ast-mcp-server 0.15.0 → 0.15.1

package/CHANGELOG.md

@@ -6,7 +6,17 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
-## [0.15.0] — not yet published (2026-11-04)
+## [0.15.1] — not yet published (2026-11-04)
+
+### Changed
+
+- `@angular/compiler` 18 and 19 are now supported (`>=18.0.0 <23.0.0`); an Angular 18 project previously reported `compiler_unsupported` and missed every template usage (#399).
+
+### Fixed
+
+- `publish-next` waits up to five minutes (was two) for the registry to expose an accepted publish before giving up, and when that bound is exhausted after a publish that did not throw, it now points the maintainer at `verify-next` instead of asking for a new dispatch that would try to republish immutable bytes. `0.15.0` was reported as failed 46 seconds before the registry served it (#395).
+
+## [0.15.0] — published to `next`, verification failed, not promoted (2026-11-04)
 
 ### Added
 
@@ -29,6 +39,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 - `ast_find_references` and `ast_rename_symbol` no longer count the declaration identifier as a reference. When a member was used before its declaration in source order, ts-morph returned the declaration identifier among the references, so the declaration appeared twice and `reference_count` was inflated by one. The declaration is now reported once and `reference_count` counts only real references (#390).
 - The dsh-adapter smoke no longer reports a surviving Harness process tree when descendants are still exiting after a clean shutdown on a loaded runner. The lifecycle assertion now polls the owned process tree with a bounded ten-second deadline, and when survivors remain it keeps failing but lists each PID with its command line and parent chain (#363).
 
+### Release status
+
+- npm published these immutable bytes under `next` with provenance and the expected Git commit (`5b2d483001d21ef29a760a9c0ae538dc719f11ea`, integrity `sha512-4dUo7lyTyIGMPhWfVHHZ0BnUMXNAiSIapItorm3VTGiJXm8JyL6jW5lrNlj1LGyONAGtA6S6cHoFtiZxakGy1A==`, publish run `41905976154`). Public-registry verification (run `41906680048`) then failed for the same reason as `0.14.3`: the consumer install resolves `minimatch@10.2.6` through `ts-morph@28.0.0`, flagged by `npm audit` for GHSA-g3hv-75wg-m249 (#361). `0.15.0` was never promoted to `latest`, tagged in Git, or released on GitHub; the version that ships the ts-morph fix will supersede it.
+
 ## [0.14.3] — published to `next`, verification failed, not promoted (2026-11-01)
 
 ### Security

package/README.md

@@ -81,7 +81,7 @@ These fields are additive: existing edge shapes, kind strings, defaults, and pub
 
 ### Angular templates
 
-In an Angular project, `ast_find_references` also reports usages of a component member in its template, and `ast_rename_symbol` rewrites external templates as part of the same reviewed plan. This needs the project's own `@angular/compiler`. The server does not bundle it: it is an optional peer dependency (`>=20.0.0 <23.0.0`, majors 20 to 22) that Angular projects already install next to `@angular/core`. Nothing changes for projects without `@angular/core`.
+In an Angular project, `ast_find_references` also reports usages of a component member in its template, and `ast_rename_symbol` rewrites external templates as part of the same reviewed plan. This needs the project's own `@angular/compiler`. The server does not bundle it: it is an optional peer dependency (`>=18.0.0 <23.0.0`, majors 18 to 22) that Angular projects already install next to `@angular/core`. Nothing changes for projects without `@angular/core`.
 
 Install or align it in the target project when the response reports `compiler_missing` or `compiler_unsupported`:
 
@@ -371,7 +371,7 @@ For a local candidate, pack and install its tarball instead:
 
 ```bash
 yarn pack --out ast-mcp-server-%v.tgz
-dsh plugin --profile web add ./ast-mcp-server-0.15.0.tgz
+dsh plugin --profile web add ./ast-mcp-server-0.15.1.tgz
 ```
 
 The first supported surface is **reads + prepare + preview**. Every apply path is

package/cordis.patch.yml

@@ -3,7 +3,7 @@
 # Mounts the packaged `ast-mcp-server` stdio command through the official
 # `@deepseek-ai/dsh-mcp-client` bridge. Harness does not resolve MCP binaries
 # from PATH, so the entrypoint is resolved relative to the profile directory
-# (`baseUrl`), where `dsh plugin --profile <name> add ./ast-mcp-server-0.15.0.tgz`
+# (`baseUrl`), where `dsh plugin --profile <name> add ./ast-mcp-server-0.15.1.tgz`
 # installs a locally packed package as a dependency.
 #
 # First-slice surface: reads + prepare + preview. Every apply path is denied

package/dist/services/angular-templates.js

@@ -9,7 +9,7 @@ import { assertSafeOperationFile } from "./safe-file.js";
 const MAX_TEMPLATE_BYTES = 512 * 1024;
 const MAX_TEMPLATE_NODES = 100_000;
 const CHECKPOINT_EVERY_NODES = 1000;
-const MIN_COMPILER_MAJOR = 20;
+const MIN_COMPILER_MAJOR = 18;
 const MAX_COMPILER_MAJOR = 22;
 const TWO_WAY_BINDING = 5; // BindingType.TwoWay, stable across supported majors
 const TWO_WAY_EVENT = 2; // ParsedEventType.TwoWay, stable across supported majors

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ast-mcp-server",
-  "version": "0.15.0",
+  "version": "0.15.1",
   "description": "Structural code MCP server and batch CLI for compact TypeScript/JavaScript reads and hash-bound AST edits.",
   "keywords": [
     "mcp",
@@ -110,7 +110,7 @@
     "zod": "^4.6.7"
   },
   "peerDependencies": {
-    "@angular/compiler": ">=20.0.0 <23.0.0"
+    "@angular/compiler": ">=18.0.0 <23.0.0"
   },
   "peerDependenciesMeta": {
     "@angular/compiler": {
@@ -120,6 +120,8 @@
   "devDependencies": {
     "@eslint/js": "^10.0.1",
     "@types/node": "^26.6.5",
+    "angular-compiler-v18": "npm:@angular/compiler@18.2.14",
+    "angular-compiler-v19": "npm:@angular/compiler@19.2.15",
     "angular-compiler-v20": "npm:@angular/compiler@20.3.34",
     "angular-compiler-v21": "npm:@angular/compiler@21.2.25",
     "angular-compiler-v22": "npm:@angular/compiler@22.2.4",
@@ -133,5 +135,5 @@
     "vitest": "^5.0.5",
     "yaml": "^2.9.0"
   },
-  "gitHead": "5b2d483001d21ef29a760a9c0ae538dc719f11ea"
+  "gitHead": "20548017b7c9266160963a0272ce8757b8f42a77"
 }

package/skills/structural-code-editing/SKILL.md

@@ -55,7 +55,7 @@ Limits to state when reporting:
 
 - `ast_explore` is TypeScript-only: its references omit template usages. This is tracked in issue #380. Use `ast_find_references` for template evidence; rename still blocks independently.
 - Diagnostics stay TypeScript-only: `ast_get_diagnostics` and the post-apply delta do not detect template errors. A template-only breakage produces no diagnostic, so run the project's Angular build or tests after a rename.
-- Detection uses the user's own `@angular/compiler`, never a bundled one. It is an optional peer (`>=20.0.0 <23.0.0`) that the project already installs with Angular. If it is missing or out of range, coverage is `unfinished` and rename is blocked. Yarn PnP projects without `node_modules` resolve nothing and report `unfinished`.
+- Detection uses the user's own `@angular/compiler`, never a bundled one. It is an optional peer (`>=18.0.0 <23.0.0`) that the project already installs with Angular. If it is missing or out of range, coverage is `unfinished` and rename is blocked. Yarn PnP projects without `node_modules` resolve nothing and report `unfinished`.
 
 ## Contributor contract
 

package/skills/structural-code-editing/releases.json

@@ -6,7 +6,7 @@
     "files": [
       {
         "path": "SKILL.md",
-        "sha256": "94ff4ce2a97d33cad56b7c1ed8057d0ff7ca22988aebd7923b21319326307c18"
+        "sha256": "afd054a923d9a4f825066e5c3fd2dfa7ae2269a8464819b032a5fbf19a9b14fd"
       },
       {
         "path": "references/operations.md",