refactor(scim): move the provisioning library under ee

The server side of directory provisioning lives with the other enterprise
features in apps/sim/ee/scim, alongside its settings UI; contracts and the
route builder stay where every surface's do.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DGXcwsHzYGp6pUDWRtJKpz

Author: waleedlatif1

apps/sim/app/api/cron/scim-reconcile/route.ts

@@ -4,7 +4,7 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { verifyCronAuth } from '@/lib/auth/internal'
 import { isScimEnabled } from '@/lib/core/config/env-flags'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import { runScimReconcileSweep } from '@/lib/scim/reconcile/job'
+import { runScimReconcileSweep } from '@/ee/scim/reconcile/job'
 
 const logger = createLogger('CronScimReconcile')
 

apps/sim/app/api/organizations/[id]/members/[memberId]/route.ts

@@ -23,7 +23,7 @@ import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { isRetryableTransactionError } from '@/lib/db/transaction'
 import { changeMemberRoleTx } from '@/lib/organizations/members/lifecycle'
 import { captureServerEvent } from '@/lib/posthog/server'
-import { assertMembershipNotScimManaged } from '@/lib/scim/managed-membership'
+import { assertMembershipNotScimManaged } from '@/ee/scim/managed-membership'
 
 const logger = createLogger('OrganizationMemberAPI')
 

apps/sim/app/api/organizations/[id]/scim/activity/route.ts

@@ -5,7 +5,7 @@ import {
   internalRateLimits,
   internalSessionAuth,
 } from '@/lib/api/server/routes'
-import { listScimActivity } from '@/lib/scim/application/admin/connection'
+import { listScimActivity } from '@/ee/scim/application/admin/connection'
 
 /** Recent provisioning requests, so a failing sync can be diagnosed from Sim. */
 export const GET = defineInternalJsonRoute({

apps/sim/app/api/organizations/[id]/scim/credentials/[credentialId]/route.ts

@@ -5,7 +5,7 @@ import {
   internalRateLimits,
   internalSessionAuth,
 } from '@/lib/api/server/routes'
-import { revokeScimCredential } from '@/lib/scim/application/admin/credentials'
+import { revokeScimCredential } from '@/ee/scim/application/admin/credentials'
 
 export const DELETE = defineInternalJsonRoute({
   contract: revokeScimCredentialContract,

apps/sim/app/api/organizations/[id]/scim/credentials/route.ts

@@ -5,7 +5,7 @@ import {
   internalRateLimits,
   internalSessionAuth,
 } from '@/lib/api/server/routes'
-import { issueScimCredential } from '@/lib/scim/application/admin/credentials'
+import { issueScimCredential } from '@/ee/scim/application/admin/credentials'
 
 /** Issues a bearer credential. The secret is returned once and never stored. */
 export const POST = defineInternalJsonRoute({

apps/sim/app/api/organizations/[id]/scim/mappings/[mappingId]/route.ts

@@ -5,7 +5,7 @@ import {
   internalRateLimits,
   internalSessionAuth,
 } from '@/lib/api/server/routes'
-import { deleteScimGroupMapping } from '@/lib/scim/application/admin/mappings'
+import { deleteScimGroupMapping } from '@/ee/scim/application/admin/mappings'
 
 export const DELETE = defineInternalJsonRoute({
   contract: deleteScimGroupMappingContract,

apps/sim/app/api/organizations/[id]/scim/mappings/route.ts

@@ -8,10 +8,7 @@ import {
   internalRateLimits,
   internalSessionAuth,
 } from '@/lib/api/server/routes'
-import {
-  listScimGroupMappings,
-  upsertScimGroupMapping,
-} from '@/lib/scim/application/admin/mappings'
+import { listScimGroupMappings, upsertScimGroupMapping } from '@/ee/scim/application/admin/mappings'
 
 /** What each directory group means inside Sim. */
 

apps/sim/app/api/organizations/[id]/scim/reconcile/route.ts

@@ -5,7 +5,7 @@ import {
   internalRateLimits,
   internalSessionAuth,
 } from '@/lib/api/server/routes'
-import { reconcileScimConnection } from '@/lib/scim/application/admin/connection'
+import { reconcileScimConnection } from '@/ee/scim/application/admin/connection'
 
 /**
  * Re-applies every group mapping to every provisioned user.

apps/sim/app/api/organizations/[id]/scim/route.ts

@@ -8,7 +8,7 @@ import {
   internalRateLimits,
   internalSessionAuth,
 } from '@/lib/api/server/routes'
-import { configureScimConnection, getScimConnection } from '@/lib/scim/application/admin/connection'
+import { configureScimConnection, getScimConnection } from '@/ee/scim/application/admin/connection'
 
 /**
  * The organization's directory-provisioning connection.

apps/sim/app/api/scim/v2/Groups/[id]/route.ts

@@ -9,10 +9,10 @@ import {
   getScimGroup,
   patchScimGroup,
   replaceScimGroup,
-} from '@/lib/scim/application/groups/manage-groups'
-import { assertGroupSchemas, toCanonicalGroup } from '@/lib/scim/protocol/canonical'
-import { parseAttributeProjection } from '@/lib/scim/protocol/resources'
-import { defineScimRoute } from '@/lib/scim/route'
+} from '@/ee/scim/application/groups/manage-groups'
+import { assertGroupSchemas, toCanonicalGroup } from '@/ee/scim/protocol/canonical'
+import { parseAttributeProjection } from '@/ee/scim/protocol/resources'
+import { defineScimRoute } from '@/ee/scim/route'
 
 /** One Group resource. */