refactor(ee): move every enterprise feature's server code under ee/<feature>/lib

apps/sim/app/api/audit-logs/export/route.test.ts

@@ -22,7 +22,7 @@ vi.mock('@/app/api/v1/audit-logs/auth', () => ({
   validateEnterpriseAuditAccess: mockValidateEnterpriseAuditAccess,
 }))
 
-vi.mock('@/lib/audit-logs/query', () => ({
+vi.mock('@/ee/audit-logs/lib/query', () => ({
   buildFilterConditions: mockBuildFilterConditions,
   buildOrgScopeCondition: mockBuildOrgScopeCondition,
   getOrgWorkspaceIds: mockGetOrgWorkspaceIds,

apps/sim/app/api/audit-logs/export/route.ts

@@ -3,17 +3,17 @@ import { getErrorMessage } from '@sim/utils/errors'
 import { type NextRequest, NextResponse } from 'next/server'
 import { exportAuditLogsContract } from '@/lib/api/contracts/audit-logs'
 import { getValidationErrorMessage, parseRequest } from '@/lib/api/server'
-import {
-  buildFilterConditions,
-  buildOrgScopeCondition,
-  getOrgWorkspaceIds,
-  queryAuditLogs,
-} from '@/lib/audit-logs/query'
 import { getSession } from '@/lib/auth'
 import { formatCsvValue, toCsvRow } from '@/lib/core/utils/csv'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { validateEnterpriseAuditAccess } from '@/app/api/v1/audit-logs/auth'
 import { formatAuditLogEntry } from '@/app/api/v1/audit-logs/format'
+import {
+  buildFilterConditions,
+  buildOrgScopeCondition,
+  getOrgWorkspaceIds,
+  queryAuditLogs,
+} from '@/ee/audit-logs/lib/query'
 
 const logger = createLogger('AuditLogsExportAPI')
 

apps/sim/app/api/audit-logs/route.test.ts

@@ -11,7 +11,7 @@ const mocks = vi.hoisted(() => ({
 
 vi.mock('@/lib/auth', () => ({ getSession: mocks.getSession }))
 
-vi.mock('@/lib/audit-logs/application/list-audit-logs', () => ({
+vi.mock('@/ee/audit-logs/lib/application/list-audit-logs', () => ({
   listAuditLogs: { operation: { id: 'audit_logs.list' }, execute: mocks.execute },
 }))
 

apps/sim/app/api/audit-logs/route.ts

@@ -5,9 +5,9 @@ import {
   internalRateLimits,
   internalSessionAuth,
 } from '@/lib/api/server/routes'
-import { listAuditLogs } from '@/lib/audit-logs/application/list-audit-logs'
-import { auditLogOperations } from '@/lib/audit-logs/application/operations'
 import { formatAuditLogEntry } from '@/app/api/v1/audit-logs/format'
+import { listAuditLogs } from '@/ee/audit-logs/lib/application/list-audit-logs'
+import { auditLogOperations } from '@/ee/audit-logs/lib/application/operations'
 
 export const dynamic = 'force-dynamic'
 

apps/sim/app/api/auth/oauth/connections/route.test.ts

@@ -28,7 +28,7 @@ vi.mock('@sim/db', () => ({
   eq: mockEq,
 }))
 
-vi.mock('@/lib/permission-groups/config-scope.server', () => permissionGroupScopeMock)
+vi.mock('@/ee/access-control/lib/config-scope.server', () => permissionGroupScopeMock)
 
 vi.mock('jose', () => ({
   decodeJwt: mockDecodeJwt,

apps/sim/app/api/auth/oauth/credentials/route.test.ts

@@ -36,10 +36,10 @@ vi.mock('@/lib/workflows/utils', () => workflowsUtilsMock)
 
 vi.mock('@/lib/workspaces/permissions/utils', () => permissionsMock)
 
-vi.mock('@/lib/permission-groups/config-scope.server', () => permissionGroupScopeMock)
+vi.mock('@/ee/access-control/lib/config-scope.server', () => permissionGroupScopeMock)
 
-import { DEFAULT_PERMISSION_GROUP_CONFIG } from '@/lib/permission-groups/fields'
 import { GET } from '@/app/api/auth/oauth/credentials/route'
+import { DEFAULT_PERMISSION_GROUP_CONFIG } from '@/ee/access-control/lib/fields'
 
 describe('OAuth Credentials API Route', () => {
   function createMockRequestWithQuery(method = 'GET', queryParams = ''): NextRequest {

apps/sim/app/api/auth/oauth/credentials/route.ts

@@ -16,11 +16,11 @@ import {
   getServiceAccountProviderForProviderId,
   providerIdsForService,
 } from '@/lib/oauth/utils'
+import { checkWorkspaceAccess } from '@/lib/workspaces/permissions/utils'
 import {
   capabilityRefusal,
   isWorkspaceCapabilityWithheld,
-} from '@/lib/permission-groups/capability-assertions'
-import { checkWorkspaceAccess } from '@/lib/workspaces/permissions/utils'
+} from '@/ee/access-control/lib/capability-assertions'
 
 export const dynamic = 'force-dynamic'
 

apps/sim/app/api/chat/manage/[id]/route.test.ts

@@ -21,7 +21,7 @@ import {
 } from '@sim/testing'
 import { NextRequest } from 'next/server'
 import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
-import { PermissionGroupCapabilityError } from '@/lib/permission-groups/capability-error'
+import { PermissionGroupCapabilityError } from '@/ee/access-control/lib/capability-error'
 
 const mocks = vi.hoisted(() => ({
   resolvePermission: vi.fn(),

apps/sim/app/api/chat/route.test.ts

@@ -18,7 +18,7 @@ import {
 } from '@sim/testing'
 import { NextRequest } from 'next/server'
 import { afterAll, beforeEach, describe, expect, it, vi } from 'vitest'
-import { PermissionGroupCapabilityError } from '@/lib/permission-groups/capability-error'
+import { PermissionGroupCapabilityError } from '@/ee/access-control/lib/capability-error'
 
 const mocks = vi.hoisted(() => ({
   resolvePermission: vi.fn(),

apps/sim/app/api/cli/auth/approve/route.test.ts

@@ -25,7 +25,7 @@ const {
   mockGetUserOrganization: vi.fn(),
 }))
 
-vi.mock('@/lib/permission-groups/resolve.server', () => ({
+vi.mock('@/ee/access-control/lib/resolve.server', () => ({
   getUserPermissionConfig: mockGetUserPermissionConfig,
   getUserPermissionConfigForOrganization: mockGetOrgPermissionConfig,
   resolveVerifiedUserAccessControlContext: mockResolveVerifiedContext,

apps/sim/app/api/cli/auth/approve/route.ts

@@ -6,9 +6,9 @@ import { getSession } from '@/lib/auth'
 import { createApproval } from '@/lib/cli-auth/approval-store'
 import { enforceUserRateLimit } from '@/lib/core/rate-limiter'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import { capabilityRefusal } from '@/lib/permission-groups/capability-assertions'
-import { isCapabilityWithheldForUser } from '@/lib/permission-groups/user-scope.server'
 import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
+import { capabilityRefusal } from '@/ee/access-control/lib/capability-assertions'
+import { isCapabilityWithheldForUser } from '@/ee/access-control/lib/user-scope.server'
 
 const logger = createLogger('CliAuthApproveAPI')
 

apps/sim/app/api/copilot/tool-permission/route.test.ts

@@ -51,7 +51,7 @@ vi.mock('@/lib/core/config/env-flags', () => ({
   isCopilotToolPermissionsEnabled: true,
 }))
 
-vi.mock('@/lib/permission-groups/resolve.server', () => ({
+vi.mock('@/ee/access-control/lib/resolve.server', () => ({
   getUserPermissionConfig,
 }))
 

apps/sim/app/api/copilot/tool-permission/route.ts

@@ -29,7 +29,7 @@ import {
 import { withIncomingGoSpan } from '@/lib/copilot/request/otel'
 import { isCopilotToolPermissionsEnabled } from '@/lib/core/config/env-flags'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import { isWorkspaceCapabilityWithheld } from '@/lib/permission-groups/capability-assertions'
+import { isWorkspaceCapabilityWithheld } from '@/ee/access-control/lib/capability-assertions'
 
 const logger = createLogger('CopilotToolPermissionAPI')
 

apps/sim/app/api/cron/run-data-drains/route.ts

@@ -4,7 +4,7 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { verifyCronAuth } from '@/lib/auth/internal'
 import { isBillingEnabled, isDataDrainsEnabled } from '@/lib/core/config/env-flags'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import { dispatchDueDrains } from '@/lib/data-drains/dispatcher'
+import { dispatchDueDrains } from '@/ee/data-drains/lib/dispatcher'
 
 const logger = createLogger('CronRunDataDrains')
 

apps/sim/app/api/custom-blocks/[id]/authorize-manage.ts

@@ -1,9 +1,9 @@
 import { NextResponse } from 'next/server'
+import { hasWorkspaceAdminAccess } from '@/lib/workspaces/permissions/utils'
 import {
   getCustomBlockManageContext,
   isCustomBlocksDeploymentEnabled,
-} from '@/lib/workflows/custom-blocks/operations'
-import { hasWorkspaceAdminAccess } from '@/lib/workspaces/permissions/utils'
+} from '@/ee/custom-blocks/lib/operations'
 
 export type ManageContext = NonNullable<Awaited<ReturnType<typeof getCustomBlockManageContext>>>
 

apps/sim/app/api/custom-blocks/[id]/route.ts

@@ -10,13 +10,13 @@ import {
 import { parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { authorizeManage } from '@/app/api/custom-blocks/[id]/authorize-manage'
 import {
   CustomBlockValidationError,
   deleteCustomBlock,
   getCustomBlockUsageCounts,
   updateCustomBlock,
-} from '@/lib/workflows/custom-blocks/operations'
-import { authorizeManage } from '@/app/api/custom-blocks/[id]/authorize-manage'
+} from '@/ee/custom-blocks/lib/operations'
 
 const logger = createLogger('CustomBlockAPI')
 

apps/sim/app/api/custom-blocks/[id]/usages/route.test.ts

@@ -17,7 +17,7 @@ vi.mock('@/lib/workspaces/permissions/utils', () => ({
   hasWorkspaceAdminAccess: mockHasWorkspaceAdminAccess,
 }))
 
-vi.mock('@/lib/workflows/custom-blocks/operations', () => mockOperations)
+vi.mock('@/ee/custom-blocks/lib/operations', () => mockOperations)
 
 import { GET } from '@/app/api/custom-blocks/[id]/usages/route'
 

apps/sim/app/api/custom-blocks/[id]/usages/route.ts

@@ -4,8 +4,8 @@ import { getCustomBlockUsageCountsContract } from '@/lib/api/contracts/custom-bl
 import { parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import { getCustomBlockUsageCounts } from '@/lib/workflows/custom-blocks/operations'
 import { authorizeManage } from '@/app/api/custom-blocks/[id]/authorize-manage'
+import { getCustomBlockUsageCounts } from '@/ee/custom-blocks/lib/operations'
 
 type RouteContext = { params: Promise<{ id: string }> }
 

apps/sim/app/api/custom-blocks/route.ts

@@ -10,14 +10,14 @@ import {
 import { parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { checkWorkspaceAccess } from '@/lib/workspaces/permissions/utils'
 import {
   CustomBlockValidationError,
   type CustomBlockWithInputs,
   isCustomBlocksEligibleForOrganization,
   listCustomBlocksWithInputs,
   publishCustomBlock,
-} from '@/lib/workflows/custom-blocks/operations'
-import { checkWorkspaceAccess } from '@/lib/workspaces/permissions/utils'
+} from '@/ee/custom-blocks/lib/operations'
 
 const logger = createLogger('CustomBlocksAPI')
 

apps/sim/app/api/invitations/[id]/resend/route.ts

@@ -18,9 +18,9 @@ import {
   prepareInvitationResend,
   sendInvitationEmail,
 } from '@/lib/invitations/send'
-import { capabilityRefusalResponse } from '@/lib/permission-groups/capability-response'
 import { getWorkspaceWithOwner, hasWorkspaceAdminAccess } from '@/lib/workspaces/permissions/utils'
 import { getWorkspaceInvitePolicy } from '@/lib/workspaces/policy'
+import { capabilityRefusalResponse } from '@/ee/access-control/lib/capability-response'
 import {
   InvitationsNotAllowedError,
   validateInvitationsAllowed,

apps/sim/app/api/logs/export/route.test.ts

@@ -25,7 +25,7 @@ const {
   mockGetUserPermissionConfig: vi.fn(),
 }))
 
-vi.mock('@/lib/permission-groups/resolve.server', () => ({
+vi.mock('@/ee/access-control/lib/resolve.server', () => ({
   getUserPermissionConfig: mockGetUserPermissionConfig,
 }))
 
@@ -46,8 +46,8 @@ vi.mock('@/lib/core/utils/concurrency', () => ({
   mapWithConcurrency: mockMapWithConcurrency,
 }))
 
-import { capabilityRefusal } from '@/lib/permission-groups/capabilities'
 import { GET } from '@/app/api/logs/export/route'
+import { capabilityRefusal } from '@/ee/access-control/lib/capabilities'
 
 const mockGetSession = authMockFns.mockGetSession
 const STARTED_AT = new Date('2026-08-23T12:00:00.000Z')

apps/sim/app/api/logs/export/route.ts

@@ -13,12 +13,12 @@ import { withheldSpendData } from '@/lib/logs/fetch-log-detail'
 import { buildFilterConditions, LogFilterParamsSchema } from '@/lib/logs/filters'
 import { expandFolderIdsWithDescendants } from '@/lib/logs/folder-expansion'
 import { logQuerySelectsCost } from '@/lib/logs/log-projection'
+import { checkWorkspaceAccess } from '@/lib/workspaces/permissions/utils'
 import {
   capabilityDeniedBy,
   capabilityRefusal,
-} from '@/lib/permission-groups/capability-assertions'
-import { resolvePermissionGroupConfig } from '@/lib/permission-groups/config-scope.server'
-import { checkWorkspaceAccess } from '@/lib/workspaces/permissions/utils'
+} from '@/ee/access-control/lib/capability-assertions'
+import { resolvePermissionGroupConfig } from '@/ee/access-control/lib/config-scope.server'
 
 const logger = createLogger('LogsExportAPI')
 const LOG_EXPORT_PAGE_SIZE = 100

apps/sim/app/api/logs/stats/route.test.ts

@@ -29,10 +29,10 @@ vi.mock('@/lib/logs/stats-queries', () => ({
   readLogStatsSegments: mocks.readLogStatsSegments,
 }))
 
-vi.mock('@/lib/permission-groups/config-scope.server', () => permissionGroupScopeMock)
+vi.mock('@/ee/access-control/lib/config-scope.server', () => permissionGroupScopeMock)
 
-import { capabilityRefusal } from '@/lib/permission-groups/capabilities'
 import { GET } from '@/app/api/logs/stats/route'
+import { capabilityRefusal } from '@/ee/access-control/lib/capabilities'
 
 const resolveGroupConfigMock = permissionGroupScopeMockFns.mockResolvePermissionGroupConfig
 

apps/sim/app/api/logs/stats/route.ts

@@ -12,9 +12,9 @@ import { expandFolderIdsWithDescendants } from '@/lib/logs/folder-expansion'
 import { logQuerySelectsCost } from '@/lib/logs/log-projection'
 import { buildDashboardStats, resolveLogStatsWindow } from '@/lib/logs/stats'
 import { readLogStatsBounds, readLogStatsSegments } from '@/lib/logs/stats-queries'
-import { isWorkspaceCapabilityWithheld } from '@/lib/permission-groups/capability-assertions'
-import { capabilityRefusalResponse } from '@/lib/permission-groups/capability-response'
 import { checkWorkspaceAccess } from '@/lib/workspaces/permissions/utils'
+import { isWorkspaceCapabilityWithheld } from '@/ee/access-control/lib/capability-assertions'
+import { capabilityRefusalResponse } from '@/ee/access-control/lib/capability-response'
 
 const logger = createLogger('LogsStatsAPI')
 

apps/sim/app/api/organizations/[id]/data-drains/[drainId]/route.ts

@@ -12,10 +12,10 @@ import {
 } from '@/lib/api/contracts/data-drains'
 import { parseRequest, validationErrorResponse } from '@/lib/api/server'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import { authorizeDrainAccess, loadDrain } from '@/lib/data-drains/access'
-import { getDestination } from '@/lib/data-drains/destinations/registry'
-import { encryptCredentials } from '@/lib/data-drains/encryption'
-import { serializeDrain } from '@/lib/data-drains/serializers'
+import { authorizeDrainAccess, loadDrain } from '@/ee/data-drains/lib/access'
+import { getDestination } from '@/ee/data-drains/lib/destinations/registry'
+import { encryptCredentials } from '@/ee/data-drains/lib/encryption'
+import { serializeDrain } from '@/ee/data-drains/lib/serializers'
 
 const logger = createLogger('DataDrainAPI')
 

apps/sim/app/api/organizations/[id]/data-drains/[drainId]/run/route.ts

@@ -8,7 +8,7 @@ import { runDataDrainContract } from '@/lib/api/contracts/data-drains'
 import { parseRequest } from '@/lib/api/server'
 import { getJobQueue } from '@/lib/core/async-jobs'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import { authorizeDrainAccess, loadDrain } from '@/lib/data-drains/access'
+import { authorizeDrainAccess, loadDrain } from '@/ee/data-drains/lib/access'
 
 const logger = createLogger('DataDrainRunAPI')
 

apps/sim/app/api/organizations/[id]/data-drains/[drainId]/runs/route.ts

@@ -5,8 +5,8 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { listDataDrainRunsContract } from '@/lib/api/contracts/data-drains'
 import { parseRequest } from '@/lib/api/server'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import { authorizeDrainAccess, loadDrain } from '@/lib/data-drains/access'
-import { serializeDrainRun } from '@/lib/data-drains/serializers'
+import { authorizeDrainAccess, loadDrain } from '@/ee/data-drains/lib/access'
+import { serializeDrainRun } from '@/ee/data-drains/lib/serializers'
 
 const DEFAULT_LIMIT = 25
 

apps/sim/app/api/organizations/[id]/data-drains/[drainId]/test/route.ts

@@ -5,9 +5,9 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { testDataDrainContract } from '@/lib/api/contracts/data-drains'
 import { parseRequest } from '@/lib/api/server'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import { authorizeDrainAccess, loadDrain } from '@/lib/data-drains/access'
-import { getDestination } from '@/lib/data-drains/destinations/registry'
-import { decryptCredentials } from '@/lib/data-drains/encryption'
+import { authorizeDrainAccess, loadDrain } from '@/ee/data-drains/lib/access'
+import { getDestination } from '@/ee/data-drains/lib/destinations/registry'
+import { decryptCredentials } from '@/ee/data-drains/lib/encryption'
 
 const logger = createLogger('DataDrainTestAPI')
 

apps/sim/app/api/organizations/[id]/data-drains/route.ts

@@ -9,10 +9,10 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { createDataDrainContract, listDataDrainsContract } from '@/lib/api/contracts/data-drains'
 import { parseRequest, validationErrorResponse } from '@/lib/api/server'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import { authorizeDrainAccess } from '@/lib/data-drains/access'
-import { getDestination } from '@/lib/data-drains/destinations/registry'
-import { encryptCredentials } from '@/lib/data-drains/encryption'
-import { serializeDrain } from '@/lib/data-drains/serializers'
+import { authorizeDrainAccess } from '@/ee/data-drains/lib/access'
+import { getDestination } from '@/ee/data-drains/lib/destinations/registry'
+import { encryptCredentials } from '@/ee/data-drains/lib/encryption'
+import { serializeDrain } from '@/ee/data-drains/lib/serializers'
 
 const logger = createLogger('DataDrainsAPI')
 

apps/sim/app/api/organizations/[id]/data-retention/route.ts

@@ -13,10 +13,10 @@ import { parseRequest, validationErrorResponse } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
 import { CLEANUP_CONFIG } from '@/lib/billing/cleanup-dispatcher'
 import { isOrganizationOnEnterprisePlan } from '@/lib/billing/core/subscription'
-import { getForeignWorkspaceTargetsReason } from '@/lib/billing/retention'
 import { isBillingEnabled } from '@/lib/core/config/env-flags'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { coercePiiLanguage } from '@/lib/guardrails/pii-entities'
+import { getForeignWorkspaceTargetsReason } from '@/ee/data-retention/lib/retention'
 
 const logger = createLogger('DataRetentionAPI')
 

apps/sim/app/api/organizations/[id]/domains/[domainId]/verify/route.test.ts

@@ -36,7 +36,7 @@ vi.mock('@sim/audit', () => ({
   AuditResourceType: { ORGANIZATION: 'organization' },
 }))
 
-vi.mock('@/lib/auth/sso/domain-verification', () => ({
+vi.mock('@/ee/sso/lib/domain-verification', () => ({
   checkDomainTxtRecord: mockCheckDomainTxtRecord,
   toDomainResponse: (row: { id: string; status: string }) => ({ id: row.id, status: row.status }),
 }))

apps/sim/app/api/organizations/[id]/domains/[domainId]/verify/route.ts

@@ -9,10 +9,10 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { verifyOrganizationDomainContract } from '@/lib/api/contracts/organization'
 import { parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
-import { checkDomainTxtRecord, toDomainResponse } from '@/lib/auth/sso/domain-verification'
 import { isOrganizationOnEnterprisePlan } from '@/lib/billing/core/subscription'
 import { isBillingEnabled } from '@/lib/core/config/env-flags'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { checkDomainTxtRecord, toDomainResponse } from '@/ee/sso/lib/domain-verification'
 
 const logger = createLogger('OrgDomainVerifyAPI')
 

apps/sim/app/api/organizations/[id]/domains/route.ts

@@ -14,10 +14,10 @@ import {
 } from '@/lib/api/contracts/organization'
 import { parseRequest, validationErrorResponse } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
-import { generateVerificationToken, toDomainResponse } from '@/lib/auth/sso/domain-verification'
 import { isOrganizationOnEnterprisePlan } from '@/lib/billing/core/subscription'
 import { isBillingEnabled } from '@/lib/core/config/env-flags'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { generateVerificationToken, toDomainResponse } from '@/ee/sso/lib/domain-verification'
 
 const logger = createLogger('OrgDomainsAPI')