@skyhook-io/k8s-ui 1.18.0 → 1.18.1

package/src/components/workload/WorkloadView.tsx

@@ -43,7 +43,7 @@ import type { NavigateToResource } from '../../utils/navigation'
 import { refToSelectedResource, pluralToKind, knownKindForPluralWithGroup, kindToPlural, kindToPluralWithGroup, apiVersionToGroup } from '../../utils/navigation'
 import { neighborhoodFor, seedNodeIds, topologyNodeResourceKind } from '../../utils/topology-neighborhood'
 import { TopologyGraph } from '../topology/TopologyGraph'
-import { gitOpsOwnerFromRelationships, type GitOpsOwnerRef } from '../../utils/gitops-owner'
+import { gitOpsOwnerFromRelationships, managerListing, type GitOpsOwnerRef } from '../../utils/gitops-owner'
 import { gitOpsRouteForResource } from '../../utils/gitops-route'
 import { buildResourceHierarchy, getAllEventsFromHierarchy, isProblematicEvent, type ResourceLane } from '../../utils/resource-hierarchy'
 import { TimelineSwimlanes, type TimeWindow } from '../timeline/TimelineSwimlanes'
@@ -57,7 +57,7 @@ import {
 import { ResourceRendererDispatch, getResourceStatus, diagnoseHealthHint, type DiagnoseHealthHint, type RendererOverrides } from '../shared/ResourceRendererDispatch'
 import type { ScalerDiagnosis } from '../resources/renderers/WorkloadRenderer'
 import { DetailShell, type DetailShellTab } from '../shared/DetailShell'
-import { HelmManagedByChip, ManagedByChip, type HelmOwnerRef } from '../shared/ManagedByChip'
+import { gitOpsOwnerKindLabel, HelmManagedByChip, ManagedByChip, type HelmOwnerRef } from '../shared/ManagedByChip'
 import { AlertBanner, getKindColorOutline, displayKindName, OperationalIssuesShownContext, ResourceRefBadge } from '../ui/drawer-components'
 import { Badge, type BadgeSeverity } from '../ui/Badge'
 import { Tooltip } from '../ui/Tooltip'
@@ -216,6 +216,8 @@ interface WorkloadViewProps {
   /** Timeline events the history lanes are built from: this workload's own
    *  history, or events for its namespace from a host that has no scoped query. */
   allEvents?: TimelineEvent[]
+  /** Reveals one event, loading older pages if needed. Use a new object for each navigation request. */
+  timelineFocusEvent?: { id: string }
   /** Older history exists beyond allEvents. */
   historyTruncated?: boolean
   /** Loads the next older page of history; omit when the host can't page. */
@@ -469,6 +471,7 @@ export function WorkloadView({
   refetch: refetchProp,
   // Timeline
   allEvents,
+  timelineFocusEvent,
   historyTruncated = false,
   onLoadOlderHistory,
   loadingOlderHistory = false,
@@ -723,6 +726,18 @@ export function WorkloadView({
   const metadata = useMemo(() => extractMetadata(kind, resource), [kind, resource])
   const relationshipGitOpsOwner = useMemo(() => gitOpsOwnerFromRelationships(relationships), [relationships])
   const gitopsOwner = resolvedGitOpsOwner ?? relationshipGitOpsOwner
+  const listing = useMemo(
+    () => managerListing(gitopsOwner, relationships?.managers, gitOpsOwnerVerified, !relationships?.ownership?.managers),
+    [gitopsOwner, relationships?.managers, relationships?.ownership?.managers, gitOpsOwnerVerified],
+  )
+  // When the chip's manager is the only one whose status lists the resource,
+  // the chip says it all: Related Resources would repeat it.
+  const rendererRelationships = useMemo(
+    () => (relationships && listing?.state === 'confirmed' ? { ...relationships, managers: undefined } : relationships),
+    [relationships, listing],
+  )
+  // When they disagree, Related Resources says which manager the label names.
+  const trackedBy = listing?.state === 'conflict' && gitopsOwner ? `${gitOpsOwnerKindLabel(gitopsOwner)} ${gitopsOwner.namespace ? `${gitopsOwner.namespace}/` : ''}${gitopsOwner.name}` : undefined
   // When the resource itself is a portal GitOps CR (Application, Kustomization,
   // HelmRelease, etc.), surface a link to its dedicated GitOps detail page —
   // the drawer's renderer is thorough but the tab has the tree + insights +
@@ -1022,7 +1037,7 @@ export function WorkloadView({
             <p className="text-sm text-theme-text-tertiary">{namespace}</p>
             {(gitopsOwner || helmOwner || (gitOpsResourcePath && onNavigateGitOpsPath) || onOpenLiveTraffic) && (
               <div className="mt-1 flex flex-wrap items-center gap-1.5">
-                {gitopsOwner && <ManagedByChip owner={gitopsOwner} status={gitOpsOwnerStatus} verified={gitOpsOwnerVerified} pending={gitOpsOwnerPending} source={gitOpsOwnerSource} onOpen={onOpenGitOpsResource} />}
+                {gitopsOwner && <ManagedByChip owner={gitopsOwner} status={gitOpsOwnerStatus} verified={gitOpsOwnerVerified} pending={gitOpsOwnerPending} source={gitOpsOwnerSource} listing={listing} onOpen={onOpenGitOpsResource} />}
                 {helmOwner && <HelmManagedByChip owner={helmOwner} source={helmOwnerSource} onOpen={onOpenHelmRelease} />}
                 {gitOpsResourcePath && onNavigateGitOpsPath && (
                   <OpenInGitOpsChip onClick={() => onNavigateGitOpsPath(gitOpsResourcePath)} />
@@ -1109,7 +1124,8 @@ export function WorkloadView({
               <ResourceRendererDispatch
                 resource={selectedResource}
                 data={resource}
-                relationships={relationships}
+                relationships={rendererRelationships}
+                trackedBy={trackedBy}
                 certificateInfo={certificateInfo}
                 hpaDiagnosis={hpaDiagnosis}
                 scalerDiagnostics={scalerDiagnostics}
@@ -1207,7 +1223,7 @@ export function WorkloadView({
             </Tooltip>
           ),
           gitopsOwner && (
-            <ManagedByChip key="gitops" owner={gitopsOwner} status={gitOpsOwnerStatus} verified={gitOpsOwnerVerified} pending={gitOpsOwnerPending} source={gitOpsOwnerSource} onOpen={onOpenGitOpsResource} variant="block" />
+            <ManagedByChip key="gitops" owner={gitopsOwner} status={gitOpsOwnerStatus} verified={gitOpsOwnerVerified} pending={gitOpsOwnerPending} source={gitOpsOwnerSource} listing={listing} onOpen={onOpenGitOpsResource} variant="block" />
           ),
           helmOwner && (
             <HelmManagedByChip key="helm" owner={helmOwner} source={helmOwnerSource} onOpen={onOpenHelmRelease} variant="block" />
@@ -1322,7 +1338,8 @@ export function WorkloadView({
             <InfoTab
               resource={resource}
               selectedResource={selectedResource}
-              relationships={relationships}
+              relationships={rendererRelationships}
+              trackedBy={trackedBy}
               certificateInfo={certificateInfo}
               hpaDiagnosis={hpaDiagnosis}
               scalerDiagnostics={scalerDiagnostics}
@@ -1383,6 +1400,7 @@ export function WorkloadView({
         )}
         {effectiveTab === 'timeline' && (
           <EventsTab
+            focusEvent={timelineFocusEvent}
             events={resourceEvents}
             isLoading={eventsLoading}
             truncated={historyTruncated}
@@ -1688,6 +1706,7 @@ function OwnershipHeading({
 // ============================================================================
 
 function EventsTab({
+  focusEvent,
   events,
   isLoading,
   truncated,
@@ -1703,6 +1722,7 @@ function EventsTab({
   topology,
   onResourceClick,
 }: {
+  focusEvent?: { id: string }
   events: TimelineEvent[]
   isLoading: boolean
   truncated?: boolean
@@ -1798,6 +1818,22 @@ function EventsTab({
     onSelectEvent(id)
   }, [onSelectEvent])
 
+  const focusedRequest = useRef<typeof focusEvent>(undefined)
+  const requestedPage = useRef<{ focus: typeof focusEvent; events: TimelineEvent[] } | undefined>(undefined)
+  const focusFound = Boolean(focusEvent && cleanEvents.some((event) => event.id === focusEvent.id))
+  useEffect(() => {
+    if (!focusEvent || focusedRequest.current === focusEvent || isLoading) return
+    if (focusFound) {
+      handleSelect(focusEvent.id)
+      focusedRequest.current = focusEvent
+    } else if (truncated && onLoadOlder && !loadingOlder && !olderError && !error) {
+      // Strict Mode can replay this effect before the loading prop updates.
+      if (requestedPage.current?.focus === focusEvent && requestedPage.current.events === events) return
+      requestedPage.current = { focus: focusEvent, events }
+      onLoadOlder()
+    }
+  }, [focusEvent, focusFound, events, isLoading, truncated, onLoadOlder, loadingOlder, olderError, error, handleSelect])
+
   if (isLoading) {
     return (
       <div className="flex items-center justify-center h-full text-theme-text-tertiary">
@@ -1827,6 +1863,15 @@ function EventsTab({
 
   return (
     <div className="h-full flex flex-col overflow-hidden">
+      {focusEvent && !focusFound && (
+        <div className="shrink-0 border-b border-theme-border px-4 py-2 text-xs text-theme-text-secondary" role="status">
+          {olderError || error
+            ? "Couldn't find the reported error because some history couldn't be loaded."
+            : truncated && onLoadOlder
+              ? 'Finding the reported error in older history…'
+              : 'The reported error is not available in the retained timeline history.'}
+        </div>
+      )}
       {error && (
         <div className="shrink-0 flex flex-wrap items-center gap-x-2 border-b border-theme-border bg-theme-base px-4 py-1.5 text-xs" role="alert">
           <span className="text-[var(--color-error)]" title={error.message}>
@@ -1932,6 +1977,7 @@ function InfoTab({
   resource,
   selectedResource,
   relationships,
+  trackedBy,
   certificateInfo,
   hpaDiagnosis,
   scalerDiagnostics,
@@ -1968,6 +2014,7 @@ function InfoTab({
   resource: any
   selectedResource: SelectedResource
   relationships?: Relationships
+  trackedBy?: string
   certificateInfo?: any
   hpaDiagnosis?: HPADiagnosis
   scalerDiagnostics?: ScalerDiagnosis[]
@@ -2022,6 +2069,7 @@ function InfoTab({
           resource={selectedResource}
           data={resource}
           relationships={relationships}
+          trackedBy={trackedBy}
           certificateInfo={certificateInfo}
           hpaDiagnosis={hpaDiagnosis}
           scalerDiagnostics={scalerDiagnostics}

package/src/hooks/index.ts

@@ -1,6 +1,8 @@
 export { useAnimatedUnmount } from './useAnimatedUnmount'
 export { useDebouncedValue } from './useDebouncedValue'
 export { useRefreshAnimation } from './useRefreshAnimation'
+export { useMediaQuery } from './useMediaQuery'
+export { usePhoneLayout, PHONE_MEDIA_QUERY } from './usePhoneLayout'
 export {
   KeyboardShortcutProvider,
   useRegisterShortcut,

package/src/hooks/useMediaQuery.ts

@@ -0,0 +1,21 @@
+import { useEffect, useState } from 'react'
+
+// Subscribe to a CSS media query. SSR-safe (returns false before mount) and
+// updates on viewport changes.
+export function useMediaQuery(query: string): boolean {
+  const [matches, setMatches] = useState(() => {
+    if (typeof window === 'undefined' || !window.matchMedia) return false
+    return window.matchMedia(query).matches
+  })
+
+  useEffect(() => {
+    if (typeof window === 'undefined' || !window.matchMedia) return
+    const mql = window.matchMedia(query)
+    const onChange = () => setMatches(mql.matches)
+    onChange()
+    mql.addEventListener('change', onChange)
+    return () => mql.removeEventListener('change', onChange)
+  }, [query])
+
+  return matches
+}

package/src/hooks/usePhoneLayout.ts

@@ -0,0 +1,12 @@
+import { useMediaQuery } from './useMediaQuery'
+
+// A phone: a narrow screen whose primary pointer is touch. A desktop browser
+// narrowed below this width keeps the desktop layout (and its content floor),
+// since a wider window can show the full UI; browser dev-tools device mode
+// emulates touch and gets the phone layout. Keep in sync with the `phone:`
+// variant in theme/tailwind-theme.css.
+export const PHONE_MEDIA_QUERY = '(max-width: 639px) and (pointer: coarse)'
+
+export function usePhoneLayout(): boolean {
+  return useMediaQuery(PHONE_MEDIA_QUERY)
+}

package/src/theme/tailwind-theme.css

@@ -6,6 +6,11 @@
  * Import after variables.css.
  */
 
+/* `phone:` styles apply on a narrow touch-first screen only (see
+ * PHONE_MEDIA_QUERY in hooks/usePhoneLayout.ts). A narrowed desktop window
+ * keeps the desktop layout. */
+@custom-variant phone (@media (max-width: 639px) and (pointer: coarse));
+
 @theme inline {
   /* Backgrounds */
   --color-theme-sidebar: var(--bg-sidebar);

package/src/types/core.ts

@@ -162,6 +162,8 @@ export interface CloudConnectCapability {
 
 export interface FeatureCapabilities {
  helmSourceIdentity?: boolean
+  resourceReadCoverage?: boolean
+  searchCoverage?: boolean
   yamlReview?: boolean
   yamlSchemas?: boolean
   workloadImages?: boolean
@@ -652,10 +654,23 @@ export interface Relationships {
     sourceResourceVersion?: string
     mirrors?: ResourceRef[]
   }
-  owner?: ResourceRef
+  owner?: ResourceRef        // The owner Kubernetes acts through: the controller reference, else the only reference
+  owners?: ResourceRef[]     // Every owner reference that resolves to an existing owner
   deployment?: ResourceRef   // Grandparent Deployment (for Pods owned by ReplicaSets)
   managedBy?: ResourceRef[]  // Topmost meaningful manager(s): GitOps controller (ArgoCD Application / Flux Kustomization / Flux HelmRelease), Helm release, or the topmost K8s owner. Synthesized server-side; replaces client-side detectGitOpsOwner.
-  children?: ResourceRef[]
+  children?: ResourceRef[]   // Objects whose owner references name this one, less olderRevisions
+  // Children kept apart because they only keep history: ReplicaSets that run
+  // no Pods and aren't their owner's current revision. ownership.children
+  // covers both lists together.
+  olderRevisions?: ResourceRef[]
+  // Management without an owner reference: GitOps member lists, class
+  // bindings, spec and status references. Never ownership or garbage collection.
+  managers?: ResourceRef[]
+  manages?: ResourceRef[]
+  /** How complete the owner-reference and recorded-membership answers are.
+   * Absent: no completeness is claimed, whether because the server answers
+   * Owner and Children from graph edges or because the resource is an Event. */
+  ownership?: OwnershipCoverage
   services?: ResourceRef[]
   ingresses?: ResourceRef[]
   gateways?: ResourceRef[]
@@ -682,6 +697,51 @@ export interface Relationships {
   resourceClaims?: ResourceRef[]    // For Pods: DRA ResourceClaims (direct + template-generated)
 }
 
+/** A kind Radar couldn't read, in namespace or (without one) in several or all of them, or the cluster for a cluster-scoped kind; reason is a readreason code. No kind stands for kinds discovery didn't list; no group is the core group. */
+export interface OwnershipGap {
+  group?: string
+  kind?: string
+  namespace?: string
+  reason: string
+}
+
+export interface OwnershipCoverage {
+  /** The owner reference's state when no owner is named: gone, replaced, withheld, unknown, unresolvable, excluded (it names an Event) or several. */
+  primaryOwnerState?: string
+  /** The owner the reference names when it is gone, replaced or unknown. */
+  ownerRef?: ResourceRef
+  /** A readreason code saying why an unknown owner couldn't be checked. */
+  ownerReason?: string
+  children: {
+    /** Children are every child the viewer may read. */
+    complete: boolean
+    notChecked?: OwnershipGap[]
+    truncated?: boolean
+    /** The viewer may read only some of the places children could be. */
+    narrowed?: boolean
+  }
+  /** For a GitOps manager whose status lists its members. */
+  manages?: {
+    membership: 'recorded' | 'remote' | 'unreadable'
+    /** A readreason code when the member list couldn't be read, as opposed to the status recording none. */
+    unavailableReason?: string
+    missing?: number
+    withheld?: number
+    unknown?: number
+    truncated?: boolean
+  }
+  /** Set when the search for the GitOps managers whose status lists this resource, for `managers`, couldn't settle every one the viewer may read. */
+  managers?: {
+    /** Managers with a member list Radar can't read, any of which may list this resource. */
+    unreadable?: number
+    /** Managers listing this resource's coordinates for a cluster Radar can't confirm is this one. */
+    remote?: number
+    notChecked?: OwnershipGap[]
+  }
+  /** A readreason code when Radar couldn't answer at all. */
+  unavailableReason?: string
+}
+
 // Parsed X.509 certificate metadata (from backend cert parsing)
 export interface CertificateInfo {
   subject: string
@@ -1212,6 +1272,7 @@ export interface InstallChartRequest {
 
 // ArtifactHub chart with rich metadata
 export interface ArtifactHubChart {
+  official?: boolean
   packageId: string
   name: string
   version: string
@@ -1234,6 +1295,9 @@ export interface ArtifactHubChart {
 
 // ArtifactHub repository info
 export interface ArtifactHubRepository {
+  organizationDisplayName?: string
+  userAlias?: string
+  displayName?: string
   name: string
   url: string
   official?: boolean

package/src/types/gitops-flux-inventory.test.ts

@@ -0,0 +1,24 @@
+import { describe, it, expect } from 'vitest'
+import { parseFluxInventory } from './gitops'
+
+// Mirrors TestParseFluxInventoryID in pkg/gitops/helpers_test.go: the
+// Kustomization renderer and the Go tree read the same inventory IDs.
+describe('parseFluxInventory', () => {
+  it('reads a colon in an RBAC name, written as a double underscore', () => {
+    expect(
+      parseFluxInventory([
+        { id: '_system__metrics-server_rbac.authorization.k8s.io_ClusterRole', v: 'v1' },
+        { id: 'kube-system_cert-manager__leaderelection_rbac.authorization.k8s.io_Role', v: 'v1' },
+      ]),
+    ).toEqual([
+      { group: 'rbac.authorization.k8s.io', kind: 'ClusterRole', namespace: '', name: 'system:metrics-server' },
+      { group: 'rbac.authorization.k8s.io', kind: 'Role', namespace: 'kube-system', name: 'cert-manager:leaderelection' },
+    ])
+  })
+
+  it('keeps single underscores in a name and the empty core group', () => {
+    expect(parseFluxInventory([{ id: 'ns_my_weird_name__ConfigMap' }])).toEqual([
+      { group: '', kind: 'ConfigMap', namespace: 'ns', name: 'my_weird_name' },
+    ])
+  })
+})

package/src/types/gitops.ts

@@ -446,9 +446,7 @@ export function argoApplicationSetConditionsToGitOpsStatus(
 export function parseFluxInventory(entries: Array<{ id: string; v?: string }>): ManagedResource[] {
   return entries
     .map(entry => {
-      // Format: namespace_name_group_kind
-      // The challenge is that namespace, name, and group can all contain underscores
-      // But the format is always: ns_name_group_kind where kind is the last part
+      // Format: namespace_name_group_kind; only the name can hold an underscore.
       const id = entry.id || ''
       const parts = id.split('_')
 
@@ -460,9 +458,11 @@ export function parseFluxInventory(entries: Array<{ id: string; v?: string }>):
       // Kind is always last, group is second-to-last
       const kind = parts[parts.length - 1]
       const group = parts[parts.length - 2]
-      // Namespace is first, name is everything in between
+      // Namespace is first, name is everything in between. Flux writes a colon
+      // in an RBAC object's name as a double underscore (system:metrics-server
+      // is system__metrics-server) and reads every "__" back as a colon.
       const namespace = parts[0]
-      const name = parts.slice(1, -2).join('_')
+      const name = parts.slice(1, -2).join('_').replaceAll('__', ':')
 
       // Validate required fields
       if (!kind || !name) {

package/src/types/index.ts

@@ -1,4 +1,5 @@
 export * from './core'
+export * from './read-coverage'
 export * from './fetch-error'
 export * from './gitops'
 export * from './gitops-tree'
@@ -6,3 +7,5 @@ export * from './gitops-insights'
 export * from './rbac'
 export * from './capacity'
 export * from './policy'
+export * from './read-coverage'
+export * from './resource-coverage'

package/src/types/read-coverage.ts

@@ -0,0 +1,65 @@
+// Coverage of a Radar read, as Radar's pkg/resourceapi serializes it. Codes
+// come from Radar's pkg/readreason.
+
+/**
+ * A known, finite set of `count` members. `names` lists all of them, sorted,
+ * when there are few enough for the response; otherwise it is absent and which
+ * members are in the set is unknown.
+ */
+export interface ReadNameSet {
+  count: number
+  names?: string[]
+}
+
+/**
+ * How far a gap reaches along one axis when it can't list it: `all` of the
+ * answer's scope, or an `unknown` part of it. A value a client doesn't know
+ * reads as unknown.
+ */
+export type ReadExtent = 'all' | 'unknown' | (string & {})
+
+/** A gap's set along one axis: listed like a ReadNameSet, or an extent. */
+export type ReadGapSet<T> = { count: number; names?: T[]; extent?: undefined } | { extent: ReadExtent; count?: undefined; names?: undefined }
+
+/** A kind; an omitted group is the core group. */
+export interface ReadKindRef {
+  kind: string
+  group?: string
+}
+
+export interface ReadObjectRef {
+  kind: string
+  group?: string
+  namespace?: string
+  name: string
+}
+
+/**
+ * Part of an answer Radar did not read, and why. A gap covers every
+ * combination of its axes. An axis that applies is always present, listed or
+ * as an extent; an absent axis doesn't apply to the gap (namespaces on a
+ * cluster-scoped kind). Within one answer a namespace is in at most one gap.
+ * `action` is what the code calls for, so a code the client doesn't know still
+ * says what resolves it.
+ */
+export interface ReadGap {
+  code: string
+  action?: string
+  kinds?: ReadGapSet<ReadKindRef>
+  namespaces?: ReadGapSet<string>
+  objects?: { count: number; names?: ReadObjectRef[] }
+}
+
+/** Why an implicitly broad read covers less than everything. */
+export type ReadNarrowing = 'user_access' | 'namespace_pin' | 'namespace_collection' | 'kind_collection' | (string & {})
+
+/**
+ * A search's coverage: `partial` when something the query named couldn't be
+ * searched or a read failed; `narrowedBy` when a broad query searched only
+ * what the caller's access and Radar's collection allow.
+ */
+export interface SearchCoverage {
+  status: 'complete' | 'partial'
+  narrowedBy?: ReadNarrowing[]
+  gaps: ReadGap[]
+}

package/src/types/resource-coverage.ts

@@ -0,0 +1,40 @@
+import type { ReadGap, ReadNameSet, ReadNarrowing } from './read-coverage'
+
+export interface ResourceReadScope {
+  type: 'cluster' | 'all_namespaces' | 'namespaces'
+  namespaces?: ReadNameSet
+}
+
+/**
+ * A single-kind read's coverage. `status` is relative to `scope`: the
+ * namespaces the request named, or what remained of every namespace after
+ * `narrowedBy` (the caller's access, Radar's pin, what Radar collects) narrowed it.
+ */
+export interface ResourceReadCoverage {
+  status: 'complete' | 'partial'
+  scope: ResourceReadScope
+  narrowedBy?: ReadNarrowing[]
+  /** What Radar read; on every successful answer, never on a failed read's coverage. */
+  read?: ResourceReadScope
+  gaps: ReadGap[]
+}
+
+export type ResourceCoverage = ResourceReadCoverage | { status: 'unknown' }
+
+export interface ResourceListResponse<T> {
+  items: T[]
+  coverage: ResourceReadCoverage
+  /** The lowercased plural from the request path, not a Kubernetes Kind. */
+  kind?: string
+  /** Omitted for the core group. */
+  group?: string
+  columns?: import('../components/resources/printer-columns').PrinterColumnDef[] | null
+  cells?: Record<string, unknown[]> | null
+}
+
+/** A failed resource read's body, on REST and in MCP results alike. */
+export interface ResourceReadErrorBody {
+  error: string
+  error_code: string
+  coverage?: ResourceReadCoverage
+}

package/src/utils/format.test.ts

@@ -50,6 +50,13 @@ describe('parseMemoryToBytes', () => {
     expect(parseMemoryToBytes('1E3')).toBe(1000)
     expect(formatMemoryString('1e9')).toBe('954 MiB')
   })
+
+  it('reads sub-unit suffixes as fractions of a byte', () => {
+    expect(parseMemoryToBytes('1181116006400m')).toBeCloseTo(1181116006.4)
+    expect(parseMemoryToBytes('1000000u')).toBeCloseTo(1)
+    expect(parseMemoryToBytes('1000000000n')).toBeCloseTo(1)
+    expect(formatMemoryString('18360985190400m')).toBe('17.1 GiB')
+  })
 })
 
 describe('parseQuantityToNumber', () => {

package/src/utils/format.ts

@@ -141,8 +141,13 @@ export function parseMemoryToBytes(memString: string): number {
     'Ei': 1024 ** 6,
   }
 
-  // Decimal suffixes (powers of 1000)
+  // Decimal suffixes (powers of 1000). The sub-unit ones are real inputs too:
+  // a request written as "1288490188800m" is valid, and a sum that includes one
+  // keeps the milli scale, so a whole cluster's total serializes with "m".
   const decimalSuffixes: Record<string, number> = {
+    'n': 1000 ** -3,
+    'u': 1000 ** -2,
+    'm': 1000 ** -1,
     'k': 1000,
     'K': 1000,
     'M': 1000 ** 2,

package/src/utils/gitops-owner.test.ts

@@ -2,7 +2,7 @@ import { describe, it, expect } from 'vitest'
 
 import type { Relationships } from '../types/core'
 
-import { gitOpsOwnerFromRelationships } from './gitops-owner'
+import { gitOpsOwnerFromRelationships, managerListing } from './gitops-owner'
 
 describe('gitOpsOwnerFromRelationships', () => {
   it('returns null when relationships is undefined', () => {
@@ -93,3 +93,44 @@ describe('gitOpsOwnerFromRelationships', () => {
     })
   })
 })
+
+describe('managerListing', () => {
+  const owner = { tool: 'argocd' as const, kind: 'applications' as const, namespace: 'argocd', name: 'billing' }
+  const app = (name: string) => ({ kind: 'Application', group: 'argoproj.io', namespace: 'argocd', name })
+
+  it('confirms an owner that is the only manager listing the resource', () => {
+    expect(managerListing(owner, [app('billing')], true, true)).toEqual({ state: 'confirmed' })
+  })
+
+  it('confirms an instance-label owner whose namespace is not known yet', () => {
+    expect(managerListing({ ...owner, namespace: '' }, [app('billing')], true, true)).toEqual({ state: 'confirmed' })
+  })
+
+  it('reports a conflict when other managers list the resource and the owner does not', () => {
+    expect(managerListing(owner, [app('hub')], true, true)).toEqual({
+      state: 'conflict',
+      listedBy: [{ tool: 'argocd', kind: 'applications', namespace: 'argocd', name: 'hub' }],
+    })
+  })
+
+  it('says nothing when the owner is one of several managers', () => {
+    expect(managerListing(owner, [app('billing'), app('hub')], true, true)).toBeUndefined()
+  })
+
+  it('says nothing without managers to compare', () => {
+    expect(managerListing(owner, undefined, true, true)).toBeUndefined()
+    expect(managerListing(owner, [], true, true)).toBeUndefined()
+    expect(managerListing(null, [app('billing')], true, true)).toBeUndefined()
+    expect(managerListing(owner, [{ kind: 'Deployment', group: 'apps', namespace: 'x', name: 'y' }], true, true)).toBeUndefined()
+  })
+
+  it('claims nothing for an owner not verified in this cluster', () => {
+    expect(managerListing(owner, [app('billing')], false, true)).toBeUndefined()
+    expect(managerListing(owner, [app('hub')], false, true)).toBeUndefined()
+  })
+
+  it('claims nothing when the search left managers unsettled, since a listed one may be a topology link', () => {
+    expect(managerListing(owner, [app('billing')], true, false)).toBeUndefined()
+    expect(managerListing(owner, [app('hub')], true, false)).toBeUndefined()
+  })
+})

package/src/utils/gitops-owner.ts

@@ -54,3 +54,25 @@ export function gitOpsOwnerFromRef(ref: ResourceRef): GitOpsOwnerRef | null {
       return null
   }
 }
+
+/**
+ * How the managers whose status lists a resource (relationships.managers) bear
+ * on the GitOps owner its own tracking metadata names. `confirmed`: that owner
+ * is the only manager listing it. `conflict`: GitOps managers list it and the
+ * owner isn't one of them. Undefined when there is nothing to compare, the
+ * owner is one of several, the owner isn't verified in this cluster, or the
+ * search left managers unsettled (`settled` false): then a listed manager may
+ * be a topology link rather than a status list Radar read, and the owner's own
+ * list may be the one it couldn't read.
+ */
+export type ManagerListing = { state: 'confirmed' } | { state: 'conflict'; listedBy: GitOpsOwnerRef[] }
+
+export function managerListing(owner: GitOpsOwnerRef | null | undefined, managers: ResourceRef[] | undefined, verified: boolean, settled: boolean): ManagerListing | undefined {
+  if (!owner || !managers?.length || !verified || !settled) return undefined
+  const listed = managers.map(gitOpsOwnerFromRef).filter((m): m is GitOpsOwnerRef => m !== null)
+  if (listed.length === 0) return undefined
+  // An Argo CD owner named only by its instance label has no namespace yet.
+  const isOwner = (m: GitOpsOwnerRef) => m.tool === owner.tool && m.kind === owner.kind && m.name === owner.name && (!owner.namespace || m.namespace === owner.namespace)
+  if (!listed.some(isOwner)) return { state: 'conflict', listedBy: listed }
+  return listed.length === 1 && managers.length === 1 ? { state: 'confirmed' } : undefined
+}

package/src/utils/index.ts

@@ -35,5 +35,7 @@ export * from './network-policy'
 export * from './cnpg-backup'
 export * from './url-path'
 export * from './resource-refs'
+export * from './resource-coverage'
+export * from './read-actions'
 
 export * from './grant'

package/src/utils/read-actions.test.ts

@@ -0,0 +1,22 @@
+import { readFileSync } from 'node:fs'
+import { dirname, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { describe, expect, it } from 'vitest'
+import { canonicalReadCode, READ_ACTIONS, readActionFor } from './read-actions'
+
+const FIXTURE = resolve(dirname(fileURLToPath(import.meta.url)), '../../../../pkg/readreason/testdata/actions.json')
+
+describe('read actions', () => {
+  it('mirror the server table exactly', () => {
+    expect(READ_ACTIONS).toEqual(JSON.parse(readFileSync(FIXTURE, 'utf8')))
+  })
+  it('maps an incomplete findings scan to changing the request', () => {
+    expect(READ_ACTIONS.findings_scan_incomplete).toBe('change_request')
+  })
+  it('read the spellings older Radars sent as the codes they became', () => {
+    expect(canonicalReadCode('kind_sync_failed')).toBe('kind_sync_timed_out')
+    expect(canonicalReadCode('rbac_denied')).toBe('user_forbidden')
+    expect(readActionFor('kind_sync_failed')).toBe('wait')
+    expect(readActionFor('rbac_denied')).toBe('user_access')
+  })
+})