@skyhook-io/k8s-ui 1.14.4 → 1.14.6

package/src/types/gitops-insights.ts

@@ -13,6 +13,7 @@ export interface GitOpsInsight {
 }
 
 import type { GitOpsTool } from './gitops'
+import type { GitOpsHealthMode, GitOpsHealthSource } from './gitops-tree'
 
 // Closed enums mirroring `pkg/gitops/insights/vocab.go`. Keeping the FE
 // vocabulary in lockstep with the Go side means switches over these fields
@@ -79,6 +80,19 @@ export interface GitOpsInsightSummary {
   // (jqPathExpressions / managedFieldsManagers rules) — the
   // drift panel may surface fields Argo's own UI suppresses.
   ignoredDifferences?: GitOpsIgnoredDifferences
+  // Argo roots: where Argo keeps per-resource health. 'appTree' means the
+  // controller's verdicts are not in the Application object and any
+  // per-resource health shown is Radar's own read.
+  resourceHealthMode?: GitOpsHealthMode
+  // The Application deploys to another cluster; Radar derives nothing about
+  // its resources from here.
+  remoteDestination?: boolean
+  // Per-resource health came from Argo CD's API server: the verdicts shown
+  // are Argo's even though the Application object doesn't carry them.
+  resourceHealthFromApi?: boolean
+  // The controller's API server was asked and didn't answer usefully — why,
+  // in the user's words. Only set when the integration is configured.
+  resourceHealthApiError?: string
 }
 
 export interface GitOpsIgnoredDifferences {
@@ -116,6 +130,10 @@ export interface GitOpsIssue {
   // a contextual action button. Nil when no automated remedy applies — the
   // `action` string still describes the manual path in that case.
   remediation?: GitOpsRemediation
+  // Set on resource-scoped issues: 'controller' when the GitOps controller's
+  // own per-resource health produced it, 'radar' when Radar's issues engine
+  // did because the controller's verdict wasn't available.
+  source?: GitOpsHealthSource
 }
 
 export type GitOpsRemediationKind = 'create-namespace'
@@ -131,6 +149,11 @@ export interface GitOpsChange {
   category: GitOpsCategory
   sync?: string
   health?: string
+  // Provenance of `health`; see GitOpsTreeNode.healthSource. `message` holds
+  // the health message from whichever source produced `health`.
+  healthSource?: GitOpsHealthSource
+  healthReason?: string
+  healthSeverity?: string
   message?: string
   // Per-resource sync failure message (Argo's status.resources[].syncResult).
   // Distinct from `message` (live health). Empty when sync succeeded.

package/src/types/gitops-tree.ts

@@ -24,6 +24,16 @@ export interface GitOpsTreeNode {
   tool: GitOpsTreeTool
   sync?: SyncStatus
   health?: GitOpsHealthStatus
+  // Who assessed `health`. 'controller' is the GitOps controller's own
+  // verdict; 'radar' is Radar's read of the live object (topology status, or
+  // the issues engine's finding when the controller's verdict isn't
+  // available). The UI labels 'radar' values so they never pass as the
+  // controller's. Absent when `health` is absent. Kept open for sources a
+  // newer backend may add — unknown values render without a label.
+  healthSource?: GitOpsHealthSource
+  healthReason?: string
+  healthMessage?: string
+  healthSeverity?: 'critical' | 'warning' | (string & {})
   topologyStatus?: HealthStatus
   info?: GitOpsTreeInfoItem[]
   resource?: unknown
@@ -32,6 +42,16 @@ export interface GitOpsTreeNode {
   data?: Record<string, unknown>
 }
 
+// 'controllerApi' is the controller's own verdict read from its API server
+// (argocd-server) because the CR doesn't carry it; same authority as
+// 'controller'.
+export type GitOpsHealthSource = 'controller' | 'controllerApi' | 'radar' | (string & {})
+
+// Where an Argo CD Application keeps per-resource health. 'appTree' is the
+// Argo CD 3 default: the controller's per-resource verdicts are not in the
+// Application object, so any node health present came from Radar.
+export type GitOpsHealthMode = 'inline' | 'appTree' | (string & {})
+
 export type GitOpsTreeEdgeType = 'owns' | 'source' | 'dependsOn'
 
 export interface GitOpsTreeEdge {
@@ -54,4 +74,13 @@ export interface GitOpsResourceTree {
   edges: GitOpsTreeEdge[]
   warnings?: string[]
   summary?: GitOpsTreeSummary
+  healthMode?: GitOpsHealthMode
+  // Per-resource health came from the controller's API server, so in
+  // appTree mode the verdicts are still the controller's.
+  healthFromApi?: boolean
+  // The controller's API server was asked and didn't answer usefully.
+  healthApiError?: string
+  // The Application deploys to another cluster; Radar derives nothing about
+  // its resources from here.
+  remoteDestination?: boolean
 }

package/src/utils/index.ts

@@ -30,3 +30,4 @@ export * from './application-history'
 export * from './bulk-workload-actions'
 export * from './inClusterConsent'
 export * from './workflow-execution'
+export * from './network-policy'

package/src/utils/navigation.test.ts

@@ -1,6 +1,6 @@
 import { describe, test, expect, afterEach } from 'vitest'
 import { englishPlural } from './pluralize'
-import { kindToPlural, kindToPluralWithGroup, pluralToKind, refToSelectedResource, initNavigationMap, resetNavigationMap, laneId, laneResourceKey, groupQualifiesLaneId, parseLaneId } from './navigation'
+import { kindToPlural, kindToPluralWithGroup, pluralToKind, knownKindForPluralWithGroup, refToSelectedResource, initNavigationMap, resetNavigationMap, laneId, laneResourceKey, groupQualifiesLaneId, parseLaneId } from './navigation'
 
 afterEach(() => {
   resetNavigationMap()
@@ -223,6 +223,25 @@ describe('initNavigationMap', () => {
       { group: 'metrics.k8s.io', version: 'v1beta1', kind: 'PodMetrics', name: 'pods', namespaced: true, isCrd: false, verbs: ['get'] },
     ])
     expect(pluralToKind('pods')).toBe('Pod')
+    expect(knownKindForPluralWithGroup('pods', '')).toBe('Pod')
+    expect(knownKindForPluralWithGroup('pods', 'metrics.k8s.io')).toBe('PodMetrics')
+    expect(kindToPluralWithGroup('PodMetrics', 'metrics.k8s.io')).toBe('pods')
+  })
+
+  test('resolves discovered plural collisions by API group', () => {
+    initNavigationMap([
+      { group: 'a.example.io', version: 'v1', kind: 'Widget', name: 'widgets', namespaced: true, isCrd: true, verbs: ['get'] },
+      { group: 'b.example.io', version: 'v1', kind: 'OtherWidget', name: 'widgets', namespaced: true, isCrd: true, verbs: ['get'] },
+    ])
+    expect(knownKindForPluralWithGroup('widgets', 'a.example.io')).toBe('Widget')
+    expect(knownKindForPluralWithGroup('widgets', 'b.example.io')).toBe('OtherWidget')
+    expect(knownKindForPluralWithGroup('OtherWidget', 'b.example.io')).toBe('OtherWidget')
+  })
+
+  test('does not invent a Kind for an undiscovered irregular CRD', () => {
+    expect(knownKindForPluralWithGroup('databases', 'postgresql.cnpg.io')).toBeUndefined()
+    expect(kindToPluralWithGroup('Database', 'postgresql.cnpg.io')).toBe('databases')
+    expect(kindToPluralWithGroup('databases', 'postgresql.cnpg.io')).toBe('databases')
   })
 
   test('keeps the virtual PodGroup alias distinct from scheduling PodGroup', () => {

package/src/utils/navigation.ts

@@ -1,5 +1,6 @@
 import type { SelectedResource, ResourceRef, APIResource } from '../types/core'
 import { englishPlural, englishSingular, isEnglishPlural } from './pluralize'
+import { CORE_RESOURCES } from './api-resources'
 
 /**
  * Canonical callback type for navigating to a resource.
@@ -44,6 +45,15 @@ const BUILTIN_PLURAL_TO_KIND: Record<string, string> = {
 
 const BUILTIN_GROUP_KIND_TO_PLURAL: Record<string, string> = {
   'scheduling.k8s.io/podgroup': 'podgroups',
+  'metrics.k8s.io/podmetrics': 'pods',
+  'metrics.k8s.io/nodemetrics': 'nodes',
+}
+
+const BUILTIN_GROUP_PLURAL_TO_KIND: Record<string, string> = {
+  ...Object.fromEntries(CORE_RESOURCES.map(r => [`${r.group}/${r.name}`, r.kind])),
+  'metrics.k8s.io/pods': 'PodMetrics',
+  'metrics.k8s.io/nodes': 'NodeMetrics',
+  'scheduling.k8s.io/podgroups': 'PodGroup',
 }
 
 // Dynamic map built from API discovery — populated by initNavigationMap().
@@ -51,6 +61,7 @@ const BUILTIN_GROUP_KIND_TO_PLURAL: Record<string, string> = {
 let discoveredPluralToKind: Record<string, string> | null = null
 let discoveredKindToPlural: Record<string, string> | null = null
 let discoveredGroupKindToPlural: Record<string, string> | null = null
+let discoveredGroupPluralToKind: Record<string, string> | null = null
 
 /**
  * Initialize navigation maps from discovered API resources.
@@ -61,6 +72,7 @@ export function initNavigationMap(resources: APIResource[]) {
   const p2k: Record<string, string> = { ...BUILTIN_PLURAL_TO_KIND }
   const k2p: Record<string, string> = {}
   const gk2p: Record<string, string> = {}
+  const gp2k: Record<string, string> = { ...BUILTIN_GROUP_PLURAL_TO_KIND }
   for (const r of resources) {
     const plural = r.name.toLowerCase()
     // First-wins on plurals: BUILTIN_PLURAL_TO_KIND seeds canonical core mappings
@@ -69,10 +81,13 @@ export function initNavigationMap(resources: APIResource[]) {
     if (!(plural in p2k)) p2k[plural] = r.kind
     k2p[r.kind.toLowerCase()] = plural
     gk2p[`${r.group}/${r.kind.toLowerCase()}`] = plural
+    const groupPlural = `${r.group}/${plural}`
+    if (!(groupPlural in gp2k)) gp2k[groupPlural] = r.kind
   }
   discoveredPluralToKind = p2k
   discoveredKindToPlural = k2p
   discoveredGroupKindToPlural = gk2p
+  discoveredGroupPluralToKind = gp2k
 }
 
 /** Reset navigation maps to builtin-only state. For testing. */
@@ -80,6 +95,7 @@ export function resetNavigationMap() {
   discoveredPluralToKind = null
   discoveredKindToPlural = null
   discoveredGroupKindToPlural = null
+  discoveredGroupPluralToKind = null
 }
 
 function getPluralToKind(): Record<string, string> {
@@ -166,6 +182,15 @@ export function pluralToKind(plural: string): string {
   return singular.charAt(0).toUpperCase() + singular.slice(1)
 }
 
+/** Return an exact Kind only when the input or group-qualified discovery proves it. */
+export function knownKindForPluralWithGroup(plural: string, group: string): string | undefined {
+  if (!plural) return undefined
+  if (plural[0] !== plural[0].toLowerCase()) return plural
+  const groupPlural = `${group}/${plural.toLowerCase()}`
+  return discoveredGroupPluralToKind?.[groupPlural]
+    ?? BUILTIN_GROUP_PLURAL_TO_KIND[groupPlural]
+}
+
 /**
  * Convert a ResourceRef (from backend relationships) to a SelectedResource (for navigation).
  * Handles kind singular→plural conversion.

package/src/utils/network-policy.test.ts

@@ -0,0 +1,42 @@
+import { describe, expect, it } from 'vitest'
+import { effectivePolicyTypeNames, effectivePolicyTypes, formatNetworkPolicyPort } from './network-policy'
+
+describe('effectivePolicyTypes', () => {
+  it('reads an explicit list as authoritative', () => {
+    expect(effectivePolicyTypes({ policyTypes: ['Egress'] })).toEqual({ ingress: false, egress: true, explicit: true })
+    expect(effectivePolicyTypes({ policyTypes: ['Ingress', 'Egress'], egress: [] })).toEqual({ ingress: true, egress: true, explicit: true })
+  })
+
+  it('defaults an omitted list to Ingress — the classic default-deny', () => {
+    expect(effectivePolicyTypes({ podSelector: {} })).toEqual({ ingress: true, egress: false, explicit: false })
+    expect(effectivePolicyTypes({ policyTypes: [] })).toEqual({ ingress: true, egress: false, explicit: false })
+    expect(effectivePolicyTypes(undefined)).toEqual({ ingress: true, egress: false, explicit: false })
+  })
+
+  it('adds Egress to the default only when egress rules are declared', () => {
+    expect(effectivePolicyTypes({ egress: [{}] })).toEqual({ ingress: true, egress: true, explicit: false })
+    expect(effectivePolicyTypes({ egress: [] })).toEqual({ ingress: true, egress: false, explicit: false })
+  })
+
+  it('names the effective types as Ingress then Egress', () => {
+    expect(effectivePolicyTypeNames({})).toEqual(['Ingress'])
+    expect(effectivePolicyTypeNames({ egress: [{}] })).toEqual(['Ingress', 'Egress'])
+    expect(effectivePolicyTypeNames({ policyTypes: ['Egress'] })).toEqual(['Egress'])
+    expect(effectivePolicyTypeNames({ policyTypes: ['Egress', 'Ingress'] })).toEqual(['Ingress', 'Egress'])
+  })
+})
+
+describe('formatNetworkPolicyPort', () => {
+  it('renders single ports, ranges, named ports and protocol-only entries', () => {
+    expect(formatNetworkPolicyPort({ port: 80 })).toBe('TCP/80')
+    expect(formatNetworkPolicyPort({ protocol: 'UDP', port: 53 })).toBe('UDP/53')
+    expect(formatNetworkPolicyPort({ port: 9000, endPort: 9100 })).toBe('TCP/9000-9100')
+    expect(formatNetworkPolicyPort({ port: 'metrics' })).toBe('TCP/metrics')
+    expect(formatNetworkPolicyPort({ protocol: 'SCTP' })).toBe('SCTP/*')
+  })
+
+  it('never shows a range off a named port or off no port', () => {
+    expect(formatNetworkPolicyPort({ port: 'metrics', endPort: 9100 })).toBe('TCP/metrics')
+    expect(formatNetworkPolicyPort({ endPort: 9100 })).toBe('TCP/*')
+  })
+})

package/src/utils/network-policy.ts

@@ -0,0 +1,59 @@
+/**
+ * Core networking.k8s.io/v1 NetworkPolicy presentation helpers, shared by the
+ * list column, the detail renderer and the flow diagram so the three cannot
+ * disagree about what a policy does.
+ */
+
+export interface EffectivePolicyTypes {
+  ingress: boolean
+  egress: boolean
+  /** True when spec.policyTypes was set; false when Kubernetes' defaulting decided. */
+  explicit: boolean
+}
+
+/**
+ * Kubernetes' policyTypes defaulting, applied exactly: when spec.policyTypes
+ * is set it is authoritative; when omitted, a policy always isolates Ingress
+ * and additionally isolates Egress iff it declares egress rules. The common
+ * default-deny (`podSelector: {}` and nothing else) has no policyTypes and
+ * isolates ingress — reading the field raw shows it as isolating nothing.
+ */
+export function effectivePolicyTypes(spec: any): EffectivePolicyTypes {
+  const declared: unknown = spec?.policyTypes
+  if (Array.isArray(declared) && declared.length > 0) {
+    return {
+      ingress: declared.includes('Ingress'),
+      egress: declared.includes('Egress'),
+      explicit: true,
+    }
+  }
+  const egressRules: unknown = spec?.egress
+  return {
+    ingress: true,
+    egress: Array.isArray(egressRules) && egressRules.length > 0,
+    explicit: false,
+  }
+}
+
+/** The effective types as the list they would have been declared as. */
+export function effectivePolicyTypeNames(spec: any): string[] {
+  const t = effectivePolicyTypes(spec)
+  const out: string[] = []
+  if (t.ingress) out.push('Ingress')
+  if (t.egress) out.push('Egress')
+  return out
+}
+
+/**
+ * One NetworkPolicyPort as `PROTO/port`, `PROTO/start-end` for an endPort
+ * range, or `PROTO/*` when the entry names a protocol but no port.
+ */
+export function formatNetworkPolicyPort(port: any): string {
+  const proto = port?.protocol || 'TCP'
+  const start = port?.port ?? '*'
+  const end = port?.endPort
+  // endPort only ever pairs with a numeric port; a range off a named port or
+  // off no port is not a range Kubernetes would accept, so it isn't shown as one.
+  const isRange = end != null && typeof start === 'number'
+  return isRange ? `${proto}/${start}-${end}` : `${proto}/${start}`
+}

package/src/utils/reflector.ts

@@ -0,0 +1,139 @@
+import type { Relationships } from "../types";
+
+const prefix = "reflector.v1.k8s.emberstack.com/";
+const annotationNames = [
+  "reflects",
+  "auto-reflects",
+  "reflected-version",
+  "reflected-at",
+  "reflection-allowed",
+  "reflection-auto-enabled",
+  "reflection-allowed-namespaces",
+  "reflection-allowed-namespaces-selector",
+  "reflection-auto-namespaces",
+  "reflection-auto-namespaces-selector",
+];
+
+export type Reflection = NonNullable<Relationships["reflection"]>;
+export interface ReflectorResource {
+  apiVersion?: string;
+  metadata?: {
+    name?: string;
+    namespace?: string;
+    annotations?: Record<string, string>;
+  };
+}
+
+function annotationsFor(data: ReflectorResource): Record<string, string> {
+  return data.apiVersion === "v1" ? (data.metadata?.annotations ?? {}) : {};
+}
+
+export function hasReflectorDetails(
+  data: ReflectorResource,
+  reflection?: Reflection,
+): boolean {
+  if (data.apiVersion !== "v1") return false;
+  const annotations = annotationsFor(data);
+  return (
+    annotationNames.some((name) => prefix + name in annotations) ||
+    !!reflection?.source ||
+    !!reflection?.mirrors?.length
+  );
+}
+
+export function isReflectorMirror(data: ReflectorResource): boolean {
+  return /^[^/\s]+\/[^/\s]+$/.test(
+    annotationsFor(data)[prefix + "reflects"] ?? "",
+  );
+}
+
+export const reflectorEditNotice =
+  "This object is a Reflector mirror. Edit the source for lasting changes. Local edits may persist until the source changes, then be overwritten.";
+
+function booleanValue(value: string | undefined): boolean | undefined {
+  if (value === undefined) return false;
+  if (value.trim().toLowerCase() === "true") return true;
+  if (value.trim().toLowerCase() === "false") return false;
+  return undefined;
+}
+
+export function parseReflector(
+  data: ReflectorResource,
+  reflection?: Reflection,
+) {
+  const annotations = annotationsFor(data);
+  const value = (name: string) => annotations[prefix + name];
+  const declaration = value("reflects");
+  const hasDeclaration = declaration !== undefined;
+  const isMirror = isReflectorMirror(data);
+  const allowed = booleanValue(value("reflection-allowed"));
+  const autoEnabled = booleanValue(value("reflection-auto-enabled"));
+  const automatic = booleanValue(value("auto-reflects"));
+  const source =
+    reflection?.source &&
+    `${reflection.source.namespace}/${reflection.source.name}` === declaration
+      ? reflection.source
+      : undefined;
+  const mirrors = reflection?.mirrors ?? [];
+  const sourceSettings =
+    !isMirror ||
+    annotationNames.some(
+      (name) => name.startsWith("reflection-") && value(name) !== undefined,
+    ) ||
+    mirrors.length > 0;
+  const copiedVersion = value("reflected-version");
+  const sourceVersion = source ? reflection?.sourceResourceVersion : undefined;
+  const warnings: string[] = [];
+  for (const name of [
+    "reflection-allowed",
+    "reflection-auto-enabled",
+    "auto-reflects",
+  ]) {
+    if (booleanValue(value(name)) === undefined)
+      warnings.push(
+        `${name} must be true or false (currently "${value(name)}").`,
+      );
+  }
+  if (hasDeclaration && !isMirror)
+    warnings.push(
+      "The reflects annotation must name a source as namespace/name.",
+    );
+  if (
+    declaration &&
+    declaration === `${data.metadata?.namespace}/${data.metadata?.name}`
+  )
+    warnings.push(
+      "The reflects annotation points to this object itself. Choose a different source.",
+    );
+  if (!isMirror && mirrors.length > 0 && allowed === false)
+    warnings.push(
+      "Reflection is not enabled on this source, but visible mirrors still reference it.",
+    );
+  if (!isMirror && autoEnabled === true && allowed === false)
+    warnings.push(
+      "Automatic mirror creation requires reflection-allowed to be true.",
+    );
+  if (
+    isMirror &&
+    (mirrors.length > 0 || allowed === true || autoEnabled === true)
+  )
+    warnings.push(
+      "This object is itself a mirror. Reflector does not propagate its updates as source updates to other mirrors.",
+    );
+
+  return {
+    value,
+    declaration,
+    hasDeclaration,
+    isMirror,
+    allowed,
+    autoEnabled,
+    automatic,
+    source,
+    mirrors,
+    sourceSettings,
+    copiedVersion,
+    sourceVersion,
+    warnings,
+  };
+}

package/src/utils/yaml-file-import.test.ts

@@ -0,0 +1,189 @@
+import { describe, expect, it } from 'vitest'
+import {
+  describeFileDrag,
+  MAX_YAML_FILE_BYTES,
+  needsReplaceConfirmation,
+  readYamlFile,
+} from './yaml-file-import'
+
+function drag(items: Array<{ kind: string; type: string }>, types: string[] = []): DataTransfer {
+  return { items, types } as unknown as DataTransfer
+}
+
+// Safari keeps the dragged items protected until the drop, so `items` is empty
+// mid-drag; only `types` reports that files are coming.
+function safariDrag(types: string[]): DataTransfer {
+  return { items: [], types } as unknown as DataTransfer
+}
+
+const MULTI_DOC = `apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: first
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: second
+`
+
+function yamlFile(name: string, content: string, type = ''): File {
+  return new File([content], name, { type })
+}
+
+describe('readYamlFile', () => {
+  it('loads a multi-document file as text the editor can hold unchanged', async () => {
+    const result = await readYamlFile([yamlFile('bundle.yaml', MULTI_DOC)])
+
+    expect(result).toEqual({ ok: true, fileName: 'bundle.yaml', yaml: MULTI_DOC })
+  })
+
+  it('accepts .yml as readily as .yaml', async () => {
+    const result = await readYamlFile([yamlFile('bundle.yml', MULTI_DOC)])
+
+    expect(result.ok).toBe(true)
+  })
+
+  // Browsers disagree on the MIME type for YAML — macOS Chrome commonly reports
+  // "", Windows reports assorted octet-stream variants — so the extension is the
+  // only signal that means the same thing everywhere.
+  it('accepts a YAML extension even when the browser reports no usable MIME type', async () => {
+    const result = await readYamlFile([
+      yamlFile('bundle.yaml', MULTI_DOC, 'application/octet-stream'),
+    ])
+
+    expect(result.ok).toBe(true)
+  })
+
+  it('rejects a non-YAML extension even when the browser claims it is YAML', async () => {
+    const result = await readYamlFile([yamlFile('notes.txt', MULTI_DOC, 'text/yaml')])
+
+    expect(result).toMatchObject({ ok: false, reason: 'extension' })
+  })
+
+  it('rejects a file that holds only whitespace', async () => {
+    const result = await readYamlFile([yamlFile('empty.yaml', '  \n\n  ')])
+
+    expect(result).toMatchObject({ ok: false, reason: 'empty' })
+  })
+
+  it('rejects a file larger than the cap without reading it', async () => {
+    const oversize = yamlFile('huge.yaml', 'x'.repeat(MAX_YAML_FILE_BYTES + 1))
+
+    expect(await readYamlFile([oversize])).toMatchObject({ ok: false, reason: 'too-large' })
+  })
+
+  it('rejects a drop carrying more than one file', async () => {
+    const result = await readYamlFile([
+      yamlFile('one.yaml', MULTI_DOC),
+      yamlFile('two.yaml', MULTI_DOC),
+    ])
+
+    expect(result).toMatchObject({ ok: false, reason: 'multiple-files' })
+  })
+
+  it('rejects an empty selection', async () => {
+    expect(await readYamlFile([])).toMatchObject({ ok: false, reason: 'no-file' })
+  })
+
+  it('reports a file the browser cannot read rather than throwing', async () => {
+    const unreadable = {
+      name: 'gone.yaml',
+      size: 128,
+      text: () => Promise.reject(new Error('NotReadableError')),
+    } as unknown as File
+
+    expect(await readYamlFile([unreadable])).toMatchObject({ ok: false, reason: 'unreadable' })
+  })
+
+  it('explains the cap in the message it hands the error banner', async () => {
+    const result = await readYamlFile([yamlFile('huge.yaml', 'x'.repeat(MAX_YAML_FILE_BYTES + 1))])
+
+    expect(result.ok).toBe(false)
+    if (!result.ok) expect(result.message).toContain('6 MiB')
+  })
+})
+
+// A drag exposes only `kind` and `type`; the file name is withheld until drop,
+// and YAML has no MIME type worth trusting. So the overlay promises "a file is
+// coming", never "an acceptable YAML file is coming".
+describe('describeFileDrag', () => {
+  it('ignores a drag with nothing attached', () => {
+    expect(describeFileDrag(null)).toBe('none')
+  })
+
+  it('leaves a text drag alone so the editor keeps its own drop behaviour', () => {
+    expect(describeFileDrag(drag([{ kind: 'string', type: 'text/plain' }]))).toBe('none')
+  })
+
+  it('reports a single file even when the browser withholds its type', () => {
+    expect(describeFileDrag(drag([{ kind: 'file', type: '' }]))).toBe('file')
+  })
+
+  it('counts only files when a drag carries companion text items', () => {
+    const dragged = drag([
+      { kind: 'file', type: '' },
+      { kind: 'string', type: 'text/uri-list' },
+    ])
+
+    expect(describeFileDrag(dragged)).toBe('file')
+  })
+
+  it('distinguishes a multi-file drag, which is the one rejection knowable up front', () => {
+    const dragged = drag([
+      { kind: 'file', type: '' },
+      { kind: 'file', type: '' },
+    ])
+
+    expect(describeFileDrag(dragged)).toBe('multiple-files')
+  })
+})
+
+// The create dialog opens prefilled — ResourcesView with a kind skeleton,
+// WorkloadView with a duplicate — so a non-empty editor is the normal state,
+// not a sign the user has work worth protecting.
+describe('needsReplaceConfirmation', () => {
+  const SKELETON = 'apiVersion: v1\nkind: ConfigMap\n'
+
+  it('loads straight over an untouched skeleton', () => {
+    expect(needsReplaceConfirmation(SKELETON, SKELETON)).toBe(false)
+  })
+
+  it('loads straight into an empty editor', () => {
+    expect(needsReplaceConfirmation('', '')).toBe(false)
+  })
+
+  it('asks before discarding edits the user actually made', () => {
+    expect(needsReplaceConfirmation(`${SKELETON}  name: checkout\n`, SKELETON)).toBe(true)
+  })
+
+  it('asks before discarding a manifest pasted into an editor that opened empty', () => {
+    expect(needsReplaceConfirmation(SKELETON, '')).toBe(true)
+  })
+
+  it('treats a whitespace-only difference as nothing worth protecting', () => {
+    expect(needsReplaceConfirmation(`${SKELETON}\n  \n`, SKELETON)).toBe(false)
+  })
+})
+
+describe('describeFileDrag across browsers', () => {
+  it('sees a file drag in Safari, where items stay empty until the drop', () => {
+    expect(describeFileDrag(safariDrag(['Files']))).toBe('file')
+  })
+
+  it('still ignores a Safari text drag, which advertises no Files type', () => {
+    expect(describeFileDrag(safariDrag(['text/plain']))).toBe('none')
+  })
+
+  it('counts files when the browser does expose them alongside the Files type', () => {
+    const dragged = drag(
+      [
+        { kind: 'file', type: '' },
+        { kind: 'file', type: '' },
+      ],
+      ['Files'],
+    )
+
+    expect(describeFileDrag(dragged)).toBe('multiple-files')
+  })
+})