapabilities, type GraphCommunity, type GraphEdge, type GraphNode, GraphRepository, type IDisposable, IdbRecordStore, type ImportCounts, type ImportOptions, type ImportProgress, type ImportProgressPhase, type ImportResult, type InferenceCapabilities, type InferenceProvider, JOB_CAPABILITIES, JOB_PRIORITIES, type JobQueueOptions, JobQueueWorker, type JobStatus, type JobType, type JournalEntry, LOCAL_ENDPOINTS, type LegacyMigrationReport, type LinkRecord0, type LinkRow, LinksRepository, type ListNotesInput, ListNotesInputSchema, type LlmCapabilityOptions, type LlmCompleteFn, type LoadedPluginScript, type LocalEndpoint, type ManageArchiveInput, ManageArchiveInputSchema, type ManageArchiveResult, type ManageAttachmentsInput, ManageAttachmentsInputSchema, type ManageAttachmentsResult, type ManageCapabilitiesInput, ManageCapabilitiesInputSchema, type ManageCapabilitiesResult, type ManageCollectionsInput, ManageCollectionsInputSchema, type ManageCollectionsResult, type ManageLinksInput, ManageLinksInputSchema, type ManageLinksResult, type ManageNoteInput, ManageNoteInputSchema, type ManageNoteResult, type ManageTagsInput, ManageTagsInputSchema, type ManageTagsResult, MemoryBlobStore, MemoryRecordStore, type Migration, MigrationRunner, type ModelCategory, type ModelFitResult, type ModelInfo, type NoteCreateInput, type NoteFull, type NoteListOptions, type NoteOriginalRecord, type NoteProjectionResult, type NoteRecord0, type NoteRevisedCurrentRecord, type NoteRevision, type NoteSkosTag, type NoteSummary, type NoteTagRecord, type NoteUpdateInput, NotesRepository, OpenAICompatibleProvider, type OpenAIProviderConfig, type OpenShardOptions, type PGliteBackendOptions, PGliteStorageBackend, PGliteStorageBackendFactory, PGliteWorkerClient, PGliteWorkerStorageBackend, PGliteWorkerStorageBackendFactory, type PGliteWorkerStorageBackendFactoryOptions, type PaginatedResult, type PersistenceMode, type PluginCspOptions, type PluginScriptDescriptor, type PluginScriptPolicy, type PrefetchOptions, type PrefetchResult, type ProbeResult, type ProbeStatus, type ProvenanceEdge, ProvenanceRepository, type ProviderCapabilities, ProviderRegistry, type ProviderTier, type QueryExecutor, type QueryResult, RECORD_COLLECTIONS, RECORD_SCHEMA_VERSION, RECORD_STORE_CAPABILITIES, type RecommendedTier, type RecordBackendManageNoteResult, type RecordBackendOptions, type RecordCollectionName, type RecordCollections, type RecordListOptions, type RecordProjectionResult, type RecordProvenanceInput, type RecordStore, type RecordStoreCapabilities, type RemoteBackendConfig, type RemoteBackendPaths, type ResolvedEmbeddingRow, type ResolvedEmbeddingSet, type RestoreDbSnapshotOptions, type RouteHandler, SHARD_FORMAT, SIGNATURE_ENTRY, SIGNING_ENVELOPE_VERSION, SUPPORTED_PGLITE_VERSION, type SWRegistrationResult, type SearchFacets, type SearchInput, SearchInputSchema, type SearchOptions, SearchRepository, type SearchResponse, type SearchResult, type ShardBackendOptions, type ShardClusterRef, type ShardCollection, type ShardComponent, type ShardComponentStore, type ShardEmbedding, type ShardEmbeddingConfig, type ShardEmbeddingSet, type ShardEmbeddingSetMember, type ShardLayout, type ShardLink, type ShardListOptions, type ShardManifest, type ShardNote, type ShardNoteFull, type ShardNoteSkosTag, type ShardProvenanceEdge, type ShardReader, type ShardReaderNote, type ShardReaderSource, type ShardSchemaValidationResult, type ShardSearchOptions, type ShardSearchRankedNote, type ShardSearchResult, type ShardSearchWeights, type ShardSignatureEnvelope, type ShardSignatureVerdict, type ShardSigner, type ShardSigningPayload, type ShardSkosConcept, type ShardSkosRelation, type ShardSkosScheme, type ShardTag, type ShardTemplate, type ShardTrustStore, type SignShardInput, type SimilarityGraphCacheKey, type SimilarityGraphOptions, type SimilarityGraphRequest, type SimilarityGraphResult, type SkosConcept, type SkosRelation, SkosRepository, type SkosScheme, type StaticSemanticProvider, type StorageBackend, type StorageBackendFactory, type StorageOpenRequest, type StorageTopology, type StreamChunk, TagsRepository, TransactionProxy, type TrustedKey, TypedEventBus, VERSION, type VectorEntry, type VerifyShardSignatureInput, type VirtualEmbeddingSetDefinition, type VirtualEmbeddingSetSource, type VirtualEmbeddingSetValidationError, type VirtualMaterializationPolicy, type VramTier, type WorkerRequest, type WorkerResponse, aiRevisionHandler, aiwgFortemiIndexFromKnowledgeShard, aiwgFortemiIndexToCommunityGraph, aiwgFortemiIndexToKnowledgeShard, allMigrations, appendPluginScript, assertAiwgFortemiChunkManifest, assertAiwgFortemiChunkPart, assertAiwgFortemiIndexExport, assertAiwgStaticEmbeddingSet, assertShardComponentRecord, buildAiwgChunkedIndex, buildAiwgStaticEmbeddingSet, buildNoteConditions, buildPluginCsp, captureKnowledge, chunkText, classifyError, classifyModel, clearPrefetchedShard, collectionFromShard, collectionToShard, computeBlobHash, computeHash, computeSri, conceptTaggingHandler, cosineSimilarity, createAiwgFetchChunkLoader, createAiwgFetchDetailLoader, createAiwgIndexController, createAiwgReviewDecisionExport, createBlobStore, createCosineSemanticProvider, createCspReportHandler, createFortemi, createLazyBlobStore, createLegacyProvider, createPGliteBackend, createPGliteInstance, createRecordBackend, createRecordStore, createRemoteBackend, createRoutes, createShardBackend, createWorkerEmbedFunction, defaultStorageBackendFactory, detectCommunities, detectGpuCapabilities, detectInferenceCapabilities, discoverLocalProviders, dropAttachmentProjection, dropNoteProjection, dumpDbSnapshot, embeddingConfigToShard, embeddingFromShard, embeddingGenerationHandler, embeddingSetFromShard, embeddingSetMemberToShard, embeddingSetToShard, embeddingToShard, enqueueFullWorkflow, enqueueJob, enqueueNoteCreationJobs, estimateModelFit, estimateVramMB, estimateVramTier, exportShard, exportShardFromRecords, fetchAndValidateFortemiCompatibility, fetchPluginScript, filterAiwgRecordsByPrivacy, findAiwgStaticDuplicatePairs, formatFortemiCompatibilitySummary, fortemiCompatibilityUrl, fortemiManifest, fromPrefetched, generateId, getAiwgFortemiFacets, getEmbedFunction, getFortemiBridge, getFortemiSecretStore, getJobQueueStatus, getKnowledgeShardSchema, getLlmFunction, getNote, getPrefetchedSha256, handleEmbedRequests, hasFortemiSecureSecrets, importShard, importShardToRecords, isPluginScriptAllowed, isShardPrefetched, isShardSigningSupported, linkFromShard, linkToShard, linkingHandler, listNotes, manageArchive, manageAttachments, manageCapabilities, manageCollections, manageLinks, manageNote, manageTags, matchRoute, migrateLegacyBlobStore, noteFromShard, noteSkosTagToShard, noteToShard, openShard, packTarGz, parseCspReport, prefetchShard, projectAttachments, projectNotes, projectRecords, provenanceEdgeToShard, queryAiwgFortemiIndex, queryAiwgHybridIndex, queryAiwgSemanticIndex, registerLlmCapability, registerSemanticCapability, registerSemanticCapabilityWorker, registerServiceWorker, restoreDbSnapshot, searchTool, selectBackend, selectLlmModel, setEmbedFunction, setLlmFunction, sha256Hex, sidecarBlobDigests, signShard, skosConceptToShard, skosRelationToShard, skosSchemeToShard, suggestTags, tagsToShard, templateToShard, titleGenerationHandler, unpackTarGz, unregisterLlmCapability, unregisterSemanticCapability, urlLinkToShard, validateAiwgFortemiChunkManifest, validateAiwgFortemiChunkPart, validateAiwgFortemiIndexExport, validateAiwgStaticEmbeddingSet, validateChecksums, validateFortemiCompatibilityResponse, validateShardArchive, validateShardComponentRecord, validateShardManifest, verifyDbSnapshotMeta, verifyShardSignature, verifySri };