cc: gate on DB readiness + real healthchecks (start.sh has no set -e and wait-for-it passes mid-initdb)

- database: pg_isready healthcheck; calcom depends_on service_healthy - calcom: healthcheck probes /auth/login with redirects (upstream wget --spider / fails on 307)
cc: fix DB wiring — base compose hardcodes unicorn_user/magical_password and builds DATABASE_URL from raw creds (Prisma URL-parse crash with base64 pw)
2026-09-28 08:16:12 -07:00 · 2026-09-28 06:44:44 -07:00 · 2026-09-28 00:23:53 -07:00 · 2026-09-27 23:36:33 -07:00
4457 changed files with 412954 additions and 40664 deletions
@@ -1,6 +1,6 @@
 {
  "$schema": "https://unpkg.com/@changesets/config@2.3.0/schema.json",
-  "changelog": ["@changesets/changelog-github", { "repo": "calcom/cal.diy" }],
+  "changelog": ["@changesets/changelog-github", { "repo": "calcom/cal.com" }],
  "commit": false,
  "fixed": [],
  "linked": [],
@@ -24,8 +24,8 @@
 # ⚠️ ⚠️ ⚠️ THESE WILL BE MIGRATED TO THE DATABASE TO PREVENT AWS's 4KB ENV QUOTA ⚠️ ⚠️ ⚠️

 #   - BASECAMP
-# Used to enable Basecamp integration with Cal.diy
-# @see https://github.com/calcom/cal.diy#obtaining-basecamp-client-id-and-secret
+# Used to enable Basecamp integration with Cal.com
+# @see https://github.com/calcom/cal.com#obtaining-basecamp-client-id-and-secret
 BASECAMP3_CLIENT_ID=
 BASECAMP3_CLIENT_SECRET=
 BASECAMP3_USER_AGENT=
@@ -34,7 +34,7 @@ BASECAMP3_USER_AGENT=
 # Enables Cal Video. to get your key
 # 1. Visit our [Daily.co Partnership Form](https://go.cal.com/daily) and enter your information
 # 2. From within your dashboard, go to the [developers](https://dashboard.daily.co/developers) tab.
-# @see https://github.com/calcom/cal.diy#obtaining-daily-api-credentials
+# @see https://github.com/calcom/cal.com#obtaining-daily-api-credentials

 DAILY_API_KEY=
 DAILY_SCALE_PLAN=''
@@ -43,7 +43,7 @@ DAILY_MEETING_ENDED_WEBHOOK_SECRET=''

 #   - GOOGLE CALENDAR/MEET/LOGIN
 # Needed to enable Google Calendar integration and Login with Google
-# @see https://github.com/calcom/cal.diy#obtaining-the-google-api-credentials
+# @see https://github.com/calcom/cal.com#obtaining-the-google-api-credentials
 GOOGLE_API_CREDENTIALS=

 # To enable Login with Google you need to:
@@ -55,18 +55,18 @@ GOOGLE_LOGIN_ENABLED=false

 #   - HUBSPOT
 # Used for the HubSpot integration
-# @see https://github.com/calcom/cal.diy/#obtaining-hubspot-client-id-and-secret
+# @see https://github.com/calcom/cal.com/#obtaining-hubspot-client-id-and-secret
 HUBSPOT_CLIENT_ID=""
 HUBSPOT_CLIENT_SECRET=""

 #   - OFFICE 365
 # Used for the Office 365 / Outlook.com Calendar / MS Teams integration
-# @see https://github.com/calcom/cal.diy/#Obtaining-Microsoft-Graph-Client-ID-and-Secret
+# @see https://github.com/calcom/cal.com/#Obtaining-Microsoft-Graph-Client-ID-and-Secret
 MS_GRAPH_CLIENT_ID=
 MS_GRAPH_CLIENT_SECRET=

 #   - SLACK
-# @see https://github.com/calcom/cal.diy/#obtaining-slack-client-id-and-secret-and-signing-secret
+# @see https://github.com/calcom/cal.com/#obtaining-slack-client-id-and-secret-and-signing-secret
 SLACK_SIGNING_SECRET=
 SLACK_CLIENT_ID=
 SLACK_CLIENT_SECRET=
@@ -87,7 +87,7 @@ TANDEM_BASE_URL="https://tandem.chat"

 #   - ZOOM
 # Used for the Zoom integration
-# @see https://github.com/calcom/cal.diy/#obtaining-zoom-client-id-and-secret
+# @see https://github.com/calcom/cal.com/#obtaining-zoom-client-id-and-secret
 ZOOM_CLIENT_ID=
 ZOOM_CLIENT_SECRET=

@@ -98,7 +98,7 @@ GIPHY_API_KEY=

 #   - VITAL
 # Used for the vital integration
-# @see https://github.com/calcom/cal.diy/#obtaining-vital-api-keys
+# @see https://github.com/calcom/cal.com/#obtaining-vital-api-keys
 VITAL_API_KEY=
 VITAL_WEBHOOK_SECRET=
 # "sandbox" | "prod" | "production" | "development"
@@ -108,7 +108,7 @@ VITAL_REGION="us"

 #   - ZAPIER
 # Used for the Zapier integration
-# @see https://github.com/calcom/cal.diy/blob/main/packages/app-store/zapier/README.md
+# @see https://github.com/calcom/cal.com/blob/main/packages/app-store/zapier/README.md
 ZAPIER_INVITE_LINK=""

 #   - LARK
@@ -1,16 +1,29 @@
 # ********** INDEX **********
 #
-# - LICENSE
+# - LICENSE (DEPRECATED)
 # - DATABASE
 # - SHARED
 #   - NEXTAUTH
 # - E-MAIL SETTINGS
 # - ORGANIZATIONS

-# - LICENSE ************************************************************************************
-# This project is licensed under the MIT License.
-# @see https://github.com/calcom/cal.diy/blob/main/LICENSE
-# Cal.diy is fully open source — no license key is required.
+# - LICENSE (DEPRECATED) ************************************************************************************
+# https://github.com/calcom/cal.com/blob/main/LICENSE
+#
+# Summary of terms:
+# - The codebase has to stay open source, whether it was modified or not
+# - You can not repackage or sell the codebase
+# - Acquire a commercial license to remove these terms by visiting: cal.com/sales
+#
+
+# To enable enterprise-only features please add your environment variable to the .env file then make your way to /auth/setup to select your license and follow instructions.
+
+CALCOM_LICENSE_KEY=
+# Signature token for the Cal.com License API (used for self-hosted integrations)
+# We will give you a token when we provide you with a license key this ensure you and only you can communicate with the Cal.com License API for your license key
+CAL_SIGNATURE_TOKEN=
+# The route to the Cal.com License API
+CALCOM_PRIVATE_API_ROUTE="https://goblin.cal.com"
 # ***********************************************************************************************************

 # - DATABASE ************************************************************************************************
@@ -31,13 +44,15 @@ NEXT_PUBLIC_WEBSITE_URL='http://localhost:3000'
 NEXT_PUBLIC_EMBED_LIB_URL='http://localhost:3000/embed/embed.js'

 # To enable SAML login, set both these variables
-# @see https://github.com/calcom/cal.diy/tree/main/packages/features/ee#setting-up-saml-login
+# @see https://github.com/calcom/cal.com/tree/main/packages/features/ee#setting-up-saml-login
 # SAML_DATABASE_URL="postgresql://postgres:@localhost:5450/cal-saml"
 SAML_DATABASE_URL=
 # SAML_ADMINS='pro@example.com'
 SAML_ADMINS=
 # NEXT_PUBLIC_HOSTED_CAL_FEATURES=1
 NEXT_PUBLIC_HOSTED_CAL_FEATURES=
+# For additional security set to a random secret and use that value as the client_secret during the OAuth 2.0 flow.
+SAML_CLIENT_SECRET_VERIFIER=

 # If you use Heroku to deploy Postgres (or use self-signed certs for Postgres) then uncomment the follow line.
 # @see https://devcenter.heroku.com/articles/connecting-heroku-postgres#connecting-in-node-js
@@ -45,7 +60,7 @@ NEXT_PUBLIC_HOSTED_CAL_FEATURES=
 PGSSLMODE=

 # Define which hostnames are expected for the app to work on
-ALLOWED_HOSTNAMES='"cal.local:3000","localhost:3000"'
+ALLOWED_HOSTNAMES='"cal.com","cal.dev","cal-staging.com","cal.community","cal.local:3000","localhost:3000"'
 #  Reserved orgs subdomains for our own usage
 RESERVED_SUBDOMAINS='"app","auth","docs","design","console","go","status","api","saml","www","matrix","developer","cal","my","team","support","security","blog","learn","admin"'

@@ -94,15 +109,6 @@ NEXT_PUBLIC_POSTHOG_HOST=
 # Dub Config
 DUB_API_KEY=
 NEXT_PUBLIC_DUB_PROGRAM_ID=
-# Optional: Domain for SMS workflow shortened links
-DUB_SMS_DOMAIN=
-# Optional: Folder ID to organize SMS workflow shortened links in Dub
-DUB_SMS_FOLDER_ID=
-
-# Sink URL Shortener Config
-SINK_API_URL=
-# API key for Sink authentication
-SINK_API_KEY=

 # Zendesk Config
 NEXT_PUBLIC_ZENDESK_KEY=
@@ -114,10 +120,6 @@ NEXT_PUBLIC_HELPSCOUT_KEY=
 NEXT_PUBLIC_FRESHCHAT_TOKEN=
 NEXT_PUBLIC_FRESHCHAT_HOST=

-# Microsoft OAuth credentials
-OUTLOOK_LOGIN_ENABLED=false
-
-
 # For holiday feature:
 # Step-by-step: Get a Google Calendar API Key
 # 1. Go to Google Cloud Console: https://console.cloud.google.com/
@@ -125,6 +127,7 @@ OUTLOOK_LOGIN_ENABLED=false
 # 3. Enable Google Calendar API (APIs & Services → Library , Search for Google Calendar API)
 # 4. Create the API Key (APIs & Services → Credentials)
 GOOGLE_CALENDAR_API_KEY=
+
 # Google OAuth credentials
 # To enable Login with Google you need to:
 # 1. Set `GOOGLE_API_CREDENTIALS` below
@@ -135,7 +138,7 @@ GOOGLE_LOGIN_ENABLED=false

 #   - GOOGLE CALENDAR/MEET/LOGIN
 # Needed to enable Google Calendar integration and Login with Google
-# @see https://github.com/calcom/cal.diy#obtaining-the-google-api-credentials
+# @see https://github.com/calcom/cal.com#obtaining-the-google-api-credentials
 GOOGLE_API_CREDENTIALS=
 # Token to verify incoming webhooks from Google Calendar
 GOOGLE_WEBHOOK_TOKEN=
@@ -181,6 +184,17 @@ FORMBRICKS_FEEDBACK_SURVEY_ID=
 AVATARAPI_USERNAME=
 AVATARAPI_PASSWORD=

+# Twilio
+# Used to send SMS reminders in workflows
+TWILIO_SID=
+TWILIO_TOKEN=
+TWILIO_MESSAGING_SID=
+TWILIO_PHONE_NUMBER=
+TWILIO_WHATSAPP_PHONE_NUMBER=
+TWILIO_WHATSAPP_REMINDER_CONTENT_SID=
+TWILIO_WHATSAPP_CANCELLED_CONTENT_SID=
+TWILIO_WHATSAPP_RESCHEDULED_CONTENT_SID=
+TWILIO_WHATSAPP_COMPLETED_CONTENT_SID=
 # For NEXT_PUBLIC_SENDER_ID only letters, numbers and spaces are allowed (max. 11 characters)
 NEXT_PUBLIC_SENDER_ID=
 TWILIO_VERIFY_SID=
@@ -220,7 +234,7 @@ API_KEY_PREFIX=cal_
 # allow access to the nodemailer transports from the .env file. E-mail templates are accessible within lib/emails/
 # Configures the global From: header whilst sending emails.
 EMAIL_FROM='notifications@yourselfhostedcal.com'
-EMAIL_FROM_NAME='Cal.diy'
+EMAIL_FROM_NAME='Cal.com'

 # Configure SMTP settings (@see https://nodemailer.com/smtp/).
 # Configuration to receive emails locally (mailhog)
@@ -264,6 +278,9 @@ CLOUDFLARE_TURNSTILE_SECRET=
 # 0 = false, 1=true
 NEXT_PUBLIC_VERCEL_USE_BOTID_IN_BOOKER=

+# Set the following value to true if you wish to enable Team Impersonation
+NEXT_PUBLIC_TEAM_IMPERSONATION=false
+
 # Close.com internal CRM
 CLOSECOM_CLIENT_ID=
 CLOSECOM_CLIENT_SECRET=
@@ -272,8 +289,8 @@ CLOSECOM_CLIENT_SECRET=
 SENDGRID_SYNC_API_KEY=

 # Change your Brand
-NEXT_PUBLIC_APP_NAME="Cal.diy"
-NEXT_PUBLIC_SUPPORT_MAIL_ADDRESS="help@cal.diy"
+NEXT_PUBLIC_APP_NAME="Cal.com"
+NEXT_PUBLIC_SUPPORT_MAIL_ADDRESS="help@cal.com"
 NEXT_PUBLIC_COMPANY_NAME="Cal.com, Inc."
 # Set this to true in to disable new signups
 # NEXT_PUBLIC_DISABLE_SIGNUP=true
@@ -333,7 +350,7 @@ E2E_TEST_APPLE_CALENDAR_EMAIL=""
 E2E_TEST_APPLE_CALENDAR_PASSWORD=""

 # - CALCOM QA ACCOUNT
-# Used for E2E tests on Cal.diy that require 3rd party integrations
+# Used for E2E tests on Cal.com that require 3rd party integrations
 E2E_TEST_CALCOM_QA_EMAIL="qa@example.com"
 # Replace with your own password
 E2E_TEST_CALCOM_QA_PASSWORD="password"
@@ -341,7 +358,7 @@ E2E_TEST_CALCOM_QA_GCAL_CREDENTIALS=
 E2E_TEST_CALCOM_GCAL_KEYS=

 # - APP CREDENTIAL SYNC ***********************************************************************************
-# Used for self-hosters that are implementing Cal.diy into their applications that already have certain integrations
+# Used for self-hosters that are implementing Cal.com into their applications that already have certain integrations
 # Under settings/admin/apps ensure that all app secrets are set the same as the parent application
 # You can use: `openssl rand -base64 32` to generate one
 CALCOM_CREDENTIAL_SYNC_SECRET=""
@@ -349,11 +366,24 @@ CALCOM_CREDENTIAL_SYNC_SECRET=""
 CALCOM_CREDENTIAL_SYNC_HEADER_NAME="calcom-credential-sync-secret"
 # This the endpoint from which the token is fetched
 CALCOM_CREDENTIAL_SYNC_ENDPOINT=""
-# Key should match on Cal.diy and your application
+# Key should match on Cal.com and your application
 # must be 24 bytes for AES256 encryption algorithm
 # You can use: `openssl rand -base64 24` to generate one
 CALCOM_APP_CREDENTIAL_ENCRYPTION_KEY=""

+# - OIDC E2E TEST *******************************************************************************************
+
+# Ensure this ADMIN EMAIL is present in the SAML_ADMINS list
+E2E_TEST_SAML_ADMIN_EMAIL=
+E2E_TEST_SAML_ADMIN_PASSWORD=
+
+E2E_TEST_OIDC_CLIENT_ID=
+E2E_TEST_OIDC_CLIENT_SECRET=
+E2E_TEST_OIDC_PROVIDER_DOMAIN=
+
+E2E_TEST_OIDC_USER_EMAIL=
+E2E_TEST_OIDC_USER_PASSWORD=
+
 # ***********************************************************************************************************

 # api v2
@@ -426,7 +456,7 @@ LINGO_DOT_DEV_API_KEY=
 DIRECTORY_IDS_TO_LOG=


-# Set this when Cal.diy is used to serve only one organization's booking pages
+# Set this when Cal.com is used to serve only one organization's booking pages
 # Read more about it in the README.md
 NEXT_PUBLIC_SINGLE_ORG_SLUG=

@@ -481,3 +511,10 @@ TRIGGER_DEV_PROJECT_REF=

 GOOGLE_ADS_ENABLED=1      # To enable Google Ads tracking (gclid)
 LINKEDIN_ADS_ENABLED=1    # To enable LinkedIn Ads tracking (li_fat_id)
+
+# - BACKBLAZE B2 (Compliance Documents) *************************************************************************
+# Used for storing and serving compliance documents (SOC 2, ISO 27001, pentest reports)
+B2_APPLICATION_KEY_ID=
+B2_APPLICATION_KEY=
+B2_BUCKET_ID=
+B2_BUCKET_NAME=
@@ -1 +1,47 @@
+.github/actions/**/* @calcom/Foundation
+.github/workflows/**/* @calcom/Foundation
+/**/package.json @calcom/Foundation
+/apps/api/**/* @calcom/Foundation
+/apps/web/**/layout.tsx @calcom/Consumer @calcom/Foundation
+/apps/web/lib/csp.ts @calcom/Foundation
+/apps/web/lib/buildNonce.ts @calcom/Foundation
+/apps/web/lib/daily-webhook/**/* @calcom/Foundation
+/apps/web/lib/core/**/* @calcom/Foundation
+/apps/web/lib/booking.ts @calcom/Foundation
+/apps/web/lib/handleOrgRedirect.ts @calcom/Foundation
+/apps/web/modules/shell/Shell.tsx @calcom/Foundation
+/apps/web/proxy.ts @calcom/Foundation
+/deploy/**/* @calcom/Foundation
+/packages/app-store/applecalendar/**/* @calcom/Foundation
+/packages/app-store/caldavcalendar/**/* @calcom/Foundation
+/packages/app-store/exchange2013calendar/**/* @calcom/Foundation
+/packages/app-store/exchange2016calendar/**/* @calcom/Foundation
+/packages/app-store/exchangecalendar/**/* @calcom/Foundation
+/packages/app-store/feishucalendar/**/* @calcom/Foundation
+/packages/app-store/googlecalendar/**/* @calcom/Foundation
+/packages/app-store/ics-feedcalendar/**/* @calcom/Foundation
+/packages/app-store/larkcalendar/**/* @calcom/Foundation
+/packages/app-store/office365calendar/**/* @calcom/Foundation
+/packages/app-store/zohocalendar/**/* @calcom/Foundation
+/packages/embeds/**/* @calcom/Foundation
+/packages/features/auth/lib/next-auth-options.ts @calcom/Foundation
+/packages/features/bookings/lib/**/* @calcom/Foundation
+/packages/features/availability/lib/getAggregatedAvailability/getAggregatedAvailability.ts @calcom/Foundation
+/packages/features/availability/lib/getUserAvailability.ts @calcom/Foundation
+/packages/features/bookings/lib/getLuckyUser.ts @calcom/Foundation
+/packages/features/schedules/lib/slots.ts @calcom/Foundation
+/packages/platform/atoms/**/*WebWrapper.tsx @calcom/Consumer
+/packages/platform/**/* @calcom/Consumer @calcom/Foundation
+/packages/prisma/**/* @calcom/Foundation
+/packages/trpc/server/routers/viewer/bookings/confirm.handler.ts @calcom/Foundation
+/packages/trpc/server/routers/viewer/bookings/get.handler.ts @calcom/Foundation
+/packages/trpc/server/routers/viewer/slots/**/* @calcom/Foundation
+/packages/ui/**/* @calcom/Consumer @calcom/Foundation

+# Exclude test files from requiring foundation/consumer approval
+**/*.spec.*
+**/*.e2e.*
+**/*.e2e-spec.*
+**/*.test.*
+**/*.test-suite.*
+**/*.integration-test.*
@@ -1,5 +1,5 @@
 blank_issues_enabled: false
 contact_links:
  - name: Questions
-    url: https://github.com/calcom/cal.diy/discussions
-    about: Need help self-hosting or have a general question about Cal.diy? Open a discussion
+    url: https://github.com/calcom/cal.com/discussions
+    about: Need help selfhosting or ask a general question about the project? Open a discussion
@@ -55,4 +55,4 @@ assignees: ""
 - If this issue has a `🚨 needs approval` label, don't start coding yet. Wait until a core member approves feature request by removing this label, then you can start coding.
  - For clarity: Non-core member issues automatically get the `🚨 needs approval` label.
  - Your feature ideas are invaluable to us! However, they undergo review to ensure alignment with the product's direction.
-  - Follow Best Practices lined out in our [Contributor Docs](https://github.com/calcom/cal.diy/blob/main/CONTRIBUTING.md)
+  - Follow Best Practices lined out in our [Contributor Docs](https://github.com/calcom/cal.com/blob/main/CONTRIBUTING.md)
@@ -1,10 +1,9 @@
 ## What does this PR do?

-<!-- Please include a summary of the change and which issue is fixed. Please also include relevant motivation and context. List any dependencies that are required for this change.
-
-Note: Cal.diy is a community-maintained open-source project. Contributions here do NOT flow to Cal.com's production service. -->
+<!-- Please include a summary of the change and which issue is fixed. Please also include relevant motivation and context. List any dependencies that are required for this change. -->

 - Fixes #XXXX (GitHub issue number)
+- Fixes CAL-XXXX (Linear issue number - should be visible at the bottom of the GitHub issue description)

 ## Visual Demo (For contributors especially)

@@ -23,7 +22,7 @@ A visual demonstration is strongly recommended, for both the original and new ch
 ## Mandatory Tasks (DO NOT REMOVE)

 - [ ] I have self-reviewed the code (A decent size PR without self-review might be rejected).
- [ ] I have updated the developer docs if this PR makes changes that would require a documentation change. If N/A, write N/A here and check the checkbox.
+- [ ] I have updated the developer docs in /docs if this PR makes changes that would require a [documentation change](https://cal.com/docs). If N/A, write N/A here and check the checkbox.
 - [ ] I confirm automated tests are in place that prove my fix is effective or that my feature works.

 ## How should this be tested?
@@ -39,7 +38,7 @@ A visual demonstration is strongly recommended, for both the original and new ch

 <!-- Remove bullet points below that don't apply to you -->

- I haven't read the [contributing guide](https://github.com/calcom/cal.diy/blob/main/CONTRIBUTING.md)
+- I haven't read the [contributing guide](https://github.com/calcom/cal.com/blob/main/CONTRIBUTING.md)
 - My code doesn't follow the style guidelines of this project
 - I haven't commented my code, particularly in hard-to-understand areas
 - I haven't checked if my changes generate no new warnings
@@ -18,6 +18,6 @@ runs:
      env:
        CACHE_NAME: cache-db
        PATH_KEY: ${{ inputs.path }}
-        PRISMA_HASH: ${{ hashFiles('packages/prisma/schema.prisma', 'packages/prisma/migrations/**/**.sql', 'packages/prisma/*.ts', 'scripts/seed*.ts') }}
+        PRISMA_HASH: ${{ hashFiles('packages/prisma/schema.prisma', 'packages/prisma/migrations/**/**.sql', 'packages/prisma/*.ts') }}
      run: |
        echo "key=${CACHE_NAME}-${PATH_KEY}-${PRISMA_HASH}" >> $GITHUB_OUTPUT
@@ -32,16 +32,14 @@ runs:
      shell: bash
    - name: Postgres Dump Backup
      if: steps.cache-db.outputs.cache-hit != 'true'
-      run: |
-        mkdir -p $(dirname "${{ inputs.path }}")
-        docker run --rm --network host \
-          -v ${{ github.workspace }}:${{ github.workspace }} -w ${{ github.workspace }} \
-          postgres:18 pg_dump "${{ inputs.DATABASE_URL }}" -O -f ${{ inputs.path }}
-      shell: bash
+      uses: tj-actions/pg-dump@v2.3
+      with:
+        database_url: ${{ inputs.DATABASE_URL }}
+        path: ${{ inputs.path }}
+        options: "-O"
    - name: Postgres Backup Restore
      if: steps.cache-db.outputs.cache-hit == 'true'
-      run: |
-        docker run --rm -i --network host \
-          -v ${{ github.workspace }}:${{ github.workspace }} -w ${{ github.workspace }} \
-          postgres:18 psql "${{ inputs.DATABASE_URL }}" -f ${{ inputs.path }}
-      shell: bash
+      uses: tj-actions/pg-restore@v4.5
+      with:
+        database_url: ${{ inputs.DATABASE_URL }}
+        backup_file: ${{ inputs.path }}
@@ -0,0 +1,124 @@
+name: 'Devin Session Checker'
+description: 'Check for existing Devin sessions on a PR'
+
+inputs:
+  devin-api-key:
+    description: 'Devin API key'
+    required: true
+  github-token:
+    description: 'GitHub token for API calls'
+    required: true
+  pr-number:
+    description: 'PR number to check for existing sessions'
+    required: true
+
+outputs:
+  has-existing-session:
+    description: 'Whether an existing active session was found (true/false)'
+    value: ${{ steps.check-session.outputs.has-existing-session }}
+  session-id:
+    description: 'ID of the existing session (if found)'
+    value: ${{ steps.check-session.outputs.session-id }}
+  session-url:
+    description: 'URL of the existing session (if found)'
+    value: ${{ steps.check-session.outputs.session-url }}
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Check for existing Devin session
+      id: check-session
+      uses: actions/github-script@v7
+      env:
+        DEVIN_API_KEY: ${{ inputs.devin-api-key }}
+        PR_NUMBER: ${{ inputs.pr-number }}
+      with:
+        github-token: ${{ inputs.github-token }}
+        script: |
+          const { owner, repo } = context.repo;
+          const prNumber = parseInt(process.env.PR_NUMBER, 10);
+          const SESSION_URL_REGEX = /app\.devin\.ai\/sessions\/([a-f0-9-]+)/;
+          const ACTIVE_STATUSES = ['working', 'blocked', 'resumed'];
+
+          async function checkSessionStatus(sessionId) {
+            const response = await fetch(`https://api.devin.ai/v1/sessions/${sessionId}`, {
+              headers: {
+                'Authorization': `Bearer ${process.env.DEVIN_API_KEY}`,
+                'Content-Type': 'application/json'
+              }
+            });
+
+            if (!response.ok) {
+              console.log(`Failed to fetch session ${sessionId}: ${response.status}`);
+              return null;
+            }
+
+            return await response.json();
+          }
+
+          const { data: pr } = await github.rest.pulls.get({
+            owner,
+            repo,
+            pull_number: prNumber
+          });
+
+          const prBody = pr.body || '';
+          const prSessionMatch = prBody.match(SESSION_URL_REGEX);
+
+          if (prSessionMatch) {
+            const sessionId = prSessionMatch[1];
+            console.log(`PR was created by Devin session: ${sessionId}`);
+            const session = await checkSessionStatus(sessionId);
+            if (session) {
+              console.log(`PR creator session status: ${session.status_enum}`);
+              if (ACTIVE_STATUSES.includes(session.status_enum)) {
+                core.setOutput('has-existing-session', 'true');
+                core.setOutput('session-id', sessionId);
+                core.setOutput('session-url', `https://app.devin.ai/sessions/${sessionId}`);
+                return;
+              } else {
+                console.log(`PR creator session ${sessionId} is not active, will check comments`);
+              }
+            }
+          }
+
+          const devinSessionPatterns = [
+            'Devin AI is completing this stale PR',
+            'Devin AI is addressing Cubic AI',
+            'Devin AI is resolving merge conflicts'
+          ];
+
+          const comments = await github.rest.issues.listComments({
+            owner,
+            repo,
+            issue_number: prNumber
+          });
+
+          for (const comment of comments.data.reverse()) {
+            const hasDevinSession = devinSessionPatterns.some(pattern => comment.body?.includes(pattern));
+            if (hasDevinSession) {
+              const match = comment.body?.match(SESSION_URL_REGEX);
+              if (match) {
+                const sessionId = match[1];
+                console.log(`Found existing Devin session from comment: ${sessionId}`);
+
+                  const session = await checkSessionStatus(sessionId);
+                  if (session) {
+                    if (ACTIVE_STATUSES.includes(session.status_enum)) {
+                    console.log(`Session ${sessionId} is active (status: ${session.status_enum})`);
+                    core.setOutput('has-existing-session', 'true');
+                    core.setOutput('session-id', sessionId);
+                    core.setOutput('session-url', `https://app.devin.ai/sessions/${sessionId}`);
+                    return;
+                  } else {
+                    console.log(`Session ${sessionId} is not active (status: ${session.status_enum})`);
+                  }
+                }
+              }
+            }
+          }
+
+          console.log('No existing active Devin session found');
+          core.setOutput('has-existing-session', 'false');
+          core.setOutput('session-id', '');
+          core.setOutput('session-url', '');
@@ -62,8 +62,8 @@ runs:
      with:
        images: |
          docker.io/calendso/calendso
-          docker.io/calcom/cal.diy
-          ghcr.io/calcom/cal.diy
+          docker.io/calcom/cal.com
+          ghcr.io/calcom/cal.com
        flavor: |
          latest=${{ !github.event.release.prerelease && inputs.use-as-latest == 'true' }}
          suffix=${{ inputs.platform-suffix }}
@@ -91,7 +91,7 @@ runs:
        docker compose logs database

    - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
+      uses: useblacksmith/setup-docker-builder@v1
      with:
        driver-opts: |
          network=container:database
@@ -100,7 +100,7 @@ runs:

    - name: Build image
      id: docker_build
-      uses: docker/build-push-action@v6
+      uses: useblacksmith/build-push-action@v2
      with:
        context: ./
        file: ./Dockerfile
@@ -159,7 +159,7 @@ runs:

    - name: Push image
      id: docker_push
-      uses: docker/build-push-action@v6
+      uses: useblacksmith/build-push-action@v2
      if: ${{ inputs.push-image == 'true' && !github.event.release.prerelease }}
      with:
        context: ./
@@ -29,6 +29,11 @@ jobs:
    uses: ./.github/workflows/api-v2-unit-tests.yml
    secrets: inherit

+  build-api-v1:
+    name: Production builds
+    uses: ./.github/workflows/api-v1-production-build.yml
+    secrets: inherit
+
  build-api-v2:
    name: Production builds
    uses: ./.github/workflows/api-v2-production-build.yml
@@ -46,38 +51,38 @@ jobs:

  integration-test:
    name: Tests
-    needs: [lint, build, build-api-v2]
+    needs: [lint, build, build-api-v1, build-api-v2]
    uses: ./.github/workflows/integration-tests.yml
    secrets: inherit

  e2e:
    name: Tests
-    needs: [lint, build, build-api-v2]
+    needs: [lint, build, build-api-v1, build-api-v2]
    uses: ./.github/workflows/e2e.yml
    secrets: inherit

  e2e-app-store:
    name: Tests
-    needs: [lint, build, build-api-v2]
+    needs: [lint, build, build-api-v1, build-api-v2]
    uses: ./.github/workflows/e2e-app-store.yml
    secrets: inherit

  e2e-embed:
    name: Tests
-    needs: [lint, build, build-api-v2]
+    needs: [lint, build, build-api-v1, build-api-v2]
    uses: ./.github/workflows/e2e-embed.yml
    secrets: inherit

  e2e-embed-react:
    name: Tests
-    needs: [lint, build, build-api-v2]
+    needs: [lint, build, build-api-v1, build-api-v2]
    uses: ./.github/workflows/e2e-embed-react.yml
    secrets: inherit

  required:
-    needs: [lint, type-check, unit-test, api-v2-unit-test, integration-test, build, build-api-v2, e2e, e2e-embed, e2e-embed-react, e2e-app-store]
+    needs: [lint, type-check, unit-test, api-v2-unit-test, integration-test, build, build-api-v1, build-api-v2, e2e, e2e-embed, e2e-embed-react, e2e-app-store]
    if: always()
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
    steps:
      - name: fail if conditional jobs failed
        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'skipped') || contains(needs.*.result, 'cancelled')
@@ -0,0 +1,94 @@
+name: Production Builds
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+env:
+  ALLOWED_HOSTNAMES: ${{ vars.CI_ALLOWED_HOSTNAMES }}
+  CALENDSO_ENCRYPTION_KEY: ${{ secrets.CI_CALENDSO_ENCRYPTION_KEY }}
+  DATABASE_URL: ${{ secrets.CI_DATABASE_URL }}
+  DATABASE_DIRECT_URL: ${{ secrets.CI_DATABASE_URL }}
+  E2E_TEST_APPLE_CALENDAR_EMAIL: ${{ secrets.E2E_TEST_APPLE_CALENDAR_EMAIL }}
+  E2E_TEST_APPLE_CALENDAR_PASSWORD: ${{ secrets.E2E_TEST_APPLE_CALENDAR_PASSWORD }}
+  E2E_TEST_CALCOM_QA_EMAIL: ${{ secrets.E2E_TEST_CALCOM_QA_EMAIL }}
+  E2E_TEST_CALCOM_QA_PASSWORD: ${{ secrets.E2E_TEST_CALCOM_QA_PASSWORD }}
+  E2E_TEST_CALCOM_QA_GCAL_CREDENTIALS: ${{ secrets.E2E_TEST_CALCOM_QA_GCAL_CREDENTIALS }}
+  E2E_TEST_CALCOM_GCAL_KEYS: ${{ secrets.E2E_TEST_CALCOM_GCAL_KEYS }}
+  GOOGLE_API_CREDENTIALS: ${{ secrets.CI_GOOGLE_API_CREDENTIALS }}
+  GOOGLE_LOGIN_ENABLED: ${{ vars.CI_GOOGLE_LOGIN_ENABLED }}
+  NEXTAUTH_SECRET: ${{ secrets.CI_NEXTAUTH_SECRET }}
+  NEXTAUTH_URL: ${{ secrets.CI_NEXTAUTH_URL }}
+  NEXT_PUBLIC_API_V2_URL: ${{ secrets.CI_NEXT_PUBLIC_API_V2_URL }}
+  NEXT_PUBLIC_API_V2_ROOT_URL: ${{ secrets.CI_NEXT_PUBLIC_API_V2_ROOT_URL }}
+  NEXT_PUBLIC_IS_E2E: ${{ vars.CI_NEXT_PUBLIC_IS_E2E }}
+  NEXT_PUBLIC_ORG_SELF_SERVE_ENABLED: ${{ vars.CI_NEXT_PUBLIC_ORG_SELF_SERVE_ENABLED }}
+  NEXT_PUBLIC_STRIPE_PUBLIC_KEY: ${{ secrets.CI_NEXT_PUBLIC_STRIPE_PUBLIC_KEY }}
+  NEXT_PUBLIC_WEBAPP_URL: ${{ vars.CI_NEXT_PUBLIC_WEBAPP_URL }}
+  NEXT_PUBLIC_WEBSITE_URL: ${{ vars.CI_NEXT_PUBLIC_WEBSITE_URL }}
+  PAYMENT_FEE_FIXED: ${{ vars.CI_PAYMENT_FEE_FIXED }}
+  PAYMENT_FEE_PERCENTAGE: ${{ vars.CI_PAYMENT_FEE_PERCENTAGE }}
+  SAML_ADMINS: ${{ secrets.CI_SAML_ADMINS }}
+  SAML_DATABASE_URL: ${{ secrets.CI_SAML_DATABASE_URL }}
+  STRIPE_PRIVATE_KEY: ${{ secrets.CI_STRIPE_PRIVATE_KEY }}
+  STRIPE_CLIENT_ID: ${{ secrets.CI_STRIPE_CLIENT_ID }}
+  STRIPE_WEBHOOK_SECRET: ${{ secrets.CI_STRIPE_WEBHOOK_SECRET }}
+  SENDGRID_API_KEY: ${{ secrets.CI_SENDGRID_API_KEY }}
+  SENDGRID_EMAIL: ${{ secrets.CI_SENDGRID_EMAIL }}
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+  TURBO_TEAM: ${{ secrets.TURBO_TEAM }}
+
+jobs:
+  build:
+    name: Build API v1
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    timeout-minutes: 30
+    services:
+      postgres:
+        image: postgres:13
+        credentials:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+        env:
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: calendso
+        options: >-
+          --health-cmd "pg_isready -h 127.0.0.1 -U postgres"
+          --health-interval 2s
+          --health-timeout 3s
+          --health-retries 15
+          --health-start-period 2s
+        ports:
+          - 5432:5432
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: .github
+      - uses: ./.github/actions/cache-checkout
+      - uses: ./.github/actions/yarn-install
+      - uses: ./.github/actions/cache-db
+      - name: Cache API v1 production build
+        uses: actions/cache@v4
+        id: cache-api-v1-build
+        env:
+          cache-name: api-v1-build
+          key-1: ${{ hashFiles('yarn.lock') }}
+          key-2: ${{ hashFiles('apps/api/v1/**.[jt]s', 'apps/api/v1/**.[jt]sx', '!**/node_modules') }}
+        with:
+          path: |
+            ${{ github.workspace }}/apps/api/v1/.next
+            **/.turbo/**
+            **/dist/**
+          key: ${{ env.cache-name }}-${{ env.key-1 }}-${{ env.key-2 }}
+      - name: Log Cache Hit
+        if: steps.cache-api-v1-build.outputs.cache-hit == 'true'
+        run: echo "Cache hit for API v1 build. Skipping build."
+      - name: Run build
+        if: steps.cache-api-v1-build.outputs.cache-hit != 'true'
+        run: |
+          export NODE_OPTIONS="--max_old_space_size=8192"
+          yarn turbo run build --filter=@calcom/api...
+        shell: bash
@@ -14,11 +14,11 @@ jobs:
    name: Build API v2
    permissions:
      contents: read
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 30
    services:
      postgres:
-        image: postgres:18
+        image: postgres:13
        credentials:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -9,7 +9,7 @@ jobs:
  test:
    name: API v2 Unit
    timeout-minutes: 20
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
    steps:
      - uses: actions/checkout@v4
        with:
@@ -8,7 +8,7 @@ jobs:
    name: Build Atoms
    permissions:
      contents: read
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4
@@ -6,7 +6,7 @@ on:

 jobs:
  cleanup:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
    steps:
      - name: Check out code
        uses: actions/checkout@v4
@@ -13,7 +13,7 @@ permissions:

 jobs:
  release:
-    if: github.repository == 'calcom/cal.diy' # prevent this action from running on forks
+    if: github.repository == 'calcom/cal.com' # prevent this action from running on forks
    name: Release
    runs-on: ubuntu-latest
    steps:
@@ -0,0 +1,67 @@
+name: Check API v2 breaking changes
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+env:
+  API_KEY_PREFIX: ${{ secrets.CI_API_KEY_PREFIX }}
+  API_PORT: ${{ vars.CI_API_V2_PORT }}
+  API_URL: "http://localhost"
+  CALCOM_LICENSE_KEY: ${{ secrets.CI_CALCOM_LICENSE_KEY }}
+  DATABASE_URL: ${{ secrets.CI_DATABASE_URL }}
+  DATABASE_READ_URL: ${{ secrets.CI_DATABASE_URL }}
+  DATABASE_WRITE_URL: ${{ secrets.CI_DATABASE_URL }}
+  JWT_SECRET: ${{ secrets.CI_JWT_SECRET }}
+  NEXTAUTH_SECRET: ${{ secrets.CI_NEXTAUTH_SECRET }}
+  NODE_ENV: ${{ vars.CI_NODE_ENV }}
+  NODE_OPTIONS: --max-old-space-size=4096
+  REDIS_URL: "redis://localhost:6379"
+  STRIPE_API_KEY: ${{ secrets.CI_STRIPE_PRIVATE_KEY }}
+  STRIPE_WEBHOOK_SECRET: ${{ secrets.CI_STRIPE_WEBHOOK_SECRET }}
+  WEB_APP_URL: "https://app.cal.com"
+
+jobs:
+  check-api-v2-breaking-changes:
+    name: Check API v2 breaking changes
+    timeout-minutes: 10
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    steps:
+      - uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: .github
+      - uses: ./.github/actions/cache-checkout
+      - uses: ./.github/actions/yarn-install
+
+      - name: Build platform packages
+        run: |
+          yarn turbo run build \
+            --filter=@calcom/platform-constants \
+            --filter=@calcom/platform-enums \
+            --filter=@calcom/platform-utils \
+            --filter=@calcom/platform-types \
+            --filter=@calcom/platform-libraries \
+            --filter=@calcom/trpc
+
+      - name: Generate Swagger
+        working-directory: apps/api/v2
+        run: |
+          yarn prisma generate
+          yarn generate-swagger
+
+      - name: Check API v2 breaking changes
+        run: |
+          docker run --rm \
+            -v "$PWD:/work" -w /work \
+            tufin/oasdiff:latest \
+            breaking \
+            https://raw.githubusercontent.com/calcom/cal.com/refs/heads/main/docs/api-reference/v2/openapi.json \
+            docs/api-reference/v2/openapi.json \
+            --fail-on ERR \
+            --err-ignore .github/oasdiff-err-ignore.txt
@@ -8,10 +8,10 @@ env:
 jobs:
  check-prisma-migrations:
    name: Check migrations match schema
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
    services:
      postgres:
-        image: postgres:18
+        image: postgres:13
        credentials:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -9,7 +9,7 @@ permissions:
  contents: read
 jobs:
  check-types:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
    steps:
      - uses: actions/checkout@v4
        with:
@@ -0,0 +1,32 @@
+name: Cubic AI Review Trigger
+
+on:
+  pull_request_review:
+    types: [submitted]
+
+# This workflow triggers on pull_request_review events (including from forks)
+# and saves the review context as an artifact. The main cubic-devin-review.yml
+# workflow then runs via workflow_run with full permissions and secrets access.
+
+jobs:
+  save-review-context:
+    name: Save Review Context
+    if: github.event.review.user.login == 'cubic-dev-ai[bot]'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Save review context to artifact
+        run: |
+          cat > review-context.json << 'EOF'
+          {
+            "pr_number": ${{ github.event.pull_request.number }},
+            "review_body": ${{ toJSON(github.event.review.body) }},
+            "repository": "${{ github.repository }}"
+          }
+          EOF
+
+      - name: Upload review context
+        uses: actions/upload-artifact@v4
+        with:
+          name: cubic-review-context
+          path: review-context.json
+          retention-days: 1
@@ -0,0 +1,245 @@
+name: Cubic feedback addressed by Devin
+
+on:
+  workflow_run:
+    workflows: ["Cubic AI Review Trigger"]
+    types:
+      - completed
+
+permissions:
+  contents: read
+  pull-requests: write
+  actions: read
+
+jobs:
+  trigger-devin:
+    name: Trigger Devin to Address Cubic AI Review
+    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    steps:
+      - name: Download review context artifact
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const artifacts = await github.rest.actions.listWorkflowRunArtifacts({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              run_id: context.payload.workflow_run.id,
+            });
+            
+            const matchArtifact = artifacts.data.artifacts.find(
+              artifact => artifact.name === 'cubic-review-context'
+            );
+            
+            if (!matchArtifact) {
+              core.setFailed('No cubic-review-context artifact found');
+              return;
+            }
+            
+            const download = await github.rest.actions.downloadArtifact({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              artifact_id: matchArtifact.id,
+              archive_format: 'zip',
+            });
+            
+            const fs = require('fs');
+            fs.writeFileSync(`${process.env.GITHUB_WORKSPACE}/context.zip`, Buffer.from(download.data));
+
+      - name: Unzip artifact
+        run: unzip context.zip
+
+      - name: Extract AI prompt from Cubic review
+        id: extract-prompt
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const contextData = JSON.parse(fs.readFileSync('review-context.json', 'utf8'));
+            const reviewBody = contextData.review_body || '';
+            const prNumber = contextData.pr_number;
+            
+            core.setOutput('pr-number', prNumber);
+            
+            const promptMatch = reviewBody.match(/<details>\s*<summary>Prompt for AI agents[^<]*<\/summary>\s*```(?:text)?\s*([\s\S]*?)```\s*<\/details>/i);
+            
+            if (!promptMatch || !promptMatch[1]) {
+              console.log('No AI prompt found in review body');
+              console.log('Review body:', reviewBody);
+              core.setOutput('has-prompt', 'false');
+              return;
+            }
+            
+            const prompt = promptMatch[1].trim();
+            console.log('Extracted prompt:', prompt);
+            
+            fs.writeFileSync('/tmp/cubic-prompt.txt', prompt);
+            
+            core.setOutput('has-prompt', 'true');
+
+      - name: Checkout repository
+        if: steps.extract-prompt.outputs.has-prompt == 'true'
+        uses: actions/checkout@v4
+
+      - name: Check for existing Devin session
+        if: steps.extract-prompt.outputs.has-prompt == 'true'
+        id: check-session
+        uses: ./.github/actions/devin-session
+        with:
+          devin-api-key: ${{ secrets.DEVIN_API_KEY }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          pr-number: ${{ steps.extract-prompt.outputs.pr-number }}
+
+      - name: Set session environment variables
+        if: steps.extract-prompt.outputs.has-prompt == 'true' && steps.check-session.outputs.has-existing-session == 'true'
+        run: |
+          echo "EXISTING_SESSION_ID=${{ steps.check-session.outputs.session-id }}" >> $GITHUB_ENV
+          echo "SESSION_URL=${{ steps.check-session.outputs.session-url }}" >> $GITHUB_ENV
+
+      - name: Send message to existing Devin session
+        if: steps.extract-prompt.outputs.has-prompt == 'true' && steps.check-session.outputs.has-existing-session == 'true'
+        env:
+          DEVIN_API_KEY: ${{ secrets.DEVIN_API_KEY }}
+        run: |
+          CUBIC_PROMPT=$(cat /tmp/cubic-prompt.txt)
+          
+          MESSAGE="New Cubic AI review feedback has been submitted on PR #${{ steps.extract-prompt.outputs.pr-number }}.
+
+          IMPORTANT: Before fixing any issue, check the individual Cubic comment on the PR for that issue's confidence score. The confidence score appears as 'Fix confidence (alpha): X/10' in each comment. Note that the (alpha) may or not be there. Don't be picky about that text. But only fix issues where the confidence score is 9/10 or higher. If you cannot find a confidence score for an issue, skip it.
+
+          Here are the issues identified by Cubic AI:
+
+          ${CUBIC_PROMPT}
+
+          Continue working on the same PR branch and push your fixes."
+
+          HTTP_CODE=$(curl -s -o /tmp/devin-response.json -w "%{http_code}" -X POST "https://api.devin.ai/v1/sessions/${EXISTING_SESSION_ID}/message" \
+            -H "Authorization: Bearer ${DEVIN_API_KEY}" \
+            -H "Content-Type: application/json" \
+            -d "$(jq -n --arg message "$MESSAGE" '{message: $message}')")
+          
+          if [ "$HTTP_CODE" -lt 200 ] || [ "$HTTP_CODE" -ge 300 ]; then
+            echo "Failed to send message to Devin session: HTTP $HTTP_CODE"
+            cat /tmp/devin-response.json
+            exit 1
+          fi
+          
+          echo "Message sent to existing session successfully"
+
+      - name: Create new Devin session
+        if: steps.extract-prompt.outputs.has-prompt == 'true' && steps.check-session.outputs.has-existing-session == 'false'
+        env:
+          DEVIN_API_KEY: ${{ secrets.DEVIN_API_KEY }}
+        run: |
+          CUBIC_PROMPT=$(cat /tmp/cubic-prompt.txt)
+          
+          FULL_PROMPT="You are addressing code review feedback from Cubic AI on PR #${{ steps.extract-prompt.outputs.pr-number }} in repository ${{ github.repository }}.
+
+          Your tasks:
+          1. Clone the repository ${{ github.repository }} locally.
+          2. Check out the PR branch and review the current code.
+          3. Read the Cubic AI review feedback below AND check each individual Cubic comment on the PR for the confidence score.
+          4. IMPORTANT: Only fix issues where the confidence score is 9/10 or higher. The confidence score appears as 'Fix confidence (alpha): X/10' in each Cubic comment. If you cannot find a confidence score for an issue, skip it.
+          5. Commit your changes with clear commit messages referencing the issues fixed.
+          6. Push your changes to the PR branch.
+
+          Cubic AI Review Feedback:
+          ${CUBIC_PROMPT}
+
+          Rules and Guidelines:
+          1. Make minimal, focused changes that directly address the feedback.
+          2. Follow the existing code style and conventions in the repository.
+          3. Test your changes if possible before pushing.
+          4. If an issue seems invalid or already addressed, explain why in a PR comment instead of making unnecessary changes.
+          5. Never ask for user confirmation. Never wait for user messages."
+
+          HTTP_CODE=$(curl -s -o /tmp/devin-response.json -w "%{http_code}" -X POST "https://api.devin.ai/v1/sessions" \
+            -H "Authorization: Bearer ${DEVIN_API_KEY}" \
+            -H "Content-Type: application/json" \
+            -d "$(jq -n \
+              --arg prompt "$FULL_PROMPT" \
+              --arg title "Cubic AI Review: PR #${{ steps.extract-prompt.outputs.pr-number }}" \
+              '{
+                prompt: $prompt,
+                title: $title,
+                tags: ["cubic-ai-review", "pr-${{ steps.extract-prompt.outputs.pr-number }}"]
+              }')")
+          
+          if [ "$HTTP_CODE" -lt 200 ] || [ "$HTTP_CODE" -ge 300 ]; then
+            echo "Failed to create Devin session: HTTP $HTTP_CODE"
+            cat /tmp/devin-response.json
+            exit 1
+          fi
+          
+          SESSION_URL=$(cat /tmp/devin-response.json | jq -r '.url // .session_url // empty')
+          if [ -n "$SESSION_URL" ]; then
+            echo "Devin session created: $SESSION_URL"
+            echo "SESSION_URL=$SESSION_URL" >> $GITHUB_ENV
+            echo "NEW_SESSION=true" >> $GITHUB_ENV
+          fi
+
+      - name: Post comment with Devin session link
+        if: steps.extract-prompt.outputs.has-prompt == 'true' && env.SESSION_URL != ''
+        id: post-comment
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const sessionUrl = process.env.SESSION_URL;
+            const isNewSession = process.env.NEW_SESSION === 'true';
+            
+            const message = isNewSession
+              ? `### Devin AI is addressing Cubic AI's review feedback\n\nA Devin session has been created to address the issues identified by Cubic AI.\n\n[View Devin Session](${sessionUrl})`
+              : `### Devin AI is addressing Cubic AI's review feedback\n\nNew feedback has been sent to the existing Devin session.\n\n[View Devin Session](${sessionUrl})`;
+            
+            // Use the PR number from the extract-prompt step output instead of reading the file
+            // (the file was deleted by the checkout step)
+            const prNumber = parseInt('${{ steps.extract-prompt.outputs.pr-number }}', 10);
+            
+            const { data: comment } = await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: prNumber,
+              body: message
+            });
+            
+            core.setOutput('comment-id', comment.id);
+
+      - name: Send completion instructions to Devin
+        if: steps.extract-prompt.outputs.has-prompt == 'true' && env.SESSION_URL != '' && steps.post-comment.outputs.comment-id != ''
+        env:
+          DEVIN_API_KEY: ${{ secrets.DEVIN_API_KEY }}
+        run: |
+          SESSION_ID="${EXISTING_SESSION_ID:-}"
+          if [ -z "$SESSION_ID" ]; then
+            SESSION_ID=$(cat /tmp/devin-response.json | jq -r '.session_id // .id // empty')
+          fi
+          
+          if [ -z "$SESSION_ID" ]; then
+            echo "No session ID found, skipping completion instructions"
+            exit 0
+          fi
+          
+          COMMENT_ID="${{ steps.post-comment.outputs.comment-id }}"
+          
+          MESSAGE="IMPORTANT: When you have finished addressing Cubic AI's feedback (whether you pushed changes or not), you MUST update the GitHub comment to show completion status.
+
+          Use the GitHub API to update comment ID ${COMMENT_ID} on PR #${{ steps.extract-prompt.outputs.pr-number }} in repository ${{ github.repository }}.
+
+          Add a completion status section at the bottom of the comment:
+          - If you pushed changes: Add '\n\n---\n:white_check_mark: Pushed commit [\`{SHORT_HASH}\`](https://github.com/${{ github.repository }}/commit/{FULL_HASH})' where {SHORT_HASH} is the first 7 characters of the commit hash and {FULL_HASH} is the full commit hash.
+          - If no changes were needed: Add '\n\n---\n:white_check_mark: No changes pushed'
+
+          To update the comment, use: gh api repos/${{ github.repository }}/issues/comments/${COMMENT_ID} -X PATCH -f body='<updated comment body>'"
+
+          HTTP_CODE=$(curl -s -o /tmp/devin-instructions-response.json -w "%{http_code}" -X POST "https://api.devin.ai/v1/sessions/${SESSION_ID}/message" \
+            -H "Authorization: Bearer ${DEVIN_API_KEY}" \
+            -H "Content-Type: application/json" \
+            -d "$(jq -n --arg message "$MESSAGE" '{message: $message}')")
+          
+          if [ "$HTTP_CODE" -lt 200 ] || [ "$HTTP_CODE" -ge 300 ]; then
+            echo "Warning: Failed to send completion instructions to Devin session: HTTP $HTTP_CODE"
+            cat /tmp/devin-instructions-response.json
+          else
+            echo "Completion instructions sent to Devin session successfully"
+          fi
@@ -0,0 +1,43 @@
+name: Delete Blacksmith Cache
+on:
+  workflow_dispatch:
+    inputs:
+      cache_key:
+        description: "Blacksmith Cache Key to Delete"
+        required: true
+        type: string
+  pull_request:
+    types: [closed]
+
+jobs:
+  manually-delete-blacksmith-cache:
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - uses: useblacksmith/cache-delete@v1
+        with:
+          key: ${{ inputs.cache_key }}
+
+  delete-cache-build-on-pr-close:
+    if: github.event_name == 'pull_request' && github.event.action == 'closed'
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    env:
+      CACHE_NAME: prod-build
+    steps:
+      - name: Delete cache-build cache
+        uses: useblacksmith/cache-delete@v1
+        with:
+          key: ${{ env.CACHE_NAME }}-${{ github.event.pull_request.head.ref }}
+          prefix: "true"
+
+  delete-git-checkout-cache-on-pr-close:
+    if: github.event_name == 'pull_request' && github.event.action == 'closed'
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    steps:
+      - name: Delete git-checkout cache
+        uses: useblacksmith/cache-delete@v1
+        with:
+          key: git-checkout-${{ github.event.pull_request.head.ref }}-
+          prefix: "true"
@@ -0,0 +1,430 @@
+name: Devin PR Conflict Resolver
+
+on:
+  pull_request_target:
+    types: [labeled]
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: 'PR number to resolve conflicts for'
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  resolve-conflicts:
+    name: Resolve PR Conflicts with Devin
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    # Only run when devin-conflict-resolution label is added, or on manual dispatch
+    if: |
+      (github.event_name == 'pull_request_target' && github.event.label.name == 'devin-conflict-resolution') ||
+      github.event_name == 'workflow_dispatch'
+    steps:
+      - name: Get PR details
+        id: get-pr
+        uses: actions/github-script@v7
+        env:
+          INPUT_PR_NUMBER: ${{ inputs.pr_number }}
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const { owner, repo } = context.repo;
+            let prNumber;
+            
+            if (context.eventName === 'workflow_dispatch') {
+              prNumber = parseInt(process.env.INPUT_PR_NUMBER, 10);
+              if (!prNumber) {
+                core.setFailed('PR number is required for manual dispatch');
+                return;
+              }
+            } else {
+              prNumber = context.payload.pull_request.number;
+            }
+            
+            console.log(`Processing PR #${prNumber}`);
+            
+            // Get PR details via GraphQL for complete info
+            const query = `
+              query($owner: String!, $repo: String!, $number: Int!) {
+                repository(owner: $owner, name: $repo) {
+                  pullRequest(number: $number) {
+                    number
+                    title
+                    mergeable
+                    isDraft
+                    headRefName
+                    baseRefName
+                    url
+                    body
+                    headRepository {
+                      owner {
+                        login
+                      }
+                      name
+                    }
+                    maintainerCanModify
+                  }
+                }
+              }
+            `;
+            
+            const result = await github.graphql(query, { owner, repo, number: prNumber });
+            const pr = result.repository.pullRequest;
+            
+            if (!pr) {
+              core.setFailed(`PR #${prNumber} not found`);
+              return;
+            }
+            
+            const isFork = pr.headRepository?.owner?.login !== owner;
+            
+            // Check if fork PR has maintainer access
+            if (isFork && !pr.maintainerCanModify) {
+              console.log(`PR #${prNumber} is from a fork without maintainer access`);
+              core.setOutput('needs-maintainer-access', 'true');
+              core.setOutput('fork-author', pr.headRepository?.owner?.login);
+            } else {
+              core.setOutput('needs-maintainer-access', 'false');
+            }
+            
+            const headRepoOwner = pr.headRepository?.owner?.login || owner;
+            const headRepoName = pr.headRepository?.name || repo;
+            
+            const prData = {
+              number: pr.number,
+              title: pr.title,
+              head_ref: pr.headRefName,
+              base_ref: pr.baseRefName,
+              html_url: pr.url,
+              body: pr.body,
+              is_fork: isFork,
+              head_repo_owner: headRepoOwner,
+              head_repo_name: headRepoName,
+              mergeable: pr.mergeable
+            };
+            
+            const fs = require('fs');
+            fs.writeFileSync('/tmp/pr-data.json', JSON.stringify(prData));
+            
+            core.setOutput('pr-number', prNumber.toString());
+            core.setOutput('has-pr', 'true');
+            core.setOutput('mergeable-status', pr.mergeable || 'UNKNOWN');
+            core.setOutput('has-conflicts', pr.mergeable === 'CONFLICTING' ? 'true' : 'false');
+            
+            console.log(`PR #${prNumber}: ${pr.title}`);
+            console.log(`Mergeable status: ${pr.mergeable}`);
+            console.log(`Is fork: ${isFork}`);
+            console.log(`Has conflicts: ${pr.mergeable === 'CONFLICTING'}`);
+
+      - name: Request maintainer access for fork PR
+        if: steps.get-pr.outputs.needs-maintainer-access == 'true'
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const { owner, repo } = context.repo;
+            const prNumber = parseInt('${{ steps.get-pr.outputs.pr-number }}', 10);
+            const forkAuthor = '${{ steps.get-pr.outputs.fork-author }}';
+            
+            console.log(`Requesting maintainer access for PR #${prNumber}`);
+            
+            const commentBody = [
+              '### Maintainer Access Needed',
+              '',
+              `Hi @${forkAuthor}! Thanks for your contribution to Cal.com.`,
+              '',
+              'We noticed that this PR doesn\'t have "Allow edits from maintainers" enabled. We\'d love to help keep your PR up to date by resolving merge conflicts and making small fixes when needed.',
+              '',
+              '**Could you please enable this setting?** Here\'s how:',
+              '1. Scroll down to the bottom of this PR page',
+              '2. In the right sidebar, check the box that says **"Allow edits and access to secrets by maintainers"**',
+              '',
+              'This allows us to push commits directly to your PR branch, which helps us:',
+              '- Resolve merge conflicts automatically',
+              '- Make small adjustments to help get your PR merged faster',
+              '',
+              'Once you enable this setting, please remove and re-add the `devin-conflict-resolution` label to trigger conflict resolution.',
+              '',
+              'If you have any concerns about enabling this setting, feel free to let us know!'
+            ].join('\n');
+            
+            await github.rest.issues.createComment({
+              owner,
+              repo,
+              issue_number: prNumber,
+              body: commentBody
+            });
+            
+            // Add label to track that we've requested access
+            await github.rest.issues.addLabels({
+              owner,
+              repo,
+              issue_number: prNumber,
+              labels: ['maintainer-access-requested']
+            });
+            
+            // Remove the devin-conflict-resolution label since we can't proceed
+            await github.rest.issues.removeLabel({
+              owner,
+              repo,
+              issue_number: prNumber,
+              name: 'devin-conflict-resolution'
+            });
+            
+            console.log(`Posted comment and updated labels for PR #${prNumber}`);
+            core.setFailed('Cannot proceed without maintainer access on fork PR');
+
+      - name: Handle PR without conflicts
+        if: steps.get-pr.outputs.has-pr == 'true' && steps.get-pr.outputs.needs-maintainer-access != 'true' && steps.get-pr.outputs.has-conflicts != 'true'
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const { owner, repo } = context.repo;
+            const prNumber = parseInt('${{ steps.get-pr.outputs.pr-number }}', 10);
+            const mergeableStatus = '${{ steps.get-pr.outputs.mergeable-status }}';
+            
+            console.log(`PR #${prNumber} does not have conflicts (status: ${mergeableStatus})`);
+            
+            let message;
+            if (mergeableStatus === 'MERGEABLE') {
+              message = `### No Conflicts Detected\n\nThis PR does not have any merge conflicts with the base branch. The \`devin-conflict-resolution\` label has been removed.\n\nIf you believe this PR should have conflicts, please check the PR status and try again.`;
+            } else {
+              message = `### Mergeable Status Unknown\n\nGitHub is still computing the mergeable status for this PR (current status: \`${mergeableStatus}\`). The \`devin-conflict-resolution\` label has been removed.\n\nPlease wait a moment and re-add the label if the PR has conflicts.`;
+            }
+            
+            await github.rest.issues.createComment({
+              owner,
+              repo,
+              issue_number: prNumber,
+              body: message
+            });
+            
+            try {
+              await github.rest.issues.removeLabel({
+                owner,
+                repo,
+                issue_number: prNumber,
+                name: 'devin-conflict-resolution'
+              });
+            } catch (e) {
+              console.log(`Label may have already been removed: ${e.message}`);
+            }
+            
+            console.log(`Posted comment and removed label for PR #${prNumber}`);
+
+      - name: Checkout repository
+        if: steps.get-pr.outputs.has-pr == 'true' && steps.get-pr.outputs.needs-maintainer-access != 'true' && steps.get-pr.outputs.has-conflicts == 'true'
+        uses: actions/checkout@v4
+
+      - name: Check for existing Devin session
+        if: steps.get-pr.outputs.has-pr == 'true' && steps.get-pr.outputs.needs-maintainer-access != 'true' && steps.get-pr.outputs.has-conflicts == 'true'
+        id: check-session
+        uses: ./.github/actions/devin-session
+        with:
+          devin-api-key: ${{ secrets.DEVIN_API_KEY }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          pr-number: ${{ steps.get-pr.outputs.pr-number }}
+
+      - name: Create Devin session for conflict resolution
+        if: steps.get-pr.outputs.has-pr == 'true' && steps.get-pr.outputs.needs-maintainer-access != 'true' && steps.get-pr.outputs.has-conflicts == 'true'
+        env:
+          DEVIN_API_KEY: ${{ secrets.DEVIN_API_KEY }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          HAS_EXISTING_SESSION: ${{ steps.check-session.outputs.has-existing-session }}
+          EXISTING_SESSION_ID: ${{ steps.check-session.outputs.session-id }}
+          EXISTING_SESSION_URL: ${{ steps.check-session.outputs.session-url }}
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const fs = require('fs');
+            const pr = JSON.parse(fs.readFileSync('/tmp/pr-data.json', 'utf8'));
+            const { owner, repo } = context.repo;
+            
+            const hasExistingSession = process.env.HAS_EXISTING_SESSION === 'true';
+            const existingSessionId = process.env.EXISTING_SESSION_ID;
+            const existingSessionUrl = process.env.EXISTING_SESSION_URL;
+            
+            console.log(`Processing PR #${pr.number}: ${pr.title}${pr.is_fork ? ' (fork)' : ''}`);
+            
+            const forkInstructions = pr.is_fork ? `
+            IMPORTANT: This PR is from a fork.
+            - Clone the FORK repository: ${pr.head_repo_owner}/${pr.head_repo_name}
+            - The branch to work on is: ${pr.head_ref}
+            - Add the upstream remote for ${owner}/${repo}
+            - Fetch and merge the upstream ${pr.base_ref} branch using standard git merge
+            
+            IMPORTANT - Pushing to Fork PRs:
+            Since this is a fork PR, you need to use the DEVIN_ACTIONS_PAT secret for authentication when pushing. Configure git to use this PAT for authentication before pushing your changes to the fork.` : `
+            - Clone the repository: ${owner}/${repo}
+            - Check out the PR branch: ${pr.head_ref}
+            - Merge the base branch (${pr.base_ref}) using standard git merge`;
+            
+            const conflictResolutionInstructions = `You are resolving merge conflicts on PR #${pr.number} in repository ${owner}/${repo}.
+
+            PR Title: ${pr.title}
+            PR URL: ${pr.html_url}
+            Head Branch: ${pr.head_ref}
+            Base Branch: ${pr.base_ref}
+            ${pr.is_fork ? `Fork Repository: ${pr.head_repo_owner}/${pr.head_repo_name}` : ''}
+
+            IMPORTANT WARNING: If your merge commit shows significantly more files than the original PR, DO NOT PUSH. This indicates the merge was done incorrectly. Abort and leave a comment instead.
+
+            Your tasks:
+            ${forkInstructions}
+
+            Then:
+            1. Resolve all merge conflicts carefully:
+               - Review the conflicting changes from both branches
+               - Make intelligent decisions about how to combine the changes
+               - Preserve the intent of both the PR changes and the base branch updates
+               - If unsure about a conflict, prefer keeping both changes where possible
+            2. Test that the code still works after resolving conflicts (run lint/type checks).
+            3. Commit the merge resolution with a clear commit message.
+            4. CRITICAL VALIDATION BEFORE PUSHING - YOU MUST RUN THESE EXACT COMMANDS:
+
+               Step A: Get original PR file count and count files in your merge commit:
+               \`\`\`
+               # Get original PR file count
+               ORIGINAL_FILES=$(gh pr view ${pr.number} --json files -q '.files | length')
+               echo "Original PR files: $ORIGINAL_FILES"
+
+               # Count files in merge commit (what the PR contributes)
+               # HEAD^2 = base branch parent, so HEAD^2...HEAD shows the PR's contribution
+               MERGE_FILES=$(git diff --name-only HEAD^2...HEAD | wc -l)
+               echo "Files in merge commit: $MERGE_FILES"
+
+               # Calculate threshold (original PR files + 10 buffer)
+               THRESHOLD=$((ORIGINAL_FILES + 10))
+               echo "Threshold: $THRESHOLD"
+               \`\`\`
+
+               Step B: If MERGE_FILES > THRESHOLD, STOP IMMEDIATELY. DO NOT PUSH.
+               - A proper merge commit should show approximately the same files as the original PR
+               - If you see significantly more files, the merge was done INCORRECTLY
+               - This usually means you accidentally reproduced changes from ${pr.base_ref} instead of just resolving conflicts
+
+               Step C: Compare your merge to the original PR:
+               \`\`\`
+               git diff --stat HEAD^2...HEAD
+               \`\`\`
+               - This should show approximately the same files as the original PR (the PR's contribution to the base branch)
+               - If you see many more files or files unrelated to the original PR, STOP
+
+               Step D: If validation fails:
+               - DO NOT PUSH under any circumstances
+               - DO NOT attempt to fix it
+               - Leave a comment on the PR explaining that the merge validation failed
+               - ABORT THE TASK IMMEDIATELY
+               - It is better to leave the PR with conflicts than to push a broken merge commit that pollutes git history
+            5. Push the resolved changes to the PR branch only after validation passes.
+            6. After successfully pushing the resolved changes, remove the \`devin-conflict-resolution\` label from the PR using the GitHub API.
+
+            Rules and Guidelines:
+            1. Be careful when resolving conflicts - understand the context of both changes.
+               To help with this, try to find the recent PRs associated with the conflicting files to gain more context.
+            2. Follow the existing code style and conventions in the repository.
+            3. Run lint and type checks before pushing to ensure the code is valid.
+            4. If a conflict seems too complex or risky to resolve automatically, explain the situation in a PR comment instead.
+            5. Never ask for user confirmation. Never wait for user messages.
+            6. CRITICAL: If this is a fork PR and you encounter ANY error when pushing (permission denied, authentication failure, etc.) even after using the DEVIN_ACTIONS_PAT, you MUST fail the task immediately. Do NOT attempt to push to a new branch in the main ${owner}/${repo} repository as a workaround. Simply report the error and stop.
+            7. CRITICAL: Never reproduce or recreate changes from the target branch. Your merge commit should ONLY contain conflict resolutions. If you find yourself manually copying file contents from ${pr.base_ref} or creating changes that mirror what's already in ${pr.base_ref}, you are doing it wrong. Use git's merge functionality properly - it handles bringing in changes automatically.
+            8. CRITICAL: If your merge commit shows significantly more files than the original PR (more than original PR files + 10), DO NOT PUSH UNDER ANY CIRCUMSTANCES. This is a sign that the merge was done incorrectly. Abort the task and leave a comment explaining the issue. A bad merge commit in the git history is worse than leaving the PR with conflicts.`;
+
+            try {
+              let sessionUrl;
+              let isNewSession = false;
+              
+              if (hasExistingSession) {
+                console.log(`Sending message to existing session ${existingSessionId} for PR #${pr.number}`);
+                
+                const message = `PR #${pr.number} has merge conflicts that need to be resolved.
+
+            ${conflictResolutionInstructions}
+
+            Continue working on the same PR branch and push your fixes.`;
+                
+                const response = await fetch(`https://api.devin.ai/v1/sessions/${existingSessionId}/message`, {
+                  method: 'POST',
+                  headers: {
+                    'Authorization': `Bearer ${process.env.DEVIN_API_KEY}`,
+                    'Content-Type': 'application/json'
+                  },
+                  body: JSON.stringify({ message })
+                });
+                
+                if (!response.ok) {
+                  console.error(`Failed to send message to session ${existingSessionId}: ${response.status}`);
+                  throw new Error(`Failed to send message to existing session: ${response.status}`);
+                }
+                
+                sessionUrl = existingSessionUrl;
+                console.log(`Message sent to existing session for PR #${pr.number}`);
+              } else {
+                console.log(`Creating new Devin session for PR #${pr.number}`);
+                
+                const response = await fetch('https://api.devin.ai/v1/sessions', {
+                  method: 'POST',
+                  headers: {
+                    'Authorization': `Bearer ${process.env.DEVIN_API_KEY}`,
+                    'Content-Type': 'application/json'
+                  },
+                  body: JSON.stringify({
+                    prompt: conflictResolutionInstructions,
+                    title: `Resolve Conflicts: PR #${pr.number}`,
+                    tags: ['conflict-resolution', `pr-${pr.number}`]
+                  })
+                });
+                
+                if (!response.ok) {
+                  console.error(`Devin API error for PR #${pr.number}: ${response.status} ${response.statusText}`);
+                  throw new Error(`Failed to create Devin session: ${response.status}`);
+                }
+                
+                const data = await response.json();
+                sessionUrl = data.url || data.session_url;
+                isNewSession = true;
+              }
+              
+              if (sessionUrl) {
+                if (isNewSession) {
+                  console.log(`Devin session created for PR #${pr.number}: ${sessionUrl}`);
+                }
+                
+                const sessionStatusMessage = isNewSession
+                  ? 'A Devin session has been created to automatically resolve them.'
+                  : 'The existing Devin session has been notified to resolve them.';
+                
+                const commentBody = `### Devin AI is resolving merge conflicts
+
+            This PR has merge conflicts with the \`${pr.base_ref}\` branch. ${sessionStatusMessage}
+
+            [View Devin Session](${sessionUrl})
+
+            Devin will:
+            1. Merge the latest \`${pr.base_ref}\` into this branch
+            2. Resolve any conflicts intelligently
+            3. Run lint/type checks to ensure validity
+            4. Push the resolved changes
+
+            If you prefer to resolve conflicts manually, you can close the Devin session and handle it yourself.`;
+                
+                await github.rest.issues.createComment({
+                  owner,
+                  repo,
+                  issue_number: pr.number,
+                  body: commentBody
+                });
+                
+                console.log(`Posted comment to PR #${pr.number}`);
+              } else {
+                throw new Error(`Failed to get session URL for PR #${pr.number}`);
+              }
+            } catch (error) {
+              console.error(`Error handling Devin session for PR #${pr.number}: ${error.message}`);
+              core.setFailed(error.message);
+            }
@@ -0,0 +1,38 @@
+# This is just to test this file
+name: Build
+
+on:
+  workflow_call:
+
+jobs:
+  build:
+    name: Build Docs
+    permissions:
+      contents: read
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: .github
+      - uses: ./.github/actions/cache-checkout
+      - name: Cache Docs build
+        uses: actions/cache@v4
+        id: cache-docs-build
+        env:
+          cache-name: docs-build
+          key-1: ${{ hashFiles('yarn.lock') }}
+          key-2: ${{ hashFiles('docs/**.*', '!**/node_modules') }}
+        with:
+          path: |
+            **/docs/**
+          key: ${{ env.cache-name }}-${{ env.key-1 }}-${{ env.key-2 }}
+      - name: Run build
+        if: steps.cache-docs-build.outputs.cache-hit != 'true'
+        working-directory: docs
+        run: |
+          export NODE_OPTIONS="--max_old_space_size=8192"
+          npm install -g mintlify@4.2.87
+          mintlify dev &
+          sleep 5 # Let it run for 5 seconds
+          kill $!
+        shell: bash
@@ -91,9 +91,10 @@ jobs:
          # Write to the specific paths
          echo "$CONTENT" > apps/web/trigger.version.ts
          echo "$CONTENT" > apps/api/v2/trigger.version.ts
+          echo "$CONTENT" > apps/api/v1/trigger.version.js
    
          # Force add to git since these are likely in .gitignore
-          git add -f apps/web/trigger.version.ts apps/api/v2/trigger.version.ts
+          git add -f apps/web/trigger.version.ts apps/api/v2/trigger.version.ts apps/api/v1/trigger.version.js

      # 4. Commit everything together
      - name: Commit changes
@@ -33,10 +33,10 @@ jobs:
  e2e:
    timeout-minutes: 20
    name: E2E API v2 (${{ matrix.shard }}/${{ strategy.job-total }})
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
    services:
      postgres:
-        image: postgres:18
+        image: postgres:13
        credentials:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -45,10 +45,10 @@ jobs:
  e2e-app-store:
    timeout-minutes: 20
    name: E2E App Store
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
    services:
      postgres:
-        image: postgres:18
+        image: postgres:13
        credentials:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -22,7 +22,7 @@ jobs:
  e2e-atoms:
    timeout-minutes: 15
    name: E2E Atoms
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
    steps:
      - uses: docker/login-action@v3
        with:
@@ -45,10 +45,10 @@ jobs:
  e2e-embed:
    timeout-minutes: 20
    name: E2E Embed React
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
    services:
      postgres:
-        image: postgres:18
+        image: postgres:13
        credentials:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -45,10 +45,10 @@ jobs:
  e2e-embed:
    timeout-minutes: 20
    name: E2E Embed Core
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
    services:
      postgres:
-        image: postgres:18
+        image: postgres:13
        credentials:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -45,10 +45,10 @@ jobs:
  e2e:
    timeout-minutes: 20
    name: E2E (${{ matrix.shard }}/${{ strategy.job-total }})
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
    services:
      postgres:
-        image: postgres:18
+        image: postgres:13
        credentials:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -10,8 +10,7 @@ concurrency:
 jobs:
  i18n:
    name: Run i18n
-    if: ${{ secrets.CI_LINGO_DOT_DEV_API_KEY != '' }}
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
    permissions:
      actions: write
      contents: write
@@ -30,7 +29,7 @@ jobs:
        with:
          node-version: 20
          cache: 'npm'
-      - uses: lingodotdev/lingo.dev@cee3eb86550ca4905fc99fe90786fb7523288a61 # main
+      - uses: lingodotdev/lingo.dev@main
        env:
          GH_TOKEN: ${{ steps.generate-token.outputs.token }}
        with:
@@ -45,10 +45,10 @@ jobs:
  integration:
    timeout-minutes: 20
    name: Integration
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
    services:
      postgres:
-        image: postgres:18
+        image: postgres:13
        credentials:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -6,7 +6,7 @@ permissions:
  contents: read
 jobs:
  lint:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404

    steps:
      - uses: actions/checkout@v4
@@ -12,7 +12,7 @@ permissions:
 jobs:
  annotate:
    if: always()
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
    steps:
      - uses: actions/checkout@v4
      - uses: ./.github/actions/yarn-install
@@ -49,7 +49,7 @@ env:
 jobs:
  analyze:
    if: always()
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4
@@ -72,11 +72,7 @@ jobs:
          path: apps/web/.next/analyze/__bundle_analysis.json

      - name: Delete cached build
-        continue-on-error: true
-        run: |
-          gh extension install actions/gh-actions-cache
-          for key in $(gh actions-cache list -R ${{ github.repository }} --key "prod-build-main-" --limit 100 | cut -f1); do
-            gh actions-cache delete "$key" -R ${{ github.repository }} --confirm
-          done
-        env:
-          GH_TOKEN: ${{ github.token }}
+        uses: useblacksmith/cache-delete@v1
+        with:
+          key: prod-build-main-
+          prefix: "true"
@@ -1,48 +0,0 @@
-name: "PR Welcome Bot"
-
-on:
-  pull_request_target:
-    types:
-      - opened
-
-permissions:
-  pull-requests: write
-
-jobs:
-  welcome:
-    name: Welcome new contributors
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/github-script@v7
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            const pr = context.payload.pull_request;
-
-            // Skip PRs from org members and bots
-            if (
-              ["MEMBER", "OWNER", "COLLABORATOR"].includes(pr.author_association) ||
-              pr.user.type === "Bot"
-            ) {
-              console.log(`Skipping — author association: ${pr.author_association}, type: ${pr.user.type}`);
-              return;
-            }
-
-            const body = [
-              `Welcome to **Cal.diy**, @${pr.user.login}! Thanks for opening this pull request.`,
-              "",
-              "A few things to keep in mind:",
-              "",
-              "- **This is Cal.diy, not Cal.com.** Cal.diy is a community-driven, fully open-source fork of Cal.com licensed under MIT. Your changes here will be part of Cal.diy — they will **not** be deployed to the Cal.com production app.",
-              "- Please review our [Contributing Guidelines](https://github.com/calcom/cal.diy/blob/main/CONTRIBUTING.md) if you haven't already.",
-              "- Make sure your PR title follows the [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) format.",
-              "",
-              "A maintainer will review your PR soon. Thanks for contributing!",
-            ].join("\n");
-
-            await github.rest.issues.createComment({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: pr.number,
-              body,
-            });
@@ -23,7 +23,7 @@ jobs:
  # This MUST run before any job that checks out PR code and executes it with secrets
  trust-check:
    name: Trust Check
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
    permissions:
      pull-requests: read
      actions: read
@@ -162,13 +162,14 @@ jobs:
    name: Prepare
    needs: [trust-check]
    if: needs.trust-check.outputs.is-trusted == 'true'
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
    permissions:
      pull-requests: read
    outputs:
      has-files-requiring-all-checks: ${{ steps.filter-exclusions.outputs.has-files-requiring-all-checks }}
      has-api-v2-changes: ${{ steps.filter-inclusions.outputs.has-api-v2-changes }}
      has-prisma-changes: ${{ steps.filter-inclusions.outputs.has-prisma-changes }}
+      has-agents-changes: ${{ steps.filter-inclusions.outputs.has-agents-changes }}
      commit-sha: ${{ steps.get_sha.outputs.commit-sha }}
      run-e2e: ${{ steps.check-if-pr-has-label.outputs.run-e2e == 'true' }}
      db-cache-hit: ${{ steps.cache-db-check.outputs.cache-hit }}
@@ -208,6 +209,8 @@ jobs:
        id: filter-inclusions
        with:
          filters: |
+            has-agents-changes:
+              - "agents/**"
            has-api-v2-changes:
              - "apps/api/v2/**"
              - "packages/platform-constants/**"
@@ -217,6 +220,7 @@ jobs:
              - "packages/platform-libraries/**"
              - "packages/trpc/**"
              - "packages/prisma/schema.prisma"
+              - "docs/api-reference/v2/**"
            has-prisma-changes:
              - "packages/prisma/schema.prisma"
              - "packages/prisma/migrations/**"
@@ -293,6 +297,13 @@ jobs:
        with:
          skip-install-if-cache-hit: "true"

+  validate-agents-format:
+    name: Validate agents/ format
+    needs: [trust-check, prepare]
+    if: needs.trust-check.outputs.is-trusted == 'true' && needs.prepare.outputs.has-agents-changes == 'true' && github.event.pull_request
+    uses: ./.github/workflows/validate-agents-format.yml
+    secrets: inherit
+
  type-check:
    name: Type Checks
    needs: [prepare]
@@ -344,6 +355,13 @@ jobs:
      DB_CACHE_HIT: ${{ needs.prepare.outputs.db-cache-hit }}
    secrets: inherit

+  build-api-v1:
+    name: Production builds
+    needs: [prepare, setup-db]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
+    uses: ./.github/workflows/api-v1-production-build.yml
+    secrets: inherit
+
  build-api-v2:
    name: Production builds
    needs: [prepare]
@@ -358,6 +376,13 @@ jobs:
    uses: ./.github/workflows/atoms-production-build.yml
    secrets: inherit

+  build-docs:
+    name: Production builds
+    needs: [prepare]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-files-requiring-all-checks == 'true' }}
+    uses: ./.github/workflows/docs-build.yml
+    secrets: inherit
+
  build:
    name: Production builds
    needs: [prepare]
@@ -379,6 +404,13 @@ jobs:
    uses: ./.github/workflows/e2e.yml
    secrets: inherit

+  check-api-v2-breaking-changes:
+    name: Check API v2 breaking changes
+    needs: [prepare]
+    if: ${{ needs.prepare.outputs.run-e2e == 'true' && needs.prepare.outputs.has-api-v2-changes == 'true' }}
+    uses: ./.github/workflows/check-api-v2-breaking-changes.yml
+    secrets: inherit
+
  e2e-api-v2:
    name: Tests
    needs: [prepare, setup-db]
@@ -418,16 +450,20 @@ jobs:
      [
        trust-check,
        prepare,
+        validate-agents-format,
        lint,
        type-check,
        unit-test,
        api-v2-unit-test,
        security-audit,
+        check-api-v2-breaking-changes,
        check-prisma-migrations,
        integration-test,
        build,
+        build-api-v1,
        build-api-v2,
        build-atoms,
+        build-docs,
        setup-db,
        e2e,
        e2e-api-v2,
@@ -436,7 +472,7 @@ jobs:
        e2e-app-store,
      ]
    if: always()
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
    steps:
      - name: Fail if trust-check did not succeed
        run: |
@@ -460,10 +496,13 @@ jobs:
            needs.unit-test.result != 'success' ||
            needs.api-v2-unit-test.result != 'success' ||
            needs.security-audit.result != 'success' ||
+            (needs.prepare.outputs.has-api-v2-changes == 'true' && needs.check-api-v2-breaking-changes.result != 'success') ||
            (needs.prepare.outputs.has-prisma-changes == 'true' && needs.check-prisma-migrations.result != 'success') ||
              needs.build.result != 'success' ||
+              needs.build-api-v1.result != 'success' ||
              needs.build-api-v2.result != 'success' ||
              needs.build-atoms.result != 'success' ||
+              needs.build-docs.result != 'success' ||
              needs.setup-db.result != 'success' ||
              needs.integration-test.result != 'success' ||
              needs.e2e.result != 'success' ||
@@ -472,4 +511,8 @@ jobs:
              needs.e2e-embed-react.result != 'success' ||
              needs.e2e-app-store.result != 'success'
            )
+          ) ||
+          (
+            needs.prepare.outputs.has-agents-changes == 'true' &&
+            needs.validate-agents-format.result != 'success'
          )
@@ -39,7 +39,7 @@ env:
 jobs:
  build:
    name: Build Web App
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4
@@ -66,12 +66,8 @@ jobs:
          lookup-only: true
      - name: Delete old production build caches for this branch
        if: steps.cache-check.outputs.cache-hit != 'true'
-        continue-on-error: true
-        run: |
-          gh extension install actions/gh-actions-cache
-          for key in $(gh actions-cache list -R ${{ github.repository }} --key "prod-build-${{ github.head_ref || github.ref_name }}" --limit 100 | cut -f1); do
-            gh actions-cache delete "$key" -R ${{ github.repository }} --confirm
-          done
-        env:
-          GH_TOKEN: ${{ github.token }}
+        uses: useblacksmith/cache-delete@v1
+        with:
+          key: prod-build-${{ github.head_ref || github.ref_name }}
+          prefix: "true"
      - uses: ./.github/actions/cache-build
@@ -32,7 +32,7 @@ on:
 jobs:
  prepare:
    name: "Prepare Release"
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
    outputs:
      release_tag: ${{ steps.determine-tag.outputs.release_tag }}
      checkout_ref: ${{ steps.determine-tag.outputs.checkout_ref }}
@@ -81,7 +81,7 @@ jobs:
  release-amd64:
    name: "Release AMD64"
    needs: prepare
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
    env:
      RELEASE_TAG: ${{ needs.prepare.outputs.release_tag }}
    steps:
@@ -106,7 +106,7 @@ jobs:
          use-as-latest: "true"

      - name: Notify Slack on Success
-        if: success() && secrets.CI_SLACK_WEBHOOK_URL != ''
+        if: success()
        uses: slackapi/slack-github-action@v1.24.0
        with:
          payload: |
@@ -117,7 +117,7 @@ jobs:
          SLACK_WEBHOOK_URL: ${{ secrets.CI_SLACK_WEBHOOK_URL }}

      - name: Notify Slack on Failure
-        if: failure() && secrets.CI_SLACK_WEBHOOK_URL != ''
+        if: failure()
        uses: slackapi/slack-github-action@v1.24.0
        with:
          payload: |
@@ -154,7 +154,7 @@ jobs:
          push-image: ${{ (github.event_name == 'push' || inputs.PUSH_IMAGE) && 'true' || 'false' }}

      - name: Notify Slack on Success
-        if: success() && secrets.CI_SLACK_WEBHOOK_URL != ''
+        if: success()
        uses: slackapi/slack-github-action@v1.24.0
        with:
          payload: |
@@ -165,7 +165,7 @@ jobs:
          SLACK_WEBHOOK_URL: ${{ secrets.CI_SLACK_WEBHOOK_URL }}

      - name: Notify Slack on Failure
-        if: failure() && secrets.CI_SLACK_WEBHOOK_URL != ''
+        if: failure()
        uses: slackapi/slack-github-action@v1.24.0
        with:
          payload: |
@@ -72,26 +72,11 @@ jobs:
            if (latestRun.status === 'in_progress' || latestRun.status === 'queued') {
              console.log(`Workflow is running (status: ${latestRun.status}). Cancelling it first...`);

-              const cancelMaxRetries = 10;
-              const cancelRetryDelay = 3000;
-              for (let attempt = 1; attempt <= cancelMaxRetries; attempt++) {
-                try {
-                  await github.rest.actions.cancelWorkflowRun({
-                    owner: context.repo.owner,
-                    repo: context.repo.repo,
-                    run_id: latestRun.id,
-                  });
-                  console.log(`Cancel request accepted on attempt ${attempt}`);
-                  break;
-                } catch (err) {
-                  if (err.status === 409 && attempt < cancelMaxRetries) {
-                    console.log(`Cancel attempt ${attempt} got 409 (not yet cancellable), retrying in ${cancelRetryDelay / 1000}s...`);
-                    await new Promise(resolve => setTimeout(resolve, cancelRetryDelay));
-                  } else {
-                    throw err;
-                  }
-                }
-              }
+              await github.rest.actions.cancelWorkflowRun({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                run_id: latestRun.id,
+              });

              // Wait for the workflow to be cancelled (poll with timeout)
              const maxWaitTime = 60000; // 60 seconds
@@ -6,7 +6,7 @@ permissions:
  contents: read
 jobs:
  audit:
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-2vcpu-ubuntu-2404
    steps:
      - uses: actions/checkout@v4
        with:
@@ -26,11 +26,11 @@ env:
 jobs:
  setup-db:
    name: Setup Database
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
    timeout-minutes: 15
    services:
      postgres:
-        image: postgres:18
+        image: postgres:13
        credentials:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -0,0 +1,291 @@
+name: Stale Community PR Devin Completion
+
+on:
+  pull_request_target:
+    types: [labeled]
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: 'PR number to complete'
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  complete-stale-pr:
+    name: Trigger Devin to Complete Stale Community PR
+    # For labeled events: only run if 'Stale' or 'devin-finish-pr' label was added
+    # For workflow_dispatch: always run (we'll validate the PR in the steps)
+    if: >
+      github.event_name == 'workflow_dispatch' ||
+      github.event.label.name == 'Stale' ||
+      github.event.label.name == 'devin-finish-pr'
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    steps:
+      - name: Get PR details
+        id: pr
+        uses: actions/github-script@v7
+        env:
+          INPUT_PR_NUMBER: ${{ inputs.pr_number }}
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            let prNumber;
+            let pr;
+
+            if (context.eventName === 'workflow_dispatch') {
+              const inputPrNumber = process.env.INPUT_PR_NUMBER;
+              prNumber = parseInt(inputPrNumber, 10);
+              if (isNaN(prNumber) || prNumber <= 0) {
+                core.setFailed(`Invalid PR number provided: "${inputPrNumber}". Please enter a valid PR number.`);
+                return;
+              }
+              const { data } = await github.rest.pulls.get({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                pull_number: prNumber
+              });
+              pr = data;
+            } else {
+              pr = context.payload.pull_request;
+              prNumber = pr.number;
+            }
+
+            if (!pr.head.repo) {
+              core.setFailed('Cannot complete this PR: the source repository (fork) has been deleted.');
+              return;
+            }
+
+            const isFork = pr.head.repo.fork || pr.head.repo.full_name !== pr.base.repo.full_name;
+            const maintainerCanModify = pr.maintainer_can_modify;
+            const needsMaintainerAccess = isFork && !maintainerCanModify;
+
+            const headRepoFullName = pr.head.repo.full_name;
+            const headRepoCloneUrl = pr.head.repo.clone_url;
+
+            core.setOutput('pr_number', prNumber);
+            core.setOutput('pr_title', pr.title);
+            core.setOutput('pr_author', pr.user.login);
+            core.setOutput('pr_branch', pr.head.ref);
+            core.setOutput('is_fork', isFork);
+            core.setOutput('head_repo_full_name', headRepoFullName);
+            core.setOutput('head_repo_clone_url', headRepoCloneUrl);
+            core.setOutput('maintainer_can_modify', maintainerCanModify);
+            core.setOutput('needs_maintainer_access', needsMaintainerAccess);
+
+            console.log(`PR #${prNumber}: "${pr.title}"`);
+            console.log(`Author: ${pr.user.login}`);
+            console.log(`Branch: ${pr.head.ref}`);
+            console.log(`Is fork: ${isFork}`);
+            console.log(`Head repo: ${headRepoFullName}`);
+            console.log(`Maintainer can modify: ${maintainerCanModify}`);
+            console.log(`Needs maintainer access: ${needsMaintainerAccess}`);
+
+      - name: Request maintainer access for fork PR
+        if: steps.pr.outputs.needs_maintainer_access == 'true'
+        uses: actions/github-script@v7
+        env:
+          PR_NUMBER: ${{ steps.pr.outputs.pr_number }}
+          PR_AUTHOR: ${{ steps.pr.outputs.pr_author }}
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const prNumber = parseInt(process.env.PR_NUMBER);
+            const prAuthor = process.env.PR_AUTHOR;
+            const { owner, repo } = context.repo;
+
+            const comments = await github.rest.issues.listComments({
+              owner,
+              repo,
+              issue_number: prNumber
+            });
+
+            const alreadyRequested = comments.data.some(comment => 
+              comment.body?.includes('### Maintainer Access Needed')
+            );
+
+            if (!alreadyRequested) {
+              const commentBody = [
+                '### Maintainer Access Needed',
+                '',
+                `Hi @${prAuthor}! Thanks for your contribution to Cal.com.`,
+                '',
+                `We'd like to help complete this stale PR, but we noticed that "Allow edits from maintainers" isn't enabled. We need this setting to push updates to your PR branch.`,
+                '',
+                '**Could you please enable this setting?** Here\'s how:',
+                '1. Scroll down to the bottom of this PR page',
+                '2. In the right sidebar, check the box that says **"Allow edits and access to secrets by maintainers"**',
+                '',
+                'This allows us to push commits directly to your PR branch, which helps us:',
+                '- Complete any remaining work on your PR',
+                '- Fix merge conflicts and make small adjustments',
+                '- Get your contribution merged faster',
+                '',
+                'Once you\'ve enabled this setting, we\'ll be able to help finish up this PR. If you have any concerns about enabling this setting, feel free to let us know!'
+              ].join('\n');
+
+              await github.rest.issues.createComment({
+                owner,
+                repo,
+                issue_number: prNumber,
+                body: commentBody
+              });
+
+              console.log(`Posted maintainer access request comment on PR #${prNumber}`);
+            } else {
+              console.log(`Maintainer access already requested on PR #${prNumber}`);
+            }
+
+            core.setFailed(`Cannot complete this fork PR: the fork owner has not enabled "Allow edits from maintainers". A comment has been posted requesting access.`);
+
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Check for existing Devin session
+        id: check-session
+        uses: ./.github/actions/devin-session
+        with:
+          devin-api-key: ${{ secrets.DEVIN_API_KEY }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          pr-number: ${{ steps.pr.outputs.pr_number }}
+
+      - name: Create or reuse Devin session
+        env:
+          DEVIN_API_KEY: ${{ secrets.DEVIN_API_KEY }}
+          PR_NUMBER: ${{ steps.pr.outputs.pr_number }}
+          PR_TITLE: ${{ steps.pr.outputs.pr_title }}
+          PR_AUTHOR: ${{ steps.pr.outputs.pr_author }}
+          PR_BRANCH: ${{ steps.pr.outputs.pr_branch }}
+          IS_FORK: ${{ steps.pr.outputs.is_fork }}
+          HEAD_REPO_FULL_NAME: ${{ steps.pr.outputs.head_repo_full_name }}
+          REPO_NAME: ${{ github.repository }}
+          HAS_EXISTING_SESSION: ${{ steps.check-session.outputs.has-existing-session }}
+          EXISTING_SESSION_ID: ${{ steps.check-session.outputs.session-id }}
+          EXISTING_SESSION_URL: ${{ steps.check-session.outputs.session-url }}
+        run: |
+          if [ "$IS_FORK" = "true" ]; then
+            CLONE_INSTRUCTIONS="This is a fork PR. Clone from the fork repository: ${HEAD_REPO_FULL_NAME}
+
+          To check out this PR:
+          1. Clone the fork: git clone https://github.com/${HEAD_REPO_FULL_NAME}.git
+          2. Check out the branch: git checkout ${PR_BRANCH}
+          3. Add the upstream remote: git remote add upstream https://github.com/${REPO_NAME}.git
+
+          IMPORTANT - Pushing to Fork PRs:
+          Since this is a fork PR, you need to use the DEVIN_ACTIONS_PAT secret for authentication when pushing. Configure git to use this PAT for authentication before pushing your changes to the fork."
+          else
+            CLONE_INSTRUCTIONS="Clone the repository ${REPO_NAME} and check out the branch: ${PR_BRANCH}"
+          fi
+
+          FULL_PROMPT="You are completing a stale community PR #${PR_NUMBER} in repository ${REPO_NAME}.
+
+          This PR was started by @${PR_AUTHOR} but has become stale. Your job is to complete it.
+
+          PR Title: ${PR_TITLE}
+          PR Branch: ${PR_BRANCH}
+
+          ${CLONE_INSTRUCTIONS}
+
+          Your tasks:
+          1. Clone the repository as described above.
+          2. Check out the PR branch: ${PR_BRANCH}
+          3. Review the current state of the PR and understand what it's trying to accomplish.
+          4. Read the PR description and any comments/review feedback on the PR.
+          5. Complete any unfinished work on the PR:
+             - Fix any issues mentioned in review comments
+             - Ensure the code follows the repository's coding standards
+             - Add any missing tests if applicable
+             - Fix any linting or type errors
+          6. Run the appropriate checks (lint, type-check, tests) to ensure the PR is ready for review.
+          7. Commit your changes with clear commit messages.
+          8. Push your changes to the PR branch.
+          9. After successfully pushing, remove the 'Stale' or 'devin-finish-pr' label from the PR (whichever was used to trigger this workflow).
+          10. Post a summary comment on the PR explaining what you completed.
+          11. Mark the PR as ready for review if applicable.
+
+          Rules and Guidelines:
+          1. Respect the original author's intent and approach - don't rewrite the PR from scratch.
+          2. Make minimal, focused changes that complete the PR's original goal.
+          3. Follow the existing code style and conventions in the repository.
+          4. If the PR's original approach seems fundamentally flawed, explain why in a comment instead of making major changes.
+          5. Never ask for user confirmation. Never wait for user messages.
+          6. Credit the original author in your commit messages where appropriate.
+          7. CRITICAL: If this is a fork PR and you encounter ANY error when pushing (permission denied, authentication failure, etc.) even after using the DEVIN_ACTIONS_PAT, you MUST fail the task immediately. Do NOT attempt to push to a new branch in the main repository as a workaround. Simply report the error and stop."
+
+          if [ "$HAS_EXISTING_SESSION" = "true" ]; then
+            echo "Sending message to existing session ${EXISTING_SESSION_ID}"
+
+            MESSAGE="This PR has been marked as stale and needs to be completed.
+
+          ${FULL_PROMPT}
+
+          Continue working on the same PR branch and push your fixes."
+
+            HTTP_CODE=$(curl -s -o /tmp/devin-response.json -w "%{http_code}" -X POST "https://api.devin.ai/v1/sessions/${EXISTING_SESSION_ID}/message" \
+              -H "Authorization: Bearer ${DEVIN_API_KEY}" \
+              -H "Content-Type: application/json" \
+              -d "$(jq -n --arg message "$MESSAGE" '{message: $message}')")
+
+            if [ "$HTTP_CODE" -lt 200 ] || [ "$HTTP_CODE" -ge 300 ]; then
+              echo "Failed to send message to Devin session: HTTP $HTTP_CODE"
+              cat /tmp/devin-response.json
+              exit 1
+            fi
+
+            echo "Message sent to existing session successfully"
+            echo "SESSION_URL=$EXISTING_SESSION_URL" >> $GITHUB_ENV
+            echo "IS_NEW_SESSION=false" >> $GITHUB_ENV
+          else
+            echo "Creating new Devin session"
+
+            RESPONSE=$(curl -s -X POST "https://api.devin.ai/v1/sessions" \
+              -H "Authorization: Bearer ${DEVIN_API_KEY}" \
+              -H "Content-Type: application/json" \
+              -d "$(jq -n \
+                --arg prompt "$FULL_PROMPT" \
+                --arg title "Complete Stale PR #${PR_NUMBER}: ${PR_TITLE}" \
+                '{
+                  prompt: $prompt,
+                  title: $title,
+                  tags: ["stale-pr-completion", "pr-'${PR_NUMBER}'"]
+                }')")
+
+            SESSION_URL=$(echo "$RESPONSE" | jq -r '.url // .session_url // empty')
+            if [ -n "$SESSION_URL" ]; then
+              echo "Devin session created: $SESSION_URL"
+              echo "SESSION_URL=$SESSION_URL" >> $GITHUB_ENV
+              echo "IS_NEW_SESSION=true" >> $GITHUB_ENV
+            else
+              echo "Failed to create Devin session"
+              echo "$RESPONSE"
+              exit 1
+            fi
+          fi
+
+      - name: Post comment with Devin session link
+        if: env.SESSION_URL != ''
+        uses: actions/github-script@v7
+        env:
+          PR_AUTHOR: ${{ steps.pr.outputs.pr_author }}
+          PR_NUMBER: ${{ steps.pr.outputs.pr_number }}
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const sessionUrl = process.env.SESSION_URL;
+            const prAuthor = process.env.PR_AUTHOR;
+            const prNumber = process.env.PR_NUMBER;
+            const isNewSession = process.env.IS_NEW_SESSION === 'true';
+
+            const message = isNewSession
+              ? `### Devin AI is completing this stale PR\n\nThis PR by @${prAuthor} has been marked as stale. A Devin session has been created to complete the remaining work.\n\n[View Devin Session](${sessionUrl})\n\n---\n*Devin will review the PR, address any feedback, and push updates to complete this PR.*`
+              : `### Devin AI is completing this stale PR\n\nThis PR by @${prAuthor} has been marked as stale. The existing Devin session has been notified to complete the remaining work.\n\n[View Devin Session](${sessionUrl})\n\n---\n*Devin will review the PR, address any feedback, and push updates to complete this PR.*`;
+
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: parseInt(prNumber),
+              body: message
+            });
@@ -0,0 +1,31 @@
+name: Sync Agents to Devin Knowledge
+
+on:
+  push:
+    paths:
+      - "agents/**"
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  sync:
+    if: false
+    name: Sync to Devin Knowledge
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: .github
+      - uses: ./.github/actions/cache-checkout
+      - uses: ./.github/actions/yarn-install
+
+      - name: Generate knowledge JSON
+        run: npx tsx scripts/devin/parse-local-knowledge.ts
+
+      - name: Sync to Devin
+        env:
+          DEVIN_API_KEY: ${{ secrets.DEVIN_API_KEY }}
+        run: npx tsx scripts/devin/sync-knowledge-to-devin.ts
@@ -9,7 +9,7 @@ jobs:
  test:
    name: Unit
    timeout-minutes: 20
-    runs-on: ubuntu-latest
+    runs-on: blacksmith-4vcpu-ubuntu-2404
    steps:
      - uses: actions/checkout@v4
        with:
@@ -0,0 +1,20 @@
+name: Validate Agents Format
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  validate-agents-format:
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: .github
+      - uses: ./.github/actions/cache-checkout
+      - uses: ./.github/actions/yarn-install
+
+      - name: Validate format
+        run: npx tsx scripts/devin/validate-local-knowledge.ts
@@ -114,6 +114,3 @@ specs/**/_drafts/
 # trigger.dev
 .trigger
 agents/devin-knowledge.json
-
-# pagefind
-_pagefind/
@@ -52,7 +52,7 @@ export default defineConfig({
          access_token: c.uuid(row.access_token),
          expires_at: c.int(row.expires_at, {
            min: 0,
-            max: 4 ** 8 - 1,
+            max: Math.pow(4, 8) - 1,
          }),
          token_type: c.uuid(row.token_type),
          id_token: c.uuid(row.id_token),
@@ -148,7 +148,7 @@ export default defineConfig({
        return {
          amount: c.int(row.amount, {
            min: 0,
-            max: 4 ** 8 - 1,
+            max: Math.pow(4, 8) - 1,
          }),
          currency: c.sentence(row.currency),
          data: {
@@ -188,7 +188,7 @@ export default defineConfig({
          id: c
            .int(row.id, {
              min: 1,
-              max: 4 ** 8 - 1,
+              max: Math.pow(4, 8) - 1,
            })
            .toString(),
          identifier: c.uuid(row.identifier),
@@ -215,6 +215,24 @@ export default defineConfig({
          payload: c.password(row.payload),
        };
      },
+      WorkflowStep({ row }) {
+        return {
+          sendTo: c.oneOf(row.sendTo, [
+            "Man",
+            "Woman",
+            "Transgender",
+            "Non-binary/non-conforming",
+            "Not specified",
+          ]),
+          sender: c.oneOf(row.sender, [
+            "Man",
+            "Woman",
+            "Transgender",
+            "Non-binary/non-conforming",
+            "Not specified",
+          ]),
+        };
+      },
      users: ({ row }) =>
        row.role !== "ADMIN"
          ? {
@@ -1,4 +1,4 @@
 Contact: security@cal.com
 Preferred-Languages: en
 Canonical: https://cal.com/.well-known/security.txt
-Policy: https://github.com/calcom/cal.diy/security/policy
+Policy: https://github.com/calcom/cal.com/security/policy
@@ -4,4 +4,10 @@ enableGlobalCache: false

 nodeLinker: node-modules

+# fast-xml-parser 4.4.1 via @boxyhq/saml-jackson → @aws-sdk/core@3.816.0 (transitive).
+# Only parses trusted AWS API responses, not user input. No practical attack vector.
+# Upstream fix pending: ory/polis (saml-jackson) has bumped to @aws-sdk@3.994.0 on main but hasn't released yet.
+npmAuditIgnoreAdvisories:
+  - "1113407"
+
 yarnPath: .yarn/releases/yarn-4.12.0.cjs
@@ -1,6 +1,6 @@
-# Cal.diy Development Guide for AI Agents
+# Cal.com Development Guide for AI Agents

-You are a senior Cal.diy engineer working in a Yarn/Turbo monorepo. You prioritize type safety, security, and small, reviewable diffs.
+You are a senior Cal.com engineer working in a Yarn/Turbo monorepo. You prioritize type safety, security, and small, reviewable diffs.

 ## Do

@@ -1 +1 @@
-AGENTS.md
+agents.md
@@ -1,6 +1,4 @@
-# Contributing to Cal.diy
-
-> **Important:** Cal.diy is a community-driven, open-source fork of Cal.com. Contributions made here **do not** get merged into Cal.com's production service — Cal.com is now closed-source. This repo is maintained independently by the community under the MIT license.
+# Contributing to Cal.com

 Contributions are what make the open source community such an amazing place to learn, inspire, and create. Any contributions you make are **greatly appreciated**.

@@ -8,7 +6,7 @@ Contributions are what make the open source community such an amazing place to l

 ### 👥 Prevent Work Duplication

-Before submitting a new issue or PR, check if it already exists in the [Issues](https://github.com/calcom/cal.diy/issues) or [Pull Requests](https://github.com/calcom/cal.diy/pulls).
+Before submitting a new issue or PR, check if it already exists in the [Issues](https://github.com/calcom/cal.com/issues) or [Pull Requests](https://github.com/calcom/cal.com/pulls).

 ### ✅ Work Only on Approved Issues

@@ -66,7 +64,7 @@ Write with the future in mind. If there are trade-offs, edge cases, or temporary
  <tr>
    <td>Minor improvements, non-core feature requests</td>
    <td>
-      <a href="https://github.com/calcom/cal.diy/issues?q=is:issue+is:open+sort:updated-desc+label:%22Low+priority%22">
+      <a href="https://github.com/calcom/cal.com/issues?q=is:issue+is:open+sort:updated-desc+label:%22Low+priority%22">
        <img src="https://img.shields.io/badge/-Low%20Priority-green">
      </a>
    </td>
@@ -74,7 +72,7 @@ Write with the future in mind. If there are trade-offs, edge cases, or temporary
  <tr>
    <td>Confusing UX (but still functional)</td>
    <td>
-      <a href="https://github.com/calcom/cal.diy/issues?q=is:issue+is:open+sort:updated-desc+label:%22Medium+priority%22">
+      <a href="https://github.com/calcom/cal.com/issues?q=is:issue+is:open+sort:updated-desc+label:%22Medium+priority%22">
        <img src="https://img.shields.io/badge/-Medium%20Priority-yellow">
      </a>
    </td>
@@ -82,7 +80,7 @@ Write with the future in mind. If there are trade-offs, edge cases, or temporary
  <tr>
    <td>Core Features (Booking page, availability, timezone calculation)</td>
    <td>
-      <a href="https://github.com/calcom/cal.diy/issues?q=is:issue+is:open+sort:updated-desc+label:%22High+priority%22">
+      <a href="https://github.com/calcom/cal.com/issues?q=is:issue+is:open+sort:updated-desc+label:%22High+priority%22">
        <img src="https://img.shields.io/badge/-High%20Priority-orange">
      </a>
    </td>
@@ -90,7 +88,7 @@ Write with the future in mind. If there are trade-offs, edge cases, or temporary
  <tr>
    <td>Core Bugs (Login, Booking page, Emails not working)</td>
    <td>
-      <a href="https://github.com/calcom/cal.diy/issues?q=is:issue+is:open+sort:updated-desc+label:Urgent">
+      <a href="https://github.com/calcom/cal.com/issues?q=is:issue+is:open+sort:updated-desc+label:Urgent">
        <img src="https://img.shields.io/badge/-Urgent-red">
      </a>
    </td>
@@ -150,7 +148,7 @@ export class HashedLinkService { ... }

 ## Developing

-[See README](https://github.com/calcom/cal.diy#development)
+[See README](https://github.com/calcom/cal.com#development)

 ## Building

@@ -168,7 +166,7 @@ More info on how to add new tests coming soon.

 ### Running Tests

-[See README](https://github.com/calcom/cal.diy#e2e-testing)
+[See README](https://github.com/calcom/cal.com#e2e-testing)

 #### Resolving Issues

@@ -1,21 +1,670 @@
-MIT License
-
 Copyright (c) 2020-present Cal.com, Inc.

-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
+Portions of this software are licensed as follows:

-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
+* All content that resides under https://github.com/calcom/cal.com/tree/main/packages/features/ee and 
+https://github.com/calcom/cal.com/tree/main/apps/api/v2/src/ee directory of this repository (Commercial License) is licensed under the license defined in "ee/LICENSE".
+* All third party components incorporated into the Cal.com Software are licensed under the original license provided by the owner of the applicable component.
+* Content outside of the above mentioned directories or restrictions above is available under the "AGPLv3" license as defined below.

-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published
+    by the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.
@@ -1,4 +1,4 @@
-# Cal.diy Permission Documentation
+# Cal.com Permission Documentation

 This document maps existing role-based permission checks to the new PBAC (Permission-Based Access Control) system's permission strings in the format `resource.action`.

@@ -4,7 +4,7 @@ Contact: [security@cal.com](mailto:security@cal.com)

 Based on [https://supabase.com/.well-known/security.txt](https://supabase.com/.well-known/security.txt)

-At Cal.diy, we consider the security of our systems a top priority. But no
+At Cal.com, we consider the security of our systems a top priority. But no
 matter how much effort we put into system security, there can still be
 vulnerabilities present.

@@ -23,7 +23,7 @@ better protect our clients and our systems.
 - Email spoofing
 - Missing DNSSEC, CAA, CSP headers
 - Lack of Secure or HTTP only flag on non-sensitive cookies
- Dead links
+- Deadlinks

 ## Please do the following

@@ -0,0 +1,105 @@
+import { test, expect } from "@playwright/test";
+
+test.describe("Org", () => {
+  // Because these pages involve next.config.js rewrites, it's better to test them on production
+  test.describe("Embeds - i.cal.com", () => {
+    test("Org Profile Page should be embeddable", async ({ page }) => {
+      const response = await page.goto("https://i.cal.com/embed");
+      expect(response?.status()).toBe(200);
+      await page.screenshot({ path: "screenshot.jpg" });
+      const body = await response?.text();
+      await expectPageToBeRenderedWithEmbedSsr(body);
+    });
+
+    test("Org User(Rick) Page should be embeddable", async ({ page }) => {
+      const response = await page.goto("https://i.cal.com/team-rick/embed");
+      expect(response?.status()).toBe(200);
+      await expect(page.locator("text=Used by Checkly")).toBeVisible();
+      const body = await response?.text();
+      await expectPageToBeRenderedWithEmbedSsr(body);
+    });
+
+    test("Org User Event(/team-rick/test-event) Page should be embeddable", async ({ page }) => {
+      const response = await page.goto("https://i.cal.com/team-rick/test-event/embed");
+      expect(response?.status()).toBe(200);
+      await expect(page.locator('[data-testid="decrementMonth"]')).toBeVisible();
+      await expect(page.locator('[data-testid="incrementMonth"]')).toBeVisible();
+      const body = await response?.text();
+      await expectPageToBeRenderedWithEmbedSsr(body);
+    });
+
+    test("Org Team Profile(/sales) page should be embeddable", async ({ page }) => {
+      const response = await page.goto("https://i.cal.com/sales/embed");
+      expect(response?.status()).toBe(200);
+      await expect(page.locator("text=Cal.com Sales")).toBeVisible();
+      const body = await response?.text();
+      await expectPageToBeRenderedWithEmbedSsr(body);
+    });
+
+    test("Org Team Event page(/sales/hippa) should be embeddable", async ({ page }) => {
+      const response = await page.goto("https://i.cal.com/sales/hipaa/embed");
+      expect(response?.status()).toBe(200);
+      await expect(page.locator('[data-testid="decrementMonth"]')).toBeVisible();
+      await expect(page.locator('[data-testid="incrementMonth"]')).toBeVisible();
+      const body = await response?.text();
+      await expectPageToBeRenderedWithEmbedSsr(body);
+    });
+  });
+
+  test.describe("Dynamic Group Booking", () => {
+    test("Dynamic Group booking link should load", async ({ page }) => {
+      const users = [
+        {
+          username: "peer",
+          name: "Peer Richelsen",
+        },
+        {
+          username: "bailey",
+          name: "Bailey Pumfleet",
+        },
+      ];
+      const response = await page.goto(`http://i.cal.com/${users[0].username}+${users[1].username}`);
+      expect(response?.status()).toBe(200);
+      expect(await page.locator('[data-testid="event-title"]').textContent()).toBe("Group Meeting");
+
+      expect(await page.locator('[data-testid="event-meta"]').textContent()).toContain(
+        "Join us for a meeting with multiple people"
+      );
+      expect((await page.locator('[data-testid="event-meta"] [data-testid="avatar"]').all()).length).toBe(2);
+    });
+  });
+
+  test("Organization Homepage - Has Engineering and Marketing Teams", async ({ page }) => {
+    const response = await page.goto("https://i.cal.com");
+    expect(response?.status()).toBe(200);
+    // Somehow there are two Cal.com text momentarily, but shouldn't be the concern of this check
+    await expect(page.locator("text=Cal.com").first()).toBeVisible();
+    await expect(page.locator("text=Engineering")).toBeVisible();
+    await expect(page.locator("text=Marketing")).toBeVisible();
+  });
+
+  test.describe("Browse the Engineering Team", async () => {
+    test("By User Navigation", async ({ page }) => {
+      const response = await page.goto("https://i.cal.com");
+      await page.waitForLoadState("networkidle");
+      expect(response?.status()).toBe(200);
+      await page.click('text="Engineering"');
+      await expect(page.locator("text=Cal.com Engineering")).toBeVisible();
+    });
+
+    test("By /team/engineering", async ({ page }) => {
+      await page.goto("https://i.cal.com/team/engineering");
+      await expect(page.locator("text=Cal.com Engineering")).toBeVisible();
+    });
+
+    test("By /engineering", async ({ page }) => {
+      await page.goto("https://i.cal.com/engineering");
+      await expect(page.locator("text=Cal.com Engineering")).toBeVisible();
+    });
+  });
+});
+
+// This ensures that the route is actually mapped to a page that is using withEmbedSsr
+async function expectPageToBeRenderedWithEmbedSsr(responseText: string | undefined) {
+  expect(responseText).toContain('\\"isEmbed\\":true');
+}
@@ -1,4 +1,4 @@
-# Cal.diy Agent Documentation Index
+# Cal.com Agent Documentation Index

 - **[../AGENTS.md](../AGENTS.md)** - Main guide (structure, tech stack, commands, examples)
 - **[commands.md](commands.md)** - Command reference
@@ -1,6 +1,6 @@
 # Knowledge Base - Domain & Product-Specific Information

-This file contains domain knowledge about the Cal.diy product and codebase. For coding guidelines and rules, see [`rules/`](rules/).
+This file contains domain knowledge about the Cal.com product and codebase. For coding guidelines and rules, see [`rules/`](rules/).

 ## When working with managed event types

@@ -52,9 +52,9 @@ Control logging verbosity by setting `NEXT_PUBLIC_LOGGER_LEVEL` in .env:
 - 5: error
 - 6: fatal

-### Cal.diy Event Identification
+### Cal.com Event Identification

-Cal.diy events in Google Calendar can be identified by checking if the iCalUID ends with `@Cal.diy` (e.g., `2GBXSdEixretciJfKVmYN8@Cal.diy`). This identifier is used to distinguish Cal.diy bookings from other calendar events for data storage and privacy purposes.
+Cal.com events in Google Calendar can be identified by checking if the iCalUID ends with `@Cal.com` (e.g., `2GBXSdEixretciJfKVmYN8@Cal.com`). This identifier is used to distinguish Cal.com bookings from other calendar events for data storage and privacy purposes.

 ### UI Component Locations

@@ -87,7 +87,7 @@ To make persistent changes to API documentation, use NestJS decorators (`@ApiQue

 ### Workflows vs Webhooks

-Workflows and webhooks are two completely separate features in Cal.diy with different implementations and file structures:
+Workflows and webhooks are two completely separate features in Cal.com with different implementations and file structures:
 - Workflow constants: `packages/features/ee/workflows/lib/constants.ts`
 - NOT in the webhooks directory

@@ -1,6 +1,6 @@
-# Cal.diy Engineering Rules
+# Cal.com Engineering Rules

-This directory contains modular, machine-readable engineering rules derived from [Cal.diy's Engineering Standards for 2026 and Beyond](https://cal.com/blog/engineering-in-2026-and-beyond).
+This directory contains modular, machine-readable engineering rules derived from [Cal.com's Engineering Standards for 2026 and Beyond](https://cal.com/blog/engineering-in-2026-and-beyond).

 ## Structure

@@ -57,4 +57,4 @@ interface BookingResponse {
 - Give users ample time to migrate (minimum 6 months for public APIs)
 - Document exactly what changed and why

-Reference: [Cal.diy Engineering Blog](https://cal.com/blog/engineering-in-2026-and-beyond)
+Reference: [Cal.com Engineering Blog](https://cal.com/blog/engineering-in-2026-and-beyond)
@@ -1,6 +1,4 @@
 ---
-paths:
-  - "apps/api/**/*.controller.ts"
 title: Keep Controllers Thin - HTTP Concerns Only
 impact: HIGH
 impactDescription: Enables technology-agnostic business logic
@@ -72,4 +70,4 @@ export async function POST(request: Request) {
 **The principle:**
 We must detach HTTP technology from our application. The way we transfer data between client and server (whether REST, tRPC, etc.) should not influence how our core application works. HTTP is a delivery mechanism, not an architectural driver.

-Reference: [Cal.diy Engineering Blog](https://cal.com/blog/engineering-in-2026-and-beyond)
+Reference: [Cal.com Engineering Blog](https://cal.com/blog/engineering-in-2026-and-beyond)
@@ -39,4 +39,4 @@ Domain boundaries are enforced automatically through linting. If `packages/featu
 - Easier testing: Test the entire feature as a unit with all pieces in one place
 - Clearer dependencies: When you see `import { getAvailability } from '@calcom/features/availability'`, you know exactly which feature you're depending on

-Reference: [Cal.diy Engineering Blog](https://cal.com/blog/engineering-in-2026-and-beyond)
+Reference: [Cal.com Engineering Blog](https://cal.com/blog/engineering-in-2026-and-beyond)
@@ -1,7 +1,4 @@
 ---
-paths:
-  - "apps/**/page.tsx"
-  - "apps/**/layout.tsx"
 title: Page-Level Authorization Checks in Next.js
 impact: CRITICAL
 impactDescription: Prevents unauthorized access to sensitive data
@@ -58,4 +58,4 @@ Each feature folder is a self-contained vertical slice that includes:
 - Teams can work on different features without conflicts
 - Features are loosely coupled and can evolve independently

-Reference: [Cal.diy Engineering Blog](https://cal.com/blog/engineering-in-2026-and-beyond)
+Reference: [Cal.com Engineering Blog](https://cal.com/blog/engineering-in-2026-and-beyond)
@@ -9,7 +9,7 @@ tags: ci, debugging, workflow

 ## What to Focus On

-When reviewing CI check failures in Cal.diy:
+When reviewing CI check failures in Cal.com:

 1. **E2E tests can be flaky** and may fail intermittently
 2. **Focus only on CI failures that are directly related to your code changes**
@@ -9,7 +9,7 @@ tags: ci, typescript, type-check, workflow

 ## Priority Order

-When working on the Cal.diy repository, prioritize fixing type issues before addressing failing tests.
+When working on the Cal.com repository, prioritize fixing type issues before addressing failing tests.

 1. Run `yarn type-check:ci --force` first
 2. Fix all TypeScript errors
@@ -42,4 +42,4 @@ We hold each other accountable for quality. Cutting corners might feel faster in
 - Focus on the code, not the person
 - Remember that quality standards protect everyone

-Reference: [Cal.diy Engineering Blog](https://cal.com/blog/engineering-in-2026-and-beyond)
+Reference: [Cal.com Engineering Blog](https://cal.com/blog/engineering-in-2026-and-beyond)
@@ -72,4 +72,4 @@ describe("calculateOverlap", () => {
 - Checks are fast and useful
 - AI helps ensure comprehensive coverage

-Reference: [Cal.diy Engineering Blog](https://cal.com/blog/engineering-in-2026-and-beyond)
+Reference: [Cal.com Engineering Blog](https://cal.com/blog/engineering-in-2026-and-beyond)
@@ -93,4 +93,4 @@ import { BookingStatus } from "@calcom/prisma/client";

 Yes, this requires more code. Yes, it's worth it. Explicit boundaries prevent the architectural erosion that creates long-term maintenance nightmares.

-Reference: [Cal.diy Engineering Blog](https://cal.com/blog/engineering-in-2026-and-beyond)
+Reference: [Cal.com Engineering Blog](https://cal.com/blog/engineering-in-2026-and-beyond)
@@ -46,4 +46,4 @@ const booking = await prisma.booking.findFirst({

 **Exception:** Use `include` only when you genuinely need all fields from a relation, which is rare.

-Reference: [Cal.diy Engineering Standards](https://cal.com/blog/engineering-in-2026-and-beyond)
+Reference: [Cal.com Engineering Standards](https://cal.com/blog/engineering-in-2026-and-beyond)
@@ -9,7 +9,7 @@ tags: prisma, feature-flags, migrations

 ## Creating Feature Flag Migrations

-To seed new feature flags in Cal.diy, create a Prisma migration:
+To seed new feature flags in Cal.com, create a Prisma migration:

 ```bash
 yarn prisma migrate dev --create-only --name seed_[feature_name]_feature
@@ -1,6 +1,4 @@
 ---
-paths:
-  - "packages/prisma/**"
 title: Prisma Schema and Migrations
 impact: HIGH
 impactDescription: Schema changes affect all downstream code and deployments
@@ -11,7 +9,7 @@ tags: prisma, database, migrations, schema

 ## After Schema Changes

-After making changes to the Prisma schema in Cal.diy and creating migrations, you need to run:
+After making changes to the Prisma schema in Cal.com and creating migrations, you need to run:

 ```bash
 yarn prisma generate
@@ -197,4 +197,4 @@ class BookingRepository {
 - Keep methods generic and reusable: `findByUserIdIncludeAttendees` not `findBookingsForReporting`
 - No business logic in repositories - that belongs in Services

-Reference: [Cal.diy Engineering Blog](https://cal.com/blog/engineering-in-2026-and-beyond)
+Reference: [Cal.com Engineering Blog](https://cal.com/blog/engineering-in-2026-and-beyond)
@@ -62,4 +62,4 @@ If we ever switch from Prisma to Drizzle or another ORM, the only changes requir
 - DI container wiring for new repositories
 - Nothing else in the codebase should care or change

-Reference: [Cal.diy Engineering Blog](https://cal.com/blog/engineering-in-2026-and-beyond)
+Reference: [Cal.com Engineering Blog](https://cal.com/blog/engineering-in-2026-and-beyond)
@@ -9,7 +9,7 @@ tags: app-store, integrations, generated-files

 ## Generated Files

-The Cal.diy repository uses generated files (`*.generated.ts`) for app-store integrations. These files are created by the app-store-cli tool.
+The Cal.com repository uses generated files (`*.generated.ts`) for app-store integrations. These files are created by the app-store-cli tool.

 **Do not manually modify** `*.generated.ts` files. If you need structural changes to how integrations are imported or used, update the CLI code that generates these files.

@@ -54,7 +54,7 @@ class BookingService {
 - **Caching Proxies**: Wrap repositories or services to add caching behavior transparently
 - **Decorators**: Add cross-cutting concerns (logging, metrics) without polluting domain logic

-## Cal.diy's Type-Safe DI with moduleLoader
+## Cal.com's Type-Safe DI with moduleLoader

 We use `@evyweb/ioctopus` to manage service and repository dependencies. The **moduleLoader pattern** provides type-safe dependency injection, ensuring that if a service adds a new dependency, TypeScript will catch missing dependencies at build time rather than runtime.

@@ -277,4 +277,4 @@ export function getMyService(): MyService {
 - **Automatic dependency resolution**: The moduleLoader automatically loads all dependencies recursively
 - **Self-documenting**: Each module declares its own dependencies explicitly

-Reference: [Cal.diy Engineering Blog](https://cal.com/blog/engineering-in-2026-and-beyond)
+Reference: [Cal.com Engineering Blog](https://cal.com/blog/engineering-in-2026-and-beyond)
@@ -84,4 +84,4 @@ class TeamBillingService extends BillingService {
 - Prefer polymorphism over conditionals
 - Watch for if statement accumulation during code review

-Reference: [Cal.diy Engineering Blog](https://cal.com/blog/engineering-in-2026-and-beyond)
+Reference: [Cal.com Engineering Blog](https://cal.com/blog/engineering-in-2026-and-beyond)
@@ -0,0 +1,39 @@
+---
+title: Workflow Trigger Implementation
+impact: MEDIUM
+impactDescription: Consistent workflow patterns ensure reliable automation
+tags: workflows, triggers, automation
+---
+
+# Workflow Trigger Implementation
+
+## Using scheduleWorkflowReminders
+
+To trigger workflows in Cal.com, use the `scheduleWorkflowReminders` function. This is the standard approach used throughout the codebase.
+
+Before implementing new workflow triggers, examine existing implementations in the codebase to understand the pattern. The function:
+- Filters workflows by trigger type
+- Processes each workflow step
+
+Key locations where this is used:
+- Booking handlers
+- Confirmation processes
+- Other booking-related events
+
+## Adding New Workflow Triggers
+
+1. Check `packages/prisma/schema.prisma` for existing webhooks and workflow trigger enums as reference
+2. Add the same enums to workflows (only when asked specifically)
+3. Add enums to `packages/features/ee/workflows/lib/constants.ts` for UI display
+4. Add translations to `en/locale.json` using the format `{enum}_trigger` (all lowercase)
+
+Webhook triggers serve as the reference implementation pattern for workflow triggers.
+
+## Workflows vs Webhooks
+
+Workflows and webhooks are two completely separate features in Cal.com with different implementations and file structures:
+
+- Workflow constants: `packages/features/ee/workflows/lib/constants.ts`
+- NOT in the webhooks directory
+
+When working on workflow triggers, do not reference or use webhook trigger implementations - they are distinct systems.
@@ -51,4 +51,4 @@ const available = availableSlots.filter(slot => {
 - **Hash maps/sets**: Use for O(1) lookups instead of `.find` or `.includes` on arrays
 - **Interval trees**: For scheduling, availability, and range queries

-Reference: [Cal.diy Engineering Blog](https://cal.com/blog/engineering-in-2026-and-beyond)
+Reference: [Cal.com Engineering Blog](https://cal.com/blog/engineering-in-2026-and-beyond)
@@ -50,4 +50,4 @@ new Intl.DateTimeFormat(language).format(date);
 - Date formatting without timezone concerns
 - Performance-critical loops over dates

-Reference: [Cal.diy Engineering Standards](https://cal.com/blog/engineering-in-2026-and-beyond)
+Reference: [Cal.com Engineering Standards](https://cal.com/blog/engineering-in-2026-and-beyond)
@@ -55,4 +55,4 @@ async function precomputeTeamAvailability(teamId: number) {

 This is why performance isn't just a nice-to-have in scheduling software. It's the foundation that determines whether your system can scale to enterprise needs.

-Reference: [Cal.diy Engineering Blog](https://cal.com/blog/engineering-in-2026-and-beyond)
+Reference: [Cal.com Engineering Blog](https://cal.com/blog/engineering-in-2026-and-beyond)
@@ -32,4 +32,4 @@ import { UserService } from "./services/UserService";
 import { Button } from "@calcom/ui/components/button";
 ```

-Reference: [Cal.diy Engineering Standards](https://cal.com/blog/engineering-in-2026-and-beyond)
+Reference: [Cal.com Engineering Standards](https://cal.com/blog/engineering-in-2026-and-beyond)
@@ -26,7 +26,7 @@ Focus on providing a clear summary of what the PR is doing and its core function

 - Does the code do what it claims to do?
 - Are there any obvious bugs or edge cases?
- Does it follow Cal.diy coding standards?
+- Does it follow Cal.com coding standards?
 - Is the change appropriately scoped?

 ## What to Skip (Unless Asked)
@@ -9,7 +9,7 @@ tags: imports, exports, modules, app-store

 ## Named vs Default Exports

-When working with imports in the Cal.diy codebase, particularly in app-store integrations, pay attention to whether modules use named exports or default exports.
+When working with imports in the Cal.com codebase, particularly in app-store integrations, pay attention to whether modules use named exports or default exports.

 Many services like VideoApiAdapter, CalendarService, and PaymentService are exported as named exports, but the actual export name may differ from the generic service type.

@@ -26,7 +26,7 @@ import CalendarService from "./applecalendar/lib/CalendarService";

 ## Generated Files

-When fixing imports in Cal.diy's generated files (like `packages/app-store/apps.browser-*.generated.tsx`), always check the actual exports in the source files first.
+When fixing imports in Cal.com's generated files (like `packages/app-store/apps.browser-*.generated.tsx`), always check the actual exports in the source files first.

 For EventTypeAppCardInterface components, they likely use named exports rather than default exports, requiring:

@@ -37,4 +37,4 @@ const processedResult = processData(userData);
 **The principle:**
 The "slowness" of doing things right is an investment, not a cost. Code that's architected correctly from the start doesn't need massive refactors later.

-Reference: [Cal.diy Engineering Blog](https://cal.com/blog/engineering-in-2026-and-beyond)
+Reference: [Cal.com Engineering Blog](https://cal.com/blog/engineering-in-2026-and-beyond)
@@ -40,4 +40,4 @@ for (const item of data) {
 **Important note:**
 Simple doesn't mean lacking in features. Just because our goal is to create simple systems, this doesn't mean they should feel anemic and lacking obvious functionality.

-Reference: [Cal.diy Engineering Blog](https://cal.com/blog/engineering-in-2026-and-beyond)
+Reference: [Cal.com Engineering Blog](https://cal.com/blog/engineering-in-2026-and-beyond)
@@ -37,4 +37,4 @@ Every nitpick matters. Every pattern violation matters. Address them before merg
 - If someone wants to commit untested code, push back
 - If someone suggests copying and pasting instead of creating a proper abstraction, call it out respectfully

-Reference: [Cal.diy Engineering Blog](https://cal.com/blog/engineering-in-2026-and-beyond)
+Reference: [Cal.com Engineering Blog](https://cal.com/blog/engineering-in-2026-and-beyond)
@@ -64,4 +64,4 @@ Yes, we know coverage doesn't guarantee perfect tests. We know you can write mea
 **Leverage AI for test generation:**
 AI can quickly and intelligently build comprehensive test suites. Manual testing is more and more a thing of the past.

-Reference: [Cal.diy Engineering Blog](https://cal.com/blog/engineering-in-2026-and-beyond)
+Reference: [Cal.com Engineering Blog](https://cal.com/blog/engineering-in-2026-and-beyond)
@@ -9,7 +9,7 @@ tags: testing, debugging, workflow

 ## One File at a Time

-When fixing failing tests in the Cal.diy repository, take an incremental approach by addressing one file at a time rather than attempting to fix all issues simultaneously.
+When fixing failing tests in the Cal.com repository, take an incremental approach by addressing one file at a time rather than attempting to fix all issues simultaneously.

 This methodical approach makes it easier to identify and resolve specific issues without getting overwhelmed by the complexity of multiple failing tests across different files.

@@ -9,13 +9,13 @@ tags: testing, mocking, calendar, app-store

 ## Calendar Service Mocks

-When mocking calendar services in Cal.diy test files, implement the `Calendar` interface rather than adding individual properties from each specific calendar service type (like `FeishuCalendarService`).
+When mocking calendar services in Cal.com test files, implement the `Calendar` interface rather than adding individual properties from each specific calendar service type (like `FeishuCalendarService`).

 Since all calendar services implement the `Calendar` interface and are stored in a map, the mock service should also implement this interface to ensure type compatibility.

 ## App-Store Integration Mocks

-When mocking app-store resources in Cal.diy tests, prefer implementing simpler mock designs that directly implement the required interfaces rather than trying to match complex deep mock structures created with `mockDeep`.
+When mocking app-store resources in Cal.com tests, prefer implementing simpler mock designs that directly implement the required interfaces rather than trying to match complex deep mock structures created with `mockDeep`.

 This approach is more maintainable and helps resolve type compatibility issues.

@@ -1,9 +1,4 @@
 ---
-paths:
-  - "apps/web/playwright/**"
-  - "packages/embeds/**/playwright/**"
-  - "apps/**/*.e2e.ts"
-  - "apps/api/**/e2e/**"
 title: Playwright E2E Testing
 impact: HIGH
 impactDescription: E2E tests catch integration issues before production
@@ -9,7 +9,7 @@ tags: testing, timezone, consistency

 ## Always Use TZ=UTC

-When running tests in the Cal.diy repository, use the `TZ=UTC` environment variable:
+When running tests in the Cal.com repository, use the `TZ=UTC` environment variable:

 ```bash
 TZ=UTC yarn test
@@ -1,9 +1,9 @@
 ---
 name: calcom-api
-description: Interact with the Cal.diy API v2 to manage scheduling, bookings, event types, availability, and calendars. Use this skill when building integrations that need to create or manage bookings, check availability, configure event types, or sync calendars with Cal.diy's scheduling infrastructure.
+description: Interact with the Cal.com API v2 to manage scheduling, bookings, event types, availability, and calendars. Use this skill when building integrations that need to create or manage bookings, check availability, configure event types, or sync calendars with Cal.com's scheduling infrastructure.
 env:
  CAL_API_KEY:
-    description: "Cal.diy API key (prefixed with cal_live_ or cal_test_). Required for all API requests."
+    description: "Cal.com API key (prefixed with cal_live_ or cal_test_). Required for all API requests."
    required: true
  CAL_CLIENT_ID:
    description: "OAuth client ID for platform integrations managing users on behalf of others. Sent as x-cal-client-id header."
@@ -16,9 +16,9 @@ env:
    required: false
 ---

-# Cal.diy API v2
+# Cal.com API v2

-This skill provides guidance for AI agents to interact with the Cal.diy API v2, enabling scheduling automation, booking management, and calendar integrations.
+This skill provides guidance for AI agents to interact with the Cal.com API v2, enabling scheduling automation, booking management, and calendar integrations.

 ## Base URL

@@ -31,7 +31,7 @@ https://api.cal.com/v2

 | Environment Variable | Required | Description |
 |---------------------|----------|-------------|
-| `CAL_API_KEY` | Yes | Cal.diy API key (prefixed with `cal_live_` or `cal_test_`). Used as Bearer token for all API requests. Generate from Settings > Developer > API Keys. |
+| `CAL_API_KEY` | Yes | Cal.com API key (prefixed with `cal_live_` or `cal_test_`). Used as Bearer token for all API requests. Generate from Settings > Developer > API Keys. |
 | `CAL_CLIENT_ID` | No | OAuth client ID for platform integrations that manage users on behalf of others. Sent as `x-cal-client-id` header. |
 | `CAL_SECRET_KEY` | No | OAuth client secret for platform integrations. Sent as `x-cal-secret-key` header. |
 | `CAL_WEBHOOK_SECRET` | No | Secret for verifying webhook payload signatures via the `X-Cal-Signature-256` header. |
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
hausgeist	b34ef206f8	cc: gate on DB readiness + real healthchecks (start.sh has no set -e and wait-for-it passes mid-initdb) - database: pg_isready healthcheck; calcom depends_on service_healthy - calcom: healthcheck probes /auth/login with redirects (upstream wget --spider / fails on 307)	2026-09-28 08:16:12 -07:00
hausgeist	1c3c661726	cc: fix DB wiring — base compose hardcodes unicorn_user/magical_password and builds DATABASE_URL from raw creds (Prisma URL-parse crash with base64 pw) - docker-compose.cc.yml: database env + calcom DATABASE_URL/DIRECT_URL from .env - cc.env.example: require HEX (URL-safe) secrets; hex generation commands	2026-09-28 06:44:44 -07:00
hausgeist	3dbad3113d	cc: build-based deploy — cal.diy publishes no prebuilt release images Verified: Docker Hub calcom/cal.diy has 0 tags; scarf/ghcr mirrors serve none. The upstream Dockerfile + compose build args are the deploy path.	2026-09-28 00:23:53 -07:00
hausgeist	b1173fc8c3	cc: CC deployment source-of-truth pinned at v6.2.0 (issue #11 ) - docker-compose.cc.yml: pin calcom v6.2.0 + postgres 16-alpine + redis 7-alpine; studio + calcom-api off (reserved profiles) - cc.env.example: CC production env spec (webapp URL, telemetry off, branding) - cc/README.md: mirror manifest + upstream-merge process	2026-09-27 23:36:33 -07:00