745→files of a production AngularJS ERP migrated to working, verified Angular in 24 hours.

SECTION 1 · OPERATING CONDITIONS

Four ways teams arrive at this page

• COND. A · COMPLIANCE

  An audit, pentest, or enterprise security questionnaire flagged EOL AngularJS

  PCI DSS 4.0 treats end-of-life software as a control failure. The finding does not expire; the framework never patches.

• COND. B · COST

  The consultancy quote came in at $500K+ and 12–18 months

  A rewrite priced by the hour has no incentive to end. A pipeline priced by the module does.

• COND. C · TALENT

  The last engineer who knows the app is leaving, or already left

  Nobody hires for AngularJS in 2026. Every quarter on it narrows the bus factor and the roadmap.

• COND. D · DILIGENCE

  An acquirer or investor asked about the frontend stack

  EOL frameworks show up in technical due diligence as risk and as a discount. A verified migration closes the line item.

ALL FOUR RESOLVE THE SAME WAY: THE APP STOPS BEING ANGULARJS. THE REST OF THIS SHEET IS HOW, AND HOW WE PROVE IT.

SECTION 2 · PROCESS

Every file parsed, typed, compiled, and run

PARSE → TYPE-EXTRACT → GENERATE UNDER COMPILER → VERIFY EVERY ROUTE IN CHROME → FLAG WHAT'S UNPROVEN

1. 01

   AST analysis

   Every file is parsed into a full abstract syntax tree. Module graphs, DI edges, and template bindings are resolved from structure — never regex, never string matching.

2. 02

   Typed state extraction

   $scope trees, watchers, and broadcasts are lifted into an explicit typed model: what state exists, who reads it, who writes it, and where it should live.

3. 03

   Compiler-in-the-loop codegen

   Generated code is fed back through the Angular compiler and strict tsc on every iteration. Nothing ships that does not build. The compiler is the judge, not us.

SECTION 3 · SUPPORTED FAILURE MODES

The patterns that kill codemods

If your codebase were clean, you would have migrated already. These are the skeletons the pipeline handles today.

$scope inheritance chains

Values read three parents up and written by a child. The chain is resolved statically and emitted as explicit inputs, outputs, and store state.

dynamic $injector lookups

Service names computed at runtime. Data-flow analysis narrows the candidate set; anything unresolvable is flagged to the issue registry — never guessed.

uib-modal dialogs

templateUrl + controller + resolve blocks become typed Dialog components with injected data and typed close results.

mega-files, multiple registrations

One 6,000-line file registering 14 artifacts is split into 14 files with correct imports and no circular dependencies.

jQuery plugins & vendor globals

Wrapped behind typed adapters. The plugin keeps working on day one; the code around it becomes real Angular.

run-blocks & ACL gates

Ordering-sensitive startup logic becomes APP_INITIALIZER providers and route guards with the same semantics — verified at runtime, not assumed.

custom form-builder engines

$compile-driven dynamic forms map to component registries with typed field configs. The gnarliest pattern we see — and the one we ask for.

yours, presumably worse

Got a pattern not on this list? Send it. That is the whole point of the unit trial.

SECTION 3 · APPENDIX — CONVERSIONS INDEX · 45 SCENARIO PROJECTS

SECTION 4 · DELIVERABLE

Every run emits its evidence

Build results, screen-by-screen checks, and the issue registry — what passed, and what was flagged.

PIPELINE RUN — erp-monolith                          2026-06-14 · run #3
────────────────────────────────────────────────────────────────
BUILD
  ng build --configuration production        ✓ 0 errors, 0 warnings
  tsc --noEmit (strict: true)                ✓ 0 errors
  files emitted                              745 / 745

ROUTES — headless Chrome via CDP, prod build
  /login                                     ✓ rendered · 0 console errors · 214ms
  /dashboard                                 ✓ rendered · 0 console errors · 388ms
  /invoices                                  ✓ rendered · 0 console errors · 341ms
  /invoices/:id                              ✓ rendered · sampled 25 ids
  /inventory/transfers                       ✓ rendered · 0 console errors · 296ms
  … 82 more                                ✓ all passing
  routes verified                            87 / 87

FLAGGED → ISSUE REGISTRY — 11 items
  src/reports/pdf-export.js       jQuery jsPDF plugin wrapped behind adapter;
                                  API surface needs owner sign-off
  src/core/acl-run-block.js       authz gate ported to route guards; timing
                                  semantics preserved — review before prod
  src/forms/builder-engine.js     $compile registry mapped to component map;
                                  2 of 31 field types flagged ambiguous
  … 8 more, each with file, reason, and suggested owner

NOT MIGRATED (by agreement)
  bower_components/*              replaced with npm equivalents where 1:1

SECTION 5 · COMPARATIVE SPECIFICATIONS

What this actually costs you today

PRICING: FIXED PER MODULE · QUOTED AFTER THE AUDIT · YOU SEE THE NUMBER BEFORE ANY CODE MOVES.

PUBLISHED MARKET RATES, FULL BREAKDOWN →WHEN THE OTHER THREE PATHS WIN →

SECTION 7 · HAZARD DATA

Unpatched CVEs, shipping today in every AngularJS app

End-of-life since January 2022. Every advisory below is permanent: no patch exists, and none is coming.

SECTION 8 · NOTES FOR THE PARANOID

The paranoid questions, answered

SECTION 9 · FIELD MANUAL

The documents behind this page

• DOC 01The verification reportThe reference 745-file run, route by route — including the 11 flagged files and why.
• DOC 02What migration actually costsPublished market rates for every path, what drives cost, and why fixed scope changes the incentive.
• DOC 03AngularJS end of life, explainedThe permanent CVE ledger, the compliance consequences, and the four options every team has.
• DOC 04Rewrite vs ngUpgrade vs support vs pipelineThe honest comparison, including when each of the other three paths is the right answer.