feat(project-files): add public sharing and protected delivery
Merged
MZ
3d ago+4269+4269+0123456789012345678901234567890123456789-1806-1806-0123456789012345678901234567890123456789
Summary
- Add Project file share management and shared bearer authorization for workspace and Project public delivery.
- Revalidate current share credentials, canonical ownership, file revisions, and referenced assets before returning bytes. Reuse the renderer-qualified compiled-document cache without compiling on public reads.
- Final backend slice of #8610, rebased onto staging after #9018. Project public API/CLI docs remain unpublished; runtime commands are available. Product integration continues in #9034.
Type of Change
- Feature / refactor
Testing
- 20 focused security unit tests and 10 disposable PostgreSQL sharing checks passed.
- Scoped TypeScript and changed-file formatting checks passed; cleanup review found no changes needed.
- 34 local HTTP/source-adapter checks passed: public delivery and credentials (22), sharing policy (7), and inline isolation/cache behavior (5). Hosted CI and bot reviews pending.
- Pre-deploy synthetic public/disabled share fixtures prepared; post-promotion verification pending. Projects remains disabled on shared staging.
Checklist
- Code follows project style guidelines
- Self-reviewed my changes
- Focused tests added/updated and passing
- Full hosted CI passed
- I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)