/**
 * GET /api/admin/accounts/:sub/cloud/documents/:id[?content=1]: one document the account owns, with its shares,
 * pending invitations, audio render counts and search index presence. Documents owned by anyone else are 404 here
 * (the unlock covers this account only). Never the text, the file or audio.
 */
export const GET = cloudRoute<{ sub: string; id: string }>("document", accountTarget, async (_request, { viewer, params }) => {
  if (!isDocumentId(params.id)) throw notFound();
  const detail = await documentDetail(params.id);
  if (!detail || detail.document.owner !== accountPrincipal(params.sub)) throw notFound();
  return presentDocumentDetail(detail, viewer);
});