dunstan 0.1.15 → 0.1.16

package/README.md

@@ -26,7 +26,7 @@ jobs:
   handback:
     runs-on: ubuntu-latest
     steps:
-      - uses: BargLabs/dunstan@v0.1.15 # pin the full commit SHA in production
+      - uses: BargLabs/dunstan@v0.1.16 # pin the full commit SHA in production
         with:
           report-source: pr-body
 ```
@@ -52,7 +52,7 @@ export exists).
 
 ## Use with Claude
 
-Dunstan ships as a Claude Code plugin: two MCP tools and a skill that has Claude declare, check and
+Dunstan ships as a Claude Code plugin: three MCP tools and a skill that has Claude declare, check and
 report a pull request's handback before it says done ([`plugins/dunstan/`](plugins/dunstan/)).
 
 **Install.** In Claude Code:
@@ -62,7 +62,7 @@ report a pull request's handback before it says done ([`plugins/dunstan/`](plugi
 /plugin install dunstan@barglabs
 ```
 
-The plugin runs the MCP server with `npx -y dunstan@0.1.15 mcp`, the `dunstan` npm package at that
+The plugin runs the MCP server with `npx -y dunstan@0.1.16 mcp`, the `dunstan` npm package at that
 exact version: one self-contained file, no dependencies.
 
 **The token.** When you enable the plugin, Claude Code asks for an optional GitHub token and keeps it

package/dist/dunstan.mjs

@@ -9881,7 +9881,7 @@ async function reportFromComment(client, repository, number4, login) {
 // src/record/checker.ts
 import { readFileSync } from "node:fs";
 var CHECKER_NAME = "dunstan";
-var CHECKER_VERSION = "0.1.15";
+var CHECKER_VERSION = "0.1.16";
 function checkerIdentity(artifact) {
   return {
     name: CHECKER_NAME,
@@ -35146,7 +35146,7 @@ var StdioServerTransport = class {
 
 // src/mcp/server.ts
 import { existsSync, writeFileSync as writeFileSync3 } from "node:fs";
-import { basename as basename2, resolve as resolve3 } from "node:path";
+import { basename as basename2, isAbsolute, resolve as resolve3 } from "node:path";
 
 // node_modules/.pnpm/zod@4.6.5/node_modules/zod/v3/helpers/util.js
 var util;
@@ -43335,14 +43335,147 @@ function suggestText(report) {
   return renderSuggestions(suggestDeclarations(report));
 }
 
+// src/template/tests-ci.ts
+var plural2 = (n, one, many) => `${n} ${n === 1 ? one : many}`;
+function unsettled(reason, why, remedy) {
+  const notes = [`tests are not declared: ${why} (${reason}).`];
+  if (remedy !== void 0) notes.push(`remedy: ${remedy}`);
+  return { status: "unsettled", reason, notes };
+}
+async function testsFromCi(client, input2) {
+  const { repository, headCommit: head, record: record2 } = input2;
+  if (!client.hasToken) {
+    return unsettled(
+      "no_token",
+      "GITHUB_TOKEN is not set, and GitHub answers an artifact download only with a token, even on a public repository",
+      "set GITHUB_TOKEN to a token that can read the repository, with actions: read, and run dunstan template --tests-ci again."
+    );
+  }
+  if (!input2.pushed) {
+    return unsettled(
+      "not_pushed",
+      `HEAD ${head} is not on any remote-tracking branch, so no CI run can have tested it`,
+      "push it, wait for CI to finish, and run dunstan template --tests-ci again (run git fetch first if it was pushed from elsewhere)."
+    );
+  }
+  const observed = { runsNotCompleted: 0 };
+  const evidence = await readTestRecord(client, repository, record2, head, observed);
+  const named = `the artifact ${record2.artifact} holding ${record2.path} from job ${record2.job}`;
+  const pending = observed.runsNotCompleted > 0 ? `CI has not finished: ${plural2(observed.runsNotCompleted, "run", "runs")} of ${record2.workflow} at ${head} ${observed.runsNotCompleted === 1 ? "is" : "are"} not completed` : void 0;
+  const again = "run dunstan template --tests-ci again once CI has finished on this commit.";
+  if (evidence.status !== "ok") {
+    const reason = evidence.status === "unreadable" ? `source_unreadable:${evidence.source}` : `evidence_field_unpopulated:${evidence.field}`;
+    if (pending !== void 0) return unsettled(reason, pending, again);
+    const why = reason === "source_unreadable:artifact" ? `a run of ${record2.workflow} at ${head} uploaded ${record2.artifact}, and it could not be read` : `the workflow runs of ${record2.workflow} at ${head} could not be read`;
+    return unsettled(
+      reason,
+      why,
+      remedyForReason(reason, { hasToken: true }) ?? "run dunstan template --tests-ci again."
+    );
+  }
+  if (evidence.runs.length === 0) {
+    if (pending !== void 0) {
+      return unsettled(
+        "record_not_found",
+        `${pending}, and no completed run uploaded ${named}`,
+        again
+      );
+    }
+    return unsettled(
+      "record_not_found",
+      `no run of ${record2.workflow} at ${head} uploaded ${named}`,
+      remedyForReason("record_not_found", { hasToken: true })
+    );
+  }
+  const executed = new Set(evidence.runs.map((r) => r.executed));
+  const failed = new Set(evidence.runs.map((r) => r.failed));
+  if (executed.size > 1 || failed.size > 1) {
+    const counts = evidence.runs.map((r) => `run ${r.runId}: ${r.executed} executed, ${r.failed} failed`).join("; ");
+    return unsettled(
+      "record_ambiguous",
+      `the runs of ${record2.workflow} at ${head} that uploaded ${record2.artifact} disagree (${counts}), and the gate never picks one`,
+      "make the runs agree (re-run the one that differs), or name a job only one of them runs."
+    );
+  }
+  const run = evidence.runs[0];
+  const runs = evidence.runs.map((r) => r.runId).join(", ");
+  const notes = [
+    `tests: ${run.executed} executed and ${run.failed} failed in ${record2.path} in the artifact ${record2.artifact} of job ${record2.job} in ${record2.workflow} at ${head}, read from CI as the gate reads it (${evidence.runs.length === 1 ? "run" : "runs"} ${runs}).`
+  ];
+  if (pending !== void 0) {
+    notes.push(
+      `${pending}; a run that finishes later with other counts makes the gate's read ambiguous. Run dunstan template --tests-ci again once CI has finished.`
+    );
+  }
+  return {
+    status: "settled",
+    run: { command: input2.command, count: run.executed, failures: run.failed, record: record2 },
+    notes
+  };
+}
+
+// src/template/run.ts
+var DEFAULT_ARTIFACT = "dunstan-junit";
+var DEFAULT_ARTIFACT_PATH = "junit.xml";
+async function testsSource(request, context) {
+  const { cwd, tests } = request;
+  if (tests === void 0) return void 0;
+  if (tests.from === "local") return { kind: "local", junit: tests.junit, command: tests.command };
+  if (tests.from === "junit") {
+    return {
+      kind: "junit",
+      junit: tests.junit,
+      command: tests.command,
+      record: {
+        workflow: tests.workflow,
+        job: tests.job,
+        artifact: tests.artifact,
+        path: tests.artifactPath
+      }
+    };
+  }
+  const head = headCommit(cwd);
+  const repository = tests.repository ?? originRepository(cwd);
+  const client = new GitHubClient({
+    token: context.env.GITHUB_TOKEN,
+    ...context.fetch === void 0 ? {} : { fetch: context.fetch },
+    warn: context.warn
+  });
+  const read = await testsFromCi(client, {
+    repository,
+    headCommit: head,
+    command: tests.command,
+    pushed: isPushed(cwd, head),
+    record: {
+      kind: "junit",
+      workflow: tests.workflow,
+      job: tests.job,
+      artifact: tests.artifact ?? DEFAULT_ARTIFACT,
+      path: tests.artifactPath ?? DEFAULT_ARTIFACT_PATH
+    }
+  });
+  return { kind: "ci", read };
+}
+async function runTemplate(request, context) {
+  const tests = await testsSource(request, context);
+  const t = templateBlock({ cwd: request.cwd, base: request.base, tests });
+  return {
+    fence: renderBlock(t.block),
+    notes: t.notes,
+    tests: tests === void 0 ? "none" : tests.kind === "ci" && tests.read.status === "unsettled" ? "not_declared" : "declared"
+  };
+}
+
 // src/mcp/server.ts
 var TOOL_NAME = "dunstan_check_handback";
 var SUGGEST_TOOL_NAME = "dunstan_suggest_declarations";
+var TEMPLATE_TOOL_NAME = "dunstan_template_handback";
 var InputError = class extends Error {
 };
-var INSTRUCTIONS = `Before you say a task is done: generate your dunstan-handback block with \`dunstan template\` and add your test and reference claims; call ${SUGGEST_TOOL_NAME} with your report and declare or reword each sentence it lists; then call ${TOOL_NAME} with your pull request and the block. If the verdict is not pass, report the rows as they are; never edit the block to make it pass without changing the work. The check reads only what the block declares; the prose is yours to bring into the block.`;
+var INSTRUCTIONS = `Before you say a task is done: call ${TEMPLATE_TOOL_NAME} with the absolute path of your checkout (and tests.from "ci" once CI has finished on your last push) to generate your dunstan-handback block, or run \`dunstan template\`, the same thing from a shell; add your reference claims; call ${SUGGEST_TOOL_NAME} with your report and declare or reword each sentence it lists; then call ${TOOL_NAME} with your pull request and the block. If the verdict is not pass, report the rows as they are; never edit the block to make it pass without changing the work. The check reads only what the block declares; the prose is yours to bring into the block.`;
 var SUGGEST_DESCRIPTION = `List the sentences in your report's prose that look like claims your dunstan-handback block does not declare, before you say done. Give report, the report text. For each, declare it in the block, or reword it if it is not a claim about this PR. Offline: needs no pull request, reads nothing and writes nothing. Never a verdict: nothing passes or fails, and nothing is written to a record. The same text as \`dunstan suggest\`.`;
 var DESCRIPTION = `Check a completion handback against the repository's own record, before you say done. Give the subject (repository owner/name and pull request number) and exactly one of: block, the dunstan-handback block as a JSON object; or report, the report text that carries exactly one \`\`\`dunstan-handback fence. Of the checks claims, checks.allSucceeded is true only if every counted check run concluded success, so a skipped or neutral run makes it false; checks.noneFailed is true if none concluded other than success, skipped or neutral and at least one succeeded. Returns the verdict (pass, fail or unverifiable), the claims table, and the full record as JSON. Same checker and same verdict as \`dunstan check\` on the same evidence; no model decides. Reads GitHub metadata with GITHUB_TOKEN and writes nothing to GitHub or the repository; the record is written to a file only when you pass outPath. If the verdict is not pass, report the rows as they are; change the work, not the block.`;
+var TEMPLATE_DESCRIPTION = `Generate your dunstan-handback block from the local git checkout of your pull request's branch, after your last push: headCommit is HEAD, filesChanged is HEAD's diff against its merge base with base. Give directory, the checkout's absolute path. To declare tests, give tests.from "ci" with command, workflow and job once CI has finished on your last push: the counts are read from the JUnit record CI published, as the gate reads it, with GITHUB_TOKEN. tests.from "local" declares a local JUnit file as a local run, which the gate reports unverifiable. Returns the first line (tests: declared, tests: not declared, or tests: none asked) and the notes, then the fence, byte for byte what \`dunstan template\` prints. When the first line is tests: not declared, the block has no tests: do not add counts yourself; do what the note says. Add your references and checks yourself. Reads git and, with tests.from "ci", GitHub metadata and the JUnit artifact for its counts; writes nothing.`;
 function reportOfBlock(block) {
   const text2 = canonicalize(block);
   return {
@@ -43421,8 +43554,47 @@ function handbackResult(record2, outPath, notes, context) {
     ]
   };
 }
-function toolError(error62) {
-  const known = error62 instanceof InputError || error62 instanceof PullRequestUnreadable || error62 instanceof PullRequestMoved || error62 instanceof CanonicalizationError || typeof error62.code === "string";
+var TESTS_LINE = {
+  declared: "tests: declared",
+  not_declared: "tests: not declared",
+  none: "tests: none asked"
+};
+async function templateHandback(input2, options) {
+  if (!isAbsolute(input2.directory)) {
+    throw new InputError(`directory ${input2.directory} is not an absolute path`);
+  }
+  const warnings = [];
+  const run = await runTemplate(
+    { cwd: input2.directory, base: input2.base, tests: input2.tests },
+    {
+      env: options.env,
+      fetch: options.fetch,
+      warn: (message) => {
+        warnings.push(message);
+        options.warn(`dunstan: ${message}
+`);
+      }
+    }
+  );
+  const head = [TESTS_LINE[run.tests]];
+  if (run.tests === "not_declared") {
+    head.push("The block below has no tests. Do not add counts yourself; do what the note says.");
+  }
+  head.push(...[...warnings, ...run.notes].map((n) => `note: ${n}`));
+  return {
+    content: [
+      { type: "text", text: `${head.join("\n")}
+` },
+      { type: "text", text: run.fence }
+    ]
+  };
+}
+var ERROR_TAIL = {
+  check: "This is an error, not a verdict: nothing was checked.",
+  template: "This is an error: no block was produced."
+};
+function toolError(error62, tail = "check") {
+  const known = error62 instanceof InputError || error62 instanceof PullRequestUnreadable || error62 instanceof PullRequestMoved || error62 instanceof CanonicalizationError || error62 instanceof TemplateError || typeof error62.code === "string";
   const message = error62.message ?? String(error62);
   return {
     isError: true,
@@ -43430,12 +43602,37 @@ function toolError(error62) {
       {
         type: "text",
         text: `dunstan: ${known ? message : `internal error: ${message}`}
-This is an error, not a verdict: nothing was checked.
+${ERROR_TAIL[tail]}
 `
       }
     ]
   };
 }
+var nonEmpty = external_exports.string().min(1);
+var TEMPLATE_TESTS = external_exports.discriminatedUnion("from", [
+  external_exports.object({
+    from: external_exports.literal("ci"),
+    command: nonEmpty.describe("The command that ran the tests, as the block declares it."),
+    workflow: nonEmpty.describe(
+      "The workflow file that ran them, as a path: .github/workflows/ci.yml."
+    ),
+    job: nonEmpty.describe("The name of the job that uploaded the JUnit artifact."),
+    artifact: nonEmpty.optional().describe("The artifact holding the JUnit file. Absent: dunstan-junit."),
+    artifactPath: nonEmpty.optional().describe("The JUnit file in the artifact. Absent: junit.xml."),
+    repository: external_exports.string().regex(REPOSITORY, "repository must be owner/name").optional().describe("The GitHub repository, owner/name. Absent: the one the origin remote names.")
+  }).strict().describe(
+    "Read CI's counts at HEAD from the JUnit record CI published, as the gate reads it (dunstan template --tests-ci)."
+  ),
+  external_exports.object({
+    from: external_exports.literal("local"),
+    junit: nonEmpty.describe(
+      "The local JUnit XML file; a relative path resolves against directory."
+    ),
+    command: nonEmpty.describe("The command that ran the tests, as the block declares it.")
+  }).strict().describe(
+    "Declare a local JUnit file as a local run, which the gate reports unverifiable (dunstan template --tests-local)."
+  )
+]);
 function createDunstanMcpServer(options) {
   const server = new McpServer(
     { name: CHECKER_NAME, version: CHECKER_VERSION },
@@ -43489,6 +43686,37 @@ function createDunstanMcpServer(options) {
     },
     async (input2) => ({ content: [{ type: "text", text: suggestText(input2.report) }] })
   );
+  server.registerTool(
+    TEMPLATE_TOOL_NAME,
+    {
+      title: "Generate a handback block from git",
+      description: TEMPLATE_DESCRIPTION,
+      inputSchema: external_exports.object({
+        directory: nonEmpty.describe(
+          "The absolute path of the local git checkout of the pull request's branch. Git runs there."
+        ),
+        base: nonEmpty.optional().describe(
+          "The ref the pull request merges into, as dunstan template --base. Absent: the remote's default branch."
+        ),
+        tests: TEMPLATE_TESTS.optional().describe(
+          "Which tests to declare. Absent: none, and the note says how."
+        )
+      }).strict(),
+      annotations: {
+        readOnlyHint: true,
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: true
+      }
+    },
+    async (input2) => {
+      try {
+        return await templateHandback(input2, options);
+      } catch (error62) {
+        return toolError(error62, "template");
+      }
+    }
+  );
   return server;
 }
 
@@ -44033,7 +44261,7 @@ function share(r) {
 function interval(r) {
   return r.wilson95 === null ? "n/a" : `${r.wilson95.low}\u2013${r.wilson95.high}`;
 }
-function plural2(n, one, many) {
+function plural3(n, one, many) {
   return `${n} ${n === 1 ? one : many}`;
 }
 function renderSurveySummary(record2) {
@@ -44057,7 +44285,7 @@ function renderSurveySummary(record2) {
     "",
     "## Claims the record could not settle",
     "",
-    `The record could not settle ${a.cannotSettle.numerator} of ${plural2(a.cannotSettle.denominator, "claim", "claims")}.`,
+    `The record could not settle ${a.cannotSettle.numerator} of ${plural3(a.cannotSettle.denominator, "claim", "claims")}.`,
     ""
   );
   if (a.unsettled.length === 0) {
@@ -44129,7 +44357,7 @@ function renderSurveySummary(record2) {
       "",
       "## Advisory notes",
       "",
-      `The advisory reader read the prose of ${plural2(a.advisory.pullRequests, "pull request", "pull requests")}. Its notes never enter either rate, and a possible disagreement is unverified.`,
+      `The advisory reader read the prose of ${plural3(a.advisory.pullRequests, "pull request", "pull requests")}. Its notes never enter either rate, and a possible disagreement is unverified.`,
       ""
     );
     if (a.advisory.notes.length === 0) lines.push("No notes.");
@@ -44162,7 +44390,7 @@ function renderSurveySummary(record2) {
       ]
     ),
     "",
-    `The listing was read for ${plural2(listing.pages.length, "page", "pages")} and no further because ${listing.end === "page_bound" ? `it reached the bound of ${listing.pageBound} pages` : END_TEXT[listing.end]}.`
+    `The listing was read for ${plural3(listing.pages.length, "page", "pages")} and no further because ${listing.end === "page_bound" ? `it reached the bound of ${listing.pageBound} pages` : END_TEXT[listing.end]}.`
   );
   const abandoned = listing.abandoned.length;
   if (listing.duplicates > 0) {
@@ -44170,18 +44398,18 @@ function renderSurveySummary(record2) {
     const reread = abandoned === 0 ? "" : ` It was read ${abandoned + 1} times, from the first page each time, and moved during every read.`;
     lines.push(
       "",
-      `The listing named ${plural2(listing.duplicates, "pull request", "pull requests")} again on a later page, so it changed while it was read: most likely ${plural2(listing.duplicates, "pull request", "pull requests")} closed meanwhile and ${one ? "was" : "were"} not listed, and the selection may be missing ${one ? "it" : "them"}. Each repeated pull request is listed, selected and counted once: the pages held ${listing.pullRequests.length + listing.duplicates} items for ${listing.pullRequests.length} pull requests.${reread}`
+      `The listing named ${plural3(listing.duplicates, "pull request", "pull requests")} again on a later page, so it changed while it was read: most likely ${plural3(listing.duplicates, "pull request", "pull requests")} closed meanwhile and ${one ? "was" : "were"} not listed, and the selection may be missing ${one ? "it" : "them"}. Each repeated pull request is listed, selected and counted once: the pages held ${listing.pullRequests.length + listing.duplicates} items for ${listing.pullRequests.length} pull requests.${reread}`
     );
   } else if (abandoned > 0) {
     lines.push(
       "",
-      `The listing moved while it was read: ${plural2(abandoned, "read was", "reads were")} abandoned at a repeated pull request and the listing was read again from the first page. The read used repeated no pull request.`
+      `The listing moved while it was read: ${plural3(abandoned, "read was", "reads were")} abandoned at a repeated pull request and the listing was read again from the first page. The read used repeated no pull request.`
     );
   }
   if (selected.length < parameters.last) {
     lines.push(
       "",
-      `${plural2(selected.length, "pull request was", "pull requests were")} selected, fewer than the ${parameters.last} asked for.`
+      `${plural3(selected.length, "pull request was", "pull requests were")} selected, fewer than the ${parameters.last} asked for.`
     );
   }
   lines.push(
@@ -44268,95 +44496,12 @@ summary: ${values.summary}
 
 // src/cli/template.ts
 import { parseArgs as parseArgs6 } from "node:util";
-
-// src/template/tests-ci.ts
-var plural3 = (n, one, many) => `${n} ${n === 1 ? one : many}`;
-function unsettled(reason, why, remedy) {
-  const notes = [`tests are not declared: ${why} (${reason}).`];
-  if (remedy !== void 0) notes.push(`remedy: ${remedy}`);
-  return { status: "unsettled", reason, notes };
-}
-async function testsFromCi(client, input2) {
-  const { repository, headCommit: head, record: record2 } = input2;
-  if (!client.hasToken) {
-    return unsettled(
-      "no_token",
-      "GITHUB_TOKEN is not set, and GitHub answers an artifact download only with a token, even on a public repository",
-      "set GITHUB_TOKEN to a token that can read the repository, with actions: read, and run dunstan template --tests-ci again."
-    );
-  }
-  if (!input2.pushed) {
-    return unsettled(
-      "not_pushed",
-      `HEAD ${head} is not on any remote-tracking branch, so no CI run can have tested it`,
-      "push it, wait for CI to finish, and run dunstan template --tests-ci again (run git fetch first if it was pushed from elsewhere)."
-    );
-  }
-  const observed = { runsNotCompleted: 0 };
-  const evidence = await readTestRecord(client, repository, record2, head, observed);
-  const named = `the artifact ${record2.artifact} holding ${record2.path} from job ${record2.job}`;
-  const pending = observed.runsNotCompleted > 0 ? `CI has not finished: ${plural3(observed.runsNotCompleted, "run", "runs")} of ${record2.workflow} at ${head} ${observed.runsNotCompleted === 1 ? "is" : "are"} not completed` : void 0;
-  const again = "run dunstan template --tests-ci again once CI has finished on this commit.";
-  if (evidence.status !== "ok") {
-    const reason = evidence.status === "unreadable" ? `source_unreadable:${evidence.source}` : `evidence_field_unpopulated:${evidence.field}`;
-    if (pending !== void 0) return unsettled(reason, pending, again);
-    const why = reason === "source_unreadable:artifact" ? `a run of ${record2.workflow} at ${head} uploaded ${record2.artifact}, and it could not be read` : `the workflow runs of ${record2.workflow} at ${head} could not be read`;
-    return unsettled(
-      reason,
-      why,
-      remedyForReason(reason, { hasToken: true }) ?? "run dunstan template --tests-ci again."
-    );
-  }
-  if (evidence.runs.length === 0) {
-    if (pending !== void 0) {
-      return unsettled(
-        "record_not_found",
-        `${pending}, and no completed run uploaded ${named}`,
-        again
-      );
-    }
-    return unsettled(
-      "record_not_found",
-      `no run of ${record2.workflow} at ${head} uploaded ${named}`,
-      remedyForReason("record_not_found", { hasToken: true })
-    );
-  }
-  const executed = new Set(evidence.runs.map((r) => r.executed));
-  const failed = new Set(evidence.runs.map((r) => r.failed));
-  if (executed.size > 1 || failed.size > 1) {
-    const counts = evidence.runs.map((r) => `run ${r.runId}: ${r.executed} executed, ${r.failed} failed`).join("; ");
-    return unsettled(
-      "record_ambiguous",
-      `the runs of ${record2.workflow} at ${head} that uploaded ${record2.artifact} disagree (${counts}), and the gate never picks one`,
-      "make the runs agree (re-run the one that differs), or name a job only one of them runs."
-    );
-  }
-  const run = evidence.runs[0];
-  const runs = evidence.runs.map((r) => r.runId).join(", ");
-  const notes = [
-    `tests: ${run.executed} executed and ${run.failed} failed in ${record2.path} in the artifact ${record2.artifact} of job ${record2.job} in ${record2.workflow} at ${head}, read from CI as the gate reads it (${evidence.runs.length === 1 ? "run" : "runs"} ${runs}).`
-  ];
-  if (pending !== void 0) {
-    notes.push(
-      `${pending}; a run that finishes later with other counts makes the gate's read ambiguous. Run dunstan template --tests-ci again once CI has finished.`
-    );
-  }
-  return {
-    status: "settled",
-    run: { command: input2.command, count: run.executed, failures: run.failed, record: record2 },
-    notes
-  };
-}
-
-// src/cli/template.ts
 var RECORD_FLAGS = [
   "tests-workflow",
   "tests-job",
   "tests-artifact",
   "tests-artifact-path"
 ];
-var DEFAULT_ARTIFACT = "dunstan-junit";
-var DEFAULT_ARTIFACT_PATH = "junit.xml";
 async function template(args, io) {
   const { values } = parseArgs6({
     args,
@@ -44381,7 +44526,6 @@ async function template(args, io) {
   }
   if (flag("repo") !== void 0 && !ci) throw new UsageError("--repo goes with --tests-ci");
   const given = ["tests-command", ...RECORD_FLAGS].filter((f) => flag(f) !== void 0);
-  const cwd = io.cwd ?? process.cwd();
   let tests;
   if (ci) {
     const missing = ["tests-command", "tests-workflow", "tests-job"].filter(
@@ -44394,28 +44538,15 @@ async function template(args, io) {
     if (repo !== void 0 && !REPOSITORY.test(repo)) {
       throw new UsageError("--repo must be <owner/name>");
     }
-    const head = headCommit(cwd);
-    const repository = repo ?? originRepository(cwd);
-    const client = new GitHubClient({
-      token: io.env.GITHUB_TOKEN,
-      ...io.fetch === void 0 ? {} : { fetch: io.fetch },
-      warn: (message) => io.err(`dunstan: ${message}
-`)
-    });
-    const read = await testsFromCi(client, {
-      repository,
-      headCommit: head,
+    tests = {
+      from: "ci",
       command: flag("tests-command"),
-      pushed: isPushed(cwd, head),
-      record: {
-        kind: "junit",
-        workflow: flag("tests-workflow"),
-        job: flag("tests-job"),
-        artifact: flag("tests-artifact") ?? DEFAULT_ARTIFACT,
-        path: flag("tests-artifact-path") ?? DEFAULT_ARTIFACT_PATH
-      }
-    });
-    tests = { kind: "ci", read };
+      workflow: flag("tests-workflow"),
+      job: flag("tests-job"),
+      artifact: flag("tests-artifact"),
+      artifactPath: flag("tests-artifact-path"),
+      repository: repo
+    };
   } else if (flag("tests-local") !== void 0) {
     if (flag("tests-command") === void 0) {
       throw new UsageError("--tests-local needs --tests-command <cmd>");
@@ -44423,7 +44554,7 @@ async function template(args, io) {
     const extra = RECORD_FLAGS.find((f) => flag(f) !== void 0);
     if (extra !== void 0) throw new UsageError(`--${extra} does not go with --tests-local`);
     tests = {
-      kind: "local",
+      from: "local",
       junit: flag("tests-local"),
       command: flag("tests-command")
     };
@@ -44437,24 +44568,26 @@ async function template(args, io) {
       );
     }
     tests = {
-      kind: "junit",
+      from: "junit",
       junit: flag("tests-junit"),
       command: flag("tests-command"),
-      record: {
-        workflow: flag("tests-workflow"),
-        job: flag("tests-job"),
-        artifact: flag("tests-artifact"),
-        path: flag("tests-artifact-path")
-      }
+      workflow: flag("tests-workflow"),
+      job: flag("tests-job"),
+      artifact: flag("tests-artifact"),
+      artifactPath: flag("tests-artifact-path")
     };
   } else if (given.length > 0) {
     throw new UsageError(`--${given[0]} goes with --tests-ci, --tests-local or --tests-junit`);
   }
-  const t = templateBlock({ cwd, base: flag("base"), tests });
-  io.out(renderBlock(t.block));
-  for (const note of t.notes) io.err(`dunstan: ${note}
+  const run = await runTemplate(
+    { cwd: io.cwd ?? process.cwd(), base: flag("base"), tests },
+    { env: io.env, fetch: io.fetch, warn: (message) => io.err(`dunstan: ${message}
+`) }
+  );
+  io.out(run.fence);
+  for (const note of run.notes) io.err(`dunstan: ${note}
 `);
-  return tests?.kind === "ci" && tests.read.status === "unsettled" ? EXIT.unverifiable : 0;
+  return run.tests === "not_declared" ? EXIT.unverifiable : 0;
 }
 
 // src/cli/verify.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dunstan",
-  "version": "0.1.15",
+  "version": "0.1.16",
   "mcpName": "io.github.BargLabs/dunstan",
   "description": "Holds a coding agent's completion report to the record: deterministic checks of a declared handback block against the repository's own metadata.",
   "license": "AGPL-3.0-only",