v0.2.2: HTTP method specification, cron triggers, test coverage

Add HTTP method field (GET/POST/PUT/PATCH/DELETE) to handlers, workflow
steps, and parallel branches. GET requests omit the body.

Add cron source type with schedule expressions and optional timezone.
Fires cron.tick events on schedule, matching handlers and workflows.

Improve test coverage: 14 gap-coverage tests added across config,
verify, db, api, and alert modules. 4 redundant tests removed.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: ezqy

CHANGELOG.md

@@ -4,6 +4,15 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.2.2] - 2026-03-10
+
+### Added
+- **HTTP method specification**: `method` field on handlers, workflow steps, and parallel branches. Supports `GET`, `POST` (default), `PUT`, `PATCH`, `DELETE`. GET requests omit the body.
+- **Cron triggers**: New `cron` source type with `schedule` (cron expression) and optional `timezone`. Fires `cron.tick` events on schedule, matching handlers and workflows.
+
+### Changed
+- Test coverage improvements: 14 gap-coverage tests added, 4 redundant tests removed (174 total unit tests).
+
 ## [0.2.0] - 2026-03-09
 
 ### Added

CLAUDE.md

@@ -58,14 +58,15 @@ src/
   lib.rs        — Module exports (for Cloud version dependency)
   api.rs        — HTTP handlers (webhook, event, sns, health)
   config.rs     — YAML config parsing + env var expansion
+  cron.rs       — Cron scheduler (periodic event generation)
   db.rs         — SQLite/Postgres via sqlx AnyPool
   metrics.rs    — Prometheus metrics (atomic counters, no deps)
   queue.rs      — Job worker (poll, deliver, retry, DLQ)
   grpc.rs       — gRPC output (prost types, tonic client, no codegen)
   verify.rs     — Signature verification (GitHub, Stripe, Shopify, HMAC, SNS X.509)
   cli.rs        — CLI commands (start, init, validate, jobs, events)
 tests/
-  e2e.sh        — E2E tests (20 tests)
+  e2e.sh        — E2E tests (26 tests)
   e2e_sns.sh    — SNS E2E tests with LocalStack (8 tests)
   mock_server.py — Python mock HTTP server for E2E
   bench.sh      — Benchmark script (receive RPS + delivery throughput)
@@ -88,7 +89,7 @@ docs/               — GitHub Pages user guide (Jekyll, Cayman theme)
 ## Conventions
 
 - **Language**: Code, comments, and all documentation in English. Exception: `docs/private/` may be in Japanese. User communication in Japanese.
-- **Source type strings**: `webhook`, `event`, `sns` (in config YAML and source_type field).
+- **Source type strings**: `webhook`, `event`, `sns`, `cron` (in config YAML and source_type field).
 - **Event type extraction order**: CloudEvents `ce-type` header → structured mode `type` field → provider-specific logic.
 - **Database**: SQLite for dev/testing, Postgres for production. Both via sqlx AnyPool.
 - **IDs**: ULID for event_id and job_id.

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "qhook"
-version = "0.2.1"
+version = "0.2.2"
 edition = "2024"
 rust-version = "1.85"
 description = "Lightweight webhook gateway and workflow engine with queue, retry, and signature verification."
@@ -69,3 +69,4 @@ tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }
 anyhow = "1"
 thiserror = "2"
+croner = "3.0.1"

Cargo.toml

@@ -53,12 +53,18 @@ sources:
     type: sns
     # skip_verify: true             # for LocalStack testing
 
+  daily-report:
+    type: cron
+    schedule: "0 9 * * MON-FRI"      # 9 AM on weekdays
+    # timezone: "+09:00"             # default: UTC
+
 handlers:
   payment-success:
     source: stripe
     events: [checkout.session.completed, invoice.paid]
     url: http://backend:3000/jobs/payment
     type: http                      # http (default) or grpc
+    method: POST                    # GET, POST (default), PUT, PATCH, DELETE
     retry: { max: 8 }
     timeout: 60s
     idempotency_key: "$.id"
@@ -157,10 +163,12 @@ Each source is a named entry under `sources:`.
 
 | Field | Type | Default | Description |
 |-------|------|---------|-------------|
-| `type` | string | required | `webhook`, `event`, or `sns` |
+| `type` | string | required | `webhook`, `event`, `sns`, or `cron` |
 | `verify` | string | - | Signature verification: `github`, `stripe`, `shopify`, or `hmac` |
 | `secret` | string | - | Shared secret for signature verification. Required when `verify` is set |
 | `skip_verify` | boolean | `false` | Skip SNS X.509 verification (for testing with LocalStack) |
+| `schedule` | string | - | Cron expression (required for `cron` sources). 5-field standard or 6-field with seconds |
+| `timezone` | string | `UTC` | Timezone for cron evaluation. `UTC` or fixed offset like `+09:00` |
 
 **Source types:**
 
@@ -169,6 +177,7 @@ Each source is a named entry under `sources:`.
 | `webhook` | `POST /webhooks/{source}` | External webhooks with signature verification |
 | `event` | `POST /events/{event_type}` | Internal events with optional bearer token auth |
 | `sns` | `POST /sns/{source}` | AWS SNS with auto-confirmation and envelope unwrapping |
+| `cron` | *(internal)* | Time-based trigger. Fires `cron.tick` events on schedule |
 
 ### handlers
 
@@ -180,6 +189,7 @@ Each handler is a named entry under `handlers:`.
 | `events` | list | `[]` (all) | Event types to match. Empty = all events from this source |
 | `url` | string | required | Delivery target URL |
 | `type` | string | `http` | Delivery protocol: `http` or `grpc` |
+| `method` | string | `POST` | HTTP method: `GET`, `POST`, `PUT`, `PATCH`, `DELETE` |
 | `retry` | object | - | Override `default_retry` for this handler |
 | `timeout` | duration | - | Override delivery timeout for this handler |
 | `idempotency_key` | string | - | JSONPath to dedup key in payload (e.g., `$.id`) |
@@ -223,6 +233,7 @@ Each workflow is a named entry under `workflows:`.
 | `name` | string | required | Unique step name (used for `goto` references) |
 | `type` | string | `http` | Step type: `http`, `choice`, `parallel`, `map`, `wait`, `callback` |
 | `url` | string | - | Delivery target URL (required for `http` steps). For `callback` steps, URL to notify with the callback token |
+| `method` | string | `POST` | HTTP method: `GET`, `POST`, `PUT`, `PATCH`, `DELETE` |
 | `headers` | map | `{}` | Custom HTTP headers to send with this step's request |
 | `retry` | object | - | Override retry config. Supports `errors` field for error type matching (`5xx`, `4xx`, `timeout`, `network`, `all`) |
 | `catch` | list | - | Error routing rules. Each entry has `errors` (list) and `goto` (step name) |
@@ -267,10 +278,12 @@ qhook validate -c /path/to/qhook.yaml
 
 Checks performed:
 - YAML syntax
-- Source type is valid (`webhook`, `event`, `sns`)
+- Source type is valid (`webhook`, `event`, `sns`, `cron`)
 - Handler type is valid (`http`, `grpc`)
+- HTTP method is valid (`GET`, `POST`, `PUT`, `PATCH`, `DELETE`)
 - Handler references an existing source
 - `verify` requires `secret` to be set (non-empty)
+- Cron sources have a valid `schedule` and `timezone`
 - Handler URLs use http/https scheme (private IPs trigger warnings)
 - Alert config has valid `on` events
 - Workflow references an existing source

docs/configuration.md

@@ -222,6 +222,20 @@ mod tests {
         assert_eq!(embed["color"], 0xFFA500);
     }
 
+    #[test]
+    fn test_format_payload_unknown_type_falls_back_to_generic() {
+        let event = AlertEvent::Dlq {
+            job_id: "j1".into(),
+            handler: "h1".into(),
+            attempts: 3,
+        };
+        let payload = format_payload("unknown_type", &event);
+        // Should produce generic JSON (not Slack/Discord format)
+        let parsed: serde_json::Value = serde_json::from_str(&payload).unwrap();
+        assert_eq!(parsed["alert"], "dlq");
+        assert_eq!(parsed["handler"], "h1");
+    }
+
     #[test]
     fn test_event_kind() {
         let dlq = AlertEvent::Dlq {