@numa-tech/numa 1.12.11 → 1.13.1

package/dist/application-onboarding/tui-model.js

@@ -1,5 +1,5 @@
 import { OnboardingError } from "./errors.js";
-import { CredentialFreeOnboardingValueSchema } from "./schemas.js";
+import { CredentialFreeOnboardingValueSchema, OnboardingSpecSchema } from "./schemas.js";
 export const ONBOARDING_STEPS = [
     "MODE",
     "BASIC_INFORMATION",
@@ -11,21 +11,54 @@ export const ONBOARDING_STEPS = [
     "REVIEW",
     "EXECUTION"
 ];
+const DEFAULT_GITOPS_STRUCTURAL_SPEC = {
+    workloadKind: "SPRING",
+    environment: {},
+    secretEnvironment: []
+};
+const GITOPS_STRUCTURAL_FIELDS = new Set([
+    "workloadKind", "chart", "workload", "service", "probes", "ingress",
+    "environment", "secretEnvironment", "advancedValues"
+]);
+const GITOPS_PLATFORM_MANAGED_FIELDS = new Set([
+    "image", "appCode", "environmentId", "namespace", "releaseName", "targetKey",
+    "repository", "writeBranch", "reconcileBranch", "overlayPath", "imageRepository", "imageTag"
+]);
+const GITOPS_MANAGED_ADVANCED_VALUES = new Set([
+    "image", "replicaCount", "strategy", "service", "ingress", "startupProbe",
+    "livenessProbe", "readinessProbe", "resources", "env"
+]);
+const GITOPS_SENSITIVE_ENVIRONMENT_NAME = /(^|_)(PASSWORD|PASSWD|PWD|SECRET|TOKEN|API_KEY|PRIVATE_KEY|ACCESS_KEY|SECRET_KEY|CREDENTIAL|DATABASE_URL|REDIS_URL|MONGO_URI|JDBC_URL)($|_)/u;
+const GITOPS_ENVIRONMENT_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/u;
 export function emptyWizardDraft(mode) {
     return {
-        schemaVersion: 1,
+        schemaVersion: 2,
         mode,
         application: { lifecycle: "EXPERIMENTAL", tier: "TIER_3" },
-        repository: { defaultBranch: "main" },
-        technology: { repoMode: "STANDALONE", parameters: {} },
+        repositoryStrategy: mode === "EXISTING" ? "ATTACH_EXISTING" : "CREATE_NEW",
+        projectStrategy: mode === "EXISTING" ? "ASSESS_ONLY" : "BOOTSTRAP_TEMPLATE",
+        technology: { repoMode: mode === "EXISTING" ? "ASSESS_ONLY" : "STANDALONE", parameters: {} },
         delivery: {
             jenkinsRequired: true,
             tiers: ["DEVELOP"],
             gitopsRequired: false,
+            profileCode: "MCI_FLUX_V1",
+            profileVersion: "1.0.0",
+            structuralSpec: cloneValue(DEFAULT_GITOPS_STRUCTURAL_SPEC),
             nacosRequired: false
         }
     };
 }
+function legacyWizardDraft(mode) {
+    return {
+        schemaVersion: 1,
+        mode,
+        application: { lifecycle: "EXPERIMENTAL", tier: "TIER_3" },
+        repository: { defaultBranch: "main" },
+        technology: { repoMode: "STANDALONE", parameters: {} },
+        delivery: cloneValue(emptyWizardDraft(mode).delivery)
+    };
+}
 export function initialOnboardingTuiState() {
     return {
         phase: "LOADING",
@@ -174,20 +207,27 @@ function mergeCatalog(current, update) {
     };
 }
 export function draftFromSession(session) {
-    const base = emptyWizardDraft(session.mode);
-    if (!session.draft || typeof session.draft !== "object" || Array.isArray(session.draft))
-        return base;
+    if (!session.draft || typeof session.draft !== "object" || Array.isArray(session.draft)) {
+        return emptyWizardDraft(session.mode);
+    }
     const incoming = cloneObject(session.draft);
-    return {
+    const schemaVersion = incoming.schemaVersion === 2
+        ? 2
+        : incoming.schemaVersion === 1 || Object.hasOwn(incoming, "repository") ? 1 : 2;
+    const base = schemaVersion === 2 ? emptyWizardDraft(session.mode) : legacyWizardDraft(session.mode);
+    const result = {
         ...base,
         ...incoming,
-        schemaVersion: typeof incoming.schemaVersion === "number" ? incoming.schemaVersion : 1,
+        schemaVersion,
         mode: session.mode,
         application: { ...asObject(base.application), ...asObject(incoming.application) },
-        repository: { ...asObject(base.repository), ...asObject(incoming.repository) },
         technology: { ...asObject(base.technology), ...asObject(incoming.technology) },
         delivery: { ...asObject(base.delivery), ...asObject(incoming.delivery) }
     };
+    if (schemaVersion === 1) {
+        result.repository = { ...asObject(base.repository), ...asObject(incoming.repository) };
+    }
+    return result;
 }
 export function fieldsForState(state) {
     const step = ONBOARDING_STEPS[state.stepIndex];
@@ -209,6 +249,39 @@ export function fieldsForState(state) {
             { path: "application.ownerUsername", label: "Owner username", kind: "text" }
         ];
     if (step === "SOURCE_CONTROL") {
+        if (valueAtPath(state.draft, "schemaVersion") === 2) {
+            const strategy = stringAt(state.draft, "repositoryStrategy");
+            const repositoryChoices = state.catalog.repositories.map((item) => ({
+                value: text(item.repositoryKey),
+                label: [
+                    text(item.fullName ?? item.name ?? item.repositoryKey),
+                    text(item.connectionCode),
+                    item.migrationRequired === true ? "MIGRATION_REQUIRED" : ""
+                ].filter(Boolean).join(" · ")
+            })).filter((item) => item.value);
+            return [
+                {
+                    path: "repositoryStrategy",
+                    label: "Repository strategy",
+                    kind: "select",
+                    required: true,
+                    choices: choices(mode === "EXISTING" ? ["ATTACH_EXISTING"] : ["CREATE_NEW", "ATTACH_EXISTING"])
+                },
+                ...(strategy === "CREATE_NEW" ? [
+                    { path: "repositoryPlanRef.planNo", label: "Repository plan number", kind: "text", required: true, placeholder: "RP-1" },
+                    { path: "repositoryPlanRef.planHash", label: "Repository plan hash", kind: "text", required: true, placeholder: "64 lowercase hex" }
+                ] : [
+                    {
+                        path: "repositoryRef.repositoryKey",
+                        label: "Managed repository key",
+                        kind: "choiceOrText",
+                        required: true,
+                        choices: includeCurrent(repositoryChoices, stringAt(state.draft, "repositoryRef.repositoryKey"))
+                    },
+                    { path: "repositoryRef.expectedHead", label: "Expected repository HEAD", kind: "text", required: true, placeholder: "40-64 hex commit" }
+                ])
+            ];
+        }
         const connectionChoices = state.catalog.connections.map((item) => ({
             value: text(item.code),
             label: [text(item.name), text(item.provider), text(item.health)].filter(Boolean).join(" · ")
@@ -258,7 +331,9 @@ export function fieldsForState(state) {
                 required: true,
                 choices: includeCurrent(stackChoices, stackCode)
             },
-            { path: "technology.repoMode", label: "Repository mode", kind: "select", choices: choices(["STANDALONE", "ADD_MODULE"]) },
+            ...(valueAtPath(state.draft, "schemaVersion") === 2 ? [] : [
+                { path: "technology.repoMode", label: "Repository mode", kind: "select", choices: choices(["STANDALONE", "ADD_MODULE"]) }
+            ]),
             ...(mode === "NEW" ? [{
                     path: "technology.templateCode",
                     label: "Copier template",
@@ -274,6 +349,12 @@ export function fieldsForState(state) {
             { path: "delivery.jenkinsRequired", label: "Jenkins required", kind: "boolean" },
             { path: "delivery.tiers", label: "Jenkins tiers", kind: "tiers" },
             { path: "delivery.gitopsRequired", label: "GitOps required", kind: "boolean" },
+            ...(valueAtPath(state.draft, "delivery.gitopsRequired") === true ? [
+                { path: "delivery.targetKey", label: "GitOps deployment target key", kind: "text", required: true },
+                { path: "delivery.profileCode", label: "GitOps layout profile", kind: "text", required: true, placeholder: "MCI_FLUX_V1" },
+                { path: "delivery.profileVersion", label: "GitOps profile version", kind: "text", required: true, placeholder: "1.0.0" },
+                { path: "delivery.structuralSpec", label: "GitOps structural spec JSON", kind: "json", required: true }
+            ] : []),
             { path: "delivery.nacosRequired", label: "Nacos required", kind: "boolean" }
         ];
     return [];
@@ -287,6 +368,33 @@ export function valueAtPath(root, path) {
     }
     return current;
 }
+export function gitopsExecutionDetails(events) {
+    for (const event of [...events].reverse()) {
+        const output = event.output;
+        if (!output || typeof output !== "object" || Array.isArray(output))
+            continue;
+        const value = output;
+        if (!value.gitopsPlanNumber && !value.gitopsRunNo && !value.gitopsState)
+            continue;
+        return {
+            planNumber: optionalText(value.gitopsPlanNumber),
+            planHash: optionalText(value.gitopsPlanHash),
+            files: textArray(value.gitopsPlanFiles),
+            warnings: textArray(value.gitopsWarnings),
+            sideEffects: textArray(value.gitopsSideEffects),
+            runNumber: optionalText(value.gitopsRunNo),
+            state: optionalText(value.gitopsState),
+            lastEventSequence: typeof value.gitopsLastEventSequence === "number"
+                ? value.gitopsLastEventSequence : undefined,
+            bindingId: optionalText(value.gitopsBindingId),
+            targetKey: optionalText(value.gitopsTargetKey),
+            baseRevision: optionalText(value.gitopsBaseRevision),
+            resultRevision: optionalText(value.gitopsResultRevision),
+            reviewUrl: optionalText(value.gitopsReviewUrl)
+        };
+    }
+    return undefined;
+}
 export function stringAt(root, path) {
     const value = valueAtPath(root, path);
     return typeof value === "string" ? value : value == null ? "" : String(value);
@@ -329,6 +437,8 @@ export function parseFieldInput(field, input) {
         if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
             throw new OnboardingError(`${field.label} must be a JSON object.`, "onboarding_input_invalid");
         }
+        if (field.path === "delivery.structuralSpec")
+            validateGitopsStructuralSpec(parsed);
         return parsed;
     }
     if (field.kind === "tiers") {
@@ -344,9 +454,26 @@ export function parseFieldInput(field, input) {
     return trimmed || undefined;
 }
 export function assertCredentialFreeDraft(draft) {
-    const parsed = CredentialFreeOnboardingValueSchema.safeParse(draft);
-    if (!parsed.success) {
-        throw new OnboardingError(`Draft contains credential-bearing input: ${parsed.error.issues[0]?.path.join(".") || "unknown field"}.`, "onboarding_secret_not_allowed");
+    const credentialScan = cloneObject(draft);
+    const delivery = asObject(credentialScan.delivery);
+    let structuralCredentialScan;
+    if (delivery.structuralSpec !== undefined) {
+        const structuralSpec = asObject(delivery.structuralSpec);
+        validateGitopsStructuralSpec(structuralSpec);
+        structuralCredentialScan = cloneObject(structuralSpec);
+        delete structuralCredentialScan.secretEnvironment;
+        delete delivery.structuralSpec;
+        credentialScan.delivery = delivery;
+    }
+    const parsed = CredentialFreeOnboardingValueSchema.safeParse(credentialScan);
+    const structuralParsed = structuralCredentialScan == null
+        ? undefined
+        : CredentialFreeOnboardingValueSchema.safeParse({ controlledStructure: structuralCredentialScan });
+    if (!parsed.success || structuralParsed?.success === false) {
+        const issue = !parsed.success
+            ? parsed.error.issues[0]
+            : structuralParsed && !structuralParsed.success ? structuralParsed.error.issues[0] : undefined;
+        throw new OnboardingError(`Draft contains credential-bearing input: ${issue?.path.join(".") || "unknown field"}.`, "onboarding_secret_not_allowed");
     }
 }
 export function cycleFieldValue(state, field, direction) {
@@ -364,6 +491,102 @@ export function cycleFieldValue(state, field, direction) {
     const selected = options[nextIndex].value;
     return setDraftPath(state.draft, field.path, field.kind === "number" ? Number(selected) : selected);
 }
+export function enableGitopsDeliveryDefaults(draft) {
+    let result = setDraftPath(draft, "delivery.jenkinsRequired", true);
+    if (!stringAt(result, "delivery.profileCode")) {
+        result = setDraftPath(result, "delivery.profileCode", "MCI_FLUX_V1");
+    }
+    if (!stringAt(result, "delivery.profileVersion")) {
+        result = setDraftPath(result, "delivery.profileVersion", "1.0.0");
+    }
+    if (!valueAtPath(result, "delivery.structuralSpec")) {
+        result = setDraftPath(result, "delivery.structuralSpec", DEFAULT_GITOPS_STRUCTURAL_SPEC);
+    }
+    return result;
+}
+export function validateGitopsStructuralSpec(spec) {
+    for (const field of Object.keys(spec)) {
+        if (GITOPS_PLATFORM_MANAGED_FIELDS.has(field)) {
+            throw new OnboardingError(`delivery.structuralSpec.${field} is platform/Jenkins-managed and cannot be submitted.`, "GITOPS_MANAGED_FIELD_FORBIDDEN");
+        }
+        if (!GITOPS_STRUCTURAL_FIELDS.has(field)) {
+            throw new OnboardingError(`delivery.structuralSpec.${field} is not supported by MCI_FLUX_V1.`, "GITOPS_SPEC_INVALID");
+        }
+    }
+    validateGitopsEnvironment(spec.environment);
+    validateGitopsSecretEnvironment(spec.secretEnvironment);
+    if (spec.advancedValues != null) {
+        const advancedValues = requireRecord(spec.advancedValues, "delivery.structuralSpec.advancedValues");
+        for (const field of Object.keys(advancedValues)) {
+            if (GITOPS_MANAGED_ADVANCED_VALUES.has(field)) {
+                throw new OnboardingError(`delivery.structuralSpec.advancedValues.${field} is managed by MCI_FLUX_V1.`, "GITOPS_MANAGED_FIELD_FORBIDDEN");
+            }
+        }
+    }
+    rejectRawGitopsSecret(spec, "delivery.structuralSpec");
+}
+function validateGitopsEnvironment(value) {
+    if (value == null)
+        return;
+    const environment = requireRecord(value, "delivery.structuralSpec.environment");
+    for (const [name, raw] of Object.entries(environment)) {
+        if (!GITOPS_ENVIRONMENT_NAME.test(name) || typeof raw !== "string") {
+            throw new OnboardingError(`delivery.structuralSpec.environment.${name} must have a valid environment name and string value.`, "GITOPS_SPEC_INVALID");
+        }
+        if (GITOPS_SENSITIVE_ENVIRONMENT_NAME.test(name.toUpperCase()) || looksLikeGitopsCredential(raw)) {
+            throw new OnboardingError(`delivery.structuralSpec.environment.${name} may contain plaintext credentials; use secretEnvironment SecretRef.`, "GITOPS_PLAINTEXT_CREDENTIAL_FORBIDDEN");
+        }
+    }
+}
+function validateGitopsSecretEnvironment(value) {
+    if (value == null)
+        return;
+    if (!Array.isArray(value)) {
+        throw new OnboardingError("delivery.structuralSpec.secretEnvironment must be an array of SecretRef objects.", "GITOPS_SPEC_INVALID");
+    }
+    value.forEach((raw, index) => {
+        const item = requireRecord(raw, `delivery.structuralSpec.secretEnvironment[${index}]`);
+        const allowed = new Set(["name", "secretName", "secretKey", "optional"]);
+        const unknown = Object.keys(item).find((field) => !allowed.has(field));
+        if (unknown) {
+            throw new OnboardingError(`delivery.structuralSpec.secretEnvironment[${index}].${unknown} is not an allowed SecretRef field.`, "GITOPS_RAW_SECRET_FORBIDDEN");
+        }
+        if (!nonEmptyString(item.name) || !GITOPS_ENVIRONMENT_NAME.test(item.name)
+            || !nonEmptyString(item.secretName) || !nonEmptyString(item.secretKey)
+            || (item.optional != null && typeof item.optional !== "boolean")) {
+            throw new OnboardingError(`delivery.structuralSpec.secretEnvironment[${index}] requires name, secretName, secretKey, and optional boolean optional.`, "GITOPS_SPEC_INVALID");
+        }
+    });
+}
+function rejectRawGitopsSecret(value, path) {
+    if (Array.isArray(value)) {
+        value.forEach((item, index) => rejectRawGitopsSecret(item, `${path}[${index}]`));
+        return;
+    }
+    if (!value || typeof value !== "object")
+        return;
+    const object = value;
+    if (String(object.kind ?? "").toLowerCase() === "secret"
+        && (Object.hasOwn(object, "data") || Object.hasOwn(object, "stringData"))) {
+        throw new OnboardingError(`${path} cannot contain Kubernetes Secret.data/stringData; use an existing SecretRef.`, "GITOPS_RAW_SECRET_FORBIDDEN");
+    }
+    Object.entries(object).forEach(([key, item]) => rejectRawGitopsSecret(item, `${path}.${key}`));
+}
+function requireRecord(value, path) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new OnboardingError(`${path} must be a JSON object.`, "GITOPS_SPEC_INVALID");
+    }
+    return value;
+}
+function nonEmptyString(value) {
+    return typeof value === "string" && Boolean(value.trim());
+}
+function looksLikeGitopsCredential(value) {
+    return /:\/\/[^/\s:@]+:[^@\s/]+@/u.test(value)
+        || /(password|passwd|secret|token|api[_-]?key)\s*[:=]/iu.test(value)
+        || value.includes("-----BEGIN PRIVATE KEY-----")
+        || value.includes("-----BEGIN RSA PRIVATE KEY-----");
+}
 export function applyRepositorySelection(draft, repositories, externalId) {
     let result = setDraftPath(draft, "repository.externalId", externalId || undefined);
     const repository = repositories.find((item) => text(item.externalId ?? item.id) === externalId);
@@ -374,6 +597,22 @@ export function applyRepositorySelection(draft, repositories, externalId) {
     result = setDraftPath(result, "repository.namespace", undefined);
     return setDraftPath(result, "repository.defaultBranch", text(repository.defaultBranch) || "main");
 }
+export function applyRepositoryStrategy(draft, mode, strategy) {
+    const effective = mode === "EXISTING" ? "ATTACH_EXISTING" : strategy;
+    let result = setDraftPath(draft, "repositoryStrategy", effective);
+    result = setDraftPath(result, "projectStrategy", mode === "EXISTING" ? "ASSESS_ONLY" : effective === "CREATE_NEW" ? "BOOTSTRAP_TEMPLATE" : "ADD_MODULE_CHANGE");
+    result = setDraftPath(result, "technology.repoMode", mode === "EXISTING" ? "ASSESS_ONLY" : effective === "CREATE_NEW" ? "STANDALONE" : "ADD_MODULE");
+    result = setDraftPath(result, effective === "CREATE_NEW" ? "repositoryRef" : "repositoryPlanRef", undefined);
+    return result;
+}
+export function applyManagedRepositorySelection(draft, repositories, repositoryKey) {
+    let result = setDraftPath(draft, "repositoryRef.repositoryKey", repositoryKey || undefined);
+    const repository = repositories.find((item) => text(item.repositoryKey) === repositoryKey);
+    if (!repository)
+        return result;
+    const observedRevision = text(repository.observedRevision ?? repository.lastObservedRevision);
+    return setDraftPath(result, "repositoryRef.expectedHead", /^[0-9a-fA-F]{40,64}$/u.test(observedRevision) ? observedRevision : undefined);
+}
 export function applyTemplateDefaults(draft, template) {
     const schema = asObject(template?.parameterSchema);
     const defaults = defaultsFromSchema(schema);
@@ -403,15 +642,60 @@ export function validateWizardBeforeStep(state, targetStepIndex) {
         errors.push("application.teamId must be a positive integer.");
     if (!positiveIntegerAt(state.draft, "application.systemId"))
         errors.push("application.systemId must be a positive integer.");
-    requireText("repository.connectionCode");
+    const schemaVersion = valueAtPath(state.draft, "schemaVersion");
     const addModule = mode === "NEW" && stringAt(state.draft, "technology.repoMode") === "ADD_MODULE";
-    if (mode === "NEW" && !addModule) {
-        requireText("repository.namespace");
-        requireText("repository.name");
+    if (schemaVersion === 2) {
+        if (Object.hasOwn(state.draft, "repository")) {
+            errors.push("schemaVersion=2 forbids legacy repository/provider fields; use repositoryPlanRef or repositoryRef.");
+        }
+        const strategy = stringAt(state.draft, "repositoryStrategy");
+        if (mode === "EXISTING" && strategy !== "ATTACH_EXISTING") {
+            errors.push("repositoryStrategy must be ATTACH_EXISTING for EXISTING onboarding.");
+        }
+        else if (!["CREATE_NEW", "ATTACH_EXISTING"].includes(strategy)) {
+            errors.push("repositoryStrategy must be CREATE_NEW or ATTACH_EXISTING.");
+        }
+        const expectedProject = mode === "EXISTING"
+            ? "ASSESS_ONLY"
+            : strategy === "CREATE_NEW" ? "BOOTSTRAP_TEMPLATE" : "ADD_MODULE_CHANGE";
+        if (stringAt(state.draft, "projectStrategy") !== expectedProject) {
+            errors.push(`projectStrategy must be ${expectedProject}.`);
+        }
+        const expectedRepoMode = mode === "EXISTING"
+            ? "ASSESS_ONLY"
+            : strategy === "CREATE_NEW" ? "STANDALONE" : "ADD_MODULE";
+        if (stringAt(state.draft, "technology.repoMode") !== expectedRepoMode) {
+            errors.push(`technology.repoMode must be ${expectedRepoMode}.`);
+        }
+        if (strategy === "CREATE_NEW") {
+            requireText("repositoryPlanRef.planNo");
+            if (!/^[0-9a-f]{64}$/u.test(stringAt(state.draft, "repositoryPlanRef.planHash"))) {
+                errors.push("repositoryPlanRef.planHash must be the exact 64-lowercase-hex server plan hash.");
+            }
+            if (valueAtPath(state.draft, "repositoryRef") != null) {
+                errors.push("CREATE_NEW cannot include repositoryRef.");
+            }
+        }
+        else if (strategy === "ATTACH_EXISTING") {
+            requireText("repositoryRef.repositoryKey");
+            if (!/^[0-9a-fA-F]{40,64}$/u.test(stringAt(state.draft, "repositoryRef.expectedHead"))) {
+                errors.push("repositoryRef.expectedHead must be an immutable 40-64 hex revision.");
+            }
+            if (valueAtPath(state.draft, "repositoryPlanRef") != null) {
+                errors.push("ATTACH_EXISTING cannot include repositoryPlanRef.");
+            }
+        }
     }
     else {
-        requireText("repository.externalId");
-        requireText("repository.expectedHead");
+        requireText("repository.connectionCode");
+        if (mode === "NEW" && !addModule) {
+            requireText("repository.namespace");
+            requireText("repository.name");
+        }
+        else {
+            requireText("repository.externalId");
+            requireText("repository.expectedHead");
+        }
     }
     requireText("technology.stackCode");
     if (mode === "NEW") {
@@ -420,6 +704,52 @@ export function validateWizardBeforeStep(state, targetStepIndex) {
         if (selected)
             errors.push(...validateTemplateParameters(state.draft, state.catalog.templates));
     }
+    if (targetStepIndex >= ONBOARDING_STEPS.indexOf("REVIEW")
+        && valueAtPath(state.draft, "delivery.gitopsRequired") === true) {
+        if (valueAtPath(state.draft, "delivery.jenkinsRequired") !== true) {
+            errors.push("delivery.jenkinsRequired must be enabled for GitOps image delivery evidence.");
+        }
+        const tiers = valueAtPath(state.draft, "delivery.tiers");
+        if (!Array.isArray(tiers) || tiers.length === 0) {
+            errors.push("delivery.tiers requires at least one Jenkins tier for GitOps onboarding.");
+        }
+        requireText("delivery.targetKey");
+        requireText("delivery.profileCode");
+        requireText("delivery.profileVersion");
+        const structuralSpec = valueAtPath(state.draft, "delivery.structuralSpec");
+        if (!structuralSpec || typeof structuralSpec !== "object" || Array.isArray(structuralSpec)
+            || Object.keys(structuralSpec).length === 0) {
+            errors.push("delivery.structuralSpec must be a non-empty controlled JSON object.");
+        }
+        else {
+            try {
+                validateGitopsStructuralSpec(structuralSpec);
+            }
+            catch (error) {
+                errors.push(error instanceof Error ? error.message : String(error));
+            }
+        }
+    }
+    if (targetStepIndex >= ONBOARDING_STEPS.indexOf("REVIEW") && schemaVersion !== 2) {
+        errors.push("Legacy schemaVersion=1 TUI sessions are recovery/read-only and cannot preflight or apply. "
+            + "Start a v2 TUI session or use `numa app onboard --spec <v2.json> --plan`.");
+    }
+    else if (targetStepIndex >= ONBOARDING_STEPS.indexOf("REVIEW")) {
+        const schemaDraft = cloneObject(state.draft);
+        const delivery = asObject(schemaDraft.delivery);
+        const structuralSpec = asObject(delivery.structuralSpec);
+        if (Object.hasOwn(structuralSpec, "secretEnvironment")) {
+            delete structuralSpec.secretEnvironment;
+            delivery.structuralSpec = structuralSpec;
+            schemaDraft.delivery = delivery;
+        }
+        const parsed = OnboardingSpecSchema.safeParse(schemaDraft);
+        if (!parsed.success) {
+            for (const issue of parsed.error.issues) {
+                errors.push(`${issue.path.join(".") || "spec"}: ${issue.message}`);
+            }
+        }
+    }
     return [...new Set(errors)];
 }
 function validateSchemaObject(schema, value, path) {
@@ -513,6 +843,18 @@ function asObject(value) {
 function text(value) {
     return typeof value === "string" ? value : typeof value === "number" ? String(value) : "";
 }
+function optionalText(value) {
+    const result = text(value).trim();
+    return result || undefined;
+}
+function textArray(value) {
+    return Array.isArray(value)
+        ? value.flatMap((item) => {
+            const result = optionalText(item);
+            return result == null ? [] : [result];
+        })
+        : [];
+}
 function choices(values) {
     return values.map((value) => ({ value, label: value }));
 }