@skyhook-io/k8s-ui 1.7.11 → 1.7.13

package/src/utils/custom-columns.test.ts

@@ -0,0 +1,111 @@
+import { describe, it, expect } from 'vitest'
+import { customColumnKey, readCustomColumnValue, sanitizeCustomColumnDefs } from './custom-columns'
+
+describe('customColumnKey', () => {
+  it('encodes source and path', () => {
+    expect(customColumnKey({ source: 'label', path: 'topology.kubernetes.io/zone' })).toBe('label:topology.kubernetes.io/zone')
+    expect(customColumnKey({ source: 'annotation', path: 'foo/bar' })).toBe('annotation:foo/bar')
+  })
+
+  it('produces equal keys for same source+path (dedupe contract)', () => {
+    const a = customColumnKey({ source: 'label', path: 'x' })
+    const b = customColumnKey({ source: 'label', path: 'x' })
+    expect(a).toBe(b)
+  })
+
+  it('distinguishes source for the same path', () => {
+    expect(customColumnKey({ source: 'label', path: 'x' }))
+      .not.toBe(customColumnKey({ source: 'annotation', path: 'x' }))
+  })
+})
+
+describe('readCustomColumnValue', () => {
+  const res = (meta: any) => ({ metadata: meta })
+
+  it('reads a label value', () => {
+    expect(readCustomColumnValue(res({ labels: { zone: 'us-east-1a' } }), { source: 'label', path: 'zone' })).toBe('us-east-1a')
+  })
+
+  it('reads an annotation value', () => {
+    expect(readCustomColumnValue(res({ annotations: { team: 'infra' } }), { source: 'annotation', path: 'team' })).toBe('infra')
+  })
+
+  it('does not cross labels and annotations', () => {
+    const r = res({ labels: { k: 'fromLabel' }, annotations: { k: 'fromAnnotation' } })
+    expect(readCustomColumnValue(r, { source: 'label', path: 'k' })).toBe('fromLabel')
+    expect(readCustomColumnValue(r, { source: 'annotation', path: 'k' })).toBe('fromAnnotation')
+  })
+
+  it('returns empty string for a missing key', () => {
+    expect(readCustomColumnValue(res({ labels: { a: '1' } }), { source: 'label', path: 'b' })).toBe('')
+  })
+
+  it('returns empty string when metadata/bag is absent', () => {
+    expect(readCustomColumnValue({}, { source: 'label', path: 'b' })).toBe('')
+    expect(readCustomColumnValue(res({}), { source: 'annotation', path: 'b' })).toBe('')
+    expect(readCustomColumnValue(undefined, { source: 'label', path: 'b' })).toBe('')
+  })
+
+  it('coerces non-string values, but maps null/undefined to empty (not the literal "null")', () => {
+    expect(readCustomColumnValue(res({ labels: { n: 5 as any } }), { source: 'label', path: 'n' })).toBe('5')
+    expect(readCustomColumnValue(res({ labels: { n: null as any } }), { source: 'label', path: 'n' })).toBe('')
+  })
+})
+
+describe('sanitizeCustomColumnDefs', () => {
+  it('returns [] for non-array input', () => {
+    expect(sanitizeCustomColumnDefs(undefined)).toEqual([])
+    expect(sanitizeCustomColumnDefs(null)).toEqual([])
+    expect(sanitizeCustomColumnDefs({ source: 'label', path: 'x' })).toEqual([])
+    expect(sanitizeCustomColumnDefs('label:x')).toEqual([])
+  })
+
+  it('keeps well-formed defs', () => {
+    const defs = [
+      { source: 'label', path: 'zone' },
+      { source: 'annotation', path: 'team' },
+    ]
+    expect(sanitizeCustomColumnDefs(defs)).toEqual(defs)
+  })
+
+  it('drops entries with invalid source, missing or blank path', () => {
+    const raw = [
+      { source: 'label', path: 'good' },
+      { source: 'lable', path: 'typo-source' },
+      { source: 'label', path: '' },
+      { source: 'label', path: '   ' },
+      { source: 'annotation' },
+      null,
+      'label:x',
+    ]
+    expect(sanitizeCustomColumnDefs(raw)).toEqual([{ source: 'label', path: 'good' }])
+  })
+
+  it('drops a non-string path without throwing (predicate short-circuits before trim)', () => {
+    const raw = [
+      { source: 'label', path: 42 },
+      { source: 'label', path: { nested: true } },
+      { source: 'annotation', path: 'ok' },
+    ]
+    expect(() => sanitizeCustomColumnDefs(raw)).not.toThrow()
+    expect(sanitizeCustomColumnDefs(raw)).toEqual([{ source: 'annotation', path: 'ok' }])
+  })
+
+  it('trims paths so the load path matches the add path', () => {
+    expect(sanitizeCustomColumnDefs([{ source: 'label', path: '  zone  ' }]))
+      .toEqual([{ source: 'label', path: 'zone' }])
+  })
+
+  it('dedupes by key, keeping the first occurrence', () => {
+    const raw = [
+      { source: 'label', path: 'zone' },
+      { source: 'label', path: 'zone' },
+      { source: 'label', path: ' zone ' },
+      { source: 'annotation', path: 'zone' },
+    ]
+    expect(sanitizeCustomColumnDefs(raw)).toEqual([
+      { source: 'label', path: 'zone' },
+      { source: 'annotation', path: 'zone' },
+    ])
+  })
+})

package/src/utils/custom-columns.ts

@@ -0,0 +1,49 @@
+// User-defined table columns sourcing a metadata.labels[path] or
+// metadata.annotations[path] value. Persisted per-kind in localStorage and
+// materialized (in ResourcesView) into a self-contained ExtraColumn so they
+// ride the existing render/sort/filter override rails.
+
+export type CustomColumnSource = 'label' | 'annotation'
+
+export interface CustomColumnDef {
+  source: CustomColumnSource
+  path: string
+}
+
+// Stable identity used as the React key, ExtraColumn.key, visibility-set
+// membership, and dedupe key. Built-in column keys never use a `:` prefix, so
+// `label:`/`annotation:` can't collide with them. Build-only — never parsed
+// back into source+path, so a colon inside `path` is harmless.
+export function customColumnKey(d: CustomColumnDef): string {
+  return `${d.source}:${d.path}`
+}
+
+export function readCustomColumnValue(resource: any, d: CustomColumnDef): string {
+  const bag = d.source === 'label' ? resource?.metadata?.labels : resource?.metadata?.annotations
+  const v = bag?.[d.path]
+  return typeof v === 'string' ? v : v == null ? '' : String(v)
+}
+
+// Drop anything that isn't a well-formed def — guards the localStorage load
+// boundary where a corrupted/hand-edited blob could otherwise be a non-array
+// (crashing a later .map) or carry empty/invalid entries (dead columns).
+// TypeScript's guarantees stop at JSON.parse, so this is the one place the
+// (source, non-empty path) invariant must be enforced at runtime. Paths are
+// trimmed and deduped by key so the load path produces the same defs the add
+// path would — a hand-edited blob can't yield a padded key or two columns
+// sharing one key.
+export function sanitizeCustomColumnDefs(raw: unknown): CustomColumnDef[] {
+  if (!Array.isArray(raw)) return []
+  const seen = new Set<string>()
+  const out: CustomColumnDef[] = []
+  for (const c of raw) {
+    if (!c || (c.source !== 'label' && c.source !== 'annotation') || typeof c.path !== 'string') continue
+    const def: CustomColumnDef = { source: c.source, path: c.path.trim() }
+    if (def.path === '') continue
+    const key = customColumnKey(def)
+    if (seen.has(key)) continue
+    seen.add(key)
+    out.push(def)
+  }
+  return out
+}

package/src/utils/extended-resources.test.ts

@@ -0,0 +1,152 @@
+import { describe, it, expect } from 'vitest'
+import {
+  isGpuResourceKey,
+  isGpuCountKey,
+  getEffectiveResourceValue,
+  getEffectiveResources,
+  getPodGpuCount,
+  getNodeGpuCount,
+  getExtendedCapacityRows,
+} from './extended-resources'
+
+describe('isGpuResourceKey', () => {
+  it('matches vendor whole-GPU keys', () => {
+    expect(isGpuResourceKey('nvidia.com/gpu')).toBe(true)
+    expect(isGpuResourceKey('amd.com/gpu')).toBe(true)
+  })
+  it('matches NVIDIA MIG slices', () => {
+    expect(isGpuResourceKey('nvidia.com/mig-1g.5gb')).toBe(true)
+  })
+  it('matches the Intel gpu.intel.com family', () => {
+    expect(isGpuResourceKey('gpu.intel.com/i915')).toBe(true)
+    expect(isGpuResourceKey('gpu.intel.com/millicores')).toBe(true)
+  })
+  it('rejects non-GPU keys', () => {
+    expect(isGpuResourceKey('cpu')).toBe(false)
+    expect(isGpuResourceKey('hugepages-2Mi')).toBe(false)
+    expect(isGpuResourceKey('example.com/fpga')).toBe(false)
+  })
+})
+
+describe('isGpuCountKey', () => {
+  it('excludes fractional Intel dimensions', () => {
+    expect(isGpuCountKey('gpu.intel.com/millicores')).toBe(false)
+    expect(isGpuCountKey('gpu.intel.com/memory.max')).toBe(false)
+    expect(isGpuCountKey('gpu.intel.com/tiles')).toBe(false)
+  })
+  it('includes count-like keys', () => {
+    expect(isGpuCountKey('nvidia.com/gpu')).toBe(true)
+    expect(isGpuCountKey('nvidia.com/mig-3g.20gb')).toBe(true)
+    expect(isGpuCountKey('gpu.intel.com/i915')).toBe(true)
+  })
+})
+
+describe('getEffectiveResourceValue', () => {
+  it('falls back to limits when requests omit the key (canonical GPU form)', () => {
+    const resources = { limits: { 'nvidia.com/gpu': '2' } }
+    expect(getEffectiveResourceValue(resources, 'nvidia.com/gpu')).toBe('2')
+  })
+  it('prefers an explicit request', () => {
+    const resources = { requests: { 'nvidia.com/gpu': '1' }, limits: { 'nvidia.com/gpu': '1' } }
+    expect(getEffectiveResourceValue(resources, 'nvidia.com/gpu')).toBe('1')
+  })
+  it('returns undefined when absent', () => {
+    expect(getEffectiveResourceValue({}, 'nvidia.com/gpu')).toBeUndefined()
+    expect(getEffectiveResourceValue(undefined, 'nvidia.com/gpu')).toBeUndefined()
+  })
+})
+
+describe('getPodGpuCount', () => {
+  it('sums limits-only GPU containers', () => {
+    const pod = {
+      spec: {
+        containers: [
+          { resources: { limits: { 'nvidia.com/gpu': '2' } } },
+          { resources: { limits: { 'nvidia.com/gpu': '1' } } },
+        ],
+      },
+    }
+    expect(getPodGpuCount(pod)).toBe(3)
+  })
+  it('applies max(sum(containers), max(initContainers))', () => {
+    const pod = {
+      spec: {
+        containers: [{ resources: { limits: { 'nvidia.com/gpu': '1' } } }],
+        initContainers: [{ resources: { limits: { 'nvidia.com/gpu': '4' } } }],
+      },
+    }
+    expect(getPodGpuCount(pod)).toBe(4)
+  })
+  it('counts MIG slices but not fractional Intel dimensions', () => {
+    const pod = {
+      spec: {
+        containers: [
+          { resources: { limits: { 'nvidia.com/mig-1g.5gb': '2', 'gpu.intel.com/millicores': '500' } } },
+        ],
+      },
+    }
+    expect(getPodGpuCount(pod)).toBe(2)
+  })
+  it('returns 0 for GPU-free pods and malformed values', () => {
+    expect(getPodGpuCount({ spec: { containers: [{ resources: { limits: { cpu: '1' } } }] } })).toBe(0)
+    expect(getPodGpuCount({ spec: { containers: [{ resources: { limits: { 'nvidia.com/gpu': 'x' } } }] } })).toBe(0)
+    expect(getPodGpuCount({})).toBe(0)
+  })
+  it('parses K8s quantity suffixes (3000m = 3, 3k = 3000)', () => {
+    expect(getPodGpuCount({ spec: { containers: [{ resources: { limits: { 'nvidia.com/gpu': '3000m' } } }] } })).toBe(3)
+    expect(getPodGpuCount({ spec: { containers: [{ resources: { limits: { 'nvidia.com/gpu': '3k' } } }] } })).toBe(3000)
+  })
+})
+
+describe('getEffectiveResources', () => {
+  it('merges limits-only keys with explicit requests', () => {
+    const resources = {
+      requests: { cpu: '100m' },
+      limits: { cpu: '200m', 'nvidia.com/gpu': '1' },
+    }
+    expect(getEffectiveResources(resources)).toEqual({ cpu: '100m', 'nvidia.com/gpu': '1' })
+  })
+  it('returns empty for missing blocks', () => {
+    expect(getEffectiveResources(undefined)).toEqual({})
+    expect(getEffectiveResources({})).toEqual({})
+  })
+})
+
+describe('getNodeGpuCount', () => {
+  it('sums allocatable count-like GPU keys', () => {
+    const node = { status: { allocatable: { 'nvidia.com/gpu': '8', cpu: '64' } } }
+    expect(getNodeGpuCount(node)).toBe(8)
+  })
+  it('returns 0 without GPU keys', () => {
+    expect(getNodeGpuCount({ status: { allocatable: { cpu: '64' } } })).toBe(0)
+    expect(getNodeGpuCount({})).toBe(0)
+  })
+})
+
+describe('getExtendedCapacityRows', () => {
+  it('excludes the curated standard keys and sorts GPU rows first', () => {
+    const capacity = {
+      cpu: '64',
+      memory: '256Gi',
+      pods: '110',
+      'ephemeral-storage': '1Ti',
+      'hugepages-1Gi': '2Gi',
+      'nvidia.com/gpu': '8',
+    }
+    const allocatable = { ...capacity, 'nvidia.com/gpu': '7' }
+    const rows = getExtendedCapacityRows(capacity, allocatable)
+    expect(rows.map(r => r.key)).toEqual(['nvidia.com/gpu', 'hugepages-1Gi'])
+    expect(rows[0]).toMatchObject({ capacity: '8', allocatable: '7', isGpu: true })
+  })
+  it('drops all-zero rows (every node advertises hugepages-* as 0)', () => {
+    const capacity = { cpu: '4', 'hugepages-2Mi': '0', 'hugepages-1Gi': '0' }
+    expect(getExtendedCapacityRows(capacity, capacity)).toEqual([])
+  })
+  it('handles keys present on only one side', () => {
+    const rows = getExtendedCapacityRows({ 'amd.com/gpu': '4' }, {})
+    expect(rows).toEqual([{ key: 'amd.com/gpu', capacity: '4', allocatable: undefined, isGpu: true }])
+  })
+  it('returns empty for nodes with only standard resources', () => {
+    expect(getExtendedCapacityRows({ cpu: '4', memory: '8Gi' }, { cpu: '4' })).toEqual([])
+  })
+})

package/src/utils/extended-resources.ts

@@ -0,0 +1,121 @@
+// Extended-resource (GPU etc.) helpers shared by table cells, renderers, and
+// the GPU views. Keep all effective-request math here — K8s semantics for
+// extended resources are subtle and must not be reimplemented per call site.
+
+import { parseMemoryToBytes } from './format'
+
+const STANDARD_NODE_RESOURCES = new Set(['cpu', 'memory', 'pods', 'ephemeral-storage'])
+
+// Broad GPU detection for badging/labeling: whole-GPU keys (nvidia.com/gpu,
+// amd.com/gpu), NVIDIA MIG slices, and Intel's gpu.intel.com family
+// (i915/xe/millicores/memory.max/tiles).
+export function isGpuResourceKey(key: string): boolean {
+  return key.endsWith('/gpu') || key.startsWith('nvidia.com/mig-') || key.startsWith('gpu.intel.com/')
+}
+
+// Count-like GPU keys only — values that mean "N devices/slices". Excludes
+// fractional dimensions (gpu.intel.com/millicores, memory.max, tiles) whose
+// numbers would distort a device count.
+export function isGpuCountKey(key: string): boolean {
+  return (
+    key.endsWith('/gpu') ||
+    key.startsWith('nvidia.com/mig-') ||
+    key === 'gpu.intel.com/i915' ||
+    key === 'gpu.intel.com/xe'
+  )
+}
+
+// GPUs are canonically specified in limits only: the request defaults to the
+// limit, and the two must be equal when both are set (no overcommit).
+export function getEffectiveResourceValue(resources: any, key: string): string | undefined {
+  return resources?.requests?.[key] ?? resources?.limits?.[key]
+}
+
+// Merged per-key effective view of a container resources block. Needed for pod
+// TEMPLATES (workload detail): apiserver defaulting copies limits→requests only
+// on live Pods, never on templates, so limits-only GPU templates have no requests.
+export function getEffectiveResources(resources: any): Record<string, string> {
+  const keys = new Set([
+    ...Object.keys(resources?.requests || {}),
+    ...Object.keys(resources?.limits || {}),
+  ])
+  const out: Record<string, string> = {}
+  for (const key of keys) {
+    const value = getEffectiveResourceValue(resources, key)
+    if (value !== undefined) out[key] = value
+  }
+  return out
+}
+
+// K8s quantity → number. Counts are usually plain integers, but quantities may
+// legally carry suffixes: "3000m" is 3, "3k" is 3000.
+function asCount(value: unknown): number {
+  if (typeof value === 'number') return Number.isFinite(value) ? value : 0
+  const s = String(value ?? '').trim()
+  if (!s) return 0
+  if (/^\d+(\.\d+)?m$/.test(s)) return Number(s.slice(0, -1)) / 1000
+  const n = parseMemoryToBytes(s)
+  return Number.isFinite(n) ? n : 0
+}
+
+function containerGpuCount(container: any): number {
+  const resources = container?.resources
+  const keys = new Set([
+    ...Object.keys(resources?.requests || {}),
+    ...Object.keys(resources?.limits || {}),
+  ])
+  let total = 0
+  for (const key of keys) {
+    if (isGpuCountKey(key)) total += asCount(getEffectiveResourceValue(resources, key))
+  }
+  return total
+}
+
+// Effective pod GPU count per scheduling semantics:
+// max(sum of regular containers, largest init container).
+export function getPodGpuCount(pod: any): number {
+  const containers: any[] = pod?.spec?.containers || []
+  const initContainers: any[] = pod?.spec?.initContainers || []
+  const regular = containers.reduce((sum, c) => sum + containerGpuCount(c), 0)
+  const init = initContainers.reduce((max, c) => Math.max(max, containerGpuCount(c)), 0)
+  return Math.max(regular, init)
+}
+
+export function getNodeGpuCount(node: any): number {
+  const allocatable = node?.status?.allocatable || {}
+  let total = 0
+  for (const [key, value] of Object.entries(allocatable)) {
+    if (isGpuCountKey(key)) total += asCount(value)
+  }
+  return total
+}
+
+export interface ExtendedCapacityRow {
+  key: string
+  capacity?: string
+  allocatable?: string
+  isGpu: boolean
+}
+
+// Node capacity/allocatable keys beyond the curated cpu/memory/pods/ephemeral-storage
+// rows (hugepages, attachable-volumes, vendor GPU keys, ...). GPU keys sort first.
+// All-zero rows are dropped — every node advertises hugepages-* as "0".
+export function getExtendedCapacityRows(capacity: any, allocatable: any): ExtendedCapacityRow[] {
+  const keys = new Set([...Object.keys(capacity || {}), ...Object.keys(allocatable || {})])
+  const rows: ExtendedCapacityRow[] = []
+  for (const key of keys) {
+    if (STANDARD_NODE_RESOURCES.has(key)) continue
+    if ((capacity?.[key] ?? '0') === '0' && (allocatable?.[key] ?? '0') === '0') continue
+    rows.push({
+      key,
+      capacity: capacity?.[key],
+      allocatable: allocatable?.[key],
+      isGpu: isGpuResourceKey(key),
+    })
+  }
+  rows.sort((a, b) => {
+    if (a.isGpu !== b.isGpu) return a.isGpu ? -1 : 1
+    return a.key.localeCompare(b.key)
+  })
+  return rows
+}

package/src/utils/format.ts

@@ -259,3 +259,14 @@ export function formatBytes(bytes: number): string {
   const i = Math.floor(Math.log(bytes) / Math.log(k))
   return `${parseFloat((bytes / Math.pow(k, i)).toFixed(1))} ${sizes[i]}`
 }
+
+/** Middle-ellipsis for long identifiers (image tags, pod names): keeps the
+ *  start and the differentiating suffix. Returns the input when it fits. */
+export function midTruncate(s: string, max = 24): string {
+  if (s.length <= max) return s
+  if (max <= 1) return '…'.slice(0, Math.max(0, max))
+  if (max <= 3) return `${s.slice(0, max - 1)}…`
+  const tail = Math.min(10, Math.floor(max / 2) - 1)
+  const head = max - tail - 1
+  return `${s.slice(0, head)}…${s.slice(-tail)}`
+}

package/src/utils/index.ts

@@ -9,6 +9,7 @@ export * from './resource-hierarchy'
 export * from './log-format'
 export * from './download'
 export * from './env-from'
+export * from './extended-resources'
 export * from './api-resources'
 export * from './skeleton-yaml'
 export * from './k8s-errors'
@@ -19,3 +20,5 @@ export * from './gitops-owner'
 export * from './gitops-route'
 export * from './rbac-badges'
 export * from './git-provider-urls'
+export * from './applications'
+export * from './topology-neighborhood'

package/src/utils/topology-neighborhood.test.ts

@@ -0,0 +1,185 @@
+import { describe, it, expect } from 'vitest'
+import { neighborhoodFor, tagWorkloadOwnership } from './topology-neighborhood'
+import type { Topology, NodeKind, EdgeType } from '../types/core'
+
+function node(id: string, kind: string, ns: string, name: string): Topology['nodes'][number] {
+  return { id, kind: kind as NodeKind, name, status: 'healthy' as Topology['nodes'][number]['status'], data: { namespace: ns } }
+}
+function edge(source: string, target: string, type: EdgeType): Topology['edges'][number] {
+  return { id: `${source}->${target}`, source, target, type }
+}
+
+describe('neighborhoodFor', () => {
+  // Deployment → ReplicaSet → Pod (manages), plus a Service exposing it and a
+  // ConfigMap configuring it. All of it is the workload's neighborhood.
+  it('includes the ownership chain + attached context', () => {
+    const topo: Topology = {
+      nodes: [
+        node('dep', 'Deployment', 'app', 'web'),
+        node('rs', 'ReplicaSet', 'app', 'web-abc'),
+        node('pod', 'Pod', 'app', 'web-abc-1'),
+        node('svc', 'Service', 'app', 'web'),
+        node('cm', 'ConfigMap', 'app', 'web-config'),
+      ],
+      edges: [
+        edge('dep', 'rs', 'manages'),
+        edge('rs', 'pod', 'manages'),
+        edge('svc', 'dep', 'exposes'),
+        edge('cm', 'dep', 'configures'),
+      ],
+    }
+    const out = neighborhoodFor(topo, [{ kind: 'Deployment', namespace: 'app', name: 'web' }])
+    expect(new Set(out.nodes.map((n) => n.id))).toEqual(new Set(['dep', 'rs', 'pod', 'svc', 'cm']))
+  })
+
+  // The leaf rule: a ConfigMap shared by two unrelated Deployments must NOT
+  // bridge the second Deployment into the first's neighborhood.
+  it('does not bleed through a shared ConfigMap', () => {
+    const topo: Topology = {
+      nodes: [
+        node('depA', 'Deployment', 'app', 'a'),
+        node('depB', 'Deployment', 'app', 'b'),
+        node('cm', 'ConfigMap', 'app', 'shared'),
+      ],
+      edges: [
+        edge('cm', 'depA', 'configures'),
+        edge('cm', 'depB', 'configures'),
+      ],
+    }
+    const out = neighborhoodFor(topo, [{ kind: 'Deployment', namespace: 'app', name: 'a' }])
+    const ids = new Set(out.nodes.map((n) => n.id))
+    expect(ids.has('depA')).toBe(true)
+    expect(ids.has('cm')).toBe(true) // the shared ConfigMap IS shown (context)
+    expect(ids.has('depB')).toBe(false) // …but it doesn't drag in the other app
+  })
+
+  // A GitOps manager reached upward is a leaf: "managed by" is shown, but its
+  // sibling workloads are not pulled in.
+  it('does not expand through a GitOps manager to its siblings', () => {
+    const topo: Topology = {
+      nodes: [
+        node('ks', 'Kustomization', 'flux-system', 'apps'),
+        node('depA', 'Deployment', 'app', 'a'),
+        node('depB', 'Deployment', 'app', 'b'),
+      ],
+      edges: [
+        edge('ks', 'depA', 'manages'),
+        edge('ks', 'depB', 'manages'),
+      ],
+    }
+    const out = neighborhoodFor(topo, [{ kind: 'Deployment', namespace: 'app', name: 'a' }])
+    const ids = new Set(out.nodes.map((n) => n.id))
+    expect(ids.has('depA')).toBe(true)
+    expect(ids.has('ks')).toBe(true) // the managing Kustomization is shown
+    expect(ids.has('depB')).toBe(false) // …but not the Kustomization's other app
+  })
+
+  // Upward manages is context for ANY manager kind, not just GitOps: a seed
+  // Job shows its CronJob ("managed by") without dragging in sibling Jobs.
+  it('does not expand upward through a CronJob to sibling Jobs', () => {
+    const topo: Topology = {
+      nodes: [
+        node('cj', 'CronJob', 'app', 'nightly'),
+        node('job1', 'Job', 'app', 'nightly-001'),
+        node('job2', 'Job', 'app', 'nightly-002'),
+        node('pod2', 'Pod', 'app', 'nightly-002-x'),
+      ],
+      edges: [
+        edge('cj', 'job1', 'manages'),
+        edge('cj', 'job2', 'manages'),
+        edge('job2', 'pod2', 'manages'),
+      ],
+    }
+    const out = neighborhoodFor(topo, [{ kind: 'Job', namespace: 'app', name: 'nightly-001' }])
+    const ids = new Set(out.nodes.map((n) => n.id))
+    expect(ids.has('job1')).toBe(true)
+    expect(ids.has('cj')).toBe(true) // the managing CronJob is shown…
+    expect(ids.has('job2')).toBe(false) // …but its sibling Jobs are not
+    expect(ids.has('pod2')).toBe(false)
+  })
+
+  // The degree guard targets shared infra (routing/context), not ownership: a
+  // workload with more than K pods must still keep every pod — the ReplicaSet
+  // in between must not be leafed for high manages-fan-out.
+  it('keeps all pods of a large workload (degree guard exempts ownership)', () => {
+    const pods = Array.from({ length: 10 }, (_, i) => node(`pod${i}`, 'Pod', 'app', `web-${i}`))
+    const topo: Topology = {
+      nodes: [node('dep', 'Deployment', 'app', 'web'), node('rs', 'ReplicaSet', 'app', 'web-abc'), ...pods],
+      edges: [edge('dep', 'rs', 'manages'), ...pods.map((p) => edge('rs', p.id, 'manages'))],
+    }
+    const out = neighborhoodFor(topo, [{ kind: 'Deployment', namespace: 'app', name: 'web' }])
+    const ids = new Set(out.nodes.map((n) => n.id))
+    expect(ids.has('rs')).toBe(true)
+    for (const p of pods) expect(ids.has(p.id)).toBe(true)
+  })
+
+  it('returns an empty graph with a warning when no seed matches', () => {
+    const topo: Topology = { nodes: [node('dep', 'Deployment', 'app', 'web')], edges: [] }
+    const out = neighborhoodFor(topo, [{ kind: 'Deployment', namespace: 'app', name: 'missing' }])
+    expect(out.nodes).toHaveLength(0)
+    expect(out.warnings?.some((w) => w.includes('No topology nodes matched'))).toBe(true)
+  })
+})
+
+describe('tagWorkloadOwnership', () => {
+  const dataOf = (t: Topology, id: string) => t.nodes.find((n) => n.id === id)!.data as Record<string, unknown>
+
+  // Two workloads, each with its own Service + Pod, plus one shared ConfigMap.
+  // Each workload owns its exclusive satellites; the shared ConfigMap is neutral.
+  it('tags exclusive satellites + pods with their workload, shared as neutral', () => {
+    const topo: Topology = {
+      nodes: [
+        node('depA', 'Deployment', 'app', 'a'),
+        node('podA', 'Pod', 'app', 'a-1'),
+        node('svcA', 'Service', 'app', 'a'),
+        node('depB', 'Deployment', 'app', 'b'),
+        node('podB', 'Pod', 'app', 'b-1'),
+        node('shared', 'ConfigMap', 'app', 'shared'),
+      ],
+      edges: [
+        edge('depA', 'podA', 'manages'),
+        edge('svcA', 'depA', 'exposes'),
+        edge('depB', 'podB', 'manages'),
+        edge('shared', 'depA', 'configures'),
+        edge('shared', 'depB', 'configures'),
+      ],
+    }
+    const { topology, colorByWorkload } = tagWorkloadOwnership(topo, [
+      { kind: 'Deployment', namespace: 'app', name: 'a' },
+      { kind: 'Deployment', namespace: 'app', name: 'b' },
+    ])
+    const a = colorByWorkload.get('Deployment/app/a')
+    const b = colorByWorkload.get('Deployment/app/b')
+    expect(a).not.toBe(b)
+    // a's core + its exclusive Service carry a's color; its pod inherits it.
+    expect(dataOf(topology, 'depA').ownerWorkloadId).toBe('Deployment/app/a')
+    expect(dataOf(topology, 'podA').ownerColorIndex).toBe(a)
+    expect(dataOf(topology, 'svcA').ownerColorIndex).toBe(a)
+    expect(dataOf(topology, 'podB').ownerColorIndex).toBe(b)
+    // the ConfigMap touches both workloads → neutral color…
+    expect(dataOf(topology, 'shared').ownerWorkloadId).toBeNull()
+    expect(dataOf(topology, 'shared').ownerColorIndex).toBeNull()
+    // …but its focus set includes BOTH, so focusing either lights it up.
+    expect(new Set(dataOf(topology, 'shared').focusWorkloadIds as string[])).toEqual(
+      new Set(['Deployment/app/a', 'Deployment/app/b']),
+    )
+    // an exclusive satellite's focus set is just its own workload.
+    expect(dataOf(topology, 'svcA').focusWorkloadIds).toEqual(['Deployment/app/a'])
+  })
+
+  // A GitOps manager is context, not membership — it never claims a color even
+  // when it manages a single workload in the neighborhood.
+  it('leaves a GitOps manager neutral', () => {
+    const topo: Topology = {
+      nodes: [
+        node('ks', 'Kustomization', 'flux-system', 'apps'),
+        node('dep', 'Deployment', 'app', 'web'),
+        node('pod', 'Pod', 'app', 'web-1'),
+      ],
+      edges: [edge('ks', 'dep', 'manages'), edge('dep', 'pod', 'manages')],
+    }
+    const { topology } = tagWorkloadOwnership(topo, [{ kind: 'Deployment', namespace: 'app', name: 'web' }])
+    expect(dataOf(topology, 'ks').ownerWorkloadId).toBeNull()
+    expect(dataOf(topology, 'pod').ownerWorkloadId).toBe('Deployment/app/web')
+  })
+})