feat(project-files): add authorized core storage and realtime operations

Author: mzxchandra

.github/scripts/http-e2e.sh

@@ -3,7 +3,7 @@
 # mobile, which serves the production build the `e2e-build` job uploads with `next start` (the
 # job extracts it into apps/sim/.next first).
 #
-# Usage: http-e2e.sh <scim|cli|stop-after|desktop-inbox|mobile>   (run from apps/sim)
+# Usage: http-e2e.sh <scim|cli|stop-after|desktop-inbox|project-files|mobile>   (run from apps/sim)
 #
 # The job provides DATABASE_URL, BETTER_AUTH_SECRET and ENCRYPTION_KEY; each group sets the rest of
 # its app's environment here. Reports and server logs land in $RUNNER_TEMP/e2e.
@@ -19,7 +19,7 @@
 # telemetry flush runs detached and still writes .next/dev).
 set -euo pipefail
 
-group=${1:?usage: http-e2e.sh <scim|cli|stop-after|desktop-inbox|mobile>}
+group=${1:?usage: http-e2e.sh <scim|cli|stop-after|desktop-inbox|project-files|mobile>}
 report_dir="$RUNNER_TEMP/e2e"
 ready_timeout_seconds=300
 mkdir -p "$report_dir"
@@ -211,6 +211,15 @@ case "$group" in
       bun run test:desktop-inbox:e2e
     ;;
 
+  project-files)
+    PROJECT_FILES_E2E_ADMIN_DATABASE_URL=postgresql://postgres:postgres@127.0.0.1:5432/postgres \
+    PROJECT_FILES_E2E_REDIS_URL=redis://127.0.0.1:6379 \
+    PROJECT_FILES_E2E_BASE_URL=http://127.0.0.1:3050 \
+    PROJECT_FILES_E2E_RELAY_URL=http://127.0.0.1:3052 \
+    PROJECT_FILES_E2E_REPORT_PATH="$report_dir/project-files/orchestration.json" \
+      bun --no-env-file scripts/test-project-files-e2e.ts
+    ;;
+
   # MOBILE_E2E_BROWSER (chromium or webkit) narrows the job to one browser; unset runs both.
   mobile)
     app_server=start

.github/workflows/checks.yml

@@ -196,6 +196,8 @@ jobs:
             runner: blacksmith-4vcpu-ubuntu-2404
           - group: stop-after
             runner: blacksmith-4vcpu-ubuntu-2404
+          - group: project-files
+            runner: blacksmith-8vcpu-ubuntu-2404
           - group: desktop-inbox
             runner: blacksmith-4vcpu-ubuntu-2404
     services:
@@ -212,7 +214,7 @@ jobs:
           --health-interval 5s
           --health-timeout 5s
           --health-retries 10
-      # Only the desktop executor's app is given REDIS_URL: its doorbell and presence live there.
+      # Project file subscriptions and the desktop executor use Redis.
       redis:
         image: redis:8.2-alpine
         ports:

apps/docs/content/docs/cli/commands.mdx

@@ -47,6 +47,7 @@ These apply to every command, and may be written before or after it.
 | [`sim meta`](/cli/meta) | Manage meta |
 | [`sim organizations`](/cli/organizations) | Manage organizations |
 | [`sim permission-groups`](/cli/permission-groups) | Manage permission groups |
+| [`sim projects`](/cli/projects) | Manage projects |
 | [`sim sandboxes`](/cli/sandboxes) | Manage sandboxes |
 | [`sim secrets`](/cli/secrets) | Manage secrets |
 | [`sim selectors`](/cli/selectors) | Manage selectors |

apps/docs/content/docs/cli/meta.json

@@ -30,6 +30,7 @@
     "meta",
     "organizations",
     "permission-groups",
+    "projects",
     "sandboxes",
     "secrets",
     "selectors",