@kindgi/cli 0.1.11-rc.0 → 0.2.0-rc.1

package/dist/commands/build.js

@@ -25,7 +25,7 @@
  */
 import { lstat, mkdir, readFile, readlink, realpath, stat, writeFile } from 'node:fs/promises';
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
-import { findKindgiConfig, resolveDiscovery, resolvePackEnv, } from '@kindgi/handler-runtime';
+import { codePatterns, findKindgiConfig, resolveDiscovery, resolvePackEnv, } from '@kindgi/handler-runtime';
 import { hostedApiAddress } from '../api-address.js';
 import { checkAptPackages } from '../build/apt.js';
 import { PACK_SERVICE_COMMAND } from '../build/containerfile.js';
@@ -37,6 +37,7 @@ import { readImageConfig } from '../build/image-config.js';
 import { checkIntegrity } from '../build/integrity.js';
 import { DEFAULT_JAVA_BUILD_IMAGE_REF, DEFAULT_JAVA_RUNTIME_IMAGE_REF, JAVA_PACK_SERVICE_COMMAND, collectJavaContextFiles, } from '../build/java-image.js';
 import { nodeBaseImageFor } from '../build/node-image.js';
+import { checkPackBlocks, packIndexerName } from '../build/pack-blocks.js';
 import { resolvePackRoots } from '../build/pack-root.js';
 import { DEFAULT_PYTHON_BASE_IMAGE_REF, DEFAULT_UV_IMAGE_REF, PYTHON_LOCKFILES, PYTHON_PACK_SERVICE_COMMAND, collectPythonContextFiles, } from '../build/python-image.js';
 import { DEFAULT_SCALA_BUILD_IMAGE_REF, SCALA_PACK_SERVICE_COMMAND, collectScalaContextFiles, } from '../build/scala-image.js';
@@ -44,7 +45,9 @@ import { resolvePackJava, resolvePackPython, resolvePackScala } from '../dev/pac
 import { renderJson } from '../output.js';
 import { loadPackConfig } from '../pack-config.js';
 import { isPackageVersion } from '../package-manager.js';
+import { progressLines } from '../progress-lines.js';
 import { isWait, sendWaitingOutRateLimits } from '../rate-limit-wait.js';
+import { CLI_VERSION } from '../version-info.js';
 import { timeFlagValue } from './helpers.js';
 /**
  * The project (id or slug) a pack config names for an environment, or
@@ -148,9 +151,13 @@ export const buildCommand = {
         },
         path: { type: 'string', description: 'The pack root. Default: the current directory.' },
     },
-    run: async (ctx) => runBuild(ctx),
+    run: async (ctx) => runBuild(ctx, progressLines(ctx.progress, ctx.globals.format === 'quiet')),
 };
-export async function runBuild(ctx) {
+/**
+ * `kindgi build`. `out` is where its lines go: the command's own, or
+ * `kindgi deploy`'s, for its inline build.
+ */
+export async function runBuild(ctx, out) {
     const runners = ctx.buildRunners;
     if (runners === undefined) {
         return {
@@ -165,11 +172,8 @@ export async function runBuild(ctx) {
         return parsed;
     const args = parsed.args;
     if (args.local)
-        return runLocalBuild(ctx, runners, args);
-    const banner = [];
-    const lines = (s) => {
-        banner.push(s);
-    };
+        return runLocalBuild(ctx, runners, args, out);
+    const lines = out.line;
     lines('');
     lines(`  Environment: ${args.envName}`);
     lines(`  Build:       ${args.hosted ? `hosted (${args.endpoint})` : args.endpoint}`);
@@ -181,16 +185,16 @@ export async function runBuild(ctx) {
     // ---- 1. Local indexer pass ------------------------------------------
     const expectedIndexPath = join(args.outDir, 'expected-index.json');
     await mkdir(args.outDir, { recursive: true });
-    const prepared = await prepareTarball(ctx, runners, args, expectedIndexPath, lines);
+    const prepared = await prepareTarball(ctx, runners, args, expectedIndexPath, out);
     if (prepared.kind === 'error')
-        return prepared;
+        return withBanner(prepared, out);
     const { tarball, tarballHash, counts } = prepared;
     lines('');
     // ---- 6. POST /v1/build + SSE stream ---------------------------------
     if (args.hosted) {
         const tooLarge = hostedUploadTooLarge(tarball.bytes.length);
         if (tooLarge !== undefined)
-            return failure(tooLarge);
+            return withBanner(failure(tooLarge), out);
     }
     const packId = args.config.pack?.id;
     lines('  Uploading to build service');
@@ -225,7 +229,7 @@ export async function runBuild(ctx) {
         : undefined);
     if ('thrown' in sent) {
         if (sent.thrown instanceof BuildServiceRefusal) {
-            return failure(describeBuildRefusal(sent.thrown));
+            return withBanner(failure(describeBuildRefusal(sent.thrown)), out);
         }
         throw sent.thrown;
     }
@@ -257,19 +261,19 @@ export async function runBuild(ctx) {
         }
         catch (err) {
             if (err instanceof BuildServiceRefusal) {
-                return failure(describeBuildRefusal(err));
+                return withBanner(failure(describeBuildRefusal(err)), out);
             }
-            return failure(`${err.message}\n`);
+            return withBanner(failure(`${err.message}\n`), out);
         }
     }
     if (terminal.status === 'failed') {
-        return failure(`Build failed: [${terminal.error?.code ?? 'unknown'}] ${terminal.error?.message ?? 'no message'}\n`);
+        return withBanner(failure(`Build failed: [${terminal.error?.code ?? 'unknown'}] ${terminal.error?.message ?? 'no message'}\n`), out);
     }
     if (terminal.imageRef === undefined ||
         terminal.imageDigest === undefined ||
         terminal.indexJson === undefined ||
         terminal.indexHash === undefined) {
-        return failure('Build terminal payload missing required fields (imageRef / imageDigest / indexJson / indexHash).\n');
+        return withBanner(failure('Build terminal payload missing required fields (imageRef / imageDigest / indexJson / indexHash).\n'), out);
     }
     lines(`    ✓ Build complete (${terminal.imageRef})`);
     for (const line of closureSummary(captured))
@@ -281,14 +285,14 @@ export async function runBuild(ctx) {
     let serverBytes;
     lines('  Verifying build output');
     if (args.skipIntegrityGate) {
-        lines('    ⚠ Integrity gate SKIPPED — --skip-integrity-gate. Signature will attest to');
-        lines('      the server-reported hash without local re-verification. NOT RECOMMENDED.');
+        out.problem('    ⚠ Integrity gate SKIPPED — --skip-integrity-gate. Signature will attest to');
+        out.problem('      the server-reported hash without local re-verification. NOT RECOMMENDED.');
     }
     else {
         if (args.skipImagePull || runners.pullImageIndex === undefined) {
-            lines('    ⚠ Image pull SKIPPED — hash-only comparison. Byte-diff path unavailable');
-            lines('      (requires Docker). CI environments where this is expected can safely');
-            lines('      omit --skip-image-pull warnings.');
+            out.problem('    ⚠ Image pull SKIPPED — hash-only comparison. Byte-diff path unavailable');
+            out.problem('      (requires Docker). CI environments where this is expected can safely');
+            out.problem('      omit --skip-image-pull warnings.');
         }
         else {
             try {
@@ -301,8 +305,8 @@ export async function runBuild(ctx) {
                 serverBytes = pulled.bytes;
             }
             catch (err) {
-                lines(`    ⚠ docker pull failed: ${err.message}`);
-                lines('      Falling back to hash-only comparison.');
+                out.problem(`    ⚠ docker pull failed: ${err.message}`);
+                out.problem('      Falling back to hash-only comparison.');
             }
         }
         const check = checkIntegrity({
@@ -312,7 +316,7 @@ export async function runBuild(ctx) {
             ...(serverBytes !== undefined && { serverBytes }),
         });
         if (!check.ok) {
-            return failure(`Integrity gate FAILED — refusing to sign.\n\n${check.reason ?? 'unknown reason'}\n`);
+            return withBanner(failure(`Integrity gate FAILED — refusing to sign.\n\n${check.reason ?? 'unknown reason'}\n`), out);
         }
         lines(`    ✓ indexHash matches local indexer output (${terminal.indexHash.slice(0, 14)}…)`);
         if (serverBytes !== undefined) {
@@ -321,7 +325,7 @@ export async function runBuild(ctx) {
     }
     lines('');
     // ---- 8. Sign + 9. emit deploy-envelope.json ------------------------------
-    const written = await signAndWriteEnvelope(runners, args, lines, {
+    const written = await signAndWriteEnvelope(runners, args, out, {
         imageRef: terminal.imageRef,
         imageDigest: terminal.imageDigest,
         index: terminal.indexJson,
@@ -329,7 +333,7 @@ export async function runBuild(ctx) {
         ...(terminal.buildLogsUrl !== undefined && { buildLogsUrl: terminal.buildLogsUrl }),
     });
     if (written.kind === 'error')
-        return written;
+        return withBanner(written, out);
     const { envelopePath, signature } = written;
     const summary = {
         envName: args.envName,
@@ -349,10 +353,7 @@ export async function runBuild(ctx) {
         imagePullSkipped: args.skipImagePull || runners.pullImageIndex === undefined,
     };
     const rendered = renderJson(summary, ctx.globals.format);
-    return {
-        kind: 'ok',
-        rendered: { stdout: rendered.stdout, stderr: `${banner.join('\n')}\n` },
-    };
+    return { kind: 'ok', rendered: { stdout: rendered.stdout, stderr: out.kept() } };
 }
 // ---------------------------------------------------------------------
 // --local: build with this machine's Docker
@@ -367,14 +368,11 @@ export async function runBuild(ctx) {
  * `--push`, the image goes to the registry, and is signed into an
  * envelope for `kindgi deploy`.
  */
-async function runLocalBuild(ctx, runners, args) {
+async function runLocalBuild(ctx, runners, args, out) {
     if (runners.dockerBuild === undefined || runners.pullImageIndex === undefined) {
         return failure('kindgi build --local needs Docker runners; rebuild the CLI.\n');
     }
-    const banner = [];
-    const lines = (s) => {
-        banner.push(s);
-    };
+    const lines = out.line;
     const pushTo = args.pushRepository;
     lines('');
     lines(pushTo !== undefined
@@ -385,9 +383,9 @@ async function runLocalBuild(ctx, runners, args) {
     lines(`  Output:      ${args.outDir}`);
     const expectedIndexPath = join(args.outDir, 'expected-index.json');
     await mkdir(args.outDir, { recursive: true });
-    const context = await preparePackContext(ctx, runners, args, expectedIndexPath, lines);
+    const context = await preparePackContext(ctx, runners, args, expectedIndexPath, out);
     if (context.kind === 'error')
-        return withBanner(context, banner);
+        return withBanner(context, out);
     const expectedBytes = new Uint8Array(await readFile(expectedIndexPath));
     const packId = JSON.parse(new TextDecoder().decode(expectedBytes))
         .packId;
@@ -408,11 +406,11 @@ async function runLocalBuild(ctx, runners, args) {
         },
     });
     if (built.kind === 'err')
-        return withBanner(failure(`Image build failed: ${built.message}\n`), banner);
+        return withBanner(failure(`Image build failed: ${built.message}\n`), out);
     for (const line of closureSummary(buildLog))
         lines(line);
     if (pushTo !== undefined && built.digest === undefined) {
-        return withBanner(failure(`The push of ${tag} reported no digest.\n`), banner);
+        return withBanner(failure(`The push of ${tag} reported no digest.\n`), out);
     }
     // Pushed: the image is the registry's, by digest; loaded: the local tag.
     const imageRef = pushTo !== undefined ? `${pushTo}@${built.digest}` : tag;
@@ -436,19 +434,19 @@ async function runLocalBuild(ctx, runners, args) {
         serverBytes: pulled.bytes,
     });
     if (!check.ok) {
-        return withBanner(failure(`Integrity gate FAILED: the image's index isn't the local one.\n\n${check.reason ?? ''}\n`), banner);
+        return withBanner(failure(`Integrity gate FAILED: the image's index isn't the local one.\n\n${check.reason ?? ''}\n`), out);
     }
     lines('    ✓ /app/index.json in the image matches the local index byte for byte');
     lines('');
     if (pushTo !== undefined && built.digest !== undefined) {
-        const written = await signAndWriteEnvelope(runners, args, lines, {
+        const written = await signAndWriteEnvelope(runners, args, out, {
             imageRef,
             imageDigest: built.digest,
             index: JSON.parse(new TextDecoder().decode(expectedBytes)),
             indexHash: expectedHash,
         });
         if (written.kind === 'error')
-            return withBanner(written, banner);
+            return withBanner(written, out);
         const rendered = renderJson({
             envName: args.envName,
             envelopePath: written.envelopePath,
@@ -463,7 +461,7 @@ async function runLocalBuild(ctx, runners, args) {
             ...(written.signature !== undefined && { signerKeyId: written.signature.keyId }),
             local: true,
         }, ctx.globals.format);
-        return { kind: 'ok', rendered: { stdout: rendered.stdout, stderr: `${banner.join('\n')}\n` } };
+        return { kind: 'ok', rendered: { stdout: rendered.stdout, stderr: out.kept() } };
     }
     lines('  Run it:');
     lines(`    docker run --rm -p 8080:8080 -e KINDGI_PACK_SERVICE_TOKEN=<token> --env-file <the pack's env> ${tag}`);
@@ -485,18 +483,19 @@ async function runLocalBuild(ctx, runners, args) {
         indexCounts: context.counts,
         local: true,
     }, ctx.globals.format);
-    return { kind: 'ok', rendered: { stdout: rendered.stdout, stderr: `${banner.join('\n')}\n` } };
+    return { kind: 'ok', rendered: { stdout: rendered.stdout, stderr: out.kept() } };
 }
 /**
  * Sign the image (Ed25519 over imageDigest, artifactVersion, indexHash,
  * tenantId, publishedAt) and write `deploy-envelope.json` for
  * `kindgi deploy`: the build service's path and `--local --push` alike.
  */
-async function signAndWriteEnvelope(runners, args, lines, image) {
+async function signAndWriteEnvelope(runners, args, out, image) {
+    const lines = out.line;
     let signature;
     if (args.skipSign) {
-        lines('  ⚠ Signing SKIPPED — --skip-sign. Emitted envelope is unsigned; deploy will refuse');
-        lines('    it. Use only for CI that signs elsewhere.');
+        out.problem('  ⚠ Signing SKIPPED — --skip-sign. Emitted envelope is unsigned; deploy will refuse');
+        out.problem('    it. Use only for CI that signs elsewhere.');
     }
     else if (args.signingKeyPath === undefined) {
         return failure(noSigningKey(undefined));
@@ -535,17 +534,17 @@ async function signAndWriteEnvelope(runners, args, lines, image) {
     lines('');
     return { kind: 'ok', envelopePath, signature };
 }
-/** A failure that still shows what the build did up to it. */
-function withBanner(result, banner) {
-    return { ...result, stderr: `${banner.join('\n')}\n${result.stderr}` };
+/** A failure that still shows what the build did up to it (the lines kept, when not streamed). */
+function withBanner(result, out) {
+    return { ...result, stderr: `${out.kept()}${result.stderr}` };
 }
 /** The pack's image context, by the pack's language. */
-function preparePackContext(ctx, runners, args, expectedIndexPath, lines) {
+function preparePackContext(ctx, runners, args, expectedIndexPath, out) {
     if (args.language === 'java' || args.language === 'scala')
-        return prepareJvmContext(ctx, runners, args, args.language, expectedIndexPath, lines);
+        return prepareJvmContext(ctx, runners, args, args.language, expectedIndexPath, out);
     return args.language === 'python'
-        ? preparePythonContext(ctx, runners, args, expectedIndexPath, lines)
-        : prepareNodeContext(runners, args, expectedIndexPath, lines);
+        ? preparePythonContext(ctx, runners, args, expectedIndexPath, out)
+        : prepareNodeContext(runners, args, expectedIndexPath, out);
 }
 /**
  * A pnpm install with no `packageManager` gets the host's pnpm version:
@@ -580,7 +579,8 @@ async function withHostPnpm(runners, install) {
  * base image, the bundles, the local index over them, the Containerfile,
  * and the build context (`<out>/context`).
  */
-async function prepareNodeContext(runners, args, expectedIndexPath, lines) {
+async function prepareNodeContext(runners, args, expectedIndexPath, out) {
+    const lines = out.line;
     const hostInstall = await resolveHostInstall(args.packDir);
     if (hostInstall.kind === 'err')
         return failure(`${hostInstall.message}\n`);
@@ -643,7 +643,8 @@ async function prepareNodeContext(runners, args, expectedIndexPath, lines) {
     const dependencies = dependenciesStep(image, bundle.computedImports, args.packDir);
     if (dependencies.kind === 'refuse')
         return failure(dependencies.message);
-    lines(dependencies.lines.join('\n'));
+    lines(dependencies.mode);
+    warn(out, dependencies.warnings);
     // Only what the pack loads: the install cut down to it, or the full one trimmed after, and why.
     let imageInstall = install;
     let trimmedBecause;
@@ -677,9 +678,12 @@ async function prepareNodeContext(runners, args, expectedIndexPath, lines) {
             .map((e) => `  [${e.code}] ${e.message}`)
             .join('\n')}\n`);
     }
+    const blocks = await checkBuildBlocks(args, localIndex.counts, expectedIndexPath);
+    if (blocks.kind === 'err')
+        return failure(`${blocks.message}\n`);
     lines(`    ✓ ${localIndex.counts.tools} tools, ${localIndex.counts.guardrails} guardrails, ` +
-        `${localIndex.counts.agents} agents, ${localIndex.counts.flows} flows indexed`);
-    printIndexWarnings(localIndex, lines);
+        `${localIndex.counts.agents} agents, ${localIndex.counts.flows} flows${blocksCounted(localIndex.counts)} indexed`);
+    printIndexWarnings(localIndex, out.problem);
     // ---- 3. Containerfile + context --------------------------------------
     const containerfilePath = join(args.outDir, 'Containerfile');
     await runners.writeContainerfile({
@@ -691,6 +695,7 @@ async function prepareNodeContext(runners, args, expectedIndexPath, lines) {
         install: imageInstall,
         image,
         hasIncludes: includeFiles.files.length > 0,
+        hasBlocks: blocks.files.length > 0,
     });
     const contextDir = join(args.outDir, 'context');
     await runners.writeContext({
@@ -701,14 +706,16 @@ async function prepareNodeContext(runners, args, expectedIndexPath, lines) {
         containerfilePath,
         includes: includeFiles.files,
         extensionFiles: image.contextFiles,
+        blockFiles: blocks.files,
     });
-    lines(`    ✓ Context: ${imageInstall.files.length} install file(s), the bundles${includeFiles.files.length > 0 ? `, ${includeFiles.files.length} bundle.include file(s)` : ''}; no pack source`);
+    lines(`    ✓ Context: ${imageInstall.files.length} install file(s), the bundles${includeFiles.files.length > 0 ? `, ${includeFiles.files.length} bundle.include file(s)` : ''}${blocks.files.length > 0 ? `, ${blocks.files.length} block file(s) for the indexer` : ''}; no pack source`);
     if (install.secrets.length > 0) {
         lines(`    ✓ ${install.secrets.map((s) => s.file).join(', ')}: read by the install as a build secret, never in the image`);
     }
     lines(installLine(imageInstall, image.steps, trimmedBecause));
     for (const line of skippedScriptLines(install.skippedScripts))
         lines(line);
+    warn(out, patchPackageWarnings(install.skippedScripts));
     const secrets = install.secrets.map((secret) => ({
         id: secret.id,
         src: join(install.root, secret.file),
@@ -737,30 +744,34 @@ export function installLine(install, steps, trimmedBecause) {
         ? `    ✓ Install: ${what}`
         : `    ✓ Install: ${what}, then trimmed to what the pack loads\n      It downloads the app's whole install first, since ${trimmedBecause}.`;
 }
-/**
- * What the image leaves out of the app's own install scripts, and what
- * to do when one of them is something the image needs: `patch-package`
- * (pnpm's own patches are applied by the install).
- */
+/** What the image leaves out of the app's own install scripts. */
 export function skippedScriptLines(skipped) {
     if (skipped.length === 0)
         return [];
-    const where = (s) => s.manifest === 'package.json' ? s.name : `${s.manifest} ${s.name}`;
-    const lines = [
-        `    ✓ The app's own install scripts don't run in the image: ${skipped.map((s) => `${where(s)} (\`${s.command}\`)`).join(', ')}`,
+    return [
+        `    ✓ The app's own install scripts don't run in the image: ${skipped.map((s) => `${scriptWhere(s)} (\`${s.command}\`)`).join(', ')}`,
     ];
-    for (const s of skipped.filter((s) => /\bpatch-package\b/.test(s.command))) {
-        lines.push(`    ⚠ ${where(s)} runs patch-package, so its patches aren't applied in the image. Apply them with a build step: defineBuildExtension({ name: 'patch-package', contextFiles: [<each file in patches/>], postInstall: [{ bin: 'patch-package' }] }) in image.extensions (@kindgi/sdk/build). With pnpm, pnpm patch applies them in the install itself.`);
-    }
-    return lines;
+}
+/**
+ * What to do when a skipped script is something the image needs:
+ * `patch-package` (pnpm's own patches are applied by the install). A
+ * warning each, after `skippedScriptLines`.
+ */
+export function patchPackageWarnings(skipped) {
+    return skipped
+        .filter((s) => /\bpatch-package\b/.test(s.command))
+        .map((s) => `    ⚠ ${scriptWhere(s)} runs patch-package, so its patches aren't applied in the image. Apply them with a build step: defineBuildExtension({ name: 'patch-package', contextFiles: [<each file in patches/>], postInstall: [{ bin: 'patch-package' }] }) in image.extensions (@kindgi/sdk/build). With pnpm, pnpm patch applies them in the install itself.`);
+}
+function scriptWhere(s) {
+    return s.manifest === 'package.json' ? s.name : `${s.manifest} ${s.name}`;
 }
 /** A pack's context, tarred for the build service. */
-async function prepareTarball(ctx, runners, args, expectedIndexPath, lines) {
-    const context = await preparePackContext(ctx, runners, args, expectedIndexPath, lines);
+async function prepareTarball(ctx, runners, args, expectedIndexPath, out) {
+    const context = await preparePackContext(ctx, runners, args, expectedIndexPath, out);
     if (context.kind === 'error')
         return context;
     if (context.secrets.length > 0) {
-        lines(`    ⚠ The build service gets no build secrets: an install that needs ${context.secrets.map((s) => s.file).join(', ')} (a private registry) fails there. \`kindgi build --local\` passes them.`);
+        out.problem(`    ⚠ The build service gets no build secrets: an install that needs ${context.secrets.map((s) => s.file).join(', ')} (a private registry) fails there. \`kindgi build --local\` passes them.`);
     }
     const tarballPath = join(args.outDir, 'pack.tgz');
     const tarball = await runners.tarPack({
@@ -768,7 +779,7 @@ async function prepareTarball(ctx, runners, args, expectedIndexPath, lines) {
         outputPath: tarballPath,
     });
     const tarballHash = await sha256Hex(tarball.bytes);
-    lines(`    ✓ Emitted ${tarballPath} (${humanBytes(tarball.size)}, ${tarballHash.slice(0, 14)}…)`);
+    out.line(`    ✓ Emitted ${tarballPath} (${humanBytes(tarball.size)}, ${tarballHash.slice(0, 14)}…)`);
     return { kind: 'ok', tarball, tarballHash, counts: context.counts };
 }
 /**
@@ -776,7 +787,8 @@ async function prepareTarball(ctx, runners, args, expectedIndexPath, lines) {
  * Containerfile (`build/python-image.ts`), the pack root as the context
  * (`<out>/context`).
  */
-async function preparePythonContext(ctx, runners, args, expectedIndexPath, lines) {
+async function preparePythonContext(ctx, runners, args, expectedIndexPath, out) {
+    const lines = out.line;
     const python = runners.python;
     if (python === undefined)
         return failure('This CLI cannot build Python packs (no Python build runners).\n');
@@ -805,10 +817,13 @@ async function preparePythonContext(ctx, runners, args, expectedIndexPath, lines
             .map((e) => `  [${e.code}] ${e.message}`)
             .join('\n')}\n`);
     }
+    const blocks = await checkBuildBlocks(args, localIndex.counts, expectedIndexPath);
+    if (blocks.kind === 'err')
+        return failure(`${blocks.message}\n`);
     lines(`  Indexing (Python — ${interpreter.value.join(' ')})`);
     lines(`    ✓ ${localIndex.counts.tools} tools, ${localIndex.counts.guardrails} guardrails, ` +
-        `${localIndex.counts.agents} agents, ${localIndex.counts.flows} flows discovered`);
-    printIndexWarnings(localIndex, lines);
+        `${localIndex.counts.agents} agents, ${localIndex.counts.flows} flows${blocksCounted(localIndex.counts)} discovered`);
+    printIndexWarnings(localIndex, out.problem);
     const packFiles = await collectPythonContextFiles(args.packDir);
     if (packFiles.kind === 'error')
         return failure(`${packFiles.message}\n`);
@@ -848,7 +863,8 @@ async function preparePythonContext(ctx, runners, args, expectedIndexPath, lines
  * (`build/java-image.ts`, `build/scala-image.ts`), the pack root as the
  * context (`<out>/context`).
  */
-async function prepareJvmContext(ctx, runners, args, language, expectedIndexPath, lines) {
+async function prepareJvmContext(ctx, runners, args, language, expectedIndexPath, out) {
+    const lines = out.line;
     const java = runners.jvm;
     const name = language === 'java' ? 'Java' : 'Scala';
     if (java === undefined)
@@ -894,11 +910,14 @@ async function prepareJvmContext(ctx, runners, args, language, expectedIndexPath
         ...(declared.value?.required ?? []),
         ...(declared.value?.optional ?? []),
     ].sort();
+    const blocks = await checkBuildBlocks(args, localIndex.counts, expectedIndexPath);
+    if (blocks.kind === 'err')
+        return failure(`${blocks.message}\n`);
     const tool = code.language === 'java' ? code.maven : code.sbt;
     lines(`  Indexing (${name} — ${code.javaHome ?? code.java}; ${tool.join(' ')})`);
     lines(`    ✓ ${localIndex.counts.tools} tools, ${localIndex.counts.guardrails} guardrails, ` +
-        `${localIndex.counts.agents} agents, ${localIndex.counts.flows} flows discovered`);
-    printIndexWarnings(localIndex, lines);
+        `${localIndex.counts.agents} agents, ${localIndex.counts.flows} flows${blocksCounted(localIndex.counts)} discovered`);
+    printIndexWarnings(localIndex, out.problem);
     const packFiles = language === 'java'
         ? await collectJavaContextFiles(args.packDir)
         : await collectScalaContextFiles(args.packDir);
@@ -1307,12 +1326,35 @@ function renderExternalsSummary(externals) {
  * esbuild bundler to walk. Handles both shapes:
  *
  *   discovery: { tools: 'tools/**\/*.ts', ... }     →  ['tools', ...]
- *   discovery: { tools: 'kindgi/tools/** The config's discovery patterns with defaults filled in — what the indexer uses. */
+ *   discovery: { tools: 'kindgi/tools/**
+ * The config's code discovery patterns with defaults filled in — the
+ * files the indexer loads, and so the bundler's entries. Not the blocks
+ * pattern: blocks are data, read from the pack's files.
+ */
 export function discoveryPatternsOf(config) {
+    return codePatterns(discoveryOf(config));
+}
+/** The config's discovery with the defaults for the pack's language filled in. */
+function discoveryOf(config, language) {
     const discovery = config.discovery;
-    return Object.values(resolveDiscovery(typeof discovery === 'object' && discovery !== null
+    return resolveDiscovery(typeof discovery === 'object' && discovery !== null
         ? discovery
-        : undefined));
+        : undefined, language);
+}
+/** The pack's blocks after its local index (`checkPackBlocks`), in every language. */
+function checkBuildBlocks(args, counts, indexPath) {
+    return checkPackBlocks({
+        packDir: args.packDir,
+        pattern: discoveryOf(args.config, args.language).blocks,
+        indexPath,
+        blocksCounted: counts.blocks !== undefined,
+        indexer: packIndexerName(args.language),
+        release: CLI_VERSION,
+    });
+}
+/** `, 2 blocks` for the indexed line, when the pack has any. */
+function blocksCounted(counts) {
+    return counts.blocks !== undefined && counts.blocks > 0 ? `, ${counts.blocks} blocks` : '';
 }
 /**
  * An unpinned build's artifact version and publish time, from one clock
@@ -1353,10 +1395,15 @@ async function isFile(path) {
         return false;
     }
 }
+/** Each of `warnings`, a line each: said under `--quiet` too. */
+function warn(out, warnings) {
+    for (const w of warnings)
+        out.problem(w);
+}
 /** The indexer's warnings, a line each: what the pack should change, though it builds as it is. */
-function printIndexWarnings(result, lines) {
+function printIndexWarnings(result, problem) {
     for (const w of result.warnings ?? [])
-        lines(`    ⚠ ${w.message}`);
+        problem(`    ⚠ ${w.message}`);
 }
 /** The image's dependencies, as the build says them (`image.dependencies`). */
 function renderDependenciesMode(image) {
@@ -1366,13 +1413,13 @@ function renderDependenciesMode(image) {
     const kept = [...image.keep, ...image.keepIfInstalled];
     return `    ✓ Dependencies: only what the pack loads (image.dependencies: 'loaded')${kept.length > 0 ? `, and ${kept.join(', ')}` : ''}`;
 }
-/** The image's dependencies, said, and with `'loaded'` the computed-import check. */
+/** The image's dependencies, said, and with `'loaded'` the computed-import check's warnings. */
 function dependenciesStep(image, computed, packDir) {
     const mode = renderDependenciesMode(image);
     if (image.dependencies === 'all')
-        return { kind: 'ok', lines: [mode] };
+        return { kind: 'ok', mode, warnings: [] };
     const check = computedImportsCheck(computed ?? [], image.keep, packDir);
-    return check.kind === 'refuse' ? check : { kind: 'ok', lines: [mode, ...check.lines] };
+    return check.kind === 'refuse' ? check : { kind: 'ok', mode, warnings: check.lines };
 }
 /**
  * With `'loaded'`: a computed `require(x)` / `import(x)` in the pack's