fix types (#25952)

* release amd as latest

* remove dockerfile change

* Apply suggestions from code review

changed from linux/amd64 to amd64

* Revert removed comment

* introduce latest as parameter

* introduce latest as parameter

.changeset/rude-candies-scream.md

@@ -0,0 +1,5 @@
+---
+"@calcom/atoms": minor
+---
+
+feat: Booker accepts rrHostSubsetIds to specify round robin hosts

.coderabbit.yaml

@@ -1,187 +0,0 @@
-language: en-US
-tone_instructions: ''
-early_access: false
-enable_free_tier: true
-reviews:
-  profile: chill
-  request_changes_workflow: false
-  high_level_summary: false
-  high_level_summary_placeholder: '@coderabbitai summary'
-  high_level_summary_in_walkthrough: false
-  auto_title_placeholder: '@coderabbitai'
-  auto_title_instructions: ''
-  review_status: true
-  commit_status: true
-  fail_commit_status: false
-  collapse_walkthrough: false
-  changed_files_summary: false
-  sequence_diagrams: false
-  estimate_code_review_effort: false
-  assess_linked_issues: true
-  related_issues: false
-  related_prs: true
-  suggested_labels: false
-  auto_apply_labels: false
-  suggested_reviewers: false
-  auto_assign_reviewers: false
-  poem: false
-  labeling_instructions: []
-  path_filters: 
-    - '!**/node_modules/**'
-    - '!**/dist/**'
-    - '!**/build/**' 
-    - '!**/.next/**'
-  path_instructions:
-    - path: "**/*.{ts,tsx,js,jsx}"
-      instructions: "Flag default exports and encourage named exports. Named exports provide better tree-shaking, easier refactoring, and clearer imports. Exempt main components like pages, layouts, and components that serve as the primary export of a module."
-  abort_on_close: true
-  disable_cache: false
-  auto_review:
-    enabled: true
-    auto_incremental_review: true
-    ignore_title_keywords: []
-    labels: []
-    drafts: false
-    base_branches: []
-  finishing_touches:
-    docstrings:
-      enabled: true
-    unit_tests:
-      enabled: true
-  pre_merge_checks:
-    docstrings:
-      mode: warning
-      threshold: 80
-    title:
-      mode: warning
-      requirements: ''
-    description:
-      mode: warning
-    issue_assessment:
-      mode: warning
-  tools:
-    ast-grep:
-      rule_dirs: []
-      util_dirs: []
-      essential_rules: true
-      packages: []
-    shellcheck:
-      enabled: true
-    ruff:
-      enabled: true
-    markdownlint:
-      enabled: true
-    github-checks:
-      enabled: true
-      timeout_ms: 180000
-    languagetool:
-      enabled: true
-      enabled_rules: []
-      disabled_rules: []
-      enabled_categories: []
-      disabled_categories: []
-      enabled_only: false
-      level: default
-    biome:
-      enabled: true
-    hadolint:
-      enabled: true
-    swiftlint:
-      enabled: true
-    phpstan:
-      enabled: true
-      level: default
-    phpmd:
-      enabled: true
-    phpcs:
-      enabled: true
-    golangci-lint:
-      enabled: true
-    yamllint:
-      enabled: true
-    gitleaks:
-      enabled: true
-    checkov:
-      enabled: true
-    detekt:
-      enabled: true
-    eslint:
-      enabled: true
-    flake8:
-      enabled: true
-    rubocop:
-      enabled: true
-    buf:
-      enabled: true
-    regal:
-      enabled: true
-    actionlint:
-      enabled: true
-    pmd:
-      enabled: true
-    cppcheck:
-      enabled: true
-    semgrep:
-      enabled: true
-    circleci:
-      enabled: true
-    clippy:
-      enabled: true
-    sqlfluff:
-      enabled: true
-    prismaLint:
-      enabled: true
-    pylint:
-      enabled: true
-    oxc:
-      enabled: true
-    shopifyThemeCheck:
-      enabled: true
-    luacheck:
-      enabled: true
-    brakeman:
-      enabled: true
-    dotenvLint:
-      enabled: true
-    htmlhint:
-      enabled: true
-    checkmake:
-      enabled: true
-    osvScanner:
-      enabled: true
-chat:
-  art: true
-  auto_reply: true
-  integrations:
-    jira:
-      usage: auto
-    linear:
-      usage: auto
-knowledge_base:
-  opt_out: false
-  web_search:
-    enabled: true
-  code_guidelines:
-    enabled: true
-    filePatterns: []
-  learnings:
-    scope: auto
-  issues:
-    scope: auto
-  jira:
-    usage: auto
-    project_keys: []
-  linear:
-    usage: auto
-    team_keys: []
-  pull_requests:
-    scope: auto
-  mcp:
-    usage: auto
-    disabled_servers: []
-code_generation:
-  docstrings:
-    language: en-US
-    path_instructions: []
-  unit_tests:
-    path_instructions: []

.dockerignore

@@ -0,0 +1,36 @@
+# Dependencies
+node_modules
+**/node_modules
+
+# Build outputs
+.next
+**/.next
+dist
+**/dist
+build
+**/build
+
+# Git
+.git
+.github
+
+# Testing
+coverage
+**/coverage
+test-results
+**/test-results
+.turbo
+**/.turbo
+
+# Logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Examples and docs
+docs

.env.example

@@ -127,6 +127,14 @@ NEXT_PUBLIC_HELPSCOUT_KEY=
 NEXT_PUBLIC_FRESHCHAT_TOKEN=
 NEXT_PUBLIC_FRESHCHAT_HOST=
 
+# For holiday feature:
+# Step-by-step: Get a Google Calendar API Key
+# 1. Go to Google Cloud Console: https://console.cloud.google.com/
+# 2. Select or Create a Project
+# 3. Enable Google Calendar API (APIs & Services → Library , Search for Google Calendar API)
+# 4. Create the API Key (APIs & Services → Credentials)
+GOOGLE_CALENDAR_API_KEY=
+
 # Google OAuth credentials
 # To enable Login with Google you need to:
 # 1. Set `GOOGLE_API_CREDENTIALS` below
@@ -144,6 +152,12 @@ GOOGLE_WEBHOOK_TOKEN=
 # Optional URL to override for tunelling webhooks. Defaults to NEXT_PUBLIC_WEBAPP_URL.
 GOOGLE_WEBHOOK_URL=
 
+# Token to verify incoming webhooks from Microsoft Calendar
+MICROSOFT_WEBHOOK_TOKEN=
+
+# Optional URL to override for tunelling webhooks. Defaults to NEXT_PUBLIC_WEBAPP_URL.
+MICROSOFT_WEBHOOK_URL=
+
 # Inbox to send user feedback
 SEND_FEEDBACK_EMAIL=
 
@@ -208,6 +222,8 @@ STRIPE_TEAM_PRODUCT_ID=
 # It is a price ID in the product with id STRIPE_ORG_PRODUCT_ID
 STRIPE_ORG_MONTHLY_PRICE_ID=
 STRIPE_ORG_PRODUCT_ID=
+# Used to pass trial days for orgs during the Stripe checkout session
+STRIPE_ORG_TRIAL_DAYS=
 
 STRIPE_WEBHOOK_SECRET=
 STRIPE_WEBHOOK_SECRET_APPS=
@@ -261,6 +277,9 @@ NEXT_PUBLIC_CLOUDFLARE_SITEKEY=
 NEXT_PUBLIC_CLOUDFLARE_USE_TURNSTILE_IN_BOOKER=
 CLOUDFLARE_TURNSTILE_SECRET=
 
+# 0 = false, 1=true
+NEXT_PUBLIC_VERCEL_USE_BOTID_IN_BOOKER=
+
 # Set the following value to true if you wish to enable Team Impersonation
 NEXT_PUBLIC_TEAM_IMPERSONATION=false
 
@@ -414,7 +433,8 @@ VAPID_PRIVATE_KEY=
 
 # Mintlify chat api
 # Power AI chat in for docs
-NEXT_PUBLIC_MINTLIFY_CHAT_API_KEY=
+MINTLIFY_CHAT_API_KEY=
+NEXT_PUBLIC_ENABLE_MINTLIFY_CHAT=
 NEXT_PUBLIC_CHAT_API_URL=
 NEXT_PUBLIC_DOCS_URL=
 
@@ -473,3 +493,20 @@ DATABASE_CHUNK_SIZE=
 # Service Account Encryption Key for encrypting/decrypting service account keys
 # You can use: `openssl rand -base64 24` to generate one
 CALCOM_SERVICE_ACCOUNT_ENCRYPTION_KEY=
+
+SALESFORCE_GRAPHQL_DELAY_MS=500
+SALESFORCE_GRAPHQL_MAX_DELAY_MS=2000
+SALESFORCE_GRAPHQL_MAX_RETRIES=3
+
+# Force Node.js to use UTC as process timezone
+TZ=UTC
+
+# test oauth client for `packages/platform/examples/base` (optional)
+SEED_PLATFORM_OAUTH_CLIENT_ID=
+SEED_PLATFORM_OAUTH_CLIENT_SECRET=
+
+# Trigger.dev
+ENABLE_ASYNC_TASKER="false" # set to "true" to enable
+TRIGGER_SECRET_KEY=
+TRIGGER_API_URL=https://api.trigger.dev
+TRIGGER_DEV_PROJECT_REF=

.eslintignore

@@ -1,9 +0,0 @@
-node_modules
-apps/api/v2/dist
-packages/platform/**/dist/*
-**/**/node_modules
-**/**/.next
-**/**/public
-packages/prisma/zod
-apps/web/public/embed
-packages/ui/components/icon/dynamicIconImports.tsx

.eslintrc.js

@@ -1,115 +0,0 @@
-/** @type {import("eslint").Linter.Config} */
-module.exports = {
-  extends: ["./packages/config/eslint-preset.js"],
-  plugins: ["import"],
-  rules: {
-    "import/no-cycle": ["warn", { maxDepth: Infinity }],
-  },
-  overrides: [
-    // WARN: features must not be imported by app-store or lib
-    {
-      files: ["packages/app-store/**/*.{ts,tsx,js,jsx}", "packages/lib/**/*.{ts,tsx,js,jsx}"],
-      rules: {
-        "no-restricted-imports": [
-          "warn",
-          {
-            patterns: [
-              {
-                group: [
-                  // Catch all relative paths into features
-                  "**/features",
-                  "**/features/*",
-                  // Catch all alias imports
-                  "@calcom/features",
-                  "@calcom/features/*",
-                ],
-                message: "Avoid importing @calcom/features from @calcom/app-store or @calcom/lib.",
-              },
-            ],
-          },
-        ],
-      },
-    },
-    // WARN: lib must not import app-store or features
-    {
-      files: ["packages/lib/**/*.{ts,tsx,js,jsx}"],
-      rules: {
-        "no-restricted-imports": [
-          "warn",
-          {
-            patterns: [
-              {
-                group: [
-                  // Catch all relative paths into app-store
-                  "**/app-store",
-                  "**/app-store/*",
-                  // Catch all relative paths into features
-                  "**/features",
-                  "**/features/*",
-                  // Catch alias imports
-                  "@calcom/app-store",
-                  "@calcom/app-store/*",
-                  "@calcom/features",
-                  "@calcom/features/*",
-                ],
-                message: "@calcom/lib should not import @calcom/app-store or @calcom/features.",
-              },
-            ],
-          },
-        ],
-      },
-    },
-    // ERROR: app-store must not import trpc
-    {
-      files: ["packages/app-store/**/*.{ts,tsx,js,jsx}"],
-      rules: {
-        "no-restricted-imports": [
-          "error",
-          {
-            patterns: [
-              {
-                group: [
-                  // Catch all relative paths into trpc
-                  "**/trpc",
-                  "**/trpc/*",
-                  // Catch alias imports
-                  "@calcom/trpc",
-                  "@calcom/trpc/*",
-                  "@trpc",
-                  "@trpc/*",
-                ],
-                message:
-                  "@calcom/app-store must not import trpc. Move UI to apps/web/components/apps or introduce an API boundary.",
-              },
-            ],
-          },
-        ],
-      },
-    },
-
-    // ERROR: prisma must not import `features` package
-    {
-      files: ["packages/prisma/**/*.{ts,tsx,js,jsx}"],
-      rules: {
-        "no-restricted-imports": [
-          "error",
-          {
-            patterns: [
-              {
-                group: [
-                  // Catch all relative paths into features
-                  "**/features",
-                  "**/features/*",
-                  // Catch all alias imports
-                  "@calcom/features",
-                  "@calcom/features/*",
-                ],
-                message: "Avoid importing @calcom/features from @calcom/prisma.",
-              },
-            ],
-          },
-        ],
-      },
-    },
-  ],
-};

.gitattributes

@@ -0,0 +1,4 @@
+/.yarn/**            linguist-vendored
+/.yarn/releases/*    binary
+/.yarn/plugins/**/*  binary
+/.pnp.*              binary linguist-generated

.github/CODEOWNERS

@@ -1,6 +1,5 @@
 /**/package.json @calcom/Foundation
-/apps/api/**/* @calcom/Platform @calcom/Foundation
-/apps/ui-playground/**/* @calcom/Consumer @calcom/Foundation
+/apps/api/**/* @calcom/API
 /apps/web/**/layout.tsx @calcom/Consumer @calcom/Foundation
 /apps/web/lib/csp.ts @calcom/Foundation
 /apps/web/lib/buildNonce.ts @calcom/Foundation
@@ -10,7 +9,6 @@
 /apps/web/lib/handleOrgRedirect.ts @calcom/Foundation
 /apps/web/middleware.ts @calcom/Foundation
 /deploy/**/* @calcom/Foundation
-/infra/**/* @calcom/Foundation
 /packages/app-store/applecalendar/**/* @calcom/Foundation
 /packages/app-store/caldavcalendar/**/* @calcom/Foundation
 /packages/app-store/exchange2013calendar/**/* @calcom/Foundation
@@ -23,11 +21,12 @@
 /packages/app-store/office365calendar/**/* @calcom/Foundation
 /packages/app-store/zohocalendar/**/* @calcom/Foundation
 /packages/embeds/**/* @calcom/Foundation
+/packages/features/auth/lib/next-auth-options.ts @calcom/Foundation
 /packages/features/bookings/lib/**/* @calcom/Foundation
-/packages/lib/getAggregatedAvailability.ts @calcom/Foundation
-/packages/lib/getUserAvailability.ts @calcom/Foundation
-/packages/lib/server/getLuckyUser.ts @calcom/Foundation
-/packages/lib/slots.ts @calcom/Foundation
+/packages/features/availability/lib/getAggregatedAvailability/getAggregatedAvailability.ts @calcom/Foundation
+/packages/features/availability/lib/getUserAvailability.ts @calcom/Foundation
+/packages/features/bookings/lib/getLuckyUser.ts @calcom/Foundation
+/packages/features/schedules/lib/slots.ts @calcom/Foundation
 /packages/platform/atoms/**/*WebWrapper.tsx @calcom/Consumer
 /packages/platform/**/* @calcom/Platform @calcom/Foundation
 /packages/prisma/**/* @calcom/Foundation

.github/actions/cache-db/action.yml

@@ -26,7 +26,7 @@ runs:
       with:
         path: ${{ inputs.path }}
         key: ${{ runner.os }}-${{ env.cache-name }}-${{ inputs.path }}-${{ env.key-1 }}-${{ env.key-2 }}-${{ env.key-3 }}
-    - run: echo ${{ env.E2E_TEST_CALCOM_QA_GCAL_CREDENTIALS }} && yarn db-seed
+    - run: yarn db-seed
       if: steps.cache-db.outputs.cache-hit != 'true'
       shell: bash
     - name: Postgres Dump Backup

.github/actions/docker-build-and-test/action.yml

@@ -0,0 +1,186 @@
+name: "Docker Build and Test"
+description: "Reusable action to build and test Docker images for Cal.com"
+
+inputs:
+  platform:
+    description: "Target platform (linux/amd64 or arm64)"
+    required: true
+  platform-suffix:
+    description: "Suffix to add to image tags (e.g., -arm)"
+    required: false
+    default: ""
+  dockerhub-username:
+    description: "Docker Hub username"
+    required: true
+  dockerhub-token:
+    description: "Docker Hub token"
+    required: true
+  github-token:
+    description: "GitHub token for GHCR"
+    required: true
+  postgres-user:
+    description: "PostgreSQL user"
+    required: true
+  postgres-password:
+    description: "PostgreSQL password"
+    required: true
+  postgres-db:
+    description: "PostgreSQL database name"
+    required: true
+  database-host:
+    description: "Database host"
+    required: true
+  push-image:
+    description: "Whether to push the built image"
+    required: false
+    default: "false"
+  use-as-latest:
+    description: "Publish as latest"
+    required: false
+    default: "false"
+
+runs:
+  using: "composite"
+  steps:
+    - name: Log in to the Docker Hub registry
+      uses: docker/login-action@v3
+      with:
+        username: ${{ inputs.dockerhub-username }}
+        password: ${{ inputs.dockerhub-token }}
+        logout: true
+
+    - name: Log in to the Github Container registry
+      uses: docker/login-action@v3
+      with:
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ inputs.github-token }}
+
+    - name: Docker meta
+      id: meta
+      uses: docker/metadata-action@v5
+      with:
+        images: |
+          docker.io/calendso/calendso
+          docker.io/calcom/cal.com
+          ghcr.io/calcom/cal.com
+        flavor: |
+          latest=${{ !github.event.release.prerelease && inputs.use-as-latest == 'true' }}
+          suffix=${{ inputs.platform-suffix }}
+
+    - name: Copy env
+      shell: bash
+      run: |
+        grep -o '^[^#]*' .env.example > .env
+        cat .env >> $GITHUB_ENV
+        echo "DATABASE_HOST=localhost:5432" >> $GITHUB_ENV
+        eval $(sed -e '/^#/d' -e 's/^/export /' -e 's/$/;/' .env) ;
+
+    - name: Start database
+      shell: bash
+      run: |
+        docker compose up -d database
+
+    - name: Show database logs and container status
+      shell: bash
+      run: |
+        echo "--- Container Status ---"
+        docker compose ps database
+
+        echo "--- Container Logs ---"
+        docker compose logs database
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+      with:
+        driver-opts: |
+          network=container:database
+        buildkitd-flags: |
+          --allow-insecure-entitlement security.insecure --allow-insecure-entitlement network.host
+
+    - name: Build image
+      id: docker_build
+      uses: docker/build-push-action@v6
+      with:
+        context: ./
+        file: ./Dockerfile
+        load: true
+        push: false
+        platforms: ${{ inputs.platform }}
+        tags: ${{ steps.meta.outputs.tags }}
+        labels: ${{ steps.meta.outputs.labels }}
+        build-args: |
+          NEXT_PUBLIC_WEBAPP_URL=http://localhost:3000
+          NEXT_PUBLIC_API_V2_URL=http://localhost:5555/api/v2
+          NEXT_PUBLIC_LICENSE_CONSENT=agree
+          DATABASE_URL=postgresql://${{ inputs.postgres-user }}:${{ inputs.postgres-password }}@${{ inputs.database-host }}/${{ inputs.postgres-db }}
+          DATABASE_DIRECT_URL=postgresql://${{ inputs.postgres-user }}:${{ inputs.postgres-password }}@${{ inputs.database-host }}/${{ inputs.postgres-db }}
+
+    - name: Test runtime
+      shell: bash
+      run: |
+        tags="${{ steps.meta.outputs.tags }}"
+        IFS=',' read -ra ADDR <<< "$tags"
+        tag=${ADDR[0]}
+
+        docker run --rm --network stack \
+          -p 3000:3000 \
+          -e DATABASE_URL=postgresql://${{ inputs.postgres-user }}:${{ inputs.postgres-password }}@database/${{ inputs.postgres-db }} \
+          -e DATABASE_DIRECT_URL=postgresql://${{ inputs.postgres-user }}:${{ inputs.postgres-password }}@database/${{ inputs.postgres-db }} \
+          -e NEXTAUTH_SECRET=${{ env.NEXTAUTH_SECRET }} \
+          -e CALENDSO_ENCRYPTION_KEY=${{ env.CALENDSO_ENCRYPTION_KEY }} \
+          $tag &
+
+          server_pid=$!
+
+          echo "Waiting for the server to start..."
+          sleep 120
+
+          echo http://localhost:3000/auth/login
+
+          for i in {1..60}; do
+            echo "Checking server health ($i/60)..."
+            response=$(curl -o /dev/null -s -w "%{http_code}" http://localhost:3000/auth/login)
+            echo "HTTP Status Code: $response"
+            if [[ "$response" == "200" ]] || [[ "$response" == "307" ]]; then
+              echo "Server is healthy"
+              kill $server_pid
+              exit 0
+            fi
+            sleep 1
+          done
+
+          echo "Server health check failed"
+          kill $server_pid
+          exit 1
+      env:
+        NEXTAUTH_SECRET: "EI4qqDpcfdvf4A+0aQEEx8JjHxHSy4uWiZw/F32K+pA="
+        CALENDSO_ENCRYPTION_KEY: "0zfLtY99wjeLnsM7qsa8xsT+Q0oSgnOL"
+
+    - name: Push image
+      id: docker_push
+      uses: docker/build-push-action@v6
+      if: ${{ inputs.push-image == 'true' && !github.event.release.prerelease }}
+      with:
+        context: ./
+        file: ./Dockerfile
+        push: true
+        platforms: ${{ inputs.platform }}
+        tags: ${{ steps.meta.outputs.tags }}
+        labels: ${{ steps.meta.outputs.labels }}
+        build-args: |
+          NEXT_PUBLIC_WEBAPP_URL=http://localhost:3000
+          NEXT_PUBLIC_API_V2_URL=http://localhost:5555/api/v2
+          NEXT_PUBLIC_LICENSE_CONSENT=agree
+          DATABASE_URL=postgresql://${{ inputs.postgres-user }}:${{ inputs.postgres-password }}@${{ inputs.database-host }}/${{ inputs.postgres-db }}
+          DATABASE_DIRECT_URL=postgresql://${{ inputs.postgres-user }}:${{ inputs.postgres-password }}@${{ inputs.database-host }}/${{ inputs.postgres-db }}
+
+    - name: Image digest
+      shell: bash
+      run: echo ${{ steps.docker_build.outputs.digest }}
+
+    - name: Cleanup
+      shell: bash
+      if: always()
+      run: |
+        docker compose down

.github/oasdiff-err-ignore.txt

@@ -0,0 +1,4 @@
+GET /v2/event-types/{eventTypeId} added to the 'data' response property 'oneOf' list for the response status '200'
+GET /v2/event-types/{eventTypeId} added '#/components/schemas/EventTypeOutput_2024_06_14, #/components/schemas/TeamEventTypeOutput_2024_06_14' to the 'data' response property 'oneOf' list for the response status '200'
+GET /v2/bookings/{bookingUid}/recordings added the new required 'header' request parameter 'Authorization'
+GET /v2/bookings/{bookingUid}/transcripts added the new required 'header' request parameter 'Authorization'

.github/workflows/all-checks.yml

@@ -74,14 +74,8 @@ jobs:
     uses: ./.github/workflows/e2e-embed-react.yml
     secrets: inherit
 
-  e2e-atoms:
-    name: Tests
-    needs: [lint, build, build-atoms, build-api-v2]
-    uses: ./.github/workflows/e2e-atoms.yml
-    secrets: inherit
-
   required:
-    needs: [lint, type-check, unit-test, integration-test, build, build-api-v1, build-api-v2, e2e, e2e-embed, e2e-embed-react, e2e-app-store, e2e-atoms]
+    needs: [lint, type-check, unit-test, integration-test, build, build-api-v1, build-api-v2, e2e, e2e-embed, e2e-embed-react, e2e-app-store]
     if: always()
     runs-on: buildjet-2vcpu-ubuntu-2204
     steps:

.github/workflows/api-v2-production-build.yml

@@ -56,8 +56,8 @@ jobs:
         if: steps.cache-api-v2-build.outputs.cache-hit != 'true'
         run: |
           export NODE_OPTIONS="--max_old_space_size=8192"
-          yarn workspace @calcom/api-v2 run generate-schemas
-          rm -rf apps/api/v2/node_modules
-          yarn install
+          yarn workspace @calcom/api-v2 run generate-schemas &&
+          rm -rf apps/api/v2/node_modules &&
+          yarn install &&
           yarn workspace @calcom/api-v2 run build
         shell: bash

.github/workflows/changesets.yml

@@ -6,23 +6,31 @@ on:
       - main
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
-permissions: {} # remove permissions and set explicitly under "permissions:" below
+permissions:
+  id-token: write # for NPM provenance - developers can verify where and how it was built
+  contents: write # to create release by changesets/action below
+  pull-requests: write # to create pull request by changesets/action below
+
 jobs:
   release:
     if: github.repository == 'calcom/cal.com' # prevent this action from running on forks
-    permissions:
-      id-token: write # for NPM provenance - developers can verify where and how it was built
-      contents: write # to create release by changesets/action below
-      pull-requests: write # to create pull request by changesets/action below
     name: Release
-    runs-on: buildjet-4vcpu-ubuntu-2204
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+      - name: Setup Node and registry for OIDC
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20.17.0"
+          registry-url: "https://registry.npmjs.org"
+          always-auth: false
       - name: Setup node, yarn and install dependencies
         uses: ./.github/actions/yarn-install
+      - name: Install npm at version supporting OIDC
+        run: npm install -g npm@11.5.1
       - name: Create Release Pull Request or Publish to npm
         id: changesets
         uses: changesets/action@v1
@@ -33,8 +41,7 @@ jobs:
           title: "chore: version packages" # PR title
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_CONFIG_PROVENANCE: "true"
           VITE_BOOKER_EMBED_OAUTH_CLIENT_ID: ${{ secrets.VITE_BOOKER_EMBED_OAUTH_CLIENT_ID }}
           VITE_BOOKER_EMBED_API_URL: ${{ secrets.VITE_BOOKER_EMBED_API_URL }}
-          NEXT_PUBLIC_WEBAPP_URL: ${{ secrets.NEXT_PUBLIC_WEBAPP_URL }}
+          NEXT_PUBLIC_WEBAPP_URL: ${{ secrets.NEXT_PUBLIC_WEBAPP_URL }}

.github/workflows/cleanup-report.yml

@@ -11,12 +11,20 @@ jobs:
   cleanup-report:
     runs-on: ubuntu-latest
     steps:
+      - name: Generate GitHub App token
+        id: generate-token
+        uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94
+        with:
+          app-id: ${{ secrets.CI_CAL_APP_ID }}
+          private-key: ${{ secrets.CI_CAL_APP_PRIVATE_KEY }}
+          repositories: 'test-results-2'
+
       - name: Checkout GitHub Pages Branch
         uses: actions/checkout@v4
         with:
-          repository: calcom/test-results
+          repository: calcom/test-results-2
           ref: gh-pages
-          token: ${{ secrets.GH_ACCESS_TOKEN }}
+          token: ${{ steps.generate-token.outputs.token }}
 
       - name: Set Git User
         run: |

.github/workflows/cleanup.yml

@@ -22,12 +22,20 @@ jobs:
       # Contains all reports for deleted branch
       BRANCH_REPORTS_DIR: reports/${{ github.event.ref }}
     steps:
-      - name: Checkout GitHub Pages Branch
-        uses: actions/checkout@v2
+      - name: Generate GitHub App token
+        id: generate-token
+        uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94
         with:
-          repository: calcom/test-results
+          app-id: ${{ secrets.CI_CAL_APP_ID }}
+          private-key: ${{ secrets.CI_CAL_APP_PRIVATE_KEY }}
+          repositories: 'test-results-2'
+
+      - name: Checkout GitHub Pages Branch
+        uses: actions/checkout@v4
+        with:
+          repository: calcom/test-results-2
           ref: gh-pages
-          token: ${{ secrets.GH_ACCESS_TOKEN }}
+          token: ${{ steps.generate-token.outputs.token }}
       - name: Set Git User
         # see: https://github.com/actions/checkout/issues/13#issuecomment-724415212
         run: |

.github/workflows/companion-build.yml

@@ -0,0 +1,42 @@
+name: Companion Builds
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+env:
+  EXPO_PUBLIC_CAL_API_KEY: ${{ secrets.CI_EXPO_PUBLIC_CAL_API_KEY || vars.CI_EXPO_PUBLIC_CAL_API_KEY || vars.EXPO_PUBLIC_CAL_API_KEY }}
+
+jobs:
+  build:
+    name: Build Companion App & Extension
+    runs-on: buildjet-4vcpu-ubuntu-2204
+    timeout-minutes: 30
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/dangerous-git-checkout
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v1
+        with:
+          bun-version: 1.3.0
+          cache: true
+          cache-dependency-path: companion/bun.lock
+
+      - name: Install dependencies
+        working-directory: companion
+        run: bun install --frozen-lockfile
+
+      - name: Build Expo web app
+        working-directory: companion
+        env:
+          EXPO_NO_TELEMETRY: 1
+          CI: true
+        run: bunx expo export --platform web
+
+      - name: Build browser extension
+        working-directory: companion
+        run: bun run ext:build

.github/workflows/cron-stale-issue.yml

@@ -20,8 +20,8 @@ jobs:
           days-before-close: -1
           days-before-issue-stale: 60
           days-before-issue-close: -1
-          days-before-pr-stale: 14
-          days-before-pr-close: -1
-          stale-pr-message: "This PR is being marked as stale due to inactivity."
-          close-pr-message: "This PR is being closed due to inactivity. Please reopen if work is intended to be continued."
+          days-before-pr-stale: 7
+          days-before-pr-close: 14
+          stale-pr-message: "This PR has been marked as stale due to inactivity. If you're still working on it or need any help, please let us know or update the PR to keep it active."
+          close-pr-message: "This PR has been closed due to inactivity. Please feel free to reopen it if you'd like to continue the work."
           operations-per-run: 100

.github/workflows/draft-release.yml

@@ -17,13 +17,20 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      
+      - name: Generate GitHub App token
+        id: generate-token
+        uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94
+        with:
+          app-id: ${{ secrets.CI_CAL_APP_ID }}
+          private-key: ${{ secrets.CI_CAL_APP_PRIVATE_KEY }}
+          repositories: 'cal.com'
+
       - name: Checkout code
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
           ref: 'main'
-          token: ${{ secrets.GH_ACCESS_TOKEN }}
+          token: ${{ steps.generate-token.outputs.token }}
 
       - name: Configure git
         run: |

.github/workflows/e2e-api-v2.yml

@@ -1,4 +1,4 @@
-name: E2E
+name: Check breaking changes and run E2E
 on:
   workflow_call:
 env:
@@ -23,6 +23,10 @@ env:
   STRIPE_CLIENT_ID: ${{ secrets.CI_STRIPE_CLIENT_ID }}
   STRIPE_WEBHOOK_SECRET: ${{ secrets.CI_STRIPE_WEBHOOK_SECRET }}
   SLOTS_CACHE_TTL: ${{ secrets.CI_SLOTS_CACHE_TTL }}
+  NEXT_PUBLIC_VAPID_PUBLIC_KEY: ${{ secrets.NEXT_PUBLIC_VAPID_PUBLIC_KEY }}
+  VAPID_PRIVATE_KEY: ${{ secrets.VAPID_PRIVATE_KEY }}
+  JWT_SECRET: ${{ secrets.CI_JWT_SECRET }}
+  NODE_ENV: ${{ vars.CI_NODE_ENV }}
 jobs:
   e2e:
     timeout-minutes: 20
@@ -68,6 +72,22 @@ jobs:
       - uses: ./.github/actions/dangerous-git-checkout
       - uses: ./.github/actions/yarn-install
       - uses: ./.github/actions/cache-db
+
+      - name: Generate Swagger
+        working-directory: apps/api/v2
+        run: yarn generate-swagger
+
+      - name: Check breaking changes
+        run: |
+          docker run --rm \
+            -v "$PWD:/work" -w /work \
+            tufin/oasdiff:latest \
+            breaking \
+            https://raw.githubusercontent.com/calcom/cal.com/refs/heads/main/docs/api-reference/v2/openapi.json \
+            docs/api-reference/v2/openapi.json \
+            --fail-on ERR \
+            --err-ignore .github/oasdiff-err-ignore.txt
+
       - name: Run Tests
         working-directory: apps/api/v2
         run: |
@@ -75,6 +95,7 @@ jobs:
           EXIT_CODE=$?
           echo "yarn workspace @calcom/platform-libraries build && yarn test:e2e command exit code: $EXIT_CODE"
           exit $EXIT_CODE
+
       - name: Upload Test Results
         if: ${{ always() }}
         uses: actions/upload-artifact@v4

.github/workflows/i18n.yml

@@ -16,6 +16,14 @@ jobs:
       contents: write
       pull-requests: write
     steps:
+      - name: Generate GitHub App token
+        id: generate-token
+        uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94
+        with:
+          app-id: ${{ secrets.CI_CAL_APP_ID }}
+          private-key: ${{ secrets.CI_CAL_APP_PRIVATE_KEY }}
+          repositories: 'cal.com'
+
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
@@ -23,7 +31,7 @@ jobs:
           cache: 'npm'
       - uses: lingodotdev/lingo.dev@main
         env:
-          GH_TOKEN: ${{ secrets.GH_ACCESS_TOKEN }}
+          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
         with:
           api-key: ${{ secrets.CI_LINGO_DOT_DEV_API_KEY }}
           pull-request: true

.github/workflows/integration-tests.yml

@@ -5,6 +5,7 @@ permissions:
   contents: read
 env:
   NODE_OPTIONS: --max-old-space-size=4096
+  INTEGRATION_TESTS: "true"
   ALLOWED_HOSTNAMES: ${{ vars.CI_ALLOWED_HOSTNAMES }}
   CALENDSO_ENCRYPTION_KEY: ${{ secrets.CI_CALENDSO_ENCRYPTION_KEY }}
   DAILY_API_KEY: ${{ secrets.CI_DAILY_API_KEY }}

.github/workflows/labeler.yml

@@ -15,18 +15,6 @@ jobs:
       - uses: actions/labeler@v5
         with:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"
-  team-labels:
-    permissions:
-      contents: read
-      pull-requests: write
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: equitybee/team-label-action@main
-        with:
-          repo-token: ${{ secrets.EQUITY_BEE_TEAM_LABELER_ACTION_TOKEN }}
-          organization-name: calcom
-          ignore-labels: "admin, app-store, ai, authentication, automated-testing, billing, bookings, caldav, calendar-apps, ci, console, crm-apps, dba, devops, docs, documentation, emails, embeds, event-types, i18n, impersonation, manual-testing, ui, performance, ops-stack, organizations, public-api, routing-forms, seats, self-hosted, teams, webhooks, workflows, zapier"
   apply-labels-from-issue:
     runs-on: ubuntu-latest
 

.github/workflows/nextjs-bundle-analysis.yml

@@ -16,7 +16,6 @@ env:
   CALENDSO_ENCRYPTION_KEY: ${{ secrets.CI_CALENDSO_ENCRYPTION_KEY }}
   DAILY_API_KEY: ${{ secrets.CI_DAILY_API_KEY }}
   DATABASE_URL: ${{ secrets.CI_DATABASE_URL }}
-  DATABASE_DIRECT_URL: ${{ secrets.CI_DATABASE_URL }}
   E2E_TEST_APPLE_CALENDAR_EMAIL: ${{ secrets.E2E_TEST_APPLE_CALENDAR_EMAIL }}
   E2E_TEST_APPLE_CALENDAR_PASSWORD: ${{ secrets.E2E_TEST_APPLE_CALENDAR_PASSWORD }}
   E2E_TEST_MAILHOG_ENABLED: ${{ vars.E2E_TEST_MAILHOG_ENABLED }}

.github/workflows/post-release.yml

@@ -6,16 +6,27 @@ on:
     tags:
       - "*"
 
+permissions:
+  contents: write
+
 jobs:
   release:
     runs-on: ubuntu-latest
     steps:
+      - name: Generate GitHub App token
+        id: generate-token
+        uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94
+        with:
+          app-id: ${{ secrets.CI_CAL_APP_ID }}
+          private-key: ${{ secrets.CI_CAL_APP_PRIVATE_KEY }}
+          repositories: 'cal.com'
+
       - name: Checkout code
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
           ref: 'main'
-          token: ${{ secrets.GH_ACCESS_TOKEN }}
+          token: ${{ steps.generate-token.outputs.token }}
 
       - name: Configure git
         run: |

.github/workflows/pr.yml

@@ -146,6 +146,13 @@ jobs:
     uses: ./.github/workflows/docs-build.yml
     secrets: inherit
 
+  build-companion:
+    name: Companion builds
+    needs: [changes, check-label, deps]
+    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
+    uses: ./.github/workflows/companion-build.yml
+    secrets: inherit
+
   build:
     name: Production builds
     needs: [changes, check-label, deps]
@@ -195,13 +202,6 @@ jobs:
     uses: ./.github/workflows/e2e-embed-react.yml
     secrets: inherit
 
-  e2e-atoms:
-    name: Tests
-    needs: [changes, check-label, build, build-atoms, build-api-v2]
-    if: ${{ needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
-    uses: ./.github/workflows/e2e-atoms.yml
-    secrets: inherit
-
   analyze:
     name: Analyze Build
     needs: [build]
@@ -211,7 +211,7 @@ jobs:
   merge-reports:
     name: Merge reports
     if: ${{ !cancelled() && needs.check-label.outputs.run-e2e == 'true' && needs.changes.outputs.has-files-requiring-all-checks == 'true' }}
-    needs: [changes, check-label, e2e, e2e-embed, e2e-embed-react, e2e-app-store, e2e-atoms]
+    needs: [changes, check-label, e2e, e2e-embed, e2e-embed-react, e2e-app-store]
     uses: ./.github/workflows/merge-reports.yml
     secrets: inherit
 
@@ -251,12 +251,12 @@ jobs:
         build-api-v2,
         build-atoms,
         build-docs,
+        build-companion,
         e2e,
         e2e-api-v2,
         e2e-embed,
         e2e-embed-react,
-        e2e-app-store,
-        e2e-atoms,
+        e2e-app-store
       ]
     if: always()
     runs-on: buildjet-2vcpu-ubuntu-2204

.github/workflows/production-build-without-database.yml

@@ -10,7 +10,6 @@ env:
   CALENDSO_ENCRYPTION_KEY: ${{ secrets.CI_CALENDSO_ENCRYPTION_KEY }}
   DAILY_API_KEY: ${{ secrets.CI_DAILY_API_KEY }}
   DATABASE_URL: ${{ secrets.CI_DATABASE_URL }}
-  DATABASE_DIRECT_URL: ${{ secrets.CI_DATABASE_URL }}
   E2E_TEST_APPLE_CALENDAR_EMAIL: ${{ secrets.E2E_TEST_APPLE_CALENDAR_EMAIL }}
   E2E_TEST_APPLE_CALENDAR_PASSWORD: ${{ secrets.E2E_TEST_APPLE_CALENDAR_PASSWORD }}
   GOOGLE_API_CREDENTIALS: ${{ secrets.CI_GOOGLE_API_CREDENTIALS }}
@@ -36,7 +35,6 @@ env:
   NEXT_PUBLIC_API_V2_ROOT_URL: ${{ secrets.CI_NEXT_PUBLIC_API_V2_ROOT_URL }}
   NEXT_PUBLIC_ORG_SELF_SERVE_ENABLED: ${{ vars.CI_NEXT_PUBLIC_ORG_SELF_SERVE_ENABLED }}
 
-
 jobs:
   build:
     name: Build Web App

.github/workflows/publish-report.yml

@@ -13,12 +13,20 @@ jobs:
       HTML_REPORT_URL_PATH: reports/${{ github.head_ref }}/${{ github.run_id }}/${{ github.run_attempt }}
       BRANCH_REPORTS_DIR: reports/${{ github.head_ref }}
     steps:
+      - name: Generate GitHub App token
+        id: generate-token
+        uses: actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94
+        with:
+          app-id: ${{ secrets.CI_CAL_APP_ID }}
+          private-key: ${{ secrets.CI_CAL_APP_PRIVATE_KEY }}
+          repositories: 'test-results-2'
+
       - name: Checkout GitHub Pages Branch
         uses: actions/checkout@v4
         with:
-          repository: calcom/test-results
+          repository: calcom/test-results-2
           ref: gh-pages
-          token: ${{ secrets.GH_ACCESS_TOKEN }}
+          token: ${{ steps.generate-token.outputs.token }}
       - name: Set Git User
         # see: https://github.com/actions/checkout/issues/13#issuecomment-724415212
         run: |
@@ -67,7 +75,7 @@ jobs:
       - name: Output Report URL as Workflow Annotation
         id: url
         run: |
-          FULL_HTML_REPORT_URL=https://calcom.github.io/test-results/$HTML_REPORT_URL_PATH
+          FULL_HTML_REPORT_URL=https://calcom.github.io/test-results-2/$HTML_REPORT_URL_PATH
           echo "::notice title=📋 Published Playwright Test Report::$FULL_HTML_REPORT_URL"
           echo "link=$FULL_HTML_REPORT_URL" >> $GITHUB_OUTPUT
       - name: Find Comment

.github/workflows/release-docker.yaml

@@ -1,10 +1,15 @@
 name: "Release Docker"
 
-on: # yamllint disable-line rule:truthy
-  release:
-    types:
-      - created
-      - published
+env:
+  POSTGRES_USER: "unicorn_user"
+  POSTGRES_PASSWORD: "magical_password"
+  POSTGRES_DB: "calendso"
+  DATABASE_HOST: "database:5432"
+
+on:
+  push:
+    tags:
+      - "v*"
   # in case manual trigger is needed
   workflow_dispatch:
     inputs:
@@ -12,11 +17,9 @@ on: # yamllint disable-line rule:truthy
         description: "v{Major}.{Minor}.{Patch}"
 
 jobs:
-  release:
-    name: "Remote Release"
-
-    runs-on: "ubuntu-latest"
-
+  release-amd64:
+    name: "Release AMD64"
+    runs-on: buildjet-4vcpu-ubuntu-2204
     steps:
       - name: checkout
         uses: actions/checkout@v4
@@ -24,25 +27,85 @@ jobs:
       - name: "Determine tag"
         run: 'echo "RELEASE_TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV'
 
-      - name: "Run remote release workflow"
-        uses: "actions/github-script@v6"
+      - name: Build and test Docker image
+        uses: ./.github/actions/docker-build-and-test
         with:
-          # Requires a personal access token with Actions Read and write permissions on calcom/docker.
-          github-token: "${{ secrets.DOCKER_REPO_ACCESS_TOKEN }}"
-          script: |
-            try {
-              const response = await github.rest.actions.createWorkflowDispatch({
-                owner: context.repo.owner,
-                repo: 'docker',
-                workflow_id: 'create-release.yaml',
-                ref: 'main',
-                inputs: {
-                  "RELEASE_TAG": process.env.RELEASE_TAG
-                },
-              });
+          platform: "linux/amd64"
+          platform-suffix: ""
+          dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
+          dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          postgres-user: ${{ env.POSTGRES_USER }}
+          postgres-password: ${{ env.POSTGRES_PASSWORD }}
+          postgres-db: ${{ env.POSTGRES_DB }}
+          database-host: ${{ env.DATABASE_HOST }}
+          push-image: "true"
+          use-as-latest: "true"
 
-              console.log(response);
-            } catch (error) {
-              console.error(error);
-              core.setFailed(error.message);
+      - name: Notify Slack on Success
+        if: success()
+        uses: slackapi/slack-github-action@v1.24.0
+        with:
+          payload: |
+            {
+              "text": ":large_green_circle: Workflow *${{ github.workflow }}* (AMD64) succeeded in job *${{ github.job }}*.\nSee: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
             }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.CI_SLACK_WEBHOOK_URL }}
+
+      - name: Notify Slack on Failure
+        if: failure()
+        uses: slackapi/slack-github-action@v1.24.0
+        with:
+          payload: |
+            {
+              "text": ":red_circle: Workflow *${{ github.workflow }}* (AMD64) failed in job *${{ github.job }}*.\nSee: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+            }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.CI_SLACK_WEBHOOK_URL }}
+
+  release-arm:
+    name: "Release ARM"
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+
+      - name: "Determine tag"
+        run: 'echo "RELEASE_TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV'
+
+      - name: Build and test Docker image
+        uses: ./.github/actions/docker-build-and-test
+        with:
+          platform: "arm64"
+          platform-suffix: "-arm"
+          dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
+          dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          postgres-user: ${{ env.POSTGRES_USER }}
+          postgres-password: ${{ env.POSTGRES_PASSWORD }}
+          postgres-db: ${{ env.POSTGRES_DB }}
+          database-host: ${{ env.DATABASE_HOST }}
+          push-image: "true"
+
+      - name: Notify Slack on Success
+        if: success()
+        uses: slackapi/slack-github-action@v1.24.0
+        with:
+          payload: |
+            {
+              "text": ":large_green_circle: Workflow *${{ github.workflow }}* (ARM) succeeded in job *${{ github.job }}*.\nSee: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+            }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.CI_SLACK_WEBHOOK_URL }}
+
+      - name: Notify Slack on Failure
+        if: failure()
+        uses: slackapi/slack-github-action@v1.24.0
+        with:
+          payload: |
+            {
+              "text": ":red_circle: Workflow *${{ github.workflow }}* (ARM) failed in job *${{ github.job }}*.\nSee: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+            }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.CI_SLACK_WEBHOOK_URL }}

.gitignore

@@ -67,6 +67,9 @@ tsconfig.tsbuildinfo
 
 # Prisma generated files
 packages/prisma/client/*
+!packages/prisma/client/index.ts
+apps/api/v2/generated/prisma/*
+packages/prisma/generated/prisma/*
 packages/prisma/zod/**/*.ts
 packages/prisma/enums
 
@@ -102,3 +105,6 @@ packages/**/.yarn/ci-cache/
 
 # AI
 .claude
+
+# trigger.dev
+.trigger

.husky/pre-commit

@@ -1,6 +1,3 @@
-#!/bin/sh
-. "$(dirname "$0")/_/husky.sh"
-
 yarn lint-staged
 
 yarn app-store:build && git add packages/app-store/*.generated.*

.nvmrc

@@ -1 +0,0 @@
-20

.prettierignore

@@ -16,5 +16,4 @@ public
 packages/prisma/zod
 packages/prisma/enums
 apps/web/public/embed
-apps/api/v2/swagger/documentation.json
 packages/ui/components/icon/dynamicIconImports.tsx

.vscode/extensions.json

@@ -4,7 +4,6 @@
     "yzhang.markdown-all-in-one", // nicer markdown support
     "esbenp.prettier-vscode", // prettier plugin
     "dbaeumer.vscode-eslint", // eslint plugin
-    "bradlc.vscode-tailwindcss", // hinting / autocompletion for tailwind
     "ban.spellright", // Spell check for docs
     "stripe.vscode-stripe", // stripe VSCode extension
     "Prisma.prisma", // syntax|format|completion for prisma

.vscode/settings.json

@@ -1,11 +1,12 @@
 {
   "typescript.tsdk": "node_modules/typescript/lib",
-  "editor.formatOnSave": false,
+  "editor.formatOnSave": true,
+  "editor.defaultFormatter": "esbenp.prettier-vscode",
   "editor.codeActionsOnSave": {
     "source.fixAll.eslint": "explicit"
   },
   "typescript.preferences.importModuleSpecifier": "non-relative",
   "spellright.language": ["en"],
   "spellright.documentTypes": ["markdown", "typescript", "typescriptreact"],
-  "tailwindCSS.experimental.classRegex": [["cva\\(([^)]*)\\)", "[\"'`]([^\"'`]*).*?[\"'`]"]]
+  "tailwindCSS.classFunctions": ["cva"]
 }

.yarn/versions/60ad8d80.yml

@@ -0,0 +1,2 @@
+undecided:
+  - calcom-monorepo

.yarn/versions/a784da6c.yml

@@ -0,0 +1,2 @@
+undecided:
+  - calcom-monorepo

.yarn/versions/c0a99150.yml

@@ -0,0 +1,2 @@
+undecided:
+  - "@calcom/prisma"

.yarn/versions/d8a9566d.yml

@@ -0,0 +1,2 @@
+undecided:
+  - calcom-monorepo

.yarn/versions/fa1a370a.yml

@@ -0,0 +1,2 @@
+undecided:
+  - calcom-monorepo

AGENTS.md

@@ -1,30 +1,213 @@
 # Cal.com Development Guide for AI Agents
 
-**📖 Complete documentation is in the [.agents/](.agents/) directory.**
+You are a senior Cal.com engineer working in a Yarn/Turbo monorepo. You prioritize type safety, security, and small, reviewable diffs.
 
-## Quick Reference
+## Do
 
-### Essential Commands
+- Use `select` instead of `include` in Prisma queries for performance and security
+- Use `import type { X }` for TypeScript type imports
+- Use early returns to reduce nesting: `if (!booking) return null;`
+- Use `ErrorWithCode` for errors in non-tRPC files (services, repositories, utilities); use `TRPCError` only in tRPC routers
+- Use conventional commits: `feat:`, `fix:`, `refactor:`
+- Create PRs in draft mode by default
+- Run `yarn type-check:ci --force` before concluding CI failures are unrelated to your changes
+- Import directly from source files, not barrel files (e.g., `@calcom/ui/components/button` not `@calcom/ui`)
+- Add translations to `apps/web/public/static/locales/en/common.json` for all UI strings
+- Use `date-fns` or native `Date` instead of Day.js when timezone awareness isn't needed
+- Put permission checks in `page.tsx`, never in `layout.tsx`
+- Use `ast-grep` for searching if available; otherwise use `rg` (ripgrep), then fall back to `grep`
 
-- `yarn dev` - Start development server
-- `yarn build` - Build all packages
-- `yarn lint:fix` - Lint and fix code
-- `yarn type-check` - TypeScript checking
-- `yarn test <filename> -- --integrationTestsOnly` - Run integration tests
-- `yarn e2e <filename> --grep "<testName>"` - Run specific E2E test
+## Don't
 
-## Tool Preferences
+- Never use `as any` - use proper type-safe solutions instead
+- Never expose `credential.key` field in API responses or queries
+- Never commit secrets or API keys
+- Never modify `*.generated.ts` files directly - they're created by app-store-cli
+- Never put business logic in repositories - that belongs in Services
+- Never use barrel imports from index.ts files
+- Never skip running type checks before pushing
+- Never create large PRs (>500 lines or >10 files) - split them instead
 
-### Search Tools Priority
+## Commands
 
-Use tools in this order of preference:
+### File-scoped (preferred for speed)
 
-1. **ast-grep** - For AST-based code searches (if available)
-2. **rg (ripgrep)** - For fast text searches
-3. **grep** - As fallback for text searches
+```bash
+# Type check - always run on changed files
+yarn type-check:ci --force
 
-## 📚 Detailed Documentation
+# Lint single file
+yarn eslint --fix path/to/file.tsx
 
-- **[.agents/README.md](.agents/README.md)** - Complete development guide
-- **[.agents/commands.md](.agents/commands.md)** - All build, test & dev commands
-- **[.agents/knowledge-base.md](.agents/knowledge-base.md)** - Knowledge base & best practices
+# Format single file  
+yarn prettier --write path/to/file.tsx
+
+# Unit test specific file
+yarn vitest run path/to/file.test.ts
+
+# Unit test specific file + specific test
+yarn vitest run path/to/file.test.ts --testNamePattern="specific test name"
+
+# Integration test specific file
+yarn test path/to/file.integration-test.ts -- --integrationTestsOnly
+
+# Integration test specific file + specific test
+yarn test path/to/file.integration-test.ts --testNamePattern="specific test name" -- --integrationTestsOnly
+
+# E2E test specific file
+PLAYWRIGHT_HEADLESS=1 yarn e2e path/to/file.e2e.ts
+
+# E2E test specific file + specific test
+PLAYWRIGHT_HEADLESS=1 yarn e2e path/to/file.e2e.ts --grep "specific test name"
+```
+
+### Project-wide (use sparingly)
+
+```bash
+# Development
+yarn dev              # Start dev server
+yarn dx               # Dev with database setup
+
+# Build & check
+yarn build            # Build all packages
+yarn lint:fix         # Lint and fix all
+yarn type-check       # Type check all
+
+# Tests (use TZ=UTC for consistency)
+TZ=UTC yarn test      # All unit tests
+yarn e2e              # All E2E tests
+
+# Database
+yarn prisma generate  # Regenerate types after schema changes
+yarn workspace @calcom/prisma db-migrate  # Run migrations
+```
+
+## Boundaries
+
+### Always do
+- Run type check on changed files before committing
+- Run relevant tests before pushing
+- Use `select` in Prisma queries
+- Follow conventional commits for PR titles
+
+### Ask first
+- Adding new dependencies
+- Schema changes to `packages/prisma/schema.prisma`
+- Changes affecting multiple packages
+- Deleting files
+- Running full build or E2E suites
+
+### Never do
+- Commit secrets, API keys, or `.env` files
+- Expose `credential.key` in any query
+- Use `as any` type casting
+- Force push or rebase shared branches
+- Modify generated files directly
+
+## Project Structure
+
+```
+apps/web/                    # Main Next.js application
+packages/prisma/             # Database schema (schema.prisma) and migrations
+packages/trpc/               # tRPC API layer (routers in server/routers/)
+packages/ui/                 # Shared UI components
+packages/features/           # Feature-specific code
+packages/app-store/          # Third-party integrations
+packages/lib/                # Shared utilities
+```
+
+### Key files
+- Routes: `apps/web/app/` (App Router)
+- Database schema: `packages/prisma/schema.prisma`
+- tRPC routers: `packages/trpc/server/routers/`
+- Translations: `apps/web/public/static/locales/en/common.json`
+- Workflow constants: `packages/features/ee/workflows/lib/constants.ts`
+
+## Tech Stack
+
+- **Framework**: Next.js 13+ (App Router in some areas)
+- **Language**: TypeScript (strict)
+- **Database**: PostgreSQL with Prisma ORM
+- **API**: tRPC for type-safe APIs
+- **Auth**: NextAuth.js
+- **Styling**: Tailwind CSS
+- **Testing**: Vitest (unit), Playwright (E2E)
+- **i18n**: next-i18next
+
+## Code Examples
+
+### Good error handling
+
+```typescript
+// Good - Descriptive error with context
+throw new Error(`Unable to create booking: User ${userId} has no available time slots for ${date}`);
+
+// Bad - Generic error
+throw new Error("Booking failed");
+```
+
+For which error class to use (`ErrorWithCode` vs `TRPCError`) and concrete examples, see [Error Types in knowledge-base.md](agents/knowledge-base.md#error-types).
+
+### Good Prisma query
+
+```typescript
+// Good - Use select for performance and security
+const booking = await prisma.booking.findFirst({
+  select: {
+    id: true,
+    title: true,
+    user: {
+      select: {
+        id: true,
+        name: true,
+        email: true,
+      }
+    }
+  }
+});
+
+// Bad - Include fetches all fields including sensitive ones
+const booking = await prisma.booking.findFirst({
+  include: { user: true }
+});
+```
+
+### Good imports
+
+```typescript
+// Good - Type imports and direct paths
+import type { User } from "@prisma/client";
+import { Button } from "@calcom/ui/components/button";
+
+// Bad - Regular import for types, barrel imports
+import { User } from "@prisma/client";
+import { Button } from "@calcom/ui";
+```
+
+## PR Checklist
+
+- [ ] Title follows conventional commits: `feat(scope): description`
+- [ ] Type check passes: `yarn type-check:ci --force`
+- [ ] Lint passes: `yarn lint:fix`
+- [ ] Relevant tests pass
+- [ ] Diff is small and focused (<500 lines, <10 files)
+- [ ] No secrets or API keys committed
+- [ ] UI strings added to translation files
+- [ ] Created as draft PR
+
+## When Stuck
+
+- Ask a clarifying question before making large speculative changes
+- Propose a short plan for complex tasks
+- Open a draft PR with notes if unsure about approach
+- Fix type errors before test failures - they're often the root cause
+- Run `yarn prisma generate` if you see missing enum/type errors
+
+## Extended Documentation
+
+For detailed information, see the `agents/` directory:
+
+- **[agents/README.md](agents/README.md)** - Architecture overview and patterns
+- **[agents/commands.md](agents/commands.md)** - Complete command reference
+- **[agents/knowledge-base.md](agents/knowledge-base.md)** - Domain knowledge and best practices
+- **[agents/coding-standards.md](agents/coding-standards.md)** - Coding standards with examples

Dockerfile

@@ -0,0 +1,94 @@
+FROM --platform=$BUILDPLATFORM node:20 AS builder
+
+WORKDIR /calcom
+
+## If we want to read any ENV variable from .env file, we need to first accept and pass it as an argument to the Dockerfile
+ARG NEXT_PUBLIC_LICENSE_CONSENT
+ARG NEXT_PUBLIC_WEBSITE_TERMS_URL
+ARG NEXT_PUBLIC_WEBSITE_PRIVACY_POLICY_URL
+ARG CALCOM_TELEMETRY_DISABLED
+ARG DATABASE_URL
+ARG NEXTAUTH_SECRET=secret
+ARG CALENDSO_ENCRYPTION_KEY=secret
+ARG MAX_OLD_SPACE_SIZE=6144
+ARG NEXT_PUBLIC_API_V2_URL
+ARG CSP_POLICY
+
+## We need these variables as required by Next.js build to create rewrites
+ARG NEXT_PUBLIC_SINGLE_ORG_SLUG
+ARG ORGANIZATIONS_ENABLED
+
+ENV NEXT_PUBLIC_WEBAPP_URL=http://NEXT_PUBLIC_WEBAPP_URL_PLACEHOLDER \
+    NEXT_PUBLIC_API_V2_URL=$NEXT_PUBLIC_API_V2_URL \
+    NEXT_PUBLIC_LICENSE_CONSENT=$NEXT_PUBLIC_LICENSE_CONSENT \
+    NEXT_PUBLIC_WEBSITE_TERMS_URL=$NEXT_PUBLIC_WEBSITE_TERMS_URL \
+    NEXT_PUBLIC_WEBSITE_PRIVACY_POLICY_URL=$NEXT_PUBLIC_WEBSITE_PRIVACY_POLICY_URL \
+    CALCOM_TELEMETRY_DISABLED=$CALCOM_TELEMETRY_DISABLED \
+    DATABASE_URL=$DATABASE_URL \
+    DATABASE_DIRECT_URL=$DATABASE_URL \
+    NEXTAUTH_SECRET=${NEXTAUTH_SECRET} \
+    CALENDSO_ENCRYPTION_KEY=${CALENDSO_ENCRYPTION_KEY} \
+    NEXT_PUBLIC_SINGLE_ORG_SLUG=$NEXT_PUBLIC_SINGLE_ORG_SLUG \
+    ORGANIZATIONS_ENABLED=$ORGANIZATIONS_ENABLED \
+    NODE_OPTIONS=--max-old-space-size=${MAX_OLD_SPACE_SIZE} \
+    BUILD_STANDALONE=true \
+    CSP_POLICY=$CSP_POLICY
+
+COPY package.json yarn.lock .yarnrc.yml playwright.config.ts turbo.json i18n.json ./
+COPY .yarn ./.yarn
+COPY apps/web ./apps/web
+COPY apps/api/v2 ./apps/api/v2
+COPY packages ./packages
+COPY tests ./tests
+
+RUN yarn config set httpTimeout 1200000
+RUN npx turbo prune --scope=@calcom/web --scope=@calcom/trpc --docker
+RUN yarn install
+# Build and make embed servable from web/public/embed folder
+RUN yarn workspace @calcom/trpc run build
+RUN yarn --cwd packages/embeds/embed-core workspace @calcom/embed-core run build
+RUN yarn --cwd apps/web workspace @calcom/web run build
+RUN rm -rf node_modules/.cache .yarn/cache apps/web/.next/cache
+
+FROM node:20 AS builder-two
+
+WORKDIR /calcom
+ARG NEXT_PUBLIC_WEBAPP_URL=http://localhost:3000
+
+ENV NODE_ENV=production
+
+COPY package.json .yarnrc.yml turbo.json i18n.json ./
+COPY .yarn ./.yarn
+COPY --from=builder /calcom/yarn.lock ./yarn.lock
+COPY --from=builder /calcom/node_modules ./node_modules
+COPY --from=builder /calcom/packages ./packages
+COPY --from=builder /calcom/apps/web ./apps/web
+COPY --from=builder /calcom/packages/prisma/schema.prisma ./prisma/schema.prisma
+COPY scripts scripts
+RUN chmod +x scripts/*
+
+# Save value used during this build stage. If NEXT_PUBLIC_WEBAPP_URL and BUILT_NEXT_PUBLIC_WEBAPP_URL differ at
+# run-time, then start.sh will find/replace static values again.
+ENV NEXT_PUBLIC_WEBAPP_URL=$NEXT_PUBLIC_WEBAPP_URL \
+    BUILT_NEXT_PUBLIC_WEBAPP_URL=$NEXT_PUBLIC_WEBAPP_URL
+
+RUN scripts/replace-placeholder.sh http://NEXT_PUBLIC_WEBAPP_URL_PLACEHOLDER ${NEXT_PUBLIC_WEBAPP_URL}
+
+FROM node:20 AS runner
+
+WORKDIR /calcom
+
+RUN apt-get update && apt-get install -y --no-install-recommends netcat-openbsd wget && rm -rf /var/lib/apt/lists/*
+
+COPY --from=builder-two /calcom ./
+ARG NEXT_PUBLIC_WEBAPP_URL=http://localhost:3000
+ENV NEXT_PUBLIC_WEBAPP_URL=$NEXT_PUBLIC_WEBAPP_URL \
+    BUILT_NEXT_PUBLIC_WEBAPP_URL=$NEXT_PUBLIC_WEBAPP_URL
+
+ENV NODE_ENV=production
+EXPOSE 3000
+
+HEALTHCHECK --interval=30s --timeout=30s --retries=5 \
+    CMD wget --spider http://localhost:3000 || exit 1
+
+CMD ["/calcom/scripts/start.sh"]

PR_TODO.md

@@ -1,15 +0,0 @@
-Possible issue:
-- We won't be able to use already built calendar-cache when Delegation Credential is enabled because existing CalendarCache entries don't have userId set.
-
-## Approach of always using SelectedCalendar.credentialId for CalendarCache even for DelegationCredentials
-- Delete Credentials when DelegationCredential is disabled
-
-
-TO Test
-- New members beyond the batch size are processed
-
-
-
-
-
-

README.md

@@ -4,7 +4,7 @@
    <img src="https://user-images.githubusercontent.com/8019099/210054112-5955e812-a76e-4160-9ddd-58f2c72f1cce.png" alt="Logo">
   </a>
 
-  <h3 align="center">Cal.com (formerly Calendso)</h3>
+  <h3 align="center">Cal.com</h3>
 
   <p align="center">
     The open-source Calendly successor.
@@ -175,6 +175,7 @@ yarn dx
 ```
 
 #### Development tip
+
 1. Add `export NODE_OPTIONS=“--max-old-space-size=16384”` to your shell script to increase the memory limit for the node process. Alternatively, you can run this in your terminal before running the app. Replace 16384 with the amount of RAM you want to allocate to the node process.
 
 2. Add `NEXT_PUBLIC_LOGGER_LEVEL={level}` to your .env file to control the logging verbosity for all tRPC queries and mutations.\
@@ -226,7 +227,7 @@ for Logger level to be set at info, for example.
 
    3. Now open your psql shell with the DB you created: `psql -h localhost -U postgres -d <DB name>`
 
-   4. Inside the psql shell execute `\conninfo`. And you will get the following info.  
+   4. Inside the psql shell execute `\conninfo`. And you will get the following info.
       ![image](https://user-images.githubusercontent.com/39329182/236612291-51d87f69-6dc1-4a23-bf4d-1ca1754e0a35.png)
 
    5. Now extract all the info and add it to your DATABASE_URL. The url would look something like this
@@ -234,9 +235,10 @@ for Logger level to be set at info, for example.
 
    </details>
 
-   If you don't want to create a local DB. Then you can also consider using services like railway.app or render.
+   If you don't want to create a local DB. Then you can also consider using services like railway.app, Northflank or render.
 
    - [Setup postgres DB with railway.app](https://docs.railway.app/guides/postgresql)
+   - [Setup postgres DB with Northflank](https://northflank.com/guides/deploy-postgres-database-on-northflank)
    - [Setup postgres DB with render](https://render.com/docs/databases)
 
 1. Copy and paste your `DATABASE_URL` from `.env` to `.env.appStore`.
@@ -374,15 +376,268 @@ Executable doesn't exist at /Users/alice/Library/Caches/ms-playwright/chromium-1
 
 ### Docker
 
-The Docker configuration for Cal.com is an effort powered by people within the community.
+**Official support**: Our team will begin to officially support the Dockerfile and docker-compose resources in this
+repository.
 
-If you want to contribute to the Docker repository, [reply here](https://github.com/calcom/docker/discussions/32).
+**Important**: Cal.com will **not** be supporting installations that use these Docker resources. While we provide and maintain the Docker configurations, support for Docker-based installations is the responsibility of the user.
 
-The Docker configuration can be found [in our docker repository](https://github.com/calcom/docker).
+This image can be found on DockerHub at [https://hub.docker.com/r/calcom/cal.com](https://hub.docker.com/r/calcom/cal.com).
 
-Issues with Docker? Find your answer or open a new discussion [here](https://github.com/calcom/docker/discussions) to ask the community.
+**Note for ARM Users**: Use the {version}-arm suffix for pulling images. Example: `docker pull calcom/cal.com:v5.6.19-arm`.
 
-Cal.com, Inc. does not provide official support for Docker, but we will accept fixes and documentation. Use at your own risk.
+#### Requirements
+
+Make sure you have `docker` & `docker compose` installed on the server / system. Both are installed by most docker utilities, including Docker Desktop and Rancher Desktop.
+
+Note: `docker compose` without the hyphen is now the primary method of using docker-compose, per the Docker documentation.
+
+#### (Most users) Running Cal.com with Docker Compose
+
+If you are evaluating Cal.com or running with minimal to no modifications, this option is for you.
+
+1. Clone calcom/cal.com
+
+   ```bash
+   git clone --recursive https://github.com/calcom/cal.com.git
+   ```
+
+2. Change into the directory
+
+   ```bash
+   cd cal.com
+   ```
+
+3. Prepare your configuration: Rename `.env.example` to `.env` and then update `.env`
+
+   ```bash
+   cp .env.example .env
+   ```
+
+   Most configurations can be left as-is, but for configuration options see [Important Run-time variables](#important-run-time-variables) below.
+
+   **Push Notifications (VAPID Keys)**
+   If you see an error like:
+
+   ```
+   Error: No key set vapidDetails.publicKey
+   ```
+
+   This means your environment variables for Web Push are missing.
+   You must generate and set `NEXT_PUBLIC_VAPID_PUBLIC_KEY` and `VAPID_PRIVATE_KEY`.
+
+   Generate them with:
+
+   ```bash
+   npx web-push generate-vapid-keys
+   ```
+
+   Then update your `.env` file:
+
+   ```env
+   NEXT_PUBLIC_VAPID_PUBLIC_KEY=your_public_key_here
+   VAPID_PRIVATE_KEY=your_private_key_here
+   ```
+
+   Do **not** commit real keys to `.env.example` — only placeholders.
+
+   Update the appropriate values in your .env file, then proceed.
+
+4. (optional) Pre-Pull the images by running the following command:
+
+   ```bash
+   docker compose pull
+   ```
+
+   This will use the default image locations as specified by `image:` in the docker-compose.yaml file.
+
+   Note: To aid with support, by default Scarf.sh is used as registry proxy for download metrics.
+
+5. Start Cal.com via docker compose
+
+   (Most basic users, and for First Run) To run the complete stack, which includes a local Postgres database, Cal.com web app, and Prisma Studio:
+
+   ```bash
+   docker compose up -d
+   ```
+
+   To run Cal.com web app and Prisma Studio against a remote database, ensure that DATABASE_URL is configured for an available database and run:
+
+   ```bash
+   docker compose up -d calcom studio
+   ```
+
+   To run only the Cal.com web app, ensure that DATABASE_URL is configured for an available database and run:
+
+   ```bash
+   docker compose up -d calcom
+   ```
+
+   **Note: to run in attached mode for debugging, remove `-d` from your desired run command.**
+
+6. Open a browser to [http://localhost:3000](http://localhost:3000), or your defined NEXT_PUBLIC_WEBAPP_URL. The first time you run Cal.com, a setup wizard will initialize. Define your first user, and you're ready to go!
+
+#### Updating Cal.com
+
+1. Stop the Cal.com stack
+
+   ```bash
+   docker compose down
+   ```
+
+2. Pull the latest changes
+
+   ```bash
+   docker compose pull
+   ```
+
+3. Update env vars as necessary.
+4. Re-start the Cal.com stack
+
+   ```bash
+   docker compose up -d
+   ```
+
+#### (Advanced users) Build and Run Cal.com
+
+1. Clone calcom/docker.
+
+   ```bash
+   git clone https://github.com/calcom/cal.com.git calcom-docker
+   ```
+
+2. Change into the directory
+
+   ```bash
+   cd calcom-docker
+   ```
+
+3. Update the calcom submodule. This project depends on the Cal.com source code, which is included here as a Git submodule. To make sure you get everything you need, update the submodule with the command below.
+
+   ```bash
+   git submodule update --remote --init
+   ```
+
+   Note: DO NOT use recursive submodule update, otherwise you will receive a git authentication error.
+
+4. Rename `.env.example` to `.env` and then update `.env`
+
+   For configuration options see [Build-time variables](#build-time-variables) below. Update the appropriate values in your .env file, then proceed.
+
+5. Build the Cal.com docker image:
+
+   Note: Due to application configuration requirements, an available database is currently required during the build process.
+
+   a) If hosting elsewhere, configure the `DATABASE_URL` in the .env file, and skip the next step
+
+   b) If a local or temporary database is required, start a local database via docker compose.
+
+   ```bash
+   docker compose up -d database
+   ```
+
+6. Build Cal.com via docker compose (DOCKER_BUILDKIT=0 must be provided to allow a network bridge to be used at build time. This requirement will be removed in the future)
+
+   ```bash
+   DOCKER_BUILDKIT=0 docker compose build calcom
+   ```
+
+7. Start Cal.com via docker compose
+
+   (Most basic users, and for First Run) To run the complete stack, which includes a local Postgres database, Cal.com web app, and Prisma Studio:
+
+   ```bash
+   docker compose up -d
+   ```
+
+   To run Cal.com web app and Prisma Studio against a remote database, ensure that DATABASE_URL is configured for an available database and run:
+
+   ```bash
+   docker compose up -d calcom studio
+   ```
+
+   To run only the Cal.com web app, ensure that DATABASE_URL is configured for an available database and run:
+
+   ```bash
+   docker compose up -d calcom
+   ```
+
+   **Note: to run in attached mode for debugging, remove `-d` from your desired run command.**
+
+8. Open a browser to [http://localhost:3000](http://localhost:3000), or your defined NEXT_PUBLIC_WEBAPP_URL. The first time you run Cal.com, a setup wizard will initialize. Define your first user, and you're ready to go!
+
+#### Configuration
+
+##### Important Run-time variables
+
+These variables must also be provided at runtime
+
+| Variable                | Description                                                                                                                                                                      | Required | Default                                                             |
+| ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ------------------------------------------------------------------- |
+| DATABASE_URL            | database url with credentials - if using a connection pooler, this setting should point there                                                                                    | required | `postgresql://unicorn_user:magical_password@database:5432/calendso` |
+| CALCOM_LICENSE_KEY      | Enterprise License Key                                                                                                                                                           | optional |                                                                     |
+| NEXT_PUBLIC_WEBAPP_URL  | Base URL of the site. NOTE: if this value differs from the value used at build-time, there will be a slight delay during container start (to update the statically built files). | optional | `http://localhost:3000`                                             |
+| NEXTAUTH_URL            | Location of the auth server. By default, this is the Cal.com docker instance itself.                                                                                             | optional | `{NEXT_PUBLIC_WEBAPP_URL}/api/auth`                                 |
+| NEXTAUTH_SECRET         | must match build variable                                                                                                                                                        | required | `secret`                                                            |
+| CALENDSO_ENCRYPTION_KEY | must match build variable                                                                                                                                                        | required | `secret`                                                            |
+
+##### Build-time variables
+
+If building the image yourself, these variables must be provided at the time of the docker build, and can be provided by updating the .env file. Currently, if you require changes to these variables, you must follow the instructions to build and publish your own image.
+
+Updating these variables is not required for evaluation, but is required for running in production. Instructions for generating variables can be found in the [Cal.com instructions](https://github.com/calcom/cal.com)
+
+| Variable                               | Description                                                                                                                                | Required | Default                                                             |
+| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | -------- | ------------------------------------------------------------------- |
+| DATABASE_URL                           | database url with credentials - if using a connection pooler, this setting should point there                                              | required | `postgresql://unicorn_user:magical_password@database:5432/calendso` |
+| MAX_OLD_SPACE_SIZE                     | Needed for Nodejs/NPM build options                                                                                                        | required | 4096                                                                |
+| NEXT_PUBLIC_LICENSE_CONSENT            | license consent - true/false                                                                                                               | required |                                                                     |
+| NEXTAUTH_SECRET                        | Cookie encryption key                                                                                                                      | required | `secret`                                                            |
+| CALENDSO_ENCRYPTION_KEY                | Authentication encryption key                                                                                                              | required | `secret`                                                            |
+| NEXT_PUBLIC_WEBAPP_URL                 | Base URL injected into static files                                                                                                        | optional | `http://localhost:3000`                                             |
+| NEXT_PUBLIC_WEBSITE_TERMS_URL          | custom URL for terms and conditions website                                                                                                | optional | `https://cal.com/terms`                                             |
+| NEXT_PUBLIC_WEBSITE_PRIVACY_POLICY_URL | custom URL for privacy policy website                                                                                                      | optional | `https://cal.com/privacy`                                           |
+| NEXT_PUBLIC_API_V2_URL                 | URL for the v2 API, only required for custom integrations or custom booking experiences using [Cal.com Platform](https://cal.com/platform) | optional |                                                                     |
+| CALCOM_TELEMETRY_DISABLED              | Allow Cal.com to collect anonymous usage data (set to `1` to disable)                                                                      | optional |                                                                     |
+| NEXT_PUBLIC_SINGLE_ORG_SLUG            | Required if ORGANIZATIONS_ENABLED is true                                                                                                  | optional |                                                                     |
+| ORGANIZATIONS_ENABLED                  | Used for Enterprise or Organizations plan                                                                                                  | optional |                                                                     |
+
+#### Troubleshooting
+
+##### SSL edge termination
+
+If running behind a load balancer which handles SSL certificates, you will need to add the environmental variable `NODE_TLS_REJECT_UNAUTHORIZED=0` to prevent requests from being rejected. Only do this if you know what you are doing and trust the services/load-balancers directing traffic to your service.
+
+##### Failed to commit changes: Invalid 'prisma.user.create()'
+
+Certain versions may have trouble creating a user if the field `metadata` is empty. Using an empty json object `{}` as the field value should resolve this issue. Also, the `id` field will autoincrement, so you may also try leaving the value of `id` as empty.
+
+##### CLIENT_FETCH_ERROR
+
+If you experience this error, it may be the way the default Auth callback in the server is using the WEBAPP_URL as a base url. The container does not necessarily have access to the same DNS as your local machine, and therefor needs to be configured to resolve to itself. You may be able to correct this by configuring `NEXTAUTH_URL=http://localhost:3000/api/auth`, to help the backend loop back to itself.
+
+```
+docker-calcom-1  | @calcom/web:start: [next-auth][error][CLIENT_FETCH_ERROR]
+docker-calcom-1  | @calcom/web:start: https://next-auth.js.org/errors#client_fetch_error request to http://testing.localhost:3000/api/auth/session failed, reason: getaddrinfo ENOTFOUND testing.localhost {
+docker-calcom-1  | @calcom/web:start:   error: {
+docker-calcom-1  | @calcom/web:start:     message: 'request to http://testing.localhost:3000/api/auth/session failed, reason: getaddrinfo ENOTFOUND testing.localhost',
+docker-calcom-1  | @calcom/web:start:     stack: 'FetchError: request to http://testing.localhost:3000/api/auth/session failed, reason: getaddrinfo ENOTFOUND testing.localhost\n' +
+docker-calcom-1  | @calcom/web:start:       '    at ClientRequest.<anonymous> (/calcom/node_modules/next/dist/compiled/node-fetch/index.js:1:65756)\n' +
+docker-calcom-1  | @calcom/web:start:       '    at ClientRequest.emit (node:events:513:28)\n' +
+docker-calcom-1  | @calcom/web:start:       '    at ClientRequest.emit (node:domain:489:12)\n' +
+docker-calcom-1  | @calcom/web:start:       '    at Socket.socketErrorListener (node:_http_client:494:9)\n' +
+docker-calcom-1  | @calcom/web:start:       '    at Socket.emit (node:events:513:28)\n' +
+docker-calcom-1  | @calcom/web:start:       '    at Socket.emit (node:domain:489:12)\n' +
+docker-calcom-1  | @calcom/web:start:       '    at emitErrorNT (node:internal/streams/destroy:157:8)\n' +
+docker-calcom-1  | @calcom/web:start:       '    at emitErrorCloseNT (node:internal/streams/destroy:122:3)\n' +
+docker-calcom-1  | @calcom/web:start:       '    at processTicksAndRejections (node:internal/process/task_queues:83:21)',
+docker-calcom-1  | @calcom/web:start:     name: 'FetchError'
+docker-calcom-1  | @calcom/web:start:   },
+docker-calcom-1  | @calcom/web:start:   url: 'http://testing.localhost:3000/api/auth/session',
+docker-calcom-1  | @calcom/web:start:   message: 'request to http://testing.localhost:3000/api/auth/session failed, reason: getaddrinfo ENOTFOUND testing.localhost'
+docker-calcom-1  | @calcom/web:start: }
+```
+
+<img referrerpolicy="no-referrer-when-downgrade" src="https://static.scarf.sh/a.png?x-pxid=81cda9f7-a102-453b-ac01-51c35650bd70" />
 
 ### Railway
 
@@ -390,6 +645,12 @@ Cal.com, Inc. does not provide official support for Docker, but we will accept f
 
 You can deploy Cal.com on [Railway](https://railway.app) using the button above. The team at Railway also have a [detailed blog post](https://blog.railway.app/p/calendso) on deploying Cal.com on their platform.
 
+### Northflank
+
+[![Deploy on Northflank](https://assets.northflank.com/deploy_to_northflank_smm_36700fb050.svg)](https://northflank.com/stacks/deploy-calcom)
+
+You can deploy Cal.com on [Northflank](https://northflank.com) using the button above. The team at Northflank also have a [detailed blog post](https://northflank.com/guides/deploy-calcom-with-northflank) on deploying Cal.com on their platform.
+
 ### Vercel
 
 Currently Vercel Pro Plan is required to be able to Deploy this application with Vercel, due to limitations on the number of serverless functions on the free plan.
@@ -418,7 +679,7 @@ See the [roadmap project](https://cal.com/roadmap) for a list of proposed featur
 
 Cal.com, Inc. is a commercial open source company, which means some parts of this open source repository require a commercial license. The concept is called "Open Core" where the core technology (99%) is fully open source, licensed under [AGPLv3](https://opensource.org/license/agpl-v3) and the last 1% is covered under a commercial license (["/ee" Enterprise Edition](https://github.com/calcom/cal.com/tree/main/packages/features/ee)) which we believe is entirely relevant for larger organisations that require enterprise features. Enterprise features are built by the core engineering team of Cal.com, Inc. which is hired in full-time. Find their compensation on https://cal.com/open.
 
-> [!NOTE]  
+> [!NOTE]
 > Our philosophy is simple, all "Singleplayer APIs" are open-source under AGPLv3. All commercial "Multiplayer APIs" are under a commercial license.
 
 |                                   | AGPLv3 | EE  |
@@ -490,8 +751,8 @@ Don't code but still want to contribute? Join our [Discussions](https://github.c
 - Set CSP_POLICY="non-strict" env variable, which enables [Strict CSP](https://web.dev/strict-csp/) except for unsafe-inline in style-src . If you have some custom changes in your instance, you might have to make some code change to make your instance CSP compatible. Right now it enables strict CSP only on login page and on other SSR pages it is enabled in Report only mode to detect possible issues. On, SSG pages it is still not supported.
 
 ## Single Org Mode
-Refer to docs [here](./docs/self-hosting/guides/organization/single-organization-setup) for a detailed documentation with screenshots.
 
+Refer to docs [here](./docs/self-hosting/guides/organization/single-organization-setup) for a detailed documentation with screenshots.
 
 ## Integrations
 
@@ -575,12 +836,12 @@ following
 
 1. Open [HubSpot Developer](https://developer.hubspot.com/) and sign into your account, or create a new one.
 2. From within the home of the Developer account page, go to "Manage apps".
-3. Click "Create app" button top right.
+3. Click "Create legacy app" button top right and select public app.
 4. Fill in any information you want in the "App info" tab
 5. Go to tab "Auth"
 6. Now copy the Client ID and Client Secret to your `.env` file into the `HUBSPOT_CLIENT_ID` and `HUBSPOT_CLIENT_SECRET` fields.
 7. Set the Redirect URL for OAuth `<Cal.com URL>/api/integrations/hubspot/callback` replacing Cal.com URL with the URI at which your application runs.
-8. In the "Scopes" section at the bottom of the page, make sure you select "Read" and "Write" for scope called `crm.objects.contacts`
+8. In the "Scopes" section at the bottom of the page, make sure you select "Read" and "Write" for scopes called `crm.objects.contacts` and `crm.lists`.
 9. Click the "Save" button at the bottom footer.
 10. You're good to go. Now you can see any booking in Cal.com created as a meeting in HubSpot for your contacts.
 
@@ -648,6 +909,7 @@ following
 We use changesets to generate changelogs and publish public packages (packages with `private: true` are ignored).
 
 An example of good readme is [atoms readme](https://github.com/calcom/cal.com/blob/main/packages/platform/atoms/README.md). Every public package must:
+
 1. Follow semantic versioning when using changesets.
 2. Mark breaking changes using `❗️Breaking change`
 

agents/coding-standards.md

@@ -27,6 +27,12 @@ import { User } from "@prisma/client";
 
 - Use React children and context instead of passing props through multiple components
 
+### ORM and Types
+
+- Never import `@calcom/prisma/client` in features, services, UI, or handlers.
+- Use repository DTOs or domain types instead.
+- See "Repository + DTO Pattern and Method Conventions" in the knowledge base for details and examples.
+
 ### Security Rules
 
 ```typescript

agents/commands.md

@@ -28,11 +28,17 @@
 
 - `yarn test` - Run unit tests (vitest)
 - `yarn test <filename>` - Run tests for specific file
-- `yarn test <filename> -- --integrationTestsOnly` - Run integration tests for specific file
-- `yarn test <filename> -t "<testName>" -- --integrationTestsOnly` - Run specific test by name
+- `yarn test <filename> -t "<testName>"` - Run specific test by name for specific file
 - `yarn tdd` - Run tests in watch mode
 - `yarn test:ui` - Run tests with UI interface
 
+### Integration Tests
+
+- `yarn test -- --integrationTestsOnly` - Run integration tests (vitest)
+- `yarn test <filename> -- --integrationTestsOnly` - Run integration tests for specific file
+- `yarn test <filename> -t "<testName>" -- --integrationTestsOnly` - Run specific integration test by name for specific file
+
+
 ### End-to-End Tests
 
 - `yarn e2e` - Run end-to-end tests (Playwright)

agents/knowledge-base.md

@@ -111,7 +111,7 @@ The event types page UI components are located in `apps/web/modules/event-types/
 
 Changes to shared UI patterns (like tab layouts and button alignments) need to be checked across multiple views to maintain consistency:
 - Event types page layout: `apps/web/modules/event-types/views/event-types-listing-view.tsx`
-- Bookings page layout: `apps/web/modules/bookings/views/bookings-listing-view.tsx`
+- Bookings page layout: `apps/web/modules/bookings/views/bookings-view.tsx`
 - Common elements like tabs, search bars, and filter buttons should maintain consistent alignment across views
 
 ## When working on workflow triggers or similar enum-based features in the Cal.com codebase
@@ -225,16 +225,38 @@ throw new Error("Booking failed");
 
 ### Error Types
 
+Use `ErrorWithCode` for files that are not directly coupled to tRPC. The tRPC package has a middleware called `errorConversionMiddleware` that automatically converts `ErrorWithCode` instances into `TRPCError` instances.
+
 ```typescript
-// ✅ Good - Use proper error classes
+// ✅ Good - Use ErrorWithCode in non-tRPC files (services, repositories, utilities)
+import { ErrorCode } from "@calcom/lib/errorCodes";
+import { ErrorWithCode } from "@calcom/lib/errors";
+
+// Option 1: Using constructor with ErrorCode enum
+throw new ErrorWithCode(ErrorCode.BookingNotFound, "Booking not found");
+
+// Option 2: Using the Factory pattern for common HTTP errors
+throw ErrorWithCode.Factory.Forbidden("You don't have permission to view this");
+throw ErrorWithCode.Factory.NotFound("Resource not found");
+throw ErrorWithCode.Factory.BadRequest("Invalid input");
+
+// ✅ Good - Use TRPCError only in tRPC routers/procedures
 import { TRPCError } from "@trpc/server";
 
 throw new TRPCError({
   code: "BAD_REQUEST",
   message: "Invalid booking time slot",
 });
+
+// ❌ Bad - Using TRPCError in non-tRPC files
+import { TRPCError } from "@trpc/server";
+// Don't use TRPCError in services, repositories, or utility files
 ```
 
+### packages/features Import Restrictions
+
+Files in `packages/features/**` should NOT import from `trpc`. This keeps the features package decoupled from the tRPC layer, making the code more reusable and testable. Use `ErrorWithCode` for error handling in these files, and let the tRPC middleware handle the conversion.
+
 ## Basic Performance Guidelines
 
 - Aim for O(n) or O(n log n) complexity, avoid O(n²)
@@ -306,6 +328,269 @@ import { Button } from "@calcom/ui/components/button";
 - **Tests**: Same as source file + `.test.ts` or `.spec.ts`
 - **Avoid**: Dot-suffixes like `.service.ts`, `.repository.ts` (except for tests, types, specs)
 
+## Repository + DTO Pattern and Method Conventions
+
+We use a Repository + DTO pattern to isolate Prisma and the database from business logic. Repositories are the only layer that talks to Prisma and database models. All services, tRPC handlers, API controllers, workflows, and UI should depend on DTOs or domain types, not Prisma types.
+
+DTOs (Data Transfer Objects) are simple TypeScript types or interfaces that represent our domain data in an ORM-agnostic way and are returned from repositories.
+
+### Why this pattern?
+
+- **Prevent type leaks**: Prisma type changes stay inside repositories instead of breaking services, handlers, and UI across dozens of files.
+- **Enable safe refactors**: Business logic works against stable DTOs, so you can change storage details without touching higher layers.
+- **Keep ORM swappable**: If we ever change ORM, only repository implementations change; services and handlers stay the same.
+
+### What not to do: tight Prisma coupling in business logic
+
+Do not import Prisma types in business logic. Prisma types belong only in the data access layer.
+
+```typescript
+// ❌ Bad – business logic depends on Prisma
+import type { Webhook } from "@calcom/prisma/client";
+export function sendPayload(webhook: Webhook) { /* ... */ }
+
+// ✅ Good – business logic depends on DTO + repository
+export interface WebhookDTO { id: string; url: string; }
+export interface IWebhookRepository { findById(id: string): Promise<WebhookDTO | null>; }
+export async function sendPayload(repo: IWebhookRepository, id: string) {
+  const webhook = await repo.findById(id);
+  // ...
+}
+```
+
+### DTOs in repositories
+
+Repositories should expose DTOs from their public methods and keep Prisma types internal. Inside the repository, use `Prisma.*GetPayload` and map rows to DTOs. The public methods should only return DTOs, never Prisma models.
+
+```typescript
+// DTO – ORM-agnostic type exported from the repository module
+export interface BookingDTO {
+  id: string;
+  userId: number;
+  startTime: Date;
+  status: "PENDING" | "CONFIRMED" | "CANCELLED";
+}
+```
+
+### Prisma boundaries
+
+- **Allowed**: `packages/prisma`, repository implementations (`packages/features/**/repositories/*Repository.ts`), and low-level data access infrastructure.
+- **Not allowed**: `packages/features/**` business logic (non-repository), `packages/trpc/**` handlers, `apps/web/**`, `apps/api/v2/**` services/controllers, and workflow/webhook/service layers.
+
+### Method Naming Rules
+
+**1. Don't include the repository's entity name in method names**
+
+Method names should be concise and avoid redundancy since the repository class name already indicates the entity type.
+
+```typescript
+// ✅ Good - Concise method names
+class BookingRepository {
+  findById(id: string) { ... }
+  findByUserId(userId: string) { ... }
+  create(data: BookingCreateInput) { ... }
+  delete(id: string) { ... }
+}
+
+// ❌ Bad - Redundant entity name in methods
+class BookingRepository {
+  findBookingById(id: string) { ... }
+  findBookingByUserId(userId: string) { ... }
+  createBooking(data: BookingCreateInput) { ... }
+  deleteBooking(id: string) { ... }
+}
+```
+
+**2. Use `include` or similar keywords for methods that fetch relational data**
+
+When a method retrieves additional related entities, make this explicit in the method name using keywords like `include`, `with`, or `andRelations`.
+
+```typescript
+// ✅ Good - Clear indication of included relations
+class EventTypeRepository {
+  findById(id: string) {
+    return prisma.eventType.findUnique({
+      where: { id },
+    });
+  }
+
+  findByIdIncludeHosts(id: string) {
+    return prisma.eventType.findUnique({
+      where: { id },
+      include: {
+        hosts: true,
+      },
+    });
+  }
+
+  findByIdIncludeHostsAndSchedule(id: string) {
+    return prisma.eventType.findUnique({
+      where: { id },
+      include: {
+        hosts: true,
+        schedule: true,
+      },
+    });
+  }
+}
+
+// ❌ Bad - Unclear what data is included
+class EventTypeRepository {
+  findById(id: string) {
+    return prisma.eventType.findUnique({
+      where: { id },
+      include: {
+        hosts: true,
+        schedule: true,
+      },
+    });
+  }
+
+  findByIdForReporting(id: string) {
+    return prisma.eventType.findUnique({
+      where: { id },
+      include: {
+        hosts: true,
+      },
+    });
+  }
+}
+```
+
+**3. Keep methods generic and reusable - avoid use-case-specific names**
+
+Repository methods should be general-purpose and describe what data they return, not how or where it's used. This promotes code reuse across different features.
+
+```typescript
+// ✅ Good - Generic, reusable methods
+class BookingRepository {
+  findByUserIdIncludeAttendees(userId: string) {
+    return prisma.booking.findMany({
+      where: { userId },
+      include: {
+        attendees: true,
+      },
+    });
+  }
+
+  findByDateRangeIncludeEventType(startDate: Date, endDate: Date) {
+    return prisma.booking.findMany({
+      where: {
+        startTime: { gte: startDate },
+        endTime: { lte: endDate },
+      },
+      include: {
+        eventType: true,
+      },
+    });
+  }
+}
+
+// ❌ Bad - Use-case-specific method names
+class BookingRepository {
+  findBookingsForReporting(userId: string) {
+    return prisma.booking.findMany({
+      where: { userId },
+      include: {
+        attendees: true,
+      },
+    });
+  }
+
+  findBookingsForDashboard(startDate: Date, endDate: Date) {
+    return prisma.booking.findMany({
+      where: {
+        startTime: { gte: startDate },
+        endTime: { lte: endDate },
+      },
+      include: {
+        eventType: true,
+      },
+    });
+  }
+}
+```
+
+**4. No business logic in repositories**
+
+Repositories should only handle data access. Business logic, validations, and complex transformations belong in the Service layer.
+
+```typescript
+// ✅ Good - Repository only handles data access
+class BookingRepository {
+  findByIdIncludeAttendees(id: string) {
+    return prisma.booking.findUnique({
+      where: { id },
+      include: {
+        attendees: true,
+      },
+    });
+  }
+
+  updateStatus(id: string, status: BookingStatus) {
+    return prisma.booking.update({
+      where: { id },
+      data: { status },
+    });
+  }
+}
+
+class BookingService {
+  async confirmBooking(bookingId: string) {
+    const booking = await this.bookingRepository.findByIdIncludeAttendees(bookingId);
+    
+    if (!booking) {
+      throw new Error("Booking not found");
+    }
+
+    if (booking.status !== "PENDING") {
+      throw new Error("Only pending bookings can be confirmed");
+    }
+
+    // Business logic: send confirmation emails
+    await this.emailService.sendConfirmationToAttendees(booking.attendees);
+    
+    // Update status through repository
+    return this.bookingRepository.updateStatus(bookingId, "CONFIRMED");
+  }
+}
+
+// ❌ Bad - Business logic in repository
+class BookingRepository {
+  async confirmBooking(bookingId: string) {
+    const booking = await prisma.booking.findUnique({
+      where: { id: bookingId },
+      include: {
+        attendees: true,
+      },
+    });
+
+    if (!booking) {
+      throw new Error("Booking not found");
+    }
+
+    if (booking.status !== "PENDING") {
+      throw new Error("Only pending bookings can be confirmed");
+    }
+
+    // ❌ Business logic shouldn't be here
+    await sendEmailToAttendees(booking.attendees);
+
+    return prisma.booking.update({
+      where: { id: bookingId },
+      data: { status: "CONFIRMED" },
+    });
+  }
+}
+```
+
+### Summary
+
+- Method names should be concise: `findById` not `findBookingById`
+- Use `include`/`with` keywords when fetching relations: `findByIdIncludeHosts`
+- Keep methods generic and reusable: `findByUserIdIncludeAttendees` not `findBookingsForReporting`
+- No business logic in repositories - that belongs in Services
+
 ## When using Day.js
 
 ```typescript

apps/api/package.json

@@ -13,5 +13,8 @@
     "connect": "^3.7.0",
     "http": "^0.0.1-security",
     "http-proxy-middleware": "^2.0.6"
+  },
+  "devDependencies": {
+    "@calcom/eslint-config": "workspace:*"
   }
 }

apps/api/v1/eslint.config.mjs

@@ -0,0 +1,3 @@
+import { nextJsConfig } from "@calcom/eslint-config/next-js";
+
+export default nextJsConfig;

apps/api/v1/lib/helpers/checkIsInMaintenanceMode.ts

@@ -1,23 +0,0 @@
-import { get } from "@vercel/edge-config";
-import type { NextMiddleware } from "next-api-middleware";
-
-const safeGet = async <T = unknown>(key: string): Promise<T | undefined> => {
-  try {
-    return get<T>(key);
-  } catch (error) {
-    // Don't crash if EDGE_CONFIG env var is missing
-  }
-};
-
-export const config = { matcher: "/:path*" };
-
-export const checkIsInMaintenanceMode: NextMiddleware = async (req, res, next) => {
-  const isInMaintenanceMode = await safeGet<boolean>("isInMaintenanceMode");
-  if (isInMaintenanceMode) {
-    return res
-      .status(503)
-      .json({ message: "API is currently under maintenance. Please try again at a later time." });
-  }
-
-  await next();
-};

apps/api/v1/lib/helpers/rateLimitApiKey.test.ts

@@ -4,7 +4,7 @@ import type { NextApiResponse, NextApiRequest } from "next";
 import { createMocks } from "node-mocks-http";
 import { describe, it, expect, vi } from "vitest";
 
-import { handleAutoLock } from "@calcom/lib/autoLock";
+import { handleAutoLock } from "@calcom/features/ee/api-keys/lib/autoLock";
 import { checkRateLimitAndThrowError } from "@calcom/lib/checkRateLimitAndThrowError";
 import { HttpError } from "@calcom/lib/http-error";
 
@@ -19,7 +19,7 @@ vi.mock("@calcom/lib/checkRateLimitAndThrowError", () => ({
   checkRateLimitAndThrowError: vi.fn(),
 }));
 
-vi.mock("@calcom/lib/autoLock", () => ({
+vi.mock("@calcom/features/ee/api-keys/lib/autoLock", () => ({
   handleAutoLock: vi.fn(),
 }));
 

apps/api/v1/lib/helpers/rateLimitApiKey.ts

@@ -1,6 +1,6 @@
 import type { NextMiddleware } from "next-api-middleware";
 
-import { handleAutoLock } from "@calcom/lib/autoLock";
+import { handleAutoLock } from "@calcom/features/ee/api-keys/lib/autoLock";
 import { checkRateLimitAndThrowError } from "@calcom/lib/checkRateLimitAndThrowError";
 import { HttpError } from "@calcom/lib/http-error";
 

apps/api/v1/lib/helpers/verifyApiKey.test.ts

@@ -1,19 +1,42 @@
-import prismock from "../../../../../tests/libs/__mocks__/prisma";
-
+/**
+ * Unit Tests for verifyApiKey middleware
+ *
+ * These tests verify the middleware logic without touching the database.
+ * All dependencies (repositories, utilities) are mocked.
+ */
 import type { Request, Response } from "express";
 import type { NextApiRequest, NextApiResponse } from "next";
 import { createMocks } from "node-mocks-http";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 import type { ILicenseKeyService } from "@calcom/ee/common/server/LicenseKeyService";
-import LicenseKeyService from "@calcom/ee/common/server/LicenseKeyService";
-import { hashAPIKey } from "@calcom/features/ee/api-keys/lib/apiKeys";
+import LicenseKeyService, { LicenseKeySingleton } from "@calcom/ee/common/server/LicenseKeyService";
+import { PrismaApiKeyRepository } from "@calcom/lib/server/repository/PrismaApiKeyRepository";
 import type { IDeploymentRepository } from "@calcom/lib/server/repository/deployment.interface";
-import prisma from "@calcom/prisma";
-import { MembershipRole, UserPermissionRole } from "@calcom/prisma/enums";
+import { ApiKeyService } from "@calcom/lib/server/service/ApiKeyService";
+import { UserPermissionRole } from "@calcom/prisma/enums";
 
+import { isAdminGuard } from "../utils/isAdmin";
+import { isLockedOrBlocked } from "../utils/isLockedOrBlocked";
+import { ScopeOfAdmin } from "../utils/scopeOfAdmin";
 import { verifyApiKey } from "./verifyApiKey";
 
+vi.mock("@calcom/lib/server/service/ApiKeyService", () => ({
+  ApiKeyService: vi.fn(),
+}));
+
+vi.mock("@calcom/lib/server/repository/PrismaApiKeyRepository", () => ({
+  PrismaApiKeyRepository: vi.fn(),
+}));
+
+vi.mock("../utils/isAdmin", () => ({
+  isAdminGuard: vi.fn(),
+}));
+
+vi.mock("../utils/isLockedOrBlocked", () => ({
+  isLockedOrBlocked: vi.fn(),
+}));
+
 vi.mock("@calcom/lib/crypto", () => ({
   symmetricDecrypt: vi.fn().mockReturnValue("mocked-decrypted-value"),
   symmetricEncrypt: vi.fn().mockReturnValue("mocked-encrypted-value"),
@@ -32,17 +55,29 @@ afterEach(() => {
 });
 
 const mockDeploymentRepository: IDeploymentRepository = {
-  getLicenseKeyWithId: vi.fn().mockResolvedValue("mockLicenseKey"), // Mocked return value
+  getLicenseKeyWithId: vi.fn().mockResolvedValue("mockLicenseKey"),
   getSignatureToken: vi.fn().mockResolvedValue("mockSignatureToken"),
 };
 
-describe("Verify API key", () => {
+describe("Verify API key - Unit Tests", () => {
   let service: ILicenseKeyService;
+  let mockApiKeyService: ApiKeyService;
 
   beforeEach(async () => {
     service = await LicenseKeyService.create(mockDeploymentRepository);
-
     vi.spyOn(service, "checkLicense");
+
+    vi.spyOn(LicenseKeySingleton, "getInstance").mockResolvedValue(service as LicenseKeyService);
+
+    mockApiKeyService = {
+      verifyKeyByHashedKey: vi.fn(),
+    } as unknown as ApiKeyService;
+
+    vi.mocked(ApiKeyService).mockImplementation(() => mockApiKeyService);
+    vi.mocked(PrismaApiKeyRepository).mockImplementation(() => ({} as unknown as PrismaApiKeyRepository));
+
+    vi.mocked(isAdminGuard).mockReset();
+    vi.mocked(isLockedOrBlocked).mockReset();
   });
 
   it("should throw an error if the api key is not valid", async () => {
@@ -98,22 +133,25 @@ describe("Verify API key", () => {
       query: {
         apiKey: "cal_test_key",
       },
-      prisma,
     });
-    const hashedKey = hashAPIKey("test_key");
-    await prismock.apiKey.create({
-      data: {
-        hashedKey,
-        user: {
-          create: {
-            email: "admin@example.com",
-            role: UserPermissionRole.ADMIN,
-            locked: false,
-          },
-        },
+
+    vi.mocked(mockApiKeyService.verifyKeyByHashedKey).mockResolvedValue({
+      valid: true,
+      userId: 1,
+      user: {
+        role: UserPermissionRole.ADMIN,
+        locked: false,
+        email: "admin@example.com",
       },
     });
 
+    vi.mocked(isAdminGuard).mockResolvedValue({
+      isAdmin: true,
+      scope: ScopeOfAdmin.SystemWide,
+    });
+
+    vi.mocked(isLockedOrBlocked).mockResolvedValue(false);
+
     const middleware = {
       fn: verifyApiKey,
     };
@@ -139,40 +177,25 @@ describe("Verify API key", () => {
       query: {
         apiKey: "cal_test_key",
       },
-      prisma,
     });
-    const hashedKey = hashAPIKey("test_key");
-    await prismock.apiKey.create({
-      data: {
-        hashedKey,
-        user: {
-          create: {
-            email: "org-admin@acme.com",
-            role: UserPermissionRole.USER,
-            locked: false,
-            teams: {
-              create: {
-                accepted: true,
-                role: MembershipRole.OWNER,
-                team: {
-                  create: {
-                    name: "ACME",
-                    isOrganization: true,
-                    organizationSettings: {
-                      create: {
-                        isAdminAPIEnabled: true,
-                        orgAutoAcceptEmail: "acme.com",
-                      },
-                    },
-                  },
-                },
-              },
-            },
-          },
-        },
+
+    vi.mocked(mockApiKeyService.verifyKeyByHashedKey).mockResolvedValue({
+      valid: true,
+      userId: 2,
+      user: {
+        role: UserPermissionRole.USER,
+        locked: false,
+        email: "org-admin@acme.com",
       },
     });
 
+    vi.mocked(isAdminGuard).mockResolvedValue({
+      isAdmin: true,
+      scope: ScopeOfAdmin.OrgOwnerOrAdmin,
+    });
+
+    vi.mocked(isLockedOrBlocked).mockResolvedValue(false);
+
     const middleware = {
       fn: verifyApiKey,
     };
@@ -198,22 +221,25 @@ describe("Verify API key", () => {
       query: {
         apiKey: "cal_test_key",
       },
-      prisma,
     });
-    const hashedKey = hashAPIKey("test_key");
-    await prismock.apiKey.create({
-      data: {
-        hashedKey,
-        user: {
-          create: {
-            email: "locked@example.com",
-            role: UserPermissionRole.USER,
-            locked: true,
-          },
-        },
+
+    vi.mocked(mockApiKeyService.verifyKeyByHashedKey).mockResolvedValue({
+      valid: true,
+      userId: 3,
+      user: {
+        role: UserPermissionRole.USER,
+        locked: true,
+        email: "locked@example.com",
       },
     });
 
+    vi.mocked(isAdminGuard).mockResolvedValue({
+      isAdmin: false,
+      scope: ScopeOfAdmin.SystemWide,
+    });
+
+    vi.mocked(isLockedOrBlocked).mockResolvedValue(true);
+
     const middleware = {
       fn: verifyApiKey,
     };

apps/api/v1/lib/helpers/verifyApiKey.ts

@@ -3,21 +3,15 @@ import type { NextMiddleware } from "next-api-middleware";
 import { LicenseKeySingleton } from "@calcom/ee/common/server/LicenseKeyService";
 import { hashAPIKey } from "@calcom/features/ee/api-keys/lib/apiKeys";
 import { IS_PRODUCTION } from "@calcom/lib/constants";
+import { PrismaApiKeyRepository } from "@calcom/lib/server/repository/PrismaApiKeyRepository";
 import { DeploymentRepository } from "@calcom/lib/server/repository/deployment";
-import prisma from "@calcom/prisma";
+import { ApiKeyService } from "@calcom/lib/server/service/ApiKeyService";
+import { prisma } from "@calcom/prisma";
 
 import { isAdminGuard } from "../utils/isAdmin";
 import { isLockedOrBlocked } from "../utils/isLockedOrBlocked";
 import { ScopeOfAdmin } from "../utils/scopeOfAdmin";
 
-// Used to check if the apiKey is not expired, could be extracted if reused. but not for now.
-export const dateNotInPast = function (date: Date) {
-  const now = new Date();
-  if (now.setHours(0, 0, 0, 0) > date.setHours(0, 0, 0, 0)) {
-    return true;
-  }
-};
-
 // This verifies the apiKey and sets the user if it is valid.
 export const verifyApiKey: NextMiddleware = async (req, res, next) => {
   const deploymentRepo = new DeploymentRepository(prisma);
@@ -32,24 +26,19 @@ export const verifyApiKey: NextMiddleware = async (req, res, next) => {
 
   const strippedApiKey = `${req.query.apiKey}`.replace(process.env.API_KEY_PREFIX || "cal_", "");
   const hashedKey = hashAPIKey(strippedApiKey);
-  const apiKey = await prisma.apiKey.findUnique({
-    where: { hashedKey },
-    include: {
-      user: {
-        select: { role: true, locked: true, email: true },
-      },
-    },
-  });
-  if (!apiKey) return res.status(401).json({ error: "Your API key is not valid." });
-  if (apiKey.expiresAt && dateNotInPast(apiKey.expiresAt)) {
-    return res.status(401).json({ error: "This API key is expired." });
+
+  // Use service layer for API key verification
+  const apiKeyRepo = new PrismaApiKeyRepository(prisma);
+  const apiKeyService = new ApiKeyService({ apiKeyRepo });
+  const result = await apiKeyService.verifyKeyByHashedKey(hashedKey);
+
+  if (!result.valid) {
+    return res.status(401).json({ error: result.error });
   }
-  if (!apiKey.userId || !apiKey.user)
-    return res.status(404).json({ error: "No user found for this API key." });
 
   // save the user id in the request for later use
-  req.userId = apiKey.userId;
-  req.user = apiKey.user;
+  req.userId = result.userId!;
+  req.user = result.user!;
 
   const { isAdmin, scope } = await isAdminGuard(req);
   const userIsLockedOrBlocked = await isLockedOrBlocked(req);

apps/api/v1/lib/helpers/withMiddleware.ts

@@ -3,7 +3,6 @@ import { label } from "next-api-middleware";
 import { addRequestId } from "./addRequestid";
 import { captureErrors } from "./captureErrors";
 import { captureUserId } from "./captureUserId";
-import { checkIsInMaintenanceMode } from "./checkIsInMaintenanceMode";
 import { extendRequest } from "./extendRequest";
 import {
   HTTP_DELETE,
@@ -26,7 +25,6 @@ const middleware = {
   HTTP_POST,
   HTTP_DELETE,
   addRequestId,
-  checkIsInMaintenanceMode,
   verifyApiKey,
   rateLimitApiKey,
   extendRequest,
@@ -38,16 +36,14 @@ const middleware = {
 
 type Middleware = keyof typeof middleware;
 
-const middlewareOrder = [
-  // The order here, determines the order of execution
-  "checkIsInMaintenanceMode",
+const middlewareOrder: Middleware[] = [
   "extendRequest",
   "captureErrors",
   "verifyApiKey",
   "rateLimitApiKey",
   "addRequestId",
   "captureUserId",
-] as Middleware[]; // <-- Provide a list of middleware to call automatically
+];
 
 const withMiddleware = label(middleware, middlewareOrder);
 

apps/api/v1/lib/selects/event-type.ts

@@ -57,7 +57,7 @@ export const eventTypeSelect = {
     },
   },
   owner: {
-    select: { username: true, id: true },
+    select: { username: true, id: true, timeZone: true },
   },
   children: {
     select: {

apps/api/v1/lib/utils/isAdmin.ts

@@ -16,13 +16,15 @@ export const isAdminGuard = async (req: NextApiRequest) => {
     where: {
       userId: userId,
       accepted: true,
+      role: {
+        in: [MembershipRole.OWNER, MembershipRole.ADMIN],
+      },
       team: {
         isOrganization: true,
         organizationSettings: {
           isAdminAPIEnabled: true,
         },
       },
-      OR: [{ role: MembershipRole.OWNER }, { role: MembershipRole.ADMIN }],
     },
     select: {
       team: {

apps/api/v1/lib/utils/isLockedOrBlocked.ts

@@ -1,9 +1,17 @@
 import type { NextApiRequest } from "next";
 
+import { sentrySpan } from "@calcom/features/watchlist/lib/telemetry";
 import { checkIfEmailIsBlockedInWatchlistController } from "@calcom/features/watchlist/operations/check-if-email-in-watchlist.controller";
 
 export async function isLockedOrBlocked(req: NextApiRequest) {
   const user = req.user;
   if (!user?.email) return false;
-  return user.locked || (await checkIfEmailIsBlockedInWatchlistController(user.email));
+  return (
+    user.locked ||
+    (await checkIfEmailIsBlockedInWatchlistController({
+      email: user.email,
+      organizationId: null,
+      span: sentrySpan,
+    }))
+  );
 }

apps/api/v1/lib/utils/retrieveScopedAccessibleUsers.ts

@@ -27,7 +27,7 @@ const getAllAdminMemberships = async (userId: number) => {
     where: {
       userId: userId,
       accepted: true,
-      OR: [{ role: MembershipRole.OWNER }, { role: MembershipRole.ADMIN }],
+      role: { in: [MembershipRole.OWNER, MembershipRole.ADMIN] },
     },
     select: {
       team: {
@@ -56,16 +56,19 @@ export const getAccessibleUsers = async ({
   memberUserIds,
   adminUserId,
 }: AccessibleUsersType): Promise<number[]> => {
+  const orConditions = [];
+  if (memberUserIds.length > 0) {
+    orConditions.push({ userId: { in: memberUserIds } });
+  }
+  orConditions.push({ userId: adminUserId, role: { in: [MembershipRole.OWNER, MembershipRole.ADMIN] } });
+
   const memberships = await prisma.membership.findMany({
     where: {
       team: {
         isOrganization: true,
       },
       accepted: true,
-      OR: [
-        { userId: { in: memberUserIds } },
-        { userId: adminUserId, role: { in: [MembershipRole.OWNER, MembershipRole.ADMIN] } },
-      ],
+      OR: orConditions,
     },
     select: {
       userId: true,

apps/api/v1/lib/validations/booking.ts

@@ -113,6 +113,12 @@ export const schemaBookingReadPublic = Booking.extend({
     )
     .optional(),
   responses: z.record(z.any()).nullable(),
+  // Override metadata to handle reassignment objects from Round Robin/Managed Events
+  // Safe to use z.any() here because:
+  // 1. API v1 POST only accepts z.record(z.string()) for metadata (user input restricted)
+  // 2. API v1 PATCH does not accept metadata changes at all
+  // 3. Complex metadata (objects) are only set by trusted internal features
+  metadata: z.record(z.any()).nullable(),
 }).pick({
   id: true,
   userId: true,

apps/api/v1/lib/validations/user.ts

@@ -1,7 +1,7 @@
 import { z } from "zod";
 
+import { checkUsername } from "@calcom/features/profile/lib/checkUsername";
 import { emailSchema } from "@calcom/lib/emailSchema";
-import { checkUsername } from "@calcom/lib/server/checkUsername";
 import { iso8601 } from "@calcom/prisma/zod-utils";
 import { UserSchema } from "@calcom/prisma/zod/modelSchema/UserSchema";
 

apps/api/v1/middleware.ts

@@ -0,0 +1,19 @@
+import type { NextRequest } from "next/server";
+import { NextResponse } from "next/server";
+
+export function middleware(_request: NextRequest) {
+  // Matcher guarantees the last segment is one of the blocked segments, so we can
+  // immediately return a 403 without further path checks.
+  return NextResponse.json({ message: "Forbidden" }, { status: 403 });
+}
+
+export const config = {
+  // The blocked segment is always the last part of the path, so we only need this matcher.
+  matcher: [
+    "/:path*/_get",
+    "/:path*/_post",
+    "/:path*/_patch",
+    "/:path*/_delete",
+    "/:path*/_auth-middleware",
+  ],
+};

apps/api/v1/package.json

@@ -10,7 +10,7 @@
     "build": "next build",
     "clean": "rm -rf .turbo && rm -rf node_modules && rm -rf .next",
     "dev": "PORT=3003 next dev",
-    "lint": "eslint . --ignore-path .gitignore",
+    "lint": "eslint .",
     "lint:fix": "eslint . --ext .ts,.js,.tsx,.jsx --fix",
     "start": "PORT=3003 next start",
     "docker-start-api": "PORT=80 next start",
@@ -18,23 +18,24 @@
     "type-check:ci": "tsc-absolute --pretty --noEmit"
   },
   "devDependencies": {
-    "@calcom/tsconfig": "*",
-    "@calcom/types": "*",
+    "@calcom/eslint-config": "workspace:*",
+    "@calcom/tsconfig": "workspace:*",
+    "@calcom/types": "workspace:*",
     "node-mocks-http": "^1.11.0"
   },
   "dependencies": {
-    "@calcom/app-store": "*",
-    "@calcom/dayjs": "*",
-    "@calcom/emails": "*",
-    "@calcom/features": "*",
-    "@calcom/lib": "*",
-    "@calcom/prisma": "*",
-    "@calcom/trpc": "*",
+    "@calcom/app-store": "workspace:*",
+    "@calcom/dayjs": "workspace:*",
+    "@calcom/emails": "workspace:*",
+    "@calcom/features": "workspace:*",
+    "@calcom/lib": "workspace:*",
+    "@calcom/prisma": "workspace:*",
+    "@calcom/trpc": "workspace:*",
     "@prisma/nextjs-monorepo-workaround-plugin": "^6.16.1",
     "@sentry/nextjs": "^9.15.0",
     "bcryptjs": "^2.4.3",
     "memory-cache": "^0.2.0",
-    "next": "^15.4.5",
+    "next": "15.4.10",
     "next-api-middleware": "^1.0.1",
     "next-axiom": "^0.17.0",
     "next-swagger-doc": "^0.3.6",

apps/api/v1/pages/api/availability/_get.ts

@@ -1,7 +1,7 @@
 import type { NextApiRequest } from "next";
 import { z } from "zod";
 
-import { getUserAvailabilityService } from "@calcom/lib/di/containers/GetUserAvailability";
+import { getUserAvailabilityService } from "@calcom/features/di/containers/GetUserAvailability";
 import { HttpError } from "@calcom/lib/http-error";
 import { defaultResponder } from "@calcom/lib/server/defaultResponder";
 import prisma from "@calcom/prisma";

apps/api/v1/pages/api/booking-references/[id]/_auth-middleware.ts

@@ -12,7 +12,7 @@ async function authMiddleware(req: NextApiRequest) {
   if (isSystemWideAdmin) return;
   // Find all references where the user has bookings
   const bookingReference = await prisma.bookingReference.findFirst({
-    where: { id, booking: { userId } },
+    where: { id, booking: { userId }, deleted: null },
   });
   if (!bookingReference) throw new HttpError({ statusCode: 403, message: "Forbidden" });
 }

apps/api/v1/pages/api/booking-references/[id]/_delete.ts

@@ -37,7 +37,7 @@ import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransform
 export async function deleteHandler(req: NextApiRequest) {
   const { query } = req;
   const { id } = schemaQueryIdParseInt.parse(query);
-  await prisma.bookingReference.delete({ where: { id } });
+  await prisma.bookingReference.update({ where: { id }, data: { deleted: true } });
   return { message: `BookingReference with id: ${id} deleted` };
 }
 

apps/api/v1/pages/api/booking-references/[id]/_get.ts

@@ -38,7 +38,7 @@ import { schemaQueryIdParseInt } from "~/lib/validations/shared/queryIdTransform
 export async function getHandler(req: NextApiRequest) {
   const { query } = req;
   const { id } = schemaQueryIdParseInt.parse(query);
-  const booking_reference = await prisma.bookingReference.findUniqueOrThrow({ where: { id } });
+  const booking_reference = await prisma.bookingReference.findUniqueOrThrow({ where: { id, deleted: null } });
   return { booking_reference: schemaBookingReferenceReadPublic.parse(booking_reference) };
 }
 

apps/api/v1/pages/api/booking-references/_get.ts

@@ -29,13 +29,13 @@ import { schemaBookingReferenceReadPublic } from "~/lib/validations/booking-refe
  *       404:
  *         description: No booking references were found
  */
-async function getHandler(req: NextApiRequest) {
+export async function handler(req: NextApiRequest) {
   const { userId, isSystemWideAdmin } = req;
   const args: Prisma.BookingReferenceFindManyArgs = isSystemWideAdmin
-    ? {}
-    : { where: { booking: { userId } } };
+    ? { where: { deleted: null } }
+    : { where: { booking: { userId }, deleted: null } };
   const data = await prisma.bookingReference.findMany(args);
   return { booking_references: data.map((br) => schemaBookingReferenceReadPublic.parse(br)) };
 }
 
-export default defaultResponder(getHandler);
+export default defaultResponder(handler);