@forcecalendar/core 2.1.63 → 2.1.65

package/core/ics/ICSHandler.js

@@ -4,7 +4,6 @@
  */
 
 import { ICSParser } from './ICSParser.js';
-import { Event } from '../events/Event.js';
 import { RecurrenceEngineV2 } from '../events/RecurrenceEngineV2.js';
 
 export class ICSHandler {
@@ -180,40 +179,127 @@ export class ICSHandler {
    * @returns {Promise<Object>} Import results
    */
   async importFromURL(url, options = {}) {
-    // Validate URL before fetching to prevent SSRF
-    ICSHandler.validateURL(url);
+    const {
+      requestTimeout = 30000,
+      maxRedirects = 5,
+      maxFileSize = this.parser.maxFileSize || ICSParser.MAX_INPUT_SIZE
+    } = options;
 
     try {
       const controller = new AbortController();
-      const timeout = setTimeout(() => controller.abort(), 30000); // 30s timeout
+      const timeout = setTimeout(() => controller.abort(), requestTimeout);
 
-      const response = await fetch(url, { signal: controller.signal });
-      clearTimeout(timeout);
+      try {
+        const response = await this.fetchSafeURL(url, {
+          signal: controller.signal,
+          maxRedirects
+        });
 
-      if (!response.ok) {
-        throw new Error(`Failed to fetch ICS: ${response.statusText}`);
-      }
+        if (!response.ok) {
+          throw new Error(`Failed to fetch ICS: ${response.statusText}`);
+        }
 
-      // Validate Content-Type header
-      const contentType = response.headers.get('content-type') || '';
-      const allowedTypes = ['text/calendar', 'text/plain', 'application/octet-stream'];
-      const typeMatch = allowedTypes.some(t => contentType.toLowerCase().includes(t));
-      if (contentType && !typeMatch) {
-        throw new Error(
-          `Unexpected Content-Type: ${contentType}. Expected text/calendar or text/plain`
-        );
-      }
+        // Validate Content-Type header
+        const contentType = response.headers.get('content-type') || '';
+        const allowedTypes = ['text/calendar', 'text/plain', 'application/octet-stream'];
+        const typeMatch = allowedTypes.some(t => contentType.toLowerCase().includes(t));
+        if (contentType && !typeMatch) {
+          throw new Error(
+            `Unexpected Content-Type: ${contentType}. Expected text/calendar or text/plain`
+          );
+        }
+
+        const contentLength = response.headers.get('content-length');
+        if (contentLength && Number(contentLength) > maxFileSize) {
+          throw new Error(`ICS response exceeds maximum size of ${maxFileSize / (1024 * 1024)}MB`);
+        }
 
-      const icsString = await response.text();
-      return this.import(icsString, options);
+        const icsString = await this.readResponseText(response, maxFileSize);
+        return this.import(icsString, options);
+      } finally {
+        clearTimeout(timeout);
+      }
     } catch (error) {
       if (error.name === 'AbortError') {
-        throw new Error('Failed to import from URL: request timed out after 30 seconds');
+        throw new Error(`Failed to import from URL: request timed out after ${requestTimeout}ms`);
       }
       throw new Error(`Failed to import from URL: ${error.message}`);
     }
   }
 
+  /**
+   * Fetch a URL after validating the initial URL and each redirect target.
+   * @private
+   */
+  async fetchSafeURL(url, { signal, maxRedirects }) {
+    if (typeof fetch !== 'function') {
+      throw new Error('fetch API is not available in this environment');
+    }
+
+    let currentURL = url;
+    const manualRedirects = ICSHandler.isNodeRuntime();
+
+    for (let redirectCount = 0; redirectCount <= maxRedirects; redirectCount++) {
+      await ICSHandler.validateURLForFetch(currentURL);
+
+      const response = await fetch(currentURL, {
+        signal,
+        redirect: manualRedirects ? 'manual' : 'follow'
+      });
+
+      if (
+        !manualRedirects ||
+        response.status < 300 ||
+        response.status >= 400 ||
+        !response.headers.get('location')
+      ) {
+        return response;
+      }
+
+      currentURL = new URL(response.headers.get('location'), currentURL).toString();
+    }
+
+    throw new Error(`Too many redirects while fetching ICS feed (limit ${maxRedirects})`);
+  }
+
+  /**
+   * Read a response body while enforcing a byte limit.
+   * @private
+   */
+  async readResponseText(response, maxFileSize) {
+    if (!response.body || typeof response.body.getReader !== 'function') {
+      const text = await response.text();
+      if (text.length > maxFileSize) {
+        throw new Error(`ICS response exceeds maximum size of ${maxFileSize / (1024 * 1024)}MB`);
+      }
+      return text;
+    }
+
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    let received = 0;
+    let text = '';
+    let done = false;
+
+    while (!done) {
+      const chunk = await reader.read();
+      done = chunk.done;
+      if (done) break;
+
+      const { value } = chunk;
+      received += value.byteLength;
+      if (received > maxFileSize) {
+        await reader.cancel();
+        throw new Error(`ICS response exceeds maximum size of ${maxFileSize / (1024 * 1024)}MB`);
+      }
+
+      text += decoder.decode(value, { stream: true });
+    }
+
+    text += decoder.decode();
+    return text;
+  }
+
   /**
    * Validate a URL for safety (prevent SSRF attacks)
    * @param {string} url - URL to validate
@@ -234,32 +320,123 @@ export class ICSHandler {
       );
     }
 
-    const hostname = parsed.hostname.toLowerCase();
+    if (parsed.username || parsed.password) {
+      throw new Error('URLs with embedded credentials are not allowed');
+    }
 
-    // Block localhost
-    if (hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '::1') {
-      throw new Error('URLs pointing to localhost are not allowed');
+    const hostname = ICSHandler.normalizeHostname(parsed.hostname);
+    if (ICSHandler.isBlockedHostname(hostname) || ICSHandler.isPrivateIPAddress(hostname)) {
+      throw new Error('URLs pointing to private/internal networks are not allowed');
     }
 
-    // Block private/internal IP ranges
-    const privatePatterns = [
-      /^127\./, // 127.0.0.0/8
-      /^10\./, // 10.0.0.0/8
-      /^192\.168\./, // 192.168.0.0/16
-      /^172\.(1[6-9]|2\d|3[01])\./, // 172.16.0.0/12
-      /^169\.254\./, // 169.254.0.0/16 (link-local)
-      /^0\./, // 0.0.0.0/8
-      /^\[?fe80:/i, // IPv6 link-local
-      /^\[?fc00:/i, // IPv6 unique local
-      /^\[?fd/i, // IPv6 unique local
-      /^\[?::1\]?$/ // IPv6 loopback
-    ];
-
-    for (const pattern of privatePatterns) {
-      if (pattern.test(hostname)) {
-        throw new Error('URLs pointing to private/internal networks are not allowed');
+    return parsed;
+  }
+
+  /**
+   * Validate a URL and, in Node runtimes, ensure DNS does not resolve privately.
+   * @param {string} url - URL to validate
+   * @returns {Promise<URL>} Parsed safe URL
+   */
+  static async validateURLForFetch(url) {
+    const parsed = ICSHandler.validateURL(url);
+
+    if (ICSHandler.isNodeRuntime() && !ICSHandler.isIPAddress(parsed.hostname)) {
+      const dns = await import('node:dns/promises');
+      const addresses = await dns.lookup(parsed.hostname, { all: true, verbatim: true });
+
+      for (const address of addresses) {
+        if (ICSHandler.isPrivateIPAddress(address.address)) {
+          throw new Error('URL hostname resolves to a private/internal network address');
+        }
       }
     }
+
+    return parsed;
+  }
+
+  /**
+   * @private
+   */
+  static isNodeRuntime() {
+    return typeof process !== 'undefined' && !!process.versions?.node;
+  }
+
+  /**
+   * @private
+   */
+  static normalizeHostname(hostname) {
+    return String(hostname)
+      .trim()
+      .toLowerCase()
+      .replace(/^\[/, '')
+      .replace(/\]$/, '')
+      .replace(/\.$/, '');
+  }
+
+  /**
+   * @private
+   */
+  static isBlockedHostname(hostname) {
+    return (
+      hostname === 'localhost' ||
+      hostname.endsWith('.localhost') ||
+      hostname === 'metadata.google.internal'
+    );
+  }
+
+  /**
+   * @private
+   */
+  static isIPAddress(hostname) {
+    const normalized = ICSHandler.normalizeHostname(hostname);
+    return /^\d{1,3}(\.\d{1,3}){3}$/.test(normalized) || normalized.includes(':');
+  }
+
+  /**
+   * @private
+   */
+  static isPrivateIPAddress(address) {
+    const normalized = ICSHandler.normalizeHostname(address);
+    const ipv4Match = normalized.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+
+    if (ipv4Match) {
+      const octets = ipv4Match.slice(1).map(Number);
+      if (octets.some(octet => octet < 0 || octet > 255)) return true;
+
+      const [first, second] = octets;
+      return (
+        first === 0 ||
+        first === 10 ||
+        first === 127 ||
+        first >= 224 ||
+        (first === 100 && second >= 64 && second <= 127) ||
+        (first === 169 && second === 254) ||
+        (first === 172 && second >= 16 && second <= 31) ||
+        (first === 192 && second === 168) ||
+        (first === 198 && (second === 18 || second === 19))
+      );
+    }
+
+    const mappedIPv4 = normalized.match(/::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/);
+    if (mappedIPv4) {
+      return ICSHandler.isPrivateIPAddress(mappedIPv4[1]);
+    }
+
+    if (!normalized.includes(':')) {
+      return false;
+    }
+
+    if (normalized === '::' || normalized === '::1') {
+      return true;
+    }
+
+    const firstHextet = parseInt(normalized.split(':')[0] || '0', 16);
+    return (
+      (firstHextet & 0xfe00) === 0xfc00 ||
+      (firstHextet & 0xffc0) === 0xfe80 ||
+      (firstHextet & 0xffc0) === 0xfec0 ||
+      (firstHextet & 0xff00) === 0xff00
+    );
   }
 
   /**

package/core/ics/ICSParser.js

@@ -67,17 +67,15 @@ export class ICSParser {
 
       // Parse property and value
       const colonIndex = line.indexOf(':');
-      const semicolonIndex = line.indexOf(';');
-      const separatorIndex =
-        semicolonIndex > -1 && semicolonIndex < colonIndex ? semicolonIndex : colonIndex;
 
-      if (separatorIndex === -1) continue;
+      if (colonIndex === -1) continue;
 
-      const property = line.substring(0, separatorIndex);
+      const property = line.substring(0, colonIndex);
+      const propertyName = this.parsePropertyParts(property).name;
       const value = line.substring(colonIndex + 1);
 
       // Handle component boundaries
-      if (property === 'BEGIN') {
+      if (propertyName === 'BEGIN') {
         if (value === 'VEVENT') {
           // Enforce event count limit
           if (events.length >= ICSParser.MAX_EVENTS) {
@@ -88,7 +86,7 @@ export class ICSParser {
         } else if (value === 'VALARM') {
           inAlarm = true;
         }
-      } else if (property === 'END') {
+      } else if (propertyName === 'END') {
         if (value === 'VEVENT' && currentEvent) {
           events.push(this.normalizeEvent(currentEvent));
           currentEvent = null;
@@ -154,10 +152,17 @@ export class ICSParser {
         lines.push(`DTEND;VALUE=DATE:${this.formatDate(event.end, true)}`);
       }
     } else {
-      const tzid = event.timezone || Intl.DateTimeFormat().resolvedOptions().timeZone;
-      lines.push(`DTSTART;TZID=${tzid}:${this.formatDate(event.start)}`);
+      const startTimeZone =
+        event.timeZone || event.timezone || Intl.DateTimeFormat().resolvedOptions().timeZone;
+      const endTimeZone = event.endTimeZone || startTimeZone;
+
+      lines.push(
+        `DTSTART;TZID=${this.escapeParamValue(startTimeZone)}:${this.formatDate(event.start)}`
+      );
       if (event.end) {
-        lines.push(`DTEND;TZID=${tzid}:${this.formatDate(event.end)}`);
+        lines.push(
+          `DTEND;TZID=${this.escapeParamValue(endTimeZone)}:${this.formatDate(event.end)}`
+        );
       }
     }
 
@@ -247,8 +252,8 @@ export class ICSParser {
    * @private
    */
   parseProperty(property, value, event) {
-    // Extract actual property name (before parameters)
-    const propName = property.split(';')[0];
+    // Extract actual property name and parameters
+    const { name: propName, params } = this.parsePropertyParts(property);
 
     // Map to event property
     const eventProp = this.propertyMap[propName];
@@ -256,12 +261,29 @@ export class ICSParser {
 
     switch (propName) {
       case 'DTSTART':
-      case 'DTEND':
-        event[eventProp] = this.parseDate(value, property);
-        if (property.includes('VALUE=DATE')) {
+      case 'DTEND': {
+        const parsed = this.parseDate(value, property);
+        event[eventProp] = parsed.date;
+
+        if (parsed.timeZone) {
+          if (propName === 'DTSTART') {
+            event.timeZone = parsed.timeZone;
+          } else {
+            event.endTimeZone = parsed.timeZone;
+          }
+        } else if (params.TZID) {
+          if (propName === 'DTSTART') {
+            event.timeZone = params.TZID;
+          } else {
+            event.endTimeZone = params.TZID;
+          }
+        }
+
+        if (params.VALUE === 'DATE') {
           event.allDay = true;
         }
         break;
+      }
 
       case 'SUMMARY':
       case 'DESCRIPTION':
@@ -313,7 +335,7 @@ export class ICSParser {
 
       case 'EXDATE': {
         if (!event.excludeDates) event.excludeDates = [];
-        const dates = value.split(',').map(d => this.parseDate(d.trim(), property));
+        const dates = value.split(',').map(d => this.parseDate(d.trim(), property).date);
         event.excludeDates.push(...dates.filter(d => d !== null));
         break;
       }
@@ -325,16 +347,18 @@ export class ICSParser {
    * @private
    */
   parseDate(dateString, property = '') {
-    // Remove timezone if present
-    dateString = dateString.replace(/^TZID=[^:]+:/, '');
+    const { params } = this.parsePropertyParts(property);
 
     // Check if it's a date-only value
-    if (property.includes('VALUE=DATE') || dateString.length === 8) {
+    if (params.VALUE === 'DATE' || dateString.length === 8) {
       // YYYYMMDD format
       const year = dateString.substring(0, 4);
       const month = dateString.substring(4, 6);
       const day = dateString.substring(6, 8);
-      return new Date(year, month - 1, day);
+      return {
+        date: new Date(year, month - 1, day),
+        timeZone: null
+      };
     }
 
     // Full datetime: YYYYMMDDTHHMMSS[Z]
@@ -347,10 +371,47 @@ export class ICSParser {
 
     if (dateString.endsWith('Z')) {
       // UTC time
-      return new Date(Date.UTC(year, month, day, hour, minute, second));
+      return {
+        date: new Date(Date.UTC(year, month, day, hour, minute, second)),
+        timeZone: 'UTC'
+      };
     }
-    // Local time
-    return new Date(year, month, day, hour, minute, second);
+
+    // Floating or TZID-bound wall time. The timezone itself is preserved on the
+    // event so Event can convert the wall-clock value to UTC consistently.
+    return {
+      date: new Date(year, month, day, hour, minute, second),
+      timeZone: params.TZID || null
+    };
+  }
+
+  /**
+   * Parse property name and parameters from a line prefix.
+   * @private
+   */
+  parsePropertyParts(property = '') {
+    const parts = property.split(';');
+    const name = (parts.shift() || '').toUpperCase();
+    const params = {};
+
+    for (const part of parts) {
+      const equalsIndex = part.indexOf('=');
+      if (equalsIndex === -1) continue;
+
+      const key = part.substring(0, equalsIndex).toUpperCase();
+      const rawValue = part.substring(equalsIndex + 1);
+      params[key] = rawValue.replace(/^"|"$/g, '');
+    }
+
+    return { name, params };
+  }
+
+  /**
+   * Escape an ICS parameter value.
+   * @private
+   */
+  escapeParamValue(value) {
+    return String(value).replace(/"/g, '');
   }
 
   /**

package/core/index.js

@@ -28,7 +28,7 @@ export { RRuleParser } from './events/RRuleParser.js';
 export { EnhancedCalendar } from './integration/EnhancedCalendar.js';
 
 // Version — keep in sync with package.json
-export const VERSION = '2.1.63';
+export const VERSION = '2.1.65';
 
 // Default export
 export { Calendar as default } from './calendar/Calendar.js';

package/core/search/SearchWorkerManager.js

@@ -9,6 +9,8 @@ export class SearchWorkerManager {
     this.workerSupported = typeof Worker !== 'undefined';
     this.worker = null;
     this.indexReady = false;
+    this.indexMode = 'none';
+    this.workerExpectedCount = 0;
     this.pendingSearches = [];
 
     // Fallback to main thread if workers not available
@@ -19,7 +21,8 @@ export class SearchWorkerManager {
       chunkSize: 100, // Events per indexing batch
       maxWorkers: 4, // Max parallel workers
       indexThreshold: 1000, // Use workers above this event count
-      cacheSize: 50 // LRU cache for search results
+      cacheSize: 50, // LRU cache for search results
+      searchTimeout: 10000 // Worker search timeout in milliseconds
     };
 
     // Search result cache
@@ -35,7 +38,7 @@ export class SearchWorkerManager {
   initializeWorker() {
     if (!this.workerSupported) {
       // Use InvertedIndex as fallback
-      this.fallbackIndex = new InvertedIndex();
+      this.ensureFallbackIndex();
       return;
     }
 
@@ -51,13 +54,14 @@ export class SearchWorkerManager {
                     events[event.id] = event;
 
                     // Index each field
-                    const fields = ['title', 'description', 'location', 'category'];
+                    const fields = ['title', 'description', 'location', 'category', 'categories'];
                     for (const field of fields) {
                         const value = event[field];
                         if (!value) continue;
 
                         // Tokenize and index
-                        const tokens = tokenize(value.toLowerCase());
+                        const values = Array.isArray(value) ? value : [value];
+                        const tokens = values.flatMap(item => tokenize(String(item).toLowerCase()));
                         for (const token of tokens) {
                             if (!index[token]) {
                                 index[token] = new Set();
@@ -163,11 +167,19 @@ export class SearchWorkerManager {
             };
         `;
 
-    // Create worker from blob
-    const blob = new Blob([workerCode], { type: 'application/javascript' });
-    const workerUrl = URL.createObjectURL(blob);
-
+    let workerUrl = null;
     try {
+      if (
+        typeof Blob === 'undefined' ||
+        typeof URL === 'undefined' ||
+        typeof URL.createObjectURL !== 'function'
+      ) {
+        throw new Error('Blob workers are not supported in this environment');
+      }
+
+      // Create worker from blob
+      const blob = new Blob([workerCode], { type: 'application/javascript' });
+      workerUrl = URL.createObjectURL(blob);
       this.worker = new Worker(workerUrl);
       this.setupWorkerHandlers();
 
@@ -180,10 +192,24 @@ export class SearchWorkerManager {
       // Clean up blob URL
       URL.revokeObjectURL(workerUrl);
     } catch (error) {
+      if (workerUrl) {
+        URL.revokeObjectURL(workerUrl);
+      }
       console.warn('Worker creation failed, falling back to main thread:', error);
       this.workerSupported = false;
+      this.ensureFallbackIndex();
+    }
+  }
+
+  /**
+   * Ensure a fallback index exists.
+   * @private
+   */
+  ensureFallbackIndex() {
+    if (!this.fallbackIndex) {
       this.fallbackIndex = new InvertedIndex();
     }
+    return this.fallbackIndex;
   }
 
   /**
@@ -191,7 +217,7 @@ export class SearchWorkerManager {
    */
   setupWorkerHandlers() {
     this.worker.onmessage = e => {
-      const { type, data } = e.data;
+      const { type } = e.data;
 
       switch (type) {
         case 'ready':
@@ -200,8 +226,10 @@ export class SearchWorkerManager {
           break;
 
         case 'indexed':
-          // Process pending searches
-          this.processPendingSearches();
+          if (e.data.count >= this.workerExpectedCount) {
+            this.indexMode = 'worker';
+            this.processPendingSearches();
+          }
           break;
 
         case 'results':
@@ -212,9 +240,12 @@ export class SearchWorkerManager {
 
     this.worker.onerror = error => {
       console.error('Worker error:', error);
+      this.rejectPendingSearches(new Error('Search worker failed'));
       // Fallback to main thread
       this.workerSupported = false;
-      this.fallbackIndex = new InvertedIndex();
+      this.worker = null;
+      this.ensureFallbackIndex().buildIndex(this.eventStore.getAllEvents());
+      this.indexMode = 'fallback';
     };
   }
 
@@ -223,17 +254,26 @@ export class SearchWorkerManager {
    */
   async indexEvents() {
     const events = this.eventStore.getAllEvents();
+    this.searchCache.clear();
+    this.cacheOrder = [];
 
     // Use main thread for small datasets
     if (events.length < this.config.indexThreshold) {
-      if (this.fallbackIndex) {
-        this.fallbackIndex.buildIndex(events);
+      this.ensureFallbackIndex().buildIndex(events);
+      this.indexMode = 'fallback';
+
+      if (this.worker && this.indexReady) {
+        this.worker.postMessage({ type: 'clear' });
       }
       return;
     }
 
     // Chunk events for worker
     if (this.worker && this.indexReady) {
+      this.indexMode = 'worker-indexing';
+      this.workerExpectedCount = events.length;
+      this.worker.postMessage({ type: 'clear' });
+
       for (let i = 0; i < events.length; i += this.config.chunkSize) {
         const chunk = events.slice(i, i + this.config.chunkSize);
         this.worker.postMessage({
@@ -241,7 +281,11 @@ export class SearchWorkerManager {
           data: { events: chunk }
         });
       }
+      return;
     }
+
+    this.ensureFallbackIndex().buildIndex(events);
+    this.indexMode = 'fallback';
   }
 
   /**
@@ -257,9 +301,13 @@ export class SearchWorkerManager {
 
     // Use appropriate search method
     let results;
-    if (this.worker && this.indexReady) {
-      results = await this.workerSearch(query, options);
-    } else if (this.fallbackIndex) {
+    if (this.worker && this.indexMode === 'worker') {
+      try {
+        results = await this.workerSearch(query, options);
+      } catch {
+        results = this.directSearch(query, options);
+      }
+    } else if (this.fallbackIndex && this.indexMode === 'fallback') {
       results = this.fallbackIndex.search(query, options);
     } else {
       // Direct search as last resort
@@ -276,14 +324,20 @@ export class SearchWorkerManager {
    * Search using worker
    */
   workerSearch(query, options) {
-    return new Promise(resolve => {
+    return new Promise((resolve, reject) => {
       const searchId = Date.now() + Math.random();
+      const timeoutId = setTimeout(() => {
+        this.pendingSearches = this.pendingSearches.filter(search => search.id !== searchId);
+        reject(new Error('Search worker timed out'));
+      }, options.timeout || this.config.searchTimeout);
 
       this.pendingSearches.push({
         id: searchId,
         query,
         options,
-        resolve
+        resolve,
+        reject,
+        timeoutId
       });
 
       this.worker.postMessage({
@@ -309,14 +363,23 @@ export class SearchWorkerManager {
       let score = 0;
 
       // Check each field
-      const fields = options.fields || ['title', 'description', 'location'];
+      const fields = options.fields || [
+        'title',
+        'description',
+        'location',
+        'category',
+        'categories'
+      ];
       for (const field of fields) {
         const value = event[field];
         if (!value) continue;
 
-        const valueLower = value.toLowerCase();
-        if (valueLower.includes(queryLower)) {
-          score += field === 'title' ? 20 : 10;
+        const values = Array.isArray(value) ? value : [value];
+        for (const item of values) {
+          const valueLower = String(item).toLowerCase();
+          if (valueLower.includes(queryLower)) {
+            score += field === 'title' ? 20 : 10;
+          }
         }
       }
 
@@ -340,6 +403,7 @@ export class SearchWorkerManager {
   handleSearchResults(data) {
     const pending = this.pendingSearches.find(s => s.id === data.id);
     if (pending) {
+      clearTimeout(pending.timeoutId);
       pending.resolve(data.results);
       this.pendingSearches = this.pendingSearches.filter(s => s.id !== data.id);
     }
@@ -366,6 +430,10 @@ export class SearchWorkerManager {
    * Cache search results with LRU eviction
    */
   cacheResults(key, results) {
+    if (this.searchCache.has(key)) {
+      this.cacheOrder = this.cacheOrder.filter(existingKey => existingKey !== key);
+    }
+
     // Add to cache
     this.searchCache.set(key, results);
     this.cacheOrder.push(key);
@@ -383,6 +451,9 @@ export class SearchWorkerManager {
   clear() {
     this.searchCache.clear();
     this.cacheOrder = [];
+    this.indexMode = 'none';
+    this.workerExpectedCount = 0;
+    this.rejectPendingSearches(new Error('Search index was cleared'));
 
     if (this.worker) {
       this.worker.postMessage({ type: 'clear' });
@@ -402,6 +473,18 @@ export class SearchWorkerManager {
     }
     this.clear();
   }
+
+  /**
+   * Reject all pending worker searches.
+   * @private
+   */
+  rejectPendingSearches(error) {
+    for (const search of this.pendingSearches) {
+      clearTimeout(search.timeoutId);
+      search.reject(error);
+    }
+    this.pendingSearches = [];
+  }
 }
 
 /**
@@ -416,7 +499,8 @@ export class InvertedIndex {
       title: 2.0,
       description: 1.0,
       location: 1.5,
-      category: 1.5
+      category: 1.5,
+      categories: 1.5
     };
   }
 
@@ -434,7 +518,8 @@ export class InvertedIndex {
         const value = event[field];
         if (!value) continue;
 
-        const tokens = this.tokenize(value);
+        const values = Array.isArray(value) ? value : [value];
+        const tokens = values.flatMap(item => this.tokenize(String(item)));
         for (const token of tokens) {
           if (!this.index.has(token)) {
             this.index.set(token, new Map());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forcecalendar/core",
-  "version": "2.1.63",
+  "version": "2.1.65",
   "type": "module",
   "private": false,
   "description": "A modern, lightweight, framework-agnostic calendar engine optimized for Salesforce",