ast-mcp-server 0.16.0 → 0.17.0

package/CHANGELOG.md

@@ -6,7 +6,26 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
-## [0.16.0] — not yet published (2026-11-06)
+## [0.17.0] — not yet published (2026-11-09)
+
+### Added
+
+- `ast_rename_symbol` runs an Angular template type check for renames that edit templates and reports the result as `template_diagnostics` (`status`, `reason`, `added`, `removed`, `added_errors`). The check is on by default and best-effort: it runs ngtsc in a one-shot child process that never writes to the workspace, within a time budget, and `unavailable` or `unfinished` statuses mean unknown, so run the project's build or tests. The field is absent for non-Angular projects and renames that edit no template; the `diagnostics` field stays TypeScript-only (#421).
+- New `ast_rename_symbol` input `block_on_template_errors` (default `false`). It blocks the plan only when a `completed` check adds template errors, and `allow_new_errors` waives it (#421).
+- The check needs `@angular/compiler-cli` to resolve from the project (same version as `@angular/compiler`, TypeScript within its peer range); it is not a declared peer, and without it the status is `unavailable` with `compiler_cli_missing`. `template_diagnostics[].file` is relative to the directory of the tsconfig, while `diagnostics[].file` is relative to `project_root` (#421).
+- Spike results and the design decision are in `docs/spikes/0421-template-type-check.md` and `docs/adr/0017-template-type-check-worker.md` (#421).
+
+### Changed
+
+- Plans from a template-editing rename persist as plan schema v3 (the hash adds `template_diagnostics` and `block_on_template_errors`), even when the status is `unavailable` or `unfinished`. Plans without a check keep schema v2 and the same hash. After a downgrade or revert, schema v3 plans are rejected on import (#421).
+- The `ast_rename_symbol` and `ast_find_references` tool descriptions no longer say template errors are not diagnosed; `ast_find_references` still reports usages only and points to `template_diagnostics` (#421).
+
+### Fixed
+
+- With `@angular/compiler` 18 or 19, template usage scans walked every subtree twice per nesting level, so `ast_find_references` on a `@Pipe` class or a component member reported `unfinished` with `work_exhausted` on deeply nested templates, and `ast_rename_symbol` refused the rename. Each template is now walked once on every supported major (#441).
+- Upgrading the `structural-code-editing` skill over an unmodified install from npm `0.16.0` would have failed with a conflict: its content changed after `0.16.0` (#443) while the skill version stayed `4.7.0`, and the `0.16.0` byte set had no recorded predecessor. The published `0.16.0` bytes are now recorded, and the skill version is `4.8.0` (#447).
+
+## [0.16.0] — published to `next`, verification failed, not promoted (2026-11-07)
 
 ### Added
 
@@ -26,6 +45,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 - `@Directive` members declared with `@Input`, `@Output`, `input()`, `output()` or `model()` reported no `template_coverage`, and members listed in the `inputs` / `outputs` metadata arrays of a `@Component` or `@Directive` were treated as plain members, so `ast_rename_symbol` planned their rename without blocking. They now report `unfinished` with reason `cross_component` (directives with `templates: 0`; a non-literal metadata array marks every member of the class), and `ast_rename_symbol` refuses them with `INCOMPLETE_EVIDENCE` (#410).
 - Upgrading the `structural-code-editing` skill over an unmodified install from npm `0.11.0`–`0.15.1` failed with a conflict: `0.13.0`–`0.15.1` had no recorded predecessor, and the `0.11.0`–`0.12.0` predecessors did not list `references/operations.md`. Every published byte set is now recorded, and the skill version is `4.7.0` (#425).
 
+### Release status
+
+- npm published these immutable bytes under `next` with provenance and the expected Git commit (`0f5a3f137703fdd673640d00a04087db3b2808af`, integrity `sha512-eyKYMudp0DisVhVJctgwXwZERA2GGsNPP8eU+P/Zh7A9aSf/0mGG9PoGY6qxtBAMW+1FJd+nFLizqo8Go7NLZA==`, publish run `42329276499`). Public-registry verification (run `42331039791`) then failed for the same reason as `0.14.3`–`0.15.1`: the consumer install resolves `minimatch@10.2.6` through `ts-morph@28.0.0`, flagged by `npm audit` for GHSA-g3hv-75wg-m249 (#361). `0.16.0` supersedes `0.15.1` on `next` and was not promoted to `latest`, tagged in Git, or released on GitHub.
+
 ## [0.15.1] — published to `next`, verification failed, not promoted (2026-11-05)
 
 ### Changed

package/README.md

@@ -97,7 +97,11 @@ Template evidence is explicit about what it proves:
 - Rename rewrites consumer bindings of a selector-bound member when coverage is `completed`, keeping the binding syntax, values and alias-keyed bindings. It returns `INCOMPLETE_EVIDENCE` when coverage is `unfinished` or `unsupported` (including `hostDirectives`, `@Directive` members and metadata-listed members), and `MUTATION_BLOCKED` for inline templates, a name collision with a template local or another binding of the element, `[(x)]` on a non-`model()` pair, `$any`, or a name in the selector. Inline templates are never rewritten.
 - Renaming a `@Pipe` class applies TypeScript edits only and keeps the `name` literal and every `| name` usage; renaming `transform` returns `INCOMPLETE_EVIDENCE`.
 - `ast_explore` stays TypeScript-only for references; template evidence there is tracked in #380. Use `ast_find_references` for template usages.
-- Diagnostics stay TypeScript-only: template errors are not detected, so run the project's Angular build or tests after a rename. Template type checking of rename plans is tracked in #421.
+- The `diagnostics` field stays TypeScript-only. When a rename edits a template, the plan also carries `template_diagnostics`: a best-effort Angular template type-check delta (`status`, `reason` when not `completed`, `added`, `removed`, `added_errors`) computed by the project's own `@angular/compiler-cli` in a separate child process that never writes to the workspace. It is absent for non-Angular projects and for renames that edit no template. `status` is `completed`, `unavailable` (`compiler_cli_missing`, `compiler_unsupported`, `typescript_incompatible`) or `unfinished` (`work_exhausted`, `deadline`, `check_failed`); the arrays are empty unless it is `completed`.
+- Treat `unavailable` and `unfinished` as unknown, never as clean: run the project's Angular build or tests before applying. `block_on_template_errors` (default `false`) blocks the plan only when the status is `completed` and `added_errors` is not empty; `allow_new_errors` waives it. Without the input the delta is reported but never blocks.
+- `template_diagnostics[].file` is relative to the directory of the tsconfig, while `diagnostics[].file` is relative to `project_root`; they differ when the tsconfig is not at the project root.
+- `@angular/compiler-cli` is not a declared peer. It must resolve from the project, with the same version as `@angular/compiler` and a TypeScript inside its supported range; otherwise the status is `unavailable` with `compiler_cli_missing`.
+- Any template-editing rename emits `template_diagnostics` and persists as plan schema v3, even when the status is `unavailable` or `unfinished`. Plans without the field stay schema v2. After a downgrade or revert, schema v3 plans are rejected on import. See [ADR 0017](docs/adr/0017-template-type-check-worker.md) and the [spike](docs/spikes/0421-template-type-check.md).
 - Yarn PnP projects without a `node_modules` directory cannot resolve the compiler and report `unfinished`; use `nodeLinker: node-modules` for template coverage.
 
 ## Why this helps
@@ -374,7 +378,7 @@ For a local candidate, pack and install its tarball instead:
 
 ```bash
 yarn pack --out ast-mcp-server-%v.tgz
-dsh plugin --profile web add ./ast-mcp-server-0.16.0.tgz
+dsh plugin --profile web add ./ast-mcp-server-0.17.0.tgz
 ```
 
 The first supported surface is **reads + prepare + preview**. Every apply path is

package/cordis.patch.yml

@@ -3,7 +3,7 @@
 # Mounts the packaged `ast-mcp-server` stdio command through the official
 # `@deepseek-ai/dsh-mcp-client` bridge. Harness does not resolve MCP binaries
 # from PATH, so the entrypoint is resolved relative to the profile directory
-# (`baseUrl`), where `dsh plugin --profile <name> add ./ast-mcp-server-0.16.0.tgz`
+# (`baseUrl`), where `dsh plugin --profile <name> add ./ast-mcp-server-0.17.0.tgz`
 # installs a locally packed package as a dependency.
 #
 # First-slice surface: reads + prepare + preview. Every apply path is denied

package/dist/angular-template-typecheck-entry.js

@@ -0,0 +1,19 @@
+import fs from "node:fs";
+import { fileURLToPath } from "node:url";
+import { runTemplateTypeCheck } from "./services/angular-template-typecheck-core.js";
+import { RequestSchema } from "./services/angular-template-typecheck-protocol.js";
+/** Validates one IPC request and runs the core; it never throws. */
+export async function handleRequest(raw, run = runTemplateTypeCheck) {
+    const parsed = RequestSchema.safeParse(raw);
+    return parsed.success ? run(parsed.data) : { v: 1, ok: false, reason: "check_failed" };
+}
+// One-shot child: serve a single request, reply, exit. A lost parent ends the process too.
+const entry = process.argv[1];
+if (process.send &&
+    entry &&
+    fs.realpathSync(entry) === fs.realpathSync(fileURLToPath(import.meta.url))) {
+    process.once("disconnect", () => process.exit(1));
+    process.once("message", (raw) => {
+        void handleRequest(raw).then((reply) => process.send(reply, () => process.exit(0)));
+    });
+}

package/dist/services/angular-package-resolution.js

@@ -0,0 +1,62 @@
+import { existsSync } from "node:fs";
+import { createRequire } from "node:module";
+import path from "node:path";
+export const MIN_COMPILER_MAJOR = 18;
+export const MAX_COMPILER_MAJOR = 22;
+/** Resolves `request` the way the project's own tooling would, or `undefined` when absent. */
+export function resolveFrom(tsConfigFilePath, request) {
+    try {
+        const resolved = createRequire(tsConfigFilePath).resolve(request);
+        return existsSync(resolved) ? resolved : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function isWithin(parent, child) {
+    const relative = path.relative(parent, child);
+    return relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+}
+/** True when `packageDir` sits in a node_modules directory owned by `projectDir` or an ancestor. */
+export function isUnderAncestorNodeModules(packageDir, projectDir) {
+    const segments = packageDir.split(path.sep);
+    return segments.some((segment, index) => segment === "node_modules" &&
+        isWithin(segments.slice(0, index).join(path.sep) || path.sep, projectDir));
+}
+export function isSupportedVersion(version) {
+    const match = /^(\d+)\.(\d+)\.(\d+)(-[0-9A-Za-z.-]+)?(?:\+.*)?$/u.exec(String(version));
+    if (!match)
+        return false;
+    const [major, minor, patch] = [match[1], match[2], match[3]].map(Number);
+    const belowFloor = major === MIN_COMPILER_MAJOR && minor === 0 && patch === 0 && !!match[4];
+    return major >= MIN_COMPILER_MAJOR && major <= MAX_COMPILER_MAJOR && !belowFloor;
+}
+const MAX_COMPARATORS = 4;
+const COMPARATOR = /^(>=|<)(\d+)\.(\d+)(?:\.(\d+))?$/u;
+const PLAIN_VERSION = /^(\d+)\.(\d+)\.(\d+)$/u;
+function compareTriples(left, right) {
+    return left[0] - right[0] || left[1] - right[1] || left[2] - right[2];
+}
+/**
+ * Evaluates a plain `x.y.z` version against a space-joined list of `>=x.y[.z]` and `<x.y[.z]`
+ * comparators, the only grammar the Angular peer ranges need. Anything else (`||`, `^`, `~`,
+ * wildcards, prereleases, other operators) is `unsupported` so callers fail closed.
+ */
+export function rangeVerdict(version, range) {
+    const plain = PLAIN_VERSION.exec(version);
+    const tokens = range.trim().split(/\s+/u);
+    if (!plain || tokens.length === 0 || tokens.length > MAX_COMPARATORS)
+        return "unsupported";
+    const actual = [Number(plain[1]), Number(plain[2]), Number(plain[3])];
+    let satisfied = true;
+    for (const token of tokens) {
+        const match = COMPARATOR.exec(token);
+        if (!match)
+            return "unsupported";
+        const bound = [Number(match[2]), Number(match[3]), Number(match[4] ?? 0)];
+        const order = compareTriples(actual, bound);
+        if (match[1] === ">=" ? order < 0 : order >= 0)
+            satisfied = false;
+    }
+    return satisfied ? "satisfied" : "unsatisfied";
+}

package/dist/services/angular-template-typecheck-core.js

@@ -0,0 +1,139 @@
+import { createRequire } from "node:module";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { MAX_MESSAGE_CHARS, } from "./angular-template-typecheck-protocol.js";
+/** Loads the TypeScript that ngtsc itself resolves, then the pre-validated compiler-cli entry. */
+export async function loadToolchain(cliEntry) {
+    const tsEntry = createRequire(cliEntry).resolve("typescript");
+    const ts = (await import(pathToFileURL(tsEntry).href)).default;
+    const cli = (await import(pathToFileURL(cliEntry).href));
+    return { ts, cli };
+}
+/** True when the public surface this driver needs is present (never touches `private/*`). */
+export function probeCompilerApi(cli) {
+    return (typeof cli.NgtscProgram === "function" &&
+        typeof cli.readConfiguration === "function" &&
+        typeof cli.createCompilerHost === "function" &&
+        typeof cli.NgtscProgram.prototype?.getNgSemanticDiagnostics === "function");
+}
+/** Forces the options that make an emit or a build-info write impossible. */
+export function withNoEmit(options) {
+    return {
+        ...options,
+        noEmit: true,
+        incremental: false,
+        composite: false,
+        tsBuildInfoFile: undefined,
+    };
+}
+/** Scope B: an edited template or a scoped component file, never anything under node_modules. */
+export function isInScope(fileName, scopeFiles) {
+    return scopeFiles.has(fileName) && !fileName.split(/[\\/]/u).includes("node_modules");
+}
+export function toWireDiagnostic(ts, root, diagnostic) {
+    const { file } = diagnostic;
+    const start = diagnostic.start ?? null;
+    const position = file && start !== null ? file.getLineAndCharacterOfPosition(start) : null;
+    return {
+        code: diagnostic.code,
+        category: ts.DiagnosticCategory[diagnostic.category] ?? String(diagnostic.category),
+        file: file ? path.relative(root, file.fileName) : "",
+        line: position ? position.line + 1 : null,
+        column: position ? position.character + 1 : null,
+        message: ts
+            .flattenDiagnosticMessageText(diagnostic.messageText, "\n")
+            .slice(0, MAX_MESSAGE_CHARS),
+        start,
+        length: diagnostic.length ?? null,
+    };
+}
+/**
+ * Host over the disk with an optional in-memory overlay. Unchanged files come from one cache
+ * shared by both runs, so the after run reuses the identical SourceFile objects and only parses
+ * overlay files again.
+ */
+function createCheckHost({ ts, cli }, options, overlay, shared) {
+    const tsHost = ts.createCompilerHost(options, true);
+    const { readFile, fileExists, getSourceFile } = tsHost;
+    const fresh = new Map();
+    tsHost.writeFile = () => {
+        throw new Error("The template type check must not write files.");
+    };
+    tsHost.readFile = (name) => overlay?.get(name) ?? readFile.call(tsHost, name);
+    tsHost.fileExists = (name) => overlay?.has(name) === true || fileExists.call(tsHost, name);
+    tsHost.getSourceFile = (name, languageVersion, ...rest) => {
+        const text = overlay?.get(name);
+        if (text !== undefined) {
+            if (!fresh.has(name))
+                fresh.set(name, ts.createSourceFile(name, text, languageVersion, true));
+            return fresh.get(name);
+        }
+        if (!shared.has(name)) {
+            shared.set(name, getSourceFile.call(tsHost, name, languageVersion, ...rest));
+        }
+        return shared.get(name);
+    };
+    const ngHost = cli.createCompilerHost({ options, tsHost });
+    if (overlay) {
+        // With `oldProgram` reuse ngtsc re-analyzes a component only if it is told which resources changed.
+        const resources = new Set([...overlay.keys()].filter((name) => !/\.[cm]?tsx?$/u.test(name)));
+        ngHost.getModifiedResourceFiles = () => resources;
+    }
+    return ngHost;
+}
+async function checkSide(toolchain, config, request, overlay, shared, oldProgram) {
+    const host = createCheckHost(toolchain, config.options, overlay, shared);
+    const program = new toolchain.cli.NgtscProgram(config.rootNames, config.options, host, oldProgram);
+    await program.loadNgStructureAsync();
+    const compiler = program.compiler;
+    if (typeof compiler?.getComponentsWithTemplateFile !== "function")
+        return "unsupported";
+    const scope = new Set(request.templates);
+    for (const template of request.templates) {
+        for (const component of compiler.getComponentsWithTemplateFile(template)) {
+            scope.add(component.getSourceFile().fileName);
+        }
+    }
+    const root = path.dirname(request.tsconfig);
+    const diagnostics = program
+        .getNgSemanticDiagnostics()
+        .filter((diagnostic) => diagnostic.file && isInScope(diagnostic.file.fileName, scope))
+        .map((diagnostic) => toWireDiagnostic(toolchain.ts, root, diagnostic));
+    return { program, diagnostics };
+}
+const fail = (reason) => ({
+    v: 1,
+    ok: false,
+    reason,
+});
+/** Runs ngtsc on the disk state, then on disk plus overlay, and returns both scoped lists. */
+export async function runTemplateTypeCheck(request, load = loadToolchain) {
+    try {
+        const toolchain = await load(request.cliEntry);
+        if (!probeCompilerApi(toolchain.cli))
+            return fail("compiler_unsupported");
+        const read = toolchain.cli.readConfiguration(request.tsconfig);
+        if (read.errors.length > 0)
+            return fail("check_failed");
+        const config = { options: withNoEmit(read.options), rootNames: read.rootNames };
+        const shared = new Map();
+        const overlay = new Map(request.overlay.map((file) => [file.absolutePath, file.text]));
+        const before = await checkSide(toolchain, config, request, undefined, shared, undefined);
+        if (before === "unsupported")
+            return fail("compiler_unsupported");
+        if (before.diagnostics.length > request.maxDiagnostics)
+            return fail("work_exhausted");
+        const after = await checkSide(toolchain, config, request, overlay, shared, before.program);
+        if (after === "unsupported")
+            return fail("compiler_unsupported");
+        if (after.diagnostics.length > request.maxDiagnostics)
+            return fail("work_exhausted");
+        return { v: 1, ok: true, before: before.diagnostics, after: after.diagnostics };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : "";
+        return fail(message.startsWith("The Angular Compiler requires TypeScript")
+            ? "typescript_incompatible"
+            : "check_failed");
+    }
+}

package/dist/services/angular-template-typecheck-protocol.js

@@ -0,0 +1,75 @@
+import path from "node:path";
+import { z } from "zod";
+/** Caps shared by both ends of the one-shot IPC channel (v1). */
+export const MAX_WIRE_DIAGNOSTICS = 5000;
+export const MAX_OVERLAY_BYTES = 32 * 1024 * 1024;
+export const MAX_TEMPLATES = 2000;
+export const MAX_OVERLAY_FILES = 10_000;
+const MAX_PATH_CHARS = 4096;
+export const MAX_MESSAGE_CHARS = 8192;
+const absolutePath = z
+    .string()
+    .max(MAX_PATH_CHARS)
+    .refine((value) => path.isAbsolute(value), "must be an absolute path");
+export const RequestSchema = z
+    .object({
+    v: z.literal(1),
+    tsconfig: absolutePath,
+    cliEntry: absolutePath,
+    templates: z.array(absolutePath).max(MAX_TEMPLATES),
+    overlay: z
+        .array(z.object({ absolutePath, text: z.string() }).strict())
+        .max(MAX_OVERLAY_FILES)
+        .refine((files) => files.reduce((total, file) => total + Buffer.byteLength(file.text, "utf8"), 0) <=
+        MAX_OVERLAY_BYTES, "overlay exceeds the byte cap"),
+    maxDiagnostics: z.number().int().min(1).max(MAX_WIRE_DIAGNOSTICS),
+})
+    .strict();
+const position = z.number().int().nonnegative().nullable();
+export const WireDiagnosticSchema = z
+    .object({
+    code: z.number().int(),
+    category: z.string().max(32),
+    /** Project-relative path. */
+    file: z.string().max(MAX_PATH_CHARS),
+    line: position,
+    column: position,
+    message: z.string().max(MAX_MESSAGE_CHARS),
+    start: position,
+    length: position,
+})
+    .strict();
+/** Only a successful reply carries diagnostics, so a non-completed status can never include any. */
+export const ResponseSchema = z.discriminatedUnion("ok", [
+    z
+        .object({
+        v: z.literal(1),
+        ok: z.literal(true),
+        before: z.array(WireDiagnosticSchema).max(MAX_WIRE_DIAGNOSTICS),
+        after: z.array(WireDiagnosticSchema).max(MAX_WIRE_DIAGNOSTICS),
+    })
+        .strict(),
+    z
+        .object({
+        v: z.literal(1),
+        ok: z.literal(false),
+        reason: z.enum([
+            "compiler_unsupported",
+            "typescript_incompatible",
+            "work_exhausted",
+            "check_failed",
+        ]),
+    })
+        .strict(),
+]);
+/** Separates an over-cap reply (work bound) from a malformed one (check failure). */
+export function parseResponse(value) {
+    if (typeof value === "object" && value !== null) {
+        const { before, after } = value;
+        const oversizedSide = (side) => Array.isArray(side) && side.length > MAX_WIRE_DIAGNOSTICS;
+        if (oversizedSide(before) || oversizedSide(after))
+            return { status: "oversized" };
+    }
+    const parsed = ResponseSchema.safeParse(value);
+    return parsed.success ? { status: "valid", response: parsed.data } : { status: "malformed" };
+}

package/dist/services/angular-template-typecheck.js

@@ -0,0 +1,262 @@
+import { fork } from "node:child_process";
+import { readFileSync, realpathSync } from "node:fs";
+import { createRequire } from "node:module";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { isSupportedVersion, isUnderAncestorNodeModules, isWithin, rangeVerdict, resolveFrom, } from "./angular-package-resolution.js";
+import { MAX_OVERLAY_BYTES, MAX_OVERLAY_FILES, MAX_TEMPLATES, MAX_WIRE_DIAGNOSTICS, parseResponse, } from "./angular-template-typecheck-protocol.js";
+import { compareObservedDiagnostics, } from "./diagnostics.js";
+import { NO_REQUEST_CONTEXT, RequestContextError } from "./request-context.js";
+const UNSUPPORTED = { ok: false, reason: "compiler_unsupported" };
+/** Locates an installed package through the shared guard, or reports why it cannot be trusted. */
+function locatePackage(tsConfigFilePath, name, projectDir) {
+    const manifestPath = resolveFrom(tsConfigFilePath, `${name}/package.json`);
+    if (!manifestPath) {
+        try {
+            createRequire(tsConfigFilePath).resolve(`${name}/package.json`);
+        }
+        catch (error) {
+            if (error.code === "MODULE_NOT_FOUND")
+                return "missing";
+        }
+        return "unsupported";
+    }
+    try {
+        const dir = realpathSync(path.dirname(manifestPath));
+        if (!isUnderAncestorNodeModules(dir, projectDir))
+            return "unsupported";
+        const manifest = JSON.parse(readFileSync(path.join(dir, "package.json"), "utf8"));
+        return manifest?.name === name ? { dir, manifest } : "unsupported";
+    }
+    catch {
+        return "unsupported";
+    }
+}
+function majorOf(version) {
+    return Number(String(version).split(".")[0]);
+}
+/** In-process checks before any spawn; TypeScript is resolved from the compiler-cli, as ngtsc does. */
+export function preflightTemplateTypeCheck(tsConfigFilePath) {
+    let projectDir;
+    try {
+        projectDir = realpathSync(path.dirname(tsConfigFilePath));
+    }
+    catch {
+        return UNSUPPORTED;
+    }
+    const cli = locatePackage(tsConfigFilePath, "@angular/compiler-cli", projectDir);
+    if (cli === "missing")
+        return { ok: false, reason: "compiler_cli_missing" };
+    if (cli === "unsupported")
+        return UNSUPPORTED;
+    const compiler = locatePackage(tsConfigFilePath, "@angular/compiler", projectDir);
+    const core = locatePackage(tsConfigFilePath, "@angular/core", projectDir);
+    if (typeof compiler === "string" || typeof core === "string")
+        return UNSUPPORTED;
+    const version = cli.manifest.version;
+    if (!isSupportedVersion(version) || compiler.manifest.version !== version)
+        return UNSUPPORTED;
+    if (!isSupportedVersion(core.manifest.version) ||
+        majorOf(core.manifest.version) !== majorOf(version)) {
+        return UNSUPPORTED;
+    }
+    const entry = resolveFrom(tsConfigFilePath, "@angular/compiler-cli");
+    let cliEntry;
+    try {
+        cliEntry = entry && realpathSync(entry);
+    }
+    catch {
+        return UNSUPPORTED;
+    }
+    if (!cliEntry || !isWithin(cli.dir, cliEntry))
+        return UNSUPPORTED;
+    const peer = cli.manifest.peerDependencies?.typescript;
+    const typescript = resolveFrom(path.join(cli.dir, "package.json"), "typescript/package.json");
+    if (typeof peer !== "string")
+        return UNSUPPORTED;
+    if (!typescript)
+        return { ok: false, reason: "typescript_incompatible" };
+    let typescriptVersion;
+    try {
+        typescriptVersion = JSON.parse(readFileSync(typescript, "utf8")).version;
+    }
+    catch {
+        return UNSUPPORTED;
+    }
+    const verdict = rangeVerdict(String(typescriptVersion), peer);
+    if (verdict === "unsupported")
+        return UNSUPPORTED;
+    if (verdict === "unsatisfied")
+        return { ok: false, reason: "typescript_incompatible" };
+    return { ok: true, cliDir: cli.dir, cliEntry };
+}
+function emptyDelta(status, reason) {
+    return { status, reason, added: [], removed: [], addedErrors: [] };
+}
+const MAX_CHECK_MS = 30_000;
+const MIN_CHECK_MS = 2_000;
+const RESERVE_MS = 10_000;
+const CHILD_HEAP_MB = 1024;
+const EXIT_SETTLE_MS = 500;
+const OOM_EXIT_CODE = 134;
+const DEFAULT_ENTRY = fileURLToPath(new URL("../angular-template-typecheck-entry.js", import.meta.url));
+const UNBOUNDED_CONTEXT = {
+    signal: NO_REQUEST_CONTEXT.signal,
+    checkpoint: () => NO_REQUEST_CONTEXT.checkpoint(),
+    remainingMs: () => MAX_CHECK_MS + RESERVE_MS,
+};
+/** Time the child may run: capped, and leaving a reserve for the rest of the operation. */
+export function checkBudgetMs(remainingMs) {
+    return Math.min(MAX_CHECK_MS, remainingMs - RESERVE_MS);
+}
+function outcomeOf(code, signal, reply) {
+    if (signal === "SIGABRT" || code === OOM_EXIT_CODE) {
+        return { kind: "reason", reason: "work_exhausted" };
+    }
+    if (code !== 0)
+        return { kind: "reason", reason: "check_failed" };
+    const parsed = parseResponse(reply);
+    if (parsed.status === "valid")
+        return { kind: "reply", response: parsed.response };
+    return {
+        kind: "reason",
+        reason: parsed.status === "oversized" ? "work_exhausted" : "check_failed",
+    };
+}
+/** Runs one child to completion; it is always reaped before this settles. */
+function runChild(request, budgetMs, ctx, deps) {
+    return new Promise((resolve, reject) => {
+        let child;
+        try {
+            child = (deps.spawn ?? fork)(deps.entry ?? DEFAULT_ENTRY, [], {
+                execPath: process.execPath,
+                execArgv: [`--max-old-space-size=${CHILD_HEAP_MB}`],
+                env: {},
+                serialization: "advanced",
+                stdio: ["ignore", "ignore", "ignore", "ipc"],
+            });
+        }
+        catch {
+            return resolve({ kind: "reason", reason: "check_failed" });
+        }
+        let reply;
+        let killedFor;
+        let failed = false;
+        let settled = false;
+        const kill = (why) => {
+            killedFor ??= why;
+            child.kill("SIGKILL");
+        };
+        const settle = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            ctx.signal.removeEventListener("abort", onAbort);
+            if (result instanceof Error)
+                reject(result);
+            else
+                resolve(result);
+        };
+        const onAbort = () => kill("abort");
+        const timer = setTimeout(() => kill("deadline"), budgetMs);
+        ctx.signal.addEventListener("abort", onAbort, { once: true });
+        child.once("message", (message) => {
+            reply = message;
+        });
+        child.once("error", () => {
+            failed = true;
+            // No pid means the spawn itself failed and no exit will follow; otherwise reap first.
+            if (child.pid === undefined)
+                settle({ kind: "reason", reason: "check_failed" });
+            else
+                child.kill("SIGKILL");
+        });
+        child.once("exit", (code, signal) => {
+            const finish = () => {
+                if (killedFor === "abort")
+                    settle(abortError(ctx));
+                else if (killedFor === "deadline")
+                    settle({ kind: "deadline" });
+                else if (failed)
+                    settle({ kind: "reason", reason: "check_failed" });
+                else
+                    settle(outcomeOf(code, signal, reply));
+            };
+            // Pending IPC messages are delivered before the channel reports closed.
+            if (!child.connected)
+                return finish();
+            child.once("disconnect", finish);
+            setTimeout(finish, EXIT_SETTLE_MS).unref();
+        });
+        if (ctx.signal.aborted)
+            return onAbort();
+        child.send(request, () => undefined);
+    });
+}
+function abortError(ctx) {
+    try {
+        ctx.checkpoint();
+    }
+    catch (error) {
+        return error;
+    }
+    return new RequestContextError("REQUEST_CANCELLED");
+}
+function observations(diagnostics) {
+    return diagnostics.map(({ start, length, ...shown }, ordinal) => ({
+        public: {
+            code: shown.code,
+            category: shown.category,
+            file: shown.file,
+            line: shown.line,
+            column: shown.column,
+            message: shown.message,
+        },
+        start,
+        length,
+        ordinal,
+    }));
+}
+function diagnosticsOf(response, changes, ctx) {
+    if (!response.ok) {
+        const reason = response.reason;
+        return emptyDelta(reason === "compiler_unsupported" || reason === "typescript_incompatible"
+            ? "unavailable"
+            : "unfinished", reason);
+    }
+    const delta = compareObservedDiagnostics(observations(response.before), observations(response.after), changes, ctx);
+    return { status: "completed", ...delta };
+}
+/**
+ * Entry point of the template type check: preflight and limits in-process, then one forked child
+ * under a wall-clock budget. A client abort kills the child and rethrows `REQUEST_CANCELLED`.
+ */
+export async function checkTemplateTypes(input, ctx = UNBOUNDED_CONTEXT, deps = {}) {
+    ctx.checkpoint();
+    const preflight = preflightTemplateTypeCheck(input.tsConfigFilePath);
+    if (!preflight.ok)
+        return emptyDelta("unavailable", preflight.reason);
+    const overlayBytes = input.overlay.reduce((total, file) => total + Buffer.byteLength(file.text, "utf8"), 0);
+    if (input.templates.length > MAX_TEMPLATES ||
+        input.overlay.length > MAX_OVERLAY_FILES ||
+        overlayBytes > MAX_OVERLAY_BYTES) {
+        return emptyDelta("unfinished", "work_exhausted");
+    }
+    const budgetMs = checkBudgetMs(ctx.remainingMs());
+    if (budgetMs < MIN_CHECK_MS)
+        return emptyDelta("unfinished", "deadline");
+    const outcome = await runChild({
+        v: 1,
+        tsconfig: input.tsConfigFilePath,
+        cliEntry: preflight.cliEntry,
+        templates: [...input.templates],
+        overlay: input.overlay.map(({ absolutePath, text }) => ({ absolutePath, text })),
+        maxDiagnostics: MAX_WIRE_DIAGNOSTICS,
+    }, budgetMs, ctx, deps);
+    if (outcome.kind === "deadline")
+        return emptyDelta("unfinished", "deadline");
+    if (outcome.kind === "reason")
+        return emptyDelta("unfinished", outcome.reason);
+    return diagnosticsOf(outcome.response, input.changes, ctx);
+}

package/dist/services/angular-templates.js

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { existsSync, readFileSync, realpathSync } from "node:fs";
+import { readFileSync, realpathSync } from "node:fs";
 import { readFile, stat } from "node:fs/promises";
 import { createRequire } from "node:module";
 import path from "node:path";
@@ -8,45 +8,17 @@ import { Node, SyntaxKind } from "ts-morph";
 import { angularCoreMajor, componentDecorator, isCoreDecorator, isDirectiveClass, isMetadataPublic, isPipeClass, isSelectorPublic, literalString, bindingNames, metadataBindingNames, } from "./angular-decorators.js";
 import { extractConsumerUsages, mayMatch, } from "./angular-template-bindings.js";
 import { createScopeResolver, MAX_SCOPE_VISITS, ScopeWorkExhausted, } from "./angular-template-scope.js";
+import { isSupportedVersion, isUnderAncestorNodeModules, isWithin, resolveFrom, } from "./angular-package-resolution.js";
 import { assertSafeOperationFile } from "./safe-file.js";
 const MAX_TEMPLATE_BYTES = 512 * 1024;
 const MAX_TEMPLATE_NODES = 100_000;
 const CHECKPOINT_EVERY_NODES = 1000;
-const MIN_COMPILER_MAJOR = 18;
-const MAX_COMPILER_MAJOR = 22;
 const TWO_WAY_BINDING = 5; // BindingType.TwoWay, stable across supported majors
 const TWO_WAY_EVENT = 2; // ParsedEventType.TwoWay, stable across supported majors
 const SCAN_LIMITS = { templates: 2000, bytes: 32 * 1024 * 1024, nodes: 1_000_000 };
 const NOT_APPLICABLE = { coverage: { status: "not_applicable" }, usages: [] };
 const ASSIGNMENT_OPERATION = /^(?:=|(?:\*\*|&&|\|\||\?\?|<<|>>>|>>|[+\-*/%&|^])=)$/u;
 const compilerCache = new Map();
-function resolveFrom(tsConfigFilePath, request) {
-    try {
-        const resolved = createRequire(tsConfigFilePath).resolve(request);
-        return existsSync(resolved) ? resolved : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-function isWithin(parent, child) {
-    const relative = path.relative(parent, child);
-    return relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
-}
-/** True when `packageDir` sits in a node_modules directory owned by `projectDir` or an ancestor. */
-function isUnderAncestorNodeModules(packageDir, projectDir) {
-    const segments = packageDir.split(path.sep);
-    return segments.some((segment, index) => segment === "node_modules" &&
-        isWithin(segments.slice(0, index).join(path.sep) || path.sep, projectDir));
-}
-function isSupportedVersion(version) {
-    const match = /^(\d+)\.(\d+)\.(\d+)(-[0-9A-Za-z.-]+)?(?:\+.*)?$/u.exec(String(version));
-    if (!match)
-        return false;
-    const [major, minor, patch] = [match[1], match[2], match[3]].map(Number);
-    const belowFloor = major === MIN_COMPILER_MAJOR && minor === 0 && patch === 0 && !!match[4];
-    return major >= MIN_COMPILER_MAJOR && major <= MAX_COMPILER_MAJOR && !belowFloor;
-}
 async function loadCompiler(tsConfigFilePath) {
     const unsupported = { reason: "compiler_unsupported" };
     const manifestPath = resolveFrom(tsConfigFilePath, "@angular/compiler/package.json");
@@ -323,9 +295,12 @@ function extractUsages(compiler, nodes, query, rc, onNode = () => { }) {
         return collector.names;
     };
     class Templates extends compiler.TmplAstRecursiveVisitor {
+        // v18/v19 `tmplAstVisitAll` runs `visitor.visit(node) || node.visit(visitor)`; returning
+        // true marks the node handled so each subtree is walked once instead of twice per level.
         visit(node) {
             tick();
             node.visit(this);
+            return true;
         }
         view(locals, children, before) {
             const names = [...locals, ...referencesOf(children)].filter((name) => !!name);

package/dist/services/h03-timeout-fixture.js

@@ -38,7 +38,7 @@ export class H05LifecycleFixtureController {
         const generationSignal = this.#generationAbort.signal, signal = AbortSignal.any([context.signal, generationSignal]);
         const checkpoint = () => { if (!this.accepts(identity) || generationSignal.aborted)
             throw new H03TimeoutFixtureError(); context.checkpoint(); };
-        const hooked = Object.freeze({ get sequence() { return context.sequence; }, get phase() { return context.phase; }, signal, checkpoint, markExecuting: () => context.markExecuting(), enterCompletionCritical: () => { checkpoint(); context.enterCompletionCritical(); } });
+        const hooked = Object.freeze({ get sequence() { return context.sequence; }, get phase() { return context.phase; }, signal, checkpoint, markExecuting: () => context.markExecuting(), remainingMs: () => context.remainingMs(), enterCompletionCritical: () => { checkpoint(); context.enterCompletionCritical(); } });
         this.#active += 1;
         this.#emit({ ...eventIdentity, phase: "started" });
         try {
@@ -201,6 +201,7 @@ export class H03TimeoutFixtureController {
             signal,
             checkpoint,
             markExecuting: () => context.markExecuting(),
+            remainingMs: () => context.remainingMs(),
             enterCompletionCritical: () => {
                 checkpoint();
                 context.enterCompletionCritical();

package/dist/services/operation-block-policy.js

@@ -0,0 +1,19 @@
+const REVIEW_HINT = "Prepare again with allow_new_errors=true only after explicit review.";
+/**
+ * A plan is blocked by new TypeScript errors, and, only when opted in, by new template errors of
+ * a `completed` check. A check that did not complete never blocks. `allow_new_errors` waives both.
+ */
+export function evaluateBlock(input) {
+    const templateErrors = input.blockOnTemplateErrors && input.template?.status === "completed"
+        ? input.template.addedErrors.length
+        : 0;
+    const reasons = [
+        ...(input.typescriptErrors > 0
+            ? [`${input.typescriptErrors} new TypeScript error(s) would be introduced.`]
+            : []),
+        ...(templateErrors > 0 ? [`${templateErrors} new template error(s) would be introduced.`] : []),
+    ];
+    if (input.allowNewErrors || reasons.length === 0)
+        return { blocked: false, reason: null };
+    return { blocked: true, reason: `${reasons.join(" ")} ${REVIEW_HINT}` };
+}

package/dist/services/operation-plan-file.js

@@ -6,6 +6,8 @@ import { z } from "zod";
 import { applyOperation, configureOperationApply, exportOperationRecord, importOperationRecord, } from "./operations.js";
 import { ensurePrivateDirectory, resolveRuntimeStateDirectory, } from "./runtime-state.js";
 export const PLAN_SCHEMA_VERSION = 2;
+/** Plans that carry a template type-check delta persist as this version. */
+export const TEMPLATE_PLAN_SCHEMA_VERSION = 3;
 export const MAX_PLAN_BYTES = 50 * 1024 * 1024;
 const HashSchema = z.string().regex(/^[a-f0-9]{64}$/);
 const IsoDateSchema = z.string().datetime({ offset: true });
@@ -38,8 +40,27 @@ const PersistedFileSchema = AffectedFileSchema.extend({
     updated_bytes_base64: z.string(),
     mode: z.number().int().nonnegative(),
 }).strict();
-const PersistedOperationSchema = z
-    .object({
+const TemplateReasonSchema = z.enum([
+    "compiler_cli_missing",
+    "compiler_unsupported",
+    "typescript_incompatible",
+    "work_exhausted",
+    "deadline",
+    "check_failed",
+]);
+const TemplateDiagnosticsSchema = z.discriminatedUnion("status", [
+    DiagnosticDeltaSchema.extend({ status: z.literal("completed") }).strict(),
+    z
+        .object({
+        status: z.enum(["unavailable", "unfinished"]),
+        reason: TemplateReasonSchema,
+        added: z.array(DiagnosticSchema).max(0),
+        removed: z.array(DiagnosticSchema).max(0),
+        addedErrors: z.array(DiagnosticSchema).max(0),
+    })
+        .strict(),
+]);
+const PersistedOperationShape = {
     operation_id: z.string().uuid(),
     plan_hash: HashSchema,
     kind: z.enum(["rename_symbol", "replace_symbol_body", "scaffold_class"]),
@@ -60,14 +81,24 @@ const PersistedOperationSchema = z
     preview_truncated: z.boolean(),
     applied_at: IsoDateSchema.optional(),
     files: z.array(PersistedFileSchema).min(1),
+};
+const PersistedOperationSchema = z.object(PersistedOperationShape).strict();
+const PersistedOperationV3Schema = z
+    .object({
+    ...PersistedOperationShape,
+    template_diagnostics: TemplateDiagnosticsSchema,
+    block_on_template_errors: z.boolean(),
 })
     .strict();
 const PlanEnvelopeSchema = z.discriminatedUnion("schema_version", [
     z.object({ schema_version: z.literal(1), operation: PersistedOperationSchema }).strict(),
     z.object({ schema_version: z.literal(2), operation: PersistedOperationSchema }).strict(),
+    z.object({ schema_version: z.literal(3), operation: PersistedOperationV3Schema }).strict(),
 ]);
 function planEnvelope(version, operation) {
-    return version === 1 ? { schema_version: 1, operation } : { schema_version: 2, operation };
+    if (version === 1)
+        return { schema_version: 1, operation };
+    return version === 2 ? { schema_version: 2, operation } : { schema_version: 3, operation };
 }
 function stateDirectory(options) {
     return resolveRuntimeStateDirectory(options);
@@ -148,7 +179,10 @@ async function readPlanEnvelope(planFileInput) {
 export async function persistOperationPlan(operationId, options = {}) {
     const plansDirectory = path.join(stateDirectory(options), "plans");
     const planFile = path.join(plansDirectory, `${operationId}.astplan`);
-    await atomicWritePlan(planFile, planEnvelope(PLAN_SCHEMA_VERSION, exportOperationRecord(operationId)));
+    const record = exportOperationRecord(operationId);
+    await atomicWritePlan(planFile, planEnvelope(record.template_diagnostics === undefined
+        ? PLAN_SCHEMA_VERSION
+        : TEMPLATE_PLAN_SCHEMA_VERSION, record));
     return planFile;
 }
 export async function applyPersistedOperation(planFileInput, planHash, options = {}) {

package/dist/services/operations.js

@@ -7,6 +7,8 @@ import { LanguageVariant, Node, ScriptTarget, SyntaxKind, ts } from "ts-morph";
 import { isPipeClass } from "./angular-decorators.js";
 import { planTemplateEdits } from "./angular-template-rename.js";
 import { collectTemplateUsages } from "./angular-templates.js";
+import { checkTemplateTypes } from "./angular-template-typecheck.js";
+import { evaluateBlock } from "./operation-block-policy.js";
 import { findNonDeclarationReferences } from "./references.js";
 import { compareObservedDiagnostics, observeDiagnostic, } from "./diagnostics.js";
 import { probePublicationCapability, publishAuthenticated, removeOwnedPublicationEntry, rollbackOwnedCommit, snapshotHeldFile, } from "./authenticated-publication.js";
@@ -47,6 +49,7 @@ function planHashFor(operation, version = 2) {
         diagnostics: operation.diagnostics,
         allow_new_errors: operation.allow_new_errors,
         blocked: operation.blocked,
+        ...(version === 3 ? templateHashFields(operation) : {}),
         files: operation.files.map((file) => ({
             file: file.file,
             original_hash: file.originalHash,
@@ -55,6 +58,27 @@ function planHashFor(operation, version = 2) {
         })),
     }));
 }
+/** The version 3 additions, in a fixed key order so equal deltas always hash equal. */
+function templateHashFields(operation) {
+    const delta = operation.template_diagnostics;
+    if (delta === undefined || operation.block_on_template_errors === undefined) {
+        throw new Error("A version 3 plan requires template_diagnostics and block_on_template_errors.");
+    }
+    return {
+        template_diagnostics: {
+            status: delta.status,
+            ...(delta.status === "completed" ? {} : { reason: delta.reason }),
+            added: delta.added,
+            removed: delta.removed,
+            addedErrors: delta.addedErrors,
+        },
+        block_on_template_errors: operation.block_on_template_errors,
+    };
+}
+/** Plans without a template check keep hashing as version 2; only a check upgrades them. */
+function planVersionOf(operation) {
+    return operation.template_diagnostics === undefined ? 2 : 3;
+}
 function pruneOperations() {
     const now = operationNow();
     for (const [id, operation] of operations) {
@@ -216,8 +240,22 @@ async function planAuxiliaryFiles(edits, projectRoot, snapshotFiles, requestCont
     }
     return planned;
 }
+/** Maps the planned files to the check input; paths are relative to the tsconfig directory. */
+function templateCheckInput(tsConfigFilePath, files, auxiliaryFiles) {
+    const base = path.dirname(tsConfigFilePath);
+    return {
+        tsConfigFilePath,
+        templates: auxiliaryFiles.map((file) => file.absolutePath),
+        overlay: files.map((file) => ({ absolutePath: file.absolutePath, text: file.updatedText })),
+        changes: files.map((file) => ({
+            file: path.relative(base, file.absolutePath),
+            beforeText: isCreatedFile(file) ? null : file.originalText,
+            afterText: file.updatedText,
+        })),
+    };
+}
 /** Internal seam shared by the prepare functions; exported so tests can drive `mutate` directly. */
-export async function createPlan(projectRootInput, kind, allowNewErrors, mutate, requestContext) {
+export async function createPlan(projectRootInput, kind, allowNewErrors, mutate, requestContext, planOptions = {}) {
     requestContext.checkpoint();
     let retainedOperationId;
     return withProjectOperation(projectRootInput, async (operationContext) => {
@@ -316,13 +354,25 @@ export async function createPlan(projectRootInput, kind, allowNewErrors, mutate,
             postWorkspaceFiles.set(file.absolutePath, file.updatedHash);
         }
         const postWorkspaceHash = hashWorkspaceFiles(postWorkspaceFiles);
+        // Only a rename that edits templates is checked; the check runs inside the project lock and
+        // before the digest check below, which proves the child's disk reads saw an unchanged tree.
+        const templateDiagnostics = kind === "rename_symbol" && auxiliaryFiles.length > 0
+            ? await checkTemplateTypes(templateCheckInput(context.tsConfigFilePath, files, auxiliaryFiles), operationContext)
+            : undefined;
+        operationContext.checkpoint();
         const workspaceAfter = createWorkspaceSnapshot(createFreshProject(context.tsConfigFilePath));
         operationContext.checkpoint();
         if (workspaceAfter.digest !== workspaceBefore.digest) {
             throw new Error("Workspace changed while the operation was being prepared. Retry preparation.");
         }
         const fullPreview = files.map((file) => file.diff).join("\n");
-        const blocked = !allowNewErrors && diagnosticDelta.addedErrors.length > 0;
+        const blockOnTemplateErrors = planOptions.blockOnTemplateErrors ?? false;
+        const verdict = evaluateBlock({
+            allowNewErrors,
+            typescriptErrors: diagnosticDelta.addedErrors.length,
+            template: templateDiagnostics,
+            blockOnTemplateErrors,
+        });
         const now = operationNow();
         const operationId = randomUUID();
         const recordWithoutHash = {
@@ -344,17 +394,21 @@ export async function createPlan(projectRootInput, kind, allowNewErrors, mutate,
             workspace_file_count: workspaceBefore.fileCount,
             diagnostics: diagnosticDelta,
             allow_new_errors: allowNewErrors,
-            blocked,
-            block_reason: blocked
-                ? `${diagnosticDelta.addedErrors.length} new TypeScript error(s) would be introduced. Prepare again with allow_new_errors=true only after explicit review.`
-                : null,
+            blocked: verdict.blocked,
+            block_reason: verdict.reason,
             preview: fullPreview.length <= MAX_INLINE_PREVIEW_CHARS ? fullPreview : null,
             preview_truncated: fullPreview.length > MAX_INLINE_PREVIEW_CHARS,
+            ...(templateDiagnostics === undefined
+                ? {}
+                : {
+                    template_diagnostics: templateDiagnostics,
+                    block_on_template_errors: blockOnTemplateErrors,
+                }),
             files,
         };
         const record = {
             ...recordWithoutHash,
-            plan_hash: planHashFor(recordWithoutHash),
+            plan_hash: planHashFor(recordWithoutHash, planVersionOf(recordWithoutHash)),
         };
         operationContext.checkpoint();
         operations.set(operationId, record);
@@ -388,6 +442,12 @@ function publicOperation(record) {
         block_reason: record.block_reason,
         preview: record.preview,
         preview_truncated: record.preview_truncated,
+        ...(record.template_diagnostics === undefined
+            ? {}
+            : {
+                template_diagnostics: record.template_diagnostics,
+                block_on_template_errors: record.block_on_template_errors,
+            }),
     };
 }
 const TEMPLATE_ANY_CAST = "$any";
@@ -448,7 +508,7 @@ export async function prepareRename(args, requestContext = NO_REQUEST_CONTEXT) {
                 expectedHash: usage.fileHash,
             })),
         };
-    }, requestContext);
+    }, requestContext, { blockOnTemplateErrors: args.blockOnTemplateErrors });
 }
 export async function prepareReplaceBody(args, requestContext = NO_REQUEST_CONTEXT) {
     return createPlan(args.projectRoot, "replace_symbol_body", args.allowNewErrors ?? false, async ({ project }) => {
@@ -982,7 +1042,7 @@ export function exportOperationRecord(operationId) {
         })),
     };
 }
-export function importOperationRecord(persisted, expectedPlanHash, planVersion = 2) {
+export function importOperationRecord(persisted, expectedPlanHash, planVersion = planVersionOf(persisted)) {
     if (persisted.plan_hash !== expectedPlanHash) {
         throw new Error(`Plan hash mismatch for operation "${persisted.operation_id}". No files were written.`);
     }
@@ -1047,18 +1107,31 @@ export function importOperationRecord(persisted, expectedPlanHash, planVersion =
     if (JSON.stringify(addedErrors) !== JSON.stringify(persisted.diagnostics.addedErrors)) {
         throw new Error("Persisted diagnostic error delta is inconsistent.");
     }
-    const blocked = !persisted.allow_new_errors && addedErrors.length > 0;
-    if (persisted.blocked !== blocked) {
+    const templateDelta = persisted.template_diagnostics;
+    if (templateDelta !== undefined) {
+        const templateErrors = templateDelta.added.filter((diagnostic) => diagnostic.category === "Error");
+        if (JSON.stringify(templateErrors) !== JSON.stringify(templateDelta.addedErrors)) {
+            throw new Error("Persisted template diagnostic error delta is inconsistent.");
+        }
+    }
+    if ((planVersion === 3) !== (templateDelta !== undefined)) {
+        throw new Error("Persisted template diagnostics are inconsistent with the plan version.");
+    }
+    const verdict = evaluateBlock({
+        allowNewErrors: persisted.allow_new_errors,
+        typescriptErrors: addedErrors.length,
+        template: templateDelta,
+        blockOnTemplateErrors: persisted.block_on_template_errors ?? false,
+    });
+    if (persisted.blocked !== verdict.blocked) {
         throw new Error("Persisted blocked status is inconsistent with diagnostics policy.");
     }
     const fullPreview = files.map((file) => file.diff).join("\n");
     const record = {
         ...persisted,
         affected_files: affectedFiles,
-        blocked,
-        block_reason: blocked
-            ? `${addedErrors.length} new TypeScript error(s) would be introduced. Prepare again with allow_new_errors=true only after explicit review.`
-            : null,
+        blocked: verdict.blocked,
+        block_reason: verdict.reason,
         preview: fullPreview.length <= MAX_INLINE_PREVIEW_CHARS ? fullPreview : null,
         preview_truncated: fullPreview.length > MAX_INLINE_PREVIEW_CHARS,
         tsConfigFilePath: context.tsConfigFilePath,

package/dist/services/project-operation-scheduler.js

@@ -354,6 +354,10 @@ export class ProjectOperationScheduler {
             checkpoint: () => {
                 this.#checkpoint(node);
             },
+            remainingMs: () => {
+                const startedAt = node.executionStartedAt ?? this.#readNow();
+                return Math.max(0, this.#operationDeadlineMs - (this.#readNow() - startedAt));
+            },
             markExecuting: () => {
                 this.#checkpoint(node);
                 if (node.phase !== "synchronizing") {

package/dist/tools/find_references.js

@@ -69,7 +69,7 @@ const ReferenceOutputSchemas = {
 export function registerFindReferences(server) {
     server.registerTool(TOOL_NAME, {
         title: "Find semantic symbol references",
-        description: "Finds type-resolved references and returns bounded project-relative locations, including declaration impact by default. When @angular/compiler resolves, it also reports Angular template usages, including consumer templates, tagged by origin with a template_coverage verdict; completed covers templates inside the Project only, incomplete coverage does not prove absence, and template errors are not diagnosed.",
+        description: "Finds type-resolved references and returns bounded project-relative locations, including declaration impact by default. When @angular/compiler resolves, it also reports Angular template usages, including consumer templates, tagged by origin with a template_coverage verdict; completed covers templates inside the Project only, incomplete coverage does not prove absence. It reports usages only; template type errors are reported by ast_rename_symbol plans in template_diagnostics.",
         inputSchema: AstFindReferencesInputSchema,
         annotations: {
             readOnlyHint: true,

package/dist/tools/operation-schema.js

@@ -34,6 +34,46 @@ export const PreparedOperationOutputSchema = z.object({
     preview: z.string().nullable(),
     preview_truncated: z.boolean(),
 });
+const TemplateDiagnosticsListSchema = z.array(NormalizedDiagnosticSchema);
+const NonCompletedTemplateListSchema = z.array(NormalizedDiagnosticSchema).max(0);
+/** Template type-check delta of a rename; present only when the check ran or tried to. */
+export const TemplateDiagnosticsSchema = z.discriminatedUnion("status", [
+    z
+        .object({
+        status: z.literal("completed"),
+        added: TemplateDiagnosticsListSchema,
+        removed: TemplateDiagnosticsListSchema,
+        added_errors: TemplateDiagnosticsListSchema,
+    })
+        .strict(),
+    z
+        .object({
+        status: z.enum(["unavailable", "unfinished"]),
+        reason: z.enum([
+            "compiler_cli_missing",
+            "compiler_unsupported",
+            "typescript_incompatible",
+            "work_exhausted",
+            "deadline",
+            "check_failed",
+        ]),
+        added: NonCompletedTemplateListSchema,
+        removed: NonCompletedTemplateListSchema,
+        added_errors: NonCompletedTemplateListSchema,
+    })
+        .strict(),
+]);
+/** Only `ast_rename_symbol` can carry template diagnostics, so only its contract changes. */
+export const RenameOperationOutputSchema = PreparedOperationOutputSchema.extend({
+    template_diagnostics: TemplateDiagnosticsSchema.optional(),
+});
+/** The one place that turns the record shape (`addedErrors`) into the wire shape. */
+export function toTemplateDiagnosticsOutput(delta) {
+    const lists = { added: delta.added, removed: delta.removed, added_errors: delta.addedErrors };
+    return delta.status === "completed"
+        ? { status: "completed", ...lists }
+        : { status: delta.status, reason: delta.reason, ...lists };
+}
 export function serializePreparedOperation(operation) {
     if (operation.status !== "prepared") {
         throw new Error(`Operation ${operation.operation_id} is not in prepared state.`);
@@ -60,5 +100,8 @@ export function serializePreparedOperation(operation) {
         block_reason: operation.block_reason,
         preview: operation.preview,
         preview_truncated: operation.preview_truncated,
+        ...(operation.template_diagnostics === undefined
+            ? {}
+            : { template_diagnostics: toTemplateDiagnosticsOutput(operation.template_diagnostics) }),
     };
 }

package/dist/tools/rename_symbol.js

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { prepareRename } from "../services/operations.js";
 import { createRequestContext } from "../services/request-context.js";
-import { PreparedOperationOutputSchema, serializePreparedOperation } from "./operation-schema.js";
+import { RenameOperationOutputSchema, serializePreparedOperation } from "./operation-schema.js";
 import { createToolErrorContext, errorResult, structuredResult } from "./result.js";
 const TOOL_NAME = "ast_rename_symbol";
 const AstRenameSymbolInputSchema = z.object({
@@ -17,20 +17,24 @@ const AstRenameSymbolInputSchema = z.object({
         .boolean()
         .default(false)
         .describe("Permit a plan with new TypeScript errors after explicit review."),
+    block_on_template_errors: z
+        .boolean()
+        .default(false)
+        .describe("Block the plan when a completed template check adds template errors. allow_new_errors still waives it."),
 });
 export function registerRenameSymbol(server) {
     server.registerTool(TOOL_NAME, {
         title: "Prepare a project-wide structural rename",
-        description: "Prepares an exact hash-bound rename plan without writing. Review the preview and apply its operation_id with ast_apply_operation. The plan also rewrites external Angular templates, including consumer templates when coverage is completed, hash-bound to the workspace snapshot; diagnostics stay TypeScript-only.",
+        description: "Prepares an exact hash-bound rename plan without writing. Review the preview and apply its operation_id with ast_apply_operation. The plan also rewrites external Angular templates, including consumer templates when coverage is completed, hash-bound to the workspace snapshot. The diagnostics field stays TypeScript-only; when templates are edited, template_diagnostics reports the template type-check delta separately with a typed status, and blocks only with block_on_template_errors=true.",
         inputSchema: AstRenameSymbolInputSchema,
-        outputSchema: PreparedOperationOutputSchema,
+        outputSchema: RenameOperationOutputSchema,
         annotations: {
             readOnlyHint: true,
             destructiveHint: false,
             idempotentHint: false,
             openWorldHint: false,
         },
-    }, async ({ project_root, file_path, symbol_path, new_name, dry_run, allow_new_errors }, extra) => {
+    }, async ({ project_root, file_path, symbol_path, new_name, dry_run, allow_new_errors, block_on_template_errors, }, extra) => {
         const requestContext = createRequestContext(extra.signal);
         try {
             if (!dry_run) {
@@ -42,6 +46,7 @@ export function registerRenameSymbol(server) {
                 symbolPath: symbol_path,
                 newName: new_name,
                 allowNewErrors: allow_new_errors,
+                blockOnTemplateErrors: block_on_template_errors,
             }, requestContext);
             return structuredResult(serializePreparedOperation(operation));
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ast-mcp-server",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "Structural code MCP server and batch CLI for compact TypeScript/JavaScript reads and hash-bound AST edits.",
   "keywords": [
     "mcp",
@@ -26,6 +26,9 @@
   },
   "type": "module",
   "packageManager": "yarn@4.15.0",
+  "workspaces": [
+    "test/angular-matrix/*"
+  ],
   "dsh": {
     "bundle": {
       "patch": "./cordis.patch.yml"
@@ -65,12 +68,14 @@
     "hono": "4.13.13",
     "minimatch": "11.0.3",
     "nanoid": "3.3.18",
-    "qs": "6.16.1"
+    "qs": "6.16.1",
+    "@babel/core@npm:7.25.2": "npm:7.29.7",
+    "@babel/core@npm:7.26.9": "npm:7.29.7"
   },
   "scripts": {
     "build": "tsc",
     "typecheck": "tsc --noEmit && tsc -p tsconfig.test.json",
-    "test": "vitest run --exclude test/supervised-worker.integration.test.ts && yarn build && vitest run test/supervised-worker.integration.test.ts --no-file-parallelism",
+    "test": "vitest run --exclude test/supervised-worker.integration.test.ts --exclude test/angular-template-typecheck.integration.test.ts --exclude test/operations-template-typecheck.integration.test.ts && yarn build && vitest run test/supervised-worker.integration.test.ts test/angular-template-typecheck.integration.test.ts test/operations-template-typecheck.integration.test.ts --no-file-parallelism",
     "test:watch": "vitest",
     "test:mcp": "yarn build && node scripts/mcp-smoke.mjs",
     "test:lifecycle": "yarn build && node scripts/mcp-lifecycle-smoke.mjs",
@@ -135,5 +140,5 @@
     "vitest": "^5.0.5",
     "yaml": "^2.9.0"
   },
-  "gitHead": "0f5a3f137703fdd673640d00a04087db3b2808af"
+  "gitHead": "e49987bd1fd36432aa76ecb27ca8359eedb613ad"
 }

package/skills/structural-code-editing/SKILL.md

@@ -4,7 +4,7 @@ description: "Trigger: navegar, analizar o editar TypeScript/JavaScript con el c
 license: "ISC"
 metadata:
   author: "yail"
-  version: "4.7.0"
+  version: "4.8.0"
   hermes:
     tags: ["typescript", "javascript", "ast", "refactoring", "mcp"]
     homepage: "https://github.com/yailPeralta/ast-mcp-server"
@@ -60,7 +60,7 @@ Pipes: renaming a `@Pipe` class applies with TypeScript edits only; the `name` l
 Limits to state when reporting:
 
 - `ast_explore` is TypeScript-only: its references omit template usages. This is tracked in issue #380. Use `ast_find_references` for template evidence; rename still blocks independently.
-- Diagnostics stay TypeScript-only: `ast_get_diagnostics` and the post-apply delta do not detect template errors, including in rewritten consumer templates. A template-only breakage produces no diagnostic, so run the project's Angular build or tests after a rename. Template type checking of rename plans is tracked in issue #421.
+- The `diagnostics` field stays TypeScript-only. When a rename edits a template, the plan also carries `template_diagnostics`, a best-effort template type-check delta (`status`, `reason`, `added`, `removed`, `added_errors`) from the project's own `@angular/compiler-cli`; it is absent for non-Angular projects and for renames that edit no template. `completed` is the only status with data; `unavailable` (`compiler_cli_missing`, `compiler_unsupported`, `typescript_incompatible`) and `unfinished` (`work_exhausted`, `deadline`, `check_failed`) mean unknown, so run the project's build or tests before applying. `block_on_template_errors` (default `false`) blocks only a `completed` delta with `added_errors`, and `allow_new_errors` waives it. `template_diagnostics[].file` is relative to the directory of the tsconfig, while `diagnostics[].file` is relative to `project_root`. `@angular/compiler-cli` is not a declared peer and must resolve from the project, otherwise the status is `unavailable/compiler_cli_missing`. Template-editing renames persist as plan schema v3, which is rejected on import after a downgrade.
 - Detection uses the user's own `@angular/compiler`, never a bundled one. It is an optional peer (`>=18.0.0 <23.0.0`) that the project already installs with Angular. If it is missing or out of range, coverage is `unfinished` and rename is blocked. Yarn PnP projects without `node_modules` resolve nothing and report `unfinished`.
 
 ## Contributor contract

package/skills/structural-code-editing/references/operations.md

@@ -22,7 +22,9 @@ Preferir `file_path` relativo; un suffix ambiguo debe devolver candidatos. `ast_
 
 ### Angular templates
 
-`ast_find_references` adds template usages (`origin: "template_external" | "template_inline"`, `template_coverage`, `template_reference_count`) only when `@angular/core` resolves; otherwise the response is unchanged. Treat `template_coverage.status` other than `completed` as not proving absence. Selector-bound members (`@Input`, `@Output`, `input()`, `output()`, `model()`, literal aliases, literal `inputs` / `outputs` metadata) also list their bindings in consumer templates (kinds `TemplateInputBinding` for `[x]`, `TemplateAttribute` for `x="lit"`, `TemplateTwoWayBinding` for `[(x)]` and `TemplateOutputBinding` for `(y)` and `(xChange)`), and `@Pipe` classes and their `transform` list `| name` usages (kind `TemplatePipeName`), for components whose resolved standalone or NgModule scope contains the declaring class. For them, `completed` covers templates inside the Project only. `hostDirectives`, `@Directive` inputs and outputs, and non-literal scopes, aliases or names stay `unfinished` with `cross_component`; runtime bindings (`setInput`, router input binding, `createComponent`) and consumers outside the Project are never examined. `ast_explore` is TypeScript-only for references (tracked in issue #380), and diagnostics stay TypeScript-only, so template errors are never detected; template type checking of rename plans is tracked in issue #421.
+`ast_find_references` adds template usages (`origin: "template_external" | "template_inline"`, `template_coverage`, `template_reference_count`) only when `@angular/core` resolves; otherwise the response is unchanged. Treat `template_coverage.status` other than `completed` as not proving absence. Selector-bound members (`@Input`, `@Output`, `input()`, `output()`, `model()`, literal aliases, literal `inputs` / `outputs` metadata) also list their bindings in consumer templates (kinds `TemplateInputBinding` for `[x]`, `TemplateAttribute` for `x="lit"`, `TemplateTwoWayBinding` for `[(x)]` and `TemplateOutputBinding` for `(y)` and `(xChange)`), and `@Pipe` classes and their `transform` list `| name` usages (kind `TemplatePipeName`), for components whose resolved standalone or NgModule scope contains the declaring class. For them, `completed` covers templates inside the Project only. `hostDirectives`, `@Directive` inputs and outputs, and non-literal scopes, aliases or names stay `unfinished` with `cross_component`; runtime bindings (`setInput`, router input binding, `createComponent`) and consumers outside the Project are never examined. `ast_explore` is TypeScript-only for references (tracked in issue #380).
+
+The `diagnostics` field stays TypeScript-only. When a rename edits a template, the plan also carries `template_diagnostics`, a best-effort template type-check delta (`status`, `reason`, `added`, `removed`, `added_errors`) from the project's own `@angular/compiler-cli`; it is absent for non-Angular projects and for renames that edit no template. `completed` is the only status with data; `unavailable` (`compiler_cli_missing`, `compiler_unsupported`, `typescript_incompatible`) and `unfinished` (`work_exhausted`, `deadline`, `check_failed`) mean unknown, so run the project's build or tests before applying. `block_on_template_errors` (default `false`) blocks only a `completed` delta with `added_errors`, and `allow_new_errors` waives it. `template_diagnostics[].file` is relative to the directory of the tsconfig, while `diagnostics[].file` is relative to `project_root`. `@angular/compiler-cli` is not a declared peer and must resolve from the project, otherwise the status is `unavailable/compiler_cli_missing`. Template-editing renames persist as plan schema v3, which is rejected on import after a downgrade.
 
 `ast_rename_symbol` edits external templates, including consumer templates of a selector-bound member with `completed` coverage, and returns `INCOMPLETE_EVIDENCE` (coverage `unfinished` or `unsupported`, `hostDirectives`, `@Directive` members, metadata-listed members, non-literal aliases) or `MUTATION_BLOCKED` (inline usage, template-local or binding-name collision, `[(x)]` on a non-`model()` pair, `$any`, name in the selector). Renaming a `@Pipe` class applies TypeScript edits only and keeps the `name` literal and `| name` usages; renaming `transform` returns `INCOMPLETE_EVIDENCE`. The user's `@angular/compiler` is an optional peer, never bundled; Yarn PnP projects without `node_modules` report `unfinished`. See the Angular templates section of `SKILL.md`.
 

package/skills/structural-code-editing/releases.json

@@ -2,15 +2,15 @@
   "schema_version": 2,
   "algorithm": "sha256",
   "current": {
-    "version": "4.7.0",
+    "version": "4.8.0",
     "files": [
       {
         "path": "SKILL.md",
-        "sha256": "2606e5fc607a3063789c7c02c49aaf8b3129824fa5527b8654e50e95ed2a8556"
+        "sha256": "15e5d25553a3ebce86365ff7b43ed61e7df11dd6ad658e83ec6e43cd84118762"
       },
       {
         "path": "references/operations.md",
-        "sha256": "c744553832f55d0630d5ff64d3b5f201b8e87c323d6b7bfeb84eb1778e775b7d"
+        "sha256": "dd633a24e9aabeb1d9e9d1f93e261906e7b30eb721fadfb3d317d6acc60db2ca"
       }
     ]
   },
@@ -191,6 +191,20 @@
         }
       ],
       "npm_versions": ["0.15.1"]
+    },
+    {
+      "version": "4.7.0",
+      "files": [
+        {
+          "path": "SKILL.md",
+          "sha256": "2606e5fc607a3063789c7c02c49aaf8b3129824fa5527b8654e50e95ed2a8556"
+        },
+        {
+          "path": "references/operations.md",
+          "sha256": "c744553832f55d0630d5ff64d3b5f201b8e87c323d6b7bfeb84eb1778e775b7d"
+        }
+      ],
+      "npm_versions": ["0.16.0"]
     }
   ]
 }