@ghostpaw/questlog 0.11.0 → 0.11.2

package/README.md

@@ -81,6 +81,9 @@ questlog list --view quests.resolved --json
 `--questline <id>`, and `--due` as YYYY-MM-DD, DD.MM.YYYY, `today`, `tomorrow`,
 `+3d`, an ISO date-time with timezone, or milliseconds since epoch. Date-only
 values use local end of day.
+`--objective` is the one flag that reads a file: `@path`, `@-` for stdin, and
+`@@text` for a literal `@text` (help marks it `(@file, @- stdin, @@ literal @)`). Every
+other value, including titles, `--outcome` and per-tool flags, is literal.
 `list` defaults to available quests; `list --help` lists all supported views.
 Its `--limit` caps text output; JSON preserves the full review tool result.
 `search --limit` caps matches in both formats. `show` prints full quest detail.
@@ -91,8 +94,8 @@ adds ISO UTC siblings for numeric timestamp fields ending in `At`.
 Commands print text by default, including hooks, delivery views and each watch tick; `call` and direct tool commands return the raw tool result as JSON. Use `--json` for the full tool result
 and `--compact` for compact JSON. `--db path` works before or after the command.
 Each command accepts `--help`. Exit codes are 0 for success, 1 for invalid input
-or a tool error, 2 for usage errors, and 3 when clarification is needed or `hook remove`/`hook test` addresses a missing target.
-Missing quests and deliveries exit 1. `hook label` names the database, not an individual target.
+or a tool error, 2 for usage errors, and 3 when clarification is needed or a quest, delivery, or hook target is not found.
+An empty `hook list` prints `No hooks` (`[]` with `--json`). Delivery text timestamps use local time; JSON retains UTC/epoch timestamps. `hook label` names the database, not an individual target.
 
 `questlog skill --short` prints the compact cheat sheet; `questlog skill --list` lists guides.
 ISO date-times without a zone (for example `2026-10-29T09:00`) use the local time zone.
@@ -163,7 +166,7 @@ irm https://raw.githubusercontent.com/GhostPawJS/questlog/main/install.ps1 | iex
 Pinned to a release:
 
 ```sh
-curl -fsSL https://raw.githubusercontent.com/GhostPawJS/questlog/main/install.sh | sh -s -- --target linux-x64 --version 0.11.0 && export PATH="$HOME/.local/bin:$PATH"
+curl -fsSL https://raw.githubusercontent.com/GhostPawJS/questlog/main/install.sh | sh -s -- --target linux-x64 --version 0.11.1 && export PATH="$HOME/.local/bin:$PATH"
 ```
 
 Also adding ~/.local/bin to ~/.profile (edits ~/.profile once; skipped if it already mentions ~/.local/bin; zsh login shells read ~/.zprofile instead, so use that file name there):
@@ -180,7 +183,7 @@ $env:GHOSTPAW_NO_MODIFY_PATH=1; irm https://raw.githubusercontent.com/GhostPawJS
 
 ```text
 $ ghostpaw-questlog --version
-questlog 0.11.0 (binary, linux-x64)
+questlog 0.11.1 (binary, linux-x64)
 ```
 
 Scripts that compare versions should use `--version --short` or `--version --json`.
@@ -550,9 +553,11 @@ Secrets and custom header values are stored in the database. On POSIX, new datab
 and their WAL/SHM siblings use mode 0600, and directories created for them use 0700.
 Existing database permissions are preserved; Windows uses its existing access controls.
 
-Add repeatable custom headers with `--header "Authorization: Bearer value"` or
-`--header-stdin` (one `Name: value` line per header, keeping values out of shell history).
-For example: `questlog hook add https://example.org/wake --header "X-Key: value"`.
+Prefer `--header-stdin` for real keys (one `Name: value` line per header), keeping
+values out of shell history and process arguments:
+`questlog hook add https://example.org/wake --header-stdin < /secure/headers.txt`.
+Keep that file private (0600 on POSIX). Repeatable `--header "Name: value"` remains
+available, but exposes values in process arguments.
 Headers accompany every delivery and test. Header names are shown with values replaced by
 `***`; values are never included in list, show, test, tick, watch, or tool output.
 Names must be HTTP tokens; `host`, `content-length`, `content-type`, and `x-questlog-*`

package/SKILL.md

@@ -35,7 +35,7 @@ Run tools as `ghostpaw-questlog ...`; use `~/.local/bin/ghostpaw-questlog` if it
 - `questlog show 12`
 - `questlog list --view quests.available`
 - Use `--json` on any plain command.
-- Exit codes: 0 ok / 1 error / 2 usage / 3 needs input or hook target not found.
+- Exit codes: 0 ok / 1 error / 2 usage / 3 needs input or item not found.
 - Database: `~/.ghostpaw/questlog.db`; override with `--db` or `GHOSTPAW_QUESTLOG_DB`.
 - Use one database per project.
 - `questlog --version` prints the installed version.

package/dist/{chunk-QK3H2AL5.js → chunk-DDMYHMXY.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 // src/surfaces/text_output.ts
-var isTime = (key, value) => typeof value === "number" && value > 1e12 && /(At|Wake)$/.test(key);
+var isTime = (key, value) => /(At|Wake)$/.test(key) && (typeof value === "number" || typeof value === "string" && /^\d{4}-\d{2}-\d{2}T/.test(value)) && Number.isFinite(new Date(value).getTime());
 function scalar(key, value) {
   if (value == null || value === "") return "-";
-  if (isTime(key, value)) return new Date(value).toISOString();
+  if (isTime(key, value)) return new Date(value).toLocaleString("en-GB", { timeZoneName: "short" });
   return String(value).replace(/[\r\n]+/g, " ");
 }
 function lines(value, indent, key = "") {

package/dist/{chunk-KOWIVBG6.js → chunk-FCHLDYAR.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { tickQuestlog, removeHook, listDueRepeatableQuestAnchors, getRepeatableQuestOrThrow, spawnDueRepeatableQuests, deriveQuestState, deriveQuestMarkerId, queryQuestDetailRecords, resolveNow, withTransaction, getQuestOrThrow, parseRRule, mapQuestRewardRow, normalizeTagName } from './chunk-RBGQK5WP.js';
+import { tickQuestlog, removeHook, listDueRepeatableQuestAnchors, getRepeatableQuestOrThrow, spawnDueRepeatableQuests, deriveQuestState, deriveQuestMarkerId, queryQuestDetailRecords, resolveNow, withTransaction, getQuestOrThrow, parseRRule, mapQuestRewardRow, normalizeTagName } from './chunk-S5EP3A3L.js';
 import { listDeliveries } from './chunk-D6EGZCT7.js';
 import { listHooks } from './chunk-NBCCA6AX.js';
 import { registerSchemaActions, minimalInput, requiredForAction } from './chunk-QYSIJ2YN.js';
@@ -591,6 +591,7 @@ function listRumors(db) {
 // src/surfaces/validate_input.ts
 function validateInput(schema, input, path = "$") {
   const errors = [];
+  const received = `; received ${JSON.stringify(input)}`;
   const matchesType = (type) => {
     switch (type) {
       case "object":
@@ -608,13 +609,13 @@ function validateInput(schema, input, path = "$") {
     }
   };
   if (schema.type && !(Array.isArray(schema.type) ? schema.type : [schema.type]).some(matchesType)) {
-    return [`${path}: expected ${String(schema.type)}`];
+    return [`${path}: expected ${schema.type}${received}`];
   }
   if (schema.enum && !schema.enum.some((value) => JSON.stringify(value) === JSON.stringify(input)))
-    errors.push(`${path}: expected one of ${JSON.stringify(schema.enum)}`);
+    errors.push(`${path}: expected one of ${JSON.stringify(schema.enum)}${received}`);
   const constant = "const" in schema ? schema.const : void 0;
   if (constant !== void 0 && constant !== input)
-    errors.push(`${path}: expected ${JSON.stringify(constant)}`);
+    errors.push(`${path}: expected ${JSON.stringify(constant)}${received}`);
   if (schema.oneOf) {
     const branches = schema.oneOf.map((branch) => validateInput(branch, input, path));
     if (!branches.some((errors2) => errors2.length === 0)) {
@@ -625,7 +626,7 @@ function validateInput(schema, input, path = "$") {
       );
     }
   }
-  if (typeof input === "object" && input !== null && !Array.isArray(input)) {
+  if (matchesType("object")) {
     const record = input;
     for (const name of [...schema.required ?? [], ...requiredForAction(schema, record.action)])
       if (!Object.hasOwn(record, name)) errors.push(`${path}.${name}: required`);

package/dist/{chunk-GVD6A3RR.js → chunk-M3WAPFGB.js}

@@ -4,20 +4,26 @@ import { readFileSync } from 'node:fs';
 var CliUsageError = class extends Error {
   exitCode = 2;
 };
+function readFileValue(raw, name) {
+  if (!raw.startsWith("@")) return raw;
+  if (raw.startsWith("@@")) return raw.slice(1);
+  const path = raw.slice(1);
+  if (!path) throw new CliUsageError(`Empty file path for ${name}; use @@ for a literal leading @`);
+  try {
+    return readFileSync(path === "-" ? 0 : path, "utf8");
+  } catch {
+    throw new CliUsageError(
+      `Cannot read value file for ${name}: ${path} (use @@ for a literal leading @)`
+    );
+  }
+}
 var keyOf = (name) => name.replace(/-([a-z])/g, (_, c) => c.toUpperCase());
 function parseCliArgs(argv, spec) {
   const values = {};
   const positions = [];
   const flags = spec.flags ?? [];
   const convert = (raw, arg) => {
-    let value = raw;
-    if (raw.startsWith("@")) {
-      try {
-        value = readFileSync(raw.slice(1), "utf8");
-      } catch {
-        throw new CliUsageError(`Cannot read value file: ${raw.slice(1)}`);
-      }
-    }
+    const value = arg.file ? readFileValue(raw, arg.name) : raw;
     let result = value;
     if (arg.type === "number" || arg.type === "integer") {
       result = Number(value);
@@ -25,17 +31,19 @@ function parseCliArgs(argv, spec) {
         throw new CliUsageError(`Expected ${arg.type} for ${arg.name}: ${value}`);
     } else if (arg.type === "boolean") {
       if (!["true", "false"].includes(value))
-        throw new CliUsageError(`Expected boolean for ${arg.name}`);
+        throw new CliUsageError(`Expected boolean for ${arg.name}: ${value}`);
       result = value === "true";
     } else if (arg.type === "json") {
       try {
         result = JSON.parse(value);
       } catch {
-        throw new CliUsageError(`Invalid JSON for ${arg.name}`);
+        throw new CliUsageError(`Invalid JSON for ${arg.name}: ${value}`);
       }
     }
     if (arg.enum && !arg.enum.includes(result))
-      throw new CliUsageError(`${arg.name} must be one of: ${arg.enum.join(", ")}`);
+      throw new CliUsageError(
+        `${arg.name} ${JSON.stringify(value)} must be one of: ${arg.enum.join(", ")}`
+      );
     return result;
   };
   let ended = false;
@@ -94,7 +102,7 @@ function parseCliArgs(argv, spec) {
   return values;
 }
 function renderCliHelp(spec) {
-  const describe = (arg) => `${arg.type}${arg.enum ? ` (${arg.enum.join("|")})` : ""}${arg.required ? " required" : ""}  ${arg.description ?? ""}`;
+  const describe = (arg) => `${arg.type}${arg.enum ? ` (${arg.enum.join("|")})` : ""}${arg.required ? " required" : ""}${arg.file ? " (@file, @- stdin, @@ literal @)" : ""}  ${arg.description ?? ""}`;
   return `Usage: ${spec.command} ${(spec.positionals ?? []).map((arg) => `<${arg.name}${arg.variadic ? "..." : ""}>`).join(" ")} [flags]
 ${spec.description ?? ""}
 

package/dist/{chunk-I2AMIXGP.js → chunk-PQAQZUCH.js}

@@ -728,7 +728,7 @@ Failure handling:
 var webhooksSkill = defineQuestlogSkill({
   name: "webhooks",
   description: "Configure signed outbound event webhooks and verify deliveries.",
-  content: '# Webhooks\n\nUse `questlog` to configure opt-in outbound automation. No server or scheduler is added.\nNo targets means no network calls. `manage_hooks` supports list, remove, tick with\n`dry_run`, and deliveries; add/test are CLI-only. `review_questlog` view `deliveries`\nand `questlog show <id>` expose pending/failed deliveries.\n\n```sh\nquestlog hook add https://example.org/wake --min-gap 60\nquestlog hook add https://example.org/team --tag work --events quest.due,quest.overdue --secret-stdin\nquestlog hook label work\nquestlog hook list\nquestlog tick --dry-run\nquestlog tick\nquestlog watch --interval 60\nquestlog hook test 1\nquestlog review deliveries\nquestlog show 12\nquestlog hook remove 1\n```\n\n`hook add` prints its random 32-byte signing secret once, also as `secret` in `--json`.\nSave it securely. `--secret-stdin` supplies one via stdin; there is no secret flag.\nSecrets and custom header values are stored in the DB. New POSIX DB/WAL/SHM files use 0600 and created directories use 0700; existing DB modes are preserved. Windows uses existing access controls.\nUse repeatable `--header "Name: value"` or `--header-stdin` (one line per header, avoiding shell history). Headers are sent on every delivery and test; output shows names with `***` values. HTTP token names are required; host, content-length, content-type, and x-questlog-* are reserved. Change headers by removing and adding the hook again. Use --header-stdin and --secret-stdin separately. URL userinfo is rejected; use a custom header or query key.\n`questlog show d_\u2026` displays delivery status, attempts, HTTP status, next attempt, redacted target URL and event ids. Text is the default; --json prints JSON. Missing hook remove/test targets exit 3; missing quests/deliveries exit 1. hook label names the database.\nList output redacts userinfo/query strings. Removal deletes the target and deliveries.\nDefault scope is the database; `--tag` matches quest tags, never rumors.\n`--events` defaults to all types. The DB label defaults to the filename without its\npath/extension (`questlog` in memory); set it to a name suitable for disclosure.\n\n```cron\n* * * * * questlog tick\n```\n\nCron\'s PATH may need `$HOME/.local/bin/questlog tick --db /path/to/quests.db`.\nWatch defaults to 60 seconds (minimum 5); SIGINT/SIGTERM finishes the current tick.\nTick exits 0 even when deliveries need retries. Dry-run records nothing and sends nothing.\n\nEvents are detected from the model at tick time:\n\n- `quest.due`: an unresolved, undeleted quest reaches its effective due time (own `due_at`, otherwise its undeleted questline\'s due time).\n- `quest.overdue`: that effective deadline is strictly earlier than now and the quest remains unresolved.\n- `quest.unblocked`: an unresolved quest is available, all active prerequisites have succeeded or been deleted, and at least one prerequisite succeeded after its unlock was installed. Occurrence time is the latest active prerequisite success or not-before time, whichever is later.\n- `repeatable.spawned`: a concrete repeatable instance was created; occurrence time is its creation time. Tick first materializes due anchors through the existing spawn operation.\n- `rumor.captured`: an undeleted rumor was created; occurrence time is its creation time, even if subsequently settled or dismissed.\n\nPersistent event keys contain type, entity ids, and occurrence time. Restarts and repeated\nticks do not repeat occurrences. Removed transitions between ticks cannot be reconstructed.\nOnly occurrences at/after target creation are assigned; tags are evaluated at assignment.\nTick materializes due repeatables using the existing spawn path, including during preview\nwith rollback. Batches contain only ids, event types, timestamps, and the DB label:\n\n```json\n{"type":"questlog.events","db":"work","deliveryId":"d_\u2026","sentAt":"2026-10-28T10:00:00.000Z","events":[{"id":"e_\u2026","type":"quest.due","questId":12,"occurredAt":"2026-10-28T09:59:00.000Z"}]}\n```\n\nHeaders are `content-type: application/json`, `user-agent: questlog/<version>`,\n`x-questlog-delivery: <deliveryId>`, `x-questlog-timestamp: <unix seconds>`, and\n`x-questlog-signature: sha256=<hex HMAC-SHA256(secret, timestamp + "." + rawBody)>`.\nNo titles, objectives, details, or tag text are sent. `hook test` sends a logged `hook.test`\nevent immediately, ignoring the min gap. Add and test are CLI-only in the tool facade;\n`manage_hooks` supports list, remove, tick (with `dry_run`), and deliveries.\n\n2xx delivers. Timeout is 5 seconds. Failures retry after 30 s, 1 m, 2 m, 4 m, doubling\nto 1 h plus <1 s jitter, subject to the target\'s min gap. Eight failures mark failed.\nRetries keep the delivery id/events; new events queue behind them. Keep the last 500\ndelivered log entries per target and all pending/failed entries. Transactional claims\nlease work for two minutes. A crash after receipt may retry: dedupe at the receiver.\n\n### Verifying a delivery\n\nCompute HMAC-SHA256 over `timestamp + "." + rawBody` with the secret and compare in constant\ntime. Reject timestamps older than 5 minutes (and timestamps too far in the future), then\ndedupe on `x-questlog-delivery`. Use durable deduplication storage in a production receiver.\nThis 15-line Node example uses an in-memory set:\n\n```js\nimport { createHmac, timingSafeEqual } from \'node:crypto\';\nimport { createServer } from \'node:http\';\nconst secret = process.env.WEBHOOK_SECRET, seen = new Set();\ncreateServer(async (req, res) => {\n  const chunks = []; for await (const chunk of req) chunks.push(chunk);\n  const rawBody = Buffer.concat(chunks), h = req.headers;\n  const timestamp = h[\'x-questlog-timestamp\'], id = h[\'x-questlog-delivery\'];\n  const age = Date.now() / 1000 - Number(timestamp);\n  const expected = createHmac(\'sha256\', secret).update(timestamp + \'.\').update(rawBody).digest();\n  const signature = String(h[\'x-questlog-signature\'] || \'\');\n  const actual = Buffer.from(signature.slice(7), \'hex\');\n  if (!id || !/^\\d+$/.test(timestamp) || age > 300 || age < -300 || !/^sha256=[a-f0-9]{64}$/.test(signature) || actual.length !== expected.length || !timingSafeEqual(actual, expected)) { res.writeHead(401).end(); return; }\n  if (!seen.has(id)) { seen.add(id); console.log(JSON.parse(rawBody)); }\n  res.writeHead(204).end();\n}).listen(8080, \'127.0.0.1\');\n```\n'
+  content: '# Webhooks\n\nUse `questlog` to configure opt-in outbound automation. No targets means no network calls. `manage_hooks` supports list, remove, tick with\n`dry_run`, and deliveries; add/test are CLI-only. `review_questlog` view `deliveries`\nand `questlog show <id>` expose pending/failed deliveries.\n\n```sh\nquestlog hook add https://example.org/wake --min-gap 60\nquestlog hook add https://example.org/team --tag work --events quest.due,quest.overdue --secret-stdin\nquestlog hook label work\nquestlog hook list\nquestlog tick --dry-run\nquestlog tick\nquestlog watch --interval 60\nquestlog hook test 1\nquestlog review deliveries\nquestlog show 12\nquestlog hook remove 1\n```\n\n`hook add` prints its random 32-byte signing secret once, also as `secret` in `--json`.\nSave it securely. `--secret-stdin` supplies one via stdin; there is no secret flag.\nSecrets/headers are stored in the DB. New POSIX DB/WAL/SHM files use 0600; new directories use 0700. Existing modes and Windows access controls are preserved.\nPrefer `--header-stdin` for real keys (one Name: value per line); use a private 0600 file. Repeatable `--header` exposes values in process arguments and shell history. Output redacts values as `***`. host, content-length, content-type and x-questlog-* are reserved. To change headers, remove/add the hook. Use --header-stdin and --secret-stdin separately. URL userinfo is rejected.\n`show d_\u2026` displays delivery attempts, HTTP status, next attempt, redacted target and event ids. Text timestamps are local; --json keeps UTC/epoch times. Missing hook remove/test targets exit 3; missing quests/deliveries also exit 3. Empty hook lists print `No hooks`. hook label names the database.\nList output redacts userinfo/query strings. Removal deletes the target and deliveries.\nDefault scope is the DB; `--tag` matches quest tags only.\n`--events` defaults to all types. The DB label defaults to the filename without its\npath/extension (`questlog` in memory); set it to a name suitable for disclosure.\n\n```cron\n* * * * * questlog tick\n```\n\nCron may need `$HOME/.local/bin/questlog tick --db /path/to/quests.db`.\nWatch defaults to 60 s (minimum 5); SIGINT/SIGTERM finishes the tick.\nTick exits 0 even when deliveries need retries. Dry-run records nothing and sends nothing.\n\nEvents are detected from the model at tick time:\n\n- `quest.due`: an unresolved, undeleted quest reaches its effective due time (own `due_at`, otherwise its undeleted questline\'s due time).\n- `quest.overdue`: that effective deadline is strictly earlier than now and the quest remains unresolved.\n- `quest.unblocked`: an unresolved quest is available, all active prerequisites have succeeded or been deleted, and at least one prerequisite succeeded after its unlock was installed. Occurrence time is the latest active prerequisite success or not-before time, whichever is later.\n- `repeatable.spawned`: a concrete repeatable instance was created; occurrence time is its creation time. Tick first materializes due anchors through the existing spawn operation.\n- `rumor.captured`: an undeleted rumor was created; occurrence time is its creation time, even if subsequently settled or dismissed.\n\nEvent keys include type, entity ids and occurrence time, preventing repeats across restarts. Transitions removed between ticks cannot be reconstructed.\nOnly events at/after target creation are assigned; tags are checked then.\nTick materializes due repeatables using the existing spawn path, including during preview\nwith rollback. Batches contain only ids, event types, timestamps, and the DB label:\n\n```json\n{"type":"questlog.events","db":"work","deliveryId":"d_\u2026","sentAt":"2026-10-28T10:00:00.000Z","events":[{"id":"e_\u2026","type":"quest.due","questId":12,"occurredAt":"2026-10-28T09:59:00.000Z"}]}\n```\n\nHeaders are `content-type: application/json`, `user-agent: questlog/<version>`,\n`x-questlog-delivery: <deliveryId>`, `x-questlog-timestamp: <unix seconds>`, and\n`x-questlog-signature: sha256=<hex HMAC-SHA256(secret, timestamp + "." + rawBody)>`.\nNo titles, objectives, details, or tag text are sent. `hook test` sends a logged `hook.test`\nevent immediately, ignoring the min gap. Add and test are CLI-only in the tool facade;\n`manage_hooks` supports list, remove, tick (with `dry_run`), and deliveries.\n\n2xx delivers. Timeout is 5 seconds. Failures retry after 30 s, 1 m, 2 m, 4 m, doubling\nto 1 h plus <1 s jitter, subject to the target\'s min gap. Eight failures mark failed.\nRetries keep the delivery id/events; new events queue behind them. Keep the last 500\ndelivered log entries per target and all pending/failed entries. Claims lease work for two minutes. Dedupe retries at the receiver.\n\n### Verifying a delivery\n\nCompute HMAC-SHA256 over `timestamp + "." + rawBody` with the secret and compare in constant\ntime. Reject timestamps older than 5 minutes (and timestamps too far in the future), then\ndedupe on `x-questlog-delivery`. Use durable deduplication in production; this example uses an in-memory set:\n\n```js\nimport { createHmac, timingSafeEqual } from \'node:crypto\';\nimport { createServer } from \'node:http\';\nconst secret = process.env.WEBHOOK_SECRET, seen = new Set();\ncreateServer(async (req, res) => {\n  const chunks = []; for await (const chunk of req) chunks.push(chunk);\n  const rawBody = Buffer.concat(chunks), h = req.headers;\n  const timestamp = h[\'x-questlog-timestamp\'], id = h[\'x-questlog-delivery\'];\n  const age = Date.now() / 1000 - Number(timestamp);\n  const expected = createHmac(\'sha256\', secret).update(timestamp + \'.\').update(rawBody).digest();\n  const signature = String(h[\'x-questlog-signature\'] || \'\');\n  const actual = Buffer.from(signature.slice(7), \'hex\');\n  if (!id || !/^\\d+$/.test(timestamp) || age > 300 || age < -300 || !/^sha256=[a-f0-9]{64}$/.test(signature) || actual.length !== expected.length || !timingSafeEqual(actual, expected)) { res.writeHead(401).end(); return; }\n  if (!seen.has(id)) { seen.add(id); console.log(JSON.parse(rawBody)); }\n  res.writeHead(204).end();\n}).listen(8080, \'127.0.0.1\');\n```\n'
 });
 
 // src/skills/skill_registry.ts

package/dist/{chunk-RBGQK5WP.js → chunk-S5EP3A3L.js}

@@ -69,14 +69,14 @@ function addHook(db, input) {
     );
   const minGap = input.minGap ?? 60;
   if (!Number.isSafeInteger(minGap) || minGap < 0)
-    throw new Error("Min gap must be a nonnegative integer");
+    throw new Error(`Min gap ${minGap} must be a nonnegative integer`);
   const events = input.events ?? [...hookEventTypes];
   if (!events.length || events.some((e) => !hookEventTypes.includes(e)))
     throw new Error(
       `unknown event ${events.find((e) => !hookEventTypes.includes(e)) ?? "(empty)"}; valid: ${hookEventTypes.join(", ")}`
     );
   if (input.tag !== void 0 && !normalizeTagName(input.tag))
-    throw new Error("Expected a tag name");
+    throw new Error(`Expected a tag name: ${JSON.stringify(input.tag)}`);
   const secret = input.secret ?? randomBytes(32).toString("hex");
   if (!secret.trim()) throw new Error("Expected a nonempty signing secret");
   const result = db.prepare(
@@ -116,7 +116,7 @@ function removeHook(db, id) {
 }
 
 // src/version.ts
-var questlogVersion = "0.11.0";
+var questlogVersion = "0.11.2";
 
 // src/hooks/send_hook_delivery.ts
 async function sendHookDelivery(db, delivery, target, options) {

package/dist/cli.js

@@ -13,5 +13,5 @@ function checkNodeVersion(version, stderr) {
 if (!checkNodeVersion(process.versions.node, process.stderr)) {
   process.exitCode = 2;
 } else {
-  await import('./cli_main-TEG3QTDP.js');
+  await import('./cli_main-KHRJVLLC.js');
 }

package/dist/{cli_main-TEG3QTDP.js → cli_main-KHRJVLLC.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { questlogSkills } from './chunk-I2AMIXGP.js';
-import { CliUsageError, renderCliHelp, parseCliArgs } from './chunk-GVD6A3RR.js';
+import { questlogSkills } from './chunk-PQAQZUCH.js';
+import { CliUsageError, renderCliHelp, parseCliArgs } from './chunk-M3WAPFGB.js';
 import { isErrorResult, resolveQuestlogDbPath } from './chunk-IL2QRKZL.js';
-import { reviewQuestlogTool, validateInput, getQuestDetail, questlogSurfaceTools } from './chunk-KOWIVBG6.js';
-import { questlogVersion } from './chunk-RBGQK5WP.js';
+import { reviewQuestlogTool, validateInput, getQuestDetail, questlogSurfaceTools } from './chunk-FCHLDYAR.js';
+import { questlogVersion } from './chunk-S5EP3A3L.js';
 import { listDeliveries } from './chunk-D6EGZCT7.js';
 import './chunk-NBCCA6AX.js';
 import { schemaRows } from './chunk-7KTRNXTU.js';
@@ -119,7 +119,7 @@ Missing: ${r.clarification.missing.map((name) => `--${name}`).join(", ")}
 ${r.error.message}
 `;
   if (r.data.deliveries && !r.data.item)
-    return `${r.data.deliveries.map((d) => `${d.id} target ${d.targetId} ${d.status} attempts ${d.attempts} HTTP ${d.httpStatus ?? "-"} next ${new Date(d.nextAttemptAt).toISOString()} events ${d.events.map((e) => e.id).join(", ")}`).join("\n") || "No deliveries"}
+    return `${r.data.deliveries.map((d) => `${d.id} target ${d.targetId} ${d.status} attempts ${d.attempts} HTTP ${d.httpStatus ?? "-"} next ${formatPlainDate(d.nextAttemptAt, true)} events ${d.events.map((e) => e.id).join(", ")}`).join("\n") || "No deliveries"}
 `;
   if (r.data.items) {
     const items = values.limit === void 0 ? r.data.items : r.data.items.slice(0, Math.max(0, Number(values.limit)));
@@ -209,7 +209,12 @@ ${values.dryRun ? `${JSON.stringify({ events: d.events, batches: d.batches }, nu
         flags: [
           { name: "title", type: "string" },
           { name: "tag", type: "array" },
-          { name: "objective", type: "string" },
+          {
+            name: "objective",
+            type: "string",
+            file: true,
+            description: "Quest objective text; defaults to the title."
+          },
           {
             name: "due",
             type: "string",
@@ -302,7 +307,7 @@ ${values.dryRun ? `${JSON.stringify({ events: d.events, batches: d.batches }, nu
     spec: { ...command.spec, flags: [...command.spec.flags ?? [], json] },
     input: (values) => {
       if (values.limit !== void 0 && Number(values.limit) < 1)
-        throw new Error("Limit must be at least 1");
+        throw new Error(`Limit ${values.limit} must be at least 1`);
       return command.input(values);
     }
   }));
@@ -337,7 +342,7 @@ Use --db <path> or GHOSTPAW_QUESTLOG_DB to override the default ~/.ghostpaw/ques
       if (command === "show" && args[0]?.startsWith("d_")) {
         const { listDeliveries: listDeliveries2 } = await import('./list_deliveries-WJEJUZIQ.js');
         const { listHooks } = await import('./list_hooks-C5CAA2C7.js');
-        const { textOutput } = await import('./text_output-X7F3K23Q.js');
+        const { textOutput } = await import('./text_output-U55ZUZX4.js');
         if (args.includes("--help") || args.includes("-h")) {
           io.stdout.write("questlog show <delivery-id> [--json]\n");
           return 0;
@@ -351,7 +356,7 @@ Use --db <path> or GHOSTPAW_QUESTLOG_DB to override the default ~/.ghostpaw/ques
           if (!delivery) {
             io.stderr.write(`Delivery ${args[0]} not found
 `);
-            return 1;
+            return 3;
           }
           const target = listHooks(db).find((h) => h.id === delivery.targetId);
           const result = {
@@ -369,7 +374,7 @@ Use --db <path> or GHOSTPAW_QUESTLOG_DB to override the default ~/.ghostpaw/ques
         }
       }
       if (command !== "hook" && command !== "watch") return void 0;
-      const { runHookCommand } = await import('./run_hook_command-BOENYNDT.js');
+      const { runHookCommand } = await import('./run_hook_command-H4J6S5DZ.js');
       return runHookCommand(command, args, io, async () => {
         const { openQuestlogDb } = await import('./open_questlog_db-6NS6BVBC.js');
         return openQuestlogDb(selectedDbPath(options));
@@ -378,12 +383,12 @@ Use --db <path> or GHOSTPAW_QUESTLOG_DB to override the default ~/.ghostpaw/ques
     plain: questlogPlainCommands(),
     guides: questlogSkills,
     mcp: async (options) => {
-      const { serveQuestlogMcp } = await import('./serve_questlog_mcp-X524X34F.js');
+      const { serveQuestlogMcp } = await import('./serve_questlog_mcp-3UGYRARA.js');
       await serveQuestlogMcp(options.db === void 0 ? {} : { dbPath: options.db });
     },
     skill: async () => {
       const { renderSkillMarkdown } = await import('./skill_markdown-EGKYZ3W2.js');
-      const { questlogSkillSpec } = await import('./questlog_skill_spec-ILTCTRYS.js');
+      const { questlogSkillSpec } = await import('./questlog_skill_spec-4U36GV6W.js');
       return renderSkillMarkdown(questlogSkillSpec);
     }
   }
@@ -625,7 +630,8 @@ ${JSON.stringify(tool.inputSchema, null, 2)}
       const coerce = (value, schema) => {
         if (schema.type === "number" || schema.type === "integer") return Number(value);
         if (schema.type === "boolean") {
-          if (!["true", "false"].includes(value)) throw new Error("Expected true or false");
+          if (!["true", "false"].includes(value))
+            throw new Error(`Expected true or false: ${value}`);
           return value === "true";
         }
         if (schema.type === "object" || schema.type === "array") return JSON.parse(value);
@@ -686,7 +692,11 @@ ${JSON.stringify(tool.inputSchema, null, 2)}
     );
     if (typeof result === "object" && result !== null && "outcome" in result && result.outcome === "needs_clarification")
       return 3;
-    return isErrorResult(result) ? 1 : 0;
+    if (isErrorResult(result)) {
+      const error = result.error;
+      return error?.code === "not_found" ? 3 : 1;
+    }
+    return 0;
   } catch (cause) {
     return fail(String(cause), 1);
   } finally {

package/dist/index.cjs

@@ -53,14 +53,14 @@ function addHook(db, input) {
     );
   const minGap = input.minGap ?? 60;
   if (!Number.isSafeInteger(minGap) || minGap < 0)
-    throw new Error("Min gap must be a nonnegative integer");
+    throw new Error(`Min gap ${minGap} must be a nonnegative integer`);
   const events = input.events ?? [...hookEventTypes];
   if (!events.length || events.some((e) => !hookEventTypes.includes(e)))
     throw new Error(
       `unknown event ${events.find((e) => !hookEventTypes.includes(e)) ?? "(empty)"}; valid: ${hookEventTypes.join(", ")}`
     );
   if (input.tag !== void 0 && !normalizeTagName(input.tag))
-    throw new Error("Expected a tag name");
+    throw new Error(`Expected a tag name: ${JSON.stringify(input.tag)}`);
   const secret = input.secret ?? node_crypto.randomBytes(32).toString("hex");
   if (!secret.trim()) throw new Error("Expected a nonempty signing secret");
   const result = db.prepare(
@@ -185,7 +185,7 @@ function removeHook(db, id) {
 }
 
 // src/version.ts
-var questlogVersion = "0.11.0";
+var questlogVersion = "0.11.2";
 
 // src/hooks/send_hook_delivery.ts
 async function sendHookDelivery(db, delivery, target, options) {
@@ -3317,7 +3317,7 @@ Failure handling:
 var webhooksSkill = defineQuestlogSkill({
   name: "webhooks",
   description: "Configure signed outbound event webhooks and verify deliveries.",
-  content: '# Webhooks\n\nUse `questlog` to configure opt-in outbound automation. No server or scheduler is added.\nNo targets means no network calls. `manage_hooks` supports list, remove, tick with\n`dry_run`, and deliveries; add/test are CLI-only. `review_questlog` view `deliveries`\nand `questlog show <id>` expose pending/failed deliveries.\n\n```sh\nquestlog hook add https://example.org/wake --min-gap 60\nquestlog hook add https://example.org/team --tag work --events quest.due,quest.overdue --secret-stdin\nquestlog hook label work\nquestlog hook list\nquestlog tick --dry-run\nquestlog tick\nquestlog watch --interval 60\nquestlog hook test 1\nquestlog review deliveries\nquestlog show 12\nquestlog hook remove 1\n```\n\n`hook add` prints its random 32-byte signing secret once, also as `secret` in `--json`.\nSave it securely. `--secret-stdin` supplies one via stdin; there is no secret flag.\nSecrets and custom header values are stored in the DB. New POSIX DB/WAL/SHM files use 0600 and created directories use 0700; existing DB modes are preserved. Windows uses existing access controls.\nUse repeatable `--header "Name: value"` or `--header-stdin` (one line per header, avoiding shell history). Headers are sent on every delivery and test; output shows names with `***` values. HTTP token names are required; host, content-length, content-type, and x-questlog-* are reserved. Change headers by removing and adding the hook again. Use --header-stdin and --secret-stdin separately. URL userinfo is rejected; use a custom header or query key.\n`questlog show d_\u2026` displays delivery status, attempts, HTTP status, next attempt, redacted target URL and event ids. Text is the default; --json prints JSON. Missing hook remove/test targets exit 3; missing quests/deliveries exit 1. hook label names the database.\nList output redacts userinfo/query strings. Removal deletes the target and deliveries.\nDefault scope is the database; `--tag` matches quest tags, never rumors.\n`--events` defaults to all types. The DB label defaults to the filename without its\npath/extension (`questlog` in memory); set it to a name suitable for disclosure.\n\n```cron\n* * * * * questlog tick\n```\n\nCron\'s PATH may need `$HOME/.local/bin/questlog tick --db /path/to/quests.db`.\nWatch defaults to 60 seconds (minimum 5); SIGINT/SIGTERM finishes the current tick.\nTick exits 0 even when deliveries need retries. Dry-run records nothing and sends nothing.\n\nEvents are detected from the model at tick time:\n\n- `quest.due`: an unresolved, undeleted quest reaches its effective due time (own `due_at`, otherwise its undeleted questline\'s due time).\n- `quest.overdue`: that effective deadline is strictly earlier than now and the quest remains unresolved.\n- `quest.unblocked`: an unresolved quest is available, all active prerequisites have succeeded or been deleted, and at least one prerequisite succeeded after its unlock was installed. Occurrence time is the latest active prerequisite success or not-before time, whichever is later.\n- `repeatable.spawned`: a concrete repeatable instance was created; occurrence time is its creation time. Tick first materializes due anchors through the existing spawn operation.\n- `rumor.captured`: an undeleted rumor was created; occurrence time is its creation time, even if subsequently settled or dismissed.\n\nPersistent event keys contain type, entity ids, and occurrence time. Restarts and repeated\nticks do not repeat occurrences. Removed transitions between ticks cannot be reconstructed.\nOnly occurrences at/after target creation are assigned; tags are evaluated at assignment.\nTick materializes due repeatables using the existing spawn path, including during preview\nwith rollback. Batches contain only ids, event types, timestamps, and the DB label:\n\n```json\n{"type":"questlog.events","db":"work","deliveryId":"d_\u2026","sentAt":"2026-10-28T10:00:00.000Z","events":[{"id":"e_\u2026","type":"quest.due","questId":12,"occurredAt":"2026-10-28T09:59:00.000Z"}]}\n```\n\nHeaders are `content-type: application/json`, `user-agent: questlog/<version>`,\n`x-questlog-delivery: <deliveryId>`, `x-questlog-timestamp: <unix seconds>`, and\n`x-questlog-signature: sha256=<hex HMAC-SHA256(secret, timestamp + "." + rawBody)>`.\nNo titles, objectives, details, or tag text are sent. `hook test` sends a logged `hook.test`\nevent immediately, ignoring the min gap. Add and test are CLI-only in the tool facade;\n`manage_hooks` supports list, remove, tick (with `dry_run`), and deliveries.\n\n2xx delivers. Timeout is 5 seconds. Failures retry after 30 s, 1 m, 2 m, 4 m, doubling\nto 1 h plus <1 s jitter, subject to the target\'s min gap. Eight failures mark failed.\nRetries keep the delivery id/events; new events queue behind them. Keep the last 500\ndelivered log entries per target and all pending/failed entries. Transactional claims\nlease work for two minutes. A crash after receipt may retry: dedupe at the receiver.\n\n### Verifying a delivery\n\nCompute HMAC-SHA256 over `timestamp + "." + rawBody` with the secret and compare in constant\ntime. Reject timestamps older than 5 minutes (and timestamps too far in the future), then\ndedupe on `x-questlog-delivery`. Use durable deduplication storage in a production receiver.\nThis 15-line Node example uses an in-memory set:\n\n```js\nimport { createHmac, timingSafeEqual } from \'node:crypto\';\nimport { createServer } from \'node:http\';\nconst secret = process.env.WEBHOOK_SECRET, seen = new Set();\ncreateServer(async (req, res) => {\n  const chunks = []; for await (const chunk of req) chunks.push(chunk);\n  const rawBody = Buffer.concat(chunks), h = req.headers;\n  const timestamp = h[\'x-questlog-timestamp\'], id = h[\'x-questlog-delivery\'];\n  const age = Date.now() / 1000 - Number(timestamp);\n  const expected = createHmac(\'sha256\', secret).update(timestamp + \'.\').update(rawBody).digest();\n  const signature = String(h[\'x-questlog-signature\'] || \'\');\n  const actual = Buffer.from(signature.slice(7), \'hex\');\n  if (!id || !/^\\d+$/.test(timestamp) || age > 300 || age < -300 || !/^sha256=[a-f0-9]{64}$/.test(signature) || actual.length !== expected.length || !timingSafeEqual(actual, expected)) { res.writeHead(401).end(); return; }\n  if (!seen.has(id)) { seen.add(id); console.log(JSON.parse(rawBody)); }\n  res.writeHead(204).end();\n}).listen(8080, \'127.0.0.1\');\n```\n'
+  content: '# Webhooks\n\nUse `questlog` to configure opt-in outbound automation. No targets means no network calls. `manage_hooks` supports list, remove, tick with\n`dry_run`, and deliveries; add/test are CLI-only. `review_questlog` view `deliveries`\nand `questlog show <id>` expose pending/failed deliveries.\n\n```sh\nquestlog hook add https://example.org/wake --min-gap 60\nquestlog hook add https://example.org/team --tag work --events quest.due,quest.overdue --secret-stdin\nquestlog hook label work\nquestlog hook list\nquestlog tick --dry-run\nquestlog tick\nquestlog watch --interval 60\nquestlog hook test 1\nquestlog review deliveries\nquestlog show 12\nquestlog hook remove 1\n```\n\n`hook add` prints its random 32-byte signing secret once, also as `secret` in `--json`.\nSave it securely. `--secret-stdin` supplies one via stdin; there is no secret flag.\nSecrets/headers are stored in the DB. New POSIX DB/WAL/SHM files use 0600; new directories use 0700. Existing modes and Windows access controls are preserved.\nPrefer `--header-stdin` for real keys (one Name: value per line); use a private 0600 file. Repeatable `--header` exposes values in process arguments and shell history. Output redacts values as `***`. host, content-length, content-type and x-questlog-* are reserved. To change headers, remove/add the hook. Use --header-stdin and --secret-stdin separately. URL userinfo is rejected.\n`show d_\u2026` displays delivery attempts, HTTP status, next attempt, redacted target and event ids. Text timestamps are local; --json keeps UTC/epoch times. Missing hook remove/test targets exit 3; missing quests/deliveries also exit 3. Empty hook lists print `No hooks`. hook label names the database.\nList output redacts userinfo/query strings. Removal deletes the target and deliveries.\nDefault scope is the DB; `--tag` matches quest tags only.\n`--events` defaults to all types. The DB label defaults to the filename without its\npath/extension (`questlog` in memory); set it to a name suitable for disclosure.\n\n```cron\n* * * * * questlog tick\n```\n\nCron may need `$HOME/.local/bin/questlog tick --db /path/to/quests.db`.\nWatch defaults to 60 s (minimum 5); SIGINT/SIGTERM finishes the tick.\nTick exits 0 even when deliveries need retries. Dry-run records nothing and sends nothing.\n\nEvents are detected from the model at tick time:\n\n- `quest.due`: an unresolved, undeleted quest reaches its effective due time (own `due_at`, otherwise its undeleted questline\'s due time).\n- `quest.overdue`: that effective deadline is strictly earlier than now and the quest remains unresolved.\n- `quest.unblocked`: an unresolved quest is available, all active prerequisites have succeeded or been deleted, and at least one prerequisite succeeded after its unlock was installed. Occurrence time is the latest active prerequisite success or not-before time, whichever is later.\n- `repeatable.spawned`: a concrete repeatable instance was created; occurrence time is its creation time. Tick first materializes due anchors through the existing spawn operation.\n- `rumor.captured`: an undeleted rumor was created; occurrence time is its creation time, even if subsequently settled or dismissed.\n\nEvent keys include type, entity ids and occurrence time, preventing repeats across restarts. Transitions removed between ticks cannot be reconstructed.\nOnly events at/after target creation are assigned; tags are checked then.\nTick materializes due repeatables using the existing spawn path, including during preview\nwith rollback. Batches contain only ids, event types, timestamps, and the DB label:\n\n```json\n{"type":"questlog.events","db":"work","deliveryId":"d_\u2026","sentAt":"2026-10-28T10:00:00.000Z","events":[{"id":"e_\u2026","type":"quest.due","questId":12,"occurredAt":"2026-10-28T09:59:00.000Z"}]}\n```\n\nHeaders are `content-type: application/json`, `user-agent: questlog/<version>`,\n`x-questlog-delivery: <deliveryId>`, `x-questlog-timestamp: <unix seconds>`, and\n`x-questlog-signature: sha256=<hex HMAC-SHA256(secret, timestamp + "." + rawBody)>`.\nNo titles, objectives, details, or tag text are sent. `hook test` sends a logged `hook.test`\nevent immediately, ignoring the min gap. Add and test are CLI-only in the tool facade;\n`manage_hooks` supports list, remove, tick (with `dry_run`), and deliveries.\n\n2xx delivers. Timeout is 5 seconds. Failures retry after 30 s, 1 m, 2 m, 4 m, doubling\nto 1 h plus <1 s jitter, subject to the target\'s min gap. Eight failures mark failed.\nRetries keep the delivery id/events; new events queue behind them. Keep the last 500\ndelivered log entries per target and all pending/failed entries. Claims lease work for two minutes. Dedupe retries at the receiver.\n\n### Verifying a delivery\n\nCompute HMAC-SHA256 over `timestamp + "." + rawBody` with the secret and compare in constant\ntime. Reject timestamps older than 5 minutes (and timestamps too far in the future), then\ndedupe on `x-questlog-delivery`. Use durable deduplication in production; this example uses an in-memory set:\n\n```js\nimport { createHmac, timingSafeEqual } from \'node:crypto\';\nimport { createServer } from \'node:http\';\nconst secret = process.env.WEBHOOK_SECRET, seen = new Set();\ncreateServer(async (req, res) => {\n  const chunks = []; for await (const chunk of req) chunks.push(chunk);\n  const rawBody = Buffer.concat(chunks), h = req.headers;\n  const timestamp = h[\'x-questlog-timestamp\'], id = h[\'x-questlog-delivery\'];\n  const age = Date.now() / 1000 - Number(timestamp);\n  const expected = createHmac(\'sha256\', secret).update(timestamp + \'.\').update(rawBody).digest();\n  const signature = String(h[\'x-questlog-signature\'] || \'\');\n  const actual = Buffer.from(signature.slice(7), \'hex\');\n  if (!id || !/^\\d+$/.test(timestamp) || age > 300 || age < -300 || !/^sha256=[a-f0-9]{64}$/.test(signature) || actual.length !== expected.length || !timingSafeEqual(actual, expected)) { res.writeHead(401).end(); return; }\n  if (!seen.has(id)) { seen.add(id); console.log(JSON.parse(rawBody)); }\n  res.writeHead(204).end();\n}).listen(8080, \'127.0.0.1\');\n```\n'
 });
 
 // src/skills/skill_registry.ts
@@ -3691,6 +3691,7 @@ function minimalInput(schema, action, name = "") {
 // src/surfaces/validate_input.ts
 function validateInput(schema, input, path = "$") {
   const errors = [];
+  const received = `; received ${JSON.stringify(input)}`;
   const matchesType = (type) => {
     switch (type) {
       case "object":
@@ -3708,13 +3709,13 @@ function validateInput(schema, input, path = "$") {
     }
   };
   if (schema.type && !(Array.isArray(schema.type) ? schema.type : [schema.type]).some(matchesType)) {
-    return [`${path}: expected ${String(schema.type)}`];
+    return [`${path}: expected ${schema.type}${received}`];
   }
   if (schema.enum && !schema.enum.some((value) => JSON.stringify(value) === JSON.stringify(input)))
-    errors.push(`${path}: expected one of ${JSON.stringify(schema.enum)}`);
+    errors.push(`${path}: expected one of ${JSON.stringify(schema.enum)}${received}`);
   const constant = "const" in schema ? schema.const : void 0;
   if (constant !== void 0 && constant !== input)
-    errors.push(`${path}: expected ${JSON.stringify(constant)}`);
+    errors.push(`${path}: expected ${JSON.stringify(constant)}${received}`);
   if (schema.oneOf) {
     const branches = schema.oneOf.map((branch) => validateInput(branch, input, path));
     if (!branches.some((errors2) => errors2.length === 0)) {
@@ -3725,7 +3726,7 @@ function validateInput(schema, input, path = "$") {
       );
     }
   }
-  if (typeof input === "object" && input !== null && !Array.isArray(input)) {
+  if (matchesType("object")) {
     const record = input;
     for (const name of [...schema.required ?? [], ...requiredForAction(schema, record.action)])
       if (!Object.hasOwn(record, name)) errors.push(`${path}.${name}: required`);

package/dist/index.js

@@ -51,14 +51,14 @@ function addHook(db, input) {
     );
   const minGap = input.minGap ?? 60;
   if (!Number.isSafeInteger(minGap) || minGap < 0)
-    throw new Error("Min gap must be a nonnegative integer");
+    throw new Error(`Min gap ${minGap} must be a nonnegative integer`);
   const events = input.events ?? [...hookEventTypes];
   if (!events.length || events.some((e) => !hookEventTypes.includes(e)))
     throw new Error(
       `unknown event ${events.find((e) => !hookEventTypes.includes(e)) ?? "(empty)"}; valid: ${hookEventTypes.join(", ")}`
     );
   if (input.tag !== void 0 && !normalizeTagName(input.tag))
-    throw new Error("Expected a tag name");
+    throw new Error(`Expected a tag name: ${JSON.stringify(input.tag)}`);
   const secret = input.secret ?? randomBytes(32).toString("hex");
   if (!secret.trim()) throw new Error("Expected a nonempty signing secret");
   const result = db.prepare(
@@ -183,7 +183,7 @@ function removeHook(db, id) {
 }
 
 // src/version.ts
-var questlogVersion = "0.11.0";
+var questlogVersion = "0.11.2";
 
 // src/hooks/send_hook_delivery.ts
 async function sendHookDelivery(db, delivery, target, options) {
@@ -3315,7 +3315,7 @@ Failure handling:
 var webhooksSkill = defineQuestlogSkill({
   name: "webhooks",
   description: "Configure signed outbound event webhooks and verify deliveries.",
-  content: '# Webhooks\n\nUse `questlog` to configure opt-in outbound automation. No server or scheduler is added.\nNo targets means no network calls. `manage_hooks` supports list, remove, tick with\n`dry_run`, and deliveries; add/test are CLI-only. `review_questlog` view `deliveries`\nand `questlog show <id>` expose pending/failed deliveries.\n\n```sh\nquestlog hook add https://example.org/wake --min-gap 60\nquestlog hook add https://example.org/team --tag work --events quest.due,quest.overdue --secret-stdin\nquestlog hook label work\nquestlog hook list\nquestlog tick --dry-run\nquestlog tick\nquestlog watch --interval 60\nquestlog hook test 1\nquestlog review deliveries\nquestlog show 12\nquestlog hook remove 1\n```\n\n`hook add` prints its random 32-byte signing secret once, also as `secret` in `--json`.\nSave it securely. `--secret-stdin` supplies one via stdin; there is no secret flag.\nSecrets and custom header values are stored in the DB. New POSIX DB/WAL/SHM files use 0600 and created directories use 0700; existing DB modes are preserved. Windows uses existing access controls.\nUse repeatable `--header "Name: value"` or `--header-stdin` (one line per header, avoiding shell history). Headers are sent on every delivery and test; output shows names with `***` values. HTTP token names are required; host, content-length, content-type, and x-questlog-* are reserved. Change headers by removing and adding the hook again. Use --header-stdin and --secret-stdin separately. URL userinfo is rejected; use a custom header or query key.\n`questlog show d_\u2026` displays delivery status, attempts, HTTP status, next attempt, redacted target URL and event ids. Text is the default; --json prints JSON. Missing hook remove/test targets exit 3; missing quests/deliveries exit 1. hook label names the database.\nList output redacts userinfo/query strings. Removal deletes the target and deliveries.\nDefault scope is the database; `--tag` matches quest tags, never rumors.\n`--events` defaults to all types. The DB label defaults to the filename without its\npath/extension (`questlog` in memory); set it to a name suitable for disclosure.\n\n```cron\n* * * * * questlog tick\n```\n\nCron\'s PATH may need `$HOME/.local/bin/questlog tick --db /path/to/quests.db`.\nWatch defaults to 60 seconds (minimum 5); SIGINT/SIGTERM finishes the current tick.\nTick exits 0 even when deliveries need retries. Dry-run records nothing and sends nothing.\n\nEvents are detected from the model at tick time:\n\n- `quest.due`: an unresolved, undeleted quest reaches its effective due time (own `due_at`, otherwise its undeleted questline\'s due time).\n- `quest.overdue`: that effective deadline is strictly earlier than now and the quest remains unresolved.\n- `quest.unblocked`: an unresolved quest is available, all active prerequisites have succeeded or been deleted, and at least one prerequisite succeeded after its unlock was installed. Occurrence time is the latest active prerequisite success or not-before time, whichever is later.\n- `repeatable.spawned`: a concrete repeatable instance was created; occurrence time is its creation time. Tick first materializes due anchors through the existing spawn operation.\n- `rumor.captured`: an undeleted rumor was created; occurrence time is its creation time, even if subsequently settled or dismissed.\n\nPersistent event keys contain type, entity ids, and occurrence time. Restarts and repeated\nticks do not repeat occurrences. Removed transitions between ticks cannot be reconstructed.\nOnly occurrences at/after target creation are assigned; tags are evaluated at assignment.\nTick materializes due repeatables using the existing spawn path, including during preview\nwith rollback. Batches contain only ids, event types, timestamps, and the DB label:\n\n```json\n{"type":"questlog.events","db":"work","deliveryId":"d_\u2026","sentAt":"2026-10-28T10:00:00.000Z","events":[{"id":"e_\u2026","type":"quest.due","questId":12,"occurredAt":"2026-10-28T09:59:00.000Z"}]}\n```\n\nHeaders are `content-type: application/json`, `user-agent: questlog/<version>`,\n`x-questlog-delivery: <deliveryId>`, `x-questlog-timestamp: <unix seconds>`, and\n`x-questlog-signature: sha256=<hex HMAC-SHA256(secret, timestamp + "." + rawBody)>`.\nNo titles, objectives, details, or tag text are sent. `hook test` sends a logged `hook.test`\nevent immediately, ignoring the min gap. Add and test are CLI-only in the tool facade;\n`manage_hooks` supports list, remove, tick (with `dry_run`), and deliveries.\n\n2xx delivers. Timeout is 5 seconds. Failures retry after 30 s, 1 m, 2 m, 4 m, doubling\nto 1 h plus <1 s jitter, subject to the target\'s min gap. Eight failures mark failed.\nRetries keep the delivery id/events; new events queue behind them. Keep the last 500\ndelivered log entries per target and all pending/failed entries. Transactional claims\nlease work for two minutes. A crash after receipt may retry: dedupe at the receiver.\n\n### Verifying a delivery\n\nCompute HMAC-SHA256 over `timestamp + "." + rawBody` with the secret and compare in constant\ntime. Reject timestamps older than 5 minutes (and timestamps too far in the future), then\ndedupe on `x-questlog-delivery`. Use durable deduplication storage in a production receiver.\nThis 15-line Node example uses an in-memory set:\n\n```js\nimport { createHmac, timingSafeEqual } from \'node:crypto\';\nimport { createServer } from \'node:http\';\nconst secret = process.env.WEBHOOK_SECRET, seen = new Set();\ncreateServer(async (req, res) => {\n  const chunks = []; for await (const chunk of req) chunks.push(chunk);\n  const rawBody = Buffer.concat(chunks), h = req.headers;\n  const timestamp = h[\'x-questlog-timestamp\'], id = h[\'x-questlog-delivery\'];\n  const age = Date.now() / 1000 - Number(timestamp);\n  const expected = createHmac(\'sha256\', secret).update(timestamp + \'.\').update(rawBody).digest();\n  const signature = String(h[\'x-questlog-signature\'] || \'\');\n  const actual = Buffer.from(signature.slice(7), \'hex\');\n  if (!id || !/^\\d+$/.test(timestamp) || age > 300 || age < -300 || !/^sha256=[a-f0-9]{64}$/.test(signature) || actual.length !== expected.length || !timingSafeEqual(actual, expected)) { res.writeHead(401).end(); return; }\n  if (!seen.has(id)) { seen.add(id); console.log(JSON.parse(rawBody)); }\n  res.writeHead(204).end();\n}).listen(8080, \'127.0.0.1\');\n```\n'
+  content: '# Webhooks\n\nUse `questlog` to configure opt-in outbound automation. No targets means no network calls. `manage_hooks` supports list, remove, tick with\n`dry_run`, and deliveries; add/test are CLI-only. `review_questlog` view `deliveries`\nand `questlog show <id>` expose pending/failed deliveries.\n\n```sh\nquestlog hook add https://example.org/wake --min-gap 60\nquestlog hook add https://example.org/team --tag work --events quest.due,quest.overdue --secret-stdin\nquestlog hook label work\nquestlog hook list\nquestlog tick --dry-run\nquestlog tick\nquestlog watch --interval 60\nquestlog hook test 1\nquestlog review deliveries\nquestlog show 12\nquestlog hook remove 1\n```\n\n`hook add` prints its random 32-byte signing secret once, also as `secret` in `--json`.\nSave it securely. `--secret-stdin` supplies one via stdin; there is no secret flag.\nSecrets/headers are stored in the DB. New POSIX DB/WAL/SHM files use 0600; new directories use 0700. Existing modes and Windows access controls are preserved.\nPrefer `--header-stdin` for real keys (one Name: value per line); use a private 0600 file. Repeatable `--header` exposes values in process arguments and shell history. Output redacts values as `***`. host, content-length, content-type and x-questlog-* are reserved. To change headers, remove/add the hook. Use --header-stdin and --secret-stdin separately. URL userinfo is rejected.\n`show d_\u2026` displays delivery attempts, HTTP status, next attempt, redacted target and event ids. Text timestamps are local; --json keeps UTC/epoch times. Missing hook remove/test targets exit 3; missing quests/deliveries also exit 3. Empty hook lists print `No hooks`. hook label names the database.\nList output redacts userinfo/query strings. Removal deletes the target and deliveries.\nDefault scope is the DB; `--tag` matches quest tags only.\n`--events` defaults to all types. The DB label defaults to the filename without its\npath/extension (`questlog` in memory); set it to a name suitable for disclosure.\n\n```cron\n* * * * * questlog tick\n```\n\nCron may need `$HOME/.local/bin/questlog tick --db /path/to/quests.db`.\nWatch defaults to 60 s (minimum 5); SIGINT/SIGTERM finishes the tick.\nTick exits 0 even when deliveries need retries. Dry-run records nothing and sends nothing.\n\nEvents are detected from the model at tick time:\n\n- `quest.due`: an unresolved, undeleted quest reaches its effective due time (own `due_at`, otherwise its undeleted questline\'s due time).\n- `quest.overdue`: that effective deadline is strictly earlier than now and the quest remains unresolved.\n- `quest.unblocked`: an unresolved quest is available, all active prerequisites have succeeded or been deleted, and at least one prerequisite succeeded after its unlock was installed. Occurrence time is the latest active prerequisite success or not-before time, whichever is later.\n- `repeatable.spawned`: a concrete repeatable instance was created; occurrence time is its creation time. Tick first materializes due anchors through the existing spawn operation.\n- `rumor.captured`: an undeleted rumor was created; occurrence time is its creation time, even if subsequently settled or dismissed.\n\nEvent keys include type, entity ids and occurrence time, preventing repeats across restarts. Transitions removed between ticks cannot be reconstructed.\nOnly events at/after target creation are assigned; tags are checked then.\nTick materializes due repeatables using the existing spawn path, including during preview\nwith rollback. Batches contain only ids, event types, timestamps, and the DB label:\n\n```json\n{"type":"questlog.events","db":"work","deliveryId":"d_\u2026","sentAt":"2026-10-28T10:00:00.000Z","events":[{"id":"e_\u2026","type":"quest.due","questId":12,"occurredAt":"2026-10-28T09:59:00.000Z"}]}\n```\n\nHeaders are `content-type: application/json`, `user-agent: questlog/<version>`,\n`x-questlog-delivery: <deliveryId>`, `x-questlog-timestamp: <unix seconds>`, and\n`x-questlog-signature: sha256=<hex HMAC-SHA256(secret, timestamp + "." + rawBody)>`.\nNo titles, objectives, details, or tag text are sent. `hook test` sends a logged `hook.test`\nevent immediately, ignoring the min gap. Add and test are CLI-only in the tool facade;\n`manage_hooks` supports list, remove, tick (with `dry_run`), and deliveries.\n\n2xx delivers. Timeout is 5 seconds. Failures retry after 30 s, 1 m, 2 m, 4 m, doubling\nto 1 h plus <1 s jitter, subject to the target\'s min gap. Eight failures mark failed.\nRetries keep the delivery id/events; new events queue behind them. Keep the last 500\ndelivered log entries per target and all pending/failed entries. Claims lease work for two minutes. Dedupe retries at the receiver.\n\n### Verifying a delivery\n\nCompute HMAC-SHA256 over `timestamp + "." + rawBody` with the secret and compare in constant\ntime. Reject timestamps older than 5 minutes (and timestamps too far in the future), then\ndedupe on `x-questlog-delivery`. Use durable deduplication in production; this example uses an in-memory set:\n\n```js\nimport { createHmac, timingSafeEqual } from \'node:crypto\';\nimport { createServer } from \'node:http\';\nconst secret = process.env.WEBHOOK_SECRET, seen = new Set();\ncreateServer(async (req, res) => {\n  const chunks = []; for await (const chunk of req) chunks.push(chunk);\n  const rawBody = Buffer.concat(chunks), h = req.headers;\n  const timestamp = h[\'x-questlog-timestamp\'], id = h[\'x-questlog-delivery\'];\n  const age = Date.now() / 1000 - Number(timestamp);\n  const expected = createHmac(\'sha256\', secret).update(timestamp + \'.\').update(rawBody).digest();\n  const signature = String(h[\'x-questlog-signature\'] || \'\');\n  const actual = Buffer.from(signature.slice(7), \'hex\');\n  if (!id || !/^\\d+$/.test(timestamp) || age > 300 || age < -300 || !/^sha256=[a-f0-9]{64}$/.test(signature) || actual.length !== expected.length || !timingSafeEqual(actual, expected)) { res.writeHead(401).end(); return; }\n  if (!seen.has(id)) { seen.add(id); console.log(JSON.parse(rawBody)); }\n  res.writeHead(204).end();\n}).listen(8080, \'127.0.0.1\');\n```\n'
 });
 
 // src/skills/skill_registry.ts
@@ -3689,6 +3689,7 @@ function minimalInput(schema, action, name = "") {
 // src/surfaces/validate_input.ts
 function validateInput(schema, input, path = "$") {
   const errors = [];
+  const received = `; received ${JSON.stringify(input)}`;
   const matchesType = (type) => {
     switch (type) {
       case "object":
@@ -3706,13 +3707,13 @@ function validateInput(schema, input, path = "$") {
     }
   };
   if (schema.type && !(Array.isArray(schema.type) ? schema.type : [schema.type]).some(matchesType)) {
-    return [`${path}: expected ${String(schema.type)}`];
+    return [`${path}: expected ${schema.type}${received}`];
   }
   if (schema.enum && !schema.enum.some((value) => JSON.stringify(value) === JSON.stringify(input)))
-    errors.push(`${path}: expected one of ${JSON.stringify(schema.enum)}`);
+    errors.push(`${path}: expected one of ${JSON.stringify(schema.enum)}${received}`);
   const constant = "const" in schema ? schema.const : void 0;
   if (constant !== void 0 && constant !== input)
-    errors.push(`${path}: expected ${JSON.stringify(constant)}`);
+    errors.push(`${path}: expected ${JSON.stringify(constant)}${received}`);
   if (schema.oneOf) {
     const branches = schema.oneOf.map((branch) => validateInput(branch, input, path));
     if (!branches.some((errors2) => errors2.length === 0)) {
@@ -3723,7 +3724,7 @@ function validateInput(schema, input, path = "$") {
       );
     }
   }
-  if (typeof input === "object" && input !== null && !Array.isArray(input)) {
+  if (matchesType("object")) {
     const record = input;
     for (const name of [...schema.required ?? [], ...requiredForAction(schema, record.action)])
       if (!Object.hasOwn(record, name)) errors.push(`${path}.${name}: required`);

package/dist/mcp-server.js

@@ -86,6 +86,7 @@ var init_surface_types = __esm({
 // src/surfaces/validate_input.ts
 function validateInput(schema, input, path = "$") {
   const errors = [];
+  const received = `; received ${JSON.stringify(input)}`;
   const matchesType = (type) => {
     switch (type) {
       case "object":
@@ -103,13 +104,13 @@ function validateInput(schema, input, path = "$") {
     }
   };
   if (schema.type && !(Array.isArray(schema.type) ? schema.type : [schema.type]).some(matchesType)) {
-    return [`${path}: expected ${String(schema.type)}`];
+    return [`${path}: expected ${schema.type}${received}`];
   }
   if (schema.enum && !schema.enum.some((value) => JSON.stringify(value) === JSON.stringify(input)))
-    errors.push(`${path}: expected one of ${JSON.stringify(schema.enum)}`);
+    errors.push(`${path}: expected one of ${JSON.stringify(schema.enum)}${received}`);
   const constant = "const" in schema ? schema.const : void 0;
   if (constant !== void 0 && constant !== input)
-    errors.push(`${path}: expected ${JSON.stringify(constant)}`);
+    errors.push(`${path}: expected ${JSON.stringify(constant)}${received}`);
   if (schema.oneOf) {
     const branches = schema.oneOf.map((branch) => validateInput(branch, input, path));
     if (!branches.some((errors2) => errors2.length === 0)) {
@@ -120,7 +121,7 @@ function validateInput(schema, input, path = "$") {
       );
     }
   }
-  if (typeof input === "object" && input !== null && !Array.isArray(input)) {
+  if (matchesType("object")) {
     const record = input;
     for (const name of [...schema.required ?? [], ...requiredForAction(schema, record.action)])
       if (!Object.hasOwn(record, name)) errors.push(`${path}.${name}: required`);
@@ -797,7 +798,7 @@ var init_open_questlog_db = __esm({
 var questlogVersion;
 var init_version = __esm({
   "src/version.ts"() {
-    questlogVersion = "0.11.0";
+    questlogVersion = "0.11.2";
   }
 });
 

package/dist/mcp.cjs

@@ -420,7 +420,7 @@ async function openQuestlogDb(path) {
 }
 
 // src/version.ts
-var questlogVersion = "0.11.0";
+var questlogVersion = "0.11.2";
 
 // src/surface/questlog_mcp_instructions.ts
 var questlogMcpInstructions = "Questlog manages local tasks, calendar commitments, and recurring work. Search before creating work, inspect before changing it, and keep uncertain work as rumors. Use unlock prerequisites to sequence work. run_quest refuses blocked starts unless force is true. Review commitments and resolve work with an honest outcome.";
@@ -714,6 +714,7 @@ function minimalInput(schema, action, name = "") {
 // src/surfaces/validate_input.ts
 function validateInput(schema, input, path = "$") {
   const errors = [];
+  const received = `; received ${JSON.stringify(input)}`;
   const matchesType = (type) => {
     switch (type) {
       case "object":
@@ -731,13 +732,13 @@ function validateInput(schema, input, path = "$") {
     }
   };
   if (schema.type && !(Array.isArray(schema.type) ? schema.type : [schema.type]).some(matchesType)) {
-    return [`${path}: expected ${String(schema.type)}`];
+    return [`${path}: expected ${schema.type}${received}`];
   }
   if (schema.enum && !schema.enum.some((value) => JSON.stringify(value) === JSON.stringify(input)))
-    errors.push(`${path}: expected one of ${JSON.stringify(schema.enum)}`);
+    errors.push(`${path}: expected one of ${JSON.stringify(schema.enum)}${received}`);
   const constant = "const" in schema ? schema.const : void 0;
   if (constant !== void 0 && constant !== input)
-    errors.push(`${path}: expected ${JSON.stringify(constant)}`);
+    errors.push(`${path}: expected ${JSON.stringify(constant)}${received}`);
   if (schema.oneOf) {
     const branches = schema.oneOf.map((branch) => validateInput(branch, input, path));
     if (!branches.some((errors2) => errors2.length === 0)) {
@@ -748,7 +749,7 @@ function validateInput(schema, input, path = "$") {
       );
     }
   }
-  if (typeof input === "object" && input !== null && !Array.isArray(input)) {
+  if (matchesType("object")) {
     const record = input;
     for (const name of [...schema.required ?? [], ...requiredForAction(schema, record.action)])
       if (!Object.hasOwn(record, name)) errors.push(`${path}.${name}: required`);

package/dist/mcp.js

@@ -418,7 +418,7 @@ async function openQuestlogDb(path) {
 }
 
 // src/version.ts
-var questlogVersion = "0.11.0";
+var questlogVersion = "0.11.2";
 
 // src/surface/questlog_mcp_instructions.ts
 var questlogMcpInstructions = "Questlog manages local tasks, calendar commitments, and recurring work. Search before creating work, inspect before changing it, and keep uncertain work as rumors. Use unlock prerequisites to sequence work. run_quest refuses blocked starts unless force is true. Review commitments and resolve work with an honest outcome.";
@@ -712,6 +712,7 @@ function minimalInput(schema, action, name = "") {
 // src/surfaces/validate_input.ts
 function validateInput(schema, input, path = "$") {
   const errors = [];
+  const received = `; received ${JSON.stringify(input)}`;
   const matchesType = (type) => {
     switch (type) {
       case "object":
@@ -729,13 +730,13 @@ function validateInput(schema, input, path = "$") {
     }
   };
   if (schema.type && !(Array.isArray(schema.type) ? schema.type : [schema.type]).some(matchesType)) {
-    return [`${path}: expected ${String(schema.type)}`];
+    return [`${path}: expected ${schema.type}${received}`];
   }
   if (schema.enum && !schema.enum.some((value) => JSON.stringify(value) === JSON.stringify(input)))
-    errors.push(`${path}: expected one of ${JSON.stringify(schema.enum)}`);
+    errors.push(`${path}: expected one of ${JSON.stringify(schema.enum)}${received}`);
   const constant = "const" in schema ? schema.const : void 0;
   if (constant !== void 0 && constant !== input)
-    errors.push(`${path}: expected ${JSON.stringify(constant)}`);
+    errors.push(`${path}: expected ${JSON.stringify(constant)}${received}`);
   if (schema.oneOf) {
     const branches = schema.oneOf.map((branch) => validateInput(branch, input, path));
     if (!branches.some((errors2) => errors2.length === 0)) {
@@ -746,7 +747,7 @@ function validateInput(schema, input, path = "$") {
       );
     }
   }
-  if (typeof input === "object" && input !== null && !Array.isArray(input)) {
+  if (matchesType("object")) {
     const record = input;
     for (const name of [...schema.required ?? [], ...requiredForAction(schema, record.action)])
       if (!Object.hasOwn(record, name)) errors.push(`${path}.${name}: required`);

package/dist/{questlog_skill_spec-ILTCTRYS.js → questlog_skill_spec-4U36GV6W.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { questlogSkills } from './chunk-I2AMIXGP.js';
+import { questlogSkills } from './chunk-PQAQZUCH.js';
 import { questlogMcpInstructions } from './chunk-SVWAEAKC.js';
-import { reviewQuestlogTool, questlogSurfaceTools } from './chunk-KOWIVBG6.js';
-import './chunk-RBGQK5WP.js';
+import { reviewQuestlogTool, questlogSurfaceTools } from './chunk-FCHLDYAR.js';
+import './chunk-S5EP3A3L.js';
 import './chunk-D6EGZCT7.js';
 import './chunk-NBCCA6AX.js';
 import './chunk-QYSIJ2YN.js';
@@ -59,7 +59,7 @@ var questlogSkillSpec = {
     "- `questlog show 12`",
     "- `questlog list --view quests.available`",
     "- Use `--json` on any plain command.",
-    "- Exit codes: 0 ok / 1 error / 2 usage / 3 needs input or hook target not found.",
+    "- Exit codes: 0 ok / 1 error / 2 usage / 3 needs input or item not found.",
     "- Database: `~/.ghostpaw/questlog.db`; override with `--db` or `GHOSTPAW_QUESTLOG_DB`.",
     "- Use one database per project.",
     "- `questlog --version` prints the installed version.",

package/dist/{run_hook_command-BOENYNDT.js → run_hook_command-H4J6S5DZ.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { parseCliArgs } from './chunk-GVD6A3RR.js';
-import { textOutput } from './chunk-QK3H2AL5.js';
-import { watchQuestlog, testHook, removeHook, hookLabel, withTransaction, addHook } from './chunk-RBGQK5WP.js';
+import { parseCliArgs } from './chunk-M3WAPFGB.js';
+import { textOutput } from './chunk-DDMYHMXY.js';
+import { watchQuestlog, testHook, removeHook, hookLabel, withTransaction, addHook } from './chunk-S5EP3A3L.js';
 import './chunk-D6EGZCT7.js';
 import { listHooks } from './chunk-NBCCA6AX.js';
 
@@ -133,7 +133,7 @@ async function runHookCommand(command, args, io, open) {
       values.json ? `${JSON.stringify(result, null, 2)}
 ` : action === "add" ? `Created hook ${result.id}
 Secret (shown once): ${result.secret}
-` : `${textOutput(result)}
+` : action === "list" && Array.isArray(result) && !result.length ? "No hooks\n" : `${textOutput(result)}
 `
     );
     return 0;

package/dist/{serve_questlog_mcp-X524X34F.js → serve_questlog_mcp-3UGYRARA.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { questlogMcpInstructions } from './chunk-SVWAEAKC.js';
 import { isErrorResult, resolveQuestlogDbPath } from './chunk-IL2QRKZL.js';
-import { validateInput, questlogSurfaceTools } from './chunk-KOWIVBG6.js';
+import { validateInput, questlogSurfaceTools } from './chunk-FCHLDYAR.js';
 import { openQuestlogDb } from './chunk-IA2GVCZS.js';
-import { questlogVersion } from './chunk-RBGQK5WP.js';
+import { questlogVersion } from './chunk-S5EP3A3L.js';
 import './chunk-D6EGZCT7.js';
 import './chunk-NBCCA6AX.js';
 import { minimalInput } from './chunk-QYSIJ2YN.js';

package/dist/text_output-U55ZUZX4.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export { textOutput } from './chunk-DDMYHMXY.js';

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@ghostpaw/questlog",
-	"version": "0.11.0",
+	"version": "0.11.2",
 	"description": "Unified task and calendar model for Node.js — SQLite, zero dependencies, with a built-in LLM tool facade",
 	"type": "module",
 	"exports": {

package/skills/questlog/SKILL.md

@@ -35,7 +35,7 @@ Run tools as `ghostpaw-questlog ...`; use `~/.local/bin/ghostpaw-questlog` if it
 - `questlog show 12`
 - `questlog list --view quests.available`
 - Use `--json` on any plain command.
-- Exit codes: 0 ok / 1 error / 2 usage / 3 needs input or hook target not found.
+- Exit codes: 0 ok / 1 error / 2 usage / 3 needs input or item not found.
 - Database: `~/.ghostpaw/questlog.db`; override with `--db` or `GHOSTPAW_QUESTLOG_DB`.
 - Use one database per project.
 - `questlog --version` prints the installed version.

package/skills/questlog/references/webhooks.md

@@ -1,7 +1,6 @@
 # Webhooks
 
-Use `questlog` to configure opt-in outbound automation. No server or scheduler is added.
-No targets means no network calls. `manage_hooks` supports list, remove, tick with
+Use `questlog` to configure opt-in outbound automation. No targets means no network calls. `manage_hooks` supports list, remove, tick with
 `dry_run`, and deliveries; add/test are CLI-only. `review_questlog` view `deliveries`
 and `questlog show <id>` expose pending/failed deliveries.
 
@@ -21,11 +20,11 @@ questlog hook remove 1
 
 `hook add` prints its random 32-byte signing secret once, also as `secret` in `--json`.
 Save it securely. `--secret-stdin` supplies one via stdin; there is no secret flag.
-Secrets and custom header values are stored in the DB. New POSIX DB/WAL/SHM files use 0600 and created directories use 0700; existing DB modes are preserved. Windows uses existing access controls.
-Use repeatable `--header "Name: value"` or `--header-stdin` (one line per header, avoiding shell history). Headers are sent on every delivery and test; output shows names with `***` values. HTTP token names are required; host, content-length, content-type, and x-questlog-* are reserved. Change headers by removing and adding the hook again. Use --header-stdin and --secret-stdin separately. URL userinfo is rejected; use a custom header or query key.
-`questlog show d_…` displays delivery status, attempts, HTTP status, next attempt, redacted target URL and event ids. Text is the default; --json prints JSON. Missing hook remove/test targets exit 3; missing quests/deliveries exit 1. hook label names the database.
+Secrets/headers are stored in the DB. New POSIX DB/WAL/SHM files use 0600; new directories use 0700. Existing modes and Windows access controls are preserved.
+Prefer `--header-stdin` for real keys (one Name: value per line); use a private 0600 file. Repeatable `--header` exposes values in process arguments and shell history. Output redacts values as `***`. host, content-length, content-type and x-questlog-* are reserved. To change headers, remove/add the hook. Use --header-stdin and --secret-stdin separately. URL userinfo is rejected.
+`show d_…` displays delivery attempts, HTTP status, next attempt, redacted target and event ids. Text timestamps are local; --json keeps UTC/epoch times. Missing hook remove/test targets exit 3; missing quests/deliveries also exit 3. Empty hook lists print `No hooks`. hook label names the database.
 List output redacts userinfo/query strings. Removal deletes the target and deliveries.
-Default scope is the database; `--tag` matches quest tags, never rumors.
+Default scope is the DB; `--tag` matches quest tags only.
 `--events` defaults to all types. The DB label defaults to the filename without its
 path/extension (`questlog` in memory); set it to a name suitable for disclosure.
 
@@ -33,8 +32,8 @@ path/extension (`questlog` in memory); set it to a name suitable for disclosure.
 * * * * * questlog tick
 ```
 
-Cron's PATH may need `$HOME/.local/bin/questlog tick --db /path/to/quests.db`.
-Watch defaults to 60 seconds (minimum 5); SIGINT/SIGTERM finishes the current tick.
+Cron may need `$HOME/.local/bin/questlog tick --db /path/to/quests.db`.
+Watch defaults to 60 s (minimum 5); SIGINT/SIGTERM finishes the tick.
 Tick exits 0 even when deliveries need retries. Dry-run records nothing and sends nothing.
 
 Events are detected from the model at tick time:
@@ -45,9 +44,8 @@ Events are detected from the model at tick time:
 - `repeatable.spawned`: a concrete repeatable instance was created; occurrence time is its creation time. Tick first materializes due anchors through the existing spawn operation.
 - `rumor.captured`: an undeleted rumor was created; occurrence time is its creation time, even if subsequently settled or dismissed.
 
-Persistent event keys contain type, entity ids, and occurrence time. Restarts and repeated
-ticks do not repeat occurrences. Removed transitions between ticks cannot be reconstructed.
-Only occurrences at/after target creation are assigned; tags are evaluated at assignment.
+Event keys include type, entity ids and occurrence time, preventing repeats across restarts. Transitions removed between ticks cannot be reconstructed.
+Only events at/after target creation are assigned; tags are checked then.
 Tick materializes due repeatables using the existing spawn path, including during preview
 with rollback. Batches contain only ids, event types, timestamps, and the DB label:
 
@@ -65,15 +63,13 @@ event immediately, ignoring the min gap. Add and test are CLI-only in the tool f
 2xx delivers. Timeout is 5 seconds. Failures retry after 30 s, 1 m, 2 m, 4 m, doubling
 to 1 h plus <1 s jitter, subject to the target's min gap. Eight failures mark failed.
 Retries keep the delivery id/events; new events queue behind them. Keep the last 500
-delivered log entries per target and all pending/failed entries. Transactional claims
-lease work for two minutes. A crash after receipt may retry: dedupe at the receiver.
+delivered log entries per target and all pending/failed entries. Claims lease work for two minutes. Dedupe retries at the receiver.
 
 ### Verifying a delivery
 
 Compute HMAC-SHA256 over `timestamp + "." + rawBody` with the secret and compare in constant
 time. Reject timestamps older than 5 minutes (and timestamps too far in the future), then
-dedupe on `x-questlog-delivery`. Use durable deduplication storage in a production receiver.
-This 15-line Node example uses an in-memory set:
+dedupe on `x-questlog-delivery`. Use durable deduplication in production; this example uses an in-memory set:
 
 ```js
 import { createHmac, timingSafeEqual } from 'node:crypto';

package/dist/text_output-X7F3K23Q.js

@@ -1,2 +0,0 @@
-#!/usr/bin/env node
-export { textOutput } from './chunk-QK3H2AL5.js';