@ghostpaw/questlog 0.10.1 → 0.11.1

package/README.md

@@ -81,6 +81,9 @@ questlog list --view quests.resolved --json
 `--questline <id>`, and `--due` as YYYY-MM-DD, DD.MM.YYYY, `today`, `tomorrow`,
 `+3d`, an ISO date-time with timezone, or milliseconds since epoch. Date-only
 values use local end of day.
+`--objective` is the one flag that reads a file: `@path`, `@-` for stdin, and
+`@@text` for a literal `@text` (help marks it `(@file, @- stdin, @@ literal @)`). Every
+other value, including titles, `--outcome` and per-tool flags, is literal.
 `list` defaults to available quests; `list --help` lists all supported views.
 Its `--limit` caps text output; JSON preserves the full review tool result.
 `search --limit` caps matches in both formats. `show` prints full quest detail.
@@ -88,10 +91,14 @@ Lists show local due dates, overdue markers, and recorded outcomes. Plain JSON
 adds ISO UTC siblings for numeric timestamp fields ending in `At`.
 `done` stores `--outcome` with the finished quest; without it the command asks for one and exits 3.
 
-Plain commands print short text by default. Use `--json` for the full tool result
+Commands print text by default, including hooks, delivery views and each watch tick; `call` and direct tool commands return the raw tool result as JSON. Use `--json` for the full tool result
 and `--compact` for compact JSON. `--db path` works before or after the command.
 Each command accepts `--help`. Exit codes are 0 for success, 1 for invalid input
-or a tool error, 2 for usage errors, and 3 when clarification is needed.
+or a tool error, 2 for usage errors, and 3 when clarification is needed or `hook remove`/`hook test` addresses a missing target.
+Missing quests and deliveries exit 1. `hook label` names the database, not an individual target.
+
+`questlog skill --short` prints the compact cheat sheet; `questlog skill --list` lists guides.
+ISO date-times without a zone (for example `2026-10-29T09:00`) use the local time zone.
 
 The `call` command and the per-tool form still reach every tool and parameter:
 
@@ -124,7 +131,7 @@ ghostpaw-questlog skill > SKILL.md
 
 Each line downloads the latest release asset, checks it against the release’s SHA256SUMS and installs it on the PATH (~/.local/bin on Linux/macOS; the Windows script adds its folder to the user PATH).
 
-These lines never edit ~/.profile or other shell startup files: `export PATH` applies to the current shell only. To keep it, add `export PATH="$HOME/.local/bin:$PATH"` to your shell profile yourself.
+These lines never edit ~/.profile or other shell startup files: `export PATH` applies to the current shell only. To keep it in new shells, use the `~/.profile` line below.
 
 linux-x64:
 
@@ -159,7 +166,13 @@ irm https://raw.githubusercontent.com/GhostPawJS/questlog/main/install.ps1 | iex
 Pinned to a release:
 
 ```sh
-curl -fsSL https://raw.githubusercontent.com/GhostPawJS/questlog/main/install.sh | sh -s -- --target linux-x64 --version 0.10.1 && export PATH="$HOME/.local/bin:$PATH"
+curl -fsSL https://raw.githubusercontent.com/GhostPawJS/questlog/main/install.sh | sh -s -- --target linux-x64 --version 0.11.1 && export PATH="$HOME/.local/bin:$PATH"
+```
+
+Also adding ~/.local/bin to ~/.profile (edits ~/.profile once; skipped if it already mentions ~/.local/bin; zsh login shells read ~/.zprofile instead, so use that file name there):
+
+```sh
+curl -fsSL https://raw.githubusercontent.com/GhostPawJS/questlog/main/install.sh | sh -s -- --target linux-x64 && { grep -qs '.local/bin' ~/.profile || echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.profile; } && export PATH="$HOME/.local/bin:$PATH"
 ```
 
 To skip the persistent Windows user PATH edit (the installer still installs and prints the folder to add):
@@ -170,7 +183,7 @@ $env:GHOSTPAW_NO_MODIFY_PATH=1; irm https://raw.githubusercontent.com/GhostPawJS
 
 ```text
 $ ghostpaw-questlog --version
-questlog 0.10.1 (binary, linux-x64)
+questlog 0.11.1 (binary, linux-x64)
 ```
 
 Scripts that compare versions should use `--version --short` or `--version --json`.
@@ -536,6 +549,22 @@ questlog hook remove 1
 
 Save the signing secret printed once by `hook add` (including its `--json` result).
 `--secret-stdin` reads a supplied secret from standard input; there is no secret flag.
+Secrets and custom header values are stored in the database. On POSIX, new database files
+and their WAL/SHM siblings use mode 0600, and directories created for them use 0700.
+Existing database permissions are preserved; Windows uses its existing access controls.
+
+Add repeatable custom headers with `--header "Authorization: Bearer value"` or
+`--header-stdin` (one `Name: value` line per header, keeping values out of shell history).
+For example: `questlog hook add https://example.org/wake --header "X-Key: value"`.
+Headers accompany every delivery and test. Header names are shown with values replaced by
+`***`; values are never included in list, show, test, tick, watch, or tool output.
+Names must be HTTP tokens; `host`, `content-length`, `content-type`, and `x-questlog-*`
+are reserved (case insensitive). To change headers, remove the hook and add it again.
+Use separate invocations for `--header-stdin` and `--secret-stdin`.
+URL userinfo is rejected; use a custom header or query key instead.
+`questlog show d_…` prints delivery status, attempts, HTTP status, next attempt,
+redacted target URL, and event ids; add `--json` for JSON.
+
 List output redacts URL userinfo and query strings. Removal deletes the target and its deliveries.
 A target covers the database unless `--tag` restricts it to quests with that tag;
 rumors have no tags and reach database targets only. `--events` defaults to all five events.

package/SKILL.md

@@ -28,15 +28,19 @@ Run tools as `ghostpaw-questlog ...`; use `~/.local/bin/ghostpaw-questlog` if it
 `questlog` and `ghostpaw-questlog` are the same binary.
 
 - `questlog search <words>` before `add` to avoid duplicates.
-- `ghostpaw-questlog add "..." --tag a,b --due tomorrow`
+- `ghostpaw-questlog add "Write the report" --tag work --due tomorrow`
 - `questlog list [--view <view>]`: deliveries, questlines, quests.active, quests.available, quests.blocked, quests.deferred, quests.due_soon, quests.in_progress, quests.missed_scheduled, quests.open, quests.overdue, quests.resolved, quests.scheduled_for_day, quests.scheduled_now, repeatables.due_anchors, rumors.
-- `questlog done <id> --outcome "..."`
-- `questlog search <words>`
-- `questlog show <id>`
+- `questlog done 12 --outcome "Report sent"`
+- `questlog search "release"`
+- `questlog show 12`
+- `questlog list --view quests.available`
 - Use `--json` on any plain command.
-- Exit codes: 0 ok / 1 error / 2 usage / 3 needs input.
+- Exit codes: 0 ok / 1 error / 2 usage / 3 needs input or hook target not found.
 - Database: `~/.ghostpaw/questlog.db`; override with `--db` or `GHOSTPAW_QUESTLOG_DB`.
-- Use one database per agent or project.
+- Use one database per project.
+- `questlog --version` prints the installed version.
+- `questlog skill --short` prints this compact cheat sheet.
+- `questlog skill --list` lists guides; `questlog skill webhooks` reads one.
 - Webhooks: `questlog hook add <url>`, `questlog tick --dry-run`, `questlog watch`. Read `questlog skill webhooks` for events, signing, verification, and cron setup.
 
 ## Appendix: MCP and tool calls
@@ -175,16 +179,39 @@ Writes: writes_state.
 | action | string | yes | attach_quest_to_questline, create_quest, create_questline, detach_quest_from_questline, dismiss_rumor, reopen_rumor, settle_rumor, update_rumor. Action to perform. |
 | questId | integer | no | Quest to attach or detach. |
 | questlineId | integer | no | Questline that should receive the quest. |
-| quest | object | no |  |
+| quest | object | no | Object: title (required), objective (required), questlineId, tags, rewards, dueAt, notBeforeAt, scheduledStartAt, scheduledEndAt, allDay, estimateSeconds |
 | quest.title | string | yes | Title for the new quest. |
 | quest.objective | string | yes | Objective for the new quest. |
-| questline | object | no |  |
+| quest.questlineId | integer | no | Optional questline to place the quest in. |
+| quest.tags | array | no | Optional tags to apply at creation. |
+| quest.rewards | array | no | Optional rewards to attach at creation. |
+| quest.rewards[].kind | string | yes | Reward kind. |
+| quest.rewards[].name | string | yes | Reward name. |
+| quest.dueAt | integer | no | Optional latest acceptable completion timestamp. |
+| quest.notBeforeAt | integer | no | Optional earliest actionable timestamp. |
+| quest.scheduledStartAt | integer | no | Optional planned schedule window start. |
+| quest.scheduledEndAt | integer | no | Optional planned schedule window end. |
+| quest.allDay | boolean | no | Whether the scheduled window is all-day. |
+| quest.estimateSeconds | integer | no | Optional active-effort estimate in seconds. |
+| questline | object | no | Object: title (required), description |
 | questline.title | string | yes | Questline title. |
 | questline.description | string | no | Optional questline description. |
 | rumorId | integer | no | Rumor to settle, dismiss, or reopen. |
 | dismissedAt | integer | no | Optional dismissal timestamp. |
 | settledAt | integer | no | Optional settlement timestamp. |
 | quests | array | no | Quests to create during rumor settlement. Include timing and tags directly. |
+| quests[].title | string | yes | Title for a created quest. |
+| quests[].objective | string | yes | Objective for a created quest. |
+| quests[].tags | array | no | Optional tags to apply at creation. |
+| quests[].rewards | array | no | Optional rewards to attach at creation. |
+| quests[].rewards[].kind | string | yes | Reward kind. |
+| quests[].rewards[].name | string | yes | Reward name. |
+| quests[].dueAt | integer | no | Optional latest acceptable completion timestamp. |
+| quests[].notBeforeAt | integer | no | Optional earliest actionable timestamp. |
+| quests[].scheduledStartAt | integer | no | Optional planned schedule window start. |
+| quests[].scheduledEndAt | integer | no | Optional planned schedule window end. |
+| quests[].allDay | boolean | no | Whether the scheduled window is all-day. |
+| quests[].estimateSeconds | integer | no | Optional active-effort estimate in seconds. |
 | now | integer | no | Optional timestamp for membership, reopen, or rumor update. |
 | title | string | no | New title for the update_rumor action. |
 | details | string | no | New or enriched context text for the update_rumor action. |
@@ -244,6 +271,8 @@ Writes: writes_state.
 | outcome | string | no | Terminal outcome text. Required for finish, abandon, and abandon_and_spawn_followups. |
 | resolvedAt | integer | no | Optional resolved timestamp for finish or abandon actions. |
 | followups | array | no | Follow-up quests to create atomically. Required for abandon_and_spawn_followups. |
+| followups[].title | string | yes | Title for a follow-up quest. |
+| followups[].objective | string | yes | Objective for a follow-up quest. |
 
 ```sh
 ghostpaw-questlog call run_quest '{"action":"start","questId":1}'
@@ -295,7 +324,7 @@ Writes: writes_state.
 | --- | --- | --- | --- |
 | action | string | yes | archive, create, preview_due, spawn_due, update. Action to perform. |
 | repeatableQuestId | integer | no | Repeatable quest to archive or update. |
-| repeatableQuest | object | no |  |
+| repeatableQuest | object | no | Object: title (required), objective (required), rrule (required), anchorAt (required) |
 | repeatableQuest.title | string | yes | Title for the new repeatable quest. |
 | repeatableQuest.objective | string | yes | Objective for the new repeatable quest. |
 | repeatableQuest.rrule | string | yes | RRULE describing recurrence. |
@@ -333,7 +362,7 @@ Writes: writes_state.
 | Parameter | Type | Required | Values / description |
 | --- | --- | --- | --- |
 | action | string | yes | add, remove, replace. Action to perform. |
-| target | object | yes |  |
+| target | object | yes | Object: id (required), kind (required) |
 | target.id | integer | yes | Target entity id. |
 | target.kind | string | yes | quest, repeatable_quest. Target kind. |
 | tagNames | array | yes | Tag names to add, remove, or replace. |
@@ -358,14 +387,16 @@ Writes: writes_state.
 | Parameter | Type | Required | Values / description |
 | --- | --- | --- | --- |
 | action | string | yes | add, claim, remove, replace_repeatable_template, update. Action to perform. |
-| target | object | yes |  |
+| target | object | yes | Object: id (required), kind (required) |
 | target.id | integer | yes | Target entity id. |
 | target.kind | string | yes | quest, reward, repeatable_quest. Target kind. |
-| reward | object | no |  |
+| reward | object | no | Object: kind (required), name (required), now |
 | reward.kind | string | yes | Reward kind. |
 | reward.name | string | yes | Reward name. |
 | reward.now | integer | no | Optional update timestamp for the update action. |
 | rewards | array | no | Full future reward template set. Required for replace_repeatable_template. |
+| rewards[].kind | string | yes | Reward kind. |
+| rewards[].name | string | yes | Reward name. |
 | claimedAt | integer | no | Optional claim timestamp. |
 | now | integer | no | Optional timestamp for removal or template replacement. |
 
@@ -399,32 +430,32 @@ ghostpaw-questlog call retire_work '{"action":"hide","target":{"kind":"quest","i
 
 ### Workflow guides
 
-- `ghostpaw-questlog skill webhooks` ([webhooks](skills/questlog/references/webhooks.md)): Configure signed outbound event webhooks and verify deliveries.
-- `ghostpaw-questlog skill archive-delete-and-prune` ([archive-delete-and-prune](skills/questlog/references/archive-delete-and-prune.md)): Choose the right retirement action for each kind of work so history stays honest and hiding does not get confused with archival or terminal execution truth.
-- `ghostpaw-questlog skill choose-work-shape` ([choose-work-shape](skills/questlog/references/choose-work-shape.md)): Choose the right structure for new work by separating uncertainty, one-shot execution, multi-step arcs, and recurring patterns.
-- `ghostpaw-questlog skill clarify-ambiguous-requests` ([clarify-ambiguous-requests](skills/questlog/references/clarify-ambiguous-requests.md)): Treat ambiguity as a real state, capture uncertainty honestly, and only commit work structure once the next executable shape is clear.
-- `ghostpaw-questlog skill close-work-and-claim-outcomes` ([close-work-and-claim-outcomes](skills/questlog/references/close-work-and-claim-outcomes.md)): Close work with the correct terminal lifecycle action, then handle any concrete reward claim as a separate explicit step.
-- `ghostpaw-questlog skill create-concrete-quest` ([create-concrete-quest](skills/questlog/references/create-concrete-quest.md)): Create real, bounded executable quests only when the objective is concrete enough to execute without interpretive guesswork.
-- `ghostpaw-questlog skill detect-slips-and-staleness` ([detect-slips-and-staleness](skills/questlog/references/detect-slips-and-staleness.md)): Detect work that is slipping or going stale by reading overdue, deferred, in-progress, and related operational views before choosing one recovery move.
-- `ghostpaw-questlog skill escalate-and-unblock` ([escalate-and-unblock](skills/questlog/references/escalate-and-unblock.md)): Diagnose blockers honestly, then remove or realign hard gates when the model is wrong instead of treating every delay as generic escalation theater.
-- `ghostpaw-questlog skill frame-initiative-questline` ([frame-initiative-questline](skills/questlog/references/frame-initiative-questline.md)): Use questlines for shared initiative context, then attach concrete quests and maintain the structure without confusing one quest with one arc.
-- `ghostpaw-questlog skill handle-exceptions-and-weird-cases` ([handle-exceptions-and-weird-cases](skills/questlog/references/handle-exceptions-and-weird-cases.md)): Handle weird cases by diagnosing the actual tool outcome, routing into clarification or recovery when needed, and refusing to fake a clean normal-state story.
-- `ghostpaw-questlog skill intake-triage` ([intake-triage](skills/questlog/references/intake-triage.md)): Triage new asks, ideas, and vague incoming work into the right next step without prematurely committing execution structure.
-- `ghostpaw-questlog skill maintain-clear-ownership` ([maintain-clear-ownership](skills/questlog/references/maintain-clear-ownership.md)): Keep ownership explicit through quest content and classification because Questlog does not provide a separate assignee field or ownership tool.
-- `ghostpaw-questlog skill manage-approvals-and-promises` ([manage-approvals-and-promises](skills/questlog/references/manage-approvals-and-promises.md)): Treat approvals and commitments as modeled work with timing and dependencies instead of burying them as vague narrative promises.
-- `ghostpaw-questlog skill plan-successor-work` ([plan-successor-work](skills/questlog/references/plan-successor-work.md)): Create explicit successor work after closure by spawning follow-ups or shaping new work, while keeping uncertain next steps in intake instead of faking certainty.
-- `ghostpaw-questlog skill plan-time-correctly` ([plan-time-correctly](skills/questlog/references/plan-time-correctly.md)): Use quest planning fields honestly so availability, due pressure, and schedule intent stay meaningful instead of getting collapsed into one generic date.
-- `ghostpaw-questlog skill prioritize-across-streams` ([prioritize-across-streams](skills/questlog/references/prioritize-across-streams.md)): Prioritize across competing work streams by reading real candidate sets, distinguishing available from blocked work, and then reflecting the choice in planning.
-- `ghostpaw-questlog skill protect-capacity-and-focus` ([protect-capacity-and-focus](skills/questlog/references/protect-capacity-and-focus.md)): Protect capacity and focus by reading the real in-progress and scheduled-now load, then using planning to rebalance instead of silently overcommitting.
-- `ghostpaw-questlog skill recover-from-modeling-mistakes` ([recover-from-modeling-mistakes](skills/questlog/references/recover-from-modeling-mistakes.md)): Recover from modeling mistakes by diagnosing the exact current state first, then applying the smallest honest corrective tool instead of rewriting history blindly.
-- `ghostpaw-questlog skill report-status-and-manage-expectations` ([report-status-and-manage-expectations](skills/questlog/references/report-status-and-manage-expectations.md)): Build status reporting from the real questlog state, separating available, blocked, in-progress, slipping, and resolved work without relying on memory.
-- `ghostpaw-questlog skill revise-or-reshape-commitment` ([revise-or-reshape-commitment](skills/questlog/references/revise-or-reshape-commitment.md)): Revise a quest objective before execution starts, but reshape commitments honestly with lifecycle tools once real execution history exists.
-- `ghostpaw-questlog skill run-operational-review` ([run-operational-review](skills/questlog/references/run-operational-review.md)): Drive daily or weekly operational review from structured list views, then move from diagnosis into actual planning or execution changes.
-- `ghostpaw-questlog skill run-recurring-rhythms` ([run-recurring-rhythms](skills/questlog/references/run-recurring-rhythms.md)): Model recurring work as repeatable definitions that spawn fresh concrete quests over time instead of living forever as one immortal task.
-- `ghostpaw-questlog skill search-and-retrieve-context` ([search-and-retrieve-context](skills/questlog/references/search-and-retrieve-context.md)): Find relevant questlog context quickly, then switch from discovery to exact inspection without confusing free-text search with structured review surfaces.
-- `ghostpaw-questlog skill sequence-with-unlocks` ([sequence-with-unlocks](skills/questlog/references/sequence-with-unlocks.md)): Model hard sequencing with unlocks between concrete quests so blocked and available work stay truthful and reviewable.
-- `ghostpaw-questlog skill settle-rumor-into-structure` ([settle-rumor-into-structure](skills/questlog/references/settle-rumor-into-structure.md)): Turn a ready rumor into committed quest or questline structure without losing provenance or pretending vague intake is settled.
-- `ghostpaw-questlog skill tag-and-filter-portfolios` ([tag-and-filter-portfolios](skills/questlog/references/tag-and-filter-portfolios.md)): Use tags for cross-cutting classification and portfolio filtering without confusing tags for status, timing, or dependency modeling.
+- `ghostpaw-questlog skill webhooks`: Configure signed outbound event webhooks and verify deliveries.
+- `ghostpaw-questlog skill archive-delete-and-prune`: Choose the right retirement action for each kind of work so history stays honest and hiding does not get confused with archival or terminal execution truth.
+- `ghostpaw-questlog skill choose-work-shape`: Choose the right structure for new work by separating uncertainty, one-shot execution, multi-step arcs, and recurring patterns.
+- `ghostpaw-questlog skill clarify-ambiguous-requests`: Treat ambiguity as a real state, capture uncertainty honestly, and only commit work structure once the next executable shape is clear.
+- `ghostpaw-questlog skill close-work-and-claim-outcomes`: Close work with the correct terminal lifecycle action, then handle any concrete reward claim as a separate explicit step.
+- `ghostpaw-questlog skill create-concrete-quest`: Create real, bounded executable quests only when the objective is concrete enough to execute without interpretive guesswork.
+- `ghostpaw-questlog skill detect-slips-and-staleness`: Detect work that is slipping or going stale by reading overdue, deferred, in-progress, and related operational views before choosing one recovery move.
+- `ghostpaw-questlog skill escalate-and-unblock`: Diagnose blockers honestly, then remove or realign hard gates when the model is wrong instead of treating every delay as generic escalation theater.
+- `ghostpaw-questlog skill frame-initiative-questline`: Use questlines for shared initiative context, then attach concrete quests and maintain the structure without confusing one quest with one arc.
+- `ghostpaw-questlog skill handle-exceptions-and-weird-cases`: Handle weird cases by diagnosing the actual tool outcome, routing into clarification or recovery when needed, and refusing to fake a clean normal-state story.
+- `ghostpaw-questlog skill intake-triage`: Triage new asks, ideas, and vague incoming work into the right next step without prematurely committing execution structure.
+- `ghostpaw-questlog skill maintain-clear-ownership`: Keep ownership explicit through quest content and classification because Questlog does not provide a separate assignee field or ownership tool.
+- `ghostpaw-questlog skill manage-approvals-and-promises`: Treat approvals and commitments as modeled work with timing and dependencies instead of burying them as vague narrative promises.
+- `ghostpaw-questlog skill plan-successor-work`: Create explicit successor work after closure by spawning follow-ups or shaping new work, while keeping uncertain next steps in intake instead of faking certainty.
+- `ghostpaw-questlog skill plan-time-correctly`: Use quest planning fields honestly so availability, due pressure, and schedule intent stay meaningful instead of getting collapsed into one generic date.
+- `ghostpaw-questlog skill prioritize-across-streams`: Prioritize across competing work streams by reading real candidate sets, distinguishing available from blocked work, and then reflecting the choice in planning.
+- `ghostpaw-questlog skill protect-capacity-and-focus`: Protect capacity and focus by reading the real in-progress and scheduled-now load, then using planning to rebalance instead of silently overcommitting.
+- `ghostpaw-questlog skill recover-from-modeling-mistakes`: Recover from modeling mistakes by diagnosing the exact current state first, then applying the smallest honest corrective tool instead of rewriting history blindly.
+- `ghostpaw-questlog skill report-status-and-manage-expectations`: Build status reporting from the real questlog state, separating available, blocked, in-progress, slipping, and resolved work without relying on memory.
+- `ghostpaw-questlog skill revise-or-reshape-commitment`: Revise a quest objective before execution starts, but reshape commitments honestly with lifecycle tools once real execution history exists.
+- `ghostpaw-questlog skill run-operational-review`: Drive daily or weekly operational review from structured list views, then move from diagnosis into actual planning or execution changes.
+- `ghostpaw-questlog skill run-recurring-rhythms`: Model recurring work as repeatable definitions that spawn fresh concrete quests over time instead of living forever as one immortal task.
+- `ghostpaw-questlog skill search-and-retrieve-context`: Find relevant questlog context quickly, then switch from discovery to exact inspection without confusing free-text search with structured review surfaces.
+- `ghostpaw-questlog skill sequence-with-unlocks`: Model hard sequencing with unlocks between concrete quests so blocked and available work stay truthful and reviewable.
+- `ghostpaw-questlog skill settle-rumor-into-structure`: Turn a ready rumor into committed quest or questline structure without losing provenance or pretending vague intake is settled.
+- `ghostpaw-questlog skill tag-and-filter-portfolios`: Use tags for cross-cutting classification and portfolio filtering without confusing tags for status, timing, or dependency modeling.
 
 ### Principles
 

package/dist/chunk-7KTRNXTU.js

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+// src/surfaces/schema_rows.ts
+function schemaRows(schema, prefix = "") {
+  const properties = { ...schema.properties };
+  const required = new Set(schema.required);
+  for (const branch of schema.oneOf ?? []) {
+    Object.assign(properties, branch.properties);
+    for (const key of branch.required ?? []) required.add(key);
+  }
+  return Object.entries(properties).flatMap(([key, property]) => {
+    const nested = property.items ?? property;
+    const children = nested.properties ?? Object.assign({}, ...(nested.oneOf ?? []).map((b) => b.properties));
+    const description = property.description || (Object.keys(children).length ? `Object: ${Object.keys(children).map((name) => `${name}${nested.required?.includes(name) ? " (required)" : ""}`).join(", ")}` : property.type === "array" ? `Array of ${property.items?.type ?? "values"}` : `Value for ${key}`);
+    return [
+      `${prefix}${key} | ${property.type ?? "oneOf"} | ${required.has(key) ? "yes" : "no"} | ${(property.enum ? `${property.enum.join(", ")}. ` : "") + description.replaceAll("|", "\\|").replaceAll("\n", " ")}`,
+      ...schemaRows(nested, `${prefix}${key}${property.items ? "[]" : ""}.`)
+    ];
+  });
+}
+
+export { schemaRows };

package/dist/{chunk-GVD6A3RR.js → chunk-B5KVA6XE.js}

@@ -4,20 +4,26 @@ import { readFileSync } from 'node:fs';
 var CliUsageError = class extends Error {
   exitCode = 2;
 };
+function readFileValue(raw, name) {
+  if (!raw.startsWith("@")) return raw;
+  if (raw.startsWith("@@")) return raw.slice(1);
+  const path = raw.slice(1);
+  if (!path) throw new CliUsageError(`Empty file path for ${name}; use @@ for a literal leading @`);
+  try {
+    return readFileSync(path === "-" ? 0 : path, "utf8");
+  } catch {
+    throw new CliUsageError(
+      `Cannot read value file for ${name}: ${path} (use @@ for a literal leading @)`
+    );
+  }
+}
 var keyOf = (name) => name.replace(/-([a-z])/g, (_, c) => c.toUpperCase());
 function parseCliArgs(argv, spec) {
   const values = {};
   const positions = [];
   const flags = spec.flags ?? [];
   const convert = (raw, arg) => {
-    let value = raw;
-    if (raw.startsWith("@")) {
-      try {
-        value = readFileSync(raw.slice(1), "utf8");
-      } catch {
-        throw new CliUsageError(`Cannot read value file: ${raw.slice(1)}`);
-      }
-    }
+    const value = arg.file ? readFileValue(raw, arg.name) : raw;
     let result = value;
     if (arg.type === "number" || arg.type === "integer") {
       result = Number(value);
@@ -94,7 +100,7 @@ function parseCliArgs(argv, spec) {
   return values;
 }
 function renderCliHelp(spec) {
-  const describe = (arg) => `${arg.type}${arg.enum ? ` (${arg.enum.join("|")})` : ""}${arg.required ? " required" : ""}  ${arg.description ?? ""}`;
+  const describe = (arg) => `${arg.type}${arg.enum ? ` (${arg.enum.join("|")})` : ""}${arg.required ? " required" : ""}${arg.file ? " (@file, @- stdin, @@ literal @)" : ""}  ${arg.description ?? ""}`;
   return `Usage: ${spec.command} ${(spec.positionals ?? []).map((arg) => `<${arg.name}${arg.variadic ? "..." : ""}>`).join(" ")} [flags]
 ${spec.description ?? ""}
 

package/dist/chunk-D6EGZCT7.js

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+// src/hooks/list_deliveries.ts
+function listDeliveries(db, options = {}) {
+  return db.prepare(
+    `SELECT * FROM hook_deliveries ${options.includeDelivered ? "" : "WHERE status <> 'delivered'"} ORDER BY target_id, next_attempt_at, id`
+  ).all().map(
+    (row) => ({
+      id: String(row.id),
+      targetId: Number(row.target_id),
+      events: JSON.parse(String(row.events)),
+      status: row.status,
+      attempts: Number(row.attempts),
+      lastAttemptAt: row.last_attempt_at == null ? null : Number(row.last_attempt_at),
+      httpStatus: row.http_status == null ? null : Number(row.http_status),
+      errorClass: row.error_class == null ? null : String(row.error_class),
+      nextAttemptAt: Number(row.next_attempt_at)
+    })
+  ).filter(
+    (d) => options.questId === void 0 || d.events.some((e) => e.questId === options.questId)
+  );
+}
+
+export { listDeliveries };

package/dist/{chunk-N7V7VUI5.js → chunk-FORPYJT4.js}

@@ -1,7 +1,44 @@
 #!/usr/bin/env node
+import { listDeliveries } from './chunk-D6EGZCT7.js';
+import { listHooks } from './chunk-NBCCA6AX.js';
 import { randomBytes, createHmac } from 'node:crypto';
 import { basename, extname } from 'node:path';
 
+// src/with_transaction.ts
+var transactionDepth = /* @__PURE__ */ new WeakMap();
+function withTransaction(db, fn) {
+  const depth = transactionDepth.get(db) ?? 0;
+  const savepoint = `questlog_${depth}`;
+  if (depth === 0) {
+    db.exec("BEGIN IMMEDIATE");
+  } else {
+    db.exec(`SAVEPOINT ${savepoint}`);
+  }
+  transactionDepth.set(db, depth + 1);
+  try {
+    const result = fn();
+    if (depth === 0) {
+      db.exec("COMMIT");
+    } else {
+      db.exec(`RELEASE SAVEPOINT ${savepoint}`);
+    }
+    transactionDepth.set(db, depth);
+    return result;
+  } catch (error) {
+    try {
+      if (depth === 0) {
+        db.exec("ROLLBACK");
+      } else {
+        db.exec(`ROLLBACK TO SAVEPOINT ${savepoint}`);
+        db.exec(`RELEASE SAVEPOINT ${savepoint}`);
+      }
+    } catch {
+    }
+    transactionDepth.set(db, depth);
+    throw error;
+  }
+}
+
 // src/tags/normalize_tag_name.ts
 function normalizeTagName(name) {
   return name.trim().toLowerCase().replace(/\s+/g, " ");
@@ -24,13 +61,20 @@ function addHook(db, input) {
   } catch {
     throw new Error("Expected an HTTP or HTTPS URL");
   }
-  if (!["http:", "https:"].includes(url.protocol)) throw new Error("Expected an HTTP or HTTPS URL");
+  if (!["http:", "https:"].includes(url.protocol))
+    throw new Error(`unsupported scheme ${url.protocol}; use http or https`);
+  if (url.username || url.password)
+    throw new Error(
+      "URL userinfo is not supported; use a custom header (--header or --header-stdin) or a query key instead"
+    );
   const minGap = input.minGap ?? 60;
   if (!Number.isSafeInteger(minGap) || minGap < 0)
     throw new Error("Min gap must be a nonnegative integer");
   const events = input.events ?? [...hookEventTypes];
   if (!events.length || events.some((e) => !hookEventTypes.includes(e)))
-    throw new Error("Unknown event filter");
+    throw new Error(
+      `unknown event ${events.find((e) => !hookEventTypes.includes(e)) ?? "(empty)"}; valid: ${hookEventTypes.join(", ")}`
+    );
   if (input.tag !== void 0 && !normalizeTagName(input.tag))
     throw new Error("Expected a tag name");
   const secret = input.secret ?? randomBytes(32).toString("hex");
@@ -62,67 +106,6 @@ function hookLabel(db, name) {
   return path ? basename(path, extname(path)) : "questlog";
 }
 
-// src/hooks/list_hooks.ts
-function listHooks(db) {
-  return db.prepare(`SELECT id, url, tag, events, min_gap, created_at, last_wake,
- (SELECT COUNT(*) FROM hook_assignments a LEFT JOIN hook_deliveries d ON d.id = a.delivery_id WHERE a.target_id = t.id AND (a.delivery_id IS NULL OR d.status = 'pending')) AS pending,
- (SELECT COUNT(*) FROM hook_deliveries d WHERE d.target_id = t.id AND d.status = 'failed') AS failed
- FROM hook_targets t ORDER BY id`).all().map((row) => {
-    const url = new URL(String(row.url));
-    url.username = "";
-    url.password = "";
-    url.search = "";
-    url.hash = "";
-    return {
-      id: Number(row.id),
-      scope: row.tag == null ? "database" : "tag",
-      url: url.href,
-      tag: row.tag == null ? null : String(row.tag),
-      events: JSON.parse(String(row.events)),
-      minGap: Number(row.min_gap),
-      createdAt: Number(row.created_at),
-      lastWake: row.last_wake == null ? null : Number(row.last_wake),
-      pending: Number(row.pending),
-      failed: Number(row.failed)
-    };
-  });
-}
-
-// src/with_transaction.ts
-var transactionDepth = /* @__PURE__ */ new WeakMap();
-function withTransaction(db, fn) {
-  const depth = transactionDepth.get(db) ?? 0;
-  const savepoint = `questlog_${depth}`;
-  if (depth === 0) {
-    db.exec("BEGIN IMMEDIATE");
-  } else {
-    db.exec(`SAVEPOINT ${savepoint}`);
-  }
-  transactionDepth.set(db, depth + 1);
-  try {
-    const result = fn();
-    if (depth === 0) {
-      db.exec("COMMIT");
-    } else {
-      db.exec(`RELEASE SAVEPOINT ${savepoint}`);
-    }
-    transactionDepth.set(db, depth);
-    return result;
-  } catch (error) {
-    try {
-      if (depth === 0) {
-        db.exec("ROLLBACK");
-      } else {
-        db.exec(`ROLLBACK TO SAVEPOINT ${savepoint}`);
-        db.exec(`RELEASE SAVEPOINT ${savepoint}`);
-      }
-    } catch {
-    }
-    transactionDepth.set(db, depth);
-    throw error;
-  }
-}
-
 // src/hooks/remove_hook.ts
 function removeHook(db, id) {
   withTransaction(db, () => {
@@ -133,7 +116,7 @@ function removeHook(db, id) {
 }
 
 // src/version.ts
-var questlogVersion = "0.10.1";
+var questlogVersion = "0.11.1";
 
 // src/hooks/send_hook_delivery.ts
 async function sendHookDelivery(db, delivery, target, options) {
@@ -154,8 +137,13 @@ async function sendHookDelivery(db, delivery, target, options) {
       method: "POST",
       redirect: "error",
       headers: {
-        "content-type": "application/json",
         "user-agent": `questlog/${questlogVersion}`,
+        ...JSON.parse(
+          String(
+            db.prepare("SELECT headers FROM hook_targets WHERE id = ?").get(target.id)?.headers ?? "{}"
+          )
+        ),
+        "content-type": "application/json",
         "x-questlog-delivery": delivery.id,
         "x-questlog-timestamp": timestamp,
         "x-questlog-signature": `sha256=${signature}`
@@ -815,27 +803,6 @@ function detectHookEvents(db, now) {
   );
 }
 
-// src/hooks/list_deliveries.ts
-function listDeliveries(db, options = {}) {
-  return db.prepare(
-    `SELECT * FROM hook_deliveries ${options.includeDelivered ? "" : "WHERE status <> 'delivered'"} ORDER BY target_id, next_attempt_at, id`
-  ).all().map(
-    (row) => ({
-      id: String(row.id),
-      targetId: Number(row.target_id),
-      events: JSON.parse(String(row.events)),
-      status: row.status,
-      attempts: Number(row.attempts),
-      lastAttemptAt: row.last_attempt_at == null ? null : Number(row.last_attempt_at),
-      httpStatus: row.http_status == null ? null : Number(row.http_status),
-      errorClass: row.error_class == null ? null : String(row.error_class),
-      nextAttemptAt: Number(row.next_attempt_at)
-    })
-  ).filter(
-    (d) => options.questId === void 0 || d.events.some((e) => e.questId === options.questId)
-  );
-}
-
 // src/hooks/tick_questlog.ts
 async function tickQuestlog(db, options = {}) {
   const now = options.now ?? options.clock?.() ?? Date.now();
@@ -979,4 +946,4 @@ async function watchQuestlog(db, options) {
   }
 }
 
-export { addHook, deriveQuestMarkerId, deriveQuestState, getQuestOrThrow, getRepeatableQuestOrThrow, hookLabel, listDeliveries, listDueRepeatableQuestAnchors, listHooks, mapQuestRewardRow, normalizeTagName, parseRRule, queryQuestDetailRecords, questlogVersion, removeHook, resolveNow, spawnDueRepeatableQuests, testHook, tickQuestlog, watchQuestlog, withTransaction };
+export { addHook, deriveQuestMarkerId, deriveQuestState, getQuestOrThrow, getRepeatableQuestOrThrow, hookLabel, listDueRepeatableQuestAnchors, mapQuestRewardRow, normalizeTagName, parseRRule, queryQuestDetailRecords, questlogVersion, removeHook, resolveNow, spawnDueRepeatableQuests, testHook, tickQuestlog, watchQuestlog, withTransaction };

package/dist/{chunk-D2W5MYNO.js → chunk-I2AMIXGP.js}

@@ -728,7 +728,7 @@ Failure handling:
 var webhooksSkill = defineQuestlogSkill({
   name: "webhooks",
   description: "Configure signed outbound event webhooks and verify deliveries.",
-  content: '# Webhooks\n\nUse `questlog` to configure opt-in outbound automation. No server or scheduler is added.\nNo targets means no network calls. `manage_hooks` supports list, remove, tick with\n`dry_run`, and deliveries; add/test are CLI-only. `review_questlog` view `deliveries`\nand `questlog show <id>` expose pending/failed deliveries.\n\n```sh\nquestlog hook add https://example.org/wake --min-gap 60\nquestlog hook add https://example.org/team --tag work --events quest.due,quest.overdue --secret-stdin\nquestlog hook label work\nquestlog hook list\nquestlog tick --dry-run\nquestlog tick\nquestlog watch --interval 60\nquestlog hook test 1\nquestlog review deliveries\nquestlog show 12\nquestlog hook remove 1\n```\n\n`hook add` prints its random 32-byte signing secret once, also as `secret` in `--json`.\nSave it securely. `--secret-stdin` supplies one via stdin; there is no secret flag.\nList output redacts userinfo/query strings. Removal deletes the target and deliveries.\nDefault scope is the database; `--tag` matches quest tags, never rumors.\n`--events` defaults to all types. The DB label defaults to the filename without its\npath/extension (`questlog` in memory); set it to a name suitable for disclosure.\n\n```cron\n* * * * * questlog tick\n```\n\nCron\'s PATH may need `$HOME/.local/bin/questlog tick --db /path/to/quests.db`.\nWatch defaults to 60 seconds (minimum 5); SIGINT/SIGTERM finishes the current tick.\nTick exits 0 even when deliveries need retries. Dry-run records nothing and sends nothing.\n\nEvents are detected from the model at tick time:\n\n- `quest.due`: an unresolved, undeleted quest reaches its effective due time (own `due_at`, otherwise its undeleted questline\'s due time).\n- `quest.overdue`: that effective deadline is strictly earlier than now and the quest remains unresolved.\n- `quest.unblocked`: an unresolved quest is available, all active prerequisites have succeeded or been deleted, and at least one prerequisite succeeded after its unlock was installed. Occurrence time is the latest active prerequisite success or not-before time, whichever is later.\n- `repeatable.spawned`: a concrete repeatable instance was created; occurrence time is its creation time. Tick first materializes due anchors through the existing spawn operation.\n- `rumor.captured`: an undeleted rumor was created; occurrence time is its creation time, even if subsequently settled or dismissed.\n\nPersistent event keys contain type, entity ids, and occurrence time. Restarts and repeated\nticks do not repeat occurrences. Removed transitions between ticks cannot be reconstructed.\nOnly occurrences at/after target creation are assigned; tags are evaluated at assignment.\nTick materializes due repeatables using the existing spawn path, including during preview\nwith rollback. Batches contain only ids, event types, timestamps, and the DB label:\n\n```json\n{"type":"questlog.events","db":"work","deliveryId":"d_\u2026","sentAt":"2026-10-28T10:00:00.000Z","events":[{"id":"e_\u2026","type":"quest.due","questId":12,"occurredAt":"2026-10-28T09:59:00.000Z"}]}\n```\n\nHeaders are `content-type: application/json`, `user-agent: questlog/<version>`,\n`x-questlog-delivery: <deliveryId>`, `x-questlog-timestamp: <unix seconds>`, and\n`x-questlog-signature: sha256=<hex HMAC-SHA256(secret, timestamp + "." + rawBody)>`.\nNo titles, objectives, details, or tag text are sent. `hook test` sends a logged `hook.test`\nevent immediately, ignoring the min gap. Add and test are CLI-only in the tool facade;\n`manage_hooks` supports list, remove, tick (with `dry_run`), and deliveries.\n\n2xx delivers. Timeout is 5 seconds. Failures retry after 30 s, 1 m, 2 m, 4 m, doubling\nto 1 h plus <1 s jitter, subject to the target\'s min gap. Eight failures mark failed.\nRetries keep the delivery id/events; new events queue behind them. Keep the last 500\ndelivered log entries per target and all pending/failed entries. Transactional claims\nlease work for two minutes. A crash after receipt may retry: dedupe at the receiver.\n\n### Verifying a delivery\n\nCompute HMAC-SHA256 over `timestamp + "." + rawBody` with the secret and compare in constant\ntime. Reject timestamps older than 5 minutes (and timestamps too far in the future), then\ndedupe on `x-questlog-delivery`. Use durable deduplication storage in a production receiver.\nThis 15-line Node example uses an in-memory set:\n\n```js\nimport { createHmac, timingSafeEqual } from \'node:crypto\';\nimport { createServer } from \'node:http\';\nconst secret = process.env.WEBHOOK_SECRET, seen = new Set();\ncreateServer(async (req, res) => {\n  const chunks = []; for await (const chunk of req) chunks.push(chunk);\n  const rawBody = Buffer.concat(chunks), h = req.headers;\n  const timestamp = h[\'x-questlog-timestamp\'], id = h[\'x-questlog-delivery\'];\n  const age = Date.now() / 1000 - Number(timestamp);\n  const expected = createHmac(\'sha256\', secret).update(timestamp + \'.\').update(rawBody).digest();\n  const signature = String(h[\'x-questlog-signature\'] || \'\');\n  const actual = Buffer.from(signature.slice(7), \'hex\');\n  if (!id || !/^\\d+$/.test(timestamp) || age > 300 || age < -300 || !/^sha256=[a-f0-9]{64}$/.test(signature) || actual.length !== expected.length || !timingSafeEqual(actual, expected)) { res.writeHead(401).end(); return; }\n  if (!seen.has(id)) { seen.add(id); console.log(JSON.parse(rawBody)); }\n  res.writeHead(204).end();\n}).listen(8080, \'127.0.0.1\');\n```\n'
+  content: '# Webhooks\n\nUse `questlog` to configure opt-in outbound automation. No server or scheduler is added.\nNo targets means no network calls. `manage_hooks` supports list, remove, tick with\n`dry_run`, and deliveries; add/test are CLI-only. `review_questlog` view `deliveries`\nand `questlog show <id>` expose pending/failed deliveries.\n\n```sh\nquestlog hook add https://example.org/wake --min-gap 60\nquestlog hook add https://example.org/team --tag work --events quest.due,quest.overdue --secret-stdin\nquestlog hook label work\nquestlog hook list\nquestlog tick --dry-run\nquestlog tick\nquestlog watch --interval 60\nquestlog hook test 1\nquestlog review deliveries\nquestlog show 12\nquestlog hook remove 1\n```\n\n`hook add` prints its random 32-byte signing secret once, also as `secret` in `--json`.\nSave it securely. `--secret-stdin` supplies one via stdin; there is no secret flag.\nSecrets and custom header values are stored in the DB. New POSIX DB/WAL/SHM files use 0600 and created directories use 0700; existing DB modes are preserved. Windows uses existing access controls.\nUse repeatable `--header "Name: value"` or `--header-stdin` (one line per header, avoiding shell history). Headers are sent on every delivery and test; output shows names with `***` values. HTTP token names are required; host, content-length, content-type, and x-questlog-* are reserved. Change headers by removing and adding the hook again. Use --header-stdin and --secret-stdin separately. URL userinfo is rejected; use a custom header or query key.\n`questlog show d_\u2026` displays delivery status, attempts, HTTP status, next attempt, redacted target URL and event ids. Text is the default; --json prints JSON. Missing hook remove/test targets exit 3; missing quests/deliveries exit 1. hook label names the database.\nList output redacts userinfo/query strings. Removal deletes the target and deliveries.\nDefault scope is the database; `--tag` matches quest tags, never rumors.\n`--events` defaults to all types. The DB label defaults to the filename without its\npath/extension (`questlog` in memory); set it to a name suitable for disclosure.\n\n```cron\n* * * * * questlog tick\n```\n\nCron\'s PATH may need `$HOME/.local/bin/questlog tick --db /path/to/quests.db`.\nWatch defaults to 60 seconds (minimum 5); SIGINT/SIGTERM finishes the current tick.\nTick exits 0 even when deliveries need retries. Dry-run records nothing and sends nothing.\n\nEvents are detected from the model at tick time:\n\n- `quest.due`: an unresolved, undeleted quest reaches its effective due time (own `due_at`, otherwise its undeleted questline\'s due time).\n- `quest.overdue`: that effective deadline is strictly earlier than now and the quest remains unresolved.\n- `quest.unblocked`: an unresolved quest is available, all active prerequisites have succeeded or been deleted, and at least one prerequisite succeeded after its unlock was installed. Occurrence time is the latest active prerequisite success or not-before time, whichever is later.\n- `repeatable.spawned`: a concrete repeatable instance was created; occurrence time is its creation time. Tick first materializes due anchors through the existing spawn operation.\n- `rumor.captured`: an undeleted rumor was created; occurrence time is its creation time, even if subsequently settled or dismissed.\n\nPersistent event keys contain type, entity ids, and occurrence time. Restarts and repeated\nticks do not repeat occurrences. Removed transitions between ticks cannot be reconstructed.\nOnly occurrences at/after target creation are assigned; tags are evaluated at assignment.\nTick materializes due repeatables using the existing spawn path, including during preview\nwith rollback. Batches contain only ids, event types, timestamps, and the DB label:\n\n```json\n{"type":"questlog.events","db":"work","deliveryId":"d_\u2026","sentAt":"2026-10-28T10:00:00.000Z","events":[{"id":"e_\u2026","type":"quest.due","questId":12,"occurredAt":"2026-10-28T09:59:00.000Z"}]}\n```\n\nHeaders are `content-type: application/json`, `user-agent: questlog/<version>`,\n`x-questlog-delivery: <deliveryId>`, `x-questlog-timestamp: <unix seconds>`, and\n`x-questlog-signature: sha256=<hex HMAC-SHA256(secret, timestamp + "." + rawBody)>`.\nNo titles, objectives, details, or tag text are sent. `hook test` sends a logged `hook.test`\nevent immediately, ignoring the min gap. Add and test are CLI-only in the tool facade;\n`manage_hooks` supports list, remove, tick (with `dry_run`), and deliveries.\n\n2xx delivers. Timeout is 5 seconds. Failures retry after 30 s, 1 m, 2 m, 4 m, doubling\nto 1 h plus <1 s jitter, subject to the target\'s min gap. Eight failures mark failed.\nRetries keep the delivery id/events; new events queue behind them. Keep the last 500\ndelivered log entries per target and all pending/failed entries. Transactional claims\nlease work for two minutes. A crash after receipt may retry: dedupe at the receiver.\n\n### Verifying a delivery\n\nCompute HMAC-SHA256 over `timestamp + "." + rawBody` with the secret and compare in constant\ntime. Reject timestamps older than 5 minutes (and timestamps too far in the future), then\ndedupe on `x-questlog-delivery`. Use durable deduplication storage in a production receiver.\nThis 15-line Node example uses an in-memory set:\n\n```js\nimport { createHmac, timingSafeEqual } from \'node:crypto\';\nimport { createServer } from \'node:http\';\nconst secret = process.env.WEBHOOK_SECRET, seen = new Set();\ncreateServer(async (req, res) => {\n  const chunks = []; for await (const chunk of req) chunks.push(chunk);\n  const rawBody = Buffer.concat(chunks), h = req.headers;\n  const timestamp = h[\'x-questlog-timestamp\'], id = h[\'x-questlog-delivery\'];\n  const age = Date.now() / 1000 - Number(timestamp);\n  const expected = createHmac(\'sha256\', secret).update(timestamp + \'.\').update(rawBody).digest();\n  const signature = String(h[\'x-questlog-signature\'] || \'\');\n  const actual = Buffer.from(signature.slice(7), \'hex\');\n  if (!id || !/^\\d+$/.test(timestamp) || age > 300 || age < -300 || !/^sha256=[a-f0-9]{64}$/.test(signature) || actual.length !== expected.length || !timingSafeEqual(actual, expected)) { res.writeHead(401).end(); return; }\n  if (!seen.has(id)) { seen.add(id); console.log(JSON.parse(rawBody)); }\n  res.writeHead(204).end();\n}).listen(8080, \'127.0.0.1\');\n```\n'
 });
 
 // src/skills/skill_registry.ts

package/dist/{chunk-ZHTX64KD.js → chunk-IA2GVCZS.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { mkdirSync } from 'node:fs';
+import { mkdirSync, closeSync, openSync } from 'node:fs';
 import { dirname } from 'node:path';
 
 // src/hooks/init_hook_tables.ts
@@ -23,6 +23,8 @@ function initHookTables(db) {
  CREATE INDEX IF NOT EXISTS idx_hook_deliveries_target ON hook_deliveries(target_id, status, next_attempt_at);
  CREATE TABLE IF NOT EXISTS hook_settings (id INTEGER PRIMARY KEY CHECK(id = 1), label TEXT NOT NULL);
  `);
+  if (!db.prepare("PRAGMA table_info(hook_targets)").all().some((row) => row.name === "headers"))
+    db.exec("ALTER TABLE hook_targets ADD COLUMN headers TEXT NOT NULL DEFAULT '{}'");
 }
 
 // src/questlines/init_questline_tables.ts
@@ -392,7 +394,14 @@ async function openQuestlogDb(path) {
   } finally {
     process.emitWarning = original;
   }
-  if (path !== ":memory:") mkdirSync(dirname(path), { recursive: true });
+  if (path !== ":memory:") {
+    mkdirSync(dirname(path), { recursive: true, mode: 448 });
+    try {
+      closeSync(openSync(path, "wx", 384));
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+    }
+  }
   const db = new sqlite.DatabaseSync(path);
   try {
     db.exec("PRAGMA journal_mode=WAL; PRAGMA busy_timeout=5000;");