mikser-io 9.67.0 → 9.72.0

package/CLAUDE.md

@@ -200,6 +200,57 @@ brevity.
   of folder names written in the plugin. A hardcoded list misses every
   collection a project registers through `sources()`, which produced 63
   false warnings per build on a real site.
+- `src/plugins/render/asset.js` / `resource.js` — URL helpers that BUILD
+  a path from a naming convention instead of looking an entity up, so
+  they cannot fail: a preset that never ran yields a well-formed link to
+  nothing on a green build. Each records its destination via
+  `track.asset()`; `engine.js` checks the collected set against
+  `outputFolder` in `onFinalized` (`reportAssetUse` / `assetUse` in
+  report.js, `reportMissingAssets` in engine.js), warning under
+  `asset-missing` / `asset-missing-summary`. `existsSync` FOLLOWS
+  symlinks, which is required — the assets folder is deployed into the
+  output as a symlink. Handlebars appends an options object to every
+  helper call, so a trailing optional arg (`format`) must be discarded
+  when it looks like one (`'hash' in format`); without that, `asset 'web'
+  '/x.jpg'` built `/assets/web/x.[object Object]` — the bug the finalize
+  check found on its first run, present since the helper took a format.
+- `matchesLibrary` (utils.js) — a resources library key is a REGEX source
+  (`escapeStringRegexp(url)`), and it has two consumers: the plugin's
+  discovery walk, which decides what to DOWNLOAD, and the `resource` render
+  helper, which builds the url. They read the same string with two matchers
+  — discovery used `matchEntity`, a GLOB demanding a full match, so a key
+  derived from `url` (a bare prefix, no trailing wildcard) matched nothing
+  and NO url-declared library was ever fetched, while the helper kept
+  building links to the missing files. Green build, missing images; found
+  when the reference check read the output back. Both now call one function
+  so they cannot drift.
+- `references.js` — the OTHER half of the broken-link answer: reads the
+  EMITTED output (html + css) and resolves every `src` / `href` / `poster`
+  / `srcset` / `url()` the way a browser does. Complements
+  `reportMissingAssets`, which reads the render track — that one sees urls
+  that never reach an html file (a feed, a sitemap) and knows the entity;
+  this one sees paths written by hand and can tell BROKEN (resolves to no
+  file) from OVER-DEEP (resolves only because a `..` run was floored at the
+  site root — loads today, breaks one nesting level deeper). Where both can
+  see a file the scan wins and the track check is skipped, so one problem
+  is one warning. Codes: `reference-broken` / `reference-over-deep` plus
+  summaries. `runtime.config.siteRoots` declares which subtrees deploy as
+  their own domain root; it CANNOT be derived — it is a fact about
+  deployment, not about the bytes — and resolving a per-language build
+  against the output root reports every working url as broken. Skips other
+  origins, `data:`, fragments, percent-encoded externals
+  (`https%3A%2F%2F...` in a query param) and unrendered template syntax.
+  Decodes `"` first: a CSS custom property in an inline style is
+  `url("../x.svg")`, and left encoded the entity text becomes the
+  path. 434 references over a real site in ~20ms.
+- Postprocess failures are RENDER ERRORS. The dispatcher's catch used to
+  log one uncoded `Postprocess error:` line and stop there — exit code 0,
+  nothing in `--json` `errors`, `🟢 Mikser completed`. A build missing
+  every PDF it was asked for reported success. It now calls `reportError`
+  with the failing `postprocessor`, so a stage that wrote no file counts
+  the same as a render that threw. `entity.origin` is deliberately NOT
+  unlinked on failure (it is on success): a retry needs it as input, and
+  for a converter it is real content.
 - `render.js` / `postprocess.js` — Piscina worker entry points AND the
   default-export functions the INLINE/SERIAL dispatcher calls directly.
   Each receives entity + options + config + state; the WORKER path also
@@ -246,7 +297,10 @@ brevity.
   `--explain`) forward too — they read, so a local run damaged nothing,
   but a catalogue another process is mid-write in is not one anyone can
   answer from. `runReportOnly()` in engine.js is the one implementation
-  both paths call. Exit code comes from `renderErrorCount()`, not
+  both paths call. `--server` / `--watch` are NOT forwardable — they ask
+  to BECOME the instance, and a running engine cannot open a port on
+  someone's behalf — so they exit 1 with a message when one is already
+  there. Exit code comes from `renderErrorCount()`, not
   `process.exitCode` — the engine suppresses that in watch mode by
   design. Config mismatch is refused by resolved PATH; config drift
   under a running instance is detected by stat over `configCoverage`.

package/app.js

@@ -2,7 +2,7 @@
 import path from 'node:path'
 
 import { setup } from './index.js'
-import { forward } from './src/instance.js'
+import { forward, isInstanceLive } from './src/instance.js'
 
 // Before anything is imported or read.
 //
@@ -26,6 +26,12 @@ function locate(argv) {
     }
     const has = (...names) => names.some(n => argv.includes(n) || argv.some(a => names.some(x => a.startsWith(`${x}=`))))
 
+    // Asking to BECOME the instance, rather than asking one for something.
+    // Not forwardable in principle: a running engine cannot open a listener on
+    // someone else's behalf, and forwarding it built, printed "completed" and
+    // exited with nothing on the port.
+    const longRunning = has('--watch', '-w', '--server', '-s')
+
     // What to ask the instance for. Report-only commands go over the same
     // socket as a build: they read, so running them locally never damaged
     // anything, but a catalogue being written by another process is not a
@@ -40,6 +46,7 @@ function locate(argv) {
         : { type: 'build', clear: has('--clear') }
 
     return {
+        longRunning,
         workingFolder: value('--working-folder', '-i') ?? '.',
         config: value('--config', '-c') ?? 'mikser.config.js',
         // Commander's negated form: `attach` is true unless --no-attach said so.
@@ -50,9 +57,25 @@ function locate(argv) {
 
 async function main() {
     const where = locate(process.argv.slice(2))
-    if (where.attach !== false) {
+    const workingFolder = path.resolve(where.workingFolder)
+
+    // A second server or watcher is the hazard this whole surface exists to
+    // remove, and it is the one shape that cannot be answered by forwarding.
+    // So it stops, rather than silently doing something else.
+    if (where.attach !== false && where.longRunning) {
+        if (await isInstanceLive(workingFolder)) {
+            process.stderr.write(
+                'mikser: another mikser is already running in this folder, and a server or watcher cannot be '
+                + 'forwarded to it — it would have to open a port on your behalf.\n'
+                + 'Stop that one, or pass --no-attach to run a second engine here (two engines share the '
+                + 'catalogue and the output tree, with no lock between them).\n')
+            process.exit(1)
+        }
+    }
+
+    if (where.attach !== false && !where.longRunning) {
         const code = await forward({
-            workingFolder: path.resolve(where.workingFolder),
+            workingFolder,
             config: path.resolve(where.workingFolder, where.config),
             request: where.request,
         })

package/docs/configuration.md

@@ -64,6 +64,31 @@ These options are part of `runtime.options` and apply to the engine itself.
 | `server.requestTimeout` | — | number | node default (`300000`) | Milliseconds a single request may take, set on the underlying `http.Server`. Node's 5-minute default is effectively an **upload size limit expressed in seconds** — a large file over a slow link is indistinguishable from a stalled request, so it is cut off and the caller sees a truncated write rather than a readable error. Raised to two hours automatically when any route registers as `streaming` (an upload surface such as `mikser-io-drive`), because Node's default mismeasures exactly those; set this explicitly to override. `0` disables the cap: reasonable on a trusted-network build server, bad facing the internet, where it removes the only bound on how long a client can hold a connection open doing nothing. `headersTimeout` is clamped to stay at or below it. The server is also exposed as `runtime.options.httpServer`. |
 | `url` | `-u, --url <url>` | string | — | Public URL where this mikser is reachable (e.g. `https://blog.me.com`). Validated, trailing slash stripped, stamped on `runtime.options.url`. Read by webhook-capable plugins for push-vs-poll gating (`url.startsWith('https://')`); used by anything that surfaces absolute URLs externally — MCP preview URLs returned to agents, forms share links, email tracking pixels. Plugins that just need internal URLs keep using `runtime.options.port`. |
 
+### `siteRoots`
+
+Which subtrees of the output folder are deployed as their own domain root.
+
+```js
+export default {
+    // out/bg becomes lmed.bg, out/en becomes lmed.info, out/mk becomes lmed.mk
+    siteRoots: ['bg', 'en', 'mk'],
+}
+```
+
+Read only by the broken-reference check. It resolves urls the way a browser
+does, and a browser cannot climb above the origin root — it discards the
+extra `..` and loads the file. Where the site root actually is therefore
+decides whether `../../x.svg` on a given page is correct, merely over-deep,
+or broken.
+
+Default is the output folder itself, which is right for the ordinary case of
+one site per build. Declare this only when a build emits several sites, as a
+per-language deploy does — resolving those against the output root instead
+misses the over-escape entirely and reports the working urls as broken.
+
+Nothing can infer it: it is a fact about where the bytes get deployed, not
+about the bytes.
+
 ## Engine Substrate
 
 The catalog, inverse-ref graph, render snapshot manifest, and per-cycle

package/docs/diagnostics.md

@@ -756,6 +756,10 @@ Three things it refuses or reports rather than guessing:
 - **A config that moved under the instance.** It stats every file in
   `config.files` and tells you to restart rather than building with a config
   you have since edited.
+- **A second server or watcher.** `mikser --server` and `mikser --watch` ask
+  to *become* the instance, which is not something a running one can do for
+  you — it would have to open a port in your process. They exit 1 and say so,
+  rather than building and leaving nothing on the port.
 - **A folder held by someone else.** `--no-attach` runs a private engine
   anyway — for checking that a cold start works — and says the folder is held.
 
@@ -846,10 +850,11 @@ surfaces that turn silence into a statement:
 - **A pattern or query that matched nothing** — several plugins warn on
   this now (layout patterns, preset matching, null filters). The warnings
   carry stable `code`s in `--json`.
-- **Output that does not match the config** — the config's bytes take
-  part in cache invalidation, so a config change forces a rebuild; but a
-  module the config *imports* does not. If you changed a helper the config
-  pulls in, use `--force`.
+- **Output that does not match the config** — the config's checksum
+  covers the local module graph it imports, not just its own bytes, so
+  editing a helper the config pulls in forces a rebuild the same way
+  editing the config does. A change *outside* that graph — inside an npm
+  dependency — still does not, so use `--force` after upgrading one.
 - **A tool that answers emptily because it is broken** — check
   [`faults`](#faults) before reading an empty result as a fact about the
   site. This is the one case where the answer and the failure are the same
@@ -857,6 +862,37 @@ surfaces that turn silence into a statement:
 - **A plugin that appears to do nothing** — `No plugins loaded` with a
   config present is a warning naming the file. A config that fails to
   load now exits non-zero rather than loading as empty.
+- **A postprocess that could not run** — a stage whose external
+  dependency is absent (no chrome for a PDF, no binary for a conversion)
+  reports a fault naming the subsystem, and each page that wanted that
+  output fails as an ordinary render error. The fault says why once; the
+  errors say who, and set the exit code. A missing dependency does not
+  fail the whole build — the HTML is already written and correct — but it
+  does not pass as clean either.
+- **A link to a file nothing produced** — helpers like `asset()` and
+  `resource()` *build* a URL from a naming convention rather than looking
+  an entity up, so they cannot fail: a preset that never ran, or a
+  template naming an extension the preset no longer emits, yields a
+  well-formed URL to nothing. Two checks run at finalize, from different
+  evidence:
+  - **The emitted output**, read back and resolved the way a browser
+    would — `src`, `href`, `poster`, `srcset` and CSS `url()` across
+    html and css. Anything resolving to no file warns under
+    `reference-broken`, naming the url and the pages carrying it. This
+    one sees paths written by hand, not just helper output.
+  - **The render track**, which records every `asset()` / `resource()`
+    call and tests the destination it built. This catches a url that
+    never reaches an html file at all — one emitted into a feed or a
+    sitemap — and warns under `asset-missing`. Where both can see the
+    same file, the output scan reports it and this one stays quiet.
+- **A link that works only by accident** — a url with one `..` too many
+  still loads, because a browser discards a climb above the origin root
+  rather than failing. It is one level of nesting away from a 404, and
+  it means the emitted depth does not match the page. Reported under
+  `reference-over-deep`, separately from the outright failures. Which
+  root to floor at is deployment intent and cannot be derived, so
+  declare it — see `siteRoots` in
+  [configuration](./configuration.md#siteroots).
 
 ## See also
 

package/docs/rendering.md

@@ -375,6 +375,33 @@ Generates relative URLs to transformed assets (output of the assets plugin). Ret
 
 The underlying path is: `/{assetsFolder}/{preset}/{path}[.{format}]`
 
+#### Checked against the output
+
+The path is *built* from that convention, not looked up, so the helper
+cannot fail — it returns a well-formed URL whether or not anything ever
+produced the file. A preset that did not run, a source that is not
+matched by the preset's patterns, or a template naming a format the
+preset no longer emits all yield a link to nothing, on a build that
+reports success.
+
+So every `asset()` and `resource()` call records its destination on the
+render track, and at finalize the engine checks each one against the
+output folder. Anything missing is warned under the `asset-missing` code,
+naming the path and the pages that linked it, with a summary under
+`asset-missing-summary`. The check follows symlinks, so an assets folder
+deployed into the output as a link resolves normally.
+
+It is a warning, not an error: a build can legitimately link a file that
+some later step supplies, and a missing asset must not stop a dev server.
+What it removes is the silence.
+
+A second check reads the **emitted output** rather than the render track —
+every `src` / `href` / `poster` / `srcset` / CSS `url()` in the html and
+css that shipped, resolved the way a browser resolves it. It covers paths
+written by hand, which no helper ever saw, and it is the only one that can
+see a url which loads solely because the browser floored a `..` run at the
+site root. See [diagnostics](./diagnostics.md#when-mikser-is-silent).
+
 ---
 
 ### `render-resource` — CDN Resource Mapping
@@ -542,6 +569,16 @@ Return shapes the dispatcher accepts:
 
 A chain is all-or-nothing. The first stage to throw or return `{success: false}` fails the entry; the dispatcher unlinks every intermediate it produced and the final destination, then re-throws. No partial output leaks.
 
+The renderer's own output (`entity.origin`) is the exception: on success the
+dispatcher unlinks it, on failure it stays. It is the input a retry needs, and
+for a converter it is content in its own right — the HTML of a report whose PDF
+could not be produced.
+
+A failed entry counts as a **render error**: it lands in `errors` under `--json`
+with the failing `postprocessor` named, and sets the exit code. It wrote no
+file, so it has to count the same as a render that threw — otherwise a build
+missing every PDF it was asked for reports success.
+
 ### Execution mode
 
 Postprocess inherits the layout's `task:` setting. `task: worker` routes both render and postprocess through the lazy Piscina pool (right for CPU-heavy stages: PDF, image compose, big MJML compilations). Default INLINE is right for everything else.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mikser-io",
-  "version": "9.67.0",
+  "version": "9.72.0",
   "description": "A mixer for content: entities in, configurable render pipelines, outputs of any kind. Static sites are the canonical recipe, not the definition — the same engine renders PDFs, emails and whatever a renderer plugin produces. Files are the source of truth, every lifecycle phase is observable, and the build graph is queryable by an agent.",
   "main": "index.js",
   "exports": {

package/src/engine.js

@@ -11,7 +11,8 @@ import { useJournal, updateEntry } from './journal.js'
 import { globby } from 'globby'
 import { OPERATION, TASKS } from './constants.js'
 import { changeExtension, formatErrorContext, projectMeta, lookupKeys } from './utils.js'
-import { reportRendered, reportSkipped, reportError, renderErrorCount, emitReport, finishCycle } from './report.js'
+import { reportRendered, reportSkipped, reportError, renderErrorCount, emitReport, finishCycle, reportAssetUse, assetUse } from './report.js'
+import { checkReferences } from './references.js'
 import { toolSchemas, invokeTool, toolResultText, toolResultFailed } from './tools.js'
 import { registerBuiltinTools } from './builtin-tools.js'
 import { useDatabase } from './database/index.js'
@@ -89,6 +90,102 @@ function workerSafeOptions(opts) {
     return result
 }
 
+// Warn for anything the EMITTED output points at that is not there.
+//
+// Complements the helper-call check below rather than repeating it: this reads
+// what shipped, so it also sees paths written by hand, and it resolves them the
+// way a browser does, which is the only way to see a url that works solely
+// because a `..` run was floored at the site root.
+//
+// A floored url is not broken today. It is the same markup one level deeper
+// away from being broken, and it means the emitted depth does not match the
+// page — so it is reported separately rather than folded in with the failures.
+//
+// Warn, never fail: a missing asset must not stop a dev server. Both lists
+// carry stable codes into `--json` so a deploy script can decide for itself.
+// Returns the set of broken targets so the helper-call check can skip them.
+async function reportBrokenReferences(logger) {
+    const outputFolder = runtime.options.outputFolder
+    if (!outputFolder || !existsSync(outputFolder)) return new Set()
+
+    const siteRoots = runtime.config?.siteRoots ?? []
+    const { broken, overDeep, checked } = await checkReferences(outputFolder, { siteRoots })
+    if (!checked) return new Set()
+
+    const SHOWN = 10
+    const named = (files) =>
+        files.slice(0, 3).join(', ') + (files.length > 3 ? ` and ${files.length - 3} more` : '')
+
+    for (const { url, target, files } of broken.slice(0, SHOWN)) {
+        logger.warn({ code: 'reference-broken', url, target, files },
+            'Resolves to nothing: %s (from %s) — %s', url, named(files), target)
+    }
+    if (broken.length) {
+        logger.warn({ code: 'reference-broken-summary', broken: broken.length, checked },
+            '%d of %d reference(s) in the output resolve to nothing%s. A URL helper builds the '
+            + 'path rather than looking it up, so these are links to files nothing produced.',
+            broken.length, checked, broken.length > SHOWN ? `, ${SHOWN} shown` : '')
+    }
+
+    for (const { url, target, files } of overDeep.slice(0, SHOWN)) {
+        logger.warn({ code: 'reference-over-deep', url, target, files },
+            'Over-deep, loads only because the browser floors it: %s (from %s) — %s',
+            url, named(files), target)
+    }
+    if (overDeep.length) {
+        logger.warn({ code: 'reference-over-deep-summary', overDeep: overDeep.length, checked },
+            '%d of %d reference(s) climb above the site root and load only because a browser '
+            + 'discards the extra `..`%s. They break as soon as the same markup renders one '
+            + 'level deeper.%s',
+            overDeep.length, checked, overDeep.length > SHOWN ? `, ${SHOWN} shown` : '',
+            siteRoots.length ? '' : ' No siteRoots are declared, so this resolved against the '
+                + 'output root — declare runtime.config.siteRoots if a subtree is deployed as its own domain.')
+    }
+
+    return new Set(broken.map(b => b.target))
+}
+
+// Warn for anything a render linked to that is not in the output.
+//
+// Deliberately phrased as what was OBSERVED. Only entities that rendered this
+// cycle recorded anything, so an incremental build checks the pages it built
+// and says nothing about the rest — the same reasoning the assets plugin
+// already applies to its preset warning, and for the same reason: a warning
+// that overclaims gets filtered, and the filtered-out line is the real one.
+async function reportMissingAssets(logger, alreadyReported = new Set()) {
+    const used = assetUse()
+    if (!used.length) return
+    const outputFolder = runtime.options.outputFolder
+    if (!outputFolder) return
+
+    const missing = []
+    for (const [destination, ids] of used) {
+        const file = path.join(outputFolder, destination.replace(/^\//, ''))
+        // The output scan resolves the same file the way a browser does and
+        // names the pages that link it, which is strictly more useful. Where
+        // both would fire, one warning is enough.
+        if (alreadyReported.has(destination.replace(/^\//, ''))) continue
+        if (!existsSync(file)) missing.push([destination, ids])
+    }
+    if (!missing.length) return
+
+    // Capped, with the total alongside. One broken preset can be referenced by
+    // every page on the site, and a thousand lines of it buries whatever else
+    // the build said.
+    const SHOWN = 10
+    for (const [destination, ids] of missing.slice(0, SHOWN)) {
+        logger.warn({ code: 'asset-missing', destination, referencedBy: ids },
+            'Linked but not in the output: %s — referenced by %s', destination,
+            ids.slice(0, 3).join(', ') + (ids.length > 3 ? ` and ${ids.length - 3} more` : ''))
+    }
+    logger.warn({ code: 'asset-missing-summary', missing: missing.length, checked: used.length },
+        '%d of %d linked file(s) are not in the output%s. A URL helper builds the path rather than looking it '
+        + 'up, so this is a link to something nothing produced — usually a preset that did not run, or a '
+        + 'template naming an extension the preset no longer emits.',
+        missing.length, used.length,
+        missing.length > SHOWN ? `, ${SHOWN} shown` : '')
+}
+
 // The report-only commands, as functions that RETURN their exit code.
 //
 // They used to be inline here and call process.exit, which is fine for a
@@ -677,6 +774,15 @@ export async function setup(options) {
                     result = rendered?.output
                     if (rendered?.track) mergeTrack(track, rendered.track)
 
+                    // Which files this entity's template linked to. Harvested
+                    // here because this is the one place that has both the
+                    // track and the entity that produced it — a worker's track
+                    // has just been folded in, so a worker render is covered
+                    // the same as an inline one.
+                    for (const destination of track.assets ?? []) {
+                        reportAssetUse(destination, renderEntity.id)
+                    }
+
                     if (!signal.aborted) {
                         // Meta reads ride on `output`, which is already
                         // free-form JSON on the journal row, rather than in
@@ -1014,6 +1120,17 @@ export async function setup(options) {
                         if (!signal.aborted) {
                             await updateEntry({ id, output: { success: false } })
                             logger.error('Postprocess error: %s%s %s', entity.id, formatErrorContext(entity, err, runtime.options), err.message)
+                            // A failed postprocess wrote no file, so it has to
+                            // count the same as a failed render. It did not:
+                            // this line was the whole of it, the exit code
+                            // stayed 0, and `errors` in --json never mentioned
+                            // it — a build with output missing reporting
+                            // success, which is the exact shape of bug the
+                            // rest of this file exists to make impossible.
+                            reportError(entity, err, {
+                                postprocessor: options.postprocessor ?? null,
+                                layout: entity.layout?.id ?? null,
+                            })
                         }
                         logger.debug('Postprocess canceled')
                     }
@@ -1070,6 +1187,20 @@ export async function setup(options) {
         if (failed) logger.error('Mikser completed with %d render error%s', failed, failed === 1 ? '' : 's')
         else logger.notice('Mikser completed')
 
+        // Is everything the templates linked to actually there?
+        //
+        // The URL helpers build paths; they do not resolve them. So a preset
+        // that never ran, a library that was not copied, or a template naming
+        // an extension the preset stopped producing all yield a well-formed
+        // link to a file that does not exist — and the only symptom is a
+        // missing image on the deployed site, found by a person.
+        //
+        // Checked at the end of the cycle because that is the first moment the
+        // answer is stable: derivatives are produced during the cycle, so
+        // asking any earlier would report files that were about to appear.
+        const brokenTargets = await reportBrokenReferences(useLogger())
+        await reportMissingAssets(useLogger(), brokenTargets)
+
         // After the cycle, and only under --json. stdout has been kept clear
         // for exactly this (the logger writes to stderr under --json), so the
         // document is the only thing on it and can be piped to jq.

package/src/instance.js

@@ -149,6 +149,35 @@ export function forward({ workingFolder, config, request }) {
     })
 }
 
+// Is somebody already holding this folder?
+//
+// Used by the commands that cannot be forwarded because they are not requests
+// at all — `--server` and `--watch` ask to BECOME the instance. Forwarding one
+// builds and exits, and the port never opens: the caller asked for a server on
+// 3010, got "completed", and has nothing listening.
+//
+// Same stale-socket rule as forward(): connect-and-fail means nobody is there,
+// never a wait.
+export function isInstanceLive(workingFolder) {
+    const endpoint = socketPath(workingFolder)
+    return new Promise((resolve) => {
+        const probe = net.connect(endpoint)
+        let settled = false
+        const answer = (live) => {
+            if (settled) return
+            settled = true
+            try { probe.destroy() } catch { /* already gone */ }
+            if (!live && process.platform !== 'win32' && existsSync(endpoint)) {
+                try { unlinkSync(endpoint) } catch { /* another client won the race */ }
+            }
+            resolve(live)
+        }
+        probe.on('connect', () => answer(true))
+        probe.on('error', () => answer(false))
+        setTimeout(() => answer(false), 1000).unref?.()
+    })
+}
+
 // ── server ──────────────────────────────────────────────────────────────
 
 // Requests run one at a time, to completion.
@@ -409,10 +438,17 @@ export async function warnIfHeld({ workingFolder, attached }) {
 export function instanceControl() {
     serveInstance()
     onLoaded(async () => {
-        if (runtime.options.watch || runtime.options.server) return
+        // Only --no-attach reaches this now. Everything else either forwarded
+        // (a build, a report) or refused before setup ran (a second server or
+        // watcher), so a process that is still here and not attaching is one
+        // that deliberately opted out — and that is exactly the case worth
+        // saying something about, long-running or not. The earlier gate
+        // skipped watch and server, which excluded `--no-attach --server`:
+        // the very command that puts two engines on one folder.
+        if (runtime.options.attach !== false) return
         await warnIfHeld({
             workingFolder: runtime.options.workingFolder,
-            attached: runtime.options.attach,
+            attached: false,
         })
     })
 }

package/src/plugins/assets.js

@@ -231,6 +231,13 @@ export function assets(options = {}) {
             for (let entityPreset of assetsMap[entityToRender.id] || []) {
                 const entity = _.cloneDeep(entityToRender)
                 entity.preset = presets[entityPreset]
+                // Named in config but with no module in presets/ and no
+                // mikser-io-preset-* package: there is nothing to render with.
+                // Loading already reported this preset ('Preset not found'),
+                // and the finalize check names the links left dangling. A line
+                // per entity here would just be that fact a third time, once
+                // per matched file.
+                if (!entity.preset) continue
                 // Per-preset config options override the preset module's
                 // defaults. Looked up at render time so config edits are
                 // picked up on the next cycle without rebuilding the

package/src/plugins/render/asset.js

@@ -15,7 +15,7 @@ import { changeExtension } from '../../utils.js'
 // derivative may simply not have been generated, and this cannot tell.
 // `meta.presets` (ADR-0011) is the looked-up answer where a caller has the
 // entity; this helper exists for the case where they have a path.
-export function load({ runtime, entity, state, options, logger }) {
+export function load({ runtime, entity, state, options, logger, track }) {
     const presets = state?.assets?.presets ?? {}
     const warned = new Set()
     const warnOnce = (key, code, message, ...args) => {
@@ -27,6 +27,15 @@ export function load({ runtime, entity, state, options, logger }) {
     runtime.asset = (preset, url, format) => {
         if (url[0] != '/') url = `/${url}`
 
+        // Handlebars appends its own options object to every helper call, so a
+        // two-argument `{{asset 'web' '/media/hero.jpg'}}` arrives here with a
+        // third. Taken as a format it stringifies, and the helper cheerfully
+        // built `hero.[object Object]` — a well-formed link to a file that
+        // could never exist. file.js strips it for the same reason; this one
+        // never did, and nothing noticed until the output check started
+        // looking at what these URLs point at.
+        if (format && typeof format === 'object' && 'hash' in format) format = undefined
+
         const declared = presets[preset]?.format
 
         // A preset name nothing declares. The URL still gets built — it is a
@@ -57,6 +66,11 @@ export function load({ runtime, entity, state, options, logger }) {
         // happened to be rendering.
         const relative = `${state.assets.assetsFolder}/${preset}${effective ? changeExtension(url, effective) : url}`
         const destination = '/' + relative
+        // Recorded so the engine can check at the end of the cycle whether
+        // this file exists. It is the one thing this helper cannot answer for
+        // itself — it takes a path, not an entity, so there is nothing to look
+        // up and the URL is well-formed whether or not anything produced it.
+        track?.asset?.(destination)
         const from = path.dirname(entity.destination || '/')
         return { url: path.relative(from, destination) }
     }

package/src/plugins/render/resource.js

@@ -1,14 +1,22 @@
 import path from 'node:path'
+import { matchesLibrary } from '../../utils.js'
 
-export function load({ runtime, entity, state, options }) {
+export function load({ runtime, entity, state, options, track }) {
     runtime.resource = (url) => {
         const { resourceLib } = state.resources
         for (let library in resourceLib) {
-            if (url.match(library)) {
+            // Same matcher the resources plugin uses to decide what to
+            // DOWNLOAD. When these disagreed, this built urls for files the
+            // plugin never fetched.
+            if (matchesLibrary(url, library)) {
                 const { origin } = new URL(url)
                 const name = url.replace(origin, `${resourceLib[library]}`)
                 const relative = url.replace(origin, `${state.resources.resourcesFolder}/${resourceLib[library]}`)
                 const destination = '/' + relative
+                // Same reason as the asset helper: this builds a URL rather
+                // than resolving one, so a library that was never copied
+                // yields a link to nothing on a green build.
+                track?.asset?.(destination)
                 const from = path.dirname(entity.destination || '/')
                 return { url: path.relative(from, destination), name }
             }

package/src/plugins/resources.js

@@ -10,6 +10,7 @@ import * as stream from 'stream'
 import { promisify } from 'util'
 import isUrl from 'is-url'
 import map from 'p-map'
+import { matchesLibrary } from '../utils.js'
 
 export function resources(options = {}) {
     return ({
@@ -24,7 +25,6 @@ export function resources(options = {}) {
         checksum,
         trackProgress,
         updateProgress,
-        matchEntity,
         constants: { OPERATION },
     }) => {
     const collection = 'resources'
@@ -52,6 +52,11 @@ export function resources(options = {}) {
 
         for (let library in (options.libraries || [])) {
             let resource = options.libraries[library]
+                // The key is a REGULAR EXPRESSION source, which is what the
+            // escapeStringRegexp call says: you only escape a string you are
+            // about to compile. The render helper has always read it that way
+            // (`url.match(library)`), so a library declared by `url` is a
+            // prefix pattern matching anything under it.
             runtime.state.resources.resourceLib[resource.match || escapeStringRegexp(resource.url)] = library
         }
     })
@@ -66,7 +71,15 @@ export function resources(options = {}) {
                 _.eachDeep(entity.meta, resource => {
                     if (typeof resource == 'string') {
                         for (let library in resourceLib) {
-                            if (matchEntity(resource, library)) {
+                            // Regex, matching the render helper. This used
+                            // matchEntity, which is a GLOB demanding a full
+                            // match — so a key derived from `url` (a bare
+                            // prefix, no trailing wildcard) matched nothing and
+                            // NO url-declared library was ever downloaded. The
+                            // helper still built urls for them, so pages linked
+                            // files nothing fetched and the build stayed green:
+                            // one string read with two incompatible matchers.
+                            if (matchesLibrary(resource, library)) {
                                 resourceMap[entity.id].push({ library, resource, entity })
                             }
                         }

package/src/references.js

@@ -0,0 +1,187 @@
+// What the build actually shipped, checked against what it actually wrote.
+//
+// The URL helpers BUILD paths from a naming convention rather than resolving
+// an entity, so they cannot fail — `asset` composes
+// `<assetsFolder>/<preset>/<path>` with whatever extension it was handed and
+// never asks whether that file exists. A wrong preset name, a wrong extension,
+// or a source whose derivative silently failed to render all produce a
+// well-formed url pointing at nothing, and every existing surface stays green:
+// nothing threw, --verify compares snapshots against what was rendered rather
+// than against what those renders point at, and mikser_refs_broken tracks
+// document-to-document refs, not urls.
+//
+// This reads the emitted bytes instead. Everything it needs is on disk at the
+// end of a cycle and nothing has to be inferred.
+//
+// It is deliberately NOT the same check as `asset-missing` in engine.js. That
+// one records helper CALLS on the render track and tests the output-root
+// absolute destination each one built; it knows the referencing entity, and it
+// sees urls that never reach an html file at all (a sitemap, a feed). This one
+// sees everything that shipped, including paths written by hand, and resolves
+// them the way a browser would — which is the only way to catch a url that
+// resolves solely because the browser floored a `..` run at the site root.
+
+import path from 'node:path'
+import { existsSync } from 'node:fs'
+import { readFile } from 'node:fs/promises'
+import { globby } from 'globby'
+
+// Documents that can carry a reference. Anything else in the output is either
+// an asset itself or something whose internal structure this has no business
+// guessing at.
+const SCANNED = ['**/*.html', '**/*.htm', '**/*.css']
+
+// Attributes whose value is a single url.
+const ATTR = /(?:src|href|poster|data-bg)\s*=\s*["']([^"']*)["']/gi
+// srcset / imagesrcset: a comma-separated list of `url [descriptor]`.
+const SRCSET = /(?:img|image)?srcset\s*=\s*["']([^"']*)["']/gi
+// css url(), in a stylesheet and in an inline style attribute alike.
+const CSS_URL = /url\(\s*(['"]?)([^'")]*)\1\s*\)/gi
+
+// A url this check has nothing to say about: another origin, an inline
+// payload, a fragment or an in-page action. `//host/path` is protocol-relative
+// and therefore external too.
+function isExternal(url) {
+    if (!url) return true
+    const u = url.trim()
+    if (!u) return true
+    if (u.startsWith('#') || u.startsWith('//')) return true
+    // Template syntax that reached the output unrendered — `{{link}}`,
+    // `${x}`, `<%= y %>`. It is not a path, so "resolves to nothing" says
+    // nothing useful about it; the real problem is that it did not render,
+    // which is a different question than this one is asking. Documentation
+    // pages showing escaped template syntax are the common source, and they
+    // are not broken at all.
+    if (/\{\{|\}\}|\$\{|<%/.test(u)) return true
+    // A scheme — http:, data:, mailto:, tel:, javascript:.
+    if (/^[a-z][a-z0-9+.-]*:/i.test(u)) return true
+    // The same thing percent-encoded, which is how an external url arrives
+    // when it was built as a query parameter — `https%3A%2F%2F...` in a maps
+    // link. It has no scheme until it is decoded, so the test above misses it
+    // and the whole encoded string gets resolved as a path segment.
+    try {
+        if (/^[a-z][a-z0-9+.-]*:/i.test(decodeURIComponent(u))) return true
+    } catch { /* malformed escape — treat as a path and let it resolve */ }
+    return false
+}
+
+// Quotes inside an attribute value arrive encoded, and a CSS custom property
+// in an inline style is the common way that happens:
+//
+//     style="--icon-src:url(&quot;../media/raw/icons/x.svg&quot;)"
+//
+// Without decoding, the captured url is the entity text itself, which resolves
+// nowhere and reports as broken — a false positive that would have buried the
+// real ones. Only the quote and ampersand forms are decoded; turning &lt; back
+// into a bracket could invent markup that was deliberately escaped.
+function decodeEntities(source) {
+    return source
+        .replace(/&quot;|&#34;/g, '"')
+        .replace(/&apos;|&#39;/g, "'")
+        .replace(/&amp;/g, '&')
+}
+
+// Everything a page points at, as raw url strings.
+export function extractReferences(rawSource) {
+    const source = decodeEntities(rawSource)
+    const found = new Set()
+    for (const [, url] of source.matchAll(ATTR)) found.add(url)
+    for (const [, , url] of source.matchAll(CSS_URL)) found.add(url)
+    for (const [, list] of source.matchAll(SRCSET)) {
+        for (const candidate of list.split(',')) {
+            const url = candidate.trim().split(/\s+/)[0]
+            if (url) found.add(url)
+        }
+    }
+    return [...found].filter(u => !isExternal(u))
+}
+
+// Resolve the way a browser does, which is the whole point.
+//
+// A browser walks the page's directory segments, pops one per `..`, and
+// DISCARDS a `..` that would climb above the origin root — it does not error
+// and it does not escape. So a url with one `..` too many still loads, and the
+// page looks correct while carrying a path that breaks the moment the same
+// markup is used one level deeper. That flooring is what `overDeep` records.
+//
+// `pageDir` and the result are both relative to `root`.
+export function resolveUrl(pageDir, url, { root = '' } = {}) {
+    const clean = url.split('#')[0].split('?')[0]
+    const absolute = clean.startsWith('/')
+    const segments = clean.split('/').filter(s => s !== '' && s !== '.')
+
+    const parts = absolute ? [] : pageDir.split('/').filter(Boolean)
+    let overDeep = false
+    for (const segment of segments) {
+        if (segment !== '..') { parts.push(segment); continue }
+        if (parts.length) parts.pop()
+        else overDeep = true      // a climb above the root, floored
+    }
+    return { target: path.join(root, ...parts), overDeep }
+}
+
+// Which declared site root a file belongs to.
+//
+// lmed emits one subtree per language and deploys each as its own domain root
+// (out/bg becomes lmed.bg), so the site root is out/<lang>/ and every url
+// carries one extra `..` for the language segment that the browser then floors.
+// Resolving against the output root instead would miss the over-escape entirely
+// and report working urls as broken. Nothing can derive this — it is deployment
+// intent — so it is declared, and the default is the output root itself.
+export function siteRootFor(relativeFile, roots) {
+    let best = ''
+    for (const root of roots) {
+        if (!root) continue
+        if (relativeFile.startsWith(`${root}/`) && root.length > best.length) best = root
+    }
+    return best
+}
+
+// Everything the output points at that is not there.
+//
+// Returns { broken, overDeep, checked }, where each entry is
+// { url, target, files } — the target with the pages that named it, because
+// "this is missing" is only actionable next to "and these link it".
+export async function checkReferences(outputFolder, { siteRoots = [] } = {}) {
+    const files = await globby(SCANNED, {
+        cwd: outputFolder,
+        followSymbolicLinks: false,
+        suppressErrors: true,
+    })
+
+    const broken = new Map()
+    const overDeep = new Map()
+    let checked = 0
+    // Existence is the expensive part and the same target repeats across a
+    // site — one lookup each.
+    const exists = new Map()
+
+    for (const file of files) {
+        let source
+        try { source = await readFile(path.join(outputFolder, file), 'utf8') }
+        catch { continue }
+
+        const root = siteRootFor(file, siteRoots)
+        // The page's directory, relative to its own site root.
+        const pageDir = path.dirname(file).slice(root.length).replace(/^\/+/, '')
+
+        for (const url of extractReferences(source)) {
+            const { target, overDeep: floored } = resolveUrl(pageDir, url, { root })
+            checked++
+
+            if (!exists.has(target)) {
+                exists.set(target, existsSync(path.join(outputFolder, target)))
+            }
+            // Broken outranks over-deep: a url that resolves nowhere is the
+            // failure, and adding that it is also one level too deep is noise.
+            const bucket = !exists.get(target) ? broken : (floored ? overDeep : null)
+            if (!bucket) continue
+
+            const key = `${target} ${url}`
+            if (!bucket.has(key)) bucket.set(key, { url, target, files: [] })
+            bucket.get(key).files.push(file)
+        }
+    }
+
+    return { broken: [...broken.values()], overDeep: [...overDeep.values()], checked }
+}

package/src/report.js

@@ -115,6 +115,10 @@ export function resetReport() {
     runtime.state.renderErrors = []
     // Per cycle, unlike the wipe: what changed is a fact about THIS build.
     runtime.state.changed = { ids: [], count: 0 }
+    // Per cycle too: an asset referenced by a page that did not re-render this
+    // time was not re-checked, and claiming otherwise would be the kind of
+    // completeness this codebase keeps having to walk back.
+    runtime.state.assetUse = new Map()
 }
 
 // Published on the runtime so runtime.js can start a fresh cycle for a
@@ -209,6 +213,38 @@ export function reportEvaluated(scope, { evaluated, of } = {}) {
     store().evaluated[scope] = { evaluated: evaluated ?? 0, ...(Number.isFinite(of) ? { of } : {}) }
 }
 
+// Files a render linked to, and who linked to them.
+//
+// The URL helpers build paths rather than resolving them, so nothing they hand
+// a template has been checked against a file: a preset that never ran, or one
+// whose format changed under a template still naming the old extension,
+// produces a well-formed link to nothing. The page renders, the build is
+// green, and the image is missing until somebody looks at the site.
+//
+// Keyed by destination with the referencing entities attached, because "this
+// file is missing" is only actionable next to "and these pages point at it".
+//
+// NOT gated on reportWanted(): the check that reads this runs on every build,
+// and gating it would make a broken link visible only to someone who already
+// suspected one.
+export function reportAssetUse(destination, entityId) {
+    if (!destination) return
+    const store = assetUseStore()
+    if (!store.has(destination)) store.set(destination, new Set())
+    if (entityId) store.get(destination).add(entityId)
+}
+
+function assetUseStore() {
+    runtime.state ??= {}
+    runtime.state.assetUse ??= new Map()
+    return runtime.state.assetUse
+}
+
+// Everything referenced this cycle, as [destination, [entity ids]].
+export function assetUse() {
+    return [...assetUseStore()].map(([destination, ids]) => [destination, [...ids]])
+}
+
 // An entity whose SOURCE did not change is gated at import and never becomes
 // a render task at all — so it appears in neither `rendered` nor `skipped`,
 // and the two lists would not reconcile with the corpus size without saying

package/src/track.js

@@ -40,7 +40,7 @@ export function filterKey(filter) {
 // The returned object exposes `partials: Set<string>` and
 // `queries: Array<filter | null>` directly. Consumers iterate either
 // shape; both are owned by the track for the lifetime of the run.
-export function createTrack({ partial = true, query = true, lookup = true, meta = false, consumed = false } = {}) {
+export function createTrack({ partial = true, query = true, lookup = true, meta = false, consumed = false, assets = true } = {}) {
     const track = {}
     if (lookup) {
         // Lookups a TEMPLATE made by name: runtime.href('/contacts'),
@@ -122,6 +122,26 @@ export function createTrack({ partial = true, query = true, lookup = true, meta
             paths.add(path)
         }
     }
+    if (assets) {
+        // Files a template asked for by URL: a preset derivative, a resource
+        // from a library. Recorded so the engine can check at the end of the
+        // cycle whether the thing being linked to is actually in the output.
+        //
+        // The helpers BUILD these paths — nothing they return has been checked
+        // against a file — so a preset that never ran, or one whose format
+        // changed, produces a perfectly well-formed link to nothing. The page
+        // renders, the build is green, and the image is missing until a person
+        // notices.
+        //
+        // The output-relative destination, not the page-relative url the
+        // helper returns: `../../assets/web/hero.webp` cannot be resolved
+        // without knowing which page asked, and this is the form that maps
+        // straight onto a path under the output folder.
+        const assetRefs = new Set()
+        track.assets = assetRefs
+        track.asset = (destination) => { if (destination) assetRefs.add(destination) }
+    }
+
     if (query) {
         const queries = []
         const queryKeys = new Set()
@@ -282,6 +302,7 @@ export function serializeTrack(track) {
         partials:  track.partials  ? [...track.partials]  : undefined,
         queries:   track.queries   ? [...track.queries]   : undefined,
         metaReads: track.metaReads ? [...track.metaReads] : undefined,
+        assets:    track.assets    ? [...track.assets]    : undefined,
         lookups:   track.lookups   ? [...track.lookups].map(([k, v]) => [k, [...v]]) : undefined,
         consumedReads: track.consumedReads
             ? [...track.consumedReads].map(([k, v]) => [k, [...v]]) : undefined,
@@ -296,6 +317,7 @@ export function mergeTrack(target, data) {
     for (const p of data.partials  ?? []) target.partial?.(p)
     for (const q of data.queries   ?? []) target.query?.(q)
     for (const m of data.metaReads ?? []) target.metaRead?.(m)
+    for (const a of data.assets    ?? []) target.asset?.(a)
     for (const [name, ids] of data.lookups ?? []) target.lookup?.(name, ids)
     for (const [id, paths] of data.consumedReads ?? []) {
         for (const path of paths) target.consumedRead?.(id, path)

package/src/utils.js

@@ -1316,3 +1316,30 @@ export function junkFilter() {
         return registered.match.some(test => test(name))
     }
 }
+
+// Does a value fall under a resources library?
+//
+// The library key is a REGULAR EXPRESSION source — `resources()` derives it
+// with escapeStringRegexp(url), and you only escape a string you are about to
+// compile. It has two consumers: the plugin's discovery walk, which decides
+// what to download, and the `resource` render helper, which builds the url.
+// They read the same string with two different matchers — discovery used a
+// GLOB, which demands a full match, so a key derived from `url` (a bare prefix
+// with no trailing wildcard) matched nothing. Nothing was ever downloaded for
+// a url-declared library, while the helper happily built links to the files
+// that were not fetched. Green build, missing images.
+//
+// One function, so the two cannot drift again.
+const libraryPatterns = new Map()
+export function matchesLibrary(value, pattern) {
+    if (typeof value !== 'string' || !pattern) return false
+    if (!libraryPatterns.has(pattern)) {
+        let re
+        try { re = new RegExp(pattern) }
+        // A hand-written `match` that is not valid regex would otherwise throw
+        // mid-walk and take the build down.
+        catch { re = { test: () => false } }
+        libraryPatterns.set(pattern, re)
+    }
+    return libraryPatterns.get(pattern).test(value)
+}