@valbuild/cli 0.147.0 → 0.148.0

package/cli/dist/valbuild-cli-cli.esm.js

@@ -4,9 +4,9 @@ import path from 'path';
 import pc from 'picocolors';
 import { glob } from 'fast-glob';
 import { Internal, DEFAULT_VAL_REMOTE_HOST, DEFAULT_CONTENT_HOST } from '@valbuild/core';
-import { createPrettierFormatter, createService, createValModuleFileInspector, fixHandlers, createFixPatch, getModulePathRange, findJsonEntryFilePath, createJsonEntryPathMap, createModulePathMap, findAndEvalValConfigFile, getSettings, uploadRemoteFile, createDefaultValFSHost, filesOfVideo, startValLogin, awaitValLoginConfirmation, persistPersonalAccessToken, ValLoginError, loadValModules, safeReadGit, ValOpsHttp, ValOpsFS, getPersonalAccessTokenPath, parsePersonalAccessTokenFile, formatPatchSourceError, APP_MODE_REQUIRES_REMOTE_FILES } from '@valbuild/server';
+import { createPrettierFormatter, askOncePerHost, createService, createValModuleFileInspector, fixHandlers, createFixPatch, getModulePathRange, findJsonEntryFilePath, createJsonEntryPathMap, createModulePathMap, findAndEvalValConfigFile, getSettings, uploadRemoteFile, createDefaultValFSHost, filesOfVideo, startValLogin, awaitValLoginConfirmation, persistPersonalAccessToken, ValLoginError, loadValModules, safeReadGit, ValOpsHttp, ValOpsFS, getPersonalAccessTokenPath, parsePersonalAccessTokenFile, formatPatchSourceError, APP_MODE_REQUIRES_REMOTE_FILES } from '@valbuild/server';
 import fs from 'fs/promises';
-import { resolveSchemaSourceFixes, traverseSchemaSource, parseBuildTarget, parseDeclare, parseArtifacts, parseVerify, parsePromote, parseStatus, parsePublishToken, PublishProtocolError, parseProblems } from '@valbuild/shared/internal';
+import { resolveSchemaSourceFixes, isRepairedOnSave, traverseSchemaSource, parseBuildTarget, parseDeclare, parseArtifacts, parseVerify, parsePromote, parseStatus, parsePublishToken, PublishProtocolError, parseProblems } from '@valbuild/shared/internal';
 import fs$1 from 'fs';
 import ts from 'typescript';
 import { spawn } from 'child_process';
@@ -96,6 +96,10 @@ async function* runValidation({
   fs
 }) {
   const projectRoot = path.resolve(root);
+  // One question per platform host for the whole run: each error is fixed by
+  // its own createFixPatch call, and a host that does not answer would
+  // otherwise cost a timeout per ref.
+  const askHostProject = askOncePerHost();
   const service = await createService(projectRoot, fs);
 
   // Modules registered in the project's val.modules. Files found on disk that
@@ -292,6 +296,9 @@ async function* runValidation({
                   message: result.errorMessage ?? "Unknown error",
                   ...(v.keyError ? {
                     keyError: true
+                  } : {}),
+                  ...(isRepairedOnSave(v) ? {
+                    repairedOnSave: true
                   } : {})
                 };
                 fileErrors += 1;
@@ -313,6 +320,9 @@ async function* runValidation({
                   fixable: true,
                   ...(v.keyError ? {
                     keyError: true
+                  } : {}),
+                  ...(isRepairedOnSave(v) ? {
+                    repairedOnSave: true
                   } : {})
                 };
               }
@@ -321,7 +331,8 @@ async function* runValidation({
               if (result.shouldApplyPatch) {
                 const fixPatch = await createFixPatch({
                   projectRoot,
-                  remoteHost: remote.remoteHost
+                  remoteHost: remote.remoteHost,
+                  askHostProject
                 }, !!fix, sourcePath, v, remoteFiles, valModule.source, valModule.schema);
                 if (fix && fixPatch !== null && fixPatch !== void 0 && fixPatch.patch && (fixPatch === null || fixPatch === void 0 ? void 0 : fixPatch.patch.length) > 0) {
                   await service.patch(moduleFilePath, fixPatch.patch);
@@ -351,6 +362,9 @@ async function* runValidation({
                     fixable: true,
                     ...(v.keyError ? {
                       keyError: true
+                    } : {}),
+                    ...(isRepairedOnSave(v) ? {
+                      repairedOnSave: true
                     } : {})
                   };
                 }
@@ -365,6 +379,9 @@ async function* runValidation({
                     fixable: !!(e.fixes && e.fixes.length),
                     ...(e.keyError ? {
                       keyError: true
+                    } : {}),
+                    ...(isRepairedOnSave(e) ? {
+                      repairedOnSave: true
                     } : {})
                   };
                 }
@@ -643,255 +660,273 @@ async function validate({
   } catch {
     console.log("Prettier not found, skipping formatting");
   }
+  const runOnce = () => validateOnce({
+    projectRoot,
+    fix: !!fix,
+    prettier
+  });
+  if (!watch) {
+    const totalErrors = await runOnce();
+    if (totalErrors > 0) {
+      process.exit(1);
+    }
+    return;
+  }
+  await watchAndValidate(projectRoot, runOnce);
+}
 
-  // Runs a single validation pass over the project and returns the number of
-  // errors found. Re-reads config and val files each call so it always reflects
-  // the latest state on disk (used both for one-shot and watch mode).
-  async function runOnce() {
-    const valConfigFile = await findAndEvalValConfigFile(projectRoot);
-    const resolvedValConfigFile = valConfigFile ? {
-      ...valConfigFile,
-      project: process.env.VAL_PROJECT || valConfigFile.project
-    } : process.env.VAL_PROJECT ? {
-      project: process.env.VAL_PROJECT
-    } : undefined;
-    console.log(pc.greenBright(`Validating project${resolvedValConfigFile !== null && resolvedValConfigFile !== void 0 && resolvedValConfigFile.project ? ` '${pc.inverse(resolvedValConfigFile.project)}'` : ""}...`));
-    const valFiles = await glob("**/*.val.{js,ts}", {
-      ignore: ["node_modules/**"],
-      cwd: projectRoot
-    });
-    console.log(pc.greenBright(`Found ${valFiles.length} files...`));
-    const fixedFiles = new Set();
-    let totalErrors = 0;
+/**
+ * One validation pass over the project, printed as `val validate` prints it,
+ * returning the number of errors found.
+ *
+ * Re-reads config and val files on each call so it always reflects the latest
+ * state on disk: `val validate` calls it once or on every change (`--watch`),
+ * and `val publish` calls it before it builds anything.
+ */
+async function validateOnce({
+  projectRoot,
+  fix,
+  prettier,
+  blockingOnly = false
+}) {
+  const valConfigFile = await findAndEvalValConfigFile(projectRoot);
+  const resolvedValConfigFile = valConfigFile ? {
+    ...valConfigFile,
+    project: process.env.VAL_PROJECT || valConfigFile.project
+  } : process.env.VAL_PROJECT ? {
+    project: process.env.VAL_PROJECT
+  } : undefined;
+  console.log(pc.greenBright(`Validating project${resolvedValConfigFile !== null && resolvedValConfigFile !== void 0 && resolvedValConfigFile.project ? ` '${pc.inverse(resolvedValConfigFile.project)}'` : ""}...`));
+  const valFiles = await glob("**/*.val.{js,ts}", {
+    ignore: ["node_modules/**"],
+    cwd: projectRoot
+  });
+  console.log(pc.greenBright(`Found ${valFiles.length} files...`));
+  const fixedFiles = new Set();
+  let totalErrors = 0;
+  let repairedOnSave = 0;
 
-    // Caches each val file's parsed source so files are read/parsed at most once
-    // per pass when resolving sourcePaths to file locations and code frames.
-    const sourceFileCache = new Map();
+  // Caches each val file's parsed source so files are read/parsed at most once
+  // per pass when resolving sourcePaths to file locations and code frames.
+  const sourceFileCache = new Map();
 
-    // Diagnostics are buffered per module (keyed by relative file path) so we can
-    // render them grouped and prioritised after the run, rather than streaming
-    // them out interleaved. Transient progress (remote/fix-applied) still streams
-    // live below.
-    const reports = new Map();
-    const valid = [];
-    const skipped = [];
+  // Diagnostics are buffered per module (keyed by relative file path) so we can
+  // render them grouped and prioritised after the run, rather than streaming
+  // them out interleaved. Transient progress (remote/fix-applied) still streams
+  // live below.
+  const reports = new Map();
+  const valid = [];
+  const skipped = [];
 
-    // Relative file path (no leading slash), matching the code frame's
-    // relativeFile so headers, diagnostics and frames all agree.
-    const relFile = file => file.replace(/^\//, "");
-    // The module a sourcePath/file belongs to is the part before the `?p=...`.
-    const moduleOf = sourcePathOrFile => relFile(sourcePathOrFile.split("?")[0]);
-    const reportFor = file => {
-      const key = relFile(file);
-      let report = reports.get(key);
-      if (!report) {
-        report = {
-          file: key,
-          durationMs: 0,
-          diagnostics: []
-        };
-        reports.set(key, report);
-      }
-      return report;
-    };
-    for await (const event of runValidation({
-      root: projectRoot,
-      fix: !!fix,
-      valFiles,
-      project: resolvedValConfigFile === null || resolvedValConfigFile === void 0 ? void 0 : resolvedValConfigFile.project,
-      remote: {
-        remoteHost: process.env.VAL_REMOTE_HOST || DEFAULT_VAL_REMOTE_HOST,
-        getSettings: (projectName, options) => getSettings(projectName, options),
-        uploadFile: (project, bucket, fileHash, fileExt, fileBuffer, options) => uploadRemoteFile(process.env.VAL_CONTENT_URL || DEFAULT_CONTENT_HOST, project, bucket, fileHash, fileExt ?? "", fileBuffer, options)
-      },
-      fs: createDefaultValFSHost()
-    })) {
-      switch (event.type) {
-        case "file-valid":
-          valid.push({
-            file: relFile(event.file),
-            durationMs: event.durationMs
-          });
-          break;
-        case "file-error-count":
-          reportFor(event.file).durationMs = event.durationMs;
-          totalErrors += event.errorCount;
-          break;
-        case "validation-error":
-          reportFor(moduleOf(event.sourcePath)).diagnostics.push({
-            severity: "error",
-            sourcePath: event.sourcePath,
-            message: event.message,
-            ...(event.keyError ? {
-              keyError: true
-            } : {})
-          });
-          break;
-        case "validation-fixable-error":
-          reportFor(moduleOf(event.sourcePath)).diagnostics.push({
-            severity: event.fixable ? "fixable" : "error",
-            sourcePath: event.sourcePath,
-            message: event.message,
-            ...(event.keyError ? {
-              keyError: true
-            } : {})
-          });
-          break;
-        case "unknown-fix":
-          reportFor(moduleOf(event.sourcePath)).diagnostics.push({
-            severity: "error",
-            sourcePath: event.sourcePath,
-            message: `Unknown fix: ${event.fixes.join(", ")}`,
-            ...(event.keyError ? {
-              keyError: true
-            } : {})
-          });
-          break;
-        case "unregistered-module":
-          skipped.push(event.file);
-          break;
-        case "fatal-error":
-          // No sourcePath for fatal errors; group by file, render message only.
-          reportFor(event.file).diagnostics.push({
-            severity: "error",
-            sourcePath: event.file,
-            message: event.message
-          });
-          break;
-        case "fix-applied":
-          console.log(pc.yellow("⚠"), "Applied fix for", event.sourcePath);
-          fixedFiles.add(event.file);
-          break;
-        case "remote-uploading":
-          console.log(pc.yellow("⚠"), `Uploading remote file: '${event.ref}'...`);
-          break;
-        case "remote-uploaded":
-          console.log(pc.green("✔"), `Completed upload of remote file: '${event.ref}'`);
-          break;
-        case "remote-already-uploaded":
-          console.log(pc.yellow("⚠"), `Remote file ${event.filePath} already uploaded`);
-          break;
-        case "remote-downloading":
-          console.log(pc.yellow("⚠"), `Downloading remote file in ${event.sourcePath}...`);
-          break;
-      }
+  // Relative file path (no leading slash), matching the code frame's
+  // relativeFile so headers, diagnostics and frames all agree.
+  const relFile = file => file.replace(/^\//, "");
+  // The module a sourcePath/file belongs to is the part before the `?p=...`.
+  const moduleOf = sourcePathOrFile => relFile(sourcePathOrFile.split("?")[0]);
+  const reportFor = file => {
+    const key = relFile(file);
+    let report = reports.get(key);
+    if (!report) {
+      report = {
+        file: key,
+        durationMs: 0,
+        diagnostics: []
+      };
+      reports.set(key, report);
     }
+    return report;
+  };
+  for await (const event of runValidation({
+    root: projectRoot,
+    fix,
+    valFiles,
+    project: resolvedValConfigFile === null || resolvedValConfigFile === void 0 ? void 0 : resolvedValConfigFile.project,
+    remote: {
+      remoteHost: process.env.VAL_REMOTE_HOST || DEFAULT_VAL_REMOTE_HOST,
+      getSettings: (projectName, options) => getSettings(projectName, options),
+      uploadFile: (project, bucket, fileHash, fileExt, fileBuffer, options) => uploadRemoteFile(process.env.VAL_CONTENT_URL || DEFAULT_CONTENT_HOST, project, bucket, fileHash, fileExt ?? "", fileBuffer, options)
+    },
+    fs: createDefaultValFSHost()
+  })) {
+    switch (event.type) {
+      case "file-valid":
+        valid.push({
+          file: relFile(event.file),
+          durationMs: event.durationMs
+        });
+        break;
+      case "file-error-count":
+        reportFor(event.file).durationMs = event.durationMs;
+        totalErrors += event.errorCount;
+        break;
+      case "validation-error":
+        if (event.repairedOnSave) repairedOnSave += 1;
+        reportFor(moduleOf(event.sourcePath)).diagnostics.push({
+          severity: "error",
+          sourcePath: event.sourcePath,
+          message: event.message,
+          ...(event.keyError ? {
+            keyError: true
+          } : {})
+        });
+        break;
+      case "validation-fixable-error":
+        if (event.repairedOnSave) repairedOnSave += 1;
+        reportFor(moduleOf(event.sourcePath)).diagnostics.push({
+          severity: event.fixable ? "fixable" : "error",
+          sourcePath: event.sourcePath,
+          message: event.message,
+          ...(event.keyError ? {
+            keyError: true
+          } : {})
+        });
+        break;
+      case "unknown-fix":
+        reportFor(moduleOf(event.sourcePath)).diagnostics.push({
+          severity: "error",
+          sourcePath: event.sourcePath,
+          message: `Unknown fix: ${event.fixes.join(", ")}`,
+          ...(event.keyError ? {
+            keyError: true
+          } : {})
+        });
+        break;
+      case "unregistered-module":
+        skipped.push(event.file);
+        break;
+      case "fatal-error":
+        // No sourcePath for fatal errors; group by file, render message only.
+        reportFor(event.file).diagnostics.push({
+          severity: "error",
+          sourcePath: event.file,
+          message: event.message
+        });
+        break;
+      case "fix-applied":
+        console.log(pc.yellow("⚠"), "Applied fix for", event.sourcePath);
+        fixedFiles.add(event.file);
+        break;
+      case "remote-uploading":
+        console.log(pc.yellow("⚠"), `Uploading remote file: '${event.ref}'...`);
+        break;
+      case "remote-uploaded":
+        console.log(pc.green("✔"), `Completed upload of remote file: '${event.ref}'`);
+        break;
+      case "remote-already-uploaded":
+        console.log(pc.yellow("⚠"), `Remote file ${event.filePath} already uploaded`);
+        break;
+      case "remote-downloading":
+        console.log(pc.yellow("⚠"), `Downloading remote file in ${event.sourcePath}...`);
+        break;
+    }
+  }
 
-    // Renders a module's diagnostics under a single left "│" gutter bar, with the
-    // file name on top and blank gutter lines for air. Output flows least- to
-    // most-actionable top-to-bottom, so fixable diagnostics are shown last (at the
-    // bottom, nearest the prompt).
-    const renderModule = report => {
-      const bar = pc.dim("│");
-      const diagnostics = [...report.diagnostics].sort((a, b) => a.severity === b.severity ? 0 : a.severity === "fixable" ? 1 : -1);
-      const fixableCount = diagnostics.filter(d => d.severity === "fixable").length;
-      const total = diagnostics.length;
-      const hasError = fixableCount < total;
-      const symbol = hasError ? pc.red("✘") : pc.yellow("⚠");
-      let label;
-      if (fixableCount === total) {
-        label = `${fixableCount} fixable`;
-      } else if (fixableCount > 0) {
-        label = `${total} error${total > 1 ? "s" : ""} (${fixableCount} fixable)`;
+  // Renders a module's diagnostics under a single left "│" gutter bar, with the
+  // file name on top and blank gutter lines for air. Output flows least- to
+  // most-actionable top-to-bottom, so fixable diagnostics are shown last (at the
+  // bottom, nearest the prompt).
+  const renderModule = report => {
+    const bar = pc.dim("│");
+    const diagnostics = [...report.diagnostics].sort((a, b) => a.severity === b.severity ? 0 : a.severity === "fixable" ? 1 : -1);
+    const fixableCount = diagnostics.filter(d => d.severity === "fixable").length;
+    const total = diagnostics.length;
+    const hasError = fixableCount < total;
+    const symbol = hasError ? pc.red("✘") : pc.yellow("⚠");
+    let label;
+    if (fixableCount === total) {
+      label = `${fixableCount} fixable`;
+    } else if (fixableCount > 0) {
+      label = `${total} error${total > 1 ? "s" : ""} (${fixableCount} fixable)`;
+    } else {
+      label = `${total} error${total > 1 ? "s" : ""}`;
+    }
+    console.log(`${pc.bold(report.file)}  ${symbol} ${label}  ${pc.dim(`(${report.durationMs}ms)`)}`);
+    for (const d of diagnostics) {
+      const target = d.keyError ? "key" : "value";
+      const dsym = d.severity === "fixable" ? pc.yellow("⚠") : pc.red("✘");
+      const parts = sourcePathToLocationParts(d.sourcePath, projectRoot, sourceFileCache, target);
+      console.log(bar);
+      if (parts) {
+        // `file:line:col` (no key/value label) so VS Code's terminal links it.
+        console.log(`${bar}  ${dsym}  ${parts.relativeFile}:${parts.line}:${parts.character}`);
+        console.log(`${bar}     ${d.message}`);
       } else {
-        label = `${total} error${total > 1 ? "s" : ""}`;
+        console.log(`${bar}  ${dsym}  ${d.message}`);
       }
-      console.log(`${pc.bold(report.file)}  ${symbol} ${label}  ${pc.dim(`(${report.durationMs}ms)`)}`);
-      for (const d of diagnostics) {
-        const target = d.keyError ? "key" : "value";
-        const dsym = d.severity === "fixable" ? pc.yellow("⚠") : pc.red("✘");
-        const parts = sourcePathToLocationParts(d.sourcePath, projectRoot, sourceFileCache, target);
+      const frame = sourcePathToCodeFrame(d.sourcePath, projectRoot, sourceFileCache, target);
+      if (frame !== undefined) {
         console.log(bar);
-        if (parts) {
-          // `file:line:col` (no key/value label) so VS Code's terminal links it.
-          console.log(`${bar}  ${dsym}  ${parts.relativeFile}:${parts.line}:${parts.character}`);
-          console.log(`${bar}     ${d.message}`);
-        } else {
-          console.log(`${bar}  ${dsym}  ${d.message}`);
-        }
-        const frame = sourcePathToCodeFrame(d.sourcePath, projectRoot, sourceFileCache, target);
-        if (frame !== undefined) {
-          console.log(bar);
-          for (const frameLine of frame.split("\n")) {
-            console.log(`${bar}     ${frameLine}`);
-          }
-        }
-        if (d.severity === "fixable") {
-          console.log(`${bar}     ${pc.dim("→ run with --fix to apply")}`);
+        for (const frameLine of frame.split("\n")) {
+          console.log(`${bar}     ${frameLine}`);
         }
       }
-      console.log(bar);
-      console.log("");
-    };
-
-    // Format the files that had fixes applied, the way the project formats
-    // everything else. See `formatFixedFiles` for why this cannot simply be
-    // `prettier.format(code, { filepath })`.
-    //
-    // A file that could not be formatted is reported and skipped rather than
-    // thrown: the fix itself landed, and aborting here would leave the fix
-    // applied and the report below unwritten.
-    if (prettier) {
-      const {
-        failures
-      } = await formatFixedFiles(prettier, projectRoot, fixedFiles);
-      for (const failure of failures) {
-        console.log(pc.yellow("⚠"), `Could not format ${relFile(failure.file)}: ${failure.message}`);
+      if (d.severity === "fixable") {
+        console.log(`${bar}     ${pc.dim("→ run with --fix to apply")}`);
       }
     }
+    console.log(bar);
+    console.log("");
+  };
 
-    // Render the grouped report least- to most-actionable, top-to-bottom, so the
-    // most important things end up at the bottom nearest the prompt: valid files
-    // and skipped modules first, then error-only modules, then fixable modules.
-    const allReports = [...reports.values()];
-    const fixableModules = allReports.filter(r => r.diagnostics.some(d => d.severity === "fixable"));
-    const errorModules = allReports.filter(r => !r.diagnostics.some(d => d.severity === "fixable"));
-    for (const v of valid) {
-      console.log(pc.green("✔"), pc.dim(`${v.file}  valid (${v.durationMs}ms)`));
+  // Format the files that had fixes applied, the way the project formats
+  // everything else. See `formatFixedFiles` for why this cannot simply be
+  // `prettier.format(code, { filepath })`.
+  //
+  // A file that could not be formatted is reported and skipped rather than
+  // thrown: the fix itself landed, and aborting here would leave the fix
+  // applied and the report below unwritten.
+  if (prettier) {
+    const {
+      failures
+    } = await formatFixedFiles(prettier, projectRoot, fixedFiles);
+    for (const failure of failures) {
+      console.log(pc.yellow("⚠"), `Could not format ${relFile(failure.file)}: ${failure.message}`);
     }
-    for (const file of skipped) {
-      console.log(pc.yellow("⚠"), pc.dim(`/${file} is not registered in val.modules - skipping`));
+  }
+
+  // Render the grouped report least- to most-actionable, top-to-bottom, so the
+  // most important things end up at the bottom nearest the prompt: valid files
+  // and skipped modules first, then error-only modules, then fixable modules.
+  const allReports = [...reports.values()];
+  const fixableModules = allReports.filter(r => r.diagnostics.some(d => d.severity === "fixable"));
+  const errorModules = allReports.filter(r => !r.diagnostics.some(d => d.severity === "fixable"));
+  for (const v of valid) {
+    console.log(pc.green("✔"), pc.dim(`${v.file}  valid (${v.durationMs}ms)`));
+  }
+  for (const file of skipped) {
+    console.log(pc.yellow("⚠"), pc.dim(`/${file} is not registered in val.modules - skipping`));
+  }
+  if (allReports.length > 0) {
+    console.log("");
+  }
+  for (const report of [...errorModules, ...fixableModules]) {
+    renderModule(report);
+  }
+  const fixableTotal = allReports.reduce((n, r) => n + r.diagnostics.filter(d => d.severity === "fixable").length, 0);
+  if (totalErrors > 0) {
+    let summary = `${totalErrors} error${totalErrors > 1 ? "s" : ""}`;
+    if (fixableTotal > 0) {
+      summary += ` (${fixableTotal} fixable)`;
     }
-    if (allReports.length > 0) {
-      console.log("");
+    summary += ` across ${allReports.length} file${allReports.length > 1 ? "s" : ""}`;
+    if (valid.length > 0) {
+      summary += ` · ${valid.length} valid`;
     }
-    for (const report of [...errorModules, ...fixableModules]) {
-      renderModule(report);
+    if (skipped.length > 0) {
+      summary += ` · ${skipped.length} skipped`;
     }
-    const fixableTotal = allReports.reduce((n, r) => n + r.diagnostics.filter(d => d.severity === "fixable").length, 0);
-    if (totalErrors > 0) {
-      let summary = `${totalErrors} error${totalErrors > 1 ? "s" : ""}`;
-      if (fixableTotal > 0) {
-        summary += ` (${fixableTotal} fixable)`;
-      }
-      summary += ` across ${allReports.length} file${allReports.length > 1 ? "s" : ""}`;
-      if (valid.length > 0) {
-        summary += ` · ${valid.length} valid`;
-      }
-      if (skipped.length > 0) {
-        summary += ` · ${skipped.length} skipped`;
-      }
-      console.log(pc.red("✘"), summary);
-    } else {
-      let summary = "No validation errors found";
-      if (valid.length > 0) {
-        summary += ` · ${valid.length} valid`;
-      }
-      if (skipped.length > 0) {
-        summary += ` · ${skipped.length} skipped`;
-      }
-      console.log(pc.green("✔"), summary);
+    console.log(pc.red("✘"), summary);
+  } else {
+    let summary = "No validation errors found";
+    if (valid.length > 0) {
+      summary += ` · ${valid.length} valid`;
     }
-    return totalErrors;
-  }
-  if (!watch) {
-    const totalErrors = await runOnce();
-    if (totalErrors > 0) {
-      process.exit(1);
+    if (skipped.length > 0) {
+      summary += ` · ${skipped.length} skipped`;
     }
-    return;
+    console.log(pc.green("✔"), summary);
   }
-  await watchAndValidate(projectRoot, runOnce);
+  return blockingOnly ? totalErrors - repairedOnSave : totalErrors;
 }
 
 // Directory names anywhere in the path that should never be watched.
@@ -3887,6 +3922,30 @@ function remoteFilesRefusal(read, {
  * person reads the lines.
  */
 async function publish(options) {
+  // Content that does not validate is not published. This is the check that
+  // lets the Studio trust a connected project's published content without
+  // re-checking every file itself: whatever reached the site went through
+  // here. Without `--fix`, so CI never rewrites what it was asked to publish.
+  //
+  // Refused on what the Studio's Publish refuses on, and no more: an error
+  // the Studio leaves to the server to repair (a local image in a remote
+  // project, metadata to fill in) is printed and published, as it would be
+  // from the Studio. Every site made on /new starts with its template's
+  // images local, so counting those would refuse its first publish.
+  if (!options.skipValidation) {
+    const projectRoot = options.root ? path.resolve(options.root) : process.cwd();
+    const errorCount = await validateOnce({
+      projectRoot,
+      fix: false,
+      blockingOnly: true
+    });
+    if (errorCount > 0) {
+      error(`Not published: ${errorCount} validation error${errorCount === 1 ? "" : "s"}.`);
+      console.error(pc.dim(`    Run "val validate --fix" in the project, commit what it changes and push, ` + `and fix by hand what it cannot. --skip-validation publishes anyway.`));
+      process.exitCode = 1;
+      return;
+    }
+  }
   const result = await runPublish({
     ...(options.root ? {
       root: options.root
@@ -4181,6 +4240,8 @@ async function main() {
         --links-own-css          The app links its own CSS (--no-links-own-css for the
                                  opposite; omit it when the build did not say)
         --dry-run                Verify, and stop before the site changes
+        --skip-validation        Publish without running "val validate" first. It runs by
+                                 default, and an error stops the publish
 
       Command: list-unused-files
       Description: EXPERIMENTAL.
@@ -4272,6 +4333,9 @@ async function main() {
       dryRun: {
         type: "boolean"
       },
+      skipValidation: {
+        type: "boolean"
+      },
       yes: {
         type: "boolean"
       },
@@ -4343,7 +4407,8 @@ async function main() {
         layerRev: flags.layerRev,
         buildHash: flags.buildHash,
         linksOwnCss: flags.linksOwnCss,
-        dryRun: flags.dryRun
+        dryRun: flags.dryRun,
+        skipValidation: flags.skipValidation
       });
     case "login":
       return login({