mikser-io 9.81.0 → 9.84.0

package/app.js

@@ -43,7 +43,16 @@ function locate(argv) {
         : tool                    ? { type: 'report', tool, toolArgs: value('--tool-args'), json: has('--json') }
         : explain                 ? { type: 'report', explain, json: has('--json') }
         : has('--audit-output')   ? { type: 'report', auditOutput: true, json: has('--json') }
-        : { type: 'build', clear: has('--clear'), renderPresets: has('--render-presets') ? (value('--render-presets') ?? true) : undefined }
+        : { type: 'build',
+            clear: has('--clear'),
+            // Not a flag that happens to be set — the client's OUTPUT
+            // CONTRACT. `--json` promises the document on stdout and every
+            // log line on stderr, and BOTH halves are decided by the process
+            // that does the writing. Forwarded, that is the instance, which
+            // was started without the flag. So the contract has to travel
+            // with the request or it is not honoured at all.
+            json: has('--json'),
+            renderPresets: has('--render-presets') ? (value('--render-presets') ?? true) : undefined }
 
     return {
         longRunning,

package/docs/diagnostics.md

@@ -796,6 +796,19 @@ queue. A client that writes a file and immediately asks can beat the file
 event, and draining would then build without the change that prompted the
 request.
 
+`--json`, `--tool` and `--tools` keep their stream contract across the socket:
+the document on stdout, the log on stderr, so `mikser --json | jq` means the
+same thing whether or not something is listening. Both halves of that contract
+are decided by the process that writes, which when forwarding is the instance —
+so the flag travels with the request, and each captured chunk is replayed on
+the stream the instance actually used. The contract applies to that one request
+and is restored afterwards: asking for a document does not put the instance
+into json mode for its own output or for the next caller.
+
+`--audit-output` is the exception, and it is the same with or without an
+instance: it reports through the log and writes no document, so `--json` there
+only moves its output to stderr.
+
 ## Faults
 
 A **fault** is a subsystem saying it cannot do its job — as opposed to an
@@ -915,16 +928,38 @@ surfaces that turn silence into a statement:
   - **The emitted output**, read back and resolved the way a browser
     would — `src`, `href`, `poster`, `srcset` and CSS `url()` across
     html and css. This one sees paths written by hand, not just helper
-    output, and it separates two problems that share a symptom:
-    `reference-wrong-base` when the file exists elsewhere in the output
-    (the url was built from the wrong root, and the report names where
-    the file actually is), `reference-broken` when nothing produced it
-    at all.
+    output, and it separates three problems that share a symptom:
+    `reference-no-derivative` when the assets plugin can say why the file
+    is not there, `reference-wrong-base` when the file exists elsewhere in
+    the output (the url was built from the wrong root, and the report names
+    where the file actually is), `reference-broken` when nothing produced
+    it at all.
   - **The render track**, which records every `asset()` / `resource()`
     call and tests the destination it built. This catches a url that
     never reaches an html file at all — one emitted into a feed or a
     sitemap — and warns under `asset-missing`. Where both can see the
     same file, the output scan reports it and this one stays quiet.
+
+  A url under the assets folder gets a cause rather than a guess. Whether a
+  preset covers a file is decided by `match` against the entity id, which is
+  not visible from a url, so the assets plugin is asked and the answer is one
+  of four: the preset name is not configured; the preset does not cover this
+  file (with the `match` that decided it, and any preset that *does* cover it,
+  since the fix is then in the template); the preset covers it and the
+  derivative still is not there, so a render failed; or there is no source
+  file under that name at all. It travels into `--json` as `reason`.
+
+  This matters most where it looks least like itself. `files()` copies the
+  source into the output, so a derivative that was never produced leaves a
+  file of the same name sitting elsewhere — and the wrong-base search finds
+  it and reports a misplaced file with complete confidence. The base is
+  right; the derivative does not exist. A real answer wins over the
+  heuristic wherever there is one.
+
+  `asset()` looks nothing up. It takes a path rather than an entity and is
+  the hottest call in a render, so it stays a string operation; the question
+  is answered once per missing destination after the cycle, and only when
+  something is already wrong.
 - **A link that works only by accident** — a url with one `..` too many
   still loads, because a browser discards a climb above the origin root
   rather than failing. Reported under `reference-over-deep`, separately

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mikser-io",
-  "version": "9.81.0",
+  "version": "9.84.0",
   "files": [
     "app.js",
     "index.js",

package/src/engine.js

@@ -10,7 +10,7 @@ import { instanceControl } from './instance.js'
 import { useJournal, updateEntry } from './journal.js'
 import { globby } from 'globby'
 import { OPERATION, TASKS } from './constants.js'
-import { changeExtension, formatErrorContext, projectMeta, lookupKeys } from './utils.js'
+import { changeExtension, formatErrorContext, projectMeta, lookupKeys, siteRootFor } from './utils.js'
 import { reportRendered, reportSkipped, reportError, renderErrorCount, emitReport, finishCycle, reportAssetUse, assetUse } from './report.js'
 import { checkReferences } from './references.js'
 import { toolSchemas, invokeTool, toolResultText, toolResultFailed } from './tools.js'
@@ -116,11 +116,56 @@ async function reportBrokenReferences(logger) {
     const named = (files) =>
         files.slice(0, 3).join(', ') + (files.length > 3 ? ` and ${files.length - 3} more` : '')
 
-    for (const { url, target, files, elsewhere } of broken.slice(0, SHOWN)) {
+    // Ask the assets plugin before guessing.
+    //
+    // A derivative that was never produced has its SOURCE sitting in the
+    // output — files() copies it there — so the same-name search finds it and
+    // "the file is at media/icons/logo.svg" reads as a base that is off by a
+    // folder. It is not: the base is right and the derivative does not exist,
+    // because the preset does not cover that file. Confidently naming the
+    // wrong cause is worse than naming none, so a real answer wins over the
+    // heuristic wherever there is one.
+    const explain = runtime.state?.assets?.explainMissing
+    const reasons = new Map()
+    if (explain) {
+        // Every broken entry, not the ones that happen to sort first. The cap
+        // below is about how much gets PRINTED; asking only within it made the
+        // answer depend on the position of the entry that had one, so a site
+        // with ten unrelated broken urls reported "No derivative produced: 0"
+        // while holding the cause of the eleventh. Cheap to ask: anything not
+        // under the assets folder is rejected on the first path segment, and
+        // the catalog index behind it is built once and only if something gets
+        // past that.
+        for (const { target } of broken) {
+            // Site-relative, because that is what the assets folder is named
+            // relative to. A build that deploys out/<lang> as its own domain
+            // root resolves this target to `a/derived/web/...`, and a plain
+            // prefix test on the assets folder sees `a` and gives up — the
+            // check goes quiet on exactly the multi-site builds where a
+            // derivative is shared into each root.
+            const root = siteRootFor(target, siteRoots)
+            const local = root ? target.slice(root.length).replace(/^\/+/, '') : target
+            try { reasons.set(target, await explain(local)) } catch { /* never break the report */ }
+        }
+    }
+
+    // A stated cause outranks a guess in what gets printed, not only in how it
+    // is worded. The cap exists so one broken preset cannot bury the rest of
+    // the build — it must not bury the answer instead.
+    const ordered = reasons.size
+        ? [...broken].sort((a, b) => (reasons.get(b.target) ? 1 : 0) - (reasons.get(a.target) ? 1 : 0))
+        : broken
+
+    for (const { url, target, files, elsewhere } of ordered.slice(0, SHOWN)) {
+        const reason = reasons.get(target)
         // Two different problems wear the same symptom. A target whose file
         // exists elsewhere in the output is a base that is wrong, not an asset
         // that is missing — and saying which one saves the reader the search.
-        if (elsewhere?.length) {
+        if (reason) {
+            logger.warn({ code: 'reference-no-derivative', url, target, files, reason },
+                'No derivative was produced: %s (from %s) — %s',
+                url, named(files), reason)
+        } else if (elsewhere?.length) {
             logger.warn({ code: 'reference-wrong-base', url, target, files, elsewhere },
                 'Points at the wrong place: %s (from %s) — nothing at %s, but the file is at %s',
                 url, named(files), target, elsewhere.join(', '))
@@ -131,16 +176,17 @@ async function reportBrokenReferences(logger) {
         }
     }
     if (broken.length) {
-        const misplaced = broken.filter(b => b.elsewhere?.length).length
+        const explained = broken.filter(b => reasons.get(b.target)).length
+        const misplaced = broken.filter(b => b.elsewhere?.length && !reasons.get(b.target)).length
         logger.warn({
             code: 'reference-broken-summary',
-            broken: broken.length, wrongBase: misplaced, checked,
+            broken: broken.length, wrongBase: misplaced, noDerivative: explained, checked,
         },
-            '%d of %d reference(s) in the output resolve to nothing%s. Wrong base (the file exists '
-            + 'elsewhere): %d. Never produced: %d. A URL helper builds the path rather than looking '
-            + 'it up, so neither kind can fail at the point it is written.',
+            '%d of %d reference(s) in the output resolve to nothing%s. No derivative produced: %d. '
+            + 'Wrong base (the file exists elsewhere): %d. Never produced: %d. A URL helper builds the '
+            + 'path rather than looking it up, so none of them can fail at the point it is written.',
             broken.length, checked, broken.length > SHOWN ? `, ${SHOWN} shown` : '',
-            misplaced, broken.length - misplaced)
+            explained, misplaced, broken.length - misplaced - explained)
     }
 
     // Grouped by how FAR each climbed, because a site whose every over-deep url
@@ -215,10 +261,19 @@ async function reportMissingAssets(logger, alreadyReported = new Set()) {
     // every page on the site, and a thousand lines of it buries whatever else
     // the build said.
     const SHOWN = 10
+    const explain = runtime.state?.assets?.explainMissing
     for (const [destination, ids] of missing.slice(0, SHOWN)) {
-        logger.warn({ code: 'asset-missing', destination, referencedBy: ids },
-            'Linked but not in the output: %s — referenced by %s', destination,
-            ids.slice(0, 3).join(', ') + (ids.length > 3 ? ` and ${ids.length - 3} more` : ''))
+        // Same question, same answer, wherever the symptom surfaces. This path
+        // sees urls that never reach an html file at all — a sitemap, a feed —
+        // which the output scan cannot look at.
+        let reason = null
+        if (explain) {
+            try { reason = await explain(destination) } catch { /* never break the report */ }
+        }
+        logger.warn({ code: 'asset-missing', destination, referencedBy: ids, reason },
+            'Linked but not in the output: %s — referenced by %s%s', destination,
+            ids.slice(0, 3).join(', ') + (ids.length > 3 ? ` and ${ids.length - 3} more` : ''),
+            reason ? `. ${reason[0].toUpperCase()}${reason.slice(1)}` : '')
     }
     logger.warn({ code: 'asset-missing-summary', missing: missing.length, checked: used.length },
         '%d of %d linked file(s) are not in the output%s. A URL helper builds the path rather than looking it '

package/src/instance.js

@@ -125,8 +125,11 @@ export function forward({ workingFolder, config, request }) {
         readFrames(socket, (message) => {
             if (message.type === 'log') {
                 // The instance's output for THIS request, on the stream it
-                // would have used locally.
-                process.stderr.write(message.chunk)
+                // would have used locally — which requires knowing which
+                // stream that was. An instance too old to say defaults to
+                // stderr, which is what every frame used to mean.
+                const out = message.stream === 'stdout' ? process.stdout : process.stderr
+                out.write(message.chunk)
             } else if (message.type === 'refused') {
                 answered = true
                 process.stderr.write(`mikser: ${message.reason}\n`)
@@ -197,14 +200,22 @@ let server = null
 // adding a log transport means the client sees precisely what it would have
 // seen locally, formatting and all, with no second rendering of the same
 // records to keep in step.
+// WHICH stream, not merely that something was written.
+//
+// stdout and stderr are not two ways of saying the same thing: under --json,
+// --tool and --tools, stdout carries a machine-readable document and stderr
+// carries the log, and the split is the entire value of those flags. Capturing
+// both into one undifferentiated stream throws that away, and the client can
+// only guess — it guessed stderr, so every forwarded document landed where no
+// consumer looks while the command exited 0.
 function captureOutput(onChunk) {
     const originals = [process.stdout.write, process.stderr.write]
-    const patch = (stream, original) => function (chunk, encoding, callback) {
-        try { onChunk(typeof chunk === 'string' ? chunk : chunk.toString()) } catch { /* client gone */ }
+    const patch = (stream, original, name) => function (chunk, encoding, callback) {
+        try { onChunk(typeof chunk === 'string' ? chunk : chunk.toString(), name) } catch { /* client gone */ }
         return original.call(stream, chunk, encoding, callback)
     }
-    process.stdout.write = patch(process.stdout, originals[0])
-    process.stderr.write = patch(process.stderr, originals[1])
+    process.stdout.write = patch(process.stdout, originals[0], 'stdout')
+    process.stderr.write = patch(process.stderr, originals[1], 'stderr')
     return () => {
         process.stdout.write = originals[0]
         process.stderr.write = originals[1]
@@ -264,10 +275,10 @@ async function configStale() {
 // the only process that can answer correctly. Same guards as a build: wrong
 // config refuses, drifted config refuses.
 async function serveReport(socket, request, logger) {
-    const restore = captureOutput((chunk) => frame(socket, { type: 'log', chunk }))
+    const restore = captureOutput((chunk, stream) => frame(socket, { type: 'log', chunk, stream }))
     let code = 0
     try {
-        code = await runReportOnly(request) ?? 0
+        code = await withRequestOutput(request, () => runReportOnly(request)) ?? 0
     } catch (err) {
         logger?.error('instance: forwarded report failed — %s', err.message)
         code = 3
@@ -328,8 +339,37 @@ function refuseStale(socket, movedFile) {
     })
 }
 
+// The client's output contract, applied to the instance for one request.
+//
+// `--json` is answered by two pieces of code that both read runtime.options:
+// the logger picks its stream per line, and emitReport() writes nothing at all
+// unless the option is set. The instance was started without the flag, so a
+// forwarded `--json` was answered under the INSTANCE's contract — a build
+// emitted no document whatsoever, and a report emitted one into the same
+// stream as the log it was supposed to be separated from.
+//
+// Tighten only, never loosen. A client asking for a document states something
+// the instance cannot know; a client not asking states nothing, and silencing
+// an instance that was itself started under `--json` would take a document
+// away from whatever is reading ITS stdout.
+//
+// Per request and restored after, like renderPresets: one client's flag does
+// not put the instance into json mode for everyone.
+async function withRequestOutput(request, run) {
+    const prior = {}
+    for (const key of ['json', 'tool', 'tools']) {
+        prior[key] = runtime.options[key]
+        if (request[key]) runtime.options[key] = request[key]
+    }
+    try {
+        return await run()
+    } finally {
+        Object.assign(runtime.options, prior)
+    }
+}
+
 async function serveBuild(socket, request, logger) {
-    const restore = captureOutput((chunk) => frame(socket, { type: 'log', chunk }))
+    const restore = captureOutput((chunk, stream) => frame(socket, { type: 'log', chunk, stream }))
     let code = 0
     try {
         // Fire the pending debounce rather than waiting it out.
@@ -356,7 +396,11 @@ async function serveBuild(socket, request, logger) {
         const priorRenderPresets = runtime.options.renderPresets
         if (request.renderPresets !== undefined) runtime.options.renderPresets = request.renderPresets
         try {
-            await runtime.rebuild()
+            // The report is emitted by the cycle itself, from inside
+            // rebuild() — the same call a one-shot makes. Nothing here
+            // re-implements it: the contract is what decides whether it
+            // writes, so setting the contract is the whole fix.
+            await withRequestOutput(request, () => runtime.rebuild())
         } finally {
             runtime.options.renderPresets = priorRenderPresets
         }

package/src/plugins/assets.js

@@ -97,19 +97,100 @@ export function assets(options = {}) {
     // reported once per process at onFinalize.
     const matchTally = { evaluated: 0, matched: new Set(), reported: false }
 
+    // Which presets select this entity. No counters, no side effects.
+    //
+    // Split out because the same question gets asked twice for different
+    // reasons: once as files enter the catalog, where the answer drives the
+    // render and feeds the unmatched-preset tally, and once after the cycle to
+    // explain a derivative that is not there. The second must not move the
+    // counters the first reports on.
+    //
+    // `some`, not a push per matching pattern. Two patterns that both cover a
+    // file used to name their preset twice in the list; the second render was
+    // gated by the checksum, so nothing rendered twice — but "which presets
+    // cover this file" is a question with one answer, and the explainer below
+    // puts that answer in front of a reader.
+    function presetsSelecting(entity) {
+        const selected = []
+        for (const preset in (options.presets || {})) {
+            const { matches } = normalizePresetConfig(options.presets[preset])
+            if (matches.some(match => matchEntity(entity, match))) selected.push(preset)
+        }
+        return selected
+    }
+
     async function getEntityPresets(entity) {
-        const entityPresets = []
         matchTally.evaluated++
-        for (let preset in (options.presets || {})) {
-            const { matches } = normalizePresetConfig(options.presets[preset])
-            for (let match of matches) {
-                if (matchEntity(entity, match)) {
-                    entityPresets.push(preset)
-                    matchTally.matched.add(preset)
-                }
+        const selected = presetsSelecting(entity)
+        for (const preset of selected) matchTally.matched.add(preset)
+        return selected
+    }
+
+    // Why a linked derivative is not in the output.
+    //
+    // The engine detects the CONSEQUENCE — it knows what the output points at
+    // and what exists on disk — but it cannot name the cause, because whether
+    // a preset covers a file is decided by `match` against the entity id and
+    // none of that is visible from a url. So one sentence covered a mistyped
+    // preset name, a preset that did not run, and a file no preset was ever
+    // asked to cover. The last is the common one, the only one whose fix is in
+    // the config rather than in the template, and the one the reader is least
+    // likely to guess.
+    //
+    // Answered here rather than in the helper: `asset()` takes a path, not an
+    // entity, and it is the hottest call in a render. Nothing is looked up
+    // when the url is built. This runs at most a handful of times, after
+    // everything has settled, and only when something is already wrong.
+    let sourceIndex = null
+    let sourceIndexCycle
+    async function explainMissing(destination) {
+        const assetsName = runtime.options.assets
+        const parts = String(destination).replace(/^\/+/, '').split('/')
+        if (!assetsName || parts[0] !== assetsName || parts.length < 3) return null
+        const preset = parts[1]
+        const name = parts.slice(2).join('/')
+
+        const configured = Object.keys(options.presets || {}).sort()
+        if (!options.presets?.[preset]) {
+            return `no preset named '${preset}' is configured (configured: ${configured.join(', ') || 'none'})`
+        }
+
+        // The derivative wears the PRESET's extension, so the source is found
+        // by stem — `media/hero.webp` came from `media/hero.jpg`.
+        const stem = (value) => value.slice(0, value.length - path.extname(value).length)
+
+        // Built once per cycle and only on this path: a build with nothing
+        // broken never walks the catalog for it.
+        const cycle = runtime.state?.cycle?.id ?? null
+        if (sourceIndexCycle !== cycle) { sourceIndex = null; sourceIndexCycle = cycle }
+        if (!sourceIndex) {
+            sourceIndex = new Map()
+            for await (const candidate of iterateEntities({ collection: { $ne: collection } })) {
+                if (typeof candidate.name !== 'string') continue
+                const key = stem(candidate.name)
+                if (!sourceIndex.has(key)) sourceIndex.set(key, [])
+                sourceIndex.get(key).push(candidate)
             }
         }
-        return entityPresets
+
+        const source = (sourceIndex.get(stem(name)) ?? [])[0]
+        if (!source) {
+            return `no source file is named '${stem(name)}' — nothing would produce this derivative `
+                + 'under any preset'
+        }
+
+        const owns = presetsSelecting(source)
+        if (owns.includes(preset)) {
+            return `preset '${preset}' does cover ${source.id}, so the derivative should be there — it was `
+                + 'not produced this cycle (the preset render failed, or the preset changed and only '
+                + '--render-presets re-derives what is already in the catalog)'
+        }
+        const { matches } = normalizePresetConfig(options.presets[preset])
+        return `preset '${preset}' does not cover ${source.id} — its match is `
+            + `${matches.join(', ') || '(none)'}`
+            + (owns.length
+                ? `. Presets that do cover it: ${owns.join(', ')}`
+                : '. No configured preset covers it')
     }
 
     // Report presets that matched none of the entities this run evaluated.
@@ -315,6 +396,11 @@ export function assets(options = {}) {
         runtime.state.assets = {
             presets: {},
             assetsMap: {},
+            // The engine asks this when a linked derivative is not on disk.
+            // Published on state rather than imported, so the engine keeps
+            // knowing nothing about presets and says nothing when this plugin
+            // is not loaded.
+            explainMissing,
             assetsFolder: options.outputFolder
                 ? path.join(options.outputFolder, assetsName)
                 : assetsName,

package/src/references.js

@@ -38,6 +38,9 @@ const ATTR = /(?:src|href|poster|data-bg)\s*=\s*["']([^"']*)["']/gi
 const SRCSET = /(?:img|image)?srcset\s*=\s*["']([^"']*)["']/gi
 // css url(), in a stylesheet and in an inline style attribute alike.
 const CSS_URL = /url\(\s*(['"]?)([^'")]*)\1\s*\)/gi
+// The same, but inside a CUSTOM PROPERTY declaration — which resolves from a
+// different place, see below.
+const CUSTOM_PROP_URL = /--[\w-]+\s*:\s*[^;{}]*?url\(\s*(['"]?)([^'")]*)\1\s*\)/gi
 
 // A url this check has nothing to say about: another origin, an inline
 // payload, a fragment or an in-page action. `//host/path` is protocol-relative
@@ -88,6 +91,10 @@ export { siteRootFor }
 export function extractReferences(rawSource) {
     const source = decodeEntities(rawSource)
     const found = new Set()
+    // Collected first, so a url that appears in a custom property is known to
+    // be one however else it is matched — CSS_URL sees it too.
+    const custom = new Set()
+    for (const [, , url] of source.matchAll(CUSTOM_PROP_URL)) custom.add(url)
     for (const [, url] of source.matchAll(ATTR)) found.add(url)
     for (const [, , url] of source.matchAll(CSS_URL)) found.add(url)
     for (const [, list] of source.matchAll(SRCSET)) {
@@ -96,7 +103,9 @@ export function extractReferences(rawSource) {
             if (url) found.add(url)
         }
     }
-    return [...found].filter(u => !isExternal(u))
+    return [...found]
+        .filter(u => !isExternal(u))
+        .map(url => ({ url, customProperty: custom.has(url) }))
 }
 
 // Resolve the way a browser does, which is the whole point.
@@ -133,9 +142,18 @@ export function resolveUrl(pageDir, url, { root = '' } = {}) {
 // { url, target, files } — the target with the pages that named it, because
 // "this is missing" is only actionable next to "and these link it".
 export async function checkReferences(outputFolder, { siteRoots = [] } = {}) {
+    // Following symlinks, because that is what gets served.
+    //
+    // files() emits by symlinking the source into the output, so a stylesheet
+    // is usually a link rather than a copy — and skipping links meant no
+    // symlinked html or css was ever read. Every `url()` inside a bundle went
+    // unchecked on any site built that way, silently, while the check reported
+    // a confident total. The same-name index below has always followed them,
+    // which is how a file could be FOUND elsewhere by a scan that would not
+    // READ it.
     const files = await globby(SCANNED, {
         cwd: outputFolder,
-        followSymbolicLinks: false,
+        followSymbolicLinks: true,
         suppressErrors: true,
     })
 
@@ -146,6 +164,30 @@ export async function checkReferences(outputFolder, { siteRoots = [] } = {}) {
     // site — one lookup each.
     const exists = new Map()
 
+    // Where a `url()` inside a CUSTOM PROPERTY resolves from.
+    //
+    // Not the page. A custom property is substituted where it is USED, and the
+    // url resolves against the stylesheet doing the substituting — so
+    //
+    //     <span style="--icon-btn-src:url(&quot;../media/icons/x.svg&quot;)">
+    //
+    // on a page three directories deep is CORRECT when the bundle that reads
+    // var(--icon-btn-src) sits at styles/. Resolving it from the page reports
+    // a base problem for markup that ships and works, and fifteen such lines
+    // are how the reader learns to skim past this check entirely.
+    //
+    // Which stylesheet substitutes it is not knowable from the bytes — any
+    // rule using the variable does — so every emitted stylesheet is a
+    // candidate base, and one that resolves is enough to stay quiet. A url
+    // that resolves from none of them is still reported: it is missing
+    // wherever it is read from.
+    const styleBases = files
+        .filter(file => file.endsWith('.css'))
+        .map((file) => {
+            const root = siteRootFor(file, siteRoots)
+            return { root, dir: path.dirname(file).slice(root.length).replace(/^\/+/, '') }
+        })
+
     for (const file of files) {
         let source
         try { source = await readFile(path.join(outputFolder, file), 'utf8') }
@@ -155,13 +197,23 @@ export async function checkReferences(outputFolder, { siteRoots = [] } = {}) {
         // The page's directory, relative to its own site root.
         const pageDir = path.dirname(file).slice(root.length).replace(/^\/+/, '')
 
-        for (const url of extractReferences(source)) {
+        for (const { url, customProperty } of extractReferences(source)) {
             const { target, overDeep, floored } = resolveUrl(pageDir, url, { root })
             checked++
 
             if (!exists.has(target)) {
                 exists.set(target, existsSync(path.join(outputFolder, target)))
             }
+
+            // Resolved from a stylesheet instead, and correct there.
+            if (!exists.get(target) && customProperty && styleBases.some((base) => {
+                const from = resolveUrl(base.dir, url, { root: base.root }).target
+                if (!exists.has(from)) {
+                    exists.set(from, existsSync(path.join(outputFolder, from)))
+                }
+                return exists.get(from)
+            })) continue
+
             // Broken outranks over-deep: a url that resolves nowhere is the
             // failure, and adding that it is also one level too deep is noise.
             const bucket = !exists.get(target) ? broken : (overDeep ? overDeepRefs : null)