refactor(ee): move every enterprise feature's server code under ee/<feature>/lib

Everything the enterprise feature flags turn on now lives with its UI in
apps/sim/ee, following the layout workspace forking already used:

- access control     lib/permission-groups              → ee/access-control/lib
- audit logs         lib/audit-logs                     → ee/audit-logs/lib
- data drains        lib/data-drains                    → ee/data-drains/lib
- data retention     lib/billing/retention              → ee/data-retention/lib
- session policies   lib/auth/session-policy            → ee/session-policy/lib
- SSO                lib/auth/sso                       → ee/sso/lib
- custom blocks      lib/workflows/custom-blocks        → ee/custom-blocks/lib
- usage monitoring   lib/billing/application/organization-usage → ee/organization-usage/lib

Pure move: git renames plus import rewrites, with the graph, capability,
enforcement, and registry-boundary checks repointed. Contracts stay in
lib/api/contracts and routes under app/api; the README documents the layout.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DGXcwsHzYGp6pUDWRtJKpz

Author: waleedlatif1

apps/sim/app/api/audit-logs/export/route.test.ts

@@ -22,7 +22,7 @@ vi.mock('@/app/api/v1/audit-logs/auth', () => ({
   validateEnterpriseAuditAccess: mockValidateEnterpriseAuditAccess,
 }))
 
-vi.mock('@/lib/audit-logs/query', () => ({
+vi.mock('@/ee/audit-logs/lib/query', () => ({
   buildFilterConditions: mockBuildFilterConditions,
   buildOrgScopeCondition: mockBuildOrgScopeCondition,
   getOrgWorkspaceIds: mockGetOrgWorkspaceIds,

apps/sim/app/api/audit-logs/export/route.ts

@@ -3,17 +3,17 @@ import { getErrorMessage } from '@sim/utils/errors'
 import { type NextRequest, NextResponse } from 'next/server'
 import { exportAuditLogsContract } from '@/lib/api/contracts/audit-logs'
 import { getValidationErrorMessage, parseRequest } from '@/lib/api/server'
-import {
-  buildFilterConditions,
-  buildOrgScopeCondition,
-  getOrgWorkspaceIds,
-  queryAuditLogs,
-} from '@/lib/audit-logs/query'
 import { getSession } from '@/lib/auth'
 import { formatCsvValue, toCsvRow } from '@/lib/core/utils/csv'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { validateEnterpriseAuditAccess } from '@/app/api/v1/audit-logs/auth'
 import { formatAuditLogEntry } from '@/app/api/v1/audit-logs/format'
+import {
+  buildFilterConditions,
+  buildOrgScopeCondition,
+  getOrgWorkspaceIds,
+  queryAuditLogs,
+} from '@/ee/audit-logs/lib/query'
 
 const logger = createLogger('AuditLogsExportAPI')
 

apps/sim/app/api/audit-logs/route.test.ts

@@ -11,7 +11,7 @@ const mocks = vi.hoisted(() => ({
 
 vi.mock('@/lib/auth', () => ({ getSession: mocks.getSession }))
 
-vi.mock('@/lib/audit-logs/application/list-audit-logs', () => ({
+vi.mock('@/ee/audit-logs/lib/application/list-audit-logs', () => ({
   listAuditLogs: { operation: { id: 'audit_logs.list' }, execute: mocks.execute },
 }))
 

apps/sim/app/api/audit-logs/route.ts

@@ -5,9 +5,9 @@ import {
   internalRateLimits,
   internalSessionAuth,
 } from '@/lib/api/server/routes'
-import { listAuditLogs } from '@/lib/audit-logs/application/list-audit-logs'
-import { auditLogOperations } from '@/lib/audit-logs/application/operations'
 import { formatAuditLogEntry } from '@/app/api/v1/audit-logs/format'
+import { listAuditLogs } from '@/ee/audit-logs/lib/application/list-audit-logs'
+import { auditLogOperations } from '@/ee/audit-logs/lib/application/operations'
 
 export const dynamic = 'force-dynamic'
 

apps/sim/app/api/auth/oauth/connections/route.test.ts

@@ -28,7 +28,7 @@ vi.mock('@sim/db', () => ({
   eq: mockEq,
 }))
 
-vi.mock('@/lib/permission-groups/config-scope.server', () => permissionGroupScopeMock)
+vi.mock('@/ee/access-control/lib/config-scope.server', () => permissionGroupScopeMock)
 
 vi.mock('jose', () => ({
   decodeJwt: mockDecodeJwt,

apps/sim/app/api/auth/oauth/credentials/route.test.ts

@@ -36,10 +36,10 @@ vi.mock('@/lib/workflows/utils', () => workflowsUtilsMock)
 
 vi.mock('@/lib/workspaces/permissions/utils', () => permissionsMock)
 
-vi.mock('@/lib/permission-groups/config-scope.server', () => permissionGroupScopeMock)
+vi.mock('@/ee/access-control/lib/config-scope.server', () => permissionGroupScopeMock)
 
-import { DEFAULT_PERMISSION_GROUP_CONFIG } from '@/lib/permission-groups/fields'
 import { GET } from '@/app/api/auth/oauth/credentials/route'
+import { DEFAULT_PERMISSION_GROUP_CONFIG } from '@/ee/access-control/lib/fields'
 
 describe('OAuth Credentials API Route', () => {
   function createMockRequestWithQuery(method = 'GET', queryParams = ''): NextRequest {

apps/sim/app/api/auth/oauth/credentials/route.ts

@@ -16,11 +16,11 @@ import {
   getServiceAccountProviderForProviderId,
   providerIdsForService,
 } from '@/lib/oauth/utils'
+import { checkWorkspaceAccess } from '@/lib/workspaces/permissions/utils'
 import {
   capabilityRefusal,
   isWorkspaceCapabilityWithheld,
-} from '@/lib/permission-groups/capability-assertions'
-import { checkWorkspaceAccess } from '@/lib/workspaces/permissions/utils'
+} from '@/ee/access-control/lib/capability-assertions'
 
 export const dynamic = 'force-dynamic'
 

apps/sim/app/api/chat/manage/[id]/route.test.ts

@@ -21,7 +21,7 @@ import {
 } from '@sim/testing'
 import { NextRequest } from 'next/server'
 import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
-import { PermissionGroupCapabilityError } from '@/lib/permission-groups/capability-error'
+import { PermissionGroupCapabilityError } from '@/ee/access-control/lib/capability-error'
 
 const mocks = vi.hoisted(() => ({
   resolvePermission: vi.fn(),

apps/sim/app/api/chat/route.test.ts

@@ -18,7 +18,7 @@ import {
 } from '@sim/testing'
 import { NextRequest } from 'next/server'
 import { afterAll, beforeEach, describe, expect, it, vi } from 'vitest'
-import { PermissionGroupCapabilityError } from '@/lib/permission-groups/capability-error'
+import { PermissionGroupCapabilityError } from '@/ee/access-control/lib/capability-error'
 
 const mocks = vi.hoisted(() => ({
   resolvePermission: vi.fn(),

apps/sim/app/api/cli/auth/approve/route.test.ts

@@ -25,7 +25,7 @@ const {
   mockGetUserOrganization: vi.fn(),
 }))
 
-vi.mock('@/lib/permission-groups/resolve.server', () => ({
+vi.mock('@/ee/access-control/lib/resolve.server', () => ({
   getUserPermissionConfig: mockGetUserPermissionConfig,
   getUserPermissionConfigForOrganization: mockGetOrgPermissionConfig,
   resolveVerifiedUserAccessControlContext: mockResolveVerifiedContext,