@catlabtech/mycal-core 0.1.0 → 0.1.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 CatLab Tech
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,56 @@
+# @catlabtech/mycal-core
+
+[![npm version](https://img.shields.io/npm/v/@catlabtech/mycal-core.svg)](https://www.npmjs.com/package/@catlabtech/mycal-core)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://github.com/Junhui20/malaysia-calendar-api/blob/main/LICENSE)
+
+Shared types, Zod schemas, and business logic for the **Malaysia Calendar API**. This is the underlying library used by [`@catlabtech/mycal-sdk`](https://www.npmjs.com/package/@catlabtech/mycal-sdk) and [`@catlabtech/mycal-mcp-server`](https://www.npmjs.com/package/@catlabtech/mycal-mcp-server).
+
+> Most users should install the SDK or MCP server instead. Use `@catlabtech/mycal-core` directly only if you need the raw types, schemas, or pure business logic (e.g. for server-side implementations or custom runtimes).
+
+## What's inside
+
+- **TypeScript types** — `Holiday`, `State`, `SchoolTerm`, `SchoolHoliday`, `Exam`, `CheckDateResult`, `BusinessDaysResult`, `LongWeekend`, etc.
+- **Zod schemas** — runtime validation matching the types exactly
+- **State resolver** — alias → canonical state code (e.g. `kl` → `kuala-lumpur`)
+- **Weekend logic** — per-state weekend history including Johor's 2014–2024 Fri–Sat switch
+- **Business day calculations** — state-aware, holiday-aware
+- **Cuti ganti generator** — replacement holiday logic per state rules
+- **iCal generator** — RFC 5545 output with auto-refresh hints
+- **School calendar logic** — term / holiday lookups for Kumpulan A and B
+
+## Install
+
+```bash
+npm install @catlabtech/mycal-core
+```
+
+Node 18+. ESM only.
+
+## Example
+
+```ts
+import {
+  resolveStateCode,
+  countBusinessDays,
+  isWeekend,
+  type Holiday,
+  type State,
+} from "@catlabtech/mycal-core";
+
+// Alias resolution
+const { canonical } = resolveStateCode("kl", allStates);  // "kuala-lumpur"
+
+// Type-safe filtering
+const federal = holidays.filter((h): h is Holiday => h.type === "federal");
+```
+
+## Documentation
+
+- **Full docs:** [https://mycal-web.pages.dev/docs](https://mycal-web.pages.dev/docs)
+- **Type reference:** [https://mycal-web.pages.dev/docs/sdk/reference](https://mycal-web.pages.dev/docs/sdk/reference)
+
+## License
+
+MIT — © catlab.tech
+
+Issues and contributions: [github.com/Junhui20/malaysia-calendar-api](https://github.com/Junhui20/malaysia-calendar-api)

package/dist/index.d.ts

@@ -6,6 +6,7 @@ interface LocalizedString {
     readonly zh?: string;
 }
 type HolidayType = "federal" | "state" | "islamic" | "islamic_state" | "replacement" | "adhoc";
+type HolidayCategory = "public" | "bank" | "optional" | "half_day" | "observance";
 type HolidayStatus = "confirmed" | "tentative" | "announced" | "cancelled";
 type GazetteLevel = "P" | "N";
 type HolidaySource = "jpm" | "jakim" | "state-gov" | "community" | "admin";
@@ -23,6 +24,8 @@ interface Holiday {
     readonly hijriDate?: string;
     readonly gazetteRef?: string;
     readonly source: HolidaySource;
+    readonly category?: HolidayCategory;
+    readonly isEstimated?: boolean;
     readonly confirmedAt?: string;
     readonly createdAt: string;
     readonly updatedAt: string;
@@ -42,6 +45,7 @@ interface State {
     readonly type: StateType;
     readonly weekendHistory: readonly WeekendConfig[];
     readonly group: StateGroup;
+    readonly isoCode?: string;
 }
 interface SchoolTermSegment {
     readonly startDate: string;
@@ -120,6 +124,15 @@ interface LongWeekend {
     readonly weekendDays: number;
     readonly bridgeDaysNeeded: number;
 }
+interface LeaveSuggestion {
+    readonly startDate: string;
+    readonly endDate: string;
+    readonly totalDays: number;
+    readonly leaveDates: readonly string[];
+    readonly leaveCost: number;
+    readonly efficiency: number;
+    readonly holidays: readonly Holiday[];
+}
 interface ChangelogEntry {
     readonly timestamp: string;
     readonly event: string;
@@ -132,6 +145,7 @@ interface ChangelogEntry {
     }>;
 }
 
+declare const holidayCategorySchema: z.ZodEnum<["public", "bank", "optional", "half_day", "observance"]>;
 declare const holidaySchema: z.ZodObject<{
     id: z.ZodString;
     date: z.ZodString;
@@ -158,6 +172,8 @@ declare const holidaySchema: z.ZodObject<{
     hijriDate: z.ZodOptional<z.ZodString>;
     gazetteRef: z.ZodOptional<z.ZodString>;
     source: z.ZodEnum<["jpm", "jakim", "state-gov", "community", "admin"]>;
+    category: z.ZodOptional<z.ZodEnum<["public", "bank", "optional", "half_day", "observance"]>>;
+    isEstimated: z.ZodOptional<z.ZodBoolean>;
     confirmedAt: z.ZodOptional<z.ZodString>;
     createdAt: z.ZodString;
     updatedAt: z.ZodString;
@@ -181,6 +197,8 @@ declare const holidaySchema: z.ZodObject<{
     isReplacementFor?: string | undefined;
     hijriDate?: string | undefined;
     gazetteRef?: string | undefined;
+    category?: "public" | "bank" | "optional" | "half_day" | "observance" | undefined;
+    isEstimated?: boolean | undefined;
     confirmedAt?: string | undefined;
 }, {
     type: "federal" | "state" | "islamic" | "islamic_state" | "replacement" | "adhoc";
@@ -202,6 +220,8 @@ declare const holidaySchema: z.ZodObject<{
     isReplacementFor?: string | undefined;
     hijriDate?: string | undefined;
     gazetteRef?: string | undefined;
+    category?: "public" | "bank" | "optional" | "half_day" | "observance" | undefined;
+    isEstimated?: boolean | undefined;
     confirmedAt?: string | undefined;
 }>;
 declare const holidayFileSchema: z.ZodArray<z.ZodObject<{
@@ -230,6 +250,8 @@ declare const holidayFileSchema: z.ZodArray<z.ZodObject<{
     hijriDate: z.ZodOptional<z.ZodString>;
     gazetteRef: z.ZodOptional<z.ZodString>;
     source: z.ZodEnum<["jpm", "jakim", "state-gov", "community", "admin"]>;
+    category: z.ZodOptional<z.ZodEnum<["public", "bank", "optional", "half_day", "observance"]>>;
+    isEstimated: z.ZodOptional<z.ZodBoolean>;
     confirmedAt: z.ZodOptional<z.ZodString>;
     createdAt: z.ZodString;
     updatedAt: z.ZodString;
@@ -253,6 +275,8 @@ declare const holidayFileSchema: z.ZodArray<z.ZodObject<{
     isReplacementFor?: string | undefined;
     hijriDate?: string | undefined;
     gazetteRef?: string | undefined;
+    category?: "public" | "bank" | "optional" | "half_day" | "observance" | undefined;
+    isEstimated?: boolean | undefined;
     confirmedAt?: string | undefined;
 }, {
     type: "federal" | "state" | "islamic" | "islamic_state" | "replacement" | "adhoc";
@@ -274,6 +298,8 @@ declare const holidayFileSchema: z.ZodArray<z.ZodObject<{
     isReplacementFor?: string | undefined;
     hijriDate?: string | undefined;
     gazetteRef?: string | undefined;
+    category?: "public" | "bank" | "optional" | "half_day" | "observance" | undefined;
+    isEstimated?: boolean | undefined;
     confirmedAt?: string | undefined;
 }>, "many">;
 declare const stateSchema: z.ZodObject<{
@@ -310,6 +336,7 @@ declare const stateSchema: z.ZodObject<{
         group: "A" | "B";
     }>, "many">;
     group: z.ZodEnum<["A", "B"]>;
+    isoCode: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     code: string;
     type: "state" | "federal_territory";
@@ -326,6 +353,7 @@ declare const stateSchema: z.ZodObject<{
         weekendDays: number[];
         group: "A" | "B";
     }[];
+    isoCode?: string | undefined;
 }, {
     code: string;
     type: "state" | "federal_territory";
@@ -342,6 +370,7 @@ declare const stateSchema: z.ZodObject<{
         weekendDays: number[];
         group: "A" | "B";
     }[];
+    isoCode?: string | undefined;
 }>;
 declare const statesFileSchema: z.ZodArray<z.ZodObject<{
     code: z.ZodString;
@@ -377,6 +406,7 @@ declare const statesFileSchema: z.ZodArray<z.ZodObject<{
         group: "A" | "B";
     }>, "many">;
     group: z.ZodEnum<["A", "B"]>;
+    isoCode: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     code: string;
     type: "state" | "federal_territory";
@@ -393,6 +423,7 @@ declare const statesFileSchema: z.ZodArray<z.ZodObject<{
         weekendDays: number[];
         group: "A" | "B";
     }[];
+    isoCode?: string | undefined;
 }, {
     code: string;
     type: "state" | "federal_territory";
@@ -409,6 +440,7 @@ declare const statesFileSchema: z.ZodArray<z.ZodObject<{
         weekendDays: number[];
         group: "A" | "B";
     }[];
+    isoCode?: string | undefined;
 }>, "many">;
 declare const schoolTermSchema: z.ZodObject<{
     id: z.ZodString;
@@ -750,18 +782,75 @@ interface HolidayFilter {
 }
 declare function filterHolidays(holidays: readonly Holiday[], filter: HolidayFilter): readonly Holiday[];
 declare function findHolidaysByDate(date: string, holidays: readonly Holiday[], stateCode?: string): readonly Holiday[];
+/**
+ * Index holidays by their ISO date for O(1) date lookups, skipping cancelled
+ * holidays and (when `stateCode` is given) holidays that do not apply to that
+ * state. Shared by the business-day and long-weekend scanners so they don't each
+ * re-filter the array on every day.
+ */
+declare function groupHolidaysByDate(holidays: readonly Holiday[], stateCode?: string): Map<string, Holiday[]>;
 declare function findNextHoliday(afterDate: string, holidays: readonly Holiday[], stateCode?: string, type?: HolidayType, limit?: number): readonly Holiday[];
 
 declare function calculateReplacementHolidays(holidays: readonly Holiday[], state: State): readonly Holiday[];
 
 declare function countBusinessDays(start: string, end: string, state: State, holidays: readonly Holiday[]): BusinessDaysResult;
 declare function addBusinessDays(startDate: string, daysToAdd: number, state: State, holidays: readonly Holiday[]): string;
+declare function subtractBusinessDays(startDate: string, daysToSubtract: number, state: State, holidays: readonly Holiday[]): string;
+declare function isBusinessDay(date: string, state: State, holidays: readonly Holiday[]): boolean;
+declare function nextBusinessDay(date: string, state: State, holidays: readonly Holiday[]): string;
+declare function previousBusinessDay(date: string, state: State, holidays: readonly Holiday[]): string;
+
+/**
+ * Natural long weekends for a state in a given year: runs of 3+ consecutive
+ * non-working days (weekend days and/or public holidays) that need no leave.
+ *
+ * Shared by the REST `/holidays/long-weekends` route and the MCP server so the
+ * two cannot diverge.
+ */
+declare function findLongWeekends(year: number, state: State, holidays: readonly Holiday[]): LongWeekend[];
+/**
+ * Leave optimizer: where can you spend up to `maxLeave` working days to chain
+ * weekends and public holidays into the longest possible continuous break?
+ *
+ * Returns suggestions sorted by efficiency (days off gained per leave day spent),
+ * then by total length. Each suggestion's `leaveDates` are the exact working days
+ * to request off — e.g. "take 2026-09-14 & 2026-09-15 → 2026-09-12…2026-09-16".
+ */
+declare function optimizeLeave(year: number, state: State, holidays: readonly Holiday[], maxLeave?: number): LeaveSuggestion[];
+
+/**
+ * Input-validation and request-safety helpers shared by the API layer. Kept here
+ * (pure, dependency-free) so they are unit-testable and reusable by any consumer.
+ */
+/** True only for a real calendar date in strict `YYYY-MM-DD` form (rejects 2026-02-30). */
+declare function isValidISODate(value: string): boolean;
+/**
+ * Constant-time string comparison for secrets (API keys). Returns early only on
+ * a length mismatch; otherwise compares every byte so timing does not leak how
+ * many leading characters matched.
+ */
+declare function timingSafeEqualString(a: string, b: string): boolean;
+/**
+ * SSRF guard for user-supplied callback/webhook URLs. Requires HTTPS and rejects
+ * obviously-internal targets (localhost, *.local/.internal, and private/loopback/
+ * link-local/reserved IP literals incl. the 169.254.169.254 cloud-metadata IP).
+ *
+ * Best-effort at registration time: DNS is NOT resolved here, so delivery code
+ * MUST re-validate the resolved IP to defend against DNS rebinding.
+ */
+declare function isSafePublicHttpsUrl(raw: string): boolean;
 
 declare function findSchoolTermByDate(date: string, terms: readonly SchoolTerm[], group: StateGroup): SchoolTerm | null;
 declare function findSchoolHolidayByDate(date: string, holidays: readonly SchoolHoliday[], group: StateGroup, stateCode?: string): SchoolHoliday | null;
+/**
+ * List the school holidays that apply to a group (and optionally a specific
+ * state, honouring `states`/`excludeStates` overrides). Shared by the REST
+ * `/school/holidays` and iCal feed routes so the filter logic lives in one place.
+ */
+declare function filterSchoolHolidays(holidays: readonly SchoolHoliday[], group: StateGroup, stateCode?: string): readonly SchoolHoliday[];
 declare function isSchoolDay(date: string, terms: readonly SchoolTerm[], schoolHolidays: readonly SchoolHoliday[], group: StateGroup, isPublicHoliday: boolean, isWeekendDay: boolean, stateCode?: string): boolean;
 
-declare function generateIcal(holidays: readonly Holiday[], schoolHolidays: readonly SchoolHoliday[], calendarName: string): string;
+declare function generateIcal(holidays: readonly Holiday[], schoolHolidays: readonly SchoolHoliday[], calendarName: string, calendarDescription?: string): string;
 
 /**
  * Basic Hijri date utilities.
@@ -800,4 +889,4 @@ declare const ISLAMIC_HOLIDAY_DATES: readonly {
     readonly hijriDay: number;
 }[];
 
-export { type BusinessDaysResult, type ChangelogEntry, type CheckDateResult, type Exam, type ExamSource, type ExamType, type GazetteLevel, HIJRI_MONTHS, type HijriMonth, type Holiday, type HolidayFilter, type HolidaySource, type HolidayStatus, type HolidayType, ISLAMIC_HOLIDAY_DATES, type LocalizedString, type LongWeekend, type SchoolHoliday, type SchoolHolidayType, type SchoolTerm, type SchoolTermSegment, type State, type StateGroup, type StateType, type WeekendConfig, addBusinessDays, addDays, calculateReplacementHolidays, countBusinessDays, diffDays, examSchema, examsFileSchema, filterHolidays, findHolidaysByDate, findNextHoliday, findSchoolHolidayByDate, findSchoolTermByDate, formatHijriDate, generateIcal, getDayOfWeekName, getStateByCode, getStatesByGroup, getWeekendConfig, getWeekendDayNames, holidayFileSchema, holidaySchema, isSchoolDay, isWeekend, nextWorkingDay, parseHijriDate, resolveStateCode, schoolHolidaySchema, schoolHolidaysFileSchema, schoolTermSchema, schoolTermsFileSchema, stateSchema, statesFileSchema };
+export { type BusinessDaysResult, type ChangelogEntry, type CheckDateResult, type Exam, type ExamSource, type ExamType, type GazetteLevel, HIJRI_MONTHS, type HijriMonth, type Holiday, type HolidayCategory, type HolidayFilter, type HolidaySource, type HolidayStatus, type HolidayType, ISLAMIC_HOLIDAY_DATES, type LeaveSuggestion, type LocalizedString, type LongWeekend, type SchoolHoliday, type SchoolHolidayType, type SchoolTerm, type SchoolTermSegment, type State, type StateGroup, type StateType, type WeekendConfig, addBusinessDays, addDays, calculateReplacementHolidays, countBusinessDays, diffDays, examSchema, examsFileSchema, filterHolidays, filterSchoolHolidays, findHolidaysByDate, findLongWeekends, findNextHoliday, findSchoolHolidayByDate, findSchoolTermByDate, formatHijriDate, generateIcal, getDayOfWeekName, getStateByCode, getStatesByGroup, getWeekendConfig, getWeekendDayNames, groupHolidaysByDate, holidayCategorySchema, holidayFileSchema, holidaySchema, isBusinessDay, isSafePublicHttpsUrl, isSchoolDay, isValidISODate, isWeekend, nextBusinessDay, nextWorkingDay, optimizeLeave, parseHijriDate, previousBusinessDay, resolveStateCode, schoolHolidaySchema, schoolHolidaysFileSchema, schoolTermSchema, schoolTermsFileSchema, stateSchema, statesFileSchema, subtractBusinessDays, timingSafeEqualString };

package/dist/index.js

@@ -21,6 +21,13 @@ var holidayStatusSchema = z.enum([
   "cancelled"
 ]);
 var gazetteLevelSchema = z.enum(["P", "N"]);
+var holidayCategorySchema = z.enum([
+  "public",
+  "bank",
+  "optional",
+  "half_day",
+  "observance"
+]);
 var holidaySourceSchema = z.enum([
   "jpm",
   "jakim",
@@ -42,6 +49,8 @@ var holidaySchema = z.object({
   hijriDate: z.string().optional(),
   gazetteRef: z.string().optional(),
   source: holidaySourceSchema,
+  category: holidayCategorySchema.optional(),
+  isEstimated: z.boolean().optional(),
   confirmedAt: z.string().optional(),
   createdAt: z.string(),
   updatedAt: z.string()
@@ -60,7 +69,8 @@ var stateSchema = z.object({
   name: localizedString,
   type: z.enum(["state", "federal_territory"]),
   weekendHistory: z.array(weekendConfigSchema).min(1),
-  group: stateGroupSchema
+  group: stateGroupSchema,
+  isoCode: z.string().optional()
 });
 var statesFileSchema = z.array(stateSchema);
 var schoolTermSegmentSchema = z.object({
@@ -186,9 +196,9 @@ function nextWorkingDay(date, state, holidayDates) {
   return candidate;
 }
 function diffDays(start, end) {
-  const s = (/* @__PURE__ */ new Date(start + "T00:00:00")).getTime();
-  const e = (/* @__PURE__ */ new Date(end + "T00:00:00")).getTime();
-  return Math.round((e - s) / (1e3 * 60 * 60 * 24));
+  const s = (/* @__PURE__ */ new Date(start + "T12:00:00Z")).getTime();
+  const e = (/* @__PURE__ */ new Date(end + "T12:00:00Z")).getTime();
+  return Math.round((e - s) / 864e5);
 }
 
 // src/filter.ts
@@ -222,6 +232,19 @@ function findHolidaysByDate(date, holidays, stateCode) {
     return true;
   });
 }
+function groupHolidaysByDate(holidays, stateCode) {
+  const map = /* @__PURE__ */ new Map();
+  for (const h of holidays) {
+    if (h.status === "cancelled") continue;
+    if (stateCode && !h.states.includes("*") && !h.states.includes(stateCode)) {
+      continue;
+    }
+    const list = map.get(h.date);
+    if (list) list.push(h);
+    else map.set(h.date, [h]);
+  }
+  return map;
+}
 function findNextHoliday(afterDate, holidays, stateCode, type, limit = 1) {
   const filtered = holidays.filter((h) => {
     if (h.date <= afterDate) return false;
@@ -236,6 +259,26 @@ function findNextHoliday(afterDate, holidays, stateCode, type, limit = 1) {
 }
 
 // src/replacement.ts
+function makeReplacement(source, replacementDate, stateCode, idSuffix, now) {
+  return {
+    id: `${source.id}-${idSuffix}`,
+    date: replacementDate,
+    name: {
+      ms: `Cuti Ganti ${source.name.ms}`,
+      en: `Replacement for ${source.name.en}`,
+      zh: source.name.zh ? `\u8865\u5047 ${source.name.zh}` : void 0
+    },
+    type: "replacement",
+    status: source.status,
+    states: [stateCode],
+    isPublicHoliday: true,
+    gazetteLevel: source.gazetteLevel,
+    isReplacementFor: source.id,
+    source: source.source,
+    createdAt: now,
+    updatedAt: now
+  };
+}
 function calculateReplacementHolidays(holidays, state) {
   const stateHolidays = holidays.filter(
     (h) => h.status !== "cancelled" && (h.states.includes("*") || h.states.includes(state.code))
@@ -246,29 +289,13 @@ function calculateReplacementHolidays(holidays, state) {
   const now = (/* @__PURE__ */ new Date()).toISOString();
   for (const holiday of stateHolidays) {
     if (holiday.type === "replacement") continue;
-    if (isWeekend(holiday.date, state)) {
-      const allOccupied = /* @__PURE__ */ new Set([...holidayDates, ...replacementDates]);
-      const replacementDate = nextWorkingDay(holiday.date, state, allOccupied);
-      replacementDates.add(replacementDate);
-      replacements.push({
-        id: `${holiday.id}-replacement`,
-        date: replacementDate,
-        name: {
-          ms: `Cuti Ganti ${holiday.name.ms}`,
-          en: `Replacement for ${holiday.name.en}`,
-          zh: holiday.name.zh ? `\u8865\u5047 ${holiday.name.zh}` : void 0
-        },
-        type: "replacement",
-        status: holiday.status,
-        states: [state.code],
-        isPublicHoliday: true,
-        gazetteLevel: holiday.gazetteLevel,
-        isReplacementFor: holiday.id,
-        source: holiday.source,
-        createdAt: now,
-        updatedAt: now
-      });
-    }
+    if (!isWeekend(holiday.date, state)) continue;
+    const occupied = /* @__PURE__ */ new Set([...holidayDates, ...replacementDates]);
+    const replacementDate = nextWorkingDay(holiday.date, state, occupied);
+    replacementDates.add(replacementDate);
+    replacements.push(
+      makeReplacement(holiday, replacementDate, state.code, "replacement", now)
+    );
   }
   const dateGroups = /* @__PURE__ */ new Map();
   for (const h of stateHolidays) {
@@ -281,49 +308,51 @@ function calculateReplacementHolidays(holidays, state) {
     const stateHoliday = group.find((h) => h.gazetteLevel === "N");
     if (!stateHoliday) continue;
     if (replacements.some((r) => r.isReplacementFor === stateHoliday.id)) continue;
-    const allOccupied = /* @__PURE__ */ new Set([...holidayDates, ...replacementDates]);
-    const replacementDate = nextWorkingDay(stateHoliday.date, state, allOccupied);
+    const occupied = /* @__PURE__ */ new Set([...holidayDates, ...replacementDates]);
+    const replacementDate = nextWorkingDay(stateHoliday.date, state, occupied);
     replacementDates.add(replacementDate);
-    replacements.push({
-      id: `${stateHoliday.id}-overlap-replacement`,
-      date: replacementDate,
-      name: {
-        ms: `Cuti Ganti ${stateHoliday.name.ms}`,
-        en: `Replacement for ${stateHoliday.name.en}`,
-        zh: stateHoliday.name.zh ? `\u8865\u5047 ${stateHoliday.name.zh}` : void 0
-      },
-      type: "replacement",
-      status: stateHoliday.status,
-      states: [state.code],
-      isPublicHoliday: true,
-      gazetteLevel: stateHoliday.gazetteLevel,
-      isReplacementFor: stateHoliday.id,
-      source: stateHoliday.source,
-      createdAt: now,
-      updatedAt: now
-    });
+    replacements.push(
+      makeReplacement(
+        stateHoliday,
+        replacementDate,
+        state.code,
+        "overlap-replacement",
+        now
+      )
+    );
   }
   return replacements;
 }
 
 // src/business-days.ts
+var MAX_SPAN_DAYS = 366 * 100;
 function countBusinessDays(start, end, state, holidays) {
-  const totalDays = diffDays(start, end) + 1;
+  if (start > end) {
+    throw new RangeError(`start (${start}) must be on or before end (${end})`);
+  }
+  const holidayMap = groupHolidaysByDate(holidays, state.code);
   let businessDays = 0;
   let weekendCount = 0;
   let holidayCount = 0;
+  let totalDays = 0;
   const holidayList = [];
+  const seenIds = /* @__PURE__ */ new Set();
   let current = start;
   while (current <= end) {
+    if (++totalDays > MAX_SPAN_DAYS) {
+      throw new RangeError(
+        `date range exceeds the maximum span of ${MAX_SPAN_DAYS} days`
+      );
+    }
     const weekend = isWeekend(current, state);
-    const dayHolidays = findHolidaysByDate(current, holidays, state.code);
-    const isHoliday = dayHolidays.length > 0;
+    const dayHolidays = holidayMap.get(current);
     if (weekend) {
       weekendCount++;
-    } else if (isHoliday) {
+    } else if (dayHolidays) {
       holidayCount++;
       for (const h of dayHolidays) {
-        if (!holidayList.some((existing) => existing.id === h.id)) {
+        if (!seenIds.has(h.id)) {
+          seenIds.add(h.id);
           holidayList.push(h);
         }
       }
@@ -340,19 +369,208 @@ function countBusinessDays(start, end, state, holidays) {
     holidayList
   };
 }
+function assertValidStep(value, label) {
+  if (!Number.isInteger(value)) {
+    throw new RangeError(`${label} must be an integer (received ${value})`);
+  }
+  if (value < 0) {
+    throw new RangeError(`${label} must be non-negative (received ${value})`);
+  }
+  if (value > MAX_SPAN_DAYS) {
+    throw new RangeError(`${label} exceeds the maximum of ${MAX_SPAN_DAYS}`);
+  }
+}
 function addBusinessDays(startDate, daysToAdd, state, holidays) {
+  assertValidStep(daysToAdd, "daysToAdd");
+  const holidayMap = groupHolidaysByDate(holidays, state.code);
   let remaining = daysToAdd;
   let current = startDate;
+  let guard = 0;
   while (remaining > 0) {
+    if (++guard > MAX_SPAN_DAYS * 2) {
+      throw new RangeError("addBusinessDays exceeded its iteration limit");
+    }
     current = addDays(current, 1);
-    const weekend = isWeekend(current, state);
-    const isHoliday = findHolidaysByDate(current, holidays, state.code).length > 0;
-    if (!weekend && !isHoliday) {
+    if (!isWeekend(current, state) && !holidayMap.has(current)) {
+      remaining--;
+    }
+  }
+  return current;
+}
+function subtractBusinessDays(startDate, daysToSubtract, state, holidays) {
+  assertValidStep(daysToSubtract, "daysToSubtract");
+  const holidayMap = groupHolidaysByDate(holidays, state.code);
+  let remaining = daysToSubtract;
+  let current = startDate;
+  let guard = 0;
+  while (remaining > 0) {
+    if (++guard > MAX_SPAN_DAYS * 2) {
+      throw new RangeError("subtractBusinessDays exceeded its iteration limit");
+    }
+    current = addDays(current, -1);
+    if (!isWeekend(current, state) && !holidayMap.has(current)) {
       remaining--;
     }
   }
   return current;
 }
+function isBusinessDay(date, state, holidays) {
+  if (isWeekend(date, state)) return false;
+  return !groupHolidaysByDate(holidays, state.code).has(date);
+}
+function nextBusinessDay(date, state, holidays) {
+  return addBusinessDays(date, 1, state, holidays);
+}
+function previousBusinessDay(date, state, holidays) {
+  return subtractBusinessDays(date, 1, state, holidays);
+}
+
+// src/long-weekend.ts
+function findLongWeekends(year, state, holidays) {
+  const holidayMap = groupHolidaysByDate(holidays, state.code);
+  const isOff = (d) => isWeekend(d, state) || holidayMap.has(d);
+  const yearEnd = `${year}-12-31`;
+  const result = [];
+  let current = `${year}-01-01`;
+  while (current <= yearEnd) {
+    if (!isOff(current)) {
+      current = addDays(current, 1);
+      continue;
+    }
+    const startDate = current;
+    const streakHolidays = [];
+    let weekendDays = 0;
+    let totalDays = 0;
+    while (current <= yearEnd && isOff(current)) {
+      if (isWeekend(current, state)) weekendDays++;
+      const hs = holidayMap.get(current);
+      if (hs) streakHolidays.push(...hs);
+      totalDays++;
+      current = addDays(current, 1);
+    }
+    if (totalDays >= 3) {
+      result.push({
+        startDate,
+        endDate: addDays(current, -1),
+        totalDays,
+        holidays: streakHolidays,
+        weekendDays,
+        bridgeDaysNeeded: 0
+        // natural long weekend — no leave required
+      });
+    }
+  }
+  return result;
+}
+function optimizeLeave(year, state, holidays, maxLeave = 3) {
+  if (!Number.isInteger(maxLeave) || maxLeave < 1) return [];
+  const holidayMap = groupHolidaysByDate(holidays, state.code);
+  const isOff = (d) => isWeekend(d, state) || holidayMap.has(d);
+  const yearEnd = `${year}-12-31`;
+  const suggestions = [];
+  let s = `${year}-01-01`;
+  while (s <= yearEnd) {
+    if (!isOff(s) || isOff(addDays(s, -1))) {
+      s = addDays(s, 1);
+      continue;
+    }
+    let leave = 0;
+    let d = s;
+    while (d <= yearEnd) {
+      if (!isOff(d)) {
+        leave++;
+        if (leave > maxLeave) break;
+      }
+      const next = addDays(d, 1);
+      if (leave >= 1 && isOff(d) && !isOff(next)) {
+        const leaveDates = [];
+        const within = [];
+        let c = s;
+        while (c <= d) {
+          if (!isOff(c)) leaveDates.push(c);
+          const hs = holidayMap.get(c);
+          if (hs) within.push(...hs);
+          c = addDays(c, 1);
+        }
+        const totalDays = diffDays(s, d) + 1;
+        suggestions.push({
+          startDate: s,
+          endDate: d,
+          totalDays,
+          leaveDates,
+          leaveCost: leaveDates.length,
+          efficiency: Math.round(totalDays / leaveDates.length * 100) / 100,
+          holidays: within
+        });
+      }
+      d = next;
+    }
+    s = addDays(s, 1);
+  }
+  suggestions.sort(
+    (a, b) => b.efficiency - a.efficiency || b.totalDays - a.totalDays || a.startDate.localeCompare(b.startDate)
+  );
+  const seen = /* @__PURE__ */ new Set();
+  return suggestions.filter((x) => {
+    const key = `${x.startDate}:${x.endDate}`;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+
+// src/validation.ts
+function isValidISODate(value) {
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(value)) return false;
+  const d = /* @__PURE__ */ new Date(value + "T12:00:00Z");
+  return !Number.isNaN(d.getTime()) && d.toISOString().slice(0, 10) === value;
+}
+function timingSafeEqualString(a, b) {
+  const enc = new TextEncoder();
+  const ab = enc.encode(a);
+  const bb = enc.encode(b);
+  if (ab.length !== bb.length) return false;
+  let diff = 0;
+  for (let i = 0; i < ab.length; i++) diff |= ab[i] ^ bb[i];
+  return diff === 0;
+}
+function isPrivateOrReservedIp(host) {
+  if (host.includes(":")) {
+    if (host === "::1" || host === "::") return true;
+    if (host.startsWith("fe80")) return true;
+    if (host.startsWith("fc") || host.startsWith("fd")) return true;
+    if (host.startsWith("::ffff:")) return isPrivateOrReservedIp(host.slice(7));
+    return false;
+  }
+  const m = host.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (!m) return false;
+  const octets = m.slice(1).map(Number);
+  if (octets.some((n) => n > 255)) return true;
+  const [a, b] = octets;
+  if (a === 0) return true;
+  if (a === 10) return true;
+  if (a === 127) return true;
+  if (a === 169 && b === 254) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 192 && b === 168) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true;
+  if (a >= 224) return true;
+  return false;
+}
+function isSafePublicHttpsUrl(raw) {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "https:") return false;
+  const host = url.hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (host === "localhost" || host.endsWith(".localhost") || host.endsWith(".local") || host.endsWith(".internal")) {
+    return false;
+  }
+  return !isPrivateOrReservedIp(host);
+}
 
 // src/school.ts
 function findSchoolTermByDate(date, terms, group) {
@@ -369,6 +587,14 @@ function findSchoolHolidayByDate(date, holidays, group, stateCode) {
     return true;
   }) ?? null;
 }
+function filterSchoolHolidays(holidays, group, stateCode) {
+  return holidays.filter((h) => {
+    if (h.group !== group) return false;
+    if (stateCode && h.excludeStates?.includes(stateCode)) return false;
+    if (h.states && stateCode && !h.states.includes(stateCode)) return false;
+    return true;
+  });
+}
 function isSchoolDay(date, terms, schoolHolidays, group, isPublicHoliday, isWeekendDay, stateCode) {
   if (isWeekendDay) return false;
   if (isPublicHoliday) return false;
@@ -385,11 +611,34 @@ function isSchoolDay(date, terms, schoolHolidays, group, isPublicHoliday, isWeek
 
 // src/ical.ts
 function escapeIcal(text) {
-  return text.replace(/[\\;,]/g, (c) => `\\${c}`).replace(/\n/g, "\\n");
+  return text.replace(/[\\;,]/g, (c) => `\\${c}`).replace(/\r\n|\r|\n/g, "\\n");
 }
 function formatIcalDate(date) {
   return date.replace(/-/g, "");
 }
+function holidayCategories(h) {
+  const cats = ["Public Holiday"];
+  switch (h.type) {
+    case "federal":
+      cats.push("Federal");
+      break;
+    case "state":
+      cats.push("State");
+      break;
+    case "islamic":
+    case "islamic_state":
+      cats.push("Religious", "Islamic");
+      break;
+    case "replacement":
+      cats.push("Replacement");
+      break;
+    case "adhoc":
+      cats.push("Ad-hoc");
+      break;
+  }
+  if (h.status === "tentative") cats.push("Tentative");
+  return cats.map(escapeIcal).join(",");
+}
 function holidayToVevent(h) {
   const dtstart = formatIcalDate(h.date);
   const dtend = h.endDate ? formatIcalDate(h.endDate) : formatIcalDate(h.date);
@@ -399,7 +648,9 @@ function holidayToVevent(h) {
     `DTEND;VALUE=DATE:${dtend}`,
     `SUMMARY:${escapeIcal(h.name.en)}`,
     `DESCRIPTION:${escapeIcal(h.name.ms)}${h.hijriDate ? ` (${h.hijriDate})` : ""}`,
+    `CATEGORIES:${holidayCategories(h)}`,
     `UID:${h.id}@mycal.my`,
+    "TRANSP:TRANSPARENT",
     `STATUS:${h.status === "tentative" ? "TENTATIVE" : "CONFIRMED"}`,
     "END:VEVENT"
   ].join("\r\n");
@@ -411,18 +662,28 @@ function schoolHolidayToVevent(h) {
     `DTEND;VALUE=DATE:${formatIcalDate(h.endDate)}`,
     `SUMMARY:[School] ${escapeIcal(h.name.en)}`,
     `DESCRIPTION:${escapeIcal(h.name.ms)}`,
+    "CATEGORIES:School Holiday",
     `UID:${h.id}@mycal.my`,
+    "TRANSP:TRANSPARENT",
     "STATUS:CONFIRMED",
     "END:VEVENT"
   ].join("\r\n");
 }
-function generateIcal(holidays, schoolHolidays, calendarName) {
+function generateIcal(holidays, schoolHolidays, calendarName, calendarDescription = "Malaysian public holidays and school calendar \u2014 mycal.my") {
   const header = [
     "BEGIN:VCALENDAR",
     "VERSION:2.0",
     "PRODID:-//MyCal//Malaysia Calendar API//EN",
     `X-WR-CALNAME:${escapeIcal(calendarName)}`,
+    `NAME:${escapeIcal(calendarName)}`,
+    // RFC 7986
+    `X-WR-CALDESC:${escapeIcal(calendarDescription)}`,
+    `DESCRIPTION:${escapeIcal(calendarDescription)}`,
+    // RFC 7986
     "X-WR-TIMEZONE:Asia/Kuala_Lumpur",
+    "COLOR:forestgreen",
+    // RFC 7986 (CSS3 colour name)
+    "X-APPLE-CALENDAR-COLOR:#22C55E",
     "CALSCALE:GREGORIAN",
     "METHOD:PUBLISH",
     "REFRESH-INTERVAL;VALUE=DURATION:PT6H",
@@ -490,7 +751,9 @@ export {
   examSchema,
   examsFileSchema,
   filterHolidays,
+  filterSchoolHolidays,
   findHolidaysByDate,
+  findLongWeekends,
   findNextHoliday,
   findSchoolHolidayByDate,
   findSchoolTermByDate,
@@ -501,17 +764,27 @@ export {
   getStatesByGroup,
   getWeekendConfig,
   getWeekendDayNames,
+  groupHolidaysByDate,
+  holidayCategorySchema,
   holidayFileSchema,
   holidaySchema,
+  isBusinessDay,
+  isSafePublicHttpsUrl,
   isSchoolDay,
+  isValidISODate,
   isWeekend,
+  nextBusinessDay,
   nextWorkingDay,
+  optimizeLeave,
   parseHijriDate,
+  previousBusinessDay,
   resolveStateCode,
   schoolHolidaySchema,
   schoolHolidaysFileSchema,
   schoolTermSchema,
   schoolTermsFileSchema,
   stateSchema,
-  statesFileSchema
+  statesFileSchema,
+  subtractBusinessDays,
+  timingSafeEqualString
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@catlabtech/mycal-core",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Core types, schemas, and business logic for the Malaysia Calendar API",
   "keywords": [
     "malaysia",
@@ -10,14 +10,18 @@
     "typescript"
   ],
   "license": "MIT",
+  "author": "CatLab Tech",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Junhui20/malaysia-calendar-api.git",
     "directory": "packages/core"
   },
-  "homepage": "https://mycal.pages.dev",
-  "bugs": "https://github.com/Junhui20/malaysia-calendar-api/issues",
+  "homepage": "https://mycal-web.pages.dev",
+  "bugs": {
+    "url": "https://github.com/Junhui20/malaysia-calendar-api/issues"
+  },
   "type": "module",
+  "sideEffects": false,
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -28,6 +32,7 @@
   },
   "files": [
     "dist",
+    "LICENSE",
     "README.md"
   ],
   "publishConfig": {
@@ -42,7 +47,7 @@
     "zod": "^3.24.0"
   },
   "scripts": {
-    "build": "tsup src/index.ts --format esm --dts",
+    "build": "tsup src/index.ts --format esm --dts --clean",
     "dev": "tsup src/index.ts --format esm --dts --watch",
     "test": "node __tests__/run-tests.cjs"
   }