human-to-code 0.1.27 → 0.1.28

package/docs/MODULES.md

@@ -95,11 +95,14 @@ accept typed, already-reviewed data and perform no I/O or mutation.
 | `candidate-overlay.ts` | In-memory candidate overlay combining whole-file outputs and inline replacements for staged validation; the working tree stays unchanged and stale or conflicting units are excluded fail-closed. |
 | `program-diagnostics.ts` | Combined TypeScript Compiler API validation over the candidate overlay: TypeScript is checked semantically; JavaScript follows explicit project `checkJs` or file `@ts-check` policy. Includes an overlay-aware compiler host, bundled `node:` typings, and multiplicity/location-aware baseline comparison. |
 | `dependency-graph.ts` | Resolved-import dependency grouping of candidate files and bounded diagnostic-to-unit attribution; diagnostics that cannot be safely attributed fail the whole staged batch. |
-| `integration-validation.ts` | Default-off cross-language audit orchestration. It groups generated files using structured ProjectMemory relationships, validates exact audit JSON against real group paths, permits one repair per named target, verifies once, and rejects unresolved groups. Large components are split into bounded relationship neighborhoods. |
+| `integration-validation.ts` | Cross-language audit orchestration (on by default). It groups generated files using structured ProjectMemory relationships, validates exact audit JSON against real group paths, permits one repair per named target, verifies once, and rejects unresolved groups. Large components are split into bounded relationship neighborhoods. |
+| `project-blueprint.ts` | The shared contract agreed once per run before any file is generated: strict bounded parser for the planning JSON, plus per-target rendering. Every path is checked against real planned targets; a credential-bearing blueprint is discarded. |
+| `unit-todos.ts` | Per-unit todo parsing, the deterministic `todoCoverage` check, and the `contractRegression` ratchet that discards a refinement unless it preserves everything the previous pass produced. |
+| `reference-validation.ts` | Deterministic cross-file reference checking over generated HTML/CSS/JS with zero model requests: missing script selectors and assets are blocking; markup/stylesheet naming drift is advisory. Includes a CSS rule scanner and specificity comparator. |
 | `staged-validation.ts` | Orchestrates overlay build, combined program validation, group rejection, and the bounded per-unit repair budget (secret-scanned repair context, injected repair callback). Produces per-unit accept/reject results for the CLI. |
 | `file-memory.ts` | Ephemeral declaration memory, replacement normalization, candidate-validation retry isolation, and sequential per-file generation. |
 | `project-memory.ts` | Ephemeral codebase context for direct generation. Stores current and projected path inventories, planned source-to-output mappings, target-relative companion/asset paths, language package-module guidance, and secret-aware compact contracts. Renders a deterministic bounded subset per target and learns accepted candidate contracts for later generation/repair requests; it never executes source or persists a cache. |
-| `project-contracts.ts` | Static language-aware summarizers used by ProjectMemory: imports/includes/declarations, HTML references/ids/classes/elements/inline handler calls/control labels, CSS imports/URLs/custom properties/selectors, JavaScript DOM selectors, and limited package metadata. Credential-bearing content produces no contract. |
+| `project-contracts.ts` | Static language-aware summarizers used by ProjectMemory and by cross-file reference checking. Exposes structured `htmlFacts`/`cssFacts`/`javaScriptFacts` with the `*Contract` renderers formatting over them — one parser, two consumers. Extracts: imports/includes/declarations, HTML references/ids/classes/elements/inline handler calls/control labels, CSS imports/URLs/custom properties/selectors, JavaScript DOM selectors, and limited package metadata. Credential-bearing content produces no contract. |
 | `language-relationships.ts` | Declarative/extensible language relationship profiles for scripts/modules, Python, Rust, Go, Java, C/C++, C#, Ruby, HTML/CSS/assets, and same-language fallbacks. Integration orchestration consumes only their structured role/path/reference output. |
 | `generation-client.ts` | Direct provider requests through OpenAI-compatible chat or Ollama: one conversion request per unit plus optional bounded integration and compiler-repair requests, always using the central prompt builders. |
 | `presentation.ts` | Stable conversion receipt and unambiguous single-code-block extraction; rejects multiple or unterminated fences. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "human-to-code",
-  "version": "0.1.27",
+  "version": "0.1.28",
   "description": "Safely turn reviewed natural-language change contracts into validated code patches.",
   "type": "module",
   "main": "./dist/index.js",