packages/trpc/server/routers/viewer/teams/inviteMember/inviteMemberUtils.test.ts (1)

28-32: Update the mock path to match the new import location.

The mock is still pointing to the old import path @calcom/lib/server/queries/teams while the actual import has been moved to @calcom/features/ee/teams/lib/queries. This could cause test failures.

Apply this diff to fix the mock path:

-vi.mock("@calcom/lib/server/queries/teams", () => {
+vi.mock("@calcom/features/ee/teams/lib/queries", () => {
   return {
     isTeamAdmin: vi.fn(),
   };
 });

packages/trpc/server/routers/viewer/teams/deleteInvite.handler.ts (1)

36-36: Prefer named export over default export

Adopt named exports for better tree-shaking and refactors.

Apply:

-export default deleteInviteHandler;
+export { deleteInviteHandler };

packages/trpc/server/routers/viewer/teams/changeMemberRole.handler.ts (1)

120-120: Prefer named export over default export

-export default changeMemberRoleHandler;
+export { changeMemberRoleHandler };

packages/trpc/server/routers/viewer/teams/removeHostsFromEventTypes.handler.ts (1)

36-36: Prefer named export over default export

-export default removeHostsFromEventTypesHandler;
+export { removeHostsFromEventTypesHandler };

packages/trpc/server/routers/viewer/teams/getInternalNotesPresets.handler.ts (1)

33-33: Prefer named export over default export

-export default getInternalNotesPresetsHandler;
+export { getInternalNotesPresetsHandler };

packages/trpc/server/routers/viewer/bookings/addGuests.handler.ts (1)

177-181: Log the error object for observability.

Currently the actual error is dropped.

Apply this diff:

-  } catch (err) {
-    console.log("Error sending AddGuestsEmails");
-  }
+  } catch (err) {
+    console.error("Error sending AddGuestsEmails", err);
+  }

packages/trpc/server/routers/viewer/teams/delete.handler.ts (1)

22-22: Prefer named exports over default exports.

Improves tree‑shaking and refactors. Consider removing the default export and updating imports.

-export default deleteHandler;
+// Use the named export `deleteHandler` at call sites instead of default export.

packages/trpc/server/routers/viewer/teams/publish.handler.ts (3)

22-29: Dead code: parseMetadataOrThrow is unused.

Remove to reduce noise.

---

30-53: Dead code: generateCheckoutSession is unused.

Remove or wire into publish flow behind billing flag.

---

84-84: Prefer named exports over default exports.

Use named export publishHandler and drop the default export.

-export default publishHandler;
+// Use the named export `publishHandler` at call sites instead of default export.

packages/trpc/server/routers/viewer/teams/addMembersToEventTypes.handler.ts (1)

41-41: Prefer named exports over default exports.

Drop default export to align with repo guidance.

-export default addMembersToEventTypesHandler;
+// Use the named export `addMembersToEventTypesHandler` at call sites instead of default export.

packages/trpc/server/routers/viewer/teams/createInvite.handler.ts (1)

58-58: Prefer named exports over default exports.

Drop default export to align with guidance.

-export default createInviteHandler;
+// Use the named export `createInviteHandler` at call sites instead of default export.

packages/trpc/server/routers/viewer/teams/acceptOrLeave.handler.ts (1)

83-83: Prefer named exports over default exports.

Drop default export.

-export default acceptOrLeaveHandler;
+// Use the named export `acceptOrLeaveHandler` at call sites instead of default export.

packages/trpc/server/routers/viewer/teams/setInviteExpiration.handler.ts (1)

29-30: Use FORBIDDEN for permission failures (user is authenticated).

UNAUTHORIZED suggests missing auth; this case is authenticated-but-not-allowed.

Apply:

-  if (!verificationToken.teamId || !(await isTeamAdmin(ctx.user.id, verificationToken.teamId)))
-    throw new TRPCError({ code: "UNAUTHORIZED" });
+  if (!verificationToken.teamId || !(await isTeamAdmin(ctx.user.id, verificationToken.teamId)))
+    throw new TRPCError({ code: "FORBIDDEN" });

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

Learnt from: Udit-takkar
PR: calcom/cal.com#22995
File: packages/trpc/server/routers/viewer/aiVoiceAgent/_router.ts:117-126
Timestamp: 2025-08-17T22:00:16.329Z
Learning: In calcom/cal.com PR #22995, packages/trpc/server/routers/viewer/aiVoiceAgent/_router.ts, the enabled input parameter in the update endpoint is intentionally not forwarded to aiService.updateAgentConfiguration() as the enabled/disabled agent functionality is not required at the moment (per maintainer Udit-takkar). Future reviews should not flag this as missing functionality unless requirements change.

Learnt from: anglerfishlyy
PR: calcom/cal.com#0
File: :0-0
Timestamp: 2025-08-27T16:39:38.192Z
Learning: anglerfishlyy successfully implemented CAL-3076 email invitation feature for Cal.com team event-types in PR #23312. The feature allows inviting people via email directly from assignment flow, with automatic team invitation if email doesn't belong to existing team member. Implementation includes Host type modifications (userId?: number, email?: string, isPending?: boolean), CheckedTeamSelect component updates with CreatableSelect, TRPC schema validation with zod email validation, and integration with existing teamInvite system.

Learnt from: Udit-takkar
PR: calcom/cal.com#22995
File: packages/features/calAIPhone/providers/retellAI/services/AgentService.ts:83-88
Timestamp: 2025-08-26T20:23:28.396Z
Learning: In calcom/cal.com PR #22995, the workflow update handler in packages/trpc/server/routers/viewer/workflows/update.handler.ts includes workflow-level authorization via isAuthorized(userWorkflow, ctx.user.id, "workflow.update") which validates the user can update the workflow before calling updateToolsFromAgentId (per maintainer Udit-takkar).

Learnt from: hbjORbj
PR: calcom/cal.com#23475
File: packages/features/credentials/handleDeleteCredential.ts:5-10
Timestamp: 2025-09-12T07:15:58.030Z
Learning: When EventTypeAppMetadataSchema is used only in z.infer<typeof EventTypeAppMetadataSchema> type annotations or type casts, it can be imported as a type-only import since this usage is purely at the TypeScript type level and doesn't require the runtime value.

Learnt from: SinghaAnirban005
PR: calcom/cal.com#23343
File: packages/features/insights/server/trpc-router.ts:1080-1101
Timestamp: 2025-08-26T08:08:23.395Z
Learning: In packages/features/insights/server/trpc-router.ts, when filtering personal event types (userId provided, no teamId, not isAll), the query correctly uses user.id (authenticated user) instead of the input userId parameter for security reasons. This prevents users from accessing other users' personal event types by passing arbitrary user IDs.

Learnt from: sean-brydon
PR: calcom/cal.com#22618
File: packages/trpc/server/routers/viewer/eventTypes/utils/transformUtils.ts:113-113
Timestamp: 2025-08-05T07:42:06.335Z
Learning: In Cal.com's getUserEventGroups handler refactor (PR #22618), the membershipCount field for team event groups is intentionally set to 0 in the new createTeamEventGroup function, as confirmed by sean-brydon (PR author). This preserves the same behavior as the old implementation that was being refactored, maintaining backward compatibility. While other parts of the codebase may use actual member counts, this specific implementation maintains the previous behavior.

Learnt from: sean-brydon
PR: calcom/cal.com#22618
File: packages/trpc/server/routers/viewer/eventTypes/utils/transformUtils.ts:113-113
Timestamp: 2025-08-05T07:42:06.335Z
Learning: In Cal.com's event type system, the membershipCount field for team event groups is intentionally set to 0, as confirmed by sean-brydon (PR author). This behavior was preserved during the refactor from the old getUserEventGroups.handler.ts implementation to the new createTeamEventGroup function in transformUtils.ts. This is not a bug but the intended behavior that maintains consistency with the previous implementation.

Learnt from: bandhan-majumder
PR: calcom/cal.com#23454
File: packages/features/bookings/Booker/components/EventMeta.tsx:16-16
Timestamp: 2025-08-29T22:57:31.407Z
Learning: In Cal.com's Booker architecture, components become client-side through BookerStoreProvider.tsx which has "use client". Any component using useBookerStoreContext automatically runs on the client and should use client-appropriate utilities like markdownToSafeHTMLClient, regardless of whether they have explicit "use client" directives.

Learnt from: supalarry
PR: calcom/cal.com#23217
File: apps/api/v2/src/ee/event-types/event-types_2024_06_14/services/output-event-types.service.ts:93-94
Timestamp: 2025-08-21T13:44:06.805Z
Learning: In apps/api/v2/src/ee/event-types/event-types_2024_06_14/event-types.repository.ts, repository functions that use explicit Prisma select clauses (like getEventTypeWithSeats) are used for specific purposes and don't need to include all EventType fields like bookingRequiresAuthentication. These methods don't feed into the general OutputEventTypesService_2024_06_14 flow.

Learnt from: Udit-takkar
PR: calcom/cal.com#22995
File: packages/trpc/server/routers/viewer/ai/_router.ts:46-84
Timestamp: 2025-08-14T10:48:52.586Z
Learning: In calcom/cal.com PR #22995, packages/trpc/server/routers/viewer/ai/_router.ts, the voiceId input parameter in the create endpoint is intentionally not forwarded to aiService.createAgent() as voice customization is not required at the moment (per maintainer Udit-takkar). Future reviews should not flag this as missing functionality unless requirements change.

packages/features/eventtypes/lib/getEventTypeById.ts (5)

135-139: Guard getBookerBaseUrl against null/undefined org IDs.

Currently getBookerBaseUrl(currentOrganizationId) can be called with null if the owner exists but the user isn’t in an org. Avoid passing null and fall back to WEBSITE_URL.

-    bookerUrl: restEventType.team
-      ? await getBookerBaseUrl(restEventType.team.parentId)
-      : restEventType.owner
-      ? await getBookerBaseUrl(currentOrganizationId)
-      : WEBSITE_URL,
+    bookerUrl:
+      restEventType.team?.parentId
+        ? await getBookerBaseUrl(restEventType.team.parentId)
+        : restEventType.owner && currentOrganizationId
+        ? await getBookerBaseUrl(currentOrganizationId)
+        : WEBSITE_URL,

---

245-253: Use explicit Prisma select for destinationCalendar to avoid overfetching.

Per repo guidance, use select instead of returning the full record. Also double‑check that no sensitive fields are exposed over tRPC.

If acceptable for clients, add a constrained select (adjust keys to your model):

-    destinationCalendar = await prisma.destinationCalendar.findFirst({
-      where: {
-        userId: userId,
-        eventTypeId: null,
-      },
-    });
+    destinationCalendar = await prisma.destinationCalendar.findFirst({
+      where: { userId, eventTypeId: null },
+      // TODO: confirm exact fields required by consumers; expand only as needed.
+      select: { id: true, userId: true, eventTypeId: true, credentialId: true, integration: true, externalId: true, name: true, primaryEmail: true },
+    });

Optionally centralize:

const DESTINATION_CALENDAR_PUBLIC_SELECT = {
  id: true, userId: true, eventTypeId: true, credentialId: true,
  integration: true, externalId: true, name: true, primaryEmail: true,
} satisfies Prisma.DestinationCalendarSelect;

Then select: DESTINATION_CALENDAR_PUBLIC_SELECT.

---

289-289: Remove default export; keep named export only.

Matches the import recommendation and repo guideline against default exports.

-export default getEventTypeById;

---

131-131: Avoid double cast as unknown as LocationObject[].

Double casts mask type mismatches. Prefer a narrow helper or schema validation to ensure the shape at runtime.

Example:

function toLocationObjects(v: unknown): LocationObject[] {
  // validate/transform or return []
  return Array.isArray(v) ? (v as LocationObject[]) : [];
}
...
locations: toLocationObjects(locations),

---

76-84: Parallelize sequential awaits to reduce latency.

The three loops await inside iteration; switch to Promise.all maps.

-  const eventTeamMembershipsWithUserProfile = [];
-  for (const eventTeamMembership of rawEventType.team?.members || []) {
-    eventTeamMembershipsWithUserProfile.push({
-      ...eventTeamMembership,
-      user: await userRepo.enrichUserWithItsProfile({
-        user: eventTeamMembership.user,
-      }),
-    });
-  }
+  const eventTeamMembershipsWithUserProfile = await Promise.all(
+    (rawEventType.team?.members ?? []).map(async (m) => ({
+      ...m,
+      user: await userRepo.enrichUserWithItsProfile({ user: m.user }),
+    }))
+  );
 
-  const childrenWithUserProfile = [];
-  for (const child of rawEventType.children || []) {
-    childrenWithUserProfile.push({
-      ...child,
-      owner: child.owner
-        ? await userRepo.enrichUserWithItsProfile({
-            user: child.owner,
-          })
-        : null,
-    });
-  }
+  const childrenWithUserProfile = await Promise.all(
+    (rawEventType.children ?? []).map(async (child) => ({
+      ...child,
+      owner: child.owner ? await userRepo.enrichUserWithItsProfile({ user: child.owner }) : null,
+    }))
+  );
 
-  const eventTypeUsersWithUserProfile = [];
-  for (const eventTypeUser of rawEventType.users) {
-    eventTypeUsersWithUserProfile.push(
-      await userRepo.enrichUserWithItsProfile({
-        user: eventTypeUser,
-      })
-    );
-  }
+  const eventTypeUsersWithUserProfile = await Promise.all(
+    rawEventType.users.map((u) => userRepo.enrichUserWithItsProfile({ user: u }))
+  );

Also applies to: 86-96, 99-105

packages/features/bookings/lib/handleSeats/reschedule/owner/moveSeatedBookingToNewTimeSlot.ts (3)

34-41: Tighten types: update() never returns null

Drop the nullable type on newBooking and the follow‑on null assumptions.

Apply (already shown above) and rely on Prisma throwing on missing record.

Also applies to: 55-56

---

57-61: Duplicate logic: extract to helper

The “reset evt.description to eventType.description before emailing” pattern appears elsewhere; extract to a shared util to avoid drift.

---

107-107: Prefer named export over default

Switch to a named export for better tree‑shaking and refactors.

-export default moveSeatedBookingToNewTimeSlot;
+export { moveSeatedBookingToNewTimeSlot };

packages/lib/server/getLuckyUser.ts (2)

155-161: Return a boolean from isFullDayEvent

Function currently returns true or undefined; make it explicit.

 function isFullDayEvent(date1: Date, date2: Date) {
   const MILLISECONDS_IN_A_DAY = 24 * 60 * 60 * 1000;
   const difference = Math.abs(date1.getTime() - date2.getTime());
 
-  if (difference % MILLISECONDS_IN_A_DAY === 0) return true;
+  return difference % MILLISECONDS_IN_A_DAY === 0;
 }

---

834-847: Reduce dayjs work inside loop

This runs per busy time; cache now/earliestStartTime outside, and use dayjs.tz directly to avoid repeated Date constructions.

-  userBusyTimesOfInterval.forEach((userBusyTime) => {
+  const now = Date.now();
+  const monthStartUtc = Date.UTC(new Date().getUTCFullYear(), new Date().getUTCMonth(), 1);
+  userBusyTimesOfInterval.forEach((userBusyTime) => {
     const fullDayBusyTimes = userBusyTime.busyTimes
       .filter((busyTime) => {
         if (!busyTime.timeZone) return false;
-        const timezoneOffset = dayjs(busyTime.start).tz(busyTime.timeZone).utcOffset() * 60000;
-        let start = new Date(new Date(busyTime.start).getTime() + timezoneOffset);
-        const end = new Date(new Date(busyTime.end).getTime() + timezoneOffset);
+        const startLocal = dayjs.tz(busyTime.start, busyTime.timeZone);
+        const endLocal = dayjs.tz(busyTime.end, busyTime.timeZone);
+        let start = new Date(startLocal.valueOf());
+        const end = new Date(endLocal.valueOf());
 
-        const earliestStartTime = new Date(Date.UTC(new Date().getFullYear(), new Date().getMonth(), 1));
+        const earliestStartTime = new Date(monthStartUtc);
         if (start < earliestStartTime) start = earliestStartTime;
 
-        return end.getTime() < new Date().getTime() && isFullDayEvent(start, end);
+        return end.getTime() < now && isFullDayEvent(start, end);
       })

packages/features/bookings/lib/handleSeats/reschedule/owner/ownerRescheduleSeatedBooking.ts (1)

56-56: Prefer named export over default

Align with repo guidance on named exports.

-export default ownerRescheduleSeatedBooking;
+export { ownerRescheduleSeatedBooking };

packages/features/bookings/lib/handleNewBooking/test/team-bookings/round-robin.test.ts (1)

152-158: Remove unused variable

calendarMock is unused; drop it to keep tests lean.

-      const calendarMock = mockCalendarToHaveNoBusySlots("googlecalendar", {
+      mockCalendarToHaveNoBusySlots("googlecalendar", {
         create: {
           id: "MOCKED_GOOGLE_CALENDAR_EVENT_ID",
           iCalUID: "MOCKED_GOOGLE_CALENDAR_ICS_ID",
         },
       });

packages/features/ee/round-robin/roundRobinReassignment.ts (1)

508-508: Prefer named export over default

Switch to a named export for consistency.

-export default roundRobinReassignment;
+export { roundRobinReassignment };

packages/lib/getConnectedDestinationCalendars.ts (1)

236-241: Avoid console.log in library code

Use logger.debug for consistency.

-  console.log(
-    `Upsert the selectedCalendar record to the DB for user ${user.id} with details ${JSON.stringify(
-      selectedCalendar
-    )}`
-  );
+  log.debug(
+    `Upserting selectedCalendar for user ${user.id}: ${JSON.stringify(selectedCalendar)}`
+  );

packages/trpc/server/routers/viewer/me/getUserTopBanners.handler.ts (1)

44-58: Typo: Inavlid → Invalid

Rename for clarity.

-  const appsWithInavlidCredentials = checkInvalidAppCredentials({ ctx });
+  const appsWithInvalidCredentials = checkInvalidAppCredentials({ ctx });
...
-    appsWithInavlidCredentials,
+    appsWithInvalidCredentials,
...
-    invalidAppCredentialBanners.status === "fulfilled" ? invalidAppCredentialBanners.value : [],
+    invalidAppCredentialBanners.status === "fulfilled" ? invalidAppCredentialBanners.value : [],

Also applies to: 60-67

packages/features/ee/round-robin/roundRobinReassignment.test.ts (1)

163-166: Tests call function without required args

roundRobinReassignment requires orgId and reassignedById; tests pass only bookingId. Either make these params optional with safe defaults or update tests to pass them.

Quick test fix:

-    await roundRobinReassignment({
-      bookingId: 123,
-    });
+    await roundRobinReassignment({
+      bookingId: 123,
+      orgId: null,
+      reassignedById: 0,
+    });

Also applies to: 273-276

packages/features/bookings/lib/handleCancelBooking.ts (1)

232-236: Micro: limit Prisma fields to what’s used.

Only organizationId is read later; select it explicitly to avoid fetching the full profile.

-  const ownerProfile = await prisma.profile.findFirst({
-    where: {
-      userId: bookingToDelete.userId,
-    },
-  });
+  const ownerProfile = await prisma.profile.findFirst({
+    where: { userId: bookingToDelete.userId },
+    select: { organizationId: true },
+  });

packages/trpc/server/routers/viewer/calendars/setDestinationCalendar.handler.test.ts (1)

81-88: Use Vitest typings instead of Jest cast.

Prefer vi.mocked(getConnectedCalendars) over (getConnectedCalendars as jest.Mock).

-    // Mock the getConnectedCalendars response
-    (getConnectedCalendars as jest.Mock).mockResolvedValue({
+    // Mock the getConnectedCalendars response
+    vi.mocked(getConnectedCalendars).mockResolvedValue({
       connectedCalendars: [
         {

packages/trpc/server/routers/viewer/bookings/editLocation.handler.ts (1)

291-293: Use logger instead of console.log.

Keep logging consistent and structured.

-  } catch (error) {
-    console.log("Error sending LocationChangeEmails", safeStringify(error));
-  }
+  } catch (error) {
+    logger.error("Error sending LocationChangeEmails", safeStringify(error));
+  }

packages/trpc/server/routers/viewer/bookings/addGuests.handler.ts (1)

71-79: Trim blacklisted emails to avoid false mismatches.

Environment lists often contain spaces; normalize input.

-  const blacklistedGuestEmails = process.env.BLACKLISTED_GUEST_EMAILS
-    ? process.env.BLACKLISTED_GUEST_EMAILS.split(",").map((email) => email.toLowerCase())
+  const blacklistedGuestEmails = process.env.BLACKLISTED_GUEST_EMAILS
+    ? process.env.BLACKLISTED_GUEST_EMAILS.split(",").map((email) => email.trim().toLowerCase())
     : [];

packages/features/bookings/lib/EventManager.ts (1)

135-135: Prefer named exports over default for libraries.

Default exports make refactors harder and reduce tree‑shaking. Consider switching to a named export in a follow‑up.

-export default class EventManager {
+export class EventManager {

Note: would require updating import sites; do in a dedicated PR.

packages/trpc/server/routers/viewer/routing-forms/findTeamMembersMatchingAttributeLogicOfRoute.handler.ts (1)

304-309: Avoid unconditional console.log in request path.

Log only when _enablePerf is true or use the structured logger at debug level.

Apply:

-  console.log("_enablePerf, _concurrency", _enablePerf, _concurrency);
-  if (_enablePerf) {
+  if (_enablePerf) {
+    console.debug("_enablePerf, _concurrency", _enablePerf, _concurrency);
     const serverTimingHeader = getServerTimingHeader(timeTaken);
     ctx.res?.setHeader("Server-Timing", serverTimingHeader);
-    console.log("Server-Timing", serverTimingHeader);
+    console.debug("Server-Timing", serverTimingHeader);
   }

packages/features/webhooks/lib/scheduleTrigger.ts (1)

80-92: Prisma: prefer select over include per repo guidelines.

Switch include to select and enumerate only needed fields to reduce payloads and comply with the “never use include” rule for Prisma.

If changing the selection alters the payload saved in webhookScheduledTriggers, gate behind a migration or keep shape compatible.

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

Learnt from: supalarry
PR: calcom/cal.com#23364
File: apps/api/v2/src/ee/event-types/event-types_2024_06_14/transformers/internal-to-api/internal-to-api.spec.ts:295-296
Timestamp: 2025-08-27T13:32:46.887Z
Learning: In calcom/cal.com, when transforming booking fields from internal to API format, tests in organizations-event-types.e2e-spec.ts already expect name field label and placeholder to be empty strings ("") rather than undefined. PR changes that set these to explicit empty strings are typically fixing implementation to match existing test expectations rather than breaking changes.

Learnt from: supalarry
PR: calcom/cal.com#23217
File: apps/api/v2/src/ee/event-types/event-types_2024_06_14/services/output-event-types.service.ts:93-94
Timestamp: 2025-08-21T13:44:06.805Z
Learning: In apps/api/v2/src/ee/event-types/event-types_2024_06_14/event-types.repository.ts, repository functions that use explicit Prisma select clauses (like getEventTypeWithSeats) are used for specific purposes and don't need to include all EventType fields like bookingRequiresAuthentication. These methods don't feed into the general OutputEventTypesService_2024_06_14 flow.

Learnt from: din-prajapati
PR: calcom/cal.com#21854
File: packages/app-store/office365calendar/__tests__/unit_tests/SubscriptionManager.test.ts:0-0
Timestamp: 2025-08-05T12:04:29.037Z
Learning: In packages/app-store/office365calendar/lib/CalendarService.ts, the fetcher method in Office365CalendarService class is public, not private. It was specifically changed from private to public in this PR to support proper testing and external access patterns.

Learnt from: SinghaAnirban005
PR: calcom/cal.com#23343
File: packages/features/insights/server/trpc-router.ts:1080-1101
Timestamp: 2025-08-26T08:08:23.395Z
Learning: In packages/features/insights/server/trpc-router.ts, when filtering personal event types (userId provided, no teamId, not isAll), the query correctly uses user.id (authenticated user) instead of the input userId parameter for security reasons. This prevents users from accessing other users' personal event types by passing arbitrary user IDs.

Learnt from: hbjORbj
PR: calcom/cal.com#23475
File: packages/features/credentials/handleDeleteCredential.ts:5-10
Timestamp: 2025-09-12T07:15:58.030Z
Learning: When EventTypeAppMetadataSchema is used only in z.infer<typeof EventTypeAppMetadataSchema> type annotations or type casts, it can be imported as a type-only import since this usage is purely at the TypeScript type level and doesn't require the runtime value.

Learnt from: vijayraghav-io
PR: calcom/cal.com#16878
File: packages/app-store/feishucalendar/api/callback.ts:72-79
Timestamp: 2025-09-08T07:27:42.903Z
Learning: Four calendar integrations in Cal.com still use direct prisma.selectedCalendar.create instead of SelectedCalendarRepository.create: feishucalendar, zohocalendar, office365calendar, and larkcalendar. These bypass repository hooks and won't trigger reconnection logic for BookingReferences.

Learnt from: CarinaWolli
PR: calcom/cal.com#22296
File: packages/lib/bookings/filterHostsBySameRoundRobinHost.ts:41-42
Timestamp: 2025-07-22T11:42:47.623Z
Learning: The filterHostsBySameRoundRobinHost function in packages/lib/bookings/filterHostsBySameRoundRobinHost.ts has a known limitation where it doesn't work correctly with fixed hosts or round robin groups. This is pre-existing technical debt that was already broken before the round robin groups feature. CarinaWolli has documented this in Linear issue CAL-6134 for future fix.

Learnt from: alishaz-polymath
PR: calcom/cal.com#23247
File: packages/features/webhooks/lib/service/FormWebhookService.ts:0-0
Timestamp: 2025-08-21T13:55:23.470Z
Learning: In the new webhook architecture for Cal.com, schedulePayload is considered legacy code that doesn't fit the clean architecture. The new architecture keeps webhook scheduling logic within the Service layer, specifically through a new method WebhookService.scheduleDelayedWebhooks, rather than using the old centralized schedulePayload helper.

Learnt from: alishaz-polymath
PR: calcom/cal.com#23247
File: packages/features/webhooks/lib/factory/WebhookPayloadFactory.ts:274-282
Timestamp: 2025-08-21T12:28:42.018Z
Learning: In webhook DTOs in packages/features/webhooks/lib/dto/types.ts, the booking fields are restricted structures containing only specific fields (id, eventTypeId, userId, and sometimes additional fields like startTime or smsReminderNumber) rather than full database booking objects, so there are no security or PII leakage concerns when using these booking objects in webhook payloads.

Learnt from: hariombalhara
PR: calcom/cal.com#23736
File: packages/features/bookings/lib/reschedule/determineReschedulePreventionRedirect.ts:73-84
Timestamp: 2025-09-12T11:23:34.118Z
Learning: The test file packages/features/bookings/lib/reschedule/determineReschedulePreventionRedirect.test.ts explicitly documents on line 236 that the current behavior of forceRescheduleForCancelledBooking affecting both CANCELLED and REJECTED bookings is known to be incorrect, but is preserved as "Current Behavior" for backward compatibility. The test comment states the expected behavior should be that REJECTED bookings redirect to booking details even when forceRescheduleForCancelledBooking=true.

Learnt from: eunjae-lee
PR: calcom/cal.com#22106
File: packages/features/insights/components/FailedBookingsByField.tsx:65-71
Timestamp: 2025-07-15T12:59:34.389Z
Learning: In the FailedBookingsByField component (packages/features/insights/components/FailedBookingsByField.tsx), although routingFormId is typed as optional in useInsightsParameters, the system automatically enforces a routing form filter, so routingFormId is always present in practice. This means the data always contains only one entry, making the single-entry destructuring approach safe.

Learnt from: vijayraghav-io
PR: calcom/cal.com#16878
File: packages/app-store/feishucalendar/api/callback.ts:72-79
Timestamp: 2025-09-08T07:27:42.903Z
Learning: In the Cal.com codebase, some calendar integrations like google-calendar already use SelectedCalendarRepository.create for selectedCalendar creation, which automatically triggers reconnection logic, while others like feishucalendar use direct prisma.selectedCalendar.create calls that bypass the repository hooks.

Learnt from: nangelina
PR: calcom/cal.com#23486
File: packages/app-store/kyzon-space/config.json:5-5
Timestamp: 2025-09-01T07:31:00.963Z
Learning: In Cal.com's video integration system, credential types (e.g., "kyzon-space_video") are transformed to app names by removing underscores using `cred.type.split("_").join("")` in videoClient.ts line 28. This means the key in packages/app-store/index.ts should match the underscore-removed version (e.g., "kyzon-spacevideo") rather than the original type name. This same pattern is used in other parts of the system like getCalendar.ts.

Learnt from: nangelina
PR: calcom/cal.com#23486
File: packages/app-store/kyzon-space/config.json:5-5
Timestamp: 2025-09-01T07:31:00.963Z
Learning: In Cal.com's video integration system, credential types (e.g., "kyzon-space_video") are transformed to app names by removing underscores using `cred.type.split("_").join("")` in videoClient.ts line 28. This means the key in packages/app-store/index.ts should match the underscore-removed version (e.g., "kyzon-spacevideo") rather than the original type name.

Learnt from: alishaz-polymath
PR: calcom/cal.com#23247
File: packages/features/webhooks/lib/factory/WebhookPayloadFactory.ts:274-282
Timestamp: 2025-08-21T12:28:42.018Z
Learning: In BookingPaymentInitiatedDTO and other webhook DTOs in packages/features/webhooks/lib/dto/types.ts, the booking field is a restricted structure containing only specific fields (id, eventTypeId, userId) rather than the full database booking object, so there are no security or PII leakage concerns when passing the booking object to buildEventPayload.

Learnt from: anglerfishlyy
PR: calcom/cal.com#0
File: :0-0
Timestamp: 2025-08-27T16:39:38.192Z
Learning: anglerfishlyy successfully implemented CAL-3076 email invitation feature for Cal.com team event-types in PR #23312. The feature allows inviting people via email directly from assignment flow, with automatic team invitation if email doesn't belong to existing team member. Implementation includes Host type modifications (userId?: number, email?: string, isPending?: boolean), CheckedTeamSelect component updates with CreatableSelect, TRPC schema validation with zod email validation, and integration with existing teamInvite system.

packages/trpc/server/routers/viewer/calendars/setDestinationCalendar.handler.ts (3)

90-101: Use a lightweight existence check (avoid fetching whole row).

Replace findFirst with count/select to follow our Prisma guideline and reduce data fetch.

Apply:

-    if (
-      !(await prisma.eventType.findFirst({
-        where: {
-          id: eventTypeId,
-          userId: user.id,
-        },
-      }))
-    ) {
+    const hasAccess = await prisma.eventType.count({
+      where: { id: eventTypeId, userId: user.id },
+    });
+    if (!hasAccess) {
       throw new TRPCError({
         code: "UNAUTHORIZED",
         message: `You don't have access to event type ${eventTypeId}`,
       });
     }

---

64-64: Minor: prefer flatMap for readability.

Equivalent but clearer than map(...).flat().

-  const allCals = connectedCalendars.map((cal) => cal.calendars ?? []).flat();
+  const allCals = connectedCalendars.flatMap((c) => c.calendars ?? []);

---

74-76: Type the where variable to avoid implicit any.

Small TS hygiene to keep types tight.

-  let where;
+  let where: { eventTypeId?: number; userId?: number };

packages/trpc/server/routers/viewer/teams/get.handler.test.ts (1)

82-82: Type the mock as vi.Mock (not jest.Mock).

You’re on Vitest; using jest.Mock can cause type drift.

-    (getConnectedCalendars as jest.Mock).mockResolvedValue({
+    (getConnectedCalendars as unknown as vi.Mock).mockResolvedValue({

packages/features/credentials/handleDeleteCredential.ts (1)

490-491: Prefer named export over default for consistency and tree‑shaking.

Switching to a named export matches our repo conventions.

-export default handleDeleteCredential;
+export { handleDeleteCredential };

Note: add/update imports accordingly.

packages/trpc/server/routers/viewer/calendars/setDestinationCalendar.handler.test.ts (1)

82-82: Use vi.Mock instead of jest.Mock.

Stay consistent with Vitest types.

-    (getConnectedCalendars as jest.Mock).mockResolvedValue({
+    (getConnectedCalendars as unknown as vi.Mock).mockResolvedValue({

packages/trpc/server/routers/viewer/bookings/editLocation.handler.ts (1)

291-293: Use logger instead of console.log for errors.

Keeps observability consistent.

-  } catch (error) {
-    console.log("Error sending LocationChangeEmails", safeStringify(error));
-  }
+  } catch (error) {
+    logger.warn("Error sending LocationChangeEmails", safeStringify(error));
+  }

packages/features/ee/round-robin/roundRobinReassignment.ts (2)

268-275: Guard the non-null assertion on previousRRHostAttendee.

Avoid potential runtime crash if attendee not found.

-    const previousRRHostAttendee = booking.attendees.find(
-      (attendee) => attendee.email === previousRRHost.email
-    );
-    await prisma.attendee.update({
-      where: {
-        id: previousRRHostAttendee!.id,
-      },
+    const previousRRHostAttendee = booking.attendees.find(
+      (a) => a.email === previousRRHost.email
+    );
+    if (!previousRRHostAttendee) {
+      throw new Error("Previous RR host attendee not found");
+    }
+    await prisma.attendee.update({
+      where: { id: previousRRHostAttendee.id },
       data: {
         name: reassignedRRHost.name || "",
         email: reassignedRRHost.email,
         timeZone: reassignedRRHost.timeZone,
         locale: reassignedRRHost.locale,
       },
     });

---

508-509: Prefer named export over default.

Improves tree‑shaking and refactorability.

-export default roundRobinReassignment;
+export { roundRobinReassignment };

Note: update import sites accordingly.

packages/lib/getConnectedDestinationCalendars.ts (2)

236-241: Use the app logger instead of console.log.

Replace noisy console logs with the structured logger.

-  console.log(
+  log.debug(
     `Upsert the selectedCalendar record to the DB for user ${user.id} with details ${JSON.stringify(
       selectedCalendar
     )}`
   );

---

342-359: Replace Array.every early‑exit hack with clearer some/loop.

Improves readability without behavior change.

-      // We use every so that we can exit early once we find the matching calendar
-      connectedCalendars.every((cal) => {
+      // Stop at first match
+      connectedCalendars.some((cal) => {
         const index = (cal.calendars || []).findIndex(
           (calendar) =>
             calendar.externalId === destinationCal.externalId &&
             calendar.integration === destinationCal.integration
         );
         if (index >= 0 && cal.calendars) {
           cal.calendars[index].isSelected = true;
           calendarToEnsureIsEnabledForConflictCheck = {
             externalId: destinationCal.externalId,
             integration: destinationCal.integration || "",
           };
-          return false;
+          return true;
         }
-
-        return true;
+        return false;
       });

packages/features/bookings/lib/handleNewBooking/test/team-bookings/round-robin.test.ts (1)

786-786: Updated EventManager path: ok. Consider named export to avoid default.

When feasible, switch EventManager to a named export to align with repo guidelines; tests can then const { EventManager } = await import(...).

If you want, I can raise a follow‑up PR to convert EventManager to named export and update call sites.

packages/features/bookings/lib/handleSeats/reschedule/rescheduleSeatedBooking.ts (1)

20-26: Prefer named export over default.

Optional, but aligns with tree‑shaking and refactor hygiene.

-const rescheduleSeatedBooking = async (
+export const rescheduleSeatedBooking = async (
   // If this function is being called then rescheduleUid is defined
   rescheduleSeatedBookingObject: RescheduleSeatedBookingObject,
@@
-export default rescheduleSeatedBooking;
+// named export above

Also applies to: 144-145

packages/features/bookings/lib/handleSeats/create/createNewSeat.ts (2)

107-112: Use select with findUnique to limit fields.

Return only fields you actually need from BookingSeat.

-  const newBookingSeat = await prisma.bookingSeat.findUnique({
-    where: {
-      referenceUid: attendeeUniqueId,
-    },
-  });
+  const newBookingSeat = await prisma.bookingSeat.findUnique({
+    where: { referenceUid: attendeeUniqueId },
+    select: { id: true, referenceUid: true }, // extend if more fields are required downstream
+  });

---

24-29: Prefer named export over default.

Keeps exports consistent across the feature module.

-const createNewSeat = async (
+export const createNewSeat = async (
   rescheduleSeatedBookingObject: NewSeatedBookingObject,
@@
-export default createNewSeat;
+// named export above

Also applies to: 225-226

apps/api/v1/pages/api/destination-calendars/_post.ts (1)

100-109: Narrow Prisma fetch for existence check.

Only presence is needed; select just the id.

-  if (parsedBody.eventTypeId) {
-    const eventType = await prisma.eventType.findFirst({
-      where: { id: parsedBody.eventTypeId, userId: parsedBody.userId },
-    });
+  if (parsedBody.eventTypeId) {
+    const eventType = await prisma.eventType.findFirst({
+      where: { id: parsedBody.eventTypeId, userId: parsedBody.userId },
+      select: { id: true },
+    });

packages/features/bookings/lib/handleSeats/reschedule/attendee/attendeeRescheduleSeatedBooking.ts (2)

5-5: Prefer named export for EventManager (if available)

If EventManager is (or can be) a named export, prefer it for tree‑shaking and consistency.

-import type EventManager from "@calcom/features/bookings/lib/EventManager";
+import type { EventManager } from "@calcom/features/bookings/lib/EventManager";

---

107-107: Avoid default export for module ergonomics

Switching to a named export improves refactors and IDE tooling. Non‑blocking for this PR.

-export default attendeeRescheduleSeatedBooking;
+export { attendeeRescheduleSeatedBooking };

packages/lib/getBusyTimes.ts (1)

132-179: Day.js in hot loops — consider minimizing allocations

This reduce/map path is hot; repeated dayjs() and toDate() calls add GC pressure. Cache conversions or use numeric epochs where possible; keep .utc() where required.

Also applies to: 249-265

packages/trpc/server/routers/viewer/eventTypes/get.handler.ts (1)

1-1: Prefer named import for getEventTypeById (if exported)

Aligns with our guideline to avoid default exports.

-import getEventTypeById from "@calcom/features/eventtypes/lib/getEventTypeById";
+import { getEventTypeById } from "@calcom/features/eventtypes/lib/getEventTypeById";

packages/trpc/server/routers/viewer/routing-forms/findTeamMembersMatchingAttributeLogicOfRoute.handler.ts (1)

78-103: Use Prisma select instead of include

Per repo guideline, avoid include so we don’t fetch unnecessary base scalar fields. Switch to select and enumerate only needed fields.

-  const form = await prisma.app_RoutingForms_Form.findFirst({
+  const form = await prisma.app_RoutingForms_Form.findFirst({
     where: {
       id: formId,
       ...entityPrismaWhereClause({ userId: user.id }),
     },
-    include: {
-      team: {
-        select: {
-          parentId: true,
-          parent: {
-            select: {
-              slug: true,
-            },
-          },
-          metadata: true,
-        },
-      },
-      user: {
-        select: {
-          id: true,
-          username: true,
-          movedToProfileId: true,
-        },
-      },
-    },
+    select: {
+      id: true,
+      teamId: true,
+      // Add other scalar fields used by getSerializableForm if required
+      team: {
+        select: {
+          parentId: true,
+          parent: { select: { slug: true } },
+          metadata: true,
+        },
+      },
+      user: { select: { id: true, username: true, movedToProfileId: true } },
+    },
   });

If getSerializableForm needs additional fields, expand the select accordingly (you can derive a typed select via Prisma.validator for compile‑time safety).

packages/features/bookings/lib/handleNewBooking.ts (2)

39-39: EventManager import path migration — LGTM

Consider exposing EventManager as a named export to match our no‑default‑exports guideline (non‑blocking).

-import EventManager, { placeholderCreatedEvent } from "@calcom/features/bookings/lib/EventManager";
+import { EventManager, placeholderCreatedEvent } from "@calcom/features/bookings/lib/EventManager";

---

2402-2402: Prefer named export for handler

Optional, but aligns with our export policy and eases refactors.

-export default handler;
+export { handler };

tests/libs/__mocks__/CalendarManager.ts (1)

4-6: Path update LGTM; declare the mock before vi.mock to avoid TDZ gotchas.

The new module path is correct. Minor nit: define CalendarManagerMock before registering the factory so the closure can’t hit TDZ if executed earlier by Vitest.

Apply this diff:

-import type * as CalendarManager from "@calcom/features/calendars/lib/CalendarManager";
-
-vi.mock("@calcom/features/calendars/lib/CalendarManager", () => CalendarManagerMock);
+import type * as CalendarManager from "@calcom/features/calendars/lib/CalendarManager";
+// Declare mock before registering the factory
+const CalendarManagerMock = mockDeep<typeof CalendarManager>();
+vi.mock("@calcom/features/calendars/lib/CalendarManager", () => CalendarManagerMock);
@@
-const CalendarManagerMock = mockDeep<typeof CalendarManager>();
 export default CalendarManagerMock;

packages/features/ee/round-robin/roundRobinManualReassignment.ts (1)

26-26: Import path updated — consider moving EventManager to a named export later.

Non-blocking: named exports ease tree‑shaking and refactors; keep default for now to minimize churn.

packages/features/eventtypes/lib/getEventTypeById.ts (4)

247-253: Limit Prisma select on destinationCalendar.

Per guidelines, avoid returning full rows. Select only required fields to prevent accidental leakage.

Apply:

-    destinationCalendar = await prisma.destinationCalendar.findFirst({
-      where: {
-        userId: userId,
-        eventTypeId: null,
-      },
-    });
+    destinationCalendar = await prisma.destinationCalendar.findFirst({
+      where: { userId, eventTypeId: null },
+      select: {
+        id: true,
+        integration: true,
+        externalId: true,
+        primaryEmail: true,
+      },
+    });

---

76-85: Parallelize profile enrichments to reduce latency.

The three for-loops await sequentially; use Promise.all to parallelize.

-  const eventTeamMembershipsWithUserProfile = [];
-  for (const eventTeamMembership of rawEventType.team?.members || []) {
-    eventTeamMembershipsWithUserProfile.push({
-      ...eventTeamMembership,
-      user: await userRepo.enrichUserWithItsProfile({
-        user: eventTeamMembership.user,
-      }),
-    });
-  }
+  const eventTeamMembershipsWithUserProfile = await Promise.all(
+    (rawEventType.team?.members || []).map(async (m) => ({
+      ...m,
+      user: await userRepo.enrichUserWithItsProfile({ user: m.user }),
+    }))
+  );
@@
-  const childrenWithUserProfile = [];
-  for (const child of rawEventType.children || []) {
-    childrenWithUserProfile.push({
-      ...child,
-      owner: child.owner
-        ? await userRepo.enrichUserWithItsProfile({
-            user: child.owner,
-          })
-        : null,
-    });
-  }
+  const childrenWithUserProfile = await Promise.all(
+    (rawEventType.children || []).map(async (child) => ({
+      ...child,
+      owner: child.owner ? await userRepo.enrichUserWithItsProfile({ user: child.owner }) : null,
+    }))
+  );
@@
-  const eventTypeUsersWithUserProfile = [];
-  for (const eventTypeUser of rawEventType.users) {
-    eventTypeUsersWithUserProfile.push(
-      await userRepo.enrichUserWithItsProfile({
-        user: eventTypeUser,
-      })
-    );
-  }
+  const eventTypeUsersWithUserProfile = await Promise.all(
+    rawEventType.users.map((u) => userRepo.enrichUserWithItsProfile({ user: u }))
+  );

Also applies to: 86-96, 98-105

---

131-131: Avoid unknown cast for locations.

Prefer tightening getRawEventType’s return type so locations are typed as LocationObject[] at the source, avoiding as unknown as ... here.

---

289-289: Prefer named export over default.

To improve tree‑shaking and refactors, export getEventTypeById as named. Consider a follow‑up codemod to migrate imports.

-export default getEventTypeById;
+export { getEventTypeById };

packages/features/bookings/lib/handleSeats/reschedule/owner/ownerRescheduleSeatedBooking.ts (1)

56-56: Prefer named export.

Switch to a named export to align with repo guidelines.

-export default ownerRescheduleSeatedBooking;
+export { ownerRescheduleSeatedBooking };

packages/features/bookings/lib/EventManager.ts (4)

128-128: Type alias name collides with value; rename for clarity.

Avoid using createdEventSchema as both a value and a type alias name.

-type createdEventSchema = z.infer<typeof createdEventSchema>;
+type CreatedEvent = z.infer<typeof createdEventSchema>;
@@
-      let createdEventObj: createdEventSchema | null = null;
+      let createdEventObj: CreatedEvent | null = null;

Also applies to: 383-399

---

879-881: Use safeStringify in logs (avoid leaking PII).

Two logs still use JSON.stringify.

-        log.silly("Creating Calendar event", JSON.stringify({ destination }));
+        log.silly("Creating Calendar event", safeStringify({ destination }));
@@
-    log.silly("updateAllCalendarEvents", JSON.stringify({ event, booking, newBookingId }));
+    log.silly("updateAllCalendarEvents", safeStringify({ event, booking, newBookingId }));

Also applies to: 1071-1071

---

1046-1050: Reject with Error instance (not string).

Helps error handling and stack traces.

-      return Promise.reject(
-        `No suitable credentials given for the requested integration name:${event.location}`
-      );
+      return Promise.reject(
+        new Error(`No suitable credentials given for the requested integration name: ${event.location}`)
+      );

---

1313-1313: Consider named export instead of default class export.

Non-blocking, but aligns with repo guidance and tree‑shaking.

-export default class EventManager {
+export class EventManager {

Follow-up: update imports across callers.

packages/platform/libraries/event-types.ts (1)

1-1: Avoid default-import bridge; directly re-export named symbol

Prefer a direct named re-export to improve tree-shaking and remove an unnecessary binding.

Apply:

-import EventManager from "@calcom/features/bookings/lib/EventManager";
+export { EventManager } from "@calcom/features/bookings/lib/EventManager";
@@
-export { EventManager };

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

Learnt from: supalarry
PR: calcom/cal.com#23364
File: apps/api/v2/src/ee/event-types/event-types_2024_06_14/transformers/internal-to-api/internal-to-api.spec.ts:295-296
Timestamp: 2025-08-27T13:32:46.887Z
Learning: In calcom/cal.com, when transforming booking fields from internal to API format, tests in organizations-event-types.e2e-spec.ts already expect name field label and placeholder to be empty strings ("") rather than undefined. PR changes that set these to explicit empty strings are typically fixing implementation to match existing test expectations rather than breaking changes.

Learnt from: hariombalhara
PR: calcom/cal.com#23736
File: packages/features/bookings/lib/reschedule/determineReschedulePreventionRedirect.ts:73-84
Timestamp: 2025-09-12T11:23:34.118Z
Learning: The test file packages/features/bookings/lib/reschedule/determineReschedulePreventionRedirect.test.ts explicitly documents on line 236 that the current behavior of forceRescheduleForCancelledBooking affecting both CANCELLED and REJECTED bookings is known to be incorrect, but is preserved as "Current Behavior" for backward compatibility. The test comment states the expected behavior should be that REJECTED bookings redirect to booking details even when forceRescheduleForCancelledBooking=true.

Learnt from: din-prajapati
PR: calcom/cal.com#21854
File: packages/app-store/office365calendar/__tests__/unit_tests/SubscriptionManager.test.ts:0-0
Timestamp: 2025-08-05T12:04:29.037Z
Learning: In packages/app-store/office365calendar/lib/CalendarService.ts, the fetcher method in Office365CalendarService class is public, not private. It was specifically changed from private to public in this PR to support proper testing and external access patterns.

Learnt from: vijayraghav-io
PR: calcom/cal.com#16878
File: packages/app-store/feishucalendar/api/callback.ts:72-79
Timestamp: 2025-09-08T07:27:42.903Z
Learning: Four calendar integrations in Cal.com still use direct prisma.selectedCalendar.create instead of SelectedCalendarRepository.create: feishucalendar, zohocalendar, office365calendar, and larkcalendar. These bypass repository hooks and won't trigger reconnection logic for BookingReferences.

Learnt from: vijayraghav-io
PR: calcom/cal.com#16878
File: packages/app-store/feishucalendar/api/callback.ts:72-79
Timestamp: 2025-09-08T07:27:42.903Z
Learning: In the Cal.com codebase, some calendar integrations like google-calendar already use SelectedCalendarRepository.create for selectedCalendar creation, which automatically triggers reconnection logic, while others like feishucalendar use direct prisma.selectedCalendar.create calls that bypass the repository hooks.

Learnt from: CarinaWolli
PR: calcom/cal.com#22296
File: packages/lib/bookings/filterHostsBySameRoundRobinHost.ts:41-42
Timestamp: 2025-07-22T11:42:47.623Z
Learning: The filterHostsBySameRoundRobinHost function in packages/lib/bookings/filterHostsBySameRoundRobinHost.ts has a known limitation where it doesn't work correctly with fixed hosts or round robin groups. This is pre-existing technical debt that was already broken before the round robin groups feature. CarinaWolli has documented this in Linear issue CAL-6134 for future fix.

Learnt from: hbjORbj
PR: calcom/cal.com#23475
File: packages/features/credentials/handleDeleteCredential.ts:5-10
Timestamp: 2025-09-12T07:15:58.030Z
Learning: When EventTypeAppMetadataSchema is used only in z.infer<typeof EventTypeAppMetadataSchema> type annotations or type casts, it can be imported as a type-only import since this usage is purely at the TypeScript type level and doesn't require the runtime value.

Learnt from: supalarry
PR: calcom/cal.com#23217
File: apps/api/v2/src/ee/event-types/event-types_2024_06_14/services/output-event-types.service.ts:93-94
Timestamp: 2025-08-21T13:44:06.805Z
Learning: In apps/api/v2/src/ee/event-types/event-types_2024_06_14/event-types.repository.ts, repository functions that use explicit Prisma select clauses (like getEventTypeWithSeats) are used for specific purposes and don't need to include all EventType fields like bookingRequiresAuthentication. These methods don't feed into the general OutputEventTypesService_2024_06_14 flow.

Learnt from: ShashwatPS
PR: calcom/cal.com#23638
File: packages/trpc/server/routers/viewer/calendars/setDestinationReminder.handler.test.ts:198-199
Timestamp: 2025-09-06T11:00:34.372Z
Learning: In calcom/cal.com PR #23638, the maintainer ShashwatPS determined that authorization checks in the setDestinationReminder handler are "not applicable" when CodeRabbit suggested adding user-scoped WHERE clauses to prevent users from modifying other users' destination calendar reminder settings.

Learnt from: SinghaAnirban005
PR: calcom/cal.com#23343
File: packages/features/insights/server/trpc-router.ts:1080-1101
Timestamp: 2025-08-26T08:08:23.395Z
Learning: In packages/features/insights/server/trpc-router.ts, when filtering personal event types (userId provided, no teamId, not isAll), the query correctly uses user.id (authenticated user) instead of the input userId parameter for security reasons. This prevents users from accessing other users' personal event types by passing arbitrary user IDs.

Learnt from: eunjae-lee
PR: calcom/cal.com#22106
File: packages/features/insights/components/FailedBookingsByField.tsx:65-71
Timestamp: 2025-07-15T12:59:34.389Z
Learning: In the FailedBookingsByField component (packages/features/insights/components/FailedBookingsByField.tsx), although routingFormId is typed as optional in useInsightsParameters, the system automatically enforces a routing form filter, so routingFormId is always present in practice. This means the data always contains only one entry, making the single-entry destructuring approach safe.

Learnt from: CR
PR: calcom/cal.com#0
File: .cursor/rules/review.mdc:0-0
Timestamp: 2025-07-28T11:50:23.946Z
Learning: Applies to **/*.{ts,tsx} : Flag excessive Day.js use in performance-critical code; prefer native Date or Day.js `.utc()` in hot paths like loops

Learnt from: alishaz-polymath
PR: calcom/cal.com#23247
File: packages/features/webhooks/lib/service/FormWebhookService.ts:0-0
Timestamp: 2025-08-21T13:55:23.470Z
Learning: In the new webhook architecture for Cal.com, schedulePayload is considered legacy code that doesn't fit the clean architecture. The new architecture keeps webhook scheduling logic within the Service layer, specifically through a new method WebhookService.scheduleDelayedWebhooks, rather than using the old centralized schedulePayload helper.

Learnt from: alishaz-polymath
PR: calcom/cal.com#23247
File: packages/features/webhooks/lib/factory/WebhookPayloadFactory.ts:274-282
Timestamp: 2025-08-21T12:28:42.018Z
Learning: In webhook DTOs in packages/features/webhooks/lib/dto/types.ts, the booking fields are restricted structures containing only specific fields (id, eventTypeId, userId, and sometimes additional fields like startTime or smsReminderNumber) rather than full database booking objects, so there are no security or PII leakage concerns when using these booking objects in webhook payloads.

apps/api/v1/pages/api/event-types/_get.ts (1)

67-71: Instantiating HttpError without throwing is a no‑op; either throw or remove.

Current code never returns 404. Pick one behavior and enforce it explicitly to avoid confusion.

-  // this really should return [], but backwards compatibility..
-  if (data.length === 0) new HttpError({ statusCode: 404, message: "No event types were found" });
+  // For backwards compatibility, return 404 when no event types are found.
+  if (data.length === 0) {
+    throw new HttpError({ statusCode: 404, message: "No event types were found" });
+  }

apps/api/v1/pages/api/bookings/[id]/transcripts/[recordingId]/_get.ts (1)

61-66: Use select instead of include; fetch only fields you read.

We only need type and meetingId from references. This removes the lint suppression and reduces data load.

-  const booking = await prisma.booking.findUnique({
-    where: { id: bookingId },
-    // eslint-disable-next-line @calcom/eslint/no-prisma-include-true
-    include: { references: true },
-  });
+  const booking = await prisma.booking.findUnique({
+    where: { id: bookingId },
+    select: {
+      references: {
+        select: { type: true, meetingId: true },
+      },
+    },
+  });

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

Learnt from: supalarry
PR: calcom/cal.com#23364
File: apps/api/v2/src/ee/event-types/event-types_2024_06_14/transformers/internal-to-api/internal-to-api.spec.ts:295-296
Timestamp: 2025-08-27T13:32:46.887Z
Learning: In calcom/cal.com, when transforming booking fields from internal to API format, tests in organizations-event-types.e2e-spec.ts already expect name field label and placeholder to be empty strings ("") rather than undefined. PR changes that set these to explicit empty strings are typically fixing implementation to match existing test expectations rather than breaking changes.

Learnt from: supalarry
PR: calcom/cal.com#23217
File: apps/api/v2/src/ee/event-types/event-types_2024_06_14/services/output-event-types.service.ts:93-94
Timestamp: 2025-08-21T13:44:06.805Z
Learning: In apps/api/v2/src/ee/event-types/event-types_2024_06_14/event-types.repository.ts, repository functions that use explicit Prisma select clauses (like getEventTypeWithSeats) are used for specific purposes and don't need to include all EventType fields like bookingRequiresAuthentication. These methods don't feed into the general OutputEventTypesService_2024_06_14 flow.

Learnt from: CR
PR: calcom/cal.com#0
File: .cursor/rules/review.mdc:0-0
Timestamp: 2025-07-28T11:50:23.946Z
Learning: Applies to **/*.ts : For Prisma queries, only select data you need; never use `include`, always use `select`