@skyhook-io/k8s-ui 1.12.0 → 1.13.3

package/src/components/resources/resource-utils-calico.test.ts

@@ -0,0 +1,215 @@
+import { describe, expect, it } from 'vitest'
+import {
+  CALICO_SELECTOR_NOT_APPLICABLE,
+  getCalicoApiGroup,
+  getCalicoIPPoolAllowedUses,
+  getCalicoIPPoolBlockSize,
+  getCalicoIPPoolEncapsulation,
+  getCalicoPolicyKindLabel,
+  getCalicoPolicySelector,
+  getCalicoPolicyTypes,
+  getCalicoTierRef,
+  isCalicoApiVersion,
+  isCalicoPolicyResource,
+  isCalicoStagedDeletion,
+  isCalicoStagedKubernetesNetworkPolicyKind,
+  isCoreNetworkPolicyKind,
+} from './resource-utils-calico'
+
+describe('Calico API group matching', () => {
+  it('extracts only supported Calico API groups', () => {
+    expect(getCalicoApiGroup('projectcalico.org/v3')).toBe('projectcalico.org')
+    expect(getCalicoApiGroup('crd.projectcalico.org/v1')).toBe(
+      'crd.projectcalico.org',
+    )
+    expect(getCalicoApiGroup('extension.projectcalico.org/v1')).toBeUndefined()
+  })
+
+  it('builds a cluster-scoped Tier reference with the policy API group', () => {
+    expect(
+      getCalicoTierRef({
+        apiVersion: 'crd.projectcalico.org/v1',
+        spec: { tier: 'security' },
+      }),
+    ).toEqual({
+      kind: 'Tier',
+      namespace: '',
+      name: 'security',
+      group: 'crd.projectcalico.org',
+    })
+  })
+
+  it.each(['projectcalico.org/v3', 'crd.projectcalico.org/v1'])(
+    'accepts the exact Calico group: %s',
+    (apiVersion) => {
+      expect(isCalicoApiVersion(apiVersion)).toBe(true)
+      expect(
+        isCalicoPolicyResource({ apiVersion, kind: 'NetworkPolicy' }),
+      ).toBe(true)
+    },
+  )
+
+  it.each(['projectcalico.org/v3', 'crd.projectcalico.org/v1'])(
+    'recognizes staged Kubernetes network policies in %s',
+    (apiVersion) => {
+      const policy = {
+        apiVersion,
+        kind: 'StagedKubernetesNetworkPolicy',
+        spec: {
+          podSelector: { matchLabels: { app: 'frontend' } },
+          policyTypes: ['Ingress'],
+        },
+      }
+      expect(isCalicoStagedKubernetesNetworkPolicyKind(policy.kind)).toBe(true)
+      expect(isCalicoPolicyResource(policy)).toBe(true)
+      expect(getCalicoPolicySelector(policy)).toBe('app=frontend')
+      expect(getCalicoPolicyKindLabel(policy.kind)).toBe(
+        'CalicoStagedKubernetesNetworkPolicy',
+      )
+    },
+  )
+
+  it.each([
+    'extension.projectcalico.org/v1',
+    'projectcalico.org.evil/v1',
+    'networking.example.io/v1',
+    'v1',
+  ])('rejects a non-Calico group: %s', (apiVersion) => {
+    expect(isCalicoApiVersion(apiVersion)).toBe(false)
+    expect(isCalicoPolicyResource({ apiVersion, kind: 'NetworkPolicy' })).toBe(
+      false,
+    )
+  })
+
+  it('recognizes only the core networking.k8s.io policy', () => {
+    expect(
+      isCoreNetworkPolicyKind('NetworkPolicy', 'networking.k8s.io/v1'),
+    ).toBe(true)
+    expect(
+      isCoreNetworkPolicyKind('NetworkPolicy', 'projectcalico.org/v3'),
+    ).toBe(false)
+    expect(
+      isCoreNetworkPolicyKind('NetworkPolicy', 'other.example.io/v1'),
+    ).toBe(false)
+    expect(isCoreNetworkPolicyKind('NetworkPolicy', undefined)).toBe(true)
+    expect(
+      isCoreNetworkPolicyKind('NetworkPolicy', undefined, 'networking.k8s.io'),
+    ).toBe(true)
+    expect(
+      isCoreNetworkPolicyKind('NetworkPolicy', undefined, 'other.example.io'),
+    ).toBe(false)
+  })
+
+  it('does not let the exact core fallback classify foreign kinds', () => {
+    expect(
+      isCoreNetworkPolicyKind('GlobalNetworkPolicy', 'networking.k8s.io/v1'),
+    ).toBe(false)
+    expect(isCoreNetworkPolicyKind('Widget', undefined)).toBe(false)
+  })
+})
+
+describe('staged deletions', () => {
+  const deletion = {
+    apiVersion: 'projectcalico.org/v3',
+    kind: 'StagedNetworkPolicy',
+    metadata: { name: 'retire-frontend', namespace: 'demo' },
+    // The Calico API rejects any other spec field alongside a Delete action.
+    spec: { stagedAction: 'Delete', tier: 'default' },
+  }
+
+  it('does not read an absent selector as every workload', () => {
+    expect(isCalicoStagedDeletion(deletion)).toBe(true)
+    expect(getCalicoPolicySelector(deletion)).toBe(
+      CALICO_SELECTOR_NOT_APPLICABLE,
+    )
+  })
+
+  it('leaves a staged Set reading its real selector', () => {
+    const set = {
+      apiVersion: 'projectcalico.org/v3',
+      kind: 'StagedNetworkPolicy',
+      metadata: { name: 'tighten', namespace: 'demo' },
+      spec: { stagedAction: 'Set', selector: "app == 'web'" },
+    }
+    expect(isCalicoStagedDeletion(set)).toBe(false)
+    expect(getCalicoPolicySelector(set)).toBe("app == 'web'")
+  })
+
+  it('still reads an enforced policy with no selector as every workload', () => {
+    const enforced = {
+      apiVersion: 'projectcalico.org/v3',
+      kind: 'NetworkPolicy',
+      metadata: { name: 'catch-all', namespace: 'demo' },
+      spec: {},
+    }
+    expect(getCalicoPolicySelector(enforced)).toBe('all workloads')
+  })
+})
+
+describe('IPPool derivations', () => {
+  it("applies Calico's block size default per address family", () => {
+    expect(getCalicoIPPoolBlockSize({ spec: { cidr: '192.168.0.0/16' } })).toBe(
+      26,
+    )
+    expect(getCalicoIPPoolBlockSize({ spec: { cidr: 'fd00::/48' } })).toBe(122)
+    expect(
+      getCalicoIPPoolBlockSize({ spec: { cidr: '10.0.0.0/8', blockSize: 24 } }),
+    ).toBe(24)
+    expect(getCalicoIPPoolBlockSize({ spec: {} })).toBeUndefined()
+  })
+
+  it('names the tunnel a pool encapsulates through', () => {
+    expect(getCalicoIPPoolEncapsulation({ spec: {} })).toBe('None')
+    expect(getCalicoIPPoolEncapsulation({ spec: { ipipMode: 'Always' } })).toBe(
+      'IPIP Always',
+    )
+    expect(
+      getCalicoIPPoolEncapsulation({ spec: { vxlanMode: 'CrossSubnet' } }),
+    ).toBe('VXLAN CrossSubnet')
+  })
+
+  it("falls back to Calico's default allowed uses", () => {
+    expect(getCalicoIPPoolAllowedUses({ spec: {} })).toBe('Workload, Tunnel')
+    expect(
+      getCalicoIPPoolAllowedUses({ spec: { allowedUses: ['Tunnel'] } }),
+    ).toBe('Tunnel')
+  })
+})
+
+describe('derived policy types', () => {
+  // Verified against Calico v3.32.1: applying these without spec.types and
+  // reading them back yields exactly these values.
+  const policy = (spec: any) => ({
+    apiVersion: 'projectcalico.org/v3',
+    kind: 'NetworkPolicy',
+    spec: { selector: "app == 'x'", ...spec },
+  })
+
+  it('derives the types from which rule lists exist', () => {
+    expect(getCalicoPolicyTypes(policy({ egress: [{ action: 'Allow' }] }))).toEqual(['Egress'])
+    expect(getCalicoPolicyTypes(policy({ ingress: [{ action: 'Allow' }] }))).toEqual(['Ingress'])
+    expect(
+      getCalicoPolicyTypes(policy({ ingress: [{ action: 'Allow' }], egress: [{ action: 'Allow' }] })),
+    ).toEqual(['Ingress', 'Egress'])
+    expect(getCalicoPolicyTypes(policy({}))).toEqual(['Ingress'])
+  })
+
+  it('follows the Kubernetes rule for the Kubernetes-shaped staged kind', () => {
+    // Kubernetes: every policy affects ingress, egress only when an egress
+    // section exists. Calico leaves policyTypes empty on this kind, so the
+    // derivation below is what the UI renders.
+    const staged = (spec: any) => ({
+      apiVersion: 'projectcalico.org/v3',
+      kind: 'StagedKubernetesNetworkPolicy',
+      spec: { podSelector: { matchLabels: { app: 'x' } }, stagedAction: 'Set', ...spec },
+    })
+    expect(getCalicoPolicyTypes(staged({ egress: [{ to: [] }] }))).toEqual(['Ingress', 'Egress'])
+    expect(getCalicoPolicyTypes(staged({ ingress: [{ from: [] }] }))).toEqual(['Ingress'])
+    expect(getCalicoPolicyTypes(staged({}))).toEqual(['Ingress'])
+  })
+
+  it('prefers what the policy actually declares', () => {
+    expect(getCalicoPolicyTypes(policy({ types: ['Egress'], ingress: [{ action: 'Allow' }] }))).toEqual(['Egress'])
+    expect(getCalicoPolicyTypes({ spec: undefined })).toEqual([])
+  })
+})

package/src/components/resources/resource-utils-calico.ts

@@ -0,0 +1,261 @@
+import type { ResourceRef } from '../../types'
+import { isApiGroup } from './resource-utils-cnpg'
+
+export const CALICO_GROUPS = [
+  'projectcalico.org',
+  'crd.projectcalico.org',
+] as const
+
+export type CalicoApiGroup = (typeof CALICO_GROUPS)[number]
+
+const CALICO_POLICY_KINDS = new Set([
+  'networkpolicy',
+  'networkpolicies',
+  'globalnetworkpolicy',
+  'globalnetworkpolicies',
+  'stagednetworkpolicy',
+  'stagednetworkpolicies',
+  'stagedglobalnetworkpolicy',
+  'stagedglobalnetworkpolicies',
+  'stagedkubernetesnetworkpolicy',
+  'stagedkubernetesnetworkpolicies',
+])
+
+const CALICO_POLICY_LABELS: Record<string, string> = {
+  networkpolicy: 'CalicoNetworkPolicy',
+  networkpolicies: 'CalicoNetworkPolicy',
+  globalnetworkpolicy: 'CalicoGlobalNetworkPolicy',
+  globalnetworkpolicies: 'CalicoGlobalNetworkPolicy',
+  stagednetworkpolicy: 'CalicoStagedNetworkPolicy',
+  stagednetworkpolicies: 'CalicoStagedNetworkPolicy',
+  stagedglobalnetworkpolicy: 'CalicoStagedGlobalNetworkPolicy',
+  stagedglobalnetworkpolicies: 'CalicoStagedGlobalNetworkPolicy',
+  stagedkubernetesnetworkpolicy: 'CalicoStagedKubernetesNetworkPolicy',
+  stagedkubernetesnetworkpolicies: 'CalicoStagedKubernetesNetworkPolicy',
+}
+
+function apiGroup(apiVersion: unknown): string {
+  if (typeof apiVersion !== 'string') return ''
+  const parts = apiVersion.split('/')
+  return parts.length === 2 ? parts[0] : ''
+}
+
+export function isCalicoApiGroup(group: unknown): group is CalicoApiGroup {
+  return (
+    typeof group === 'string' &&
+    (CALICO_GROUPS as readonly string[]).includes(group)
+  )
+}
+
+export function isCalicoApiVersion(apiVersion: unknown): boolean {
+  return isCalicoApiGroup(apiGroup(apiVersion))
+}
+
+export function getCalicoApiGroup(
+  apiVersion: unknown,
+): CalicoApiGroup | undefined {
+  const group = apiGroup(apiVersion)
+  return isCalicoApiGroup(group) ? group : undefined
+}
+
+export function getCalicoTierRef(policy: any): ResourceRef {
+  return {
+    kind: 'Tier',
+    namespace: '',
+    name: String(policy?.spec?.tier ?? 'default'),
+    group: getCalicoApiGroup(policy?.apiVersion),
+  }
+}
+
+export function isCalicoPolicyKind(kind: unknown): boolean {
+  return typeof kind === 'string' && CALICO_POLICY_KINDS.has(kind.toLowerCase())
+}
+
+export function isCalicoNetworkPolicyKind(kind: unknown): boolean {
+  return (
+    typeof kind === 'string' &&
+    ['networkpolicy', 'networkpolicies'].includes(kind.toLowerCase())
+  )
+}
+
+export function isCalicoStagedKubernetesNetworkPolicyKind(
+  kind: unknown,
+): boolean {
+  return (
+    typeof kind === 'string' &&
+    [
+      'stagedkubernetesnetworkpolicy',
+      'stagedkubernetesnetworkpolicies',
+    ].includes(kind.toLowerCase())
+  )
+}
+
+export function isCalicoPolicyResource(data: any): boolean {
+  return isCalicoApiVersion(data?.apiVersion) && isCalicoPolicyKind(data?.kind)
+}
+
+export function isCoreNetworkPolicyApiVersion(apiVersion: unknown): boolean {
+  return isApiGroup(apiVersion, 'networking.k8s.io')
+}
+
+export function isCoreNetworkPolicyResource(data: any): boolean {
+  return isCoreNetworkPolicyKind(data?.kind, data?.apiVersion)
+}
+
+export function isCoreNetworkPolicyKind(
+  kind: unknown,
+  apiVersion: unknown,
+  group?: string,
+): boolean {
+  if (!isCalicoNetworkPolicyKind(kind)) return false
+  if (apiVersion !== undefined && apiVersion !== null && apiVersion !== '') {
+    return isCoreNetworkPolicyApiVersion(apiVersion)
+  }
+  return group === undefined || group === '' || group === 'networking.k8s.io'
+}
+
+export function getCalicoPolicyKindLabel(kind: unknown): string {
+  if (typeof kind !== 'string') return 'CalicoNetworkPolicy'
+  return CALICO_POLICY_LABELS[kind.toLowerCase()] ?? 'CalicoNetworkPolicy'
+}
+
+export function getCalicoPolicyTypes(policy: any): string[] {
+  const raw = policy?.spec?.types ?? policy?.spec?.policyTypes
+  if (Array.isArray(raw) && raw.length > 0) return raw.map(String)
+  if (typeof raw === 'string' && raw !== '') return [raw]
+  if (policy?.spec === undefined) return []
+  const hasIngress = Array.isArray(policy.spec.ingress) && policy.spec.ingress.length > 0
+  const hasEgress = Array.isArray(policy.spec.egress) && policy.spec.egress.length > 0
+
+  // The two families default this field by different rules, and a
+  // StagedKubernetesNetworkPolicy carries the Kubernetes shape. Kubernetes
+  // treats every policy as affecting ingress and adds egress only when an
+  // egress section exists; Calico derives from which rule lists exist, so an
+  // egress-only Calico policy is egress ONLY. Calico stores its own derivation
+  // but leaves policyTypes empty on the Kubernetes-shaped kind, so this runs.
+  if (isCalicoStagedKubernetesNetworkPolicyKind(policy?.kind)) {
+    return hasEgress ? ['Ingress', 'Egress'] : ['Ingress']
+  }
+  if (hasEgress && !hasIngress) return ['Egress']
+  return hasEgress ? ['Ingress', 'Egress'] : ['Ingress']
+}
+
+export function getCalicoPolicyRuleCount(policy: any): {
+  ingress: number
+  egress: number
+} {
+  return {
+    ingress: Array.isArray(policy?.spec?.ingress)
+      ? policy.spec.ingress.length
+      : 0,
+    egress: Array.isArray(policy?.spec?.egress) ? policy.spec.egress.length : 0,
+  }
+}
+
+/** The staged action, lower-cased. Absent means Set, which is Calico's default. */
+export function getCalicoStagedAction(policy: any): string {
+  const action = policy?.spec?.stagedAction
+  return typeof action === 'string' ? action.toLowerCase() : ''
+}
+
+/**
+ * A staged policy that stages a removal rather than a change. Calico requires
+ * the rest of its spec to be empty, so it has no selector and no rules — an
+ * absent selector here means "not applicable", never "every workload".
+ */
+export function isCalicoStagedDeletion(policy: any): boolean {
+  return getCalicoStagedAction(policy) === 'delete'
+}
+
+/**
+ * A staged policy Calico skips entirely. It previews nothing, so presenting its
+ * rules as a preview of protection is the same overstatement as reading a
+ * deletion's absent selector as "every workload".
+ */
+export function isCalicoStagedIgnored(policy: any): boolean {
+  return getCalicoStagedAction(policy) === 'ignore'
+}
+
+export const CALICO_SELECTOR_NOT_APPLICABLE = '-'
+
+export function getCalicoPolicySelector(policy: any): string {
+  if (isCalicoStagedDeletion(policy)) return CALICO_SELECTOR_NOT_APPLICABLE
+  const kubernetesPolicy = isCalicoStagedKubernetesNetworkPolicyKind(
+    policy?.kind,
+  )
+  const selector = kubernetesPolicy
+    ? policy?.spec?.podSelector
+    : policy?.spec?.selector
+  if (kubernetesPolicy) return formatKubernetesLabelSelector(selector)
+  return selector === undefined || selector === null || selector === ''
+    ? 'all workloads'
+    : String(selector)
+}
+
+export function formatKubernetesLabelSelector(selector: any): string {
+  if (!selector || typeof selector !== 'object') return 'all workloads'
+  const parts: string[] = []
+  for (const [key, value] of Object.entries(selector.matchLabels ?? {})) {
+    parts.push(`${key}=${String(value)}`)
+  }
+  for (const expression of Array.isArray(selector.matchExpressions)
+    ? selector.matchExpressions
+    : []) {
+    if (!expression || typeof expression !== 'object') continue
+    const item = expression as {
+      key?: string
+      operator?: string
+      values?: unknown[]
+    }
+    const values = Array.isArray(item.values)
+      ? item.values.map(String).join(',')
+      : ''
+    parts.push(
+      values
+        ? `${item.key ?? '?'} ${item.operator ?? '?'} (${values})`
+        : `${item.key ?? '?'} ${item.operator ?? '?'}`,
+    )
+  }
+  return parts.length > 0 ? parts.join(', ') : 'all workloads'
+}
+
+export function getCalicoPolicyNamespaceSelector(policy: any): string {
+  const selector = policy?.spec?.namespaceSelector
+  return selector === undefined || selector === null || selector === ''
+    ? '-'
+    : String(selector)
+}
+
+export function getCalicoPolicyServiceAccountSelector(policy: any): string {
+  const selector = policy?.spec?.serviceAccountSelector
+  return selector === undefined || selector === null || selector === ''
+    ? '-'
+    : String(selector)
+}
+
+/**
+ * Calico's own defaults for an IPPool, applied when a field is absent. The pool
+ * behaves this way whether or not the field is written, so a reader that shows
+ * only what is set describes the pool inaccurately.
+ */
+export function getCalicoIPPoolBlockSize(pool: any): number | undefined {
+  if (pool?.spec?.blockSize !== undefined) return Number(pool.spec.blockSize)
+  const cidr = pool?.spec?.cidr
+  if (typeof cidr !== 'string') return undefined
+  return cidr.includes(':') ? 122 : 26
+}
+
+/** The tunnel a pool encapsulates through, or "None" when it routes directly. */
+export function getCalicoIPPoolEncapsulation(pool: any): string {
+  const ipip = String(pool?.spec?.ipipMode ?? 'Never')
+  const vxlan = String(pool?.spec?.vxlanMode ?? 'Never')
+  if (ipip !== 'Never') return `IPIP ${ipip}`
+  if (vxlan !== 'Never') return `VXLAN ${vxlan}`
+  return 'None'
+}
+
+export function getCalicoIPPoolAllowedUses(pool: any): string {
+  const uses = pool?.spec?.allowedUses
+  if (!Array.isArray(uses)) return 'Workload, Tunnel'
+  return uses.length > 0 ? uses.map(String).join(', ') : '-'
+}

package/src/components/resources/resource-utils-cnpg-declarative.test.ts

@@ -0,0 +1,104 @@
+import { describe, it, expect } from 'vitest'
+import {
+  splitCNPGDeclarativeByApplied,
+  getCNPGDeclarativeStatus,
+  getCNPGDeclarativeMessage,
+  getCNPGReclaimPolicy,
+  getCNPGImageCatalogEntries,
+} from './resource-utils-cnpg'
+
+/**
+ * `status.applied` has three meanings and the middle one is easy to lose.
+ * Verified against a live CNPG 1.27 operator: `demo-app` came back true,
+ * `demo-broken` came back false with `role "nobody-owns-this" does not exist`,
+ * and every object is briefly absent-status before the operator reaches it.
+ */
+describe('declarative object status', () => {
+  it('is healthy once the operator has applied it', () => {
+    expect(getCNPGDeclarativeStatus({ status: { applied: true } }).level).toBe('healthy')
+  })
+
+  it('is unhealthy when the operator tried and failed', () => {
+    expect(getCNPGDeclarativeStatus({ status: { applied: false } }).level).toBe('unhealthy')
+  })
+
+  // The one that matters: a freshly created object has no `applied` at all, and
+  // reporting that as failed condemns everything in its first seconds.
+  it('is unknown — not failed — before the operator has reconciled', () => {
+    expect(getCNPGDeclarativeStatus({}).level).toBe('unknown')
+    expect(getCNPGDeclarativeStatus({ status: {} }).level).toBe('unknown')
+    expect(getCNPGDeclarativeStatus({ status: { applied: undefined } }).text).toBe('Pending')
+  })
+
+  it('passes the operator’s message through untouched', () => {
+    const msg = 'while creating database "demo_broken": ERROR: role "nobody-owns-this" does not exist'
+    expect(getCNPGDeclarativeMessage({ status: { message: msg } })).toBe(msg)
+    expect(getCNPGDeclarativeMessage({ status: { message: '' } })).toBeUndefined()
+    expect(getCNPGDeclarativeMessage({})).toBeUndefined()
+  })
+})
+
+/**
+ * The reclaim policy decides whether deleting a manifest drops real data, so
+ * the destructive case has to be identified rather than printed.
+ */
+describe('reclaim policy', () => {
+  it('flags delete as destructive across all three kinds', () => {
+    expect(getCNPGReclaimPolicy({ spec: { databaseReclaimPolicy: 'delete' } }).destructive).toBe(true)
+    expect(getCNPGReclaimPolicy({ spec: { publicationReclaimPolicy: 'delete' } }).destructive).toBe(true)
+    expect(getCNPGReclaimPolicy({ spec: { subscriptionReclaimPolicy: 'delete' } }).destructive).toBe(true)
+  })
+
+  it('does not flag retain', () => {
+    expect(getCNPGReclaimPolicy({ spec: { databaseReclaimPolicy: 'retain' } }).destructive).toBe(false)
+  })
+
+  // CNPG defaults to retain, and defaulting the other way in the UI would
+  // warn about data loss that is not going to happen.
+  it('defaults to retain when unset', () => {
+    const r = getCNPGReclaimPolicy({ spec: {} })
+    expect(r.value).toBe('retain')
+    expect(r.destructive).toBe(false)
+  })
+})
+
+describe('image catalog entries', () => {
+  it('sorts by major so the list does not reshuffle between reads', () => {
+    const e = getCNPGImageCatalogEntries({
+      spec: { images: [{ major: 17, image: 'pg:17' }, { major: 15, image: 'pg:15' }, { major: 16, image: 'pg:16' }] },
+    })
+    expect(e.map((x) => x.major)).toEqual([15, 16, 17])
+  })
+
+  it('drops entries with no image rather than rendering a blank row', () => {
+    expect(getCNPGImageCatalogEntries({ spec: { images: [{ major: 16 }] } })).toEqual([])
+  })
+
+  it('returns nothing for a catalog with no images', () => {
+    expect(getCNPGImageCatalogEntries({ spec: {} })).toEqual([])
+    expect(getCNPGImageCatalogEntries({})).toEqual([])
+  })
+})
+
+/**
+ * The Database page renders these three buckets with three different claims, so
+ * collapsing pending into failed puts "this exists in Kubernetes and not in
+ * PostgreSQL" under an object nothing has looked at yet.
+ */
+describe('splitCNPGDeclarativeByApplied', () => {
+  it('keeps pending out of the failures', () => {
+    const live = { status: { applied: true } }
+    const broken = { status: { applied: false, message: 'boom' } }
+    const fresh = {}
+    const alsoFresh = { status: {} }
+
+    const out = splitCNPGDeclarativeByApplied([live, broken, fresh, alsoFresh])
+    expect(out.applied).toEqual([live])
+    expect(out.notApplied).toEqual([broken])
+    expect(out.pending).toEqual([fresh, alsoFresh])
+  })
+
+  it('returns three empty buckets for nothing', () => {
+    expect(splitCNPGDeclarativeByApplied([])).toEqual({ applied: [], notApplied: [], pending: [] })
+  })
+})