chore: import upstream snapshot with attribution

apps/sim/app/api/blocks/visibility/route.ts

@@ -0,0 +1,46 @@
+import type { NextRequest } from 'next/server'
+import { NextResponse } from 'next/server'
+import { getBlockVisibilityContract } from '@/lib/api/contracts/block-visibility'
+import { parseRequest } from '@/lib/api/server'
+import { getSession } from '@/lib/auth'
+import { getBlockVisibility } from '@/lib/core/config/block-visibility'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { isPlatformAdmin } from '@/lib/permissions/super-user'
+import { checkWorkspaceAccess } from '@/lib/workspaces/permissions/utils'
+
+/**
+ * Evaluates the viewer's block-visibility projection for a workspace: which
+ * preview blocks are revealed (and preview-tagged) and which shipped blocks are
+ * kill-switched. Consumed by the client visibility overlay
+ * (`BlockVisibilityLoader`); discovery-only — execution is never gated.
+ */
+export const GET = withRouteHandler(async (request: NextRequest) => {
+  const session = await getSession()
+  if (!session?.user?.id) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  }
+
+  const parsed = await parseRequest(getBlockVisibilityContract, request, {})
+  if (!parsed.success) return parsed.response
+
+  const userId = session.user.id
+  const { workspaceId } = parsed.data.query
+
+  const access = await checkWorkspaceAccess(workspaceId, userId)
+  if (!access.hasAccess) {
+    return NextResponse.json({ error: 'Access denied' }, { status: 403 })
+  }
+
+  const isAdmin = await isPlatformAdmin(userId)
+  const vis = await getBlockVisibility({
+    userId,
+    orgId: access.workspace?.organizationId,
+    isAdmin,
+  })
+
+  return NextResponse.json({
+    revealed: [...vis.revealed],
+    disabled: [...vis.disabled],
+    previewTagged: [...vis.previewTagged],
+  })
+})