@skyhook-io/k8s-ui 1.17.0 → 1.18.0

package/src/types/core.ts

@@ -126,6 +126,7 @@ export interface Capabilities {
   helmWrite: boolean      // Helm write operations (install, upgrade, rollback, uninstall, apply values)
   nodeWrite: boolean      // Node write operations (cordon, uncordon, drain)
   workloadWrites?: WorkloadWritePermissions // Workload patch permissions (restart/scale controls)
+  mcpReadOnly?: boolean  // Full MCP endpoint is disabled; read-only endpoints remain available
   mcpEnabled: boolean     // MCP server is running
   // Karpenter discovery and NodePool read state. Optional on the wire for the
   // same newer-frontend/older-backend reason as `deployment` below — consumers
@@ -160,16 +161,20 @@ export interface CloudConnectCapability {
 }
 
 export interface FeatureCapabilities {
+ helmSourceIdentity?: boolean
   yamlReview?: boolean
   yamlSchemas?: boolean
   workloadImages?: boolean
   resourceIssues?: boolean
+  resourceIssueCoverage?: boolean
   podEnvironment?: boolean
   policyResource?: boolean
   workloadHistory?: boolean
+  cnpgWorkspace?: boolean
+  cnpgProtectionSetup?: boolean
+  gitopsWriteEvidence?: boolean
   serviceEndpointSlices?: boolean
   trafficRecords?: boolean
-  gitopsWriteEvidence?: boolean
 }
 
 // DeploymentMode is the closed set of topologies Radar can run in.
@@ -201,6 +206,7 @@ export type CoreNodeKind =
   | 'HTTPRoute'
   | 'GRPCRoute'
   | 'TCPRoute'
+  | 'UDPRoute'
   | 'TLSRoute'
   | 'Service'
   | 'Deployment'
@@ -639,6 +645,8 @@ export interface ResourceRef {
 
 // Computed relationships for a resource
 export interface Relationships {
+  /** Istio registry domain supplied by the producer; omitted when unknown. */
+  istioServiceDomain?: string
   reflection?: {
     source?: ResourceRef
     sourceResourceVersion?: string
@@ -658,6 +666,13 @@ export interface Relationships {
   storageRefs?: ResourceRef[]
   dependencies?: ResourceRef[]
   dependents?: ResourceRef[]
+  monitors?: ResourceRef[]
+  monitorTargets?: ResourceRef[]
+  backends?: ResourceRef[]
+  routedFrom?: ResourceRef[]
+  protects?: ResourceRef[]
+  healthChecks?: ResourceRef[]
+  stagedPolicies?: ResourceRef[]
   scaleTarget?: ResourceRef
   pdbs?: ResourceRef[]              // PodDisruptionBudgets protecting this workload
   networkPolicies?: ResourceRef[]   // NetworkPolicy / CiliumNetworkPolicy / ClusterNetworkPolicy variants selecting this workload
@@ -728,6 +743,7 @@ export interface HPADiagnosis extends HPADiagnosisView {
     name?: string
   }
   bounds: HPABounds
+  /** Spec order keeps source references paired with values; unmatched status entries follow. */
   metrics?: HPAMetricSummary[]
 }
 
@@ -785,6 +801,8 @@ export interface APIResource {
   name: string // Plural name (e.g., "deployments")
   namespaced: boolean
   isCrd: boolean
+  /** Confirmed, readable cached CRD identity; never inferred from isCrd. */
+  definitionName?: string
   featured?: boolean
   verbs: string[]
   observation?: DynamicResourceObservation
@@ -1073,12 +1091,42 @@ export interface UpgradeInfo {
   error?: string
   // Machine-readable source-resolution failure, used to make the Helm drawer
   // explain whether tracking an OCI source can help.
-  sourceIssue?: 'untracked' | 'repo_index_error' | 'ambiguous_repository'
+  sourceIssue?: 'source_confirmation_required' | 'source_change_required' | 'release_changing' | 'untracked' | 'repo_index_error' | 'ambiguous_repository' | 'ambiguous_source' | 'source_unavailable'
   // True only when the error is a genuinely untracked source (registering a
   // chart source could fix it). Kept for compatibility; prefer sourceIssue.
   untracked?: boolean
 }
 
+export type ChartSourceCandidate =
+  | { type: 'repository'; reference: string; url: string }
+  | { type: 'oci'; reference: string; url?: never }
+
+export interface SourceUpgradeSelection {
+ source: ChartSourceCandidate
+ expectedRevision: number
+ expectedSource: ChartSourceCandidate | null
+ previewDigest?: string
+}
+
+export interface ChartSourceSuggestion {
+ source: ChartSourceCandidate
+ current: boolean
+ hasInstalledVersion: boolean
+ state: 'available' | 'index_unavailable' | 'unchecked'
+}
+
+export interface ChartSourceStatus {
+ changing?: boolean
+ revision?: number
+ confirmed?: boolean
+ sourceChangeRequired?: boolean
+ suggestions?: ChartSourceSuggestion[]
+  recorded?: ChartSourceCandidate
+  configured: boolean
+  available: boolean
+  candidates?: ChartSourceCandidate[]
+}
+
 // Batch upgrade info keyed by "storageNamespace/name".
 export interface BatchUpgradeInfo {
   releases: Record<string, UpgradeInfo>
@@ -1093,6 +1141,9 @@ export interface ApplyValuesRequest {
 
 // Response for previewing values changes
 export interface ValuesPreviewResponse {
+	baselineSource?: ChartSourceCandidate
+ previewDigest?: string
+ baselineRevision?: number
   currentValues: Record<string, unknown>
   newValues: Record<string, unknown>
   manifestDiff: string

package/src/types/gitops-flux-status.test.ts

@@ -29,13 +29,44 @@ describe('fluxConditionsToGitOpsStatus truth table', () => {
   })
 
   it('treats the -1 sentinel as drift', () => {
-    const got = fluxConditionsToGitOpsStatus([c('Ready', 'False'), c('Reconciling', 'True')], false, {
+    // A first reconcile reports Ready=Unknown; a reported failure outranks drift.
+    const got = fluxConditionsToGitOpsStatus([c('Ready', 'Unknown'), c('Reconciling', 'True')], false, {
       generation: 1,
       observedGeneration: -1,
     })
     expect(got.sync).toBe('Reconciling')
   })
 
+  it('a failure while retrying and never reconciled is degraded', () => {
+    // Live shape of a GitRepository whose repository doesn't exist.
+    const got = fluxConditionsToGitOpsStatus(
+      [c('Reconciling', 'True', { reason: 'ProgressingWithRetry' }), c('Ready', 'False', { reason: 'GitOperationFailed', observedGeneration: 1 })],
+      false,
+      { generation: 1, observedGeneration: -1 },
+    )
+    expect(got.sync).toBe('OutOfSync')
+    expect(got.health).toBe('Degraded')
+  })
+
+  it('a failure about an older generation does not outrank a new spec', () => {
+    const got = fluxConditionsToGitOpsStatus([c('Ready', 'False', { reason: 'BuildFailed', observedGeneration: 2 })], false, {
+      generation: 3,
+      observedGeneration: 1,
+    })
+    expect(got.sync).toBe('Reconciling')
+    expect(got.health).toBe('Progressing')
+  })
+
+  it('a retry while reconciling stays progressing', () => {
+    const got = fluxConditionsToGitOpsStatus(
+      [c('Reconciling', 'True', { reason: 'Progressing' }), c('Ready', 'False', { reason: 'ProgressingWithRetry' })],
+      false,
+      { generation: 2, observedGeneration: 1 },
+    )
+    expect(got.sync).toBe('Reconciling')
+    expect(got.health).toBe('Progressing')
+  })
+
   it('does not treat an absent observedGeneration as drift', () => {
     // Kinds and controller versions that never set it must not all read stale.
     expect(fluxConditionsToGitOpsStatus([c('Ready', 'True')], false, { generation: 3 }).sync).toBe('Synced')

package/src/types/gitops-insights.ts

@@ -93,6 +93,12 @@ export interface GitOpsInsightSummary {
   // The controller's API server was asked and didn't answer usefully — why,
   // in the user's words. Only set when the integration is configured.
   resourceHealthApiError?: string
+  // The host is still connecting to the controller's API server; ask again
+  // shortly.
+  resourceHealthApiPending?: boolean
+  // The host couldn't reach the controller's API server and is retrying;
+  // ask again now and then.
+  resourceHealthApiRetrying?: boolean
 }
 
 export interface GitOpsIgnoredDifferences {
@@ -164,6 +170,7 @@ export interface GitOpsChange {
   hookPhase?: string
   hasDesired: boolean
   hasLive: boolean
+  missing?: boolean
   // Structured per-field diff between the desired state (parsed from
   // kubectl.kubernetes.io/last-applied-configuration) and the live spec.
   // Undefined when the diff couldn't be computed (no annotation, SSA-applied
@@ -177,6 +184,8 @@ export interface GitOpsChange {
   recentEvents?: GitOpsEventSummary[]
   partial: boolean
   partialNote?: string
+  // A Flux source or dependsOn target the root consumes but doesn't manage.
+  dependency?: boolean
 }
 
 export interface GitOpsDrift {
@@ -247,6 +256,12 @@ export interface GitOpsCapabilities {
   // tell "not set up" (offer Connect) from "set up but disconnected" (offer
   // Reconnect) — instead of advertising a diff that would fail.
   argoConfigured?: boolean
+  // Configured, and the host is still making the first connection; ask
+  // again shortly instead of reporting the diff as down.
+  argoConnecting?: boolean
+  // Configured, the connection failed in a way that may pass on its own, and
+  // the host is retrying; ask again now and then.
+  argoRetrying?: boolean
   // True on an Argo CD Application detail when the integration is connected,
   // meaning the revision-metadata endpoint can resolve Git commit details
   // (author, message, signature) for this app's deployed revisions.
@@ -269,13 +284,16 @@ export interface ArgoRevisionMetadata {
 // Response of GET /api/argo/applications/{ns}/{name}/resource-diff. `desired`
 // is the Git-rendered manifest, `live` the normalized cluster state — both YAML
 // for the line-by-line view. `fieldEntries` is the same diff structured per
-// path for a compact summary. `redacted` is set when Secret values were masked
+// path for a compact summary; Radars before the list was made non-null send
+// null when it is empty. `fieldEntriesTruncated` is set when the list was cut
+// at the server's entry cap. `redacted` is set when Secret values were masked
 // server-side; `hook` marks Argo sync-hook resources.
 export interface GitOpsResourceDiff {
   source: string
   desired: string
   live: string
-  fieldEntries: GitOpsResourceDiffFieldEntry[]
+  fieldEntries: GitOpsResourceDiffFieldEntry[] | null
+  fieldEntriesTruncated?: boolean
   redacted: boolean
   hook: boolean
 }

package/src/types/gitops-tree.ts

@@ -24,6 +24,8 @@ export interface GitOpsTreeNode {
   tool: GitOpsTreeTool
   sync?: SyncStatus
   health?: GitOpsHealthStatus
+  // A local lookup confirmed NotFound; independent of controller health.
+  missing?: boolean
   // Who assessed `health`. 'controller' is the GitOps controller's own
   // verdict; 'radar' is Radar's read of the live object (topology status, or
   // the issues engine's finding when the controller's verdict isn't
@@ -43,6 +45,9 @@ export interface GitOpsTreeNode {
   // Lives on the destination cluster of a remote tree. This cluster's API
   // would answer for a different, same-named object.
   remote?: boolean
+  // Reached only through a Flux source, chart or dependsOn declaration: the
+  // root consumes it but does not manage it. Not counted as a managed resource.
+  dependency?: boolean
 }
 
 // 'controllerApi' is the controller's own verdict read from its API server
@@ -69,6 +74,7 @@ export interface GitOpsTreeSummary {
   grouped: number
   degraded: number
   outOfSync: number
+  dependencies?: number
 }
 
 export interface GitOpsResourceTree {
@@ -83,6 +89,12 @@ export interface GitOpsResourceTree {
   healthFromApi?: boolean
   // The controller's API server was asked and didn't answer usefully.
   healthApiError?: string
+  // The host is still connecting to the controller's API server; ask again
+  // shortly.
+  healthApiPending?: boolean
+  // The host couldn't reach the controller's API server and is retrying;
+  // ask again now and then.
+  healthApiRetrying?: boolean
   // The Application (or Flux object with spec.kubeConfig) deploys to another
   // cluster; Radar derives nothing about its resources from here.
   remoteDestination?: boolean

package/src/types/gitops.ts

@@ -99,6 +99,7 @@ export interface FluxCondition {
   reason?: string
   message?: string
   lastTransitionTime?: string
+  observedGeneration?: number
 }
 
 // ============================================================================
@@ -141,8 +142,11 @@ function hasGenerationDrift(gen?: FluxGeneration): boolean {
  * - suspend                                   → Suspended (sync from Ready, unless drifted)
  * - Stalled=True                              → OutOfSync / Degraded
  * - Ready=True and no generation drift        → Synced, health from Healthy
+ * - Ready=False with a failure reason about
+ *   the current generation                    → OutOfSync / Degraded
  * - drift, or Reconciling with Ready not True → Reconciling / Progressing
- * - Ready=False                               → OutOfSync
+ * - Ready=False                               → OutOfSync / Degraded, or
+ *   Progressing for a retry/wait reason
  */
 export function fluxConditionsToGitOpsStatus(
   conditions: FluxCondition[],
@@ -203,6 +207,25 @@ export function fluxConditionsToGitOpsStatus(
     }
   }
 
+  // A failure the controller reported outranks activity too: a source that
+  // can't clone keeps Reconciling=True and never records observedGeneration
+  // while it retries, and reading that as "in progress" hid it.
+  const readyReason = readyCondition?.reason || ''
+  const transientReason = readyReason.includes('Progress') || readyReason.includes('Retry') || readyReason.includes('Wait')
+  // Only a failure about the current spec counts: after a fix, the old
+  // Ready=False describes an older generation until the controller looks again.
+  const currentFailure = readyCondition?.observedGeneration !== undefined && readyCondition.observedGeneration === generation?.generation
+  if (readyCondition?.status === 'False' && !transientReason && currentFailure) {
+    return {
+      sync: 'OutOfSync',
+      health: 'Degraded',
+      message: readyCondition.message,
+      lastSyncTime: readyCondition.lastTransitionTime,
+      suspended: false,
+      ...activity,
+    }
+  }
+
   // Genuinely not applied: the controller has not observed the current spec, or
   // it is working and has not reached Ready.
   if (drifted || isReconciling) {
@@ -216,14 +239,11 @@ export function fluxConditionsToGitOpsStatus(
     }
   }
 
-  // Handle not ready state
+  // A retry or remediation in flight is out of sync, but not a settled failure.
   if (readyCondition?.status === 'False') {
-    const reason = readyCondition.reason || ''
-    const isTransient = reason.includes('Progress') || reason.includes('Retry') || reason.includes('Wait')
-
     return {
       sync: 'OutOfSync',
-      health: isTransient ? 'Progressing' : 'Degraded',
+      health: transientReason ? 'Progressing' : 'Degraded',
       message: readyCondition.message,
       lastSyncTime: readyCondition.lastTransitionTime,
       suspended: false,

package/src/utils/api-resources.ts

@@ -63,6 +63,13 @@ const ADDITIONAL_BUILTIN_IDENTITIES: Record<string, string> = {
   deviceclass: 'resource.k8s.io', deviceclasses: 'resource.k8s.io',
 };
 
+// Kind spellings only: a resource name such as `services` is not a Kind.
+const ADDITIONAL_CORE_KINDS: ReadonlySet<string> = new Set(['Endpoints'])
+
+export function isBuiltinCoreKind(kind: string): boolean {
+  return ADDITIONAL_CORE_KINDS.has(kind) || CORE_RESOURCES.some(r => r.group === '' && r.kind === kind)
+}
+
 export function builtinGroupForKind(kindOrResource: string): string | undefined {
   const value = kindOrResource.toLowerCase()
   return CORE_RESOURCES.find(resource =>

package/src/utils/application-history.ts

@@ -38,6 +38,7 @@ const RELATED_RUNTIME_KINDS = new Set([
   'HTTPRoute',
   'GRPCRoute',
   'TCPRoute',
+  'UDPRoute',
   'TLSRoute',
   'ConfigMap',
   'Secret',

package/src/utils/cnpg-backup.test.ts

@@ -0,0 +1,26 @@
+import { readFileSync } from 'node:fs'
+import { describe, expect, it } from 'vitest'
+import { cnpgBackupDeclaration, cnpgBackupDestinationBlocker, cnpgBarmanPlugin, cnpgDestinationPlugin, cnpgHasBackupDestination } from './cnpg-backup'
+
+const cases: Array<{
+  name: string
+  cluster: Parameters<typeof cnpgBackupDeclaration>[0]
+  method: string
+  plugin: string
+  hasDestination: boolean
+  destinationPlugin: string
+  blockerCode: string
+  barman: { objectStore: string; serverName: string } | null
+}> = JSON.parse(readFileSync(new URL('../../../../pkg/cnpg/testdata/backup-declarations.json', import.meta.url), 'utf8'))
+
+describe('CNPG backup declarations shared with Go', () => {
+  it.each(cases)('$name', (test) => {
+    const declaration = cnpgBackupDeclaration(test.cluster)
+    expect(cnpgHasBackupDestination(declaration)).toBe(test.hasDestination)
+    expect(cnpgDestinationPlugin(declaration)?.name ?? '').toBe(test.destinationPlugin)
+    expect(cnpgBackupDestinationBlocker(declaration, test.method || undefined, test.plugin)?.code ?? '').toBe(test.blockerCode)
+    const barman = cnpgBarmanPlugin(declaration)
+    if (test.barman) expect(barman).toMatchObject({ barmanObjectName: test.barman.objectStore || undefined, serverName: test.barman.serverName })
+    else expect(barman).toBeUndefined()
+  })
+})

package/src/utils/cnpg-backup.ts

@@ -0,0 +1,70 @@
+export const CNPG_BARMAN_PLUGIN_NAME = 'barman-cloud.cloudnative-pg.io'
+
+interface BackupCluster {
+  metadata?: { name?: string }
+  spec?: {
+    backup?: { barmanObjectStore?: { destinationPath?: string }; volumeSnapshot?: unknown }
+    plugins?: { name: string; enabled?: boolean; isWALArchiver?: boolean; parameters?: { barmanObjectName?: string; serverName?: string } }[]
+  }
+}
+
+export interface CNPGBackupPlugin {
+  name: string
+  enabled: boolean
+  isWALArchiver: boolean
+  barmanObjectName?: string
+  serverName?: string
+}
+
+export interface CNPGBackupDeclaration {
+  plugins: CNPGBackupPlugin[]
+  inTreeConfigured: boolean
+  inTreeDestination?: string
+  snapshotsConfigured: boolean
+}
+
+export function cnpgBackupDeclaration(cluster: BackupCluster): CNPGBackupDeclaration {
+  const backup = cluster.spec?.backup
+  return {
+    inTreeConfigured: !!backup?.barmanObjectStore,
+    inTreeDestination: backup?.barmanObjectStore?.destinationPath,
+    snapshotsConfigured: backup?.volumeSnapshot != null,
+    plugins: (cluster.spec?.plugins ?? []).filter((p) => p?.name).map((p) => ({
+      name: p.name,
+      enabled: p.enabled !== false,
+      isWALArchiver: p.isWALArchiver === true,
+      barmanObjectName: p.parameters?.barmanObjectName,
+      serverName: p.parameters?.serverName || cluster.metadata?.name,
+    })),
+  }
+}
+
+export function cnpgBarmanPlugin(declaration: CNPGBackupDeclaration): CNPGBackupPlugin | undefined {
+  return declaration.plugins.find((p) => p.enabled && p.name === CNPG_BARMAN_PLUGIN_NAME)
+}
+
+export function cnpgDestinationPlugin(declaration: CNPGBackupDeclaration): CNPGBackupPlugin | undefined {
+  return declaration.plugins.find((p) => p.enabled && (p.name !== CNPG_BARMAN_PLUGIN_NAME || !!p.barmanObjectName))
+}
+
+export function cnpgHasBackupDestination(declaration: CNPGBackupDeclaration): boolean {
+  return !!declaration.inTreeDestination || declaration.snapshotsConfigured || !!cnpgDestinationPlugin(declaration)
+}
+
+export interface CNPGBackupBlocker {
+  code: 'no_destination' | 'method_destination_missing'
+  method: string
+  plugin?: string
+}
+
+export function cnpgBackupDestinationBlocker(declaration: CNPGBackupDeclaration, method = 'barmanObjectStore', plugin?: string): CNPGBackupBlocker | null {
+  const blocked = method === 'barmanObjectStore' ? !declaration.inTreeDestination
+    : method === 'volumeSnapshot' ? !declaration.snapshotsConfigured
+    : method === 'plugin' ? !declaration.plugins.some((p) => p.name === plugin && p.enabled && (p.name !== CNPG_BARMAN_PLUGIN_NAME || !!p.barmanObjectName))
+    : false
+  return blocked ? { code: cnpgHasBackupDestination(declaration) ? 'method_destination_missing' : 'no_destination', method, plugin: cnpgDestinationPlugin(declaration)?.name } : null
+}
+
+export function cnpgBackupBlockerText(blocker: CNPGBackupBlocker): string {
+  return blocker.code === 'no_destination' ? 'No backup destination' : `No ${blocker.method} destination`
+}

package/src/utils/format.test.ts

@@ -41,6 +41,15 @@ describe('parseMemoryToBytes', () => {
     expect(parseMemoryToBytes('1P')).toBe(1000 ** 5)
     expect(parseMemoryToBytes('1E')).toBe(1000 ** 6)
   })
+
+  // The API server keeps a quoted exponent quantity as written, and defaults a
+  // request from it the same way ("1e9" limit → "500e6" request).
+  it('parses decimal-exponent quantities', () => {
+    expect(parseMemoryToBytes('1e9')).toBe(1e9)
+    expect(parseMemoryToBytes('500e6')).toBe(5e8)
+    expect(parseMemoryToBytes('1E3')).toBe(1000)
+    expect(formatMemoryString('1e9')).toBe('954 MiB')
+  })
 })
 
 describe('parseQuantityToNumber', () => {

package/src/utils/format.ts

@@ -120,6 +120,10 @@ export function parseMemoryToBytes(memString: string): number {
   if (!memString) return 0
 
   const str = memString.trim()
+  // Decimal-exponent form ("1e9") is decided before the suffix table, as in
+  // parseQuantityToNumber, so "1E3" reads as 1000 and not as exa.
+  if (/^[+-]?\d+(?:\.\d+)?[eE][+-]?\d+$/.test(str)) return Number(str)
+
   const match = str.match(/^(-?\d+(?:\.\d+)?)\s*([A-Za-z]*)$/)
   if (!match) return 0
 

package/src/utils/gitops-owner.ts

@@ -38,10 +38,11 @@ export function gitOpsOwnerFromRelationships(
 ): GitOpsOwnerRef | null {
   const refs = rel?.managedBy
   if (!refs || refs.length === 0) return null
-  return refToGitOpsOwner(refs[0])
+  return gitOpsOwnerFromRef(refs[0])
 }
 
-function refToGitOpsOwner(ref: ResourceRef): GitOpsOwnerRef | null {
+/** A manager ref (relationships.managedBy, a workspace's managedBy) as a GitOps owner, or null when the manager is not a GitOps controller. */
+export function gitOpsOwnerFromRef(ref: ResourceRef): GitOpsOwnerRef | null {
   switch (true) {
     case ref.kind === 'Application' && ref.group === ARGO_APPLICATION_GROUP:
       return { tool: 'argocd', kind: 'applications', namespace: ref.namespace, name: ref.name }

package/src/utils/grant.test.ts

@@ -0,0 +1,19 @@
+import { describe, expect, it } from 'vitest'
+import { formatGrant } from './grant'
+
+describe('formatGrant', () => {
+  it('words a namespaced grant like the server', () => {
+    expect(formatGrant({ verb: 'patch', group: 'postgresql.cnpg.io', resource: 'clusters', subresource: 'status', namespace: 'pg' })).toBe(
+      'patch clusters/status (postgresql.cnpg.io) in namespace pg',
+    )
+    expect(formatGrant({ verb: 'get', resource: 'pods', subresource: 'proxy', namespace: 'pg' })).toBe('get pods/proxy in namespace pg')
+  })
+  it('words a cluster-wide grant with the group as resource.group', () => {
+    expect(formatGrant({ verb: 'patch', resource: 'clusters', group: 'example.io', subresource: 'status' })).toBe('patch clusters.example.io/status cluster-wide')
+    expect(formatGrant({ verb: 'get', resource: 'nodes' })).toBe('get nodes cluster-wide')
+    expect(formatGrant({ verb: 'list', group: 'postgresql.cnpg.io', resource: 'clusters' })).toBe('list clusters.postgresql.cnpg.io cluster-wide')
+  })
+  it('is undefined without a grant', () => {
+    expect(formatGrant(undefined)).toBeUndefined()
+  })
+})

package/src/utils/grant.ts

@@ -0,0 +1,35 @@
+/**
+ * One RBAC permission a read or action needs, as the server sends it. An
+ * empty namespace means cluster-wide (a cluster-scoped resource, or a list
+ * across every namespace).
+ */
+export interface Grant {
+  verb: string
+  group?: string
+  resource: string
+  subresource?: string
+  namespace?: string
+}
+
+function grantResource(g: Grant): string {
+  return g.subresource ? `${g.resource}/${g.subresource}` : g.resource
+}
+
+/**
+ * The grant's two halves for display: what ("patch clusters/status
+ * (postgresql.cnpg.io)") and where (" in namespace pg", " cluster-wide").
+ */
+export function grantParts(g: Grant): { what: string; scope: string } {
+  if (g.namespace) {
+    return { what: `${g.verb} ${grantResource(g)}${g.group ? ` (${g.group})` : ''}`, scope: ` in namespace ${g.namespace}` }
+  }
+  return { what: `${g.verb} ${g.resource}${g.group ? `.${g.group}` : ''}${g.subresource ? `/${g.subresource}` : ''}`, scope: ' cluster-wide' }
+}
+
+export function formatGrant(g: Grant): string
+export function formatGrant(g: Grant | undefined): string | undefined
+export function formatGrant(g: Grant | undefined): string | undefined {
+  if (!g) return undefined
+  const { what, scope } = grantParts(g)
+  return what + scope
+}

package/src/utils/index.ts

@@ -32,4 +32,8 @@ export * from './bulk-workload-actions'
 export * from './inClusterConsent'
 export * from './workflow-execution'
 export * from './network-policy'
+export * from './cnpg-backup'
+export * from './url-path'
 export * from './resource-refs'
+
+export * from './grant'

package/src/utils/k8s-errors.ts

@@ -6,7 +6,7 @@ interface FriendlyError {
   suggestion: string
 }
 
-const patterns: Array<{ test: (msg: string) => boolean; friendly: (msg: string) => FriendlyError }> = [
+const patterns: Array<{ test: (msg: string) => boolean; friendly: (msg: string, allowApply: boolean) => FriendlyError }> = [
   // Admission webhook timeout
   {
     test: (msg) => /failed calling webhook.*context deadline exceeded/i.test(msg),
@@ -75,9 +75,9 @@ const patterns: Array<{ test: (msg: string) => boolean; friendly: (msg: string)
   // Already exists (create mode)
   {
     test: (msg) => /already exists/i.test(msg),
-    friendly: () => ({
+    friendly: (_msg, allowApply) => ({
       summary: 'Resource already exists',
-      suggestion: 'Switch to Apply mode to update the existing resource, or change the name to create a new one.',
+      suggestion: allowApply ? 'Switch to Apply mode to update the existing resource, or change the name to create a new one.' : 'Change the name to create a new resource, or remove this document if it was already created.',
     }),
   },
   // Quota exceeded
@@ -122,11 +122,11 @@ function stripPrefix(msg: string): string {
   return msg.replace(/^failed to (apply|create) resource:\s*/i, '')
 }
 
-export function getFriendlyError(rawError: string): { summary: string; suggestion: string; raw: string } | null {
+export function getFriendlyError(rawError: string, allowApply = true): { summary: string; suggestion: string; raw: string } | null {
   const cleaned = stripPrefix(rawError)
   for (const pattern of patterns) {
     if (pattern.test(cleaned)) {
-      const { summary, suggestion } = pattern.friendly(cleaned)
+      const { summary, suggestion } = pattern.friendly(cleaned, allowApply)
       return { summary, suggestion, raw: cleaned }
     }
   }
@@ -134,8 +134,8 @@ export function getFriendlyError(rawError: string): { summary: string; suggestio
 }
 
 // Always returns something displayable — friendly if matched, raw if not
-export function formatApplyError(rawError: string): { summary: string; suggestion?: string; raw: string } {
-  const friendly = getFriendlyError(rawError)
+export function formatApplyError(rawError: string, { allowApply = true }: { allowApply?: boolean } = {}): { summary: string; suggestion?: string; raw: string } {
+  const friendly = getFriendlyError(rawError, allowApply)
   if (friendly) return friendly
   const cleaned = stripPrefix(rawError)
   return { summary: cleaned, raw: rawError }

package/src/utils/log-format.test.ts

@@ -0,0 +1,41 @@
+import { describe, expect, it } from 'vitest'
+import { highlightJson, tokenizeJson, unescapeJsonStrings } from './log-format'
+
+describe('unescapeJsonStrings', () => {
+  it('expands whitespace inside strings while leaving escapes outside them untouched', () => {
+    expect(unescapeJsonStrings('{"msg":"first\\r\\nsecond\\nthird\\tend"}')).toBe('{"msg":"first\r\nsecond\nthird\tend"}')
+    expect(unescapeJsonStrings('outside\\n {"msg":"inside\\n"} outside\\t')).toBe('outside\\n {"msg":"inside\n"} outside\\t')
+  })
+
+  it('keeps escaped quotes and backslashes in their original string', () => {
+    expect(unescapeJsonStrings('{"msg":"say \\"hello\\"\\nnext","path":"C:\\\\docs"}')).toBe('{"msg":"say \\"hello\\"\nnext","path":"C:\\\\docs"}')
+    expect(unescapeJsonStrings(JSON.stringify({ empty: '', nested: ['a\nb', 'c\td'], number: 42, yes: true }))).toBe('{"empty":"","nested":["a\nb","c\td"],"number":42,"yes":true}')
+  })
+
+  it('stops once at an unterminated string with many escaped quotes', () => {
+    const text = '"' + '\\"'.repeat(100_000) + '\\n'
+    expect(unescapeJsonStrings(text)).toBe(text)
+  })
+})
+
+describe('JSON highlighting', () => {
+  it('keeps primitive-looking words inside strings and preserves JSON token colors', () => {
+    const tokens = tokenizeJson('{ "text" : "true null 123 \\"quoted\\"", "values": [-1.2e+3, true, false, null, ""] }')
+    expect(tokens.filter((token) => token.type === 'string').map((token) => token.value)).toEqual(['"true null 123 \\"quoted\\""', '""'])
+    expect(tokens.filter((token) => token.type === 'number').map((token) => token.value)).toEqual(['-1.2e+3'])
+    expect(highlightJson('{"a":true,"b":null,"n":12}')).toBe('{<span style="color:#7cacf8">"a"</span>:<span style="color:#c678dd">true</span>,<span style="color:#7cacf8">"b"</span>:<span style="color:#808080">null</span>,<span style="color:#7cacf8">"n"</span>:<span style="color:#e5c07b">12</span>}')
+  })
+
+  it('escapes HTML in log values before inserting highlighting markup', () => {
+    const html = highlightJson(JSON.stringify({ msg: '<script>alert("x")</script>&' }))
+    expect(html).toContain('&lt;script&gt;')
+    expect(html).toContain('&lt;/script&gt;&amp;')
+    expect(html).not.toContain('<script>')
+  })
+
+  it('leaves a long unterminated string as plain text without rescanning escaped quotes', () => {
+    const text = '"' + '\\"'.repeat(100_000)
+    expect(tokenizeJson(text)).toEqual([{ type: 'text', value: text }])
+    expect(highlightJson(text)).toBe(text)
+  })
+})