@skyhook-io/k8s-ui 1.17.0 → 1.18.0

package/src/utils/log-format.ts

@@ -363,24 +363,71 @@ export const SYNTAX_COLOR_NUMBER = '#e5c07b'
 export const SYNTAX_COLOR_BOOLEAN = '#c678dd'
 export const SYNTAX_COLOR_NULL = '#808080'
 
+export interface JsonToken {
+  type: 'text' | 'key' | 'string' | 'number' | 'boolean' | 'null'
+  value: string
+}
+
+function jsonStringEnd(text: string, start: number): number {
+  let offset = start + 1
+  while (offset < text.length) {
+    const char = text[offset++]
+    if (char === '\\') offset++
+    else if (char === '"') return offset
+  }
+  return -1
+}
+
+export function tokenizeJson(text: string): JsonToken[] {
+  const tokens: JsonToken[] = []
+  const primitiveRe = /(-?\b\d+(?:\.\d+)?(?:[eE][+-]?\d+)?\b)|\b(true|false)\b|\b(null)\b/y
+  let copied = 0
+  let offset = 0
+  while (offset < text.length) {
+    const start = offset
+    let type: JsonToken['type']
+    let value: string
+    if (text[offset] === '"') {
+      const end = jsonStringEnd(text, offset)
+      if (end < 0) break
+      value = text.slice(start, end)
+      let colon = end
+      while (colon < text.length && /\s/.test(text[colon])) colon++
+      type = text[colon] === ':' ? 'key' : 'string'
+      offset = type === 'key' ? colon + 1 : end
+    } else {
+      primitiveRe.lastIndex = offset
+      const match = primitiveRe.exec(text)
+      if (!match) {
+        offset++
+        continue
+      }
+      type = match[1] !== undefined ? 'number' : match[2] !== undefined ? 'boolean' : 'null'
+      value = match[0]
+      offset = primitiveRe.lastIndex
+    }
+    if (start > copied) tokens.push({ type: 'text', value: text.slice(copied, start) })
+    tokens.push({ type, value })
+    copied = offset
+  }
+  if (copied < text.length) tokens.push({ type: 'text', value: text.slice(copied) })
+  return tokens
+}
+
 /**
  * Syntax-highlight a pretty-printed JSON string for HTML display.
  * Wraps keys, string values, numbers, booleans, and null in colored spans.
  * Applies HTML escaping internally — do not pre-escape the input.
  */
 export function highlightJson(json: string): string {
-  const escaped = escapeHtml(json)
-  // Single-pass tokenizer: matches all JSON tokens at once so content inside strings
-  // is consumed and can't be re-matched by number/boolean/null patterns.
-  const tokenRe = /("(?:\\.|[^"\\])*")\s*:|("(?:\\.|[^"\\])*")|(-?\b\d+(?:\.\d+)?(?:[eE][+-]?\d+)?\b)|\b(true|false)\b|\b(null)\b/g
-  return escaped.replace(tokenRe, (match, key, str, num, bool, nil) => {
-    if (key) return `<span style="color:${SYNTAX_COLOR_KEY}">${key}</span>:`
-    if (str) return `<span style="color:${SYNTAX_COLOR_STRING}">${str}</span>`
-    if (num) return `<span style="color:${SYNTAX_COLOR_NUMBER}">${num}</span>`
-    if (bool) return `<span style="color:${SYNTAX_COLOR_BOOLEAN}">${bool}</span>`
-    if (nil) return `<span style="color:${SYNTAX_COLOR_NULL}">${nil}</span>`
-    return match
-  })
+  return tokenizeJson(escapeHtml(json)).map(({ type, value }) => {
+    if (type === 'key') return `<span style="color:${SYNTAX_COLOR_KEY}">${value}</span>:`
+    if (type === 'string') return `<span style="color:${SYNTAX_COLOR_STRING}">${value}</span>`
+    if (type === 'number') return `<span style="color:${SYNTAX_COLOR_NUMBER}">${value}</span>`
+    if (type === 'boolean') return `<span style="color:${SYNTAX_COLOR_BOOLEAN}">${value}</span>`
+    if (type === 'null') return `<span style="color:${SYNTAX_COLOR_NULL}">${value}</span>`
+    return value
+  }).join('')
 }
 
 /**
@@ -389,12 +436,21 @@ export function highlightJson(json: string): string {
  * making stack traces and multi-line messages readable in the expanded view.
  */
 export function unescapeJsonStrings(text: string): string {
-  return text.replace(/"(?:[^"\\]|\\.)*"/g, (match) => {
-    return match
+  let result = ''
+  let copied = 0
+  let offset = 0
+  while (offset < text.length) {
+    if (text[offset++] !== '"') continue
+    const start = offset - 1
+    offset = jsonStringEnd(text, start)
+    if (offset < 0) break
+    result += text.slice(copied, start) + text.slice(start, offset)
       .replace(/\\r\\n/g, '\r\n')
       .replace(/\\n/g, '\n')
       .replace(/\\t/g, '\t')
-  })
+    copied = offset
+  }
+  return result + text.slice(copied)
 }
 
 // logfmt detection and parsing

package/src/utils/log-level.ts

@@ -49,14 +49,22 @@ export function normalizeLevel(raw: unknown): LogLevel | null {
   return 'unknown'
 }
 
-// PostgreSQL's error_severity values (every DEBUGn is written as DEBUG);
-// anything else under `record` isn't PostgreSQL's.
+// PostgreSQL writes every DEBUGn severity as DEBUG.
 const POSTGRES_SEVERITIES: Record<string, LogLevel> = {
   DEBUG: 'debug', LOG: 'info', INFO: 'info', NOTICE: 'info', WARNING: 'warn', ERROR: 'error', FATAL: 'error', PANIC: 'error',
 }
 
 const LEVEL_FIELD_KEYS = ['level', 'lvl', 'severity', 'levelname', 'log.level'] as const
 
+export function selectPostgresRecord(obj: Record<string, unknown>): { record: Record<string, unknown>; raw: string; level: LogLevel } | null {
+  const record = obj.record
+  if (obj.logger !== 'postgres' || obj.msg !== 'record' || !record || typeof record !== 'object' || Array.isArray(record)) return null
+  const fields = record as Record<string, unknown>
+  const raw = fields.error_severity
+  const level = typeof raw === 'string' ? POSTGRES_SEVERITIES[raw.trim().toUpperCase()] : undefined
+  return typeof raw === 'string' && level ? { record: fields, raw, level } : null
+}
+
 /**
  * Pick the level field of a structured record. Shared by detection and the
  * structured-line badge so the badge text and the line's resolved level always
@@ -65,12 +73,8 @@ const LEVEL_FIELD_KEYS = ['level', 'lvl', 'severity', 'levelname', 'log.level']
 export function selectLevelField(obj: Record<string, unknown>): { raw: unknown; level: LogLevel } | null {
   // CloudNativePG wraps each PostgreSQL line in an instance-manager record
   // whose own level is usually info; the database's severity is nested.
-  const pgRecord = obj.record
-  if (pgRecord && typeof pgRecord === 'object' && !Array.isArray(pgRecord)) {
-    const raw = (pgRecord as Record<string, unknown>).error_severity
-    const level = typeof raw === 'string' ? POSTGRES_SEVERITIES[raw.trim().toUpperCase()] : undefined
-    if (level) return { raw, level }
-  }
+  const pgRecord = selectPostgresRecord(obj)
+  if (pgRecord) return { raw: pgRecord.raw, level: pgRecord.level }
   for (const key of LEVEL_FIELD_KEYS) {
     const level = normalizeLevel(obj[key])
     if (level) return { raw: obj[key], level }

package/src/utils/navigation.test.ts

@@ -193,6 +193,63 @@ describe('pluralToKind', () => {
 })
 
 describe('initNavigationMap', () => {
+  const coreNode = { group: '', version: 'v1', kind: 'Node', name: 'nodes', namespaced: false, isCrd: false, verbs: ['get'] }
+  const customNode = { group: 'collision.example.io', version: 'v1', kind: 'Node', name: 'workerhosts', namespaced: false, isCrd: true, verbs: ['get'] }
+
+  test.each([
+    ['core listed first', [coreNode, customNode]],
+    ['custom listed first', [customNode, coreNode]],
+  ])('keeps the core plural for a Kind a CRD reuses under another plural (%s)', (_, resources) => {
+    initNavigationMap(resources)
+    expect(kindToPlural('Node')).toBe('nodes')
+    expect(kindToPluralWithGroup('Node', '')).toBe('nodes')
+    expect(refToSelectedResource({ kind: 'Node', group: '', name: 'worker' }).kind).toBe('nodes')
+    expect(kindToPluralWithGroup('Node', 'collision.example.io')).toBe('workerhosts')
+  })
+
+  test('keeps the core plural when partial discovery omits the core group', () => {
+    initNavigationMap([customNode])
+    expect(refToSelectedResource({ kind: 'Node', group: '', name: 'worker' }).kind).toBe('nodes')
+    expect(kindToPluralWithGroup('Node', 'collision.example.io')).toBe('workerhosts')
+  })
+
+  test.each([
+    ['partial discovery', [{ ...customNode, name: 'node' }]],
+    ['full discovery', [coreNode, { ...customNode, name: 'node' }]],
+  ])('keeps the core plural when a CRD registers the core Kind word as its plural (%s)', (_, resources) => {
+    initNavigationMap(resources)
+    expect(refToSelectedResource({ kind: 'Node', group: '', name: 'worker' }).kind).toBe('nodes')
+    expect(kindToPlural('node')).toBe('node')
+    expect(kindToPluralWithGroup('Node', 'collision.example.io')).toBe('node')
+  })
+
+  test('resolves a group-qualified Kind spelled like a core plural to its own resource', () => {
+    initNavigationMap([
+      { group: '', version: 'v1', kind: 'Endpoints', name: 'endpoints', namespaced: true, isCrd: false, verbs: ['get'] },
+      { group: 'custom.example.io', version: 'v1', kind: 'Endpoints', name: 'virtualendpoints', namespaced: true, isCrd: true, verbs: ['get'] },
+    ])
+    expect(kindToPluralWithGroup('Endpoints', 'custom.example.io')).toBe('virtualendpoints')
+    expect(kindToPluralWithGroup('Endpoints', '')).toBe('endpoints')
+  })
+
+  test('keeps a lowercase group plural rather than reading it as another Kind', () => {
+    initNavigationMap([
+      { group: 'shapes.example.io', version: 'v1', kind: 'Widget', name: 'widgets', namespaced: true, isCrd: true, verbs: ['get'] },
+      { group: 'shapes.example.io', version: 'v1', kind: 'Widgets', name: 'widgetsets', namespaced: true, isCrd: true, verbs: ['get'] },
+    ])
+    expect(kindToPluralWithGroup('widgets', 'shapes.example.io')).toBe('widgets')
+    expect(kindToPluralWithGroup('Widgets', 'shapes.example.io')).toBe('widgetsets')
+    expect(kindToPluralWithGroup('Widget', 'shapes.example.io')).toBe('widgets')
+  })
+
+  test('keeps last-wins for Kinds that only CRDs declare', () => {
+    initNavigationMap([
+      { group: 'a.example.io', version: 'v1', kind: 'Widget', name: 'widgets', namespaced: true, isCrd: true, verbs: [] },
+      { group: 'b.example.io', version: 'v1', kind: 'Widget', name: 'gadgets', namespaced: true, isCrd: true, verbs: [] },
+    ])
+    expect(kindToPlural('Widget')).toBe('gadgets')
+  })
+
   test('discovered API resources override heuristic pluralization', () => {
     // Before init, an unknown CRD would hit the heuristic fallback
     // After init, it uses the discovered plural name

package/src/utils/navigation.ts

@@ -1,6 +1,6 @@
 import type { SelectedResource, ResourceRef, APIResource } from '../types/core'
 import { englishPlural, englishSingular, isEnglishPlural } from './pluralize'
-import { CORE_RESOURCES } from './api-resources'
+import { CORE_RESOURCES, isBuiltinCoreKind } from './api-resources'
 
 /**
  * Canonical callback type for navigating to a resource.
@@ -67,6 +67,18 @@ let discoveredPluralToKind: Record<string, string> | null = null
 let discoveredKindToPlural: Record<string, string> | null = null
 let discoveredGroupKindToPlural: Record<string, string> | null = null
 let discoveredGroupPluralToKind: Record<string, string> | null = null
+let discoveredGroupKindNamespaced: Record<string, boolean> | null = null
+let discoveredCRDNames: Record<string, string> | null = null
+const crdDefinitionListeners = new Set<() => void>()
+
+export function subscribeCRDDefinitions(listener: () => void): () => void {
+  crdDefinitionListeners.add(listener)
+  return () => { crdDefinitionListeners.delete(listener) }
+}
+
+export function getCRDDefinitionsSnapshot(): Readonly<Record<string, string>> | null {
+  return discoveredCRDNames
+}
 
 /**
  * Initialize navigation maps from discovered API resources.
@@ -75,17 +87,35 @@ let discoveredGroupPluralToKind: Record<string, string> | null = null
  */
 export function initNavigationMap(resources: APIResource[]) {
   const p2k: Record<string, string> = { ...BUILTIN_PLURAL_TO_KIND }
-  const k2p: Record<string, string> = {}
+  // Seeded from the built-in table so core protection survives partial
+  // discovery (the server forwards whatever groups it could list).
+  const k2p: Record<string, string> = Object.fromEntries(
+    CORE_RESOURCES.filter(r => r.group === '').map(r => [r.kind.toLowerCase(), r.name]),
+  )
   const gk2p: Record<string, string> = {}
   const gp2k: Record<string, string> = { ...BUILTIN_GROUP_PLURAL_TO_KIND }
+  const scopes: Record<string, boolean> = {}
+  const crdNames: Record<string, string> = {}
+  const coreKinds = new Set(Object.keys(k2p))
   for (const r of resources) {
     const plural = r.name.toLowerCase()
+    const kindLower = r.kind.toLowerCase()
+    if (r.definitionName) crdNames[`${r.group}/${r.kind}`] = r.definitionName
     // First-wins on plurals: BUILTIN_PLURAL_TO_KIND seeds canonical core mappings
     // (e.g. "pods" → "Pod") so a colliding API resource (metrics.k8s.io exposes
     // "pods" with kind "PodMetrics") cannot hijack the core mapping.
     if (!(plural in p2k)) p2k[plural] = r.kind
-    k2p[r.kind.toLowerCase()] = plural
-    gk2p[`${r.group}/${r.kind.toLowerCase()}`] = plural
+    // Kind-only lookups (core links carry an empty group) likewise keep the core
+    // plural: a CRD that reuses a core Kind under another plural must not win
+    // just because discovery happened to list it later.
+    if (r.group === '') {
+      k2p[kindLower] = plural
+      coreKinds.add(kindLower)
+    } else if (!coreKinds.has(kindLower)) {
+      k2p[kindLower] = plural
+    }
+    gk2p[`${r.group}/${kindLower}`] = plural
+    scopes[`${r.group}/${kindLower}`] = r.namespaced
     const groupPlural = `${r.group}/${plural}`
     if (!(groupPlural in gp2k)) gp2k[groupPlural] = r.kind
   }
@@ -93,14 +123,20 @@ export function initNavigationMap(resources: APIResource[]) {
   discoveredKindToPlural = k2p
   discoveredGroupKindToPlural = gk2p
   discoveredGroupPluralToKind = gp2k
+  discoveredGroupKindNamespaced = scopes
+  discoveredCRDNames = crdNames
+  crdDefinitionListeners.forEach(listener => listener())
 }
 
-/** Reset navigation maps to builtin-only state. For testing. */
+/** Reset navigation maps to builtin-only state on cluster changes. */
 export function resetNavigationMap() {
   discoveredPluralToKind = null
   discoveredKindToPlural = null
   discoveredGroupKindToPlural = null
   discoveredGroupPluralToKind = null
+  discoveredGroupKindNamespaced = null
+  discoveredCRDNames = null
+  crdDefinitionListeners.forEach(listener => listener())
 }
 
 function getPluralToKind(): Record<string, string> {
@@ -117,6 +153,11 @@ export function kindToPlural(kind: string): string {
   const kindLower = kind.toLowerCase()
   const pluralToKindMap = getPluralToKind()
 
+  // An exact core Kind (PascalCase, unlike plural slugs) keeps its core plural
+  // even when a CRD registered that word as its own plural.
+  const core = kind !== kindLower ? CORE_RESOURCES.find(r => r.group === '' && r.kind === kind) : undefined
+  if (core) return core.name
+
   // Already a known plural — return as-is to prevent double-pluralization
   if (kindLower in pluralToKindMap) return kindLower
 
@@ -156,10 +197,15 @@ export function kindToPlural(kind: string): string {
 export function kindToPluralWithGroup(kind: string, group: string): string {
   if (!group) return kindToPlural(kind)
   const kindLower = kind.toLowerCase()
-  const pluralToKindMap = getPluralToKind()
-  if (kindLower in pluralToKindMap) return kindLower
+  // The group's own plural, then its exact Kind, before the group-blind plural
+  // shortcut: a custom Kind spelled like a core plural (Endpoints) has its own
+  // resource, while a lowercase plural must not be read as another Kind.
+  if (kind === kindLower && discoveredGroupPluralToKind?.[`${group}/${kindLower}`]) return kindLower
   const groupKind = `${group}/${kindLower}`
-  return discoveredGroupKindToPlural?.[groupKind] ?? BUILTIN_GROUP_KIND_TO_PLURAL[groupKind] ?? kindToPlural(kind)
+  const exact = discoveredGroupKindToPlural?.[groupKind] ?? BUILTIN_GROUP_KIND_TO_PLURAL[groupKind]
+  if (exact) return exact
+  if (kindLower in getPluralToKind()) return kindLower
+  return kindToPlural(kind)
 }
 
 /**
@@ -196,6 +242,13 @@ export function knownKindForPluralWithGroup(plural: string, group: string): stri
     ?? BUILTIN_GROUP_PLURAL_TO_KIND[groupPlural]
 }
 
+/** Return a CRD definition only when exact group/kind discovery identifies a CRD. */
+export function customResourceDefinitionRef(apiVersion: string | undefined, kind: string | undefined): ResourceRef | null {
+  if (!apiVersion || !kind) return null
+  const name = discoveredCRDNames?.[`${apiVersionToGroup(apiVersion)}/${kind}`]
+  return name ? { kind: 'CustomResourceDefinition', group: 'apiextensions.k8s.io', namespace: '', name } : null
+}
+
 /**
  * Convert a ResourceRef (from backend relationships) to a SelectedResource (for navigation).
  * Handles kind singular→plural conversion.
@@ -225,6 +278,31 @@ export function apiVersionToGroup(apiVersion?: string | null): string {
   return i === -1 ? '' : apiVersion.slice(0, i)
 }
 
+/** A Kubernetes ObjectReference retains its own API identity and namespace.
+ * Cluster scope comes from exact group/kind discovery (or known built-ins).
+ * Core controllers omit apiVersion for core objects (the EndpointSlice
+ * controller writes Pod targets as kind/namespace/name/uid), so an omitted
+ * apiVersion means the core group only for a built-in core Kind. Any other
+ * missing identity or scope stays non-navigable rather than guessing an API
+ * or borrowing the referring object's namespace. UID is not a drawer locator.
+ */
+export function objectReferenceToResourceRef(ref: {
+  apiVersion?: string
+  kind?: string
+  namespace?: string
+  name?: string
+} | null | undefined): ResourceRef | null {
+  if (!ref?.kind || !ref.name) return null
+  const kindLower = ref.kind.toLowerCase()
+  if (!ref.apiVersion && !isBuiltinCoreKind(ref.kind)) return null
+  const group = apiVersionToGroup(ref.apiVersion)
+  const key = `${group}/${kindLower}`
+  const namespaced = discoveredGroupKindNamespaced?.[key]
+    ?? CORE_RESOURCES.find(r => r.group === group && r.kind.toLowerCase() === kindLower)?.namespaced
+  if (namespaced !== false && !ref.namespace) return null
+  return { kind: ref.kind, group, namespace: namespaced === false ? '' : ref.namespace!, name: ref.name }
+}
+
 // -----------------------------------------------------------------------------
 // Timeline lane identity. A lane's id includes the API group so two CRDs that
 // share a kind name across vendors (CAPI `Cluster` in cluster.x-k8s.io vs CNPG

package/src/utils/object-reference-navigation.test.ts

@@ -0,0 +1,43 @@
+import { afterEach, describe, expect, it } from 'vitest'
+import { initNavigationMap, objectReferenceToResourceRef, resetNavigationMap } from './navigation'
+
+afterEach(resetNavigationMap)
+
+describe('objectReferenceToResourceRef', () => {
+  it('keeps the reference namespace and drops it for cluster-scoped core kinds', () => {
+    expect(objectReferenceToResourceRef({ apiVersion: 'v1', kind: 'Pod', namespace: 'other', name: 'backend' }))
+      .toEqual({ kind: 'Pod', group: '', namespace: 'other', name: 'backend' })
+    expect(objectReferenceToResourceRef({ apiVersion: 'v1', kind: 'Node', namespace: 'irrelevant', name: 'worker' }))
+      .toEqual({ kind: 'Node', group: '', namespace: '', name: 'worker' })
+  })
+
+  it('resolves a core Kind without apiVersion, the shape the EndpointSlice controller writes', () => {
+    expect(objectReferenceToResourceRef({ kind: 'Pod', namespace: 'team', name: 'backend' }))
+      .toEqual({ kind: 'Pod', group: '', namespace: 'team', name: 'backend' })
+    expect(objectReferenceToResourceRef({ kind: 'Endpoints', namespace: 'team', name: 'backend' }))
+      .toEqual({ kind: 'Endpoints', group: '', namespace: 'team', name: 'backend' })
+    expect(objectReferenceToResourceRef({ kind: 'Deployment', namespace: 'team', name: 'backend' })).toBeNull()
+    expect(objectReferenceToResourceRef({ kind: 'Services', namespace: 'team', name: 'backend' })).toBeNull()
+    expect(objectReferenceToResourceRef({ kind: 'Nodes', namespace: 'team', name: 'worker' })).toBeNull()
+  })
+
+  it('uses exact discovered scope for colliding API kinds', () => {
+    initNavigationMap([
+      { group: 'cluster.example.io', version: 'v1', kind: 'Node', name: 'nodes', namespaced: false, isCrd: true, verbs: ['get'] },
+      { group: 'team.example.io', version: 'v1', kind: 'Node', name: 'nodes', namespaced: true, isCrd: true, verbs: ['get'] },
+    ])
+    expect(objectReferenceToResourceRef({ apiVersion: 'cluster.example.io/v1', kind: 'Node', name: 'worker' }))
+      .toEqual({ kind: 'Node', group: 'cluster.example.io', namespace: '', name: 'worker' })
+    expect(objectReferenceToResourceRef({ apiVersion: 'team.example.io/v1', kind: 'Node', namespace: 'team', name: 'worker' }))
+      .toEqual({ kind: 'Node', group: 'team.example.io', namespace: 'team', name: 'worker' })
+    expect(objectReferenceToResourceRef({ apiVersion: 'team.example.io/v1', kind: 'Node', name: 'worker' })).toBeNull()
+  })
+
+  it('does not invent a custom API group, a namespace, or an unknown cluster scope', () => {
+    expect(objectReferenceToResourceRef({ kind: 'Widget', namespace: 'team', name: 'backend' })).toBeNull()
+    expect(objectReferenceToResourceRef({ apiVersion: 'v1', kind: 'Pod', name: 'backend' })).toBeNull()
+    expect(objectReferenceToResourceRef({ apiVersion: 'unknown.example.io/v1', kind: 'Node', name: 'worker' })).toBeNull()
+    expect(objectReferenceToResourceRef({ apiVersion: 'unknown.example.io/v1', kind: 'Widget', namespace: 'team', name: 'backend' }))
+      .toEqual({ kind: 'Widget', group: 'unknown.example.io', namespace: 'team', name: 'backend' })
+  })
+})

package/src/utils/resource-hierarchy.test.ts

@@ -1560,3 +1560,40 @@ describe('uses edges in the timeline hierarchy', () => {
     expect(deployment.children?.map(child => child.kind)).toEqual(['HorizontalPodAutoscaler'])
   })
 })
+
+describe('buildResourceHierarchy Flux sources', () => {
+  it('keeps a shared Flux source as its own lane instead of nesting it under one consumer', () => {
+    const event = (kind: string, name: string, apiVersion: string): TimelineEvent => ({
+      id: `${kind}/flux-system/${name}`,
+      timestamp: '2024-01-01T00:00:00.000Z',
+      source: 'informer',
+      kind,
+      apiVersion,
+      namespace: 'flux-system',
+      name,
+      eventType: 'update',
+    } as TimelineEvent)
+    const events = [
+      event('GitRepository', 'podinfo', 'source.toolkit.fluxcd.io/v1'),
+      event('Kustomization', 'base', 'kustomize.toolkit.fluxcd.io/v1'),
+      event('Kustomization', 'overlay', 'kustomize.toolkit.fluxcd.io/v1'),
+    ]
+    const topology = {
+      nodes: [
+        { id: 'gitrepository/flux-system/podinfo', kind: 'GitRepository', name: 'podinfo', status: 'healthy', data: { namespace: 'flux-system', apiVersion: 'source.toolkit.fluxcd.io/v1' } },
+        { id: 'kustomization/flux-system/base', kind: 'Kustomization', name: 'base', status: 'healthy', data: { namespace: 'flux-system', apiVersion: 'kustomize.toolkit.fluxcd.io/v1' } },
+        { id: 'kustomization/flux-system/overlay', kind: 'Kustomization', name: 'overlay', status: 'healthy', data: { namespace: 'flux-system', apiVersion: 'kustomize.toolkit.fluxcd.io/v1' } },
+      ],
+      edges: [
+        { id: 'e1', source: 'gitrepository/flux-system/podinfo', target: 'kustomization/flux-system/base', type: 'configures' },
+        { id: 'e2', source: 'gitrepository/flux-system/podinfo', target: 'kustomization/flux-system/overlay', type: 'configures' },
+      ],
+    } as unknown as Topology
+    const lanes = buildResourceHierarchy({ events, topology, grouping: 'owner' })
+    expect(lanes.map((lane) => `${lane.kind}/${lane.name}`).sort()).toEqual([
+      'GitRepository/podinfo',
+      'Kustomization/base',
+      'Kustomization/overlay',
+    ])
+  })
+})

package/src/utils/resource-hierarchy.ts

@@ -466,7 +466,7 @@ function sortEventsForRendering(events: TimelineEvent[]): TimelineEvent[] {
 // then workloads, then their generated children (ReplicaSet/Pod), config last.
 // Applied at EVERY depth so a Job's Pods sort the same way a root's children do.
 const CHILD_SORT_KIND_PRIORITY: Record<string, number> = {
-  Service: 1, Gateway: 1, HTTPRoute: 2, GRPCRoute: 2, TCPRoute: 2, TLSRoute: 2,
+  Service: 1, Gateway: 1, HTTPRoute: 2, GRPCRoute: 2, TCPRoute: 2, TLSRoute: 2, UDPRoute: 2,
   Deployment: 2, Rollout: 2, StatefulSet: 2, DaemonSet: 2,
   Job: 3, CronJob: 3,
   ReplicaSet: 3, Pod: 4, ConfigMap: 5, Secret: 5,
@@ -761,11 +761,11 @@ export function buildResourceHierarchy(options: HierarchyOptions): ResourceLane[
         const targetKind = parseLaneId(targetId)!.kind
 
         // Gateway→Route: Gateway is parent of Route
-        if (sourceKind === 'Gateway' && (targetKind === 'HTTPRoute' || targetKind === 'GRPCRoute' || targetKind === 'TCPRoute' || targetKind === 'TLSRoute')) {
+        if (sourceKind === 'Gateway' && (targetKind === 'HTTPRoute' || targetKind === 'GRPCRoute' || targetKind === 'TCPRoute' || targetKind === 'TLSRoute' || targetKind === 'UDPRoute')) {
           link(targetId, sourceId, targetExists)
         }
         // Route→Service: reverse (Service is representative, like Ingress)
-        else if ((sourceKind === 'HTTPRoute' || sourceKind === 'GRPCRoute' || sourceKind === 'TCPRoute' || sourceKind === 'TLSRoute') && targetKind === 'Service') {
+        else if ((sourceKind === 'HTTPRoute' || sourceKind === 'GRPCRoute' || sourceKind === 'TCPRoute' || sourceKind === 'TLSRoute' || sourceKind === 'UDPRoute') && targetKind === 'Service') {
           link(sourceId, targetId, sourceExists)
         }
         // Ingress→Service: reverse relationship (Service is representative)
@@ -778,8 +778,10 @@ export function buildResourceHierarchy(options: HierarchyOptions): ResourceLane[
         }
       }
 
-      // configures/protects: ConfigMap→Deployment, PDB→Deployment (target is parent)
-      if (edge.type === 'configures' || edge.type === 'protects') {
+      // configures/protects: ConfigMap→Deployment, PDB→Deployment (target is parent).
+      // A Flux source feeds many reconcilers and its timeline is its own, so it
+      // never nests under one of them.
+      if ((edge.type === 'configures' && !isFluxSource(topologyNodeById.get(edge.source))) || edge.type === 'protects') {
         link(sourceId, targetId, sourceExists)
       }
       // uses: only an autoscaler or a mounted claim belongs under the workload it
@@ -813,7 +815,7 @@ export function buildResourceHierarchy(options: HierarchyOptions): ResourceLane[
     const appLabelEligibleKinds = new Set([
       'Service', 'Deployment', 'Rollout', 'StatefulSet', 'DaemonSet',
       'Job', 'CronJob', 'Ingress', 'Gateway', 'HTTPRoute', 'GRPCRoute',
-      'TCPRoute', 'TLSRoute', 'ConfigMap', 'Secret',
+      'TCPRoute', 'TLSRoute', 'UDPRoute', 'ConfigMap', 'Secret',
       'Application', 'Kustomization', 'HelmRelease', 'GitRepository',
       'Workflow', 'CronWorkflow',
       'KnativeService', 'KnativeConfiguration', 'KnativeRevision', 'KnativeRoute',
@@ -844,7 +846,7 @@ export function buildResourceHierarchy(options: HierarchyOptions): ResourceLane[
 
       const kindPriority: Record<string, number> = {
         Service: 1, Ingress: 2, Gateway: 2,
-        HTTPRoute: 2, GRPCRoute: 2, TCPRoute: 2, TLSRoute: 2,
+        HTTPRoute: 2, GRPCRoute: 2, TCPRoute: 2, TLSRoute: 2, UDPRoute: 2,
         Deployment: 3, Rollout: 3, StatefulSet: 3, DaemonSet: 3,
         Job: 4, CronJob: 4, Workflow: 4, CronWorkflow: 4,
         ConfigMap: 5, Secret: 5,
@@ -1487,6 +1489,12 @@ const ATTACHED_USES_SOURCES = new Set([
   '/PersistentVolumeClaim',
 ])
 
+function isFluxSource(node: Topology['nodes'][number] | undefined): boolean {
+  if (!node) return false
+  const apiVersion = typeof node.data?.apiVersion === 'string' ? node.data.apiVersion : ''
+  return apiVersionToGroup(apiVersion) === 'source.toolkit.fluxcd.io'
+}
+
 function attachesToTarget(node: Topology['nodes'][number] | undefined): boolean {
   if (!node) return false
   const kind = topologyNodeResourceKind(node)

package/src/utils/resource-icons.ts

@@ -111,6 +111,7 @@ const KIND_ICON_MAP: Record<string, LucideIcon> = {
   httproute: Globe,
   grpcroute: Globe,
   tcproute: Globe,
+  udproute: Globe,
   tlsroute: Globe,
 
   // Config
@@ -219,6 +220,7 @@ const KIND_ICON_MAP: Record<string, LucideIcon> = {
   // pseudo-kinds (cnpgcluster/…) belong here only once pkg/topology's
   // KindForGVK emits them — it has no CNPG case today.
   pooler: Waypoints,
+  databaserole: UserCog,
 
   // Cluster API
   capicluster: Server,

package/src/utils/skeleton-yaml.test.ts

@@ -0,0 +1,21 @@
+import { describe, expect, it } from 'vitest'
+import { getSkeletonYaml } from './skeleton-yaml'
+
+describe('getSkeletonYaml', () => {
+  it('starts a CloudNativePG Cluster from a spec the operator accepts', () => {
+    const yaml = getSkeletonYaml('Cluster', 'postgresql.cnpg.io')
+    expect(yaml).toContain('apiVersion: postgresql.cnpg.io/v1')
+    expect(yaml).toContain('instances: 3')
+    expect(yaml).toContain('size: 1Gi')
+  })
+
+  it('leaves a Cluster API Cluster on the generic template', () => {
+    const yaml = getSkeletonYaml('Cluster', 'cluster.x-k8s.io')
+    expect(yaml).toContain('apiVersion: cluster.x-k8s.io/v1')
+    expect(yaml).not.toContain('instances')
+  })
+
+  it('keeps core kinds on their own skeleton', () => {
+    expect(getSkeletonYaml('Pod')).toContain('containers:')
+  })
+})

package/src/utils/skeleton-yaml.ts

@@ -198,8 +198,24 @@ spec:
           image: nginx:latest`,
 }
 
+// Keyed by group as well as kind: CloudNativePG and Cluster API both name a
+// kind Cluster.
+const groupSkeletons: Record<string, string> = {
+  'postgresql.cnpg.io/Cluster': `apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: my-cluster
+  namespace: default
+spec:
+  instances: 3
+  storage:
+    size: 1Gi`,
+}
+
 // Returns skeleton YAML for a known kind, or a generic template for unknown kinds.
 export function getSkeletonYaml(kind: string, group?: string): string {
+  const grouped = group ? groupSkeletons[`${group}/${kind}`] : undefined
+  if (grouped) return grouped
   const skeleton = skeletons[kind]
   if (skeleton) return skeleton
 

package/src/utils/url-path.test.ts

@@ -0,0 +1,35 @@
+import { describe, expect, it } from 'vitest'
+import { normalizeURLForComparison, stripTrailingSlashes } from './url-path'
+
+describe('stripTrailingSlashes', () => {
+  it.each([
+    ['', ''],
+    ['/', ''],
+    ['////', ''],
+    ['/api///', '/api'],
+    ['https://store.example//bucket///', 'https://store.example//bucket'],
+    ['https://store.example//bucket?prefix=/', 'https://store.example//bucket?prefix='],
+    ['/api//nested', '/api//nested'],
+  ])('preserves the existing path normalization for %s', (value, expected) => {
+    expect(stripTrailingSlashes(value)).toBe(expected)
+  })
+
+  it('handles long slash runs without scanning each possible start', () => {
+    const slashes = '/'.repeat(100_000)
+    expect(stripTrailingSlashes(`prefix${slashes}`)).toBe('prefix')
+    expect(stripTrailingSlashes(`prefix${slashes}suffix`)).toBe(`prefix${slashes}suffix`)
+  })
+})
+
+it('compares equivalent origins while retaining declared path semantics', () => {
+  expect(normalizeURLForComparison('https://STORE.example:443/prefix/')).toBe(normalizeURLForComparison('https://store.example/prefix'))
+  expect(normalizeURLForComparison('http://STORE.example:080/')).toBe(normalizeURLForComparison('http://store.example'))
+  expect(normalizeURLForComparison('s3://BUCKET/path/')).toBe(normalizeURLForComparison('s3://bucket/path'))
+  expect(normalizeURLForComparison('https://store.example/Prefix')).not.toBe(normalizeURLForComparison('https://store.example/prefix'))
+  expect(normalizeURLForComparison('https://store.example/a/../b')).not.toBe(normalizeURLForComparison('https://store.example/b'))
+  expect(normalizeURLForComparison('https://store.example:8443/path')).not.toBe(normalizeURLForComparison('https://store.example/path'))
+  expect(normalizeURLForComparison('')).toBe('')
+  expect(normalizeURLForComparison('invalid')).toBeNull()
+  expect(normalizeURLForComparison('https://host\\prefix')).toBeNull()
+  expect(normalizeURLForComparison('https://user:password@store.example')).toBeNull()
+})