Application Frontend Migration Skill

HARD RULES (NEVER VIOLATE)

1. Never touch the source project. All migration work happens exclusively inside appfront-migrated/. The source directory is read-only — never edit, delete, or overwrite any file outside appfront-migrated/.
2. Never assume the auth service. Always read xs-security.json (or ias-security.json) and every xs-app.json before deciding XSUAA vs IAS. The source may mix both.
3. Never apply html5-repo migration rules to a Neo source. Neo uses a different MTA structure (neo-mta.yaml, parameters-based artifacts). Check first.
4. HTML5Runtime_enabled: true on a destination-service resource must be removed. Its presence signals html5-apps-repo usage. appFront does not use this property.
5. The destination-content module must be removed entirely. This module creates instance-level destinations with service keys — a pattern only used by html5-apps-repo. appFront's deployer module binds directly to service instances.
6. The app-content module's requires list must include all backend service instances directly. Not via destination mapping. Credentials injected into the running approuter come from direct requires.
7. Never change xs-app.json authenticationType on any route without explicit user confirmation of the target auth service. Wrong authenticationType = 401 in production.
8. If the source uses sap.cloud.service in a destination-content module, flag this as a WorkZone integration pattern requiring additional CDM steps. Document it clearly in the migration plan and wait for user acknowledgment before proceeding.
9. Resource and service naming must use the sap.cloud.service prefix (without dots). Given prefix P (dots stripped):
   • Resource name: P-<service> (e.g. comsapfavorites-app-front, comsapfavorites-xsuaa)
   • service-name parameter: P-<service>-service (e.g. comsapfavorites-app-front-service)
   • Never invent arbitrary names. Never reuse the source app names. Always derive from the sap.cloud.service value extracted in Phase 1a-naming.
10. Always ask for the backend URL when the backend exists. Only emit <<REPLACE_WITH_REAL_BACKEND_URL>> when the user explicitly says the URL is not yet known. This placeholder is intentionally invalid — it will cause an MTA build error, forcing the user to replace it before deploying.
11. Never add redirect-uris to generated xs-security.json. appFront does not require them — omit the field entirely, even if the source had them.