@skyhook-io/k8s-ui 1.18.0 → 1.18.2

package/src/types/core.ts

@@ -126,6 +126,7 @@ export interface Capabilities {
   helmWrite: boolean      // Helm write operations (install, upgrade, rollback, uninstall, apply values)
   nodeWrite: boolean      // Node write operations (cordon, uncordon, drain)
   workloadWrites?: WorkloadWritePermissions // Workload patch permissions (restart/scale controls)
+  mcpExecTools?: boolean // Full MCP registration; does not grant the caller exec permission
   mcpReadOnly?: boolean  // Full MCP endpoint is disabled; read-only endpoints remain available
   mcpEnabled: boolean     // MCP server is running
   // Karpenter discovery and NodePool read state. Optional on the wire for the
@@ -162,6 +163,8 @@ export interface CloudConnectCapability {
 
 export interface FeatureCapabilities {
  helmSourceIdentity?: boolean
+  resourceReadCoverage?: boolean
+  searchCoverage?: boolean
   yamlReview?: boolean
   yamlSchemas?: boolean
   workloadImages?: boolean
@@ -175,6 +178,7 @@ export interface FeatureCapabilities {
   gitopsWriteEvidence?: boolean
   serviceEndpointSlices?: boolean
   trafficRecords?: boolean
+  clusterScopedPlaceholder?: boolean
 }
 
 // DeploymentMode is the closed set of topologies Radar can run in.
@@ -652,10 +656,23 @@ export interface Relationships {
     sourceResourceVersion?: string
     mirrors?: ResourceRef[]
   }
-  owner?: ResourceRef
+  owner?: ResourceRef        // The owner Kubernetes acts through: the controller reference, else the only reference
+  owners?: ResourceRef[]     // Every owner reference that resolves to an existing owner
   deployment?: ResourceRef   // Grandparent Deployment (for Pods owned by ReplicaSets)
   managedBy?: ResourceRef[]  // Topmost meaningful manager(s): GitOps controller (ArgoCD Application / Flux Kustomization / Flux HelmRelease), Helm release, or the topmost K8s owner. Synthesized server-side; replaces client-side detectGitOpsOwner.
-  children?: ResourceRef[]
+  children?: ResourceRef[]   // Objects whose owner references name this one, less olderRevisions
+  // Children kept apart because they only keep history: ReplicaSets that run
+  // no Pods and aren't their owner's current revision. ownership.children
+  // covers both lists together.
+  olderRevisions?: ResourceRef[]
+  // Management without an owner reference: GitOps member lists, class
+  // bindings, spec and status references. Never ownership or garbage collection.
+  managers?: ResourceRef[]
+  manages?: ResourceRef[]
+  /** How complete the owner-reference and recorded-membership answers are.
+   * Absent: no completeness is claimed, whether because the server answers
+   * Owner and Children from graph edges or because the resource is an Event. */
+  ownership?: OwnershipCoverage
   services?: ResourceRef[]
   ingresses?: ResourceRef[]
   gateways?: ResourceRef[]
@@ -682,6 +699,101 @@ export interface Relationships {
   resourceClaims?: ResourceRef[]    // For Pods: DRA ResourceClaims (direct + template-generated)
 }
 
+/** A kind Radar couldn't read, in namespace or (without one) in several or all of them, or the cluster for a cluster-scoped kind; reason is a readreason code. No kind stands for kinds discovery didn't list; no group is the core group. */
+export interface OwnershipGap {
+  group?: string
+  kind?: string
+  namespace?: string
+  reason: string
+}
+
+export interface OwnershipCoverage {
+  /** The owner reference's state when no owner is named: gone, replaced, withheld, unknown, unresolvable, excluded (it names an Event) or several. */
+  primaryOwnerState?: string
+  /** The owner the reference names when it is gone, replaced or unknown. */
+  ownerRef?: ResourceRef
+  /** A readreason code saying why an unknown owner couldn't be checked. */
+  ownerReason?: string
+  children: {
+    /** Children are every child the viewer may read. */
+    complete: boolean
+    notChecked?: OwnershipGap[]
+    truncated?: boolean
+    /** The viewer may read only some of the places children could be. */
+    narrowed?: boolean
+  }
+  /** For a GitOps manager whose status lists its members. */
+  manages?: {
+    membership: 'recorded' | 'remote' | 'unreadable'
+    /** A readreason code when the member list couldn't be read, as opposed to the status recording none. */
+    unavailableReason?: string
+    missing?: number
+    withheld?: number
+    unknown?: number
+    truncated?: boolean
+  }
+  /** Set when the search for the GitOps managers whose status lists this resource, for `managers`, couldn't settle every one the viewer may read. */
+  managers?: {
+    /** Managers with a member list Radar can't read, any of which may list this resource. */
+    unreadable?: number
+    /** Managers listing this resource's coordinates for a cluster Radar can't confirm is this one. */
+    remote?: number
+    notChecked?: OwnershipGap[]
+  }
+  /** What manages this resource, from its own evidence or its nearest controller ancestor's. Absent means no answer (a Radar that predates it, or unavailableReason), never "none". */
+  manager?: ManagerAnswer
+  /** A readreason code when Radar couldn't answer at all. */
+  unavailableReason?: string
+}
+
+/** What manages a resource: the managers whose status lists name it and what its metadata claims. It names no winner the evidence doesn't support. */
+export interface ManagerAnswer {
+  /** none: no evidence in what Radar collects and the viewer may read, never "unmanaged". */
+  state: 'shared' | 'disagree' | 'agree' | 'listed' | 'claimed' | 'unknown' | 'none'
+  /** The manager to show first, never a verdict: the recorder for agree/listed; for shared, the one recorder a claim names, if exactly one; for claimed, the manager every claim names, if they agree. Its namespace is "" when it comes from a claim that names none. */
+  lead?: ResourceRef
+  /** The evidence on the resource itself. */
+  direct: ManagerEvidence
+  /** The nearest controller ancestor's evidence that settles it when the resource's own doesn't, or, when nothing does and the resource makes no claim that isn't copied, the nearest ancestor that makes one; state and lead then come from it. */
+  via?: ManagerEvidence
+  /** Other objects the walk passed that make claims, in chain order. When via is a fallback to the nearest claim, claims farther up stay here. */
+  between?: ManagerEvidence[]
+  /** Why a walk that found no settling evidence stopped short. Absent when evidence settled it first, or the walk reached the chain's top. */
+  chainEnd?: 'unfollowed' | 'cycle' | 'truncated'
+  /** The controller reference the walk couldn't follow, when chainEnd is unfollowed. */
+  stop?: {
+    at: ResourceRef
+    /** As primaryOwnerState: gone, replaced, withheld, unknown, unresolvable or excluded. */
+    state: string
+    /** The owner the reference names when it is gone, replaced or unknown. */
+    owner?: ResourceRef
+    /** A readreason code when the owner is unknown. */
+    reason?: string
+  }
+  /** The viewer's access is restricted, so the evidence is the part it may read. */
+  narrowed?: boolean
+}
+
+export interface ManagerEvidence {
+  object: ResourceRef
+  /** Local managers whose status lists name it. */
+  recorders?: ResourceRef[]
+  /** Managers its own metadata names. */
+  claims?: ManagerClaim[]
+}
+
+/** source, check, and the answer's state and chainEnd may gain values in newer Radars: show an unfamiliar one generically and never treat it as confirming. */
+export interface ManagerClaim {
+  /** Its namespace is "" when the metadata doesn't say. */
+  manager: ResourceRef
+  source: 'flux-helm-labels' | 'flux-kustomize-labels' | 'argo-tracking-id' | 'argo-instance-label' | 'helm-release'
+  check: 'recorded' | 'omitted' | 'unreadable' | 'remote' | 'missing' | 'not-recording' | 'unresolved' | 'withheld' | 'unchecked'
+  /** An Argo CD tracking ID naming another object. */
+  copied?: boolean
+  /** Copied, or an instance label or Helm release annotation on an object a controller owns: it doesn't stop the walk. One that isn't copied can still answer when nothing on the chain settles it. */
+  weak?: boolean
+}
+
 // Parsed X.509 certificate metadata (from backend cert parsing)
 export interface CertificateInfo {
   subject: string
@@ -1212,6 +1324,7 @@ export interface InstallChartRequest {
 
 // ArtifactHub chart with rich metadata
 export interface ArtifactHubChart {
+  official?: boolean
   packageId: string
   name: string
   version: string
@@ -1234,6 +1347,9 @@ export interface ArtifactHubChart {
 
 // ArtifactHub repository info
 export interface ArtifactHubRepository {
+  organizationDisplayName?: string
+  userAlias?: string
+  displayName?: string
   name: string
   url: string
   official?: boolean
@@ -1451,7 +1567,7 @@ export interface AggregatedFlow {
 
 // Cluster info for traffic detection
 export interface TrafficClusterInfo {
-  platform: string // rke2, gke, eks, aks, minikube, kind, docker-desktop, openshift, rancher, generic
+  platform: string // nkp, rke2, gke, eks, aks, nutanix, minikube, kind, docker-desktop, openshift, rancher, generic
   cni: string // cilium, canal, calico, flannel, vpc-cni, azure-cni, gke-native, unknown
   dataplaneV2: boolean
   clusterName?: string

package/src/types/gitops-flux-inventory.test.ts

@@ -0,0 +1,24 @@
+import { describe, it, expect } from 'vitest'
+import { parseFluxInventory } from './gitops'
+
+// Mirrors TestParseFluxInventoryID in pkg/gitops/helpers_test.go: the
+// Kustomization renderer and the Go tree read the same inventory IDs.
+describe('parseFluxInventory', () => {
+  it('reads a colon in an RBAC name, written as a double underscore', () => {
+    expect(
+      parseFluxInventory([
+        { id: '_system__metrics-server_rbac.authorization.k8s.io_ClusterRole', v: 'v1' },
+        { id: 'kube-system_cert-manager__leaderelection_rbac.authorization.k8s.io_Role', v: 'v1' },
+      ]),
+    ).toEqual([
+      { group: 'rbac.authorization.k8s.io', kind: 'ClusterRole', namespace: '', name: 'system:metrics-server' },
+      { group: 'rbac.authorization.k8s.io', kind: 'Role', namespace: 'kube-system', name: 'cert-manager:leaderelection' },
+    ])
+  })
+
+  it('keeps single underscores in a name and the empty core group', () => {
+    expect(parseFluxInventory([{ id: 'ns_my_weird_name__ConfigMap' }])).toEqual([
+      { group: '', kind: 'ConfigMap', namespace: 'ns', name: 'my_weird_name' },
+    ])
+  })
+})

package/src/types/gitops.ts

@@ -446,9 +446,7 @@ export function argoApplicationSetConditionsToGitOpsStatus(
 export function parseFluxInventory(entries: Array<{ id: string; v?: string }>): ManagedResource[] {
   return entries
     .map(entry => {
-      // Format: namespace_name_group_kind
-      // The challenge is that namespace, name, and group can all contain underscores
-      // But the format is always: ns_name_group_kind where kind is the last part
+      // Format: namespace_name_group_kind; only the name can hold an underscore.
       const id = entry.id || ''
       const parts = id.split('_')
 
@@ -460,9 +458,11 @@ export function parseFluxInventory(entries: Array<{ id: string; v?: string }>):
       // Kind is always last, group is second-to-last
       const kind = parts[parts.length - 1]
       const group = parts[parts.length - 2]
-      // Namespace is first, name is everything in between
+      // Namespace is first, name is everything in between. Flux writes a colon
+      // in an RBAC object's name as a double underscore (system:metrics-server
+      // is system__metrics-server) and reads every "__" back as a colon.
       const namespace = parts[0]
-      const name = parts.slice(1, -2).join('_')
+      const name = parts.slice(1, -2).join('_').replaceAll('__', ':')
 
       // Validate required fields
       if (!kind || !name) {

package/src/types/index.ts

@@ -1,4 +1,5 @@
 export * from './core'
+export * from './read-coverage'
 export * from './fetch-error'
 export * from './gitops'
 export * from './gitops-tree'
@@ -6,3 +7,5 @@ export * from './gitops-insights'
 export * from './rbac'
 export * from './capacity'
 export * from './policy'
+export * from './read-coverage'
+export * from './resource-coverage'

package/src/types/read-coverage.ts

@@ -0,0 +1,65 @@
+// Coverage of a Radar read, as Radar's pkg/resourceapi serializes it. Codes
+// come from Radar's pkg/readreason.
+
+/**
+ * A known, finite set of `count` members. `names` lists all of them, sorted,
+ * when there are few enough for the response; otherwise it is absent and which
+ * members are in the set is unknown.
+ */
+export interface ReadNameSet {
+  count: number
+  names?: string[]
+}
+
+/**
+ * How far a gap reaches along one axis when it can't list it: `all` of the
+ * answer's scope, or an `unknown` part of it. A value a client doesn't know
+ * reads as unknown.
+ */
+export type ReadExtent = 'all' | 'unknown' | (string & {})
+
+/** A gap's set along one axis: listed like a ReadNameSet, or an extent. */
+export type ReadGapSet<T> = { count: number; names?: T[]; extent?: undefined } | { extent: ReadExtent; count?: undefined; names?: undefined }
+
+/** A kind; an omitted group is the core group. */
+export interface ReadKindRef {
+  kind: string
+  group?: string
+}
+
+export interface ReadObjectRef {
+  kind: string
+  group?: string
+  namespace?: string
+  name: string
+}
+
+/**
+ * Part of an answer Radar did not read, and why. A gap covers every
+ * combination of its axes. An axis that applies is always present, listed or
+ * as an extent; an absent axis doesn't apply to the gap (namespaces on a
+ * cluster-scoped kind). Within one answer a namespace is in at most one gap.
+ * `action` is what the code calls for, so a code the client doesn't know still
+ * says what resolves it.
+ */
+export interface ReadGap {
+  code: string
+  action?: string
+  kinds?: ReadGapSet<ReadKindRef>
+  namespaces?: ReadGapSet<string>
+  objects?: { count: number; names?: ReadObjectRef[] }
+}
+
+/** Why an implicitly broad read covers less than everything. */
+export type ReadNarrowing = 'user_access' | 'namespace_pin' | 'namespace_collection' | 'kind_collection' | (string & {})
+
+/**
+ * A search's coverage: `partial` when something the query named couldn't be
+ * searched or a read failed; `narrowedBy` when a broad query searched only
+ * what the caller's access and Radar's collection allow.
+ */
+export interface SearchCoverage {
+  status: 'complete' | 'partial'
+  narrowedBy?: ReadNarrowing[]
+  gaps: ReadGap[]
+}

package/src/types/resource-coverage.ts

@@ -0,0 +1,40 @@
+import type { ReadGap, ReadNameSet, ReadNarrowing } from './read-coverage'
+
+export interface ResourceReadScope {
+  type: 'cluster' | 'all_namespaces' | 'namespaces'
+  namespaces?: ReadNameSet
+}
+
+/**
+ * A single-kind read's coverage. `status` is relative to `scope`: the
+ * namespaces the request named, or what remained of every namespace after
+ * `narrowedBy` (the caller's access, Radar's pin, what Radar collects) narrowed it.
+ */
+export interface ResourceReadCoverage {
+  status: 'complete' | 'partial'
+  scope: ResourceReadScope
+  narrowedBy?: ReadNarrowing[]
+  /** What Radar read; on every successful answer, never on a failed read's coverage. */
+  read?: ResourceReadScope
+  gaps: ReadGap[]
+}
+
+export type ResourceCoverage = ResourceReadCoverage | { status: 'unknown' }
+
+export interface ResourceListResponse<T> {
+  items: T[]
+  coverage: ResourceReadCoverage
+  /** The lowercased plural from the request path, not a Kubernetes Kind. */
+  kind?: string
+  /** Omitted for the core group. */
+  group?: string
+  columns?: import('../components/resources/printer-columns').PrinterColumnDef[] | null
+  cells?: Record<string, unknown[]> | null
+}
+
+/** A failed resource read's body, on REST and in MCP results alike. */
+export interface ResourceReadErrorBody {
+  error: string
+  error_code: string
+  coverage?: ResourceReadCoverage
+}

package/src/utils/api-resources.ts

@@ -216,6 +216,7 @@ export function formatGroupName(group: string): string {
     'logstash.k8s.elastic.co': 'Elastic',
     'jaegertracing.io': 'Jaeger',
     'opentelemetry.io': 'OpenTelemetry',
+    'flagger.app': 'Flagger',
     'projectcalico.org': 'Calico',
     'crd.projectcalico.org': 'Calico',
     'projectcontour.io': 'Contour',

package/src/utils/format.test.ts

@@ -50,6 +50,13 @@ describe('parseMemoryToBytes', () => {
     expect(parseMemoryToBytes('1E3')).toBe(1000)
     expect(formatMemoryString('1e9')).toBe('954 MiB')
   })
+
+  it('reads sub-unit suffixes as fractions of a byte', () => {
+    expect(parseMemoryToBytes('1181116006400m')).toBeCloseTo(1181116006.4)
+    expect(parseMemoryToBytes('1000000u')).toBeCloseTo(1)
+    expect(parseMemoryToBytes('1000000000n')).toBeCloseTo(1)
+    expect(formatMemoryString('18360985190400m')).toBe('17.1 GiB')
+  })
 })
 
 describe('parseQuantityToNumber', () => {

package/src/utils/format.ts

@@ -141,8 +141,13 @@ export function parseMemoryToBytes(memString: string): number {
     'Ei': 1024 ** 6,
   }
 
-  // Decimal suffixes (powers of 1000)
+  // Decimal suffixes (powers of 1000). The sub-unit ones are real inputs too:
+  // a request written as "1288490188800m" is valid, and a sum that includes one
+  // keeps the milli scale, so a whole cluster's total serializes with "m".
   const decimalSuffixes: Record<string, number> = {
+    'n': 1000 ** -3,
+    'u': 1000 ** -2,
+    'm': 1000 ** -1,
     'k': 1000,
     'K': 1000,
     'M': 1000 ** 2,

package/src/utils/gitops-owner.test.ts

@@ -2,7 +2,7 @@ import { describe, it, expect } from 'vitest'
 
 import type { Relationships } from '../types/core'
 
-import { gitOpsOwnerFromRelationships } from './gitops-owner'
+import { gitOpsOwnerFromRelationships, managerListing } from './gitops-owner'
 
 describe('gitOpsOwnerFromRelationships', () => {
   it('returns null when relationships is undefined', () => {
@@ -93,3 +93,44 @@ describe('gitOpsOwnerFromRelationships', () => {
     })
   })
 })
+
+describe('managerListing', () => {
+  const owner = { tool: 'argocd' as const, kind: 'applications' as const, namespace: 'argocd', name: 'billing' }
+  const app = (name: string) => ({ kind: 'Application', group: 'argoproj.io', namespace: 'argocd', name })
+
+  it('confirms an owner that is the only manager listing the resource', () => {
+    expect(managerListing(owner, [app('billing')], true, true)).toEqual({ state: 'confirmed' })
+  })
+
+  it('confirms an instance-label owner whose namespace is not known yet', () => {
+    expect(managerListing({ ...owner, namespace: '' }, [app('billing')], true, true)).toEqual({ state: 'confirmed' })
+  })
+
+  it('reports a conflict when other managers list the resource and the owner does not', () => {
+    expect(managerListing(owner, [app('hub')], true, true)).toEqual({
+      state: 'conflict',
+      listedBy: [{ tool: 'argocd', kind: 'applications', namespace: 'argocd', name: 'hub' }],
+    })
+  })
+
+  it('says nothing when the owner is one of several managers', () => {
+    expect(managerListing(owner, [app('billing'), app('hub')], true, true)).toBeUndefined()
+  })
+
+  it('says nothing without managers to compare', () => {
+    expect(managerListing(owner, undefined, true, true)).toBeUndefined()
+    expect(managerListing(owner, [], true, true)).toBeUndefined()
+    expect(managerListing(null, [app('billing')], true, true)).toBeUndefined()
+    expect(managerListing(owner, [{ kind: 'Deployment', group: 'apps', namespace: 'x', name: 'y' }], true, true)).toBeUndefined()
+  })
+
+  it('claims nothing for an owner not verified in this cluster', () => {
+    expect(managerListing(owner, [app('billing')], false, true)).toBeUndefined()
+    expect(managerListing(owner, [app('hub')], false, true)).toBeUndefined()
+  })
+
+  it('claims nothing when the search left managers unsettled, since a listed one may be a topology link', () => {
+    expect(managerListing(owner, [app('billing')], true, false)).toBeUndefined()
+    expect(managerListing(owner, [app('hub')], true, false)).toBeUndefined()
+  })
+})

package/src/utils/gitops-owner.ts

@@ -1,12 +1,8 @@
-// Map a resource's server-side `Relationships.managedBy` to a navigable
-// GitOps owner ref, used by the drawer to render the "Managed by <app>" chip.
-//
-// The detection (label/annotation parsing, Argo tracking-id decoding, Flux
-// label inspection, Helm release annotation, owner-chain walk) lives server-
-// side in pkg/topology.SynthesizeManagedBy. This file is now a thin mapper
-// from the structured ref into the discriminated union the chip + router need.
+// Maps server manager evidence to drawer copy and navigation. Older Radars
+// without the answer retain their managedBy projection.
 
-import type { Relationships, ResourceRef } from '../types/core'
+import type { ManagerAnswer, ManagerClaim, ManagerEvidence, Relationships, ResourceRef } from '../types/core'
+import { dedupeResourceRefs, resourceRefKey } from './resource-refs'
 
 // GitOpsOwnerRef is a discriminated union — the tool determines which kind is
 // valid. Modeling it this way prevents callers (and consumers of the returned
@@ -36,6 +32,8 @@ const FLUX_HELM_GROUP = 'helm.toolkit.fluxcd.io'
 export function gitOpsOwnerFromRelationships(
   rel: Relationships | undefined | null,
 ): GitOpsOwnerRef | null {
+  const answer = rel?.ownership?.manager
+  if (answer) return answer.lead ? gitOpsOwnerFromRef(answer.lead) : null
   const refs = rel?.managedBy
   if (!refs || refs.length === 0) return null
   return gitOpsOwnerFromRef(refs[0])
@@ -54,3 +52,155 @@ export function gitOpsOwnerFromRef(ref: ResourceRef): GitOpsOwnerRef | null {
       return null
   }
 }
+
+/**
+ * How the managers whose status lists a resource (relationships.managers) bear
+ * on the GitOps owner its own tracking metadata names. `confirmed`: that owner
+ * is the only manager listing it. `conflict`: GitOps managers list it and the
+ * owner isn't one of them. Undefined when there is nothing to compare, the
+ * owner is one of several, the owner isn't verified in this cluster, or the
+ * search left managers unsettled (`settled` false): then a listed manager may
+ * be a topology link rather than a status list Radar read, and the owner's own
+ * list may be the one it couldn't read.
+ */
+export type ManagerListing = { state: 'confirmed' } | { state: 'conflict'; listedBy: GitOpsOwnerRef[] }
+
+export function managerListing(owner: GitOpsOwnerRef | null | undefined, managers: ResourceRef[] | undefined, verified: boolean, settled: boolean): ManagerListing | undefined {
+  if (!owner || !managers?.length || !verified || !settled) return undefined
+  const listed = managers.map(gitOpsOwnerFromRef).filter((m): m is GitOpsOwnerRef => m !== null)
+  if (listed.length === 0) return undefined
+  // An Argo CD owner named only by its instance label has no namespace yet.
+  const isOwner = (m: GitOpsOwnerRef) => m.tool === owner.tool && m.kind === owner.kind && m.name === owner.name && (!owner.namespace || m.namespace === owner.namespace)
+  if (!listed.some(isOwner)) return { state: 'conflict', listedBy: listed }
+  return listed.length === 1 && managers.length === 1 ? { state: 'confirmed' } : undefined
+}
+
+
+export function activeManagerClaims(evidence: ManagerEvidence): ManagerClaim[] {
+  const claims = (evidence.claims ?? []).filter(c => !c.copied)
+  const hasGitOps = Boolean(evidence.recorders?.length) || claims.some(c => c.source !== 'helm-release')
+  return hasGitOps ? claims.filter(c => c.source !== 'helm-release') : claims
+}
+
+export function managerCandidates(answer: ManagerAnswer): ResourceRef[] {
+  const evidence = answer.via ?? answer.direct
+  const recorders = evidence.recorders ?? []
+  const qualified = [...recorders, ...(answer.lead ? [answer.lead] : []), ...activeManagerClaims(evidence).map(c => c.manager).filter(r => r.namespace)]
+  // A claim without a namespace names the qualified manager of its kind and
+  // name the answer already holds, when there is exactly one.
+  const claims = activeManagerClaims(evidence).map(c => {
+    const ref = c.manager
+    if (ref.namespace) return ref
+    const matches = dedupeResourceRefs(qualified.filter(r => r.kind === ref.kind && r.group === ref.group && r.name === ref.name))
+    return matches.length === 1 ? matches[0] : ref
+  })
+  return dedupeResourceRefs([...(answer.lead ? [answer.lead] : []), ...claims, ...recorders])
+}
+
+export function managerRefLabel(ref: ResourceRef): string {
+  return `${ref.kind} ${ref.namespace ? `${ref.namespace}/` : ''}${ref.name}`
+}
+
+export function managerChipPresentation(answer: ManagerAnswer): { prefix: string; label: string; via?: string; tooltip: string; warning: boolean } | null {
+  if (answer.state === 'unknown' || answer.state === 'none') return null
+  const evidence = answer.via ?? answer.direct
+  const candidates = managerCandidates(answer)
+  const names = (refs: ResourceRef[]) => refs.map(managerRefLabel).join(' and ')
+  const claims = activeManagerClaims(evidence)
+  const claimed = dedupeResourceRefs(claims.map(c => c.manager))
+  const recorders = evidence.recorders ?? []
+  // A list alone records what a manager compared or applied, which can be an
+  // object it doesn't sync (a copy carrying another's tracking ID, a CRD a
+  // HelmRelease skips): only a list and the object's metadata agreeing says
+  // it manages the object.
+  const prefix = answer.state === 'agree' ? 'Managed by' : answer.state === 'shared' || answer.state === 'listed' ? 'Listed by' : 'Tracked by'
+  const listed = answer.lead && recorders.some(r => resourceRefKey(r) === resourceRefKey(answer.lead!))
+    ? dedupeResourceRefs([answer.lead, ...recorders]) : recorders
+  const displayed = answer.state === 'disagree' ? claimed : answer.state === 'shared' ? listed : candidates
+  const label = displayed.map(r => r.namespace ? `${r.namespace}/${r.name}` : r.name).join(' and ')
+  const reasons: Record<ManagerClaim['check'], string> = {
+    recorded: 'its status lists this resource',
+    omitted: "its status doesn't list this resource",
+    unreadable: "Radar can't read its status",
+    remote: "Radar can't confirm it deploys to this cluster",
+    missing: 'no such manager here',
+    'not-recording': 'Helm records an installation, rather than continuously reconciling it',
+    unresolved: 'Radar found no manager of that name listing this resource; it may be managed from another cluster',
+    withheld: "you can't view it",
+    unchecked: "Radar couldn't check its status",
+  }
+  const subject = answer.via ? managerRefLabel(evidence.object) : 'this resource'
+  const details: string[] = []
+  const whose = answer.via ? `${managerRefLabel(evidence.object)}'s` : "This resource's"
+  // A newer Radar may send a check this UI doesn't know.
+  const why = (c: ManagerClaim, object: string) => c.check === 'missing'
+    ? `there's no such ${c.manager.kind} here`
+    : (reasons[c.check] ?? "Radar couldn't confirm its status lists this resource").replace('manager of', `${c.manager.kind} of`).replace('this resource', object)
+  // Tracked by names what metadata says, which Radar hasn't confirmed: one
+  // claim says why in the same sentence.
+  const single = answer.state === 'claimed' && claims.length === 1 && claims[0].check !== 'recorded' ? claims[0] : null
+  if (single) {
+    details.push(`${whose} ${single.source.includes('label') ? 'label' : 'annotation'} names ${managerRefLabel(single.manager)}, but ${why(single, answer.via ? subject : 'it')}.`)
+  } else if (answer.state === 'claimed') {
+    details.push(`${whose} labels or annotations name ${names(claimed)}; Radar hasn't confirmed ${claimed.length === 1 ? 'it manages' : 'they manage'} it.`)
+  }
+  for (const c of claims) {
+    if (c.check === 'recorded' || c === single) continue
+    details.push(`${managerRefLabel(c.manager)}: ${why(c, subject)}.`)
+  }
+  if (recorders.length) {
+    // A claim its list confirms adds nothing but the agreement.
+    const confirmed = claims.some(c => c.check === 'recorded')
+    details.push(`${names(recorders)} ${recorders.length === 1 ? 'lists' : 'list'} ${subject} in ${recorders.length === 1 ? 'its status' : 'their statuses'}${confirmed ? `, and ${answer.via ? 'its' : 'this resource\'s'} tracking metadata names ${recorders.length === 1 ? 'it' : 'one of them'}` : ''}.`)
+  }
+  if (answer.via) details.push(`Through ${managerRefLabel(answer.via.object)}.`)
+  // Claims the answer passed on the way stay visible, with or without Via.
+  {
+    for (const e of [...(answer.via ? [answer.direct] : []), ...(answer.between ?? [])]) {
+      for (const c of e.claims ?? []) {
+        if (c.copied) continue
+        details.push(`${managerRefLabel(e.object)}: its own ${c.source.includes('label') ? 'label' : 'annotation'} names ${managerRefLabel(c.manager)}.`)
+      }
+    }
+  }
+  if (answer.narrowed) details.push('This answer covers what you can view.')
+  return { prefix, label, via: answer.via?.object.kind, tooltip: details.join(' '), warning: answer.state === 'disagree' }
+}
+
+/**
+ * A candidate manager of an answer, with what names it: its list, its
+ * metadata, or both. found: Radar read the manager, so a link to it opens it;
+ * a claim of a manager that is missing, withheld or unresolved isn't.
+ */
+export type ManagerChoice = { ref: ResourceRef; listed: boolean; claimed: boolean; found: boolean }
+
+/** Every candidate manager of an answer, lead first, each with what names it. */
+export function managerChoices(answer: ManagerAnswer): ManagerChoice[] {
+  const evidence = answer.via ?? answer.direct
+  const recorders = new Set((evidence.recorders ?? []).map(resourceRefKey))
+  const candidates = managerCandidates(answer)
+  // A manager is found when any claim naming it read it; a check this UI
+  // doesn't know never counts as one.
+  const read: Array<string> = ['recorded', 'omitted', 'unreadable', 'remote']
+  const claimed = new Set<string>()
+  const found = new Set<string>()
+  for (const c of activeManagerClaims(evidence)) {
+    const ref = c.manager
+    const key = resourceRefKey(ref.namespace ? ref : candidates.find(r => r.kind === ref.kind && r.group === ref.group && r.name === ref.name) ?? ref)
+    claimed.add(key)
+    if (read.includes(c.check)) found.add(key)
+  }
+  return candidates.map(ref => {
+    const key = resourceRefKey(ref)
+    const listed = recorders.has(key)
+    return { ref, listed, claimed: claimed.has(key), found: listed || found.has(key) }
+  })
+}
+
+export function managerChipCoversGroup(relationships: Relationships): boolean {
+  const answer = relationships.ownership?.manager
+  if (!answer || !['agree', 'listed'].includes(answer.state) || answer.via || relationships.ownership?.managers) return false
+  const recorders = answer.direct.recorders ?? []
+  const managers = relationships.managers ?? []
+  return recorders.length === 1 && managers.length === 1 && resourceRefKey(recorders[0]) === resourceRefKey(managers[0])
+}