Align HEY and Basecamp clients with current official APIs

[is2b007]

Review of Daybreak’s HEY and Basecamp clients against hey-cli v1.0 / hey-sdk 0.21 and the current bc3-api (flat routes, OAuth grant_type, completed assignments, rich-text comments).

This branch includes the HEY alignment from #60 plus the Basecamp review fixes. Prefer this PR if you want both in one merge.

HEY

Official writes and reads now match hey-sdk: form POST/PATCH /calendar/events.json with set_time_zone=1, week periods for expanded recurrences, date-only todos, empty time-track start + 409 adopt, canonical laterbox / asidebox / trailbox.

Review follow-up: occurrence ids ({series}:{date}) now use the event’s wall date. A UTC parse of 2026-04-15T23:00:00-05:00 was becoming the next day, so PATCH/DELETE .../occurrences/:date.json would 404.

Basecamp — issues that needed resolving

Official docs now treat flat routes as canonical. Legacy /buckets/:id/... still works, but several Daybreak paths were wrong or incomplete:

Area	Was	Now
Complete / uncomplete	/buckets/:bucket/todos/:id/completion.json	POST/DELETE /todos/:id/completion.json
Comments	/buckets/:bucket/recordings/:id/comments.json, first page only, plain text body	GET/POST /recordings/:id/comments.json, paginated; body is HTML (<div>…<br>…</div>) per rich_text.md
Schedule entries	first page only	paginated /schedules/:id/entries.json
OAuth	type=web_server / type=refresh only; discarded rotated refresh_token; hardcoded 2-week expiry	also sends grant_type; persists new refresh token + expires_in
Account pick	product == "bc3" only	also href / resource (Basecamp’s own authorization.json omits product)
Assignments	active list only; completed-in-Basecamp todos never updated locally	stamp existing rows from GET /my/assignments/completed.json (does not import history)
Recurring meetings	series starts_at only, so weekly meetings that began earlier vanished from this week	expand common recurrence_schedule frequencies into the week window as {id}:{YYYY-MM-DD}

Pagination Link: rel=next is now followed only for https://3.basecampapi.com/{account_id}/.... Comments and completion no longer require a stored basecamp_bucket_id.

bin/brakeman uses --ensure-latest; Brakeman is bumped 8.0.5 → 8.0.6 so scan_ruby is green.

Left as-is (not bugs in the current product surface)

• Card table cards in /my/assignments.json — a card has no completion endpoint; it is “done” by moving it to a done column (POST /card_tables/cards/:id/moves.json). Syncing them without that write-back would stamp into a failing WriteCompletionJob.
• HEY uncomplete — Daybreak has no unstamp flow (spec 04).
• Remote HEY email writes, ActionCable, habits, contacts, screener, compose — still out of scope.
• Legacy Basecamp bucket routes remain available upstream; we just stopped using them.

Tests

Full suite: 159 runs, 0 failures. No live HEY/Basecamp account in this environment.

  

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
daybreak	Ready	Preview	Aug 25, 2026 2:25am