one CRUD, three callers — the browser and the agent stop writing iCalendar

the skill told an agent how to hand-write a .ics: escape the commas, fold at 75
octets, CRLF, DTSTAMP is required, and DTEND is the day after. all true, all
silent when wrong, and the browser had learned the same lesson separately in its
own copy of the code. this makes the sidecar the only thing that knows the
format, and gives everyone else fields.

WHAT WAS MISSING BEFORE THE SKILL COULD CHANGE. reading was already JSON, and
create-event landed this morning. this adds PATCH /_officer/item — change some
fields of an event or a card — and POST /_officer/contact. delete already worked.
with those the skill has no reason left to mention iCalendar, so it does not.

PATCH IS READ-PATCH-PUT, SERVER SIDE. it reads the stored text, replaces only the
lines it owns, and puts the whole thing back, so alarms, attendees, RRULEs and
every X- property a phone invented survive an edit made from a form that cannot
show them. that logic came out of the browser, where it had needed a duplicate of
the escaping and folding rules to live; the agent would have been a third copy in
bash. the web bundle now contains no iCalendar literals at all.

AND LIVE TESTING FOUND THE BUG THAT MATTERS. an event with a TZID is stored with
a VTIMEZONE block beside it, and that block has DTSTART lines of its own — the
rule for when summer time starts. taking the first DTSTART in the file rewrote
the TIMEZONE DEFINITION, left the event where it was, and answered ok. the
calendar showed the old time and the file was quietly corrupt. every write is now
confined to the first VEVENT or VCARD, and the file that caught it is a test.

three more traps handled rather than documented: a patch that reuses an all-day
event's stored DTEND must subtract the exclusive day first or the holiday drifts
every time the title is edited; moving a timed event must DROP a stale TZID
rather than preserve it, because a TZID and a Z together are a contradiction
clients resolve by moving the event; and a move bumps SEQUENCE, which is how a
phone tells an update from a duplicate.

contacts got the create form the calendar had, so both screens now do all four.
editing a card sends the other emails and phones back untouched — the form shows
the first of each, and sending only that would delete the rest.

47 tests across the writer and the patcher. verified live against a real event
carrying an alarm, an attendee, an RRULE and an X- property: all four intact
after a rename, a relocation and a move to a different day.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Officer-Session: 656f5c85-e49a-4f1f-b9f3-042a04b4d043

sidecar/ical.ts

@@ -211,7 +211,7 @@ export function parseContacts(vcf: string): Contact[] {
 
 // ─── Writing ────────────────────────────────────────────────────────────────────────────────────────
 
-const escapeText = (value: string) =>
+export const escapeText = (value: string) =>
   value
     .replace(/\\/g, '\\\\')
     .replace(/\r?\n/g, '\\n')
@@ -243,17 +243,17 @@ export function fold(line: string): string {
   return out.join('\r\n');
 }
 
-const pad = (n: number) => String(n).padStart(2, '0');
+export const pad = (n: number) => String(n).padStart(2, '0');
 
 /** `20260827T140000Z`. Always UTC, so the file carries no timezone this codebase would have to resolve. */
-const utcStamp = (date: Date) =>
+export const utcStamp = (date: Date) =>
   `${date.getUTCFullYear()}${pad(date.getUTCMonth() + 1)}${pad(date.getUTCDate())}T` +
   `${pad(date.getUTCHours())}${pad(date.getUTCMinutes())}${pad(date.getUTCSeconds())}Z`;
 
 /** `2026-08-27` → `20260827`. */
-const dateStamp = (iso: string) => iso.slice(0, 10).replace(/-/g, '');
+export const dateStamp = (iso: string) => iso.slice(0, 10).replace(/-/g, '');
 
-const addDay = (iso: string) => {
+export const addDay = (iso: string) => {
   const d = new Date(`${iso.slice(0, 10)}T00:00:00Z`);
   d.setUTCDate(d.getUTCDate() + 1);
   return d.toISOString().slice(0, 10);
@@ -303,3 +303,43 @@ export function buildEvent(uid: string, event: NewEvent): string {
 
   return lines.map(fold).join('\r\n') + '\r\n';
 }
+
+/** The inverse of `addDay`. Turns a file's EXCLUSIVE all-day DTEND back into the last day a person means. */
+export const subDay = (iso: string) => {
+  const d = new Date(`${iso.slice(0, 10)}T00:00:00Z`);
+  d.setUTCDate(d.getUTCDate() - 1);
+  return d.toISOString().slice(0, 10);
+};
+
+export type NewContact = {
+  fullName: string;
+  emails?: string[];
+  phones?: string[];
+  org?: string;
+  title?: string;
+};
+
+/**
+ * A minimal vCard 3.0 — the version CardDAV clients, iOS included, actually write.
+ *
+ * `N` is REQUIRED in 3.0 and is `Family;Given;Middle;Prefix;Suffix`. Nobody supplies it, so it is split
+ * out of the full name: last word is the family name, everything before it is given. That is wrong for
+ * some names in the world and right for most, and `FN` — which is what a phone displays — is whatever
+ * was actually typed either way.
+ */
+export function buildContact(uid: string, contact: NewContact): string {
+  const [family, ...given] = contact.fullName.trim().split(/\s+/).reverse();
+  const lines = [
+    'BEGIN:VCARD',
+    'VERSION:3.0',
+    `UID:${uid}`,
+    `FN:${escapeText(contact.fullName)}`,
+    `N:${escapeText(family ?? '')};${escapeText(given.reverse().join(' '))};;;`,
+  ];
+  for (const email of contact.emails ?? []) lines.push(`EMAIL;TYPE=INTERNET:${escapeText(email)}`);
+  for (const phone of contact.phones ?? []) lines.push(`TEL;TYPE=CELL:${escapeText(phone)}`);
+  if (contact.org) lines.push(`ORG:${escapeText(contact.org)}`);
+  if (contact.title) lines.push(`TITLE:${escapeText(contact.title)}`);
+  lines.push('END:VCARD');
+  return lines.map(fold).join('\r\n') + '\r\n';
+}