create an event, newest day first, and a URL you can read

three small things, one of which turned out to be a bug in what shipped an hour
ago.

CREATE. a POST to /_officer/event, and the SIDECAR builds the file — the browser
sends title, when and where. a UID, a DTSTAMP and a UTC timestamp each have
exactly one correct form, and that belongs next to the parser that reads them
back, not in a react component. it writes the minimum a VEVENT can legally be:
no recurrence, no alarms, no attendees. this app cannot show those, and a field
the list cannot display is a field that silently disappears on the next edit.

times go in as UTC. the alternative is DTSTART;TZID plus a VTIMEZONE block
defining that zone's rules, and a subtly wrong VTIMEZONE moves an event by an
hour twice a year. UTC needs no definition and every client renders it local.
all-day is the other trap: RFC 5545 makes DTEND EXCLUSIVE, so a one-day event on
the 29th ends on the 30th — write the 29th and some clients draw nothing at all.
the form takes the last day a person means and the builder adds the day.

NEWEST DAY ON TOP. a calendar accumulates years, so ascending opened on whatever
was imported first and this week was a scroll away. within a day the order stays
chronological, because that is what a day is.

?collection=ra-guide, NOT ?collection=%2Fdav%2F1%2Fra-guide%2F. the path is
/dav/<userId>/<name>/, so the escaped form spent six characters on slashes to
say `ra-guide` and put the owner's user id in a URL people paste at each other.
the name is unique within a user, which is all a selector needs, and the full
path is recovered from the collections list the screen already loaded. a full
path in the param still resolves, because somebody's bookmark has one.

AND THE BUG. setProperty replaced a property's first line and left its
continuation lines behind. a value over 75 octets is FOLDED onto lines starting
with a space — so editing a long summary left the old tail folded onto the new
value, and each edit inherited the last one's ending. it only bites on long
values, which is why the first round of testing missed it. the fix consumes the
whole folded run and folds what it writes; both are now under test, including
the accent-near-the-boundary case that a naive slice(0,75) cuts in half.

verified live: both event shapes written and read back, escaping round-tripped,
and a long summary edited twice with no accumulation.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Officer-Session: 656f5c85-e49a-4f1f-b9f3-042a04b4d043

sidecar/index.ts

@@ -1,7 +1,7 @@
 import type { SidecarCommand, SidecarEvent } from '@@/sidecar/protocol';
 import { createSidecarConnector } from '@@/sidecar/connect';
 import { startRadicale, davPaths } from './radicale';
-import { listCollections, listEvents, listContacts } from './collections';
+import { listCollections, listEvents, listContacts, createEvent } from './collections';
 import { DATA_PATH } from '@@/data-path';
 import { API_URL } from '@@/officer-url.mjs';
 
@@ -232,6 +232,44 @@ const server = Bun.serve({
         return Response.json({ ok: true, status: res.status });
       }
 
+      /*
+        Create an event. POST rather than PUT, because the caller does not choose the address — the
+        sidecar mints the filename, so this is "add one to that collection", not "put this here".
+
+        The BODY carries the collection, which is why this sits above the guard below: that one reads a
+        collection out of the query string, and a create has none there.
+      */
+      if (url.pathname === '/_officer/event' && req.method === 'POST') {
+        const body = (await req.json().catch(() => ({}))) as {
+          collection?: string;
+          summary?: string;
+          location?: string;
+          start?: string;
+          end?: string;
+          allDay?: boolean;
+        };
+        const collection = String(body.collection ?? '');
+        if (!collection.startsWith(`/dav/${userId}/`)) {
+          return Response.json({ error: 'collection is required and must be your own' }, { status: 400 });
+        }
+        const summary = (body.summary ?? '').trim();
+        if (!summary) return Response.json({ error: 'summary is required' }, { status: 400 });
+        if (!body.start) return Response.json({ error: 'start is required' }, { status: 400 });
+
+        try {
+          const created = await createEvent(fetcher, collection, {
+            summary,
+            location: (body.location ?? '').trim() || undefined,
+            start: body.start,
+            end: body.end,
+            allDay: Boolean(body.allDay),
+          });
+          return Response.json(created, { status: 201 });
+        } catch (err) {
+          return Response.json({ error: String(err) }, { status: 502 });
+        }
+      }
+
       const path = url.searchParams.get('collection');
       // Confine reads to this user's own tree. The header already scopes Radicale, but a path from a
       // query string is attacker-shaped input and should not be handed on unchecked.
@@ -247,7 +285,7 @@ const server = Bun.serve({
       }
 
       /*
-        Writing, from Officer's own screens.
+        On the writing routes above.
 
         ── Why the href is required and never derived ──