improvement(projects): unify environment archive and align with shared patterns

- Archive a workspace's workflows atomically with it through one
  archiveEnvironmentInTransaction shared by workspace delete and Project archive;
  the workspace row is locked before the sweep so concurrent creates are covered
- Scope the Project lock timeout to lock acquisition and map lock timeouts and
  deadlocks to a retryable conflict; backfill and multi-Project locks use the
  shared advisory-lock helpers in code-unit order
- Shared orchestrationFailureResponse for raw routes; contracts use the ID
  primitives and export only what is consumed; audit enums and mock in sync
- Project restrictions section matches its sibling settings rows
- Batch account-deletion Project loads/locks; skip inconsistent Projects in lists
- Harden the foundation integration suite (user-keyed cleanup, poll helper,
  pid-scoped waits, precise assertions)

Author: waleedlatif1

apps/sim/app/api/files/uploads/utils.ts

@@ -4,8 +4,8 @@ import {
   type InternalFileUploadSession,
   internalFileUploadSessionSchema,
 } from '@/lib/api/contracts/upload-sessions'
+import { orchestrationFailureResponse } from '@/lib/api/server/orchestration-response'
 import { getSession } from '@/lib/auth'
-import { asOrchestrationError, statusForOrchestrationError } from '@/lib/core/orchestration/types'
 import type { UploadSessionRecord } from '@/lib/uploads/upload-session/service'
 import type { UploadActor, UploadPurposeResult } from '@/app/api/files/uploads/finalizers'
 
@@ -32,13 +32,7 @@ export async function requireUploadUser(): Promise<AuthenticatedUploadActor | Ne
 }
 
 export function uploadSessionErrorResponse(error: unknown): NextResponse | null {
-  const classified = asOrchestrationError(error)
-  return classified
-    ? NextResponse.json(
-        { error: classified.message },
-        { status: statusForOrchestrationError(classified.code) }
-      )
-    : null
+  return orchestrationFailureResponse(error)
 }
 
 export function toInternalUploadSession(

apps/sim/app/api/superuser/import-workflow/route.ts

@@ -7,7 +7,7 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { importWorkflowAsSuperuserContract } from '@/lib/api/contracts/workflows'
 import { parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
-import { OrchestrationError } from '@/lib/core/orchestration/types'
+import { asOrchestrationError } from '@/lib/core/orchestration/types'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { loadCopilotChatMessages } from '@/lib/mothership/chat/lifecycle'
 import { appendCopilotChatMessages } from '@/lib/mothership/chat/messages-store'
@@ -226,7 +226,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       copilotChatsImported,
     })
   } catch (error) {
-    if (error instanceof OrchestrationError && error.code === 'not_found') {
+    if (asOrchestrationError(error)?.code === 'not_found') {
       return NextResponse.json({ error: 'Target workspace not found' }, { status: 404 })
     }
     logger.error('Error importing workflow', error)

apps/sim/app/api/table/utils.ts

@@ -2,8 +2,8 @@ import { createLogger } from '@sim/logger'
 import { permissionSatisfies } from '@sim/platform-authz/workspace'
 import { toError } from '@sim/utils/errors'
 import { NextResponse } from 'next/server'
+import { orchestrationFailureResponse } from '@/lib/api/server/orchestration-response'
 import {
-  asOrchestrationError,
   messageForOrchestrationError,
   type OrchestrationErrorCode,
   statusForOrchestrationError,
@@ -137,13 +137,7 @@ export function orchestrationErrorResponse(error: unknown): NextResponse | null
   const lockResponse = tableLockErrorResponse(error)
   if (lockResponse) return lockResponse
 
-  const classified = asOrchestrationError(error)
-  if (!classified) return null
-
-  return NextResponse.json(
-    { error: classified.message },
-    { status: statusForOrchestrationError(classified.code) }
-  )
+  return orchestrationFailureResponse(error)
 }
 
 /**

apps/sim/app/api/v1/admin/workflows/import/route.ts

@@ -28,7 +28,7 @@ import { and, eq, isNull } from 'drizzle-orm'
 import { NextResponse } from 'next/server'
 import { adminV1ImportWorkflowContract } from '@/lib/api/contracts/v1/admin'
 import { parseRequest } from '@/lib/api/server'
-import { OrchestrationError } from '@/lib/core/orchestration/types'
+import { asOrchestrationError } from '@/lib/core/orchestration/types'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { parseWorkflowJson } from '@/lib/workflows/operations/import-export'
 import { insertNewWorkflowRow } from '@/lib/workflows/persistence/new-workflow-row'
@@ -181,7 +181,7 @@ export const POST = withRouteHandler(
 
       return NextResponse.json(response)
     } catch (error) {
-      if (error instanceof OrchestrationError && error.code === 'not_found') {
+      if (asOrchestrationError(error)?.code === 'not_found') {
         return notFoundResponse('Workspace')
       }
       if (error instanceof FolderNotFoundError) {

apps/sim/app/api/workspaces/[id]/route.ts

@@ -5,9 +5,9 @@ import { and, eq, isNull } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { deleteWorkspaceBodySchema, updateWorkspaceContract } from '@/lib/api/contracts'
 import { parseRequest, validationErrorResponse } from '@/lib/api/server'
+import { orchestrationFailureResponse } from '@/lib/api/server/orchestration-response'
 import { getSession } from '@/lib/auth'
 import { changeWorkspaceStoragePayerInTx } from '@/lib/billing/storage/payer-transfer'
-import { OrchestrationError, statusForOrchestrationError } from '@/lib/core/orchestration/types'
 import { captureServerEvent } from '@/lib/posthog/server'
 import { archiveWorkspace } from '@/lib/workspaces/lifecycle'
 
@@ -331,12 +331,8 @@ export const DELETE = withRouteHandler(
 
       return NextResponse.json({ success: true })
     } catch (error) {
-      if (error instanceof OrchestrationError) {
-        return NextResponse.json(
-          { error: error.message },
-          { status: statusForOrchestrationError(error.code) }
-        )
-      }
+      const failure = orchestrationFailureResponse(error, 'Failed to delete workspace')
+      if (failure) return failure
       logger.error(`Error deleting workspace ${workspaceId}:`, error)
       return NextResponse.json({ error: 'Failed to delete workspace' }, { status: 500 })
     }

apps/sim/ee/access-control/components/group-detail.tsx

@@ -1784,16 +1784,6 @@ export function GroupDetail({
 
         {configTab === 'platform' && (
           <div className='flex flex-col gap-7'>
-            <ProjectIssueRestrictions
-              organizationId={organizationId}
-              value={editingConfig.deniedPartialAccessProjectIssues}
-              onChange={(value) =>
-                setEditingConfig((previous) => ({
-                  ...previous,
-                  deniedPartialAccessProjectIssues: value,
-                }))
-              }
-            />
             <div className='flex items-center gap-2'>
               <ChipInput
                 icon={Search}
@@ -1871,6 +1861,16 @@ export function GroupDetail({
                 </div>
               </SettingsSection>
             ))}
+            <ProjectIssueRestrictions
+              organizationId={organizationId}
+              value={editingConfig.deniedPartialAccessProjectIssues}
+              onChange={(value) =>
+                setEditingConfig((previous) => ({
+                  ...previous,
+                  deniedPartialAccessProjectIssues: value,
+                }))
+              }
+            />
           </div>
         )}
       </SettingsPanel>

apps/sim/ee/access-control/components/project-issue-restrictions.tsx

@@ -1,6 +1,6 @@
 'use client'
 
-import { Checkbox, Chip, Info } from '@sim/emcn'
+import { Checkbox, Chip, Info, OverflowText } from '@sim/emcn'
 import { isApiClientError } from '@/lib/api/client/errors'
 import { SettingsSection } from '@/app/workspace/[workspaceId]/settings/components/settings-section/settings-section'
 import { useProjects } from '@/hooks/queries/projects'
@@ -24,12 +24,14 @@ export function ProjectIssueRestrictions({
   if (projects.isPending || (isApiClientError(projects.error) && projects.error.status === 503)) {
     return null
   }
+  const choices = projects.data?.pages.flatMap((page) => page.projects) ?? []
+  if (!projects.error && choices.length === 0) return null
   const selected = new Set(value)
   return (
     <SettingsSection
-      label='Restrict Issues for partial-access teammates'
+      label='Project Issues'
       headerAccessory={
-        <Info side='top' className='shrink-0'>
+        <Info side='top'>
           For selected Projects, teammates governed by this group need access to every active
           environment to use Issues.
         </Info>
@@ -49,13 +51,14 @@ export function ProjectIssueRestrictions({
         <p className='pl-2 text-[var(--text-error)] text-caption'>{projects.error.message}</p>
       )}
       <div className='flex flex-col gap-0.5'>
-        {projects.data?.pages
-          .flatMap((page) => page.projects)
-          .map((project) => (
+        {choices.map((project) => (
+          <div
+            key={project.id}
+            className='flex items-center gap-1.5 rounded-md pr-2 transition-colors hover-hover:bg-[var(--surface-active)]'
+          >
             <label
               htmlFor={`project-issues-${project.id}`}
-              key={project.id}
-              className='flex cursor-pointer items-center gap-2 rounded-md py-[5px] pl-2 transition-colors hover-hover:bg-[var(--surface-active)]'
+              className='flex min-w-0 flex-1 cursor-pointer items-center gap-2 py-[5px] pl-2'
             >
               <Checkbox
                 id={`project-issues-${project.id}`}
@@ -68,9 +71,10 @@ export function ProjectIssueRestrictions({
                   )
                 }
               />
-              <span className='text-sm'>{project.name}</span>
+              <OverflowText label={project.name} className='text-sm' />
             </label>
-          ))}
+          </div>
+        ))}
       </div>
     </SettingsSection>
   )

apps/sim/ee/workspace-forking/application/lineage-details.ts

@@ -1,7 +1,6 @@
 import { db } from '@sim/db'
 import { workspace } from '@sim/db/schema'
-import { eq } from 'drizzle-orm'
-import { readForkSyncNewWorkflowsExcluded } from '@/lib/workflows/persistence/new-workflow-row'
+import { and, eq, isNull } from 'drizzle-orm'
 import { getEffectiveWorkspacePermission } from '@/lib/workspaces/permissions/utils'
 import { getForkChildren, getForkParent } from '@/ee/workspace-forking/lib/lineage/lineage'
 import { getUndoableRunForTarget } from '@/ee/workspace-forking/lib/promote/promote-run-store'
@@ -24,6 +23,21 @@ async function withViewerAccess<T extends { id: string; organizationId: string |
 import { defineForkUseCase } from '@/ee/workspace-forking/application/authorized-fork-use-case'
 import { forkOperations } from '@/ee/workspace-forking/application/operations'
 
+/**
+ * The workspace's `forkSyncNewWorkflowsExcluded` policy: whether a workflow created now
+ * starts outside fork sync. `false` for an archived or missing workspace: a wrongly-synced
+ * workflow is visible and fixable in the Forks list, while a wrongly-excluded one silently
+ * stops syncing.
+ */
+async function readForkSyncNewWorkflowsExcluded(workspaceId: string): Promise<boolean> {
+  const [row] = await db
+    .select({ excluded: workspace.forkSyncNewWorkflowsExcluded })
+    .from(workspace)
+    .where(and(eq(workspace.id, workspaceId), isNull(workspace.archivedAt)))
+    .limit(1)
+  return row?.excluded ?? false
+}
+
 export const getWorkspaceForkLineageDetails = defineForkUseCase({
   operation: forkOperations.discover,
   availability: true,
@@ -40,7 +54,7 @@ export const getWorkspaceForkLineageDetails = defineForkUseCase({
       getForkChildren(workspaceId),
       getUndoableRunForTarget(db, workspaceId),
       // Lineage-uniform, so this workspace's own value is the lineage's value.
-      readForkSyncNewWorkflowsExcluded(db, workspaceId),
+      readForkSyncNewWorkflowsExcluded(workspaceId),
     ])
 
     const [parent, children] = await Promise.all([

apps/sim/ee/workspace-forking/lib/copy/copy-workflows.ts

@@ -26,7 +26,6 @@ import {
   type SubBlockTransform,
 } from '@/lib/workflows/references/remap-references'
 import type { CanonicalModeOverrides } from '@/lib/workflows/subblocks/visibility'
-import { lockActiveWorkspace } from '@/lib/workspaces/active-workspace'
 import {
   deriveForkBlockId,
   type ForkBlockIdResolver,
@@ -503,7 +502,6 @@ export async function copyWorkflowStateIntoTarget(
     requestId = 'unknown',
   } = params
 
-  await lockActiveWorkspace(tx, targetWorkspaceId)
   const targetFolderId = sourceMeta.folderId ? (folderIdMap.get(sourceMeta.folderId) ?? null) : null
 
   const varIdMapping = new Map<string, string>()

apps/sim/ee/workspace-forking/lib/promote/promote.test.ts

@@ -1,4 +1,5 @@
-import { resetDbChainMock } from '@sim/testing/mocks/database.mock'
+import { workspace } from '@sim/db/schema'
+import { queueTableRows, resetDbChainMock } from '@sim/testing/mocks/database.mock'
 import { permissionsMock, permissionsMockFns } from '@sim/testing/mocks/permissions.mock'
 import {
   workflowsPersistenceUtilsMock,
@@ -366,6 +367,11 @@ describe('promoteFork gates', () => {
 })
 
 describe('promoteFork dependent values', () => {
+  beforeEach(() => {
+    queueTableRows(workspace, [{ name: 'Target' }])
+    queueTableRows(workspace, [{ archivedAt: null, forkSyncNewWorkflowsExcluded: false }])
+  })
+
   it('unions the dependent-value picks into the copy discovery set (a re-picked document must be copied)', async () => {
     mockComputePlan.mockResolvedValue(
       makePlan({
@@ -476,6 +482,8 @@ describe('promoteFork dependent values', () => {
 
 describe('promoteFork trigger URLs', () => {
   beforeEach(() => {
+    queueTableRows(workspace, [{ name: 'Target' }])
+    queueTableRows(workspace, [{ archivedAt: null, forkSyncNewWorkflowsExcluded: false }])
     // A block only holds a public URL when its config declares a `useWebhookUrl` field, so the
     // fixture has to look like a webhook trigger to the shared predicate.
     vi.mocked(getBlock).mockReturnValue({