feat(aem-cloud-service): add vault-package-dependencies analyzer detector + expert skill

plugins/aem/cloud-service/skills/migration/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: migration
-description: Migrates legacy AEM (6.x, AMS, on-prem) to AEM as a Cloud Service using BPA CSV/cache, CAM/MCP discovery, and a one-pattern-per-session workflow. Use to review/scan a project for AEMaaCS migration (generates a read-only migration-runbook.md covering all patterns via per-pattern detection strategies), for BPA/CAM findings, Cloud Service blockers, or fixes for scheduler, ResourceChangeListener, replication, EventListener, OSGi EventHandler, DAM AssetManager, HTL data-sly-test lint, Classic UI dialog migration (lui — ExtJS/Coral 2 → Coral 3), Custom Design Widgets (cdw), Guava cache → Caffeine swaps (guavaCache), and static→editable template modernization. OSGi configs → Cloud Manager — scan for secrets and $[secret:]/$[env:] placeholders. Converts AMS/on-prem Dispatcher configs to AEMaaCS (Branch E, beta). After discovery, migration hands off each (pattern, file) pair to code-assessment for pattern guides/shared references; template modernization, legacy UI, and Guava cache follow references/ modules.
+description: Migrates legacy AEM (6.x, AMS, on-prem) to AEM as a Cloud Service using BPA CSV/cache, CAM/MCP discovery, and a one-pattern-per-session workflow. Use to review/scan a project for AEMaaCS migration (generates a read-only migration-runbook.md covering all patterns via per-pattern detection strategies), for BPA/CAM findings, or fixes for scheduler, ResourceChangeListener, replication, EventListener, OSGi EventHandler, DAM AssetManager, HTL data-sly-test lint, Classic UI dialog migration (lui — ExtJS/Coral 2 → Coral 3), Custom Design Widgets (cdw), Vault package deps (vault-package-dependencies), Guava cache swaps (guavaCache), and static→editable template modernization. OSGi configs → Cloud Manager — scan for secrets and $[secret:]/$[env:] placeholders. Converts AMS/on-prem Dispatcher configs (Branch E, beta). After discovery, migration hands off each (pattern, file) pair to code-assessment for pattern guides/shared references; template modernization and legacy UI use references/ modules.
 license: Apache-2.0
 ---
 
@@ -24,6 +24,7 @@ This skill drives the **migration workflow**: BPA data, CAM/MCP, **one pattern p
 | **Just a few files** | *"Migrate **scheduler** in `core/.../MyJob.java`"* | Manual flow: no BPA required |
 | **OSGi → Cloud Manager** | *"**Scan my config files and create Cloud Manager environment secrets or variables.**"* | Agent **auto-reads** [references/osgi-cfg-json-cloud-manager.md](references/osgi-cfg-json-cloud-manager.md) (full Adobe-aligned rules inlined there); no BPA pattern id |
 | **HTL lint warnings** | *"Fix **htlLint** issues in `ui.apps`"* | Proactive discovery via `rg` → fix per the HTL lint reference |
+| **Vault package dependencies** | *"Fix **vault-package-dependencies** findings"* / *"Package install fails on AEMaaCS."* | Agent reads [references/vault-package-dependencies.md](references/vault-package-dependencies.md) — heuristic `pom.xml` scan (no BPA subtype, no analyzer) for `day/cq60/product:*` install-time deps in `content-package-maven-plugin`; removes the whole `<dependencies>` block. Not a `code-assessment` pattern — this dependency shape never occurs in native AEMaaCS code. |
 | **Template modernization** | *"**Migrate my static templates to editable templates and generate Modernize Tools rules.**"* / *"Create editable templates from my static templates."* / *"Generate AEM Modernize Tools structure/component/policy rules."* | Agent **auto-reads** [references/template-modernization/template-modernization-context.md](references/template-modernization/template-modernization-context.md) (shared discovery + structured context), produces a **per-template plan table**, then executes the plan using [editable-template-creation.md](references/template-modernization/editable-template-creation.md) and [aem-modernization.md](references/template-modernization/aem-modernization.md), and validates via [template-modernization-validation.md](references/template-modernization/template-modernization-validation.md). No BPA pattern id. |
 | **Dialog migration** | *"Convert my Classic UI / ExtJS dialogs to Touch UI."* / *"Upgrade Coral 2 dialogs to Coral 3."* / *"Fix LUI dialog findings."* | Agent reads [references/legacy-ui/dialog/context.md](references/legacy-ui/dialog/context.md) — filters BPA LUI to dialog sub-types, converts via [extjs-to-coral3.md](references/legacy-ui/dialog/extjs-to-coral3.md) or [coral2-to-coral3.md](references/legacy-ui/dialog/coral2-to-coral3.md), validates via [validation.md](references/legacy-ui/dialog/validation.md). BPA pattern id: `lui`. |
 | **Custom widget migration** | *"Fix my CDW findings."* / *"Migrate custom ExtJS widgets to Coral 3."* | Agent reads [references/legacy-ui/cdw/context.md](references/legacy-ui/cdw/context.md) — inventories xtypes, maps or scaffolds Granite UI components via [conversion.md](references/legacy-ui/cdw/conversion.md), validates via [validation.md](references/legacy-ui/cdw/validation.md). BPA pattern id: `cdw`. Run CDW before dialog migration when both are needed. |
@@ -38,6 +39,7 @@ This skill drives the **migration workflow**: BPA data, CAM/MCP, **one pattern p
 - *"**Manual:** **event listener** migration for `.../Listener.java` — read the code-assessment pattern guide first."*
 - *"Scan my config files and create Cloud Manager environment secrets or variables."*
 - *"Fix **htlLint** in `ui.apps` — scan for `data-sly-test` redundant constant warnings and fix them."*
+- *"Fix **vault-package-dependencies** findings — package install fails on AEMaaCS."*
 - *"Migrate my static templates to editable templates and generate the Modernize Tools rewrite rules."*
 - *"Fix LUI dialog findings using BPA CSV at `./reports/bpa.csv`."*
 - *"Migrate custom ExtJS widgets (CDW findings) from CAM."*
@@ -78,6 +80,7 @@ Applies to **finding and editing the user's AEM project** (Java, bundles, config
    - `eventListener` / `eventHandler` → **`{code-assessment}/event-migration/SKILL.md`** *(pattern guide — both JCR and OSGi Event Admin paths)*
    - `assetApi` → **`{code-assessment}/asset-manager/SKILL.md`** *(pattern guide)*
    - `htlLint` → **`{code-assessment}/references/data-sly-test-redundant-constant.md`** *(reference — HTL lint is a single shared reference, not a dedicated pattern guide)*
+   - `vault-package-dependencies` → **[references/vault-package-dependencies.md](references/vault-package-dependencies.md)** *(reference — heuristic pom.xml scan; lives under `migration` only, not `code-assessment`, since this dependency shape never occurs in native AEMaaCS code)*
    - `guavaCache` → **[references/guava-cache.md](references/guava-cache.md)** *(reference — Guava cache → Caffeine swap; lives under `migration` only, not `code-assessment`, since Guava cache usage does not occur in native AEMaaCS code, only in code carried over from legacy AEM)*
 3. When code uses SCR, `ResourceResolver`, or console logging, read **`{code-assessment}/references/scr-to-osgi-ds.md`** and **`{code-assessment}/references/resource-resolver-logging.md`** (or the hub **`{code-assessment}/references/aem-cloud-service-pattern-prerequisites.md`**).
 
@@ -118,6 +121,7 @@ If the user asks to **convert / migrate a Dispatcher configuration** to AEM as a
 
 - Migrate legacy AEM Java toward **Cloud Service–compatible** patterns (scheduler, ResourceChangeListener, replication, EventListener/EventHandler, AssetManager)
 - Fix **HTL (Sightly)** lint warnings (`data-sly-test: redundant constant value comparison`)
+- Fix **Vault package install-time dependencies** (`day/cq60/product:*`) blocking package installation on AEMaaCS
 - Swap **Guava cache** (`com.google.common.cache.*`) for **Caffeine** (`guavaCache`)
 - **OSGi → Cloud Manager** secret/variable externalization (Branch A), **Template Modernization** (Branch C), **Legacy UI** dialog/CDW migration (Branch D)
 - Drive work from **BPA** (CSV or cached collection) or **CAM via MCP**, **one pattern per session**
@@ -224,7 +228,7 @@ For retries, error categories, and when user-directed CSV/manual paths are allow
 
 ## Pattern guides
 
-Do **not** duplicate the pattern table here. Use **`{code-assessment}/SKILL.md` → Pattern Guides** — five patterns each have a pattern guide (`{code-assessment}/<pattern>/SKILL.md`); shared topics (SCR→DS, ResourceResolver/SLF4J, HTL lint, prerequisites hub) stay as references (`{code-assessment}/references/<file>.md`). See **Branch B step 2** above for the per-pattern routing table.
+Do **not** duplicate the pattern table here. Use **`{code-assessment}/SKILL.md` → Pattern Guides** — five patterns each have a pattern guide (`{code-assessment}/<pattern>/SKILL.md`); shared topics (SCR→DS, ResourceResolver/SLF4J, HTL lint, prerequisites hub) stay as references (`{code-assessment}/references/<file>.md`); `vault-package-dependencies` is a `migration`-only reference (`references/vault-package-dependencies.md`), not a `{code-assessment}` pattern guide. See **Branch B step 2** above for the per-pattern routing table.
 
 ## Workflow
 
@@ -240,11 +244,12 @@ The runbook covers **every pattern the migration skill can address**. Each patte
 | `replication` | `cascade` | analyzer → LLM scan (no BPA/CSV subtype mapping) |
 | `htlLint` | `html-scan` | heuristic regex scan of `.html` (pure Node — no `rg` binary needed) |
 | `osgiConfig` | `config-scan` | heuristic scan of OSGi config files for secret-looking keys / `$[secret:]`/`$[env:]` placeholders — **key names + locations only, never secret values** |
+| `vault-package-dependencies` | `pom-scan` | heuristic regex/text scan of `pom.xml` (pure Node) — **no BPA tier and no analyzer**; `content-package-maven-plugin` install-time deps are invisible to a deployed-artifact BPA scan, and there is no compiled detector for it |
 | `lui`, `cdw`, `templateModernization` | BPA `cascade` → `content-scan` fallback | When a BPA CSV/CAM source is present, these come from BPA (subtypes `custom.classic.widget`; `legacy.dialog.classic`/`.coral2`; `legacy.static.template` + `custom.static.template`). With no BPA source, a heuristic `.content.xml` scan is the fallback — for `templateModernization` it walks `apps/<appId>/templates/**` at **any depth** (nested/grouped templates included) and classifies each static template as `custom.static.template` or `legacy.static.template` from its page-component resource type, so the custom-vs-legacy distinction survives even without a BPA report. Sample prompts route to **Branch D** (legacy-ui) / **Branch C** (templates), not code-assessment |
 | `guavaCache` | `bpa-only` (no analyzer, no content-scan) | BPA is the **sole** source of truth (subtype `custom.guava.cache`), one finding per **bundle** — `identifier` on this subtype is a Guava-internal class, not a customer class, so raw rows are deduped to the bundle named in the message, not surfaced per row. With no BPA source, `guavaCache` has no deterministic fallback and surfaces under **Tier 4 — LLM scan**: the agent greps `.java` files for `import com.google.common.cache` per module, per [references/guava-cache.md](references/guava-cache.md), and tags the result `confidence: llm`. There is deliberately no compiled analyzer detector for this pattern — it does not run inside `code-assessment`'s own discovery. |
 | `dispatcherConversion` | `content-scan` | Heuristic scan for an AMS / on-prem Dispatcher config layout (a monolithic `dispatcher.any` + `conf.vhost.d/`, or `conf.dispatcher.d/` AMS trees). Detected by `dispatcher-inventory.js`; the sample prompt routes to **Branch E** (beta). |
 
-`htlLint`, `osgiConfig`, and the content-scan **fallback** for `lui`/`cdw`/`templateModernization` are **heuristic** (tagged `confidence: heuristic` in the cache) — candidate matches, not compiler-validated. BPA-sourced `lui`/`cdw`/`templateModernization`/`replication`/`guavaCache` findings are authoritative. Out of scope: `inject-in-sling-model` and `outdated-dependencies` (those belong to code-assessment's own runbook, not migration).
+`htlLint`, `osgiConfig`, `vault-package-dependencies`, and the content-scan **fallback** for `lui`/`cdw`/`templateModernization` are **heuristic** (tagged `confidence: heuristic` in the cache) — candidate matches, not compiler-validated. BPA-sourced `lui`/`cdw`/`templateModernization`/`replication`/`guavaCache` findings are authoritative. Out of scope: `inject-in-sling-model` and `outdated-dependencies` (those belong to code-assessment's own runbook, not migration).
 
 **BPA is the source of truth when a report is available.** `lui`/`cdw`/`templateModernization`/`replication` are read from the BPA CSV/CAM (the parser now extracts these subtypes and excludes `_COUNT_*`/`_STAT` summary rows), so the runbook counts match your BPA report's LUI-dialog / CDW / static-template / REP tallies. `lui` keeps only the dialog sub-types (`legacy.custom.component` → create-component; `legacy.static.template` is counted under `templateModernization`). The `.content.xml` scan is only the fallback when no BPA source is present — and it can **undercount** relative to BPA when the flagged legacy nodes live in packages (e.g. acs-commons) not in the project source. `replication`: BPA `replication.agent` findings when a report is present, else the analyzer detects `Replicator` usage from source.
 

plugins/aem/cloud-service/skills/migration/references/vault-package-dependencies.md

@@ -0,0 +1,98 @@
+# Vault package dependencies on AEM as a Cloud Service
+
+Not a Cloud-Service-native code-quality issue — it only shows up in `pom.xml` carried over from a pre-cloud (legacy AEM 6.x / AMS) codebase, so this is a migration reference, not a `code-assessment` pattern. No BPA pattern id exists for it: a `pom.xml` install-time dependency declaration is invisible to a deployed-artifact BPA scan (confirmed against a real BPA report — zero hits for `day/cq60`, `vault`, or `content-package-maven-plugin`).
+
+## Why it's flagged
+
+Content packages built for AEM 6.x declare Vault install-time `<dependencies>` inside `content-package-maven-plugin / <configuration>`. These reference AEM 6.x product packages (`day/cq60/product:cq-content`, `day/cq60/product:cq-commerce-content`, etc.) that were pre-installed on AEM 6.x instances. On AEM as a Cloud Service the platform is delivered via a container image — those product packages no longer exist as installable entries in CRX Package Manager. CRX Package Manager checks all declared Vault dependencies at install time and **refuses the install** if any are unresolvable, even though `mvn clean install` succeeds.
+
+The fix is mechanical: remove the entire `<dependencies>` block. The functionality the packages provided is still present on AEMaaCS; only the install-time check needs to be removed.
+
+## Discovery — pom.xml scan (no BPA, no analyzer)
+
+Scan every `pom.xml` in the workspace, mirroring the heuristic model `htlLint` uses for `.html`: a pure regex/text scan (`migration/scripts/vault-package-scan-runner.js`), no analyzer, no BPA/CAM/CSV tier.
+
+Group by **`<dependencies>` block**, not by `<dependency>` entry: a block with several legacy dependencies is still one finding, one migration unit — the fix removes the whole block regardless of how many legacy entries it contains.
+
+## Classification — confirm this pattern applies
+
+- A `pom.xml` whose `content-package-maven-plugin / <configuration>` contains a `<dependencies>` block with at least one `<dependency>` whose `<group>` starts with `day/cq60/`, `day/cq560/`, or `adobe/cq60`.
+- Applies regardless of whether the plugin groupId is `com.day.jcr.vault` (legacy) or `org.apache.jackrabbit` (current filevault-package-maven-plugin).
+- The same pom may have the plugin in both main `<build>` and inside `<profiles>` — check both.
+
+## Resolution contract
+
+**Self-evident** — always remove the entire `<dependencies>` block. No user input required.
+
+## Locator
+
+For each file:
+
+1. Find the `<plugin>` element whose direct `<artifactId>` child text equals `content-package-maven-plugin`.
+2. Inside that plugin, find the direct `<configuration>` child element.
+3. Inside `<configuration>`, find the direct `<dependencies>` child element containing at least one `<dependency>/<group>` prefixed with `day/cq60/`, `day/cq560/`, or `adobe/cq60`.
+4. Repeat for every occurrence of `content-package-maven-plugin` in the file — the same pom may declare the plugin in the main `<build>` section **and** in one or more `<profiles>/<profile>/<build>` sections.
+
+## Edit
+
+Remove the entire `<dependencies>...</dependencies>` block, including its surrounding blank/indentation line. Do not touch any sibling elements (`<subPackages>`, `<embeddeds>`, `<filters>`, `<properties>`, etc.).
+
+## Before / after
+
+**Before (`ui.apps/pom.xml`):**
+```xml
+<configuration>
+    <verbose>true</verbose>
+    <failOnError>true</failOnError>
+    <group>adobe/aem6/sample</group>
+    <failOnMissingEmbed>true</failOnMissingEmbed>
+    <dependencies>
+        <dependency>
+            <group>day/cq60/product</group>
+            <name>cq-content</name>
+            <version>[6.3.0,)</version>
+        </dependency>
+        <dependency>
+            <group>day/cq60/product</group>
+            <name>cq-commerce-content</name>
+            <version>[1.5.0,)</version>
+        </dependency>
+    </dependencies>
+    <subPackages>
+        ...
+    </subPackages>
+</configuration>
+```
+
+**After:**
+```xml
+<configuration>
+    <verbose>true</verbose>
+    <failOnError>true</failOnError>
+    <group>adobe/aem6/sample</group>
+    <failOnMissingEmbed>true</failOnMissingEmbed>
+    <subPackages>
+        ...
+    </subPackages>
+</configuration>
+```
+
+## Unlocatable / skip reasons
+
+| Situation | `skipped` reason string |
+|---|---|
+| `content-package-maven-plugin` not found in pom | `vault-package-dependencies-no-plugin: content-package-maven-plugin not found in <file>` |
+| Plugin found but no `<configuration>/<dependencies>` block present | `vault-package-dependencies-no-deps-block: no <dependencies> block under <configuration> in <file>` |
+| `<dependencies>` block contains no legacy group prefixes | `vault-package-dependencies-no-legacy-groups: no day/cq60 or day/cq560 group prefixes found in <file>` |
+
+## Editing strategy
+
+Surgical XML edit — anchor on ≥3 lines of context before and after the `<dependencies>` block. Do not re-serialize or reformat any surrounding XML.
+
+## Review checklist
+
+- [ ] Only the `<dependencies>` block under `content-package-maven-plugin / <configuration>` removed — no other plugin config touched
+- [ ] Maven classpath `<dependencies>` at the project level left intact
+- [ ] No whitespace churn outside the removed block
+- [ ] All occurrences removed — check both main `<build>` and any `<profiles>` sections
+- [ ] Build still succeeds after the change (`mvn clean install`)