@skyhook-io/k8s-ui 1.19.0 → 1.20.0

package/src/components/workload/WorkloadView.tsx

@@ -1,4 +1,5 @@
 import { dedupeResourceRefs } from '../../utils/resource-refs'
+import { isKubeRayClusterIdentity } from '../resources/resource-utils-ray'
 import { PodRow, PodListFrame, PodListToggle, workloadPodDetail } from './PodList'
 export { workloadPodDetail, podStatusLabel, podStatusClass, podDotClass } from './PodList'
 import { useState, useMemo, useEffect, useRef, useCallback, type ComponentType, type ReactNode } from 'react'
@@ -38,10 +39,12 @@ import {
 } from 'lucide-react'
 import type { TimelineEvent, ResourceRef, Relationships, SelectedResource, ResolvedEnvFrom, Topology, TopologyNode, HPADiagnosis, WorkloadPodInfo } from '../../types'
 import type { GitOpsStatus } from '../../types/gitops'
+import type { ReadGap } from '../../types/read-coverage'
+import { workloadHistoryNotes, type WorkloadHistoryCoverage } from '../../utils/workload-history-notes'
 import { isFetchError } from '../../types/fetch-error'
 import type { NavigateToResource } from '../../utils/navigation'
 import { refToSelectedResource, pluralToKind, knownKindForPluralWithGroup, kindToPlural, kindToPluralWithGroup, apiVersionToGroup } from '../../utils/navigation'
-import { neighborhoodFor, seedNodeIds, topologyNodeResourceKind } from '../../utils/topology-neighborhood'
+import { jobSetMemberRunKey, neighborhoodFor, seedNodeIds, topologyNodeResourceKind } from '../../utils/topology-neighborhood'
 import { TopologyGraph } from '../topology/TopologyGraph'
 import { gitOpsOwnerFromRelationships, managerChipCoversGroup, managerChipPresentation, managerListing, type GitOpsOwnerRef } from '../../utils/gitops-owner'
 import { gitOpsRouteForResource } from '../../utils/gitops-route'
@@ -125,8 +128,8 @@ interface WorkloadViewProps {
   onCollapseToDrawer?: () => void
   /** false = collapsed drawer mode, true (default) = full expanded mode */
   expanded?: boolean
-  /** false on the outgoing layer during an expand/collapse crossfade — suspend
-   *  keyboard shortcuts so the invisible layer doesn't capture them (default true) */
+  /** false on the outgoing layer during an expand/collapse crossfade: suspend
+   *  keyboard shortcuts and let hosted renderers pause their reads (default true). */
   active?: boolean
   /** Close the drawer (collapsed mode) */
   onClose?: () => void
@@ -230,8 +233,12 @@ interface WorkloadViewProps {
   /** allEvents holds only this workload's own history (what it runs and the
    *  resources attached to it), not its whole namespace. */
   historyScoped?: boolean
-  /** Some related resources' history isn't included: there were more than the host follows. */
+  /** Scope bounds or expired ownership records may leave related history out. */
   historyIncomplete?: boolean
+  /** Radar may not hold every change since the workload existed. */
+  historyCoverage?: WorkloadHistoryCoverage | null
+  /** Related kinds the history can't include for this viewer. */
+  historyGaps?: ReadGap[] | null
   historyError?: Error | null
   onRetryHistory?: () => void
   /** Persisted lifecycle events reconstructed for resources related to this workload. */
@@ -360,6 +367,12 @@ interface WorkloadViewProps {
     /** Place resource notices within the replacement layout's content area. */
     leadContent?: ReactNode
   }) => ReactNode
+  /** Called instead of navigating when a Topology-tab click lands on a member
+   *  Job of the JobSet this view shows, so the host can open the member in
+   *  place. `memberKey` is the member list's run key, `jobs/<namespace>/<name>`
+   *  (see `jobSetMemberRunKey`), not a node ID or UID. Omit to navigate as for
+   *  any node. */
+  onSelectTopologyMember?: (memberKey: string) => void
   /** Render the metrics tab content */
   renderMetricsTab?: (props: { kind: string; namespace: string; name: string }) => ReactNode
   /** Render the Diagnose tab content - a path-shaped trace for network
@@ -480,6 +493,8 @@ export function WorkloadView({
   olderHistoryError = null,
   historyScoped = false,
   historyIncomplete = false,
+  historyCoverage,
+  historyGaps,
   historyError = null,
   onRetryHistory,
   relatedTimelineEvents = [],
@@ -509,6 +524,7 @@ export function WorkloadView({
   renderDiagnoseTab,
   reachableVia,
   renderExpandedOverview,
+  onSelectTopologyMember,
   renderSummary,
   extraTabs,
   tabOrder,
@@ -579,6 +595,21 @@ export function WorkloadView({
   const [selectedEventId, setSelectedEventId] = useState<string | null>(null)
   const [selectedPod, setSelectedPod] = useState<string | null>(null)
   const [initialContainer, setInitialContainer] = useState<string | null>(null)
+  // Hosts reuse this view across resources, and a resource can be recreated
+  // under the same name: a Pod picked for one must not reach the next, not
+  // even for one render. A UID arriving with the first load is not a change.
+  const selectionIdentity = `${kind}\u0000${namespace}\u0000${name}`
+  // A host can briefly pass the previous resource with the new name.
+  const selectionUID = resource?.metadata?.name === name && (resource?.metadata?.namespace ?? '') === (namespace ?? '') ? resource?.metadata?.uid as string | undefined : undefined
+  const [selectionScope, setSelectionScope] = useState({ identity: selectionIdentity, uid: selectionUID })
+  if (selectionScope.identity !== selectionIdentity || (selectionUID && selectionScope.uid !== selectionUID)) {
+    const recreated = selectionScope.identity === selectionIdentity && selectionScope.uid !== undefined
+    setSelectionScope({ identity: selectionIdentity, uid: selectionUID })
+    if (selectionScope.identity !== selectionIdentity || recreated) {
+      setSelectedPod(null)
+      setInitialContainer(null)
+    }
+  }
   const [copied, setCopied] = useState<string | null>(null)
   const [saveSuccess, setSaveSuccess] = useState(false)
   const [recentImageSave, setRecentImageSave] = useState(false)
@@ -613,6 +644,7 @@ export function WorkloadView({
       groupByApp: true,
     })
   }, [allEvents, topology, kind, group, namespace, name, historyScoped])
+  const historyNotes = useMemo(() => workloadHistoryNotes(historyCoverage, historyGaps), [historyCoverage, historyGaps])
 
   // Topology tab — the seeded neighborhood around this one workload (its
   // ownership core + attached Services/config/policies), not the whole namespace.
@@ -667,6 +699,13 @@ export function WorkloadView({
   const yamlObject = yamlObjectId ? yamlObjects.find((o) => o.id === yamlObjectId) : undefined
   const handleTopologyNodeClick = useCallback(
     (node: TopologyNode) => {
+      const memberKey = onSelectTopologyMember && topology && neighborhoodFocusId
+        ? jobSetMemberRunKey(topology, neighborhoodFocusId, node)
+        : undefined
+      if (memberKey) {
+        onSelectTopologyMember?.(memberKey)
+        return
+      }
       const resourceKind = topologyNodeResourceKind(node)
       if (!onNavigateToResource || !resourceKind || !node.name) return
       const group = apiVersionToGroup(node.data?.apiVersion as string | undefined)
@@ -677,7 +716,7 @@ export function WorkloadView({
         group,
       })
     },
-    [onNavigateToResource],
+    [onNavigateToResource, onSelectTopologyMember, topology, neighborhoodFocusId],
   )
 
   // Flatten events from hierarchy
@@ -896,7 +935,7 @@ export function WorkloadView({
   // prominent "Diagnose" on a problem, a quiet icon when fine. Rendered via the host
   // slot (DiagnoseCustomization); standalone Radar injects it, Hub overrides it.
   const renderDiagnose = actionsBarProps?.renderDiagnose as
-    | ((ctx: { kind: string; group?: string; namespace: string; name: string; health?: DiagnoseHealthHint }) => ReactNode)
+    | ((ctx: { kind: string; group?: string; namespace: string; name: string; health?: DiagnoseHealthHint; createdAt?: string }) => ReactNode)
     | undefined
   const headerActions = resource && !resourceGone && renderHeaderActions?.({ resource, context: expanded ? 'expanded' : 'drawer', onNavigate: onNavigateToResource })
   const diagnoseAction = resourceGone ? null : renderDiagnose?.({
@@ -905,6 +944,7 @@ export function WorkloadView({
     namespace,
     name,
     health: diagnoseHealthHint(apiKind, resource),
+    createdAt: resource?.metadata?.creationTimestamp,
   })
 
   const showMetricsTab = isMetricsAvailable ? isMetricsAvailable(kind, resource) : false
@@ -1131,6 +1171,7 @@ export function WorkloadView({
               )}
               {overviewIntro && <div className="px-4 pt-4">{overviewIntro}</div>}
               <ResourceRendererDispatch
+                active={active}
                 resource={selectedResource}
                 data={resource}
                 relationships={rendererRelationships}
@@ -1357,6 +1398,7 @@ export function WorkloadView({
           <div className="h-full min-h-0 overflow-y-auto">{specTab.render()}</div>
         ) : (effectiveTab === 'overview' || effectiveTab === 'spec') && (
             <InfoTab
+              active={active}
               resource={resource}
               selectedResource={selectedResource}
               relationships={rendererRelationships}
@@ -1430,6 +1472,7 @@ export function WorkloadView({
             olderError={olderHistoryError}
             scoped={historyScoped}
             incomplete={historyIncomplete}
+            notes={historyNotes}
             error={historyError}
             onRetry={onRetryHistory}
             selectedEventId={selectedEventId}
@@ -1738,6 +1781,7 @@ function EventsTab({
   olderError,
   scoped,
   incomplete,
+  notes = [],
   error,
   onRetry,
   selectedEventId,
@@ -1754,6 +1798,8 @@ function EventsTab({
   olderError?: Error | null
   scoped?: boolean
   incomplete?: boolean
+  /** Coverage and access sentences from workloadHistoryNotes. */
+  notes?: string[]
   error?: Error | null
   onRetry?: () => void
   selectedEventId: string | null
@@ -1911,14 +1957,15 @@ function EventsTab({
           )}
         </div>
       )}
-      {(scoped || truncated || incomplete) && (
+      {(scoped || truncated || incomplete || notes.length > 0) && (
         <div className="shrink-0 flex flex-wrap items-center gap-x-2 gap-y-0.5 border-b border-theme-border bg-theme-base px-4 py-1.5 text-xs text-theme-text-secondary" role="note">
           {scoped && (
             <span className="text-theme-text-tertiary">
               This workload, what it runs, and the Services, Ingresses, config and scalers attached to it.
             </span>
           )}
-          {incomplete && <span>This workload has more past runs and related resources than Radar follows, so some are left out.</span>}
+          {incomplete && <span>Some past runs or related resources may be outside the history Radar can follow.</span>}
+          {notes.map((note) => <span key={note}>{note}</span>)}
           {truncated && <span>Showing the most recent events. Older history exists.</span>}
           {truncated && olderError && (
             <span className="text-[var(--color-error)]" title={olderError.message}>Couldn't load older events.</span>
@@ -1997,6 +2044,7 @@ function EventsTab({
 // ============================================================================
 
 function InfoTab({
+  active,
   resource,
   selectedResource,
   relationships,
@@ -2034,6 +2082,7 @@ function InfoTab({
   onEvaluateCapacity,
   recentImageSave,
 }: {
+  active: boolean
   resource: any
   selectedResource: SelectedResource
   relationships?: Relationships
@@ -2089,6 +2138,7 @@ function InfoTab({
           </div>
         )}
         <ResourceRendererDispatch
+          active={active}
           resource={selectedResource}
           data={resource}
           relationships={relationships}
@@ -2176,6 +2226,7 @@ const LOGS_TAB_WITHOUT_PODS_KINDS = new Set([
   'clusterworkflowtemplates',
   'scaledjobs',
   'jobsets',
+  'rayclusters',
   'clusters',
 ])
 const RUNTIME_WORKLOAD_OVERVIEW_KINDS = new Set(['deployments', 'statefulsets', 'daemonsets', 'jobs', 'cronjobs'])
@@ -2193,6 +2244,8 @@ export function supportsLogsWithoutPods(
   if (normalizedKind === 'jobsets') {
     return group === 'jobset.x-k8s.io' && apiVersion === 'jobset.x-k8s.io/v1alpha2'
   }
+  // A KubeRay RayCluster's tab reads the Pods it owns now, not recorded ones.
+  if (normalizedKind === 'rayclusters') return isKubeRayClusterIdentity(group, apiVersion)
   // A CloudNativePG Cluster's instance Pods are its children, not related
   // Pods, and its logs are resolved server-side from the Cluster itself.
   if (normalizedKind === 'clusters') {

package/src/components/workload/workload-logs-availability.test.ts

@@ -23,4 +23,11 @@ describe('supportsLogsWithoutPods', () => {
     expect(supportsLogsWithoutPods('clusters', 'Cluster', undefined, 'postgresql.cnpg.io/v1')).toBe(true)
     expect(supportsLogsWithoutPods('clusters', 'Cluster', 'cluster.x-k8s.io', 'cluster.x-k8s.io/v1beta1')).toBe(false)
   })
+
+  it('offers a KubeRay RayCluster its owned-Pod logs without recorded Pods, but not other RayCluster kinds', () => {
+    expect(supportsLogsWithoutPods('rayclusters', 'RayCluster', 'ray.io', 'ray.io/v1')).toBe(true)
+    expect(supportsLogsWithoutPods('rayclusters', 'RayCluster', 'ray.io', undefined)).toBe(true)
+    expect(supportsLogsWithoutPods('rayclusters', 'RayCluster', 'ray.io', 'ray.io/v1alpha1')).toBe(false)
+    expect(supportsLogsWithoutPods('rayclusters', 'RayCluster', 'example.io', 'example.io/v1')).toBe(false)
+  })
 })

package/src/types/core.ts

@@ -1,4 +1,6 @@
+import type { Issue, IssueResourceRef } from '../components/issues/types'
 import type { CapacityIntegrationState } from './capacity'
+import type { ReadGap, ReadKindRef } from './read-coverage'
 
 // Topology types matching the Go backend
 
@@ -119,6 +121,8 @@ export interface Capabilities {
   configManagement?: 'local' | 'operator' | 'cloud'
   exec: boolean           // Terminal feature (pods/exec)
   localTerminal: boolean  // Local terminal available (not in-cluster, not disabled)
+  /** Shell family where a hand-off command runs; absent from older Radars. */
+  localShell?: 'powershell' | 'posix'
   logs: boolean           // Log viewer (pods/log)
   portForward: boolean    // Port forwarding (pods/portforward)
   secrets: boolean        // List secrets
@@ -129,6 +133,7 @@ export interface Capabilities {
   mcpExecTools?: boolean // Full MCP registration; does not grant the caller exec permission
   mcpReadOnly?: boolean  // Full MCP endpoint is disabled; read-only endpoints remain available
   mcpEnabled: boolean     // MCP server is running
+  mcpApplicationEvidence?: boolean
   // Karpenter discovery and NodePool read state. Optional on the wire for the
   // same newer-frontend/older-backend reason as `deployment` below — consumers
   // must treat absence as "unknown" and fall back to discovery signals.
@@ -165,6 +170,7 @@ export interface FeatureCapabilities {
  helmSourceIdentity?: boolean
   resourceReadCoverage?: boolean
   searchCoverage?: boolean
+ applicationEvidence?: boolean
   yamlReview?: boolean
   yamlSchemas?: boolean
   workloadImages?: boolean
@@ -179,7 +185,17 @@ export interface FeatureCapabilities {
   agentSigninCheck?: boolean
   serviceEndpointSlices?: boolean
   trafficRecords?: boolean
+  argoRollbackSync?: boolean
+  argoSyncInheritance?: boolean
+  argoEnableSelfHealOff?: boolean
   clusterScopedPlaceholder?: boolean
+  kueuePendingPosition?: boolean
+  // GET /api/workloads/rayclusters/{namespace}/{name}/pods. Older Radars that
+  // serve the route omit the flag; radarFeatures falls back to v1.15.0.
+  rayClusterPods?: boolean
+  // Workload Pod info marks native sidecars (containerStatuses[].sidecar).
+  podSidecarMarks?: boolean
+  kueueQueueWorkloads?: boolean
 }
 
 // DeploymentMode is the closed set of topologies Radar can run in.
@@ -234,6 +250,7 @@ export type CoreNodeKind =
   | 'HorizontalPodAutoscaler'
   | 'Job'
   | 'CronJob'
+  | 'JobSet' // jobset.x-k8s.io JobSet
   | 'Workflow'
   | 'CronWorkflow'
   | 'WorkflowTemplate'
@@ -876,8 +893,29 @@ export interface HPAMetricSummary {
   status: string
 }
 
+/** Current findings from one bounded local inventory, independent of parent health.
+ * No groups or no findings never establishes absence of associations or recovery. */
+export interface RelatedFindingsGroup {
+  /** Association anchor; each finding identifies its own subject. */
+  associatedVia: IssueResourceRef
+  /** Nonempty finite set of resource kinds selected for assessment; names, when present, lists all. */
+  kinds: { count: number; names?: ReadKindRef[] }
+  /** Authorized candidate resource snapshots, not findings or API calls. */
+  checked: number
+  /** Checked snapshots the producer could not assess, not known inactive states.
+   * checked - unknown is not a healthy count. */
+  unknown: number
+  findings?: Issue[]
+  /** Inventory-read limitations; always an array, including when empty. */
+  gaps: ReadGap[]
+  /** Findings were omitted from output; inventory read failures use gaps. */
+  truncated?: boolean
+}
+
 // Resource with computed relationships and optional certificate info (API response wrapper)
 export interface ResourceWithRelationships<T = unknown> {
+  /** Optional association bundle; absence is not an all-clear. */
+  relatedFindings?: RelatedFindingsGroup[]
   resource: T
   relationships?: Relationships
   certificateInfo?: SecretCertificateInfo
@@ -1738,6 +1776,8 @@ export interface ImageMetadata {
 export interface WorkloadPodContainerInfo {
   name: string
   init?: boolean
+  /** An init container with restartPolicy Always. Absent from older Radars. */
+  sidecar?: boolean
   ready: boolean
   restartCount: number
 }

package/src/types/gitops-insights.ts

@@ -56,6 +56,9 @@ export interface GitOpsInsightSummary {
   source?: string
   targetRevision?: string
   lastRevision?: string
+  // Revision(s) deployed by the latest successful marked rollback, set only while
+  // effective auto-sync is off. Absence does not mean no rollback happened.
+  rollbackRevision?: string
   lastReconcile?: string
   partialReason?: string
   // Human-readable sync mode for the chip in the status strip.
@@ -84,8 +87,8 @@ export interface GitOpsInsightSummary {
   // controller's verdicts are not in the Application object and any
   // per-resource health shown is Radar's own read.
   resourceHealthMode?: GitOpsHealthMode
-  // The Application deploys to another cluster; Radar derives nothing about
-  // its resources from here.
+  // The current destination or recorded Argo comparison is elsewhere;
+  // Radar derives nothing from same-named local resources.
   remoteDestination?: boolean
   // Per-resource health came from Argo CD's API server: the verdicts shown
   // are Argo's even though the Application object doesn't carry them.
@@ -242,6 +245,12 @@ export interface GitOpsHistoryItem {
   rawMessage?: string
   source?: string
   initiatedBy?: string
+  // Whether an Argo CD history entry has an ID and recorded source(s), independently
+  // of auto-sync, lifecycle, in-flight operations and RBAC. Absent where not
+  // applicable (current-operation and Flux rows), or not supplied by Radar.
+  rollbackable?: boolean
+  // Compatibility warning: the current Application or history entry uses plural sources.
+  rollbackMultiSourceWarning?: boolean
 }
 
 export interface GitOpsCapabilities {

package/src/types/gitops-tree.ts

@@ -95,7 +95,7 @@ export interface GitOpsResourceTree {
   // The host couldn't reach the controller's API server and is retrying;
   // ask again now and then.
   healthApiRetrying?: boolean
-  // The Application (or Flux object with spec.kubeConfig) deploys to another
-  // cluster; Radar derives nothing about its resources from here.
+  // The current destination or recorded Argo comparison is elsewhere;
+  // Radar derives nothing from same-named local resources.
   remoteDestination?: boolean
 }

package/src/types/kueue-queues.ts

@@ -0,0 +1,84 @@
+// Which Workloads belong to one Kueue queue, as Radar's
+// GET /api/kueue/{clusterqueues/{name},localqueues/{namespace}/{name}}/workloads
+// serializes it (internal/server/kueue_queue_workloads.go).
+import type { ReadGapSet } from './read-coverage'
+import type { KueueAdmissionState } from './scheduling'
+import type { ResourceReadCoverage, ResourceReadErrorBody } from './resource-coverage'
+
+export type KueueQueueMembership = 'submission' | 'reservation'
+
+export interface KueueQueueWorkload {
+  namespace: string
+  name: string
+  uid: string
+  apiVersion: string
+  createdAt: string | null
+  deleting: boolean
+  /** The Workload's shared admission classification (schedulinginsight.ClassifyKueueWorkload); absent when Radar doesn't classify it. */
+  phase?: 'pending' | 'quota_reserved' | 'admitted' | 'finished' | (string & {})
+  admission?: KueueAdmissionState
+  /** Why the Workload is in this queue. */
+  membership: KueueQueueMembership[]
+  queueName?: string
+  /**
+   * Where the Workload's LocalQueue points now, when Radar read it; not where it
+   * pointed at submission. Absent when there is no queueName, the LocalQueue
+   * doesn't exist, or it wasn't read (then `localQueueUnread` is true).
+   */
+  submission?: { localQueue: string; localQueueUID: string; clusterQueue: string }
+  /** Radar didn't read the LocalQueues in this Workload's namespace, so whether it was submitted here is unknown. Absent means false. */
+  localQueueUnread?: boolean
+  /** The ClusterQueue the Workload reports its admission in. */
+  reservation?: { clusterQueue: string }
+}
+
+/** One page of a queue's Workloads. Every count describes all members Radar read for you (not just this page), as of this page's read. */
+export interface KueueQueueMembers {
+  items: KueueQueueWorkload[]
+  /** Members the filters keep, across all pages. */
+  matching: number
+  /**
+   * Over every member Radar read for you; submission and reservation overlap
+   * (ClusterQueue only: a LocalQueue's members all belong by submission, so its
+   * reservation count is 0). `states` counts, by admission state, the members
+   * the membership filter keeps.
+   */
+  counts: { members: number; submission: number; reservation: number; states: Record<string, number> }
+  next?: string
+  /**
+   * The Workload read alone. `complete` doesn't make the membership complete:
+   * see `submissionUnresolved`.
+   */
+  coverage: ResourceReadCoverage
+  /**
+   * ClusterQueue only. Namespaces whose Workloads Radar read but whose
+   * LocalQueues it didn't: only reservations place Workloads there, so while
+   * set, `counts.members`, `counts.submission` and `matching` (unless filtered
+   * to reservation) are lower bounds. Absent: no such namespace.
+   */
+  submissionUnresolved?: ReadGapSet<string>
+}
+
+export interface KueueQueueLocalQueue {
+  namespace: string
+  name: string
+  /** The LocalQueue's own counts as its controller reports them; null when not reported. */
+  reported: { pending: number | null; reserving: number | null; admitted: number | null }
+  /** Radar read Workloads in this LocalQueue's namespace for you. When false, `workloadsGap` is the pkg/readreason code, when Radar knows it. */
+  workloadsRead: boolean
+  workloadsGap?: string
+}
+
+/**
+ * Each part is present or its error is: `workloads` or `workloadsError`;
+ * `localQueues` or `localQueuesError` for a ClusterQueue's first page only
+ * (later pages and LocalQueue responses carry neither, except an error).
+ */
+export interface KueueQueueWorkloadsResponse {
+  queue: { kind: 'ClusterQueue' | 'LocalQueue'; namespace?: string; name: string; uid: string; clusterQueue?: string }
+  workloads?: KueueQueueMembers
+  workloadsError?: ResourceReadErrorBody
+  /** At most 500 items; `total` counts every LocalQueue found. Not paged. */
+  localQueues?: { items: KueueQueueLocalQueue[]; total: number; coverage: ResourceReadCoverage }
+  localQueuesError?: ResourceReadErrorBody
+}

package/src/types/read-coverage.ts

@@ -38,7 +38,8 @@ export interface ReadObjectRef {
  * Part of an answer Radar did not read, and why. A gap covers every
  * combination of its axes. An axis that applies is always present, listed or
  * as an extent; an absent axis doesn't apply to the gap (namespaces on a
- * cluster-scoped kind). Within one answer a namespace is in at most one gap.
+ * cluster-scoped kind). Within a single-kind answer a namespace is in at most one gap;
+ * multi-kind answers may name it for different kinds and reasons.
  * `action` is what the code calls for, so a code the client doesn't know still
  * says what resolves it.
  */

package/src/types/scheduling.ts

@@ -45,9 +45,81 @@ export interface SchedulingObservation {
     waitingForReplacementPods?: SchedulingCondition
     requeueState?: { count?: number; requeueAt?: string }
     concurrentAdmission?: { parentName: string; parentRef?: SchedulingRef }
+    pendingPosition?: KueuePendingPosition
+    admission?: KueueAdmissionState
   }
 }
 
+// Mirrors resourcecontext.KueueAdmissionFact (see its Go doc for the
+// evidence contract: message is bounded display text, an absent stale means
+// not known to be stale).
+export interface KueueAdmissionFact {
+  code: string
+  // Open like code: a newer Radar may send a source this UI doesn't know.
+  source?: 'condition' | 'admission_check' | 'spec' | (string & {})
+  name?: string
+  reason?: string
+  message?: string
+  since?: string
+  stale?: boolean
+}
+
+// Mirrors resourcecontext.KueueAdmissionState. The server is the only place
+// codes and attention are decided; a code this UI does not know still renders
+// verbatim. A missing fact is not evidence on its own (see the Go doc for
+// which facts each state reports), and a missing admission block means an
+// older Radar, not a Workload with no blocker.
+export interface KueueAdmissionState {
+  state: string
+  attention: string
+  stale?: boolean
+  inactive?: KueueAdmissionFact
+  blocker?: KueueAdmissionFact
+  disruption?: KueueAdmissionFact
+}
+
+/**
+ * Where Kueue's visibility API placed one pending Workload when Radar read it,
+ * as the viewer (pkg/resourcecontext/kueue_position.go). Never derived by Radar.
+ */
+export type KueuePendingPositionStatus =
+  | 'listed'
+  | 'not_listed'
+  | 'limit_reached'
+  | 'queue_unknown'
+  | 'no_local_queue'
+  | 'not_served'
+  | 'unsupported'
+  | 'unavailable'
+
+export interface KueuePendingPosition {
+  status: KueuePendingPositionStatus | (string & {})
+  /** listed only: Workloads Kueue orders before this one (Kueue's 0-based position). */
+  aheadInLocalQueue?: number
+  aheadInClusterQueue?: number
+  /** Workload spec.queueName; omitted when empty, even when no request was made. */
+  localQueue?: string
+  /** Rows Kueue returned; set whenever a read succeeded. */
+  rows?: number
+  /** Requested limit; present only with a successfully decoded answer. */
+  rowLimit?: number
+  /** Supported version selected for the lookup; absent when none was selected. */
+  apiVersion?: string
+  /** When Radar made the read (RFC 3339). */
+  readAt?: string
+  /** pkg/readreason code; unavailable only. */
+  code?: string
+  message?: string
+}
+
+/** GET /api/kueue/position/{namespace}/{name} */
+export interface KueuePositionResponse {
+  uid: string
+  /** The supplied Workload snapshot permits a lookup; not proof of queue membership. */
+  eligible: boolean
+  position?: KueuePendingPosition
+}
+
 export interface KueueAdmissionWorkload {
   apiVersion: string
   namespace: string

package/src/utils/animation.test.ts

@@ -0,0 +1,38 @@
+import { describe, expect, it } from 'vitest'
+import {
+  DURATION_HOVER_REVEAL_IN,
+  DURATION_HOVER_REVEAL_OUT,
+  HOVER_INTENT_DELAY,
+  HOVER_REVEAL_ACTION,
+  HOVER_REVEAL_HIT,
+  HOVER_REVEAL_REST,
+} from './animation'
+
+// The presets spell their timing out for Tailwind's scanner; this keeps the
+// literals in step with the named constants.
+describe('hover-reveal presets', () => {
+  const intent = `delay-${HOVER_INTENT_DELAY}`
+  const into = `duration-${DURATION_HOVER_REVEAL_IN}`
+  const outOf = `duration-${DURATION_HOVER_REVEAL_OUT}`
+
+  it.each([
+    ['action', HOVER_REVEAL_ACTION],
+    ['hit target', HOVER_REVEAL_HIT],
+  ])('the %s leaves on the out clock and comes in on the in clock after the intent delay', (_, preset) => {
+    const classes = preset.split(/\s+/)
+    expect(classes).toContain(outOf)
+    for (const v of ['group-hover', 'group-has-[:focus-visible]']) {
+      expect(classes).toContain(`${v}:${into}`)
+      expect(classes).toContain(`${v}:${intent}`)
+    }
+  })
+
+  it('the resting content steps out on the out clock and returns on the in clock', () => {
+    const classes = HOVER_REVEAL_REST.split(/\s+/)
+    expect(classes).toContain(into)
+    for (const v of ['group-hover', 'group-has-[:focus-visible]']) {
+      expect(classes).toContain(`${v}:${outOf}`)
+      expect(classes).toContain(`${v}:${intent}`)
+    }
+  })
+})

package/src/utils/animation.ts

@@ -45,6 +45,17 @@ export const DURATION_DISCLOSURE = 300
  *  should feel immediate. */
 export const DURATION_MENU_IN = 140
 export const DURATION_MENU_OUT = 100
+/** Hover-revealed row actions (HOVER_REVEAL_*). In the range of Radar's other
+ *  hover effects (150–200ms) rather than the menu clock, which reads as a
+ *  flicker on something the pointer merely passes over. The exit is shorter
+ *  so leaving a row feels immediate. The preset class strings spell these
+ *  values out for Tailwind's scanner; a test keeps them in step. */
+export const DURATION_HOVER_REVEAL_IN = 200
+export const DURATION_HOVER_REVEAL_OUT = 120
+/** Hover intent before a row action comes in: a pointer sweeping down a long
+ *  list passes each row in well under this, so actions don't ripple in behind
+ *  it. Entrance only; leaving a row hides its action at once. */
+export const HOVER_INTENT_DELAY = 60
 /** Modal dialogs and command palettes. */
 export const DURATION_DIALOG_IN = 220
 export const DURATION_DIALOG_OUT = 160
@@ -104,6 +115,29 @@ export const TRANSITION_PANEL =
 export const TRANSITION_MENU =
   `transition-[translate,scale,opacity] ${TW_EASE} motion-reduce:transition-none`
 
+/** Hover-revealed row action, the resting half: the row content the action
+ *  replaces (an age, a chip) lifts 3px and fades on the exit clock. Needs a
+ *  `group` ancestor; keyboard reveal keys on :focus-visible inside the group,
+ *  so a row left focused by a mouse click doesn't keep its action up. Timing
+ *  is DURATION_HOVER_REVEAL_IN / _OUT and HOVER_INTENT_DELAY. */
+export const HOVER_REVEAL_REST =
+  `transition-[opacity,translate] duration-200 ${TW_EASE} motion-reduce:transition-none group-hover:opacity-0 group-hover:-translate-y-[3px] group-hover:duration-120 group-hover:delay-60 group-has-[:focus-visible]:opacity-0 group-has-[:focus-visible]:-translate-y-[3px] group-has-[:focus-visible]:duration-120 group-has-[:focus-visible]:delay-60`
+
+/** Hover-revealed row action, the action half: rises 3px into place on the
+ *  entrance clock after the hover-intent delay, drops out on the exit clock.
+ *  Never a hit target itself, so its padding and any backdrop leave clicks to
+ *  the row underneath; put HOVER_REVEAL_HIT on the control inside it. Pair
+ *  with HOVER_REVEAL_REST in one group. */
+export const HOVER_REVEAL_ACTION =
+  `transition-[opacity,translate] duration-120 ${TW_EASE} motion-reduce:transition-none pointer-events-none opacity-0 translate-y-[3px] group-hover:opacity-100 group-hover:translate-y-0 group-hover:duration-200 group-hover:delay-60 group-has-[:focus-visible]:opacity-100 group-has-[:focus-visible]:translate-y-0 group-has-[:focus-visible]:duration-200 group-has-[:focus-visible]:delay-60`
+
+/** Hover-revealed row action, the control inside it: takes clicks only while
+ *  shown. pointer-events transitions as a discrete property on the same
+ *  clock, so it flips partway through the entrance rather than at hover start
+ *  and a click during the intent delay lands on the row. */
+export const HOVER_REVEAL_HIT =
+  `transition-[pointer-events] transition-discrete duration-120 ${TW_EASE} motion-reduce:transition-none pointer-events-none group-hover:pointer-events-auto group-hover:duration-200 group-hover:delay-60 group-has-[:focus-visible]:pointer-events-auto group-has-[:focus-visible]:duration-200 group-has-[:focus-visible]:delay-60`
+
 export type OverlayKind = 'menu' | 'dialog' | 'sheet' | 'drawer'
 
 const OVERLAY_DURATIONS: Record<OverlayKind, { in: number; out: number }> = {