List every document in the vault with its id, title, encryption status, attachment status, and content size.

Fetch a single plaintext document by id. Refuses encrypted documents (their content is unreadable server-side).

Case-insensitive substring search across titles (always) and plaintext content. Returns id, title, encrypted flag, what matched, and a short snippet.

Fetch the file attached to a plaintext document. Returns filename, byte size, base64-encoded content, and a UTF-8 text rendition when the bytes are valid UTF-8 (e.g. .md, .txt, .json). Refuses if the attachment is encrypted client-side (named '_dmencblob').

Create a new plaintext document. Returns the new id. Cannot create encrypted documents.

Replace the content (and optionally the title) of an existing plaintext document. Refuses if the document is encrypted.

Attach a file to an existing plaintext document. Replaces any pre-existing attachment for that document (one attachment per doc by design). Refuses if the document is encrypted client-side. Provide either 'content' (UTF-8 text, e.g. markdown) or 'content_base64' (binary, base64-encoded).

Delete a document and all of its associated blobs (main content, title, and any attachment). Works on encrypted documents too — deletion is destructive but does not disclose contents. Irreversible.

Delete the file attached to a document, leaving the document itself intact. No-op (with status: 'no_attachment') if the document has no attachment. Works on encrypted attachments too.