@@ -0,0 +1,4 @@
+interface:
+  display_name: "Migrate Application Operation"
+  short_description: "Share one operation across API and tool surfaces"
+  default_prompt: "Use $migrate-application-operation to migrate one resource operation across internal APIs, public APIs, Copilot, and other tools."
@@ -66,11 +66,12 @@ When the user runs `/ship`:
     exit 1
   }
   rm -f /tmp/ship-audit-results
-  for s in check:boundaries check:api-validation:strict check:desktop-bridge check:desktop-ipc \
+  for s in check:boundaries check:api-validation:strict check:openapi \
+           check:desktop-bridge check:desktop-ipc \
            check:utils check:zustand-v5 \
            check:react-query check:client-boundary check:bare-icons check:icon-paths \
            check:realtime-prune check:tool-registry-boundary check:tool-request-boundary \
-           tool-metadata:check \
+           check:sql-date-binding tool-metadata:check \
            integration-catalog:check skills:check agent-stream-docs:check; do
     ( bun run "$s" >"/tmp/ship-audit-${s//:/-}.log" 2>&1; echo "$? $s" >>/tmp/ship-audit-results ) &
   done
 
@@ -65,11 +65,12 @@ When the user runs `/ship`:
     exit 1
   }
   rm -f /tmp/ship-audit-results
-  for s in check:boundaries check:api-validation:strict check:desktop-bridge check:desktop-ipc \
+  for s in check:boundaries check:api-validation:strict check:openapi \
+           check:desktop-bridge check:desktop-ipc \
            check:utils check:zustand-v5 \
            check:react-query check:client-boundary check:bare-icons check:icon-paths \
            check:realtime-prune check:tool-registry-boundary check:tool-request-boundary \
-           tool-metadata:check \
+           check:sql-date-binding tool-metadata:check \
            integration-catalog:check skills:check agent-stream-docs:check; do
     ( bun run "$s" >"/tmp/ship-audit-${s//:/-}.log" 2>&1; echo "$? $s" >>/tmp/ship-audit-results ) &
   done
 
@@ -60,11 +60,12 @@ When the user runs `/ship`:
     exit 1
   }
   rm -f /tmp/ship-audit-results
-  for s in check:boundaries check:api-validation:strict check:desktop-bridge check:desktop-ipc \
+  for s in check:boundaries check:api-validation:strict check:openapi \
+           check:desktop-bridge check:desktop-ipc \
            check:utils check:zustand-v5 \
            check:react-query check:client-boundary check:bare-icons check:icon-paths \
            check:realtime-prune check:tool-registry-boundary check:tool-request-boundary \
-           tool-metadata:check \
+           check:sql-date-binding tool-metadata:check \
            integration-catalog:check skills:check agent-stream-docs:check; do
     ( bun run "$s" >"/tmp/ship-audit-${s//:/-}.log" 2>&1; echo "$? $s" >>/tmp/ship-audit-results ) &
   done
 
@@ -0,0 +1,83 @@
+/**
+ * @vitest-environment node
+ */
+import { NextRequest } from 'next/server'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  getSession: vi.fn(),
+  execute: vi.fn(),
+}))
+
+vi.mock('@/lib/auth', () => ({ getSession: mocks.getSession }))
+
+vi.mock('@/lib/audit-logs/application/list-audit-logs', () => ({
+  listAuditLogs: { operation: { id: 'audit_logs.list' }, execute: mocks.execute },
+}))
+
+import { OrchestrationError } from '@/lib/core/orchestration/types'
+import { GET } from '@/app/api/audit-logs/route'
+
+const log = {
+  id: 'audit-1',
+  workspaceId: 'workspace-1',
+  actorId: 'admin-1',
+  actorName: 'Ada',
+  actorEmail: 'ada@example.com',
+  action: 'workspace.updated',
+  resourceType: 'workspace',
+  resourceId: 'workspace-1',
+  resourceName: 'Engineering',
+  description: null,
+  metadata: {},
+  createdAt: new Date('2026-08-01T00:00:00Z'),
+}
+
+describe('GET /api/audit-logs', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mocks.getSession.mockResolvedValue({
+      user: { id: 'admin-1' },
+      session: { id: 'session-1' },
+    })
+    mocks.execute.mockResolvedValue({ data: [log], nextCursor: 'next-1' })
+  })
+
+  it('authenticates before parsing the organization query', async () => {
+    const response = await GET(new NextRequest('http://localhost:3000/api/audit-logs'))
+
+    expect(response.status).toBe(400)
+    expect(mocks.getSession).toHaveBeenCalled()
+    expect(mocks.execute).not.toHaveBeenCalled()
+  })
+
+  it('keeps the internal envelope while sharing the application operation', async () => {
+    const request = new NextRequest(
+      'http://localhost:3000/api/audit-logs?organizationId=organization-1'
+    )
+    const response = await GET(request)
+
+    expect(response.status).toBe(200)
+    expect(await response.json()).toMatchObject({
+      success: true,
+      data: [{ id: 'audit-1', actorId: 'admin-1' }],
+      nextCursor: 'next-1',
+    })
+    expect(mocks.execute).toHaveBeenCalledWith({
+      principal: { kind: 'session', userId: 'admin-1', sessionId: 'session-1' },
+      input: expect.objectContaining({ organizationId: 'organization-1' }),
+      request,
+    })
+  })
+
+  it('preserves internal typed error presentation', async () => {
+    mocks.execute.mockRejectedValueOnce(new OrchestrationError('forbidden', 'Admin required'))
+
+    const response = await GET(
+      new NextRequest('http://localhost:3000/api/audit-logs?organizationId=organization-1')
+    )
+
+    expect(response.status).toBe(403)
+    expect(await response.json()).toEqual({ error: 'Admin required' })
+  })
+})
@@ -1,97 +1,42 @@
-import { createLogger } from '@sim/logger'
-import { getErrorMessage } from '@sim/utils/errors'
-import { type NextRequest, NextResponse } from 'next/server'
 import { listAuditLogsContract } from '@/lib/api/contracts/audit-logs'
-import { getValidationErrorMessage, parseRequest } from '@/lib/api/server'
-import { getSession } from '@/lib/auth'
-import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import { validateEnterpriseAuditAccess } from '@/app/api/v1/audit-logs/auth'
-import { formatAuditLogEntry } from '@/app/api/v1/audit-logs/format'
 import {
-  buildFilterConditions,
-  buildOrgScopeCondition,
-  getOrgWorkspaceIds,
-  queryAuditLogs,
-} from '@/app/api/v1/audit-logs/query'
-
-const logger = createLogger('AuditLogsAPI')
+  defineInternalJsonRoute,
+  internalPlainOrchestrationErrorPolicy,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import { listAuditLogs } from '@/lib/audit-logs/application/list-audit-logs'
+import { auditLogOperations } from '@/lib/audit-logs/application/operations'
+import { formatAuditLogEntry } from '@/app/api/v1/audit-logs/format'
 
 export const dynamic = 'force-dynamic'
 
-export const GET = withRouteHandler(async (request: NextRequest) => {
-  try {
-    const session = await getSession()
-    if (!session?.user?.id) {
-      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-    }
-
-    const parsed = await parseRequest(
-      listAuditLogsContract,
-      request,
-      {},
-      {
-        validationErrorResponse: (error) =>
-          NextResponse.json(
-            { error: getValidationErrorMessage(error, 'Invalid query parameters') },
-            { status: 400 }
-          ),
-      }
-    )
-    if (!parsed.success) return parsed.response
-
-    const authResult = await validateEnterpriseAuditAccess(
-      session.user.id,
-      parsed.data.query.organizationId
-    )
-    if (!authResult.success) {
-      return authResult.response
-    }
-
-    const { organizationId, orgMemberIds } = authResult.context
-
-    const {
-      organizationId: _targetOrganizationId,
-      search,
-      action,
-      resourceType,
-      actorId,
-      startDate,
-      endDate,
-      includeDeparted,
-      limit,
-      cursor,
-    } = parsed.data.query
-
-    const orgWorkspaceIds = await getOrgWorkspaceIds(organizationId)
-    const scopeCondition = buildOrgScopeCondition({
-      organizationId,
-      orgWorkspaceIds,
-      orgMemberIds,
-      includeDeparted,
-    })
-    const filterConditions = buildFilterConditions({
-      action,
-      resourceType,
-      actorId,
-      search,
-      startDate,
-      endDate,
-    })
-
-    const { data, nextCursor } = await queryAuditLogs(
-      [scopeCondition, ...filterConditions],
-      limit,
-      cursor
-    )
-
-    return NextResponse.json({
-      success: true,
-      data: data.map(formatAuditLogEntry),
-      nextCursor,
-    })
-  } catch (error: unknown) {
-    const message = getErrorMessage(error, 'Unknown error')
-    logger.error('Audit logs fetch error', { error: message })
-    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
-  }
+export const GET = defineInternalJsonRoute({
+  contract: listAuditLogsContract,
+  auth: internalSessionAuth,
+  operation: auditLogOperations.list,
+  rateLimit: internalRateLimits.none({
+    reason: 'Existing authenticated audit-log settings read has no request-rate policy',
+  }),
+  errorPolicy: internalPlainOrchestrationErrorPolicy,
+  mapInput: ({ query }) => ({
+    organizationId: query.organizationId,
+    includeDeparted: query.includeDeparted,
+    filters: {
+      search: query.search,
+      action: query.action,
+      resourceType: query.resourceType,
+      actorId: query.actorId,
+      startDate: query.startDate,
+      endDate: query.endDate,
+    },
+    limit: query.limit,
+    cursor: query.cursor,
+  }),
+  useCase: listAuditLogs,
+  present: ({ data, nextCursor }) => ({
+    success: true,
+    data: data.map(formatAuditLogEntry),
+    nextCursor,
+  }),
 })
@@ -2,9 +2,7 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { completeInternalFileUploadContract } from '@/lib/api/contracts/upload-sessions'
 import { parseRequest } from '@/lib/api/server'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
-import { completeUploadSession, getOwnedUploadSession } from '@/lib/uploads/upload-session/service'
-import { finalizeUploadPurpose } from '@/app/api/files/uploads/finalizers'
-import { reauthorizeUploadPurpose } from '@/app/api/files/uploads/purposes'
+import { completeInternalUploadSession } from '@/lib/uploads/upload-session/application'
 import {
   requireUploadUser,
   toInternalUploadSession,
@@ -22,16 +20,15 @@ export const POST = withRouteHandler(async (request: NextRequest, context: Uploa
   if (!parsed.success) return parsed.response
 
   try {
-    const session = await getOwnedUploadSession({
-      uploadId: parsed.data.params.uploadId,
-      uploadToken: parsed.data.headers['upload-token'],
-      userId: actor.id,
-    })
-    await reauthorizeUploadPurpose(actor.id, session)
-    const completed = await completeUploadSession({
-      session,
-      finalize: (claimed) => finalizeUploadPurpose({ session: claimed, actor, request }),
-    })
+    const completed = await completeInternalUploadSession(
+      actor.principal,
+      {
+        uploadId: parsed.data.params.uploadId,
+        uploadToken: parsed.data.headers['upload-token'],
+        actor,
+      },
+      request
+    )
     return NextResponse.json({
       data: toInternalUploadSession(completed.session, completed.value),
     })