@skyhook-io/k8s-ui 1.17.0 → 1.17.1

package/src/types/gitops-insights.ts

@@ -93,6 +93,12 @@ export interface GitOpsInsightSummary {
   // The controller's API server was asked and didn't answer usefully — why,
   // in the user's words. Only set when the integration is configured.
   resourceHealthApiError?: string
+  // The host is still connecting to the controller's API server; ask again
+  // shortly.
+  resourceHealthApiPending?: boolean
+  // The host couldn't reach the controller's API server and is retrying;
+  // ask again now and then.
+  resourceHealthApiRetrying?: boolean
 }
 
 export interface GitOpsIgnoredDifferences {
@@ -177,6 +183,8 @@ export interface GitOpsChange {
   recentEvents?: GitOpsEventSummary[]
   partial: boolean
   partialNote?: string
+  // A Flux source or dependsOn target the root consumes but doesn't manage.
+  dependency?: boolean
 }
 
 export interface GitOpsDrift {
@@ -247,6 +255,12 @@ export interface GitOpsCapabilities {
   // tell "not set up" (offer Connect) from "set up but disconnected" (offer
   // Reconnect) — instead of advertising a diff that would fail.
   argoConfigured?: boolean
+  // Configured, and the host is still making the first connection; ask
+  // again shortly instead of reporting the diff as down.
+  argoConnecting?: boolean
+  // Configured, the connection failed in a way that may pass on its own, and
+  // the host is retrying; ask again now and then.
+  argoRetrying?: boolean
   // True on an Argo CD Application detail when the integration is connected,
   // meaning the revision-metadata endpoint can resolve Git commit details
   // (author, message, signature) for this app's deployed revisions.
@@ -269,13 +283,16 @@ export interface ArgoRevisionMetadata {
 // Response of GET /api/argo/applications/{ns}/{name}/resource-diff. `desired`
 // is the Git-rendered manifest, `live` the normalized cluster state — both YAML
 // for the line-by-line view. `fieldEntries` is the same diff structured per
-// path for a compact summary. `redacted` is set when Secret values were masked
+// path for a compact summary; Radars before the list was made non-null send
+// null when it is empty. `fieldEntriesTruncated` is set when the list was cut
+// at the server's entry cap. `redacted` is set when Secret values were masked
 // server-side; `hook` marks Argo sync-hook resources.
 export interface GitOpsResourceDiff {
   source: string
   desired: string
   live: string
-  fieldEntries: GitOpsResourceDiffFieldEntry[]
+  fieldEntries: GitOpsResourceDiffFieldEntry[] | null
+  fieldEntriesTruncated?: boolean
   redacted: boolean
   hook: boolean
 }

package/src/types/gitops-tree.ts

@@ -43,6 +43,9 @@ export interface GitOpsTreeNode {
   // Lives on the destination cluster of a remote tree. This cluster's API
   // would answer for a different, same-named object.
   remote?: boolean
+  // Reached only through a Flux source, chart or dependsOn declaration: the
+  // root consumes it but does not manage it. Not counted as a managed resource.
+  dependency?: boolean
 }
 
 // 'controllerApi' is the controller's own verdict read from its API server
@@ -69,6 +72,7 @@ export interface GitOpsTreeSummary {
   grouped: number
   degraded: number
   outOfSync: number
+  dependencies?: number
 }
 
 export interface GitOpsResourceTree {
@@ -83,6 +87,12 @@ export interface GitOpsResourceTree {
   healthFromApi?: boolean
   // The controller's API server was asked and didn't answer usefully.
   healthApiError?: string
+  // The host is still connecting to the controller's API server; ask again
+  // shortly.
+  healthApiPending?: boolean
+  // The host couldn't reach the controller's API server and is retrying;
+  // ask again now and then.
+  healthApiRetrying?: boolean
   // The Application (or Flux object with spec.kubeConfig) deploys to another
   // cluster; Radar derives nothing about its resources from here.
   remoteDestination?: boolean

package/src/types/gitops.ts

@@ -99,6 +99,7 @@ export interface FluxCondition {
   reason?: string
   message?: string
   lastTransitionTime?: string
+  observedGeneration?: number
 }
 
 // ============================================================================
@@ -141,8 +142,11 @@ function hasGenerationDrift(gen?: FluxGeneration): boolean {
  * - suspend                                   → Suspended (sync from Ready, unless drifted)
  * - Stalled=True                              → OutOfSync / Degraded
  * - Ready=True and no generation drift        → Synced, health from Healthy
+ * - Ready=False with a failure reason about
+ *   the current generation                    → OutOfSync / Degraded
  * - drift, or Reconciling with Ready not True → Reconciling / Progressing
- * - Ready=False                               → OutOfSync
+ * - Ready=False                               → OutOfSync / Degraded, or
+ *   Progressing for a retry/wait reason
  */
 export function fluxConditionsToGitOpsStatus(
   conditions: FluxCondition[],
@@ -203,6 +207,25 @@ export function fluxConditionsToGitOpsStatus(
     }
   }
 
+  // A failure the controller reported outranks activity too: a source that
+  // can't clone keeps Reconciling=True and never records observedGeneration
+  // while it retries, and reading that as "in progress" hid it.
+  const readyReason = readyCondition?.reason || ''
+  const transientReason = readyReason.includes('Progress') || readyReason.includes('Retry') || readyReason.includes('Wait')
+  // Only a failure about the current spec counts: after a fix, the old
+  // Ready=False describes an older generation until the controller looks again.
+  const currentFailure = readyCondition?.observedGeneration !== undefined && readyCondition.observedGeneration === generation?.generation
+  if (readyCondition?.status === 'False' && !transientReason && currentFailure) {
+    return {
+      sync: 'OutOfSync',
+      health: 'Degraded',
+      message: readyCondition.message,
+      lastSyncTime: readyCondition.lastTransitionTime,
+      suspended: false,
+      ...activity,
+    }
+  }
+
   // Genuinely not applied: the controller has not observed the current spec, or
   // it is working and has not reached Ready.
   if (drifted || isReconciling) {
@@ -216,14 +239,11 @@ export function fluxConditionsToGitOpsStatus(
     }
   }
 
-  // Handle not ready state
+  // A retry or remediation in flight is out of sync, but not a settled failure.
   if (readyCondition?.status === 'False') {
-    const reason = readyCondition.reason || ''
-    const isTransient = reason.includes('Progress') || reason.includes('Retry') || reason.includes('Wait')
-
     return {
       sync: 'OutOfSync',
-      health: isTransient ? 'Progressing' : 'Degraded',
+      health: transientReason ? 'Progressing' : 'Degraded',
       message: readyCondition.message,
       lastSyncTime: readyCondition.lastTransitionTime,
       suspended: false,

package/src/utils/api-resources.ts

@@ -63,6 +63,13 @@ const ADDITIONAL_BUILTIN_IDENTITIES: Record<string, string> = {
   deviceclass: 'resource.k8s.io', deviceclasses: 'resource.k8s.io',
 };
 
+// Kind spellings only: a resource name such as `services` is not a Kind.
+const ADDITIONAL_CORE_KINDS: ReadonlySet<string> = new Set(['Endpoints'])
+
+export function isBuiltinCoreKind(kind: string): boolean {
+  return ADDITIONAL_CORE_KINDS.has(kind) || CORE_RESOURCES.some(r => r.group === '' && r.kind === kind)
+}
+
 export function builtinGroupForKind(kindOrResource: string): string | undefined {
   const value = kindOrResource.toLowerCase()
   return CORE_RESOURCES.find(resource =>

package/src/utils/application-history.ts

@@ -38,6 +38,7 @@ const RELATED_RUNTIME_KINDS = new Set([
   'HTTPRoute',
   'GRPCRoute',
   'TCPRoute',
+  'UDPRoute',
   'TLSRoute',
   'ConfigMap',
   'Secret',

package/src/utils/cnpg-backup.test.ts

@@ -0,0 +1,26 @@
+import { readFileSync } from 'node:fs'
+import { describe, expect, it } from 'vitest'
+import { cnpgBackupDeclaration, cnpgBackupDestinationBlocker, cnpgBarmanPlugin, cnpgDestinationPlugin, cnpgHasBackupDestination } from './cnpg-backup'
+
+const cases: Array<{
+  name: string
+  cluster: Parameters<typeof cnpgBackupDeclaration>[0]
+  method: string
+  plugin: string
+  hasDestination: boolean
+  destinationPlugin: string
+  blockerCode: string
+  barman: { objectStore: string; serverName: string } | null
+}> = JSON.parse(readFileSync(new URL('../../../../pkg/cnpg/testdata/backup-declarations.json', import.meta.url), 'utf8'))
+
+describe('CNPG backup declarations shared with Go', () => {
+  it.each(cases)('$name', (test) => {
+    const declaration = cnpgBackupDeclaration(test.cluster)
+    expect(cnpgHasBackupDestination(declaration)).toBe(test.hasDestination)
+    expect(cnpgDestinationPlugin(declaration)?.name ?? '').toBe(test.destinationPlugin)
+    expect(cnpgBackupDestinationBlocker(declaration, test.method || undefined, test.plugin)?.code ?? '').toBe(test.blockerCode)
+    const barman = cnpgBarmanPlugin(declaration)
+    if (test.barman) expect(barman).toMatchObject({ barmanObjectName: test.barman.objectStore || undefined, serverName: test.barman.serverName })
+    else expect(barman).toBeUndefined()
+  })
+})

package/src/utils/cnpg-backup.ts

@@ -0,0 +1,70 @@
+export const CNPG_BARMAN_PLUGIN_NAME = 'barman-cloud.cloudnative-pg.io'
+
+interface BackupCluster {
+  metadata?: { name?: string }
+  spec?: {
+    backup?: { barmanObjectStore?: { destinationPath?: string }; volumeSnapshot?: unknown }
+    plugins?: { name: string; enabled?: boolean; isWALArchiver?: boolean; parameters?: { barmanObjectName?: string; serverName?: string } }[]
+  }
+}
+
+export interface CNPGBackupPlugin {
+  name: string
+  enabled: boolean
+  isWALArchiver: boolean
+  barmanObjectName?: string
+  serverName?: string
+}
+
+export interface CNPGBackupDeclaration {
+  plugins: CNPGBackupPlugin[]
+  inTreeConfigured: boolean
+  inTreeDestination?: string
+  snapshotsConfigured: boolean
+}
+
+export function cnpgBackupDeclaration(cluster: BackupCluster): CNPGBackupDeclaration {
+  const backup = cluster.spec?.backup
+  return {
+    inTreeConfigured: !!backup?.barmanObjectStore,
+    inTreeDestination: backup?.barmanObjectStore?.destinationPath,
+    snapshotsConfigured: backup?.volumeSnapshot != null,
+    plugins: (cluster.spec?.plugins ?? []).filter((p) => p?.name).map((p) => ({
+      name: p.name,
+      enabled: p.enabled !== false,
+      isWALArchiver: p.isWALArchiver === true,
+      barmanObjectName: p.parameters?.barmanObjectName,
+      serverName: p.parameters?.serverName || cluster.metadata?.name,
+    })),
+  }
+}
+
+export function cnpgBarmanPlugin(declaration: CNPGBackupDeclaration): CNPGBackupPlugin | undefined {
+  return declaration.plugins.find((p) => p.enabled && p.name === CNPG_BARMAN_PLUGIN_NAME)
+}
+
+export function cnpgDestinationPlugin(declaration: CNPGBackupDeclaration): CNPGBackupPlugin | undefined {
+  return declaration.plugins.find((p) => p.enabled && (p.name !== CNPG_BARMAN_PLUGIN_NAME || !!p.barmanObjectName))
+}
+
+export function cnpgHasBackupDestination(declaration: CNPGBackupDeclaration): boolean {
+  return !!declaration.inTreeDestination || declaration.snapshotsConfigured || !!cnpgDestinationPlugin(declaration)
+}
+
+export interface CNPGBackupBlocker {
+  code: 'no_destination' | 'method_destination_missing'
+  method: string
+  plugin?: string
+}
+
+export function cnpgBackupDestinationBlocker(declaration: CNPGBackupDeclaration, method = 'barmanObjectStore', plugin?: string): CNPGBackupBlocker | null {
+  const blocked = method === 'barmanObjectStore' ? !declaration.inTreeDestination
+    : method === 'volumeSnapshot' ? !declaration.snapshotsConfigured
+    : method === 'plugin' ? !declaration.plugins.some((p) => p.name === plugin && p.enabled && (p.name !== CNPG_BARMAN_PLUGIN_NAME || !!p.barmanObjectName))
+    : false
+  return blocked ? { code: cnpgHasBackupDestination(declaration) ? 'method_destination_missing' : 'no_destination', method, plugin: cnpgDestinationPlugin(declaration)?.name } : null
+}
+
+export function cnpgBackupBlockerText(blocker: CNPGBackupBlocker): string {
+  return blocker.code === 'no_destination' ? 'No backup destination' : `No ${blocker.method} destination`
+}

package/src/utils/format.test.ts

@@ -41,6 +41,15 @@ describe('parseMemoryToBytes', () => {
     expect(parseMemoryToBytes('1P')).toBe(1000 ** 5)
     expect(parseMemoryToBytes('1E')).toBe(1000 ** 6)
   })
+
+  // The API server keeps a quoted exponent quantity as written, and defaults a
+  // request from it the same way ("1e9" limit → "500e6" request).
+  it('parses decimal-exponent quantities', () => {
+    expect(parseMemoryToBytes('1e9')).toBe(1e9)
+    expect(parseMemoryToBytes('500e6')).toBe(5e8)
+    expect(parseMemoryToBytes('1E3')).toBe(1000)
+    expect(formatMemoryString('1e9')).toBe('954 MiB')
+  })
 })
 
 describe('parseQuantityToNumber', () => {

package/src/utils/format.ts

@@ -120,6 +120,10 @@ export function parseMemoryToBytes(memString: string): number {
   if (!memString) return 0
 
   const str = memString.trim()
+  // Decimal-exponent form ("1e9") is decided before the suffix table, as in
+  // parseQuantityToNumber, so "1E3" reads as 1000 and not as exa.
+  if (/^[+-]?\d+(?:\.\d+)?[eE][+-]?\d+$/.test(str)) return Number(str)
+
   const match = str.match(/^(-?\d+(?:\.\d+)?)\s*([A-Za-z]*)$/)
   if (!match) return 0
 

package/src/utils/gitops-owner.ts

@@ -38,10 +38,11 @@ export function gitOpsOwnerFromRelationships(
 ): GitOpsOwnerRef | null {
   const refs = rel?.managedBy
   if (!refs || refs.length === 0) return null
-  return refToGitOpsOwner(refs[0])
+  return gitOpsOwnerFromRef(refs[0])
 }
 
-function refToGitOpsOwner(ref: ResourceRef): GitOpsOwnerRef | null {
+/** A manager ref (relationships.managedBy, a workspace's managedBy) as a GitOps owner, or null when the manager is not a GitOps controller. */
+export function gitOpsOwnerFromRef(ref: ResourceRef): GitOpsOwnerRef | null {
   switch (true) {
     case ref.kind === 'Application' && ref.group === ARGO_APPLICATION_GROUP:
       return { tool: 'argocd', kind: 'applications', namespace: ref.namespace, name: ref.name }

package/src/utils/grant.test.ts

@@ -0,0 +1,19 @@
+import { describe, expect, it } from 'vitest'
+import { formatGrant } from './grant'
+
+describe('formatGrant', () => {
+  it('words a namespaced grant like the server', () => {
+    expect(formatGrant({ verb: 'patch', group: 'postgresql.cnpg.io', resource: 'clusters', subresource: 'status', namespace: 'pg' })).toBe(
+      'patch clusters/status (postgresql.cnpg.io) in namespace pg',
+    )
+    expect(formatGrant({ verb: 'get', resource: 'pods', subresource: 'proxy', namespace: 'pg' })).toBe('get pods/proxy in namespace pg')
+  })
+  it('words a cluster-wide grant with the group as resource.group', () => {
+    expect(formatGrant({ verb: 'patch', resource: 'clusters', group: 'example.io', subresource: 'status' })).toBe('patch clusters.example.io/status cluster-wide')
+    expect(formatGrant({ verb: 'get', resource: 'nodes' })).toBe('get nodes cluster-wide')
+    expect(formatGrant({ verb: 'list', group: 'postgresql.cnpg.io', resource: 'clusters' })).toBe('list clusters.postgresql.cnpg.io cluster-wide')
+  })
+  it('is undefined without a grant', () => {
+    expect(formatGrant(undefined)).toBeUndefined()
+  })
+})

package/src/utils/grant.ts

@@ -0,0 +1,35 @@
+/**
+ * One RBAC permission a read or action needs, as the server sends it. An
+ * empty namespace means cluster-wide (a cluster-scoped resource, or a list
+ * across every namespace).
+ */
+export interface Grant {
+  verb: string
+  group?: string
+  resource: string
+  subresource?: string
+  namespace?: string
+}
+
+function grantResource(g: Grant): string {
+  return g.subresource ? `${g.resource}/${g.subresource}` : g.resource
+}
+
+/**
+ * The grant's two halves for display: what ("patch clusters/status
+ * (postgresql.cnpg.io)") and where (" in namespace pg", " cluster-wide").
+ */
+export function grantParts(g: Grant): { what: string; scope: string } {
+  if (g.namespace) {
+    return { what: `${g.verb} ${grantResource(g)}${g.group ? ` (${g.group})` : ''}`, scope: ` in namespace ${g.namespace}` }
+  }
+  return { what: `${g.verb} ${g.resource}${g.group ? `.${g.group}` : ''}${g.subresource ? `/${g.subresource}` : ''}`, scope: ' cluster-wide' }
+}
+
+export function formatGrant(g: Grant): string
+export function formatGrant(g: Grant | undefined): string | undefined
+export function formatGrant(g: Grant | undefined): string | undefined {
+  if (!g) return undefined
+  const { what, scope } = grantParts(g)
+  return what + scope
+}

package/src/utils/index.ts

@@ -32,4 +32,8 @@ export * from './bulk-workload-actions'
 export * from './inClusterConsent'
 export * from './workflow-execution'
 export * from './network-policy'
+export * from './cnpg-backup'
+export * from './url-path'
 export * from './resource-refs'
+
+export * from './grant'

package/src/utils/k8s-errors.ts

@@ -6,7 +6,7 @@ interface FriendlyError {
   suggestion: string
 }
 
-const patterns: Array<{ test: (msg: string) => boolean; friendly: (msg: string) => FriendlyError }> = [
+const patterns: Array<{ test: (msg: string) => boolean; friendly: (msg: string, allowApply: boolean) => FriendlyError }> = [
   // Admission webhook timeout
   {
     test: (msg) => /failed calling webhook.*context deadline exceeded/i.test(msg),
@@ -75,9 +75,9 @@ const patterns: Array<{ test: (msg: string) => boolean; friendly: (msg: string)
   // Already exists (create mode)
   {
     test: (msg) => /already exists/i.test(msg),
-    friendly: () => ({
+    friendly: (_msg, allowApply) => ({
       summary: 'Resource already exists',
-      suggestion: 'Switch to Apply mode to update the existing resource, or change the name to create a new one.',
+      suggestion: allowApply ? 'Switch to Apply mode to update the existing resource, or change the name to create a new one.' : 'Change the name to create a new resource, or remove this document if it was already created.',
     }),
   },
   // Quota exceeded
@@ -122,11 +122,11 @@ function stripPrefix(msg: string): string {
   return msg.replace(/^failed to (apply|create) resource:\s*/i, '')
 }
 
-export function getFriendlyError(rawError: string): { summary: string; suggestion: string; raw: string } | null {
+export function getFriendlyError(rawError: string, allowApply = true): { summary: string; suggestion: string; raw: string } | null {
   const cleaned = stripPrefix(rawError)
   for (const pattern of patterns) {
     if (pattern.test(cleaned)) {
-      const { summary, suggestion } = pattern.friendly(cleaned)
+      const { summary, suggestion } = pattern.friendly(cleaned, allowApply)
       return { summary, suggestion, raw: cleaned }
     }
   }
@@ -134,8 +134,8 @@ export function getFriendlyError(rawError: string): { summary: string; suggestio
 }
 
 // Always returns something displayable — friendly if matched, raw if not
-export function formatApplyError(rawError: string): { summary: string; suggestion?: string; raw: string } {
-  const friendly = getFriendlyError(rawError)
+export function formatApplyError(rawError: string, { allowApply = true }: { allowApply?: boolean } = {}): { summary: string; suggestion?: string; raw: string } {
+  const friendly = getFriendlyError(rawError, allowApply)
   if (friendly) return friendly
   const cleaned = stripPrefix(rawError)
   return { summary: cleaned, raw: rawError }

package/src/utils/log-format.test.ts

@@ -0,0 +1,41 @@
+import { describe, expect, it } from 'vitest'
+import { highlightJson, tokenizeJson, unescapeJsonStrings } from './log-format'
+
+describe('unescapeJsonStrings', () => {
+  it('expands whitespace inside strings while leaving escapes outside them untouched', () => {
+    expect(unescapeJsonStrings('{"msg":"first\\r\\nsecond\\nthird\\tend"}')).toBe('{"msg":"first\r\nsecond\nthird\tend"}')
+    expect(unescapeJsonStrings('outside\\n {"msg":"inside\\n"} outside\\t')).toBe('outside\\n {"msg":"inside\n"} outside\\t')
+  })
+
+  it('keeps escaped quotes and backslashes in their original string', () => {
+    expect(unescapeJsonStrings('{"msg":"say \\"hello\\"\\nnext","path":"C:\\\\docs"}')).toBe('{"msg":"say \\"hello\\"\nnext","path":"C:\\\\docs"}')
+    expect(unescapeJsonStrings(JSON.stringify({ empty: '', nested: ['a\nb', 'c\td'], number: 42, yes: true }))).toBe('{"empty":"","nested":["a\nb","c\td"],"number":42,"yes":true}')
+  })
+
+  it('stops once at an unterminated string with many escaped quotes', () => {
+    const text = '"' + '\\"'.repeat(100_000) + '\\n'
+    expect(unescapeJsonStrings(text)).toBe(text)
+  })
+})
+
+describe('JSON highlighting', () => {
+  it('keeps primitive-looking words inside strings and preserves JSON token colors', () => {
+    const tokens = tokenizeJson('{ "text" : "true null 123 \\"quoted\\"", "values": [-1.2e+3, true, false, null, ""] }')
+    expect(tokens.filter((token) => token.type === 'string').map((token) => token.value)).toEqual(['"true null 123 \\"quoted\\""', '""'])
+    expect(tokens.filter((token) => token.type === 'number').map((token) => token.value)).toEqual(['-1.2e+3'])
+    expect(highlightJson('{"a":true,"b":null,"n":12}')).toBe('{<span style="color:#7cacf8">"a"</span>:<span style="color:#c678dd">true</span>,<span style="color:#7cacf8">"b"</span>:<span style="color:#808080">null</span>,<span style="color:#7cacf8">"n"</span>:<span style="color:#e5c07b">12</span>}')
+  })
+
+  it('escapes HTML in log values before inserting highlighting markup', () => {
+    const html = highlightJson(JSON.stringify({ msg: '<script>alert("x")</script>&' }))
+    expect(html).toContain('&lt;script&gt;')
+    expect(html).toContain('&lt;/script&gt;&amp;')
+    expect(html).not.toContain('<script>')
+  })
+
+  it('leaves a long unterminated string as plain text without rescanning escaped quotes', () => {
+    const text = '"' + '\\"'.repeat(100_000)
+    expect(tokenizeJson(text)).toEqual([{ type: 'text', value: text }])
+    expect(highlightJson(text)).toBe(text)
+  })
+})

package/src/utils/log-format.ts

@@ -363,24 +363,71 @@ export const SYNTAX_COLOR_NUMBER = '#e5c07b'
 export const SYNTAX_COLOR_BOOLEAN = '#c678dd'
 export const SYNTAX_COLOR_NULL = '#808080'
 
+export interface JsonToken {
+  type: 'text' | 'key' | 'string' | 'number' | 'boolean' | 'null'
+  value: string
+}
+
+function jsonStringEnd(text: string, start: number): number {
+  let offset = start + 1
+  while (offset < text.length) {
+    const char = text[offset++]
+    if (char === '\\') offset++
+    else if (char === '"') return offset
+  }
+  return -1
+}
+
+export function tokenizeJson(text: string): JsonToken[] {
+  const tokens: JsonToken[] = []
+  const primitiveRe = /(-?\b\d+(?:\.\d+)?(?:[eE][+-]?\d+)?\b)|\b(true|false)\b|\b(null)\b/y
+  let copied = 0
+  let offset = 0
+  while (offset < text.length) {
+    const start = offset
+    let type: JsonToken['type']
+    let value: string
+    if (text[offset] === '"') {
+      const end = jsonStringEnd(text, offset)
+      if (end < 0) break
+      value = text.slice(start, end)
+      let colon = end
+      while (colon < text.length && /\s/.test(text[colon])) colon++
+      type = text[colon] === ':' ? 'key' : 'string'
+      offset = type === 'key' ? colon + 1 : end
+    } else {
+      primitiveRe.lastIndex = offset
+      const match = primitiveRe.exec(text)
+      if (!match) {
+        offset++
+        continue
+      }
+      type = match[1] !== undefined ? 'number' : match[2] !== undefined ? 'boolean' : 'null'
+      value = match[0]
+      offset = primitiveRe.lastIndex
+    }
+    if (start > copied) tokens.push({ type: 'text', value: text.slice(copied, start) })
+    tokens.push({ type, value })
+    copied = offset
+  }
+  if (copied < text.length) tokens.push({ type: 'text', value: text.slice(copied) })
+  return tokens
+}
+
 /**
  * Syntax-highlight a pretty-printed JSON string for HTML display.
  * Wraps keys, string values, numbers, booleans, and null in colored spans.
  * Applies HTML escaping internally — do not pre-escape the input.
  */
 export function highlightJson(json: string): string {
-  const escaped = escapeHtml(json)
-  // Single-pass tokenizer: matches all JSON tokens at once so content inside strings
-  // is consumed and can't be re-matched by number/boolean/null patterns.
-  const tokenRe = /("(?:\\.|[^"\\])*")\s*:|("(?:\\.|[^"\\])*")|(-?\b\d+(?:\.\d+)?(?:[eE][+-]?\d+)?\b)|\b(true|false)\b|\b(null)\b/g
-  return escaped.replace(tokenRe, (match, key, str, num, bool, nil) => {
-    if (key) return `<span style="color:${SYNTAX_COLOR_KEY}">${key}</span>:`
-    if (str) return `<span style="color:${SYNTAX_COLOR_STRING}">${str}</span>`
-    if (num) return `<span style="color:${SYNTAX_COLOR_NUMBER}">${num}</span>`
-    if (bool) return `<span style="color:${SYNTAX_COLOR_BOOLEAN}">${bool}</span>`
-    if (nil) return `<span style="color:${SYNTAX_COLOR_NULL}">${nil}</span>`
-    return match
-  })
+  return tokenizeJson(escapeHtml(json)).map(({ type, value }) => {
+    if (type === 'key') return `<span style="color:${SYNTAX_COLOR_KEY}">${value}</span>:`
+    if (type === 'string') return `<span style="color:${SYNTAX_COLOR_STRING}">${value}</span>`
+    if (type === 'number') return `<span style="color:${SYNTAX_COLOR_NUMBER}">${value}</span>`
+    if (type === 'boolean') return `<span style="color:${SYNTAX_COLOR_BOOLEAN}">${value}</span>`
+    if (type === 'null') return `<span style="color:${SYNTAX_COLOR_NULL}">${value}</span>`
+    return value
+  }).join('')
 }
 
 /**
@@ -389,12 +436,21 @@ export function highlightJson(json: string): string {
  * making stack traces and multi-line messages readable in the expanded view.
  */
 export function unescapeJsonStrings(text: string): string {
-  return text.replace(/"(?:[^"\\]|\\.)*"/g, (match) => {
-    return match
+  let result = ''
+  let copied = 0
+  let offset = 0
+  while (offset < text.length) {
+    if (text[offset++] !== '"') continue
+    const start = offset - 1
+    offset = jsonStringEnd(text, start)
+    if (offset < 0) break
+    result += text.slice(copied, start) + text.slice(start, offset)
       .replace(/\\r\\n/g, '\r\n')
       .replace(/\\n/g, '\n')
       .replace(/\\t/g, '\t')
-  })
+    copied = offset
+  }
+  return result + text.slice(copied)
 }
 
 // logfmt detection and parsing

package/src/utils/log-level.ts

@@ -49,14 +49,22 @@ export function normalizeLevel(raw: unknown): LogLevel | null {
   return 'unknown'
 }
 
-// PostgreSQL's error_severity values (every DEBUGn is written as DEBUG);
-// anything else under `record` isn't PostgreSQL's.
+// PostgreSQL writes every DEBUGn severity as DEBUG.
 const POSTGRES_SEVERITIES: Record<string, LogLevel> = {
   DEBUG: 'debug', LOG: 'info', INFO: 'info', NOTICE: 'info', WARNING: 'warn', ERROR: 'error', FATAL: 'error', PANIC: 'error',
 }
 
 const LEVEL_FIELD_KEYS = ['level', 'lvl', 'severity', 'levelname', 'log.level'] as const
 
+export function selectPostgresRecord(obj: Record<string, unknown>): { record: Record<string, unknown>; raw: string; level: LogLevel } | null {
+  const record = obj.record
+  if (obj.logger !== 'postgres' || obj.msg !== 'record' || !record || typeof record !== 'object' || Array.isArray(record)) return null
+  const fields = record as Record<string, unknown>
+  const raw = fields.error_severity
+  const level = typeof raw === 'string' ? POSTGRES_SEVERITIES[raw.trim().toUpperCase()] : undefined
+  return typeof raw === 'string' && level ? { record: fields, raw, level } : null
+}
+
 /**
  * Pick the level field of a structured record. Shared by detection and the
  * structured-line badge so the badge text and the line's resolved level always
@@ -65,12 +73,8 @@ const LEVEL_FIELD_KEYS = ['level', 'lvl', 'severity', 'levelname', 'log.level']
 export function selectLevelField(obj: Record<string, unknown>): { raw: unknown; level: LogLevel } | null {
   // CloudNativePG wraps each PostgreSQL line in an instance-manager record
   // whose own level is usually info; the database's severity is nested.
-  const pgRecord = obj.record
-  if (pgRecord && typeof pgRecord === 'object' && !Array.isArray(pgRecord)) {
-    const raw = (pgRecord as Record<string, unknown>).error_severity
-    const level = typeof raw === 'string' ? POSTGRES_SEVERITIES[raw.trim().toUpperCase()] : undefined
-    if (level) return { raw, level }
-  }
+  const pgRecord = selectPostgresRecord(obj)
+  if (pgRecord) return { raw: pgRecord.raw, level: pgRecord.level }
   for (const key of LEVEL_FIELD_KEYS) {
     const level = normalizeLevel(obj[key])
     if (level) return { raw: obj[key], level }