one CRUD, three callers — the browser and the agent stop writing iCalendar

the skill told an agent how to hand-write a .ics: escape the commas, fold at 75
octets, CRLF, DTSTAMP is required, and DTEND is the day after. all true, all
silent when wrong, and the browser had learned the same lesson separately in its
own copy of the code. this makes the sidecar the only thing that knows the
format, and gives everyone else fields.

WHAT WAS MISSING BEFORE THE SKILL COULD CHANGE. reading was already JSON, and
create-event landed this morning. this adds PATCH /_officer/item — change some
fields of an event or a card — and POST /_officer/contact. delete already worked.
with those the skill has no reason left to mention iCalendar, so it does not.

PATCH IS READ-PATCH-PUT, SERVER SIDE. it reads the stored text, replaces only the
lines it owns, and puts the whole thing back, so alarms, attendees, RRULEs and
every X- property a phone invented survive an edit made from a form that cannot
show them. that logic came out of the browser, where it had needed a duplicate of
the escaping and folding rules to live; the agent would have been a third copy in
bash. the web bundle now contains no iCalendar literals at all.

AND LIVE TESTING FOUND THE BUG THAT MATTERS. an event with a TZID is stored with
a VTIMEZONE block beside it, and that block has DTSTART lines of its own — the
rule for when summer time starts. taking the first DTSTART in the file rewrote
the TIMEZONE DEFINITION, left the event where it was, and answered ok. the
calendar showed the old time and the file was quietly corrupt. every write is now
confined to the first VEVENT or VCARD, and the file that caught it is a test.

three more traps handled rather than documented: a patch that reuses an all-day
event's stored DTEND must subtract the exclusive day first or the holiday drifts
every time the title is edited; moving a timed event must DROP a stale TZID
rather than preserve it, because a TZID and a Z together are a contradiction
clients resolve by moving the event; and a move bumps SEQUENCE, which is how a
phone tells an update from a duplicate.

contacts got the create form the calendar had, so both screens now do all four.
editing a card sends the other emails and phones back untouched — the form shows
the first of each, and sending only that would delete the rest.

47 tests across the writer and the patcher. verified live against a real event
carrying an alarm, an attendee, an RRULE and an X- property: all four intact
after a rename, a relocation and a move to a different day.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Officer-Session: 656f5c85-e49a-4f1f-b9f3-042a04b4d043

sidecar/index.ts

@@ -1,7 +1,8 @@
 import type { SidecarCommand, SidecarEvent } from '@@/sidecar/protocol';
 import { createSidecarConnector } from '@@/sidecar/connect';
 import { startRadicale, davPaths } from './radicale';
-import { listCollections, listEvents, listContacts, createEvent } from './collections';
+import { listCollections, listEvents, listContacts, createEvent, createContact } from './collections';
+import { patchFor, summarise } from './patch';
 import { DATA_PATH } from '@@/data-path';
 import { API_URL } from '@@/officer-url.mjs';
 
@@ -16,7 +17,10 @@ import { API_URL } from '@@/officer-url.mjs';
 //                        Reached from the platform's TOP-LEVEL /dav mount, which authenticates a DAV
 //                        app password over HTTP Basic. This is the door phones use.
 //   GET  /_health        is Radicale up, and does it answer.
-//   GET  /_officer/*     the JSON door for Officer's own web UI (see collections.ts).
+//   *    /_officer/*     the JSON door. Reads, and field-level writes: POST /_officer/event and
+//                        /_officer/contact create, PATCH /_officer/item changes fields, DELETE removes.
+//                        Built for the web UI; the agent skill speaks it too, which is why the writes
+//                        take FIELDS rather than iCalendar text (see patch.ts).
 //
 // WHY TWO DOORS. A browser should not speak DAV — rendering a month view out of multistatus XML is a
 // lot of machinery, and it would make the web UI as fragile as the protocol. The collections are on
@@ -203,6 +207,44 @@ const server = Bun.serve({
         return Response.json({ href, data: await res.text() });
       }
 
+      /*
+        Change some FIELDS of an item, rather than replacing its text.
+
+        This is the route anything sane should use. PUT is still here because the raw text is sometimes
+        genuinely what a caller has, but a caller that only wants to move an event or fix a phone number
+        should not have to learn iCalendar escaping to do it — and every caller that did learn it learned
+        it slightly differently. The read, the patch and the write happen here, in one round trip, over
+        the ORIGINAL text, so nothing the patcher does not recognise is disturbed.
+      */
+      if (url.pathname === '/_officer/item' && req.method === 'PATCH') {
+        const body = (await req.json().catch(() => ({}))) as { href?: string; [field: string]: unknown };
+        const href = String(body.href ?? '');
+        if (!href.startsWith(`/dav/${userId}/`)) {
+          return Response.json({ error: 'href is required and must be your own' }, { status: 400 });
+        }
+
+        const read = await fetcher(href, { method: 'GET' });
+        if (!read.ok) return Response.json({ error: `radicale answered ${read.status}` }, { status: 502 });
+
+        let patched: string;
+        try {
+          const { href: _ignored, ...fields } = body;
+          patched = patchFor(href, fields, await read.text());
+        } catch (err) {
+          return Response.json({ error: String(err) }, { status: 400 });
+        }
+
+        const isCard = href.endsWith('.vcf');
+        const written = await fetcher(href, {
+          method: 'PUT',
+          headers: { 'Content-Type': isCard ? 'text/vcard; charset=utf-8' : 'text/calendar; charset=utf-8' },
+          body: patched,
+        });
+        if (!written.ok) return Response.json({ error: `radicale answered ${written.status}` }, { status: 502 });
+        // The item as it now reads, so a caller can confirm what it did without a second call.
+        return Response.json({ ok: true, item: summarise(href, patched) });
+      }
+
       if (url.pathname === '/_officer/item' && (req.method === 'PUT' || req.method === 'DELETE')) {
         const body = (await req.json().catch(() => ({}))) as { href?: string; data?: string };
         const href = String(body.href ?? '');
@@ -270,6 +312,38 @@ const server = Bun.serve({
         }
       }
 
+      /* Same contract as the event route above, for an address book. */
+      if (url.pathname === '/_officer/contact' && req.method === 'POST') {
+        const body = (await req.json().catch(() => ({}))) as {
+          collection?: string;
+          fullName?: string;
+          emails?: string[];
+          phones?: string[];
+          org?: string;
+          title?: string;
+        };
+        const collection = String(body.collection ?? '');
+        if (!collection.startsWith(`/dav/${userId}/`)) {
+          return Response.json({ error: 'collection is required and must be your own' }, { status: 400 });
+        }
+        const fullName = (body.fullName ?? '').trim();
+        // FN is what a phone displays and vCard requires it. A card without one shows as a blank row.
+        if (!fullName) return Response.json({ error: 'fullName is required' }, { status: 400 });
+
+        try {
+          const created = await createContact(fetcher, collection, {
+            fullName,
+            emails: (body.emails ?? []).filter(Boolean),
+            phones: (body.phones ?? []).filter(Boolean),
+            org: (body.org ?? '').trim() || undefined,
+            title: (body.title ?? '').trim() || undefined,
+          });
+          return Response.json(created, { status: 201 });
+        } catch (err) {
+          return Response.json({ error: String(err) }, { status: 502 });
+        }
+      }
+
       const path = url.searchParams.get('collection');
       // Confine reads to this user's own tree. The header already scopes Radicale, but a path from a
       // query string is attacker-shaped input and should not be handed on unchecked.