Scheduling current limitations

Storefront and tenancy

• The public storefront shows one team per deployment, chosen by STOREFRONT_TEAM_SLUG or the oldest active public team. There is no multi-team directory or per-team domain routing.
• The dashboard supports several teams per user through memberships, but the storefront does not switch between them.

Bookings

• RescheduleRequest exists in the schema, but no workflow writes it. There is no request-and-approve rescheduling. Reschedules apply directly through transitionBooking, manageStorefrontBooking, or manageCustomerBooking.
• Booking statuses are limited to pending, confirmed, cancelled, completed, and no_show. There is no waitlist and no seat-based group booking.
• Recurring bookings support cancelling future occurrences of a series. Editing a whole series at once is not provided.

Integrations

• Calendars: Google and Microsoft only. Each needs its own OAuth app and credentials. No CalDAV or Apple Calendar.
• Conferencing: Zoom and Microsoft Teams connections take operator-supplied access tokens. There is no in-app OAuth flow or automatic token refresh for them. An expired token moves the connection to needs_reauth. The adapter sends the same request body shape to every vendor, so test it against each vendor's API before you rely on it.
• Payments: Stripe and a manual adapter only. No tax calculation, invoices, or payouts.
• SMS: only a generic HTTPS endpoint (SCHEDULING_SMS_ENDPOINT). No vendor adapter.
• Object storage is configured, but no current list stores files or images in it.
• The MCP endpoint offers only generic GraphQL tools. It has no scheduling-specific commands and does not accept API keys; it uses the session cookie.

Configuration and deployment

• features/keystone/lib/productionConfig.ts defines production configuration rules (required secrets, HTTPS public URL, SMTP, storage, and calendar settings), but current source does not call assertProductionConfiguration at start-up. A misconfigured deployment can start and fail later at the point of use.
• Outside production, several secrets fall back to values derived from SESSION_SECRET. Set dedicated values before shared use.
• npm run dev and npm run build apply migrations to DATABASE_URL. Separate migration from the build if you need immutable release images.
• The outbox runs inside the production Next.js process (instrumentation.ts) or alongside it (npm run start:production). Serverless hosts need a separate long-lived worker.
• .env.example includes AI_CHAT_ENABLED, but current source does not read it. Shared AI chat is available whenever OPENROUTER_API_KEY and OPENROUTER_MODEL are set.

No certification

The repository does not provide HIPAA, PCI DSS, SOC 2, GDPR, or accessibility certification. It does not verify that hosts are qualified for the services they offer. Stripe handles card data on its hosted pages, but your deployment still needs its own security, privacy, retention, and payment review. Tests, builds, and HTTP responses show only that the exercised paths ran.