The vCard heredoc inside <<~XML sat at column 0, so no indentation
was stripped and the response body started with spaces before the
XML declaration, which strict parsers reject.

Assisted-by: Claude Opus 4.5 (pi coding agent)

diff --git a/lib/pro_tacts/web.rb b/lib/pro_tacts/web.rb
index 30fdeae..17f09a9 100644
--- a/lib/pro_tacts/web.rb
+++ b/lib/pro_tacts/web.rb
@@ -284,6 +284,16 @@ module ProTacts
             response["Content-Type"] = "text/xml"
             response.status = 207
             contact_etag = %("a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2")
+            vcard = <<~VCARD.chomp
+              BEGIN:VCARD
+              VERSION:3.0
+              PRODID:-//Apple Inc.//macOS 14.6.1//EN
+              N:Contact;Test;;;
+              FN:Test Contact
+              REV:2026-01-14T00:00:00Z
+              UID:AB12C345-6789-0DEF-1234-567890ABCDEF
+              END:VCARD
+            VCARD
 
             <<~XML
               <?xml version="1.0" encoding="UTF-8"?>
@@ -293,14 +303,7 @@ module ProTacts
                   <d:propstat>
                     <d:prop>
                       <d:getetag>#{contact_etag}</d:getetag>
-                      <card:address-data>BEGIN:VCARD
-VERSION:3.0
-PRODID:-//Apple Inc.//macOS 14.6.1//EN
-N:Contact;Test;;;
-FN:Test Contact
-REV:2026-01-14T00:00:00Z
-UID:AB12C345-6789-0DEF-1234-567890ABCDEF
-END:VCARD</card:address-data>
+                      <card:address-data>#{vcard}</card:address-data>
                     </d:prop>
                     <d:status>HTTP/1.1 200 OK</d:status>
                   </d:propstat>