@opengeni/documents 0.2.72 → 0.3.3

package/dist/index.js

@@ -1,5 +1,12 @@
 // src/index.ts
-import { requireFile, withRlsContext, withWorkspaceRls } from "@opengeni/db";
+import {
+  requireFile,
+  rlsContextForWorkspace,
+  setSubjectRlsContext,
+  withRlsContext,
+  withWorkspaceRls,
+  withWorkspaceSubjectRls
+} from "@opengeni/db";
 import * as schema from "@opengeni/db/schema";
 import { LiteParse } from "@llamaindex/liteparse";
 import { and, asc, desc, eq, inArray, or, sql } from "drizzle-orm";
@@ -11,6 +18,7 @@ var DEFAULT_DOCUMENT_CHUNK_SIZE = 1200;
 var DEFAULT_DOCUMENT_CHUNK_OVERLAP = 160;
 var DEFAULT_DOCUMENT_CURATION_MODEL = "gpt-4o-mini";
 var DOCUMENT_CURATION_MAX_INPUT_CHARS = 24e3;
+var DOCUMENT_AUTHORITY_SUBJECT_MAX_BYTES = 1024;
 var DOCUMENT_CURATION_AUTO_FILE_CONFIDENCE = 0.75;
 var DEFAULT_BASE_NAME = "Default";
 var DEFAULT_BASE_DESCRIPTION = "Default base for dropped files and notes.";
@@ -362,12 +370,12 @@ async function getDocumentInventory(db, workspaceId, input) {
     DOCUMENT_INVENTORY_MAX_TOPIC_CHARS,
     "topicMaxChars"
   );
-  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+  return await withDocumentRls(db, workspaceId, input.access, async (scopedDb) => {
     const [baseTotal] = await scopedDb.select({ count: sql`count(*)::int` }).from(schema.documentBases).where(eq(schema.documentBases.workspaceId, workspaceId));
     const baseJoin = and(
       eq(schema.documents.workspaceId, workspaceId),
       eq(schema.documents.baseId, schema.documentBases.id),
-      ...documentAccessConditions(input.access)
+      ...documentAccessConditions(workspaceId, input.access)
     );
     const baseRows = await scopedDb.select({
       id: schema.documentBases.id,
@@ -381,7 +389,7 @@ async function getDocumentInventory(db, workspaceId, input) {
     }).from(schema.documentBases).leftJoin(schema.documents, baseJoin).where(eq(schema.documentBases.workspaceId, workspaceId)).groupBy(schema.documentBases.id, schema.documentBases.name, schema.documentBases.createdAt).orderBy(desc(schema.documentBases.createdAt), asc(schema.documentBases.id)).limit(baseLimit);
     const documentWhere = and(
       eq(schema.documents.workspaceId, workspaceId),
-      ...documentAccessConditions(input.access)
+      ...documentAccessConditions(workspaceId, input.access)
     );
     const [summary] = await scopedDb.select({
       visibleDocumentCount: sql`count(${schema.documents.id})::int`,
@@ -501,12 +509,23 @@ async function addDocumentToBase(db, input) {
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => {
+      const viewerSubjectId = cleanString(input.access?.viewerSubjectId ?? null);
+      const authority = resolveDocumentAuthority({
+        kind: input.authorityKind,
+        legacyVisibility: input.visibility,
+        workspaceId: input.workspaceId,
+        initiatingSubjectId: input.initiatingSubjectId
+      });
+      if (authority.kind === "organization" && input.organizationAuthorityGranted !== true) {
+        throw new Error("organization document writes require exact account authority");
+      }
+      if (authority.kind === "personal" && (viewerSubjectId !== authority.subjectId || cleanString(input.createdBy ?? null) !== authority.subjectId)) {
+        throw new Error("personal document writes require the exact initiating subject");
+      }
+      if (viewerSubjectId) await setSubjectRlsContext(scopedDb, viewerSubjectId);
       const base = await getDocumentBase(scopedDb, input.workspaceId, input.baseId);
       if (!base) throw new Error(`Document base not found: ${input.baseId}`);
       const file = await requireReadyFile(scopedDb, input.workspaceId, input.fileId);
-      if (input.visibility === "private" && !cleanString(input.createdBy ?? null)) {
-        throw new Error("private documents require a creating subject");
-      }
       const now = /* @__PURE__ */ new Date();
       const [existing] = await scopedDb.select().from(schema.documents).where(
         and(
@@ -519,6 +538,10 @@ async function addDocumentToBase(db, input) {
         if (!documentMatchesAccess(existing, input.access)) {
           throw new Error(`Document not found: ${existing.id}`);
         }
+        assertOrganizationDocumentAuthority(
+          existing.authorityKind,
+          input.organizationAuthorityGranted
+        );
         const [updated] = await scopedDb.update(schema.documents).set({
           title: cleanString(input.title) ?? cleanString(input.sourceTitle) ?? existing.title,
           ...input.sourceKind !== void 0 ? { sourceKind: input.sourceKind } : {},
@@ -535,7 +558,7 @@ async function addDocumentToBase(db, input) {
           and(
             eq(schema.documents.workspaceId, input.workspaceId),
             eq(schema.documents.id, existing.id),
-            ...documentAccessConditions(input.access)
+            ...documentAccessConditions(input.workspaceId, input.access)
           )
         ).returning();
         return mapDocument(updated ?? existing);
@@ -557,7 +580,10 @@ async function addDocumentToBase(db, input) {
         sourceUpdatedAt: parseOptionalDate(input.sourceUpdatedAt),
         sourceVersion: cleanString(input.sourceVersion) ?? null,
         aclTags: cleanStringArray(input.aclTags),
-        visibility: input.visibility ?? "workspace",
+        authorityKind: authority.kind,
+        authorityWorkspaceId: authority.workspaceId,
+        authoritySubjectId: authority.subjectId,
+        visibility: authority.kind === "personal" ? "private" : "workspace",
         agentAccess: input.agentAccess ?? true,
         createdBy: input.createdBy ?? null,
         curationStatus: input.curationStatus ?? "none",
@@ -573,14 +599,17 @@ async function moveDocumentToBase(db, input) {
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => {
+      const viewerSubjectId = cleanString(input.access?.viewerSubjectId ?? null);
+      if (viewerSubjectId) await setSubjectRlsContext(scopedDb, viewerSubjectId);
       const [row] = await scopedDb.select().from(schema.documents).where(
         and(
           eq(schema.documents.workspaceId, input.workspaceId),
           eq(schema.documents.id, input.documentId),
-          ...documentAccessConditions(input.access)
+          ...documentAccessConditions(input.workspaceId, input.access)
         )
       ).limit(1);
       if (!row) throw new Error(`Document not found: ${input.documentId}`);
+      assertOrganizationDocumentAuthority(row.authorityKind, input.organizationAuthorityGranted);
       const suggestion = row.curation?.suggestedBaseId;
       const targetBaseId = input.targetBaseId ?? suggestion;
       if (!targetBaseId) {
@@ -609,7 +638,7 @@ async function moveDocumentToBase(db, input) {
           and(
             eq(schema.documents.workspaceId, input.workspaceId),
             eq(schema.documents.id, input.documentId),
-            ...documentAccessConditions(input.access)
+            ...documentAccessConditions(input.workspaceId, input.access)
           )
         ).returning();
         if (updated) {
@@ -632,16 +661,22 @@ async function deleteDocumentFromBase(db, input) {
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => {
+      const viewerSubjectId = cleanString(input.access?.viewerSubjectId ?? null);
+      if (viewerSubjectId) await setSubjectRlsContext(scopedDb, viewerSubjectId);
       const [document] = await scopedDb.select().from(schema.documents).where(
         and(
           eq(schema.documents.workspaceId, input.workspaceId),
           eq(schema.documents.id, input.documentId),
-          ...documentAccessConditions(input.access)
+          ...documentAccessConditions(input.workspaceId, input.access)
         )
       ).limit(1);
       if (!document) {
         throw new Error(`Document not found: ${input.documentId}`);
       }
+      assertOrganizationDocumentAuthority(
+        document.authorityKind,
+        input.organizationAuthorityGranted
+      );
       if (document.baseId !== input.baseId) {
         throw new Error(`Document not found: ${input.documentId}`);
       }
@@ -649,38 +684,47 @@ async function deleteDocumentFromBase(db, input) {
         and(
           eq(schema.documents.workspaceId, input.workspaceId),
           eq(schema.documents.id, input.documentId),
-          ...documentAccessConditions(input.access)
+          ...documentAccessConditions(input.workspaceId, input.access)
         )
       );
     }
   );
 }
 async function listDocuments(db, workspaceId, baseId, access) {
-  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+  return await withDocumentRls(db, workspaceId, access, async (scopedDb) => {
     const rows = await scopedDb.select().from(schema.documents).where(
       and(
         eq(schema.documents.workspaceId, workspaceId),
         eq(schema.documents.baseId, baseId),
-        ...documentAccessConditions(access)
+        ...documentAccessConditions(workspaceId, access)
       )
     ).orderBy(asc(schema.documents.createdAt));
     return rows.map(mapDocument);
   });
 }
 async function getDocument(db, workspaceId, documentId, access) {
-  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+  return await withDocumentRls(db, workspaceId, access, async (scopedDb) => {
     const [row] = await scopedDb.select().from(schema.documents).where(
       and(
         eq(schema.documents.workspaceId, workspaceId),
         eq(schema.documents.id, documentId),
-        ...documentAccessConditions(access)
+        ...documentAccessConditions(workspaceId, access)
       )
     ).limit(1);
     return row ? mapDocument(row) : null;
   });
 }
-async function queueDocumentForReindex(db, workspaceId, documentId, access) {
-  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+async function queueDocumentForReindex(db, workspaceId, documentId, access, organizationAuthorityGranted) {
+  return await withDocumentRls(db, workspaceId, access, async (scopedDb) => {
+    const [document] = await scopedDb.select({ authorityKind: schema.documents.authorityKind }).from(schema.documents).where(
+      and(
+        eq(schema.documents.workspaceId, workspaceId),
+        eq(schema.documents.id, documentId),
+        ...documentAccessConditions(workspaceId, access)
+      )
+    ).limit(1);
+    if (!document) throw new Error(`Document not found: ${documentId}`);
+    assertOrganizationDocumentAuthority(document.authorityKind, organizationAuthorityGranted);
     const [row] = await scopedDb.update(schema.documents).set({
       status: "queued",
       error: null,
@@ -689,17 +733,23 @@ async function queueDocumentForReindex(db, workspaceId, documentId, access) {
       and(
         eq(schema.documents.workspaceId, workspaceId),
         eq(schema.documents.id, documentId),
-        ...documentAccessConditions(access)
+        ...documentAccessConditions(workspaceId, access)
       )
     ).returning();
     if (!row) throw new Error(`Document not found: ${documentId}`);
     return mapDocument(row);
   });
 }
-async function indexDocumentNow(db, objectStorage, workspaceId, documentId, services = createDocumentServices(), hooks = {}) {
-  const [loadedDocument] = await withWorkspaceRls(
+function assertOrganizationDocumentAuthority(authorityKind, organizationAuthorityGranted) {
+  if (authorityKind === "organization" && organizationAuthorityGranted !== true) {
+    throw new Error("organization document mutations require exact account authority");
+  }
+}
+async function indexDocumentNow(db, objectStorage, workspaceId, documentId, services = createDocumentServices(), hooks = {}, access) {
+  const [loadedDocument] = await withDocumentRls(
     db,
     workspaceId,
+    access,
     async (scopedDb) => await scopedDb.select().from(schema.documents).where(
       and(eq(schema.documents.workspaceId, workspaceId), eq(schema.documents.id, documentId))
     ).limit(1)
@@ -707,7 +757,7 @@ async function indexDocumentNow(db, objectStorage, workspaceId, documentId, serv
   if (!loadedDocument) throw new Error(`Document not found: ${documentId}`);
   let document = loadedDocument;
   const file = await requireReadyFile(db, workspaceId, document.fileId);
-  await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+  await withDocumentRls(db, workspaceId, access, async (scopedDb) => {
     await scopedDb.update(schema.documents).set({
       status: "indexing",
       parser: services.parser.name,
@@ -736,9 +786,10 @@ async function indexDocumentNow(db, objectStorage, workspaceId, documentId, serv
         `Embedding provider returned ${embeddings.length} embeddings for ${chunks.length} chunks`
       );
     }
-    await withWorkspaceRls(
+    await withDocumentRls(
       db,
       workspaceId,
+      access,
       async (scopedDb) => await scopedDb.transaction(async (tx) => {
         await tx.delete(schema.documentChunks).where(
           and(
@@ -754,6 +805,9 @@ async function indexDocumentNow(db, objectStorage, workspaceId, documentId, serv
               documentId,
               baseId: document.baseId,
               fileId: file.id,
+              authorityKind: document.authorityKind,
+              authorityWorkspaceId: document.authorityWorkspaceId,
+              authoritySubjectId: document.authoritySubjectId,
               chunkIndex: index,
               text: chunk.text,
               metadata: {
@@ -793,9 +847,10 @@ async function indexDocumentNow(db, objectStorage, workspaceId, documentId, serv
       })
     );
   } catch (error) {
-    const [failed] = await withWorkspaceRls(
+    const [failed] = await withDocumentRls(
       db,
       workspaceId,
+      access,
       async (scopedDb) => await scopedDb.update(schema.documents).set({
         status: "failed",
         error: error instanceof Error ? error.message : String(error),
@@ -808,16 +863,17 @@ async function indexDocumentNow(db, objectStorage, workspaceId, documentId, serv
     return mapDocument(failed);
   }
   const updated = await getDocument(db, workspaceId, documentId, {
-    viewerSubjectId: document.createdBy
+    viewerSubjectId: document.authoritySubjectId
   });
   if (!updated) throw new Error(`Document disappeared after indexing: ${documentId}`);
   return updated;
 }
 async function curateDroppedDocument(db, services, document, parsed, file) {
   if (!services.curator) {
-    const [updated2] = await withWorkspaceRls(
+    const [updated2] = await withDocumentRls(
       db,
       document.workspaceId,
+      { viewerSubjectId: document.authoritySubjectId },
       async (scopedDb) => await scopedDb.update(schema.documents).set({
         curationStatus: "none",
         summary: null,
@@ -860,9 +916,10 @@ async function curateDroppedDocument(db, services, document, parsed, file) {
   const suggestedBase = candidates.find((base) => base.id === outcome.targetBaseId) ?? null;
   let moveToBaseId = null;
   if (suggestedBase && failure === null && outcome.confidence >= DOCUMENT_CURATION_AUTO_FILE_CONFIDENCE) {
-    const conflict = await withWorkspaceRls(
+    const conflict = await withDocumentRls(
       db,
       document.workspaceId,
+      { viewerSubjectId: document.authoritySubjectId },
       async (scopedDb) => await scopedDb.select({ id: schema.documents.id }).from(schema.documents).where(
         and(
           eq(schema.documents.workspaceId, document.workspaceId),
@@ -884,9 +941,10 @@ async function curateDroppedDocument(db, services, document, parsed, file) {
     model
   };
   const curationStatus = failure ? "failed" : moveToBaseId ? "auto_filed" : "suggested";
-  const [updated] = await withWorkspaceRls(
+  const [updated] = await withDocumentRls(
     db,
     document.workspaceId,
+    { viewerSubjectId: document.authoritySubjectId },
     async (scopedDb) => await scopedDb.update(schema.documents).set({
       title: outcome.title ?? document.title,
       summary: outcome.summary,
@@ -906,6 +964,7 @@ async function curateDroppedDocument(db, services, document, parsed, file) {
   return updated ?? document;
 }
 async function searchDocuments(db, input, services = createDocumentServices()) {
+  await assertDocumentAccountWorkspace(db, input.accountId, input.workspaceId);
   const mode = input.mode ?? "hybrid";
   const limit = Math.min(Math.max(input.limit ?? 5, 1), 50);
   const candidateLimit = mode === "hybrid" ? Math.min(limit * 4, 100) : limit;
@@ -931,15 +990,44 @@ async function searchDocuments(db, input, services = createDocumentServices()) {
   }
   return mergeDocumentSearchRows(rows, mode).slice(0, limit);
 }
+async function searchEffectiveDocuments(db, input, services = createDocumentServices()) {
+  const initiatingSubjectId = cleanString(input.initiatingSubjectId);
+  if (!initiatingSubjectId) {
+    throw new Error("effective document retrieval requires an initiating subject");
+  }
+  return await searchDocuments(
+    db,
+    {
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      query: input.query,
+      baseIds: input.baseIds,
+      limit: input.limit,
+      mode: input.mode,
+      sourceKinds: input.sourceKinds,
+      aclTags: input.aclTags,
+      // Construct the lower-level access filter here instead of spreading the
+      // caller input, so an untyped/legacy access override is always ignored.
+      access: {
+        viewerSubjectId: initiatingSubjectId,
+        ...input.surface === "agent" ? { agentOnly: true } : {}
+      }
+    },
+    services
+  );
+}
 async function vectorSearchDocuments(db, input, limit, services) {
   const queryEmbedding = await services.embedder.embedQuery(input.query);
   validateEmbedding(queryEmbedding, services.embedder.dimensions, services.embedder.model);
   const distance = sql`${schema.documentChunks.embedding} <=> ${vectorLiteral(queryEmbedding)}::vector`;
-  const rows = await withWorkspaceRls(
+  const rows = await withDocumentAccountRls(
     db,
+    input.accountId,
     input.workspaceId,
+    input.access,
     async (scopedDb) => await scopedDb.select({
       chunkId: schema.documentChunks.id,
+      workspaceId: schema.documentChunks.workspaceId,
       documentId: schema.documentChunks.documentId,
       baseId: schema.documentChunks.baseId,
       fileId: schema.documentChunks.fileId,
@@ -956,22 +1044,28 @@ async function vectorSearchDocuments(db, input, limit, services) {
       sourceUpdatedAt: schema.documents.sourceUpdatedAt,
       sourceVersion: schema.documents.sourceVersion,
       aclTags: schema.documents.aclTags,
+      authorityKind: schema.documents.authorityKind,
+      authorityWorkspaceId: schema.documents.authorityWorkspaceId,
+      authoritySubjectId: schema.documents.authoritySubjectId,
       distance
     }).from(schema.documentChunks).innerJoin(schema.documents, eq(schema.documentChunks.documentId, schema.documents.id)).where(and(...documentSearchConditions(input, services.embedder.model))).orderBy(distance).limit(limit)
   );
   return rows.map((row) => ({
-    ...mapSearchRowBase(row, input.workspaceId),
+    ...mapSearchRowBase(row),
     vectorScore: 1 / (1 + Number(row.distance)),
     keywordScore: null
   }));
 }
 async function keywordSearchDocuments(db, input, limit) {
   const rank = sql`ts_rank_cd(to_tsvector('simple', ${schema.documentChunks.text}), plainto_tsquery('simple', ${input.query}))`;
-  const rows = await withWorkspaceRls(
+  const rows = await withDocumentAccountRls(
     db,
+    input.accountId,
     input.workspaceId,
+    input.access,
     async (scopedDb) => await scopedDb.select({
       chunkId: schema.documentChunks.id,
+      workspaceId: schema.documentChunks.workspaceId,
       documentId: schema.documentChunks.documentId,
       baseId: schema.documentChunks.baseId,
       fileId: schema.documentChunks.fileId,
@@ -988,6 +1082,9 @@ async function keywordSearchDocuments(db, input, limit) {
       sourceUpdatedAt: schema.documents.sourceUpdatedAt,
       sourceVersion: schema.documents.sourceVersion,
       aclTags: schema.documents.aclTags,
+      authorityKind: schema.documents.authorityKind,
+      authorityWorkspaceId: schema.documents.authorityWorkspaceId,
+      authoritySubjectId: schema.documents.authoritySubjectId,
       rank
     }).from(schema.documentChunks).innerJoin(schema.documents, eq(schema.documentChunks.documentId, schema.documents.id)).where(
       and(
@@ -997,17 +1094,20 @@ async function keywordSearchDocuments(db, input, limit) {
     ).orderBy(desc(rank)).limit(limit)
   );
   return rows.map((row) => ({
-    ...mapSearchRowBase(row, input.workspaceId),
+    ...mapSearchRowBase(row),
     vectorScore: null,
     keywordScore: normalizeKeywordScore(Number(row.rank))
   }));
 }
-async function getDocumentChunk(db, workspaceId, chunkId, access) {
-  const [row] = await withWorkspaceRls(
+async function getDocumentChunk(db, accountId, workspaceId, chunkId, access) {
+  const [row] = await withDocumentAccountRls(
     db,
+    accountId,
     workspaceId,
+    access,
     async (scopedDb) => await scopedDb.select({
       chunkId: schema.documentChunks.id,
+      workspaceId: schema.documentChunks.workspaceId,
       documentId: schema.documentChunks.documentId,
       baseId: schema.documentChunks.baseId,
       fileId: schema.documentChunks.fileId,
@@ -1023,55 +1123,102 @@ async function getDocumentChunk(db, workspaceId, chunkId, access) {
       sourceCreatedAt: schema.documents.sourceCreatedAt,
       sourceUpdatedAt: schema.documents.sourceUpdatedAt,
       sourceVersion: schema.documents.sourceVersion,
-      aclTags: schema.documents.aclTags
+      aclTags: schema.documents.aclTags,
+      authorityKind: schema.documents.authorityKind,
+      authorityWorkspaceId: schema.documents.authorityWorkspaceId,
+      authoritySubjectId: schema.documents.authoritySubjectId
     }).from(schema.documentChunks).innerJoin(schema.documents, eq(schema.documentChunks.documentId, schema.documents.id)).where(
       and(
-        eq(schema.documentChunks.workspaceId, workspaceId),
+        eq(schema.documents.accountId, accountId),
+        eq(schema.documentChunks.accountId, accountId),
         eq(schema.documentChunks.id, chunkId),
         eq(schema.documents.status, "ready"),
-        ...documentAccessConditions(access)
+        ...documentAccessConditions(workspaceId, access)
       )
     ).limit(1)
   );
   if (!row) return null;
   return {
-    ...mapSearchRowBase(row, workspaceId),
+    ...mapSearchRowBase(row),
     score: 1,
     matchType: "hybrid",
     vectorScore: null,
     keywordScore: null
   };
 }
-function documentAccessConditions(access) {
-  if (access?.agentOnly) {
-    const viewer2 = access.viewerSubjectId;
-    const visibility = viewer2 ? or(eq(schema.documents.visibility, "workspace"), eq(schema.documents.createdBy, viewer2)) : eq(schema.documents.visibility, "workspace");
-    return [eq(schema.documents.agentAccess, true), ...visibility ? [visibility] : []];
+function resolveDocumentAuthority(input) {
+  const legacyKind = input.legacyVisibility === "private" ? "personal" : "workspace";
+  const kind = input.kind ?? legacyKind;
+  if (input.kind && input.legacyVisibility && input.legacyVisibility === "private" !== (input.kind === "personal")) {
+    throw new Error("document authorityKind conflicts with legacy visibility");
+  }
+  if (kind === "organization") {
+    return { kind, workspaceId: null, subjectId: null };
   }
-  const viewer = access?.viewerSubjectId;
-  if (viewer) {
-    const condition = or(
-      eq(schema.documents.visibility, "workspace"),
-      eq(schema.documents.createdBy, viewer)
+  if (kind === "workspace") {
+    return { kind, workspaceId: input.workspaceId, subjectId: null };
+  }
+  const subjectId = cleanString(input.initiatingSubjectId ?? null);
+  if (!subjectId) throw new Error("personal documents require an initiating subject");
+  if (new TextEncoder().encode(subjectId).byteLength > DOCUMENT_AUTHORITY_SUBJECT_MAX_BYTES) {
+    throw new Error(
+      `personal document initiating subject exceeds ${DOCUMENT_AUTHORITY_SUBJECT_MAX_BYTES} UTF-8 bytes`
     );
-    return condition ? [condition] : [];
   }
-  return [eq(schema.documents.visibility, "workspace")];
+  return { kind, workspaceId: input.workspaceId, subjectId };
+}
+async function withDocumentRls(db, workspaceId, access, fn) {
+  const subjectId = cleanString(access?.viewerSubjectId ?? null);
+  return subjectId ? await withWorkspaceSubjectRls(db, workspaceId, subjectId, fn) : await withWorkspaceRls(db, workspaceId, fn);
+}
+async function withDocumentAccountRls(db, accountId, workspaceId, access, fn) {
+  const context = await assertDocumentAccountWorkspace(db, accountId, workspaceId);
+  const subjectId = cleanString(access?.viewerSubjectId ?? null);
+  return await withRlsContext(db, context, async (scopedDb) => {
+    if (subjectId) await setSubjectRlsContext(scopedDb, subjectId);
+    return await fn(scopedDb);
+  });
+}
+async function assertDocumentAccountWorkspace(db, accountId, workspaceId) {
+  const context = await rlsContextForWorkspace(db, workspaceId);
+  if (context.accountId !== accountId) {
+    throw new Error("document account/workspace authority mismatch");
+  }
+  return context;
+}
+function documentAccessConditions(workspaceId, access) {
+  const organization = eq(schema.documents.authorityKind, "organization");
+  const workspace = and(
+    eq(schema.documents.authorityKind, "workspace"),
+    eq(schema.documents.authorityWorkspaceId, workspaceId)
+  );
+  const viewer = cleanString(access?.viewerSubjectId ?? null);
+  const personal = viewer ? and(
+    eq(schema.documents.authorityKind, "personal"),
+    eq(schema.documents.authorityWorkspaceId, workspaceId),
+    eq(schema.documents.authoritySubjectId, viewer)
+  ) : void 0;
+  const authority = viewer ? or(organization, workspace, personal) ?? organization : or(organization, workspace) ?? organization;
+  if (access?.agentOnly) {
+    return [eq(schema.documents.agentAccess, true), authority];
+  }
+  return [authority];
 }
 function documentMatchesAccess(document, access) {
   if (access?.agentOnly) {
-    return document.agentAccess && (document.visibility !== "private" || !!access.viewerSubjectId && document.createdBy === access.viewerSubjectId);
+    return document.agentAccess && canViewDocument(document, access.viewerSubjectId);
   }
   return canViewDocument(document, access?.viewerSubjectId);
 }
 function canViewDocument(document, viewerSubjectId) {
-  return document.visibility !== "private" || !!viewerSubjectId && document.createdBy === viewerSubjectId;
+  return document.authorityKind !== "personal" || !!viewerSubjectId && document.authoritySubjectId === viewerSubjectId;
 }
 function documentSearchConditions(input, embeddingModel) {
   const conditions = [
     eq(schema.documents.status, "ready"),
-    eq(schema.documentChunks.workspaceId, input.workspaceId),
-    ...documentAccessConditions(input.access)
+    eq(schema.documents.accountId, input.accountId),
+    eq(schema.documentChunks.accountId, input.accountId),
+    ...documentAccessConditions(input.workspaceId, input.access)
   ];
   if (embeddingModel) {
     conditions.push(eq(schema.documentChunks.embeddingModel, embeddingModel));
@@ -1088,10 +1235,10 @@ function documentSearchConditions(input, embeddingModel) {
   }
   return conditions;
 }
-function mapSearchRowBase(row, workspaceId) {
+function mapSearchRowBase(row) {
   return {
     chunkId: row.chunkId,
-    workspaceId,
+    workspaceId: row.workspaceId,
     documentId: row.documentId,
     baseId: row.baseId,
     fileId: row.fileId,
@@ -1107,7 +1254,10 @@ function mapSearchRowBase(row, workspaceId) {
     sourceCreatedAt: row.sourceCreatedAt?.toISOString() ?? null,
     sourceUpdatedAt: row.sourceUpdatedAt?.toISOString() ?? null,
     sourceVersion: row.sourceVersion,
-    aclTags: cleanStringArray(row.aclTags)
+    aclTags: cleanStringArray(row.aclTags),
+    authorityKind: normalizeDocumentAuthorityKind(row.authorityKind),
+    authorityWorkspaceId: row.authorityWorkspaceId,
+    authoritySubjectId: row.authoritySubjectId
   };
 }
 function mergeDocumentSearchRows(rows, mode) {
@@ -1312,6 +1462,9 @@ function mapDocument(row) {
     sourceUpdatedAt: row.sourceUpdatedAt?.toISOString() ?? null,
     sourceVersion: row.sourceVersion,
     aclTags: cleanStringArray(row.aclTags),
+    authorityKind: normalizeDocumentAuthorityKind(row.authorityKind),
+    authorityWorkspaceId: row.authorityWorkspaceId,
+    authoritySubjectId: row.authoritySubjectId,
     visibility: normalizeDocumentVisibility(row.visibility),
     createdBy: row.createdBy,
     agentAccess: row.agentAccess,
@@ -1323,6 +1476,15 @@ function mapDocument(row) {
     updatedAt: row.updatedAt.toISOString()
   };
 }
+function normalizeDocumentAuthorityKind(value) {
+  switch (value) {
+    case "organization":
+    case "personal":
+      return value;
+    default:
+      return "workspace";
+  }
+}
 function normalizeDocumentVisibility(value) {
   return value === "private" ? "private" : "workspace";
 }
@@ -1346,6 +1508,7 @@ export {
   DEFAULT_DOCUMENT_EMBEDDING_DIMENSIONS,
   DEFAULT_DOCUMENT_EMBEDDING_MODEL,
   DEFAULT_DOCUMENT_PARSER,
+  DOCUMENT_AUTHORITY_SUBJECT_MAX_BYTES,
   DOCUMENT_CURATION_AUTO_FILE_CONFIDENCE,
   DOCUMENT_CURATION_MAX_INPUT_CHARS,
   DeterministicEmbeddingProvider,
@@ -1376,6 +1539,8 @@ export {
   parseCurationOutcome,
   parseDocumentBytes,
   queueDocumentForReindex,
-  searchDocuments
+  resolveDocumentAuthority,
+  searchDocuments,
+  searchEffectiveDocuments
 };
 //# sourceMappingURL=index.js.map