@sockethub/platform-caldav 1.0.0-beta.4 → 1.0.0-beta.6

package/dist/index.js

@@ -66075,9 +66075,10 @@ function xmlText(value) {
     return predefined[entity.toLowerCase()] ?? reference;
   });
 }
-function parseDavXml(xml) {
+function parseDavXml(xml, options = {}) {
   return new XMLParser({
     ignoreAttributes: false,
+    parseTagValue: options.parseTagValue ?? true,
     removeNSPrefix: true,
     processEntities: false,
     tagValueProcessor: (_tagName, value) => xmlText(value),
@@ -66106,6 +66107,39 @@ function propertyHref(value) {
     return davHref(value.href);
   return davHref(value);
 }
+function safePathname(pathname) {
+  if (pathname.includes("\\") || /%(?:2f|5c)/i.test(pathname))
+    return false;
+  for (const segment of pathname.split("/")) {
+    let decoded = segment;
+    try {
+      for (let pass = 0;pass < 3; pass += 1) {
+        const next = decodeURIComponent(decoded);
+        if (next === decoded)
+          break;
+        decoded = next;
+      }
+    } catch {
+      return false;
+    }
+    if (decoded === "." || decoded === ".." || /[\\/]/.test(decoded))
+      return false;
+  }
+  return true;
+}
+function isDavCollectionChild(collectionId, resourceId) {
+  try {
+    const collection = new URL(collectionId);
+    const resource = new URL(resourceId);
+    if (collection.search || collection.hash || resource.search || resource.hash || !safePathname(collection.pathname) || !safePathname(resource.pathname))
+      return false;
+    const prefix = collection.pathname.endsWith("/") ? collection.pathname : `${collection.pathname}/`;
+    return resource.origin === collection.origin && resource.pathname.startsWith(prefix) && resource.pathname !== prefix;
+  } catch {
+    return false;
+  }
+}
+
 class DiscoveryCache {
   maxEntries;
   secret = randomBytes(32);
@@ -66223,6 +66257,16 @@ function digestChallenge(header) {
   return;
 }
 var quote = (value) => `"${value.replaceAll("\\", "\\\\").replaceAll('"', "\\\"")}"`;
+var isStatus = (value, code) => new RegExp(`\\s${code}(?:\\s|$)`).test(String(value ?? ""));
+function davPreconditions(xml) {
+  try {
+    const error = parseDavXml(xml).error;
+    return error && typeof error === "object" ? Object.keys(error) : [];
+  } catch {
+    return [];
+  }
+}
+var xmlEscape = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
 
 class DavClient {
   authentication;
@@ -66267,9 +66311,10 @@ class DavClient {
     this.assertAllowed(url);
     let response;
     try {
+      const { passForbidden: _, ...fetchInit } = init;
       const authorization = this.authorization(url, init);
       response = await this.fetchImpl(url, {
-        ...init,
+        ...fetchInit,
         redirect: "manual",
         signal,
         headers: {
@@ -66313,7 +66358,7 @@ class DavClient {
       }
       throw new DavFailure(`${this.errorPrefix}:${authAttempts > 0 ? "authentication-failed" : "unsupported-authentication"}`);
     }
-    if (response.status === 401 || response.status === 403) {
+    if (response.status === 401 || response.status === 403 && !init.passForbidden) {
       await response.body?.cancel().catch(() => {});
       throw new DavFailure(`${this.errorPrefix}:authentication-failed`);
     }
@@ -66334,6 +66379,175 @@ class DavClient {
       await response.body?.cancel().catch(() => {});
       throw new DavFailure(`${this.errorPrefix}:invalid-response`);
     }
+    return this.readMultistatus(response);
+  }
+  async currentSyncToken(collection) {
+    const response = await this.request(collection, {
+      method: "PROPFIND",
+      headers: {
+        depth: "0",
+        "content-type": "application/xml; charset=utf-8"
+      },
+      body: `<?xml version="1.0" encoding="utf-8"?>
+<d:propfind xmlns:d="DAV:"><d:prop><d:sync-token/></d:prop></d:propfind>`
+    });
+    if (response.status === 404)
+      return rejectDavResponse(response, `${this.errorPrefix}:not-found`);
+    if (response.status !== 207) {
+      await response.body?.cancel().catch(() => {});
+      throw new DavFailure(`${this.errorPrefix}:invalid-response`);
+    }
+    let responses;
+    try {
+      responses = asArray(parseDavXml(await response.text(), {
+        parseTagValue: false
+      }).multistatus?.response);
+    } catch {
+      throw new DavFailure(`${this.errorPrefix}:invalid-response`);
+    }
+    const token = successfulProps(responses[0] ?? {})["sync-token"];
+    if (typeof token !== "string" || token.trim() === "")
+      throw new DavFailure(`${this.errorPrefix}:sync-unsupported`);
+    return token.trim();
+  }
+  async syncCollection(collection, prop, syncToken, namespaces = "") {
+    const response = await this.request(collection, {
+      method: "REPORT",
+      passForbidden: true,
+      headers: {
+        depth: "0",
+        "content-type": "application/xml; charset=utf-8"
+      },
+      body: `<?xml version="1.0" encoding="utf-8"?>
+<d:sync-collection xmlns:d="DAV:"${namespaces ? ` ${namespaces}` : ""}>
+ ${syncToken ? `<d:sync-token>${xmlEscape(syncToken)}</d:sync-token>` : "<d:sync-token/>"}
+ <d:sync-level>1</d:sync-level>
+ <d:prop>${prop}</d:prop>
+</d:sync-collection>`
+    });
+    if (response.status !== 207) {
+      let body = "";
+      try {
+        body = await response.text();
+      } catch {}
+      const preconditions = davPreconditions(body);
+      const prefix = this.errorPrefix;
+      if (preconditions.includes("valid-sync-token"))
+        throw new DavFailure(`${prefix}:sync-token-invalid`);
+      if (preconditions.includes("supported-report"))
+        throw new DavFailure(`${prefix}:sync-unsupported`);
+      if (response.status === 404)
+        throw new DavFailure(`${prefix}:not-found`);
+      if ([400, 409, 412].includes(response.status) && syncToken)
+        throw new DavFailure(`${prefix}:sync-token-invalid`);
+      if (response.status === 403)
+        throw new DavFailure(`${prefix}:authentication-failed`);
+      if ([400, 405, 415, 501].includes(response.status))
+        throw new DavFailure(`${prefix}:sync-unsupported`);
+      throw new DavFailure(`${prefix}:sync-failed`);
+    }
+    let multistatus;
+    try {
+      const parsed = parseDavXml(await response.text(), {
+        parseTagValue: false
+      }).multistatus;
+      if (!parsed || typeof parsed !== "object")
+        throw new Error;
+      multistatus = parsed;
+    } catch {
+      throw new DavFailure(`${this.errorPrefix}:invalid-response`);
+    }
+    const token = multistatus["sync-token"];
+    if (typeof token !== "string" || token.trim() === "")
+      throw new DavFailure(`${this.errorPrefix}:invalid-response`);
+    const result = {
+      changed: [],
+      removed: [],
+      syncToken: token.trim(),
+      truncated: false
+    };
+    for (const item of asArray(multistatus.response)) {
+      const href = davHref(item.href);
+      if (!href)
+        throw new DavFailure(`${this.errorPrefix}:invalid-response`);
+      const id = new URL(href, collection).href;
+      const status = item.status;
+      if (id === collection.href || `${id}/` === collection.href) {
+        if (isStatus(status, 507))
+          result.truncated = true;
+        continue;
+      }
+      if (!isDavCollectionChild(collection.href, id))
+        throw new DavFailure(`${this.errorPrefix}:invalid-response`);
+      if (isStatus(status, 404))
+        result.removed.push(id);
+      else
+        result.changed.push({ id, props: successfulProps(item) });
+    }
+    return result;
+  }
+  async syncResources(collection, options, syncToken) {
+    const property = options.data.slice(options.data.indexOf(":") + 1);
+    const sync = await this.syncCollection(collection, `<d:getetag/><${options.data}/>`, syncToken, options.namespaces);
+    const resources = [];
+    const missing = new Map;
+    const add = (id, value, etag) => {
+      const data = value && typeof value === "object" ? value["#text"] : value;
+      if (typeof data !== "string")
+        return false;
+      resources.push({
+        id,
+        data,
+        ...typeof etag === "string" ? { etag } : {}
+      });
+      return true;
+    };
+    for (const member of sync.changed)
+      if (!add(member.id, member.props[property], member.props.getetag))
+        missing.set(member.id, member.props.getetag);
+    if (missing.size) {
+      const hrefs = [...missing.keys()].map((id) => `<d:href>${xmlEscape(new URL(id).pathname)}</d:href>`).join("");
+      const response = await this.request(collection, {
+        method: "REPORT",
+        headers: {
+          depth: "1",
+          "content-type": "application/xml; charset=utf-8"
+        },
+        body: `<?xml version="1.0" encoding="utf-8"?>
+<${options.multiget} xmlns:d="DAV:" ${options.namespaces}>
+ <d:prop><d:getetag/><${options.data}/></d:prop>
+ ${hrefs}
+</${options.multiget}>`
+      });
+      if (response.status !== 207)
+        return rejectDavResponse(response, `${this.errorPrefix}:sync-failed`);
+      for (const item of await this.readMultistatus(response)) {
+        const href = davHref(item.href);
+        if (!href)
+          continue;
+        const id = new URL(href, collection).href;
+        if (!missing.has(id))
+          continue;
+        if (isStatus(item.status, 404)) {
+          sync.removed.push(id);
+          missing.delete(id);
+          continue;
+        }
+        const props = successfulProps(item);
+        if (add(id, props[property], props.getetag ?? missing.get(id)))
+          missing.delete(id);
+      }
+      if (missing.size)
+        throw new DavFailure(`${this.errorPrefix}:invalid-response`);
+    }
+    return {
+      resources,
+      removed: sync.removed,
+      syncToken: sync.syncToken,
+      truncated: sync.truncated
+    };
+  }
+  async readMultistatus(response) {
     try {
       const parsed = parseDavXml(await response.text());
       return asArray(parsed.multistatus?.response);
@@ -66634,7 +66848,7 @@ var ActivityStreamSchema = {
 var package_default = {
   name: "@sockethub/schemas",
   description: "JSON schema files for validating Sockethub Activity Streams",
-  version: "3.0.0-beta.4",
+  version: "3.0.0-beta.6",
   type: "module",
   private: false,
   author: "Nick Jennings <nick@silverbucket.net>",
@@ -66704,7 +66918,7 @@ var package_default = {
     "ajv-formats": "^2.1.1",
     "ajv-formats-draft2019": "^1.6.1"
   },
-  gitHead: "639c296a7332f192a1b3f7e86ef6603b5b67bbaa",
+  gitHead: "604f3da8850a19a4fd5f5e5dcec10bf283e9085e",
   types: "./dist/index.d.ts"
 };
 
@@ -67851,7 +68065,7 @@ function timeZoneRange(input, fallbackYear) {
   const last = years.length ? Math.max(...years) : fallbackYear;
   return [first - 1, Math.max(last + 1, first + 30)];
 }
-function buildICalendar(input, now = new Date) {
+function buildICalendar(input, now = new Date, { created = false } = {}) {
   const uid = input.uid ?? `${randomUUID()}@sockethub`;
   if (/[\r\n%/\\]/.test(uid))
     throw new Error("invalid uid");
@@ -67870,6 +68084,8 @@ function buildICalendar(input, now = new Date) {
     `BEGIN:${component}`,
     `UID:${escapeText(uid)}`,
     `DTSTAMP:${utcDateTime(now.toISOString(), "now")}`,
+    ...created ? [`CREATED:${utcDateTime(now.toISOString(), "now")}`] : [],
+    `LAST-MODIFIED:${utcDateTime(now.toISOString(), "now")}`,
     `SUMMARY:${escapeText(input.name)}`
   ];
   if (input.content)
@@ -67916,6 +68132,13 @@ function parseDate(value) {
     return `${value.slice(0, 4)}-${value.slice(4, 6)}-${value.slice(6, 8)}T${value.slice(9, 11)}:${value.slice(11, 13)}:${value.slice(13, 15)}`;
   return value;
 }
+function utcTimestamp(value) {
+  if (!value || !/^\d{8}T\d{6}Z$/.test(value))
+    return;
+  const iso = parseDate(value);
+  const parsed = new Date(iso);
+  return !Number.isNaN(parsed.getTime()) && parsed.toISOString().replace(".000Z", "Z") === iso ? iso : undefined;
+}
 var STATUSES = {
   event: ["tentative", "confirmed", "cancelled"],
   task: ["needs-action", "in-process", "completed", "cancelled"]
@@ -67991,6 +68214,13 @@ function parseICalendar(body, id, etag) {
     name: unescapeText(summary),
     updateSupported: isUpdateSupported(body)
   };
+  const created = utcTimestamp(first("CREATED")?.value);
+  const hasMethod = lines.slice(0, begin).some((line) => /^METHOD[;:]/i.test(line));
+  const lastModified = utcTimestamp(first("LAST-MODIFIED")?.value) ?? (hasMethod ? undefined : utcTimestamp(first("DTSTAMP")?.value));
+  if (created)
+    item.created = created;
+  if (lastModified)
+    item.lastModified = lastModified;
   if (first("DESCRIPTION"))
     item.content = unescapeText(first("DESCRIPTION")?.value ?? "");
   if (first("LOCATION"))
@@ -68124,7 +68354,15 @@ var queryBody = (query) => `<?xml version="1.0" encoding="utf-8"?>
  <d:prop><d:getetag/><c:calendar-data/></d:prop>
  <c:filter><c:comp-filter name="VCALENDAR"><c:comp-filter name="${query.type === "task" ? "VTODO" : "VEVENT"}">${query.startTime || query.endTime ? `<c:time-range${query.startTime ? ` start="${calDavTime(query.startTime)}"` : ""}${query.endTime ? ` end="${calDavTime(query.endTime)}"` : ""}/>` : ""}</c:comp-filter></c:comp-filter></c:filter>
 </c:calendar-query>`;
+var HAS_EVENT_OR_TASK = /^BEGIN:(?:VEVENT|VTODO)\r?$/m;
 var CalDavFailure = DavFailure;
+function calendarItem(data, id, etag) {
+  try {
+    return parseICalendar(data, id, typeof etag === "string" ? etag : undefined);
+  } catch {
+    throw new CalDavFailure("caldav:invalid-response");
+  }
+}
 
 class CalDavClient extends DavClient {
   constructor(url, authentication, timeoutMs = 15000, networkOptions = {}) {
@@ -68232,28 +68470,28 @@ class CalDavClient extends DavClient {
         await response.body?.cancel().catch(() => {});
         throw new CalDavFailure("caldav:query-failed");
       }
-      let parsed;
-      try {
-        parsed = parseDavXml(await response.text());
-      } catch {
-        throw new CalDavFailure("caldav:invalid-response");
-      }
-      const responses = asArray(parsed.multistatus?.response);
-      for (const item of responses) {
+      for (const item of await this.readMultistatus(response)) {
         const props = successfulProps(item);
         const itemHref = davHref(item.href);
         const data = props["calendar-data"];
         if (!itemHref || typeof data !== "string")
           continue;
-        try {
-          items.push(parseICalendar(data, new URL(itemHref, calendar.id).href, typeof props.getetag === "string" ? props.getetag : undefined));
-        } catch {
-          throw new CalDavFailure("caldav:invalid-response");
-        }
+        items.push(calendarItem(data, new URL(itemHref, calendar.id).href, props.getetag));
       }
     }
     return items;
   }
+  async sync(calendar, syncToken) {
+    const { resources, ...result } = await this.syncResources(new URL(calendar.id), {
+      namespaces: 'xmlns:c="urn:ietf:params:xml:ns:caldav"',
+      data: "c:calendar-data",
+      multiget: "c:calendar-multiget"
+    }, syncToken);
+    return {
+      ...result,
+      items: resources.filter((resource) => HAS_EVENT_OR_TASK.test(resource.data)).map((resource) => calendarItem(resource.data, resource.id, resource.etag))
+    };
+  }
   async update(id, etag, body) {
     const resource = new URL(id);
     this.assertAllowed(resource);
@@ -68267,7 +68505,8 @@ class CalDavClient extends DavClient {
       return rejectDavResponse(current, "caldav:not-found");
     if (!current.ok)
       return rejectDavResponse(current, "caldav:update-failed");
-    if (!isUpdateSupported(await current.text()))
+    const stored = await current.text();
+    if (!isUpdateSupported(stored))
       throw new CalDavFailure("caldav:unsupported-update");
     const response = await this.request(resource, {
       method: "PUT",
@@ -68275,7 +68514,7 @@ class CalDavClient extends DavClient {
         "content-type": "text/calendar; charset=utf-8",
         "if-match": etag
       },
-      body
+      body: typeof body === "function" ? body(stored) : body
     });
     if (response.status === 412)
       return rejectDavResponse(response, "caldav:conflict");
@@ -68485,11 +68724,126 @@ END:VCALENDAR\r
     skipped
   };
 }
+
+// src/patch.ts
+var GROUPS = [
+  { fields: ["name"], names: ["SUMMARY"] },
+  { fields: ["content"], names: ["DESCRIPTION"] },
+  { fields: ["location"], names: ["LOCATION"] },
+  { fields: ["url"], names: ["URL"] },
+  {
+    fields: ["startTime", "endTime", "due", "allDay", "timeZone"],
+    names: ["DTSTART", "DTEND", "DUE"]
+  },
+  { fields: ["status"], names: ["STATUS"] },
+  { fields: ["completedTime"], names: ["COMPLETED"] },
+  { fields: ["percentComplete"], names: ["PERCENT-COMPLETE"] },
+  { fields: ["sequence"], names: ["SEQUENCE"] },
+  { fields: ["recurrence"], names: ["RRULE"] },
+  { fields: ["organizer"], names: ["ORGANIZER"] },
+  { fields: ["attendees"], names: ["ATTENDEE"] },
+  { fields: ["attachments"], names: ["ATTACH"] },
+  { fields: ["reminders"], names: ["VALARM"] },
+  { fields: [], names: ["DTSTAMP", "LAST-MODIFIED"] }
+];
+function logicalLines(body) {
+  const lines = [];
+  for (const line of body.split(/\r?\n/)) {
+    if (/^[ \t]/.test(line) && lines.length)
+      lines[lines.length - 1].push(line);
+    else
+      lines.push([line]);
+  }
+  while (lines.length && lines[lines.length - 1].join("") === "")
+    lines.pop();
+  return lines;
+}
+var unfolded = (raw) => raw.map((line, index) => index ? line.slice(1) : line).join("");
+var propertyName = (raw) => (unfolded(raw).match(/^[^;:]*/)?.[0] ?? "").toUpperCase();
+function componentBounds(lines) {
+  const begin = lines.findIndex((raw) => /^BEGIN:(?:VEVENT|VTODO)$/.test(unfolded(raw)));
+  if (begin === -1)
+    return;
+  const name = unfolded(lines[begin]).slice("BEGIN:".length);
+  const end = lines.findIndex((raw, index) => index > begin && unfolded(raw) === `END:${name}`);
+  return end === -1 ? undefined : { begin, end, name };
+}
+function units(lines) {
+  const result = [];
+  let alarm;
+  for (const raw of lines) {
+    const text = unfolded(raw);
+    if (alarm) {
+      alarm.push(...raw);
+      if (text === "END:VALARM") {
+        result.push({ name: "VALARM", raw: alarm });
+        alarm = undefined;
+      }
+    } else if (text === "BEGIN:VALARM")
+      alarm = [...raw];
+    else
+      result.push({ name: propertyName(raw), raw });
+  }
+  if (alarm)
+    result.push({ name: "", raw: alarm });
+  return result;
+}
+function canonical(value) {
+  return JSON.stringify(value, (_key, entry) => entry && typeof entry === "object" && !Array.isArray(entry) ? Object.fromEntries(Object.keys(entry).sort().map((key) => [key, entry[key]])) : entry);
+}
+function sameField(current, next, field) {
+  if (field === "allDay")
+    return current.allDay === true === (next.allDay === true);
+  return canonical(current[field]) === canonical(next[field]);
+}
+function patchICalendar(stored, item, generated) {
+  const current = parseICalendar(stored, "");
+  if (current.type !== item.type)
+    return { uid: item.uid ?? current.uid, body: generated };
+  const lines = logicalLines(stored);
+  const bounds = componentBounds(lines);
+  const fresh = logicalLines(generated);
+  const freshBounds = componentBounds(fresh);
+  if (!bounds || !freshBounds)
+    throw new Error("invalid calendar data");
+  const freshUnits = units(fresh.slice(freshBounds.begin + 1, freshBounds.end));
+  const replaced = new Set;
+  for (const group of GROUPS)
+    if (!group.fields.length || !group.fields.every((field) => sameField(current, item, field)))
+      for (const name of group.names)
+        replaced.add(name);
+  const freshNames = new Set(freshUnits.map((unit) => unit.name));
+  if (replaced.has("DTSTART") && (freshNames.has("DTEND") || freshNames.has("DUE")))
+    replaced.add("DURATION");
+  const kept = [];
+  let insertAt;
+  for (const unit of units(lines.slice(bounds.begin + 1, bounds.end))) {
+    if (replaced.has(unit.name))
+      insertAt ??= kept.length;
+    else
+      kept.push(unit);
+  }
+  const added = freshUnits.filter((unit) => replaced.has(unit.name));
+  kept.splice(insertAt ?? kept.length, 0, ...added);
+  const zone = item.timeZone;
+  const freshZone = fresh.findIndex((raw) => unfolded(raw) === "BEGIN:VTIMEZONE");
+  const zones = zone && replaced.has("DTSTART") && freshZone !== -1 && freshZone < freshBounds.begin && !lines.slice(0, bounds.begin).concat(lines.slice(bounds.end + 1)).some((raw) => unfolded(raw) === `TZID:${zone}`) ? fresh.slice(freshZone, freshBounds.begin) : [];
+  const output = [
+    ...lines.slice(0, bounds.begin),
+    ...zones,
+    lines[bounds.begin],
+    ...kept.map((unit) => unit.raw),
+    ...lines.slice(bounds.end)
+  ].flat();
+  return { uid: current.uid, body: `${output.join(`\r
+`)}\r
+` };
+}
 // package.json
 var package_default2 = {
   name: "@sockethub/platform-caldav",
   description: "A Sockethub platform for synchronizing CalDAV calendars, events, and tasks",
-  version: "1.0.0-beta.4",
+  version: "1.0.0-beta.6",
   type: "module",
   private: false,
   license: "LGPL-3.0+",
@@ -68523,16 +68877,16 @@ var package_default2 = {
     test: "bun test src/"
   },
   dependencies: {
-    "@sockethub/dav": "^1.0.0-beta.4",
-    "@sockethub/schemas": "^3.0.0-beta.4",
-    "@sockethub/util": "^1.0.0-beta.4",
+    "@sockethub/dav": "^1.0.0-beta.6",
+    "@sockethub/schemas": "^3.0.0-beta.6",
+    "@sockethub/util": "^1.0.0-beta.6",
     undici: "^7.30.0"
   },
   devDependencies: {
     "@types/bun": "latest"
   },
   peerDependencies: {
-    "@sockethub/server": "^5.0.0-beta.4"
+    "@sockethub/server": "^5.0.0-beta.6"
   },
   peerDependenciesMeta: {
     "@sockethub/server": {
@@ -68540,7 +68894,7 @@ var package_default2 = {
     }
   },
   types: "./dist/index.d.ts",
-  gitHead: "639c296a7332f192a1b3f7e86ef6603b5b67bbaa"
+  gitHead: "604f3da8850a19a4fd5f5e5dcec10bf283e9085e"
 };
 
 // src/schema.ts
@@ -68670,7 +69024,9 @@ var shared = {
   attendees: { type: "array", maxItems: 1000, items: person },
   reminders: { type: "array", maxItems: 100, items: reminder },
   attachments: { type: "array", maxItems: 100, items: attachment },
-  updateSupported: { type: "boolean" }
+  updateSupported: { type: "boolean" },
+  created: { type: "string", format: "date-time" },
+  lastModified: { type: "string", format: "date-time" }
 };
 var eventObject = {
   type: "object",
@@ -68737,7 +69093,14 @@ var queryObject = {
     endTime: { type: "string", format: "date-time" }
   }
 };
-var calendarItem = { oneOf: [eventObject, taskObject] };
+var syncToken = { type: "string", minLength: 1, maxLength: 4096 };
+var syncObject = {
+  type: "object",
+  additionalProperties: false,
+  properties: { syncToken, tokenOnly: { const: true } },
+  not: { required: ["syncToken", "tokenOnly"] }
+};
+var calendarItem2 = { oneOf: [eventObject, taskObject] };
 var mutationObject = {
   type: "object",
   required: ["id", "type"],
@@ -68760,12 +69123,27 @@ var PlatformCalDavSchema = {
     properties: {
       type: {
         type: "string",
-        enum: ["fetch", "read", "query", "create", "update", "delete"]
+        enum: [
+          "fetch",
+          "read",
+          "query",
+          "sync",
+          "create",
+          "update",
+          "delete"
+        ]
       },
       actor,
       target: { oneOf: [target, feedTarget] },
       object: {
-        oneOf: [eventObject, taskObject, deleteObject, queryObject]
+        oneOf: [
+          eventObject,
+          taskObject,
+          deleteObject,
+          queryObject,
+          { ...syncObject, required: ["syncToken"] },
+          { ...syncObject, required: ["tokenOnly"] }
+        ]
       }
     }
   },
@@ -68794,11 +69172,19 @@ var PlatformCalDavSchema = {
         },
         required: ["type", "actor", "target"]
       },
+      {
+        properties: {
+          type: { const: "sync" },
+          target,
+          object: syncObject
+        },
+        required: ["type", "actor", "target"]
+      },
       {
         properties: {
           type: { const: "create" },
           target,
-          object: calendarItem
+          object: calendarItem2
         },
         required: ["type", "actor", "target", "object"]
       },
@@ -68909,7 +69295,7 @@ var PlatformCalDavSchema = {
             type: "array",
             items: {
               oneOf: [
-                calendarItem,
+                calendarItem2,
                 {
                   type: "object",
                   required: [
@@ -68939,6 +69325,30 @@ var PlatformCalDavSchema = {
           }
         }
       },
+      {
+        type: "object",
+        required: [
+          "@context",
+          "type",
+          "totalItems",
+          "items",
+          "removed",
+          "syncToken",
+          "truncated"
+        ],
+        additionalProperties: false,
+        properties: {
+          "@context": { type: "array", items: { type: "string" } },
+          id: { type: ["string", "null"] },
+          type: { const: "collection" },
+          summary: { type: "string" },
+          totalItems: { type: "integer", minimum: 0 },
+          items: { type: "array", items: calendarItem2 },
+          removed: { type: "array", items: shared.id },
+          syncToken,
+          truncated: { type: "boolean" }
+        }
+      },
       {
         type: "object",
         required: ["@context", "type", "actor", "target", "object"],
@@ -68960,39 +69370,8 @@ var PlatformCalDavSchema = {
 var CONTEXT = buildCanonicalContext(PlatformCalDavSchema.contextUrl);
 var MAX_FEED_BYTES = 10 * 1024 * 1024;
 var MAX_FEED_REDIRECTS = 5;
-function safePathname(pathname) {
-  if (pathname.includes("\\") || /%(?:2f|5c)/i.test(pathname))
-    return false;
-  for (const segment of pathname.split("/")) {
-    let decoded = segment;
-    try {
-      for (let pass = 0;pass < 3; pass += 1) {
-        const next = decodeURIComponent(decoded);
-        if (next === decoded)
-          break;
-        decoded = next;
-      }
-    } catch {
-      return false;
-    }
-    if (decoded === "." || decoded === ".." || /[\\/]/.test(decoded))
-      return false;
-  }
-  return true;
-}
 function assertCalendarResource(calendarId, resourceId) {
-  let calendar;
-  let resource;
-  try {
-    calendar = new URL(calendarId);
-    resource = new URL(resourceId);
-  } catch {
-    throw new CalDavFailure("caldav:invalid-resource");
-  }
-  if (calendar.search || calendar.hash || resource.search || resource.hash || !safePathname(calendar.pathname) || !safePathname(resource.pathname))
-    throw new CalDavFailure("caldav:invalid-resource");
-  const prefix = calendar.pathname.endsWith("/") ? calendar.pathname : `${calendar.pathname}/`;
-  if (resource.origin !== calendar.origin || !resource.pathname.startsWith(prefix) || resource.pathname === prefix)
+  if (!isDavCollectionChild(calendarId, resourceId))
     throw new CalDavFailure("caldav:invalid-resource");
 }
 
@@ -69003,7 +69382,14 @@ class CalDav {
   discovery = new DiscoveryCache;
   config = {
     persist: false,
-    requireCredentials: ["fetch", "query", "create", "update", "delete"],
+    requireCredentials: [
+      "fetch",
+      "query",
+      "sync",
+      "create",
+      "update",
+      "delete"
+    ],
     connectTimeoutMs: 15000,
     allowPrivateAddresses: false,
     allowInsecureHttp: false,
@@ -69065,7 +69451,9 @@ class CalDav {
       if (!target.components.includes(input.type)) {
         throw new CalDavFailure("caldav:unsupported-component");
       }
-      const calendarData = buildICalendar(input);
+      const calendarData = buildICalendar(input, new Date, {
+        created: true
+      });
       const created = await client.create(target, calendarData.uid, calendarData.body);
       done(null, {
         "@context": CONTEXT,
@@ -69093,13 +69481,35 @@ class CalDav {
       items
     })).catch((error) => this.fail(job, error, done, credentials)).finally(() => client.close().catch(() => {}));
   }
+  sync(job, credentials, done) {
+    const client = this.client(credentials);
+    const input = job.object ?? {};
+    this.calendar(client, credentials, job.target?.id ?? "").then((calendar) => input.tokenOnly ? client.currentSyncToken(new URL(calendar.id)).then((syncToken) => ({
+      items: [],
+      removed: [],
+      syncToken,
+      truncated: false
+    })) : client.sync(calendar, input.syncToken)).then((result) => done(null, {
+      "@context": CONTEXT,
+      ...job.id ? { id: job.id } : {},
+      type: "collection",
+      summary: "CalDAV changes",
+      totalItems: result.items.length,
+      ...result
+    })).catch((error) => this.fail(job, error, done, credentials)).finally(() => client.close().catch(() => {}));
+  }
   update(job, credentials, done) {
     const client = this.client(credentials);
     const input = job.object;
     this.calendar(client, credentials, job.target?.id ?? "").then((calendar) => {
       this.assertResource(calendar.id, input.id ?? "");
       const generated = buildICalendar(input);
-      return client.update(input.id ?? "", input.etag ?? "", generated.body).then((updated) => ({ updated, uid: generated.uid }));
+      let uid = generated.uid;
+      return client.update(input.id ?? "", input.etag ?? "", (stored) => {
+        const patched = patchICalendar(stored, input, generated.body);
+        uid = patched.uid;
+        return patched.body;
+      }).then((updated) => ({ updated, uid }));
     }).then(({ updated, uid }) => done(null, this.mutationResponse(job, "update", updated.id, input.type, uid, updated.etag))).catch((error) => this.fail(job, error, done, credentials)).finally(() => client.close().catch(() => {}));
   }
   delete(job, credentials, done) {
@@ -69228,4 +69638,4 @@ export {
   foldLine
 };
 
-//# debugId=911786856EA8A5A164756E2164756E21
+//# debugId=0BA1D0264BEB87B464756E2164756E21