create an event, newest day first, and a URL you can read

three small things, one of which turned out to be a bug in what shipped an hour
ago.

CREATE. a POST to /_officer/event, and the SIDECAR builds the file — the browser
sends title, when and where. a UID, a DTSTAMP and a UTC timestamp each have
exactly one correct form, and that belongs next to the parser that reads them
back, not in a react component. it writes the minimum a VEVENT can legally be:
no recurrence, no alarms, no attendees. this app cannot show those, and a field
the list cannot display is a field that silently disappears on the next edit.

times go in as UTC. the alternative is DTSTART;TZID plus a VTIMEZONE block
defining that zone's rules, and a subtly wrong VTIMEZONE moves an event by an
hour twice a year. UTC needs no definition and every client renders it local.
all-day is the other trap: RFC 5545 makes DTEND EXCLUSIVE, so a one-day event on
the 29th ends on the 30th — write the 29th and some clients draw nothing at all.
the form takes the last day a person means and the builder adds the day.

NEWEST DAY ON TOP. a calendar accumulates years, so ascending opened on whatever
was imported first and this week was a scroll away. within a day the order stays
chronological, because that is what a day is.

?collection=ra-guide, NOT ?collection=%2Fdav%2F1%2Fra-guide%2F. the path is
/dav/<userId>/<name>/, so the escaped form spent six characters on slashes to
say `ra-guide` and put the owner's user id in a URL people paste at each other.
the name is unique within a user, which is all a selector needs, and the full
path is recovered from the collections list the screen already loaded. a full
path in the param still resolves, because somebody's bookmark has one.

AND THE BUG. setProperty replaced a property's first line and left its
continuation lines behind. a value over 75 octets is FOLDED onto lines starting
with a space — so editing a long summary left the old tail folded onto the new
value, and each edit inherited the last one's ending. it only bites on long
values, which is why the first round of testing missed it. the fix consumes the
whole folded run and folds what it writes; both are now under test, including
the accent-near-the-boundary case that a naive slice(0,75) cuts in half.

verified live: both event shapes written and read back, escaping round-tripped,
and a long summary edited twice with no accumulation.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Officer-Session: 656f5c85-e49a-4f1f-b9f3-042a04b4d043

sidecar/ical.ts

@@ -6,8 +6,12 @@
 // owns correctness. `rrule` is passed through raw so the UI can say "repeats" without either of us
 // pretending to know when.
 //
-// Everything here is display-only. The authoritative copy of an event is the .ics on disk that DAV
-// clients read and write; nothing in this file ever writes one back.
+// Reading is display-only: the authoritative copy of an event is the .ics on disk that DAV clients read
+// and write, and an edit patches THAT text rather than rebuilding it from what was parsed here.
+//
+// `buildEvent` is the one exception, and only because a NEW event has no original to preserve. It is
+// deliberately the minimum a VEVENT can legally be — no RRULE, no alarms, no attendees. Officer's screens
+// cannot express those, and writing a field the UI cannot show is how an editor starts lying.
 
 /** Unfold RFC 5545 continuation lines (a leading space or tab continues the previous line). */
 function unfold(text: string): string[] {
@@ -204,3 +208,98 @@ export function parseContacts(vcf: string): Contact[] {
   }
   return contacts;
 }
+
+// ─── Writing ────────────────────────────────────────────────────────────────────────────────────────
+
+const escapeText = (value: string) =>
+  value
+    .replace(/\\/g, '\\\\')
+    .replace(/\r?\n/g, '\\n')
+    .replace(/([,;])/g, '\\$1');
+
+/**
+ * RFC 5545 §3.1: no content line over 75 OCTETS, continued by a line starting with one space.
+ *
+ * Octets, not characters — so this measures encoded length and breaks between code points. A pasted
+ * title with an accent in it is exactly where a naive `slice(0, 75)` splits a multi-byte character in
+ * half and produces a file some clients refuse and others render as mojibake.
+ */
+export function fold(line: string): string {
+  const encoder = new TextEncoder();
+  const out: string[] = [];
+  let current = '';
+  let bytes = 0;
+  for (const ch of line) {
+    const size = encoder.encode(ch).length;
+    if (bytes + size > 75) {
+      out.push(current);
+      current = ' ';
+      bytes = 1;
+    }
+    current += ch;
+    bytes += size;
+  }
+  out.push(current);
+  return out.join('\r\n');
+}
+
+const pad = (n: number) => String(n).padStart(2, '0');
+
+/** `20260827T140000Z`. Always UTC, so the file carries no timezone this codebase would have to resolve. */
+const utcStamp = (date: Date) =>
+  `${date.getUTCFullYear()}${pad(date.getUTCMonth() + 1)}${pad(date.getUTCDate())}T` +
+  `${pad(date.getUTCHours())}${pad(date.getUTCMinutes())}${pad(date.getUTCSeconds())}Z`;
+
+/** `2026-08-27` → `20260827`. */
+const dateStamp = (iso: string) => iso.slice(0, 10).replace(/-/g, '');
+
+const addDay = (iso: string) => {
+  const d = new Date(`${iso.slice(0, 10)}T00:00:00Z`);
+  d.setUTCDate(d.getUTCDate() + 1);
+  return d.toISOString().slice(0, 10);
+};
+
+export type NewEvent = {
+  summary: string;
+  location?: string;
+  /** An ISO instant for a timed event; `YYYY-MM-DD` when `allDay`. */
+  start: string;
+  /** Same shape as `start`. For an all-day event this is the LAST day, inclusive, as a person means it. */
+  end?: string;
+  allDay: boolean;
+};
+
+/**
+ * A minimal VEVENT, wrapped in its own VCALENDAR — one event per file, which is what every DAV client
+ * writes and what makes an href addressable.
+ *
+ * TIMES ARE WRITTEN IN UTC. The alternative is `DTSTART;TZID=Europe/Lisbon` plus a VTIMEZONE block
+ * defining that zone's rules, and getting a VTIMEZONE subtly wrong moves an event by an hour twice a
+ * year. UTC needs no definition and every client renders it in local time.
+ *
+ * ALL-DAY IS DIFFERENT, and its trap is DTEND. RFC 5545 makes the end date EXCLUSIVE, so a one-day
+ * event on the 27th ends on the 28th. Writing the 27th produces a zero-length event that some clients
+ * hide entirely; callers pass the last day they mean and this adds the day.
+ */
+export function buildEvent(uid: string, event: NewEvent): string {
+  const lines = ['BEGIN:VCALENDAR', 'VERSION:2.0', 'PRODID:-//Officer//caldav//EN', 'BEGIN:VEVENT', `UID:${uid}`];
+  lines.push(`DTSTAMP:${utcStamp(new Date())}`);
+
+  if (event.allDay) {
+    const last = event.end?.slice(0, 10) || event.start.slice(0, 10);
+    lines.push(`DTSTART;VALUE=DATE:${dateStamp(event.start)}`);
+    lines.push(`DTEND;VALUE=DATE:${dateStamp(addDay(last))}`);
+  } else {
+    const start = new Date(event.start);
+    // An hour is the default a calendar has taught everyone to expect from an event with no end.
+    const end = event.end ? new Date(event.end) : new Date(start.getTime() + 60 * 60 * 1000);
+    lines.push(`DTSTART:${utcStamp(start)}`);
+    lines.push(`DTEND:${utcStamp(end)}`);
+  }
+
+  lines.push(`SUMMARY:${escapeText(event.summary)}`);
+  if (event.location) lines.push(`LOCATION:${escapeText(event.location)}`);
+  lines.push('END:VEVENT', 'END:VCALENDAR');
+
+  return lines.map(fold).join('\r\n') + '\r\n';
+}