@skyhook-io/k8s-ui 1.8.10 → 1.8.11

package/src/components/workload/index.ts

@@ -1,2 +1,2 @@
-export { WorkloadView, type WorkloadTabType } from './WorkloadView'
+export { WorkloadView, type ResourceOwnershipContext, type ServingResourceDetail, type WorkloadTabType } from './WorkloadView'
 export { ResourceDetailDrawer } from './ResourceDetailDrawer'

package/src/theme/variables.css

@@ -156,6 +156,6 @@
   --shadow-sm: 0 1px 3px rgba(0,0,0,0.3), 0 1px 2px rgba(0,0,0,0.2), 0 0 0 1px rgba(255,255,255,0.06);
   --shadow-md: 0 4px 12px -2px rgba(0,0,0,0.35), 0 2px 4px rgba(0,0,0,0.15), 0 0 0 1px rgba(255,255,255,0.06);
   --shadow-lg: 0 12px 32px -6px rgba(0,0,0,0.3), 0 4px 8px rgba(0,0,0,0.1);
-  --shadow-drawer: -16px 0 60px rgba(0,0,0,0.6), -6px 0 20px rgba(0,0,0,0.4);
+  --shadow-drawer: -12px 0 36px rgba(0,0,0,0.45), -4px 0 14px rgba(0,0,0,0.3), 0 0 0 1px rgba(255,255,255,0.06);
   --topology-node-shadow: 0 2px 6px rgba(0,0,0,0.2), 0 6px 16px rgba(0,0,0,0.15);
 }

package/src/types/core.ts

@@ -11,6 +11,7 @@ export interface ResourcePermissions {
   statefulSets: boolean
   replicaSets: boolean
   ingresses: boolean
+  ingressClasses: boolean
   configMaps: boolean
   secrets: boolean
   events: boolean
@@ -94,7 +95,6 @@ export interface Deployment {
 // When adding a new kind here, also update:
 // - ALL_NODE_KINDS in App.tsx
 // - TopologyFilterSidebar.tsx RESOURCE_KINDS array
-// - index.css .topology-icon-* class
 // - K8sResourceNode.tsx NODE_DIMENSIONS
 // - resource-icons.ts KIND_ICON_MAP
 // - kindToPlural in navigation.ts (if irregular plural)
@@ -123,9 +123,17 @@ export type CoreNodeKind =
   | 'PodGroup'
   | 'ConfigMap'
   | 'Secret'
+  | 'ServiceAccount'
+  | 'SealedSecret'
+  | 'ServiceMonitor'
+  | 'PodMonitor'
   | 'HorizontalPodAutoscaler'
   | 'Job'
   | 'CronJob'
+  | 'Workflow'
+  | 'CronWorkflow'
+  | 'WorkflowTemplate'
+  | 'ClusterWorkflowTemplate'
   | 'PersistentVolumeClaim'
   | 'Node'
   | 'Namespace'
@@ -168,6 +176,10 @@ export function displayKind(kind: string): string {
   const shortNames: Record<string, string> = {
     HorizontalPodAutoscaler: 'HPA',
     PersistentVolumeClaim: 'PVC',
+    ServiceAccount: 'Service Account',
+    SealedSecret: 'Sealed Secret',
+    ServiceMonitor: 'Service Monitor',
+    PodMonitor: 'Pod Monitor',
     EC2NodeClass: 'NodeClass',
     KnativeService: 'Knative Svc',
     KnativeConfiguration: 'Knative Config',
@@ -275,6 +287,10 @@ export interface TimelineEvent {
   id: string
   timestamp: string // ISO date string
   source: EventSource // Where event originated: 'informer', 'k8s_event', 'historical'
+  // Store-assigned arrival number (monotonic per store instance). The delta
+  // cursor keys on it — arrival order, not event time, so late-arriving
+  // events can't slip behind a client's cursor.
+  seq?: number
 
   // Resource identity
   kind: string
@@ -339,6 +355,20 @@ export function isWorkloadKind(kind: string): boolean {
   ].includes(kind)
 }
 
+export function isDeploymentLikeWorkloadKind(kind: string, group = ''): boolean {
+  switch (kind) {
+    case 'Deployment':
+    case 'ReplicaSet':
+    case 'StatefulSet':
+    case 'DaemonSet':
+      return group === '' || group === 'apps'
+    case 'Rollout':
+      return group === '' || group === 'argoproj.io'
+    default:
+      return false
+  }
+}
+
 // Check if a resource kind is typically managed by another
 export function isManagedKind(kind: string): boolean {
   return ['ReplicaSet', 'Pod', 'Event'].includes(kind)
@@ -353,7 +383,7 @@ export interface TimelineFilters {
   timeRange: TimeRange
 }
 
-export type TimeRange = '5m' | '30m' | '1h' | '6h' | '24h' | 'all'
+export type TimeRange = '5m' | '30m' | '1h' | '6h' | '24h' | '7d' | '30d' | 'all'
 
 // Cluster info
 export interface ClusterInfo {
@@ -445,6 +475,7 @@ export interface Relationships {
   configRefs?: ResourceRef[]
   consumers?: ResourceRef[]
   scalers?: ResourceRef[]
+  storageRefs?: ResourceRef[]
   scaleTarget?: ResourceRef
   pdbs?: ResourceRef[]              // PodDisruptionBudgets protecting this workload
   networkPolicies?: ResourceRef[]   // NetworkPolicy / CiliumNetworkPolicy / ClusterNetworkPolicy variants selecting this workload
@@ -822,9 +853,11 @@ export interface UpgradeInfo {
   // oci:// chart reference an OCI-sourced upgrade lives at (display only).
   chartRef?: string
   error?: string
+  // Machine-readable source-resolution failure, used to make the Helm drawer
+  // explain whether tracking an OCI source can help.
+  sourceIssue?: 'untracked' | 'repo_index_error' | 'ambiguous_repository'
   // True only when the error is a genuinely untracked source (registering a
-  // chart source could fix it) — NOT for repo-side errors like a stale index or
-  // classic ambiguity. Gates the "track source" affordance.
+  // chart source could fix it). Kept for compatibility; prefer sourceIssue.
   untracked?: boolean
 }
 
@@ -836,6 +869,8 @@ export interface BatchUpgradeInfo {
 // Request body for applying new values to a release
 export interface ApplyValuesRequest {
   values: Record<string, unknown>
+  version?: string
+  repository?: string
 }
 
 // Response for previewing values changes
@@ -1234,10 +1269,28 @@ export interface ImageMetadata {
 // ============================================================================
 
 // Pod info returned from workload pods endpoint
+export interface WorkloadPodContainerInfo {
+  name: string
+  init?: boolean
+  ready: boolean
+  restartCount: number
+}
+
 export interface WorkloadPodInfo {
   name: string
   containers: string[]
   ready: boolean
+  phase?: string
+  healthLevel?: HealthStatus
+  reason?: string
+  message?: string
+  restartCount?: number
+  lastTerminationReason?: string
+  createdAt?: string
+  containerStatuses?: WorkloadPodContainerInfo[]
+  stepID?: string
+  stepName?: string
+  stepPhase?: string
 }
 
 // SSE event types for workload log streaming

package/src/utils/application-topology.test.ts

@@ -0,0 +1,198 @@
+import { describe, expect, it } from 'vitest'
+import type { GitOpsResourceTree, Topology } from '../types'
+import { collapseStableReplicaSets, deploymentInventoryFromGitOps, deploymentInventoryFromHelm, layerDeploymentInventory, topologyGroup } from './application-topology'
+
+const topology: Topology = {
+  nodes: [
+    { id: 'deployment/default/api', kind: 'Deployment', name: 'api', status: 'healthy', data: { namespace: 'default', apiVersion: 'apps/v1' } },
+    { id: 'service/default/external', kind: 'Service', name: 'external', status: 'healthy', data: { namespace: 'default', apiVersion: 'v1' } },
+  ],
+  edges: [],
+}
+
+it('resolves the stored API group for source-only CRD nodes', () => {
+  expect(topologyGroup({
+    id: 'source/prometheusrule',
+    kind: 'PrometheusRule',
+    name: 'alerts',
+    status: 'healthy',
+    data: { namespace: 'monitoring', sourceGroup: 'monitoring.coreos.com' },
+  })).toBe('monitoring.coreos.com')
+})
+
+function inventory(warnings?: string[]): GitOpsResourceTree {
+  const root = { id: 'root', ref: { group: 'argoproj.io', kind: 'Application', namespace: 'argocd', name: 'api' }, role: 'root' as const, tool: 'argocd' as const }
+  return {
+    root,
+    warnings,
+    edges: [],
+    nodes: [
+      root,
+      { id: 'deployment', ref: { group: 'apps', kind: 'Deployment', namespace: 'default', name: 'api' }, role: 'declared', tool: 'argocd' },
+      { id: 'config', ref: { kind: 'ConfigMap', namespace: 'default', name: 'api-config' }, role: 'declared', tool: 'argocd' },
+    ],
+  }
+}
+
+describe('layerDeploymentInventory', () => {
+  it('separates overlapping, runtime-only, and managed-only resources', () => {
+    const result = layerDeploymentInventory(topology, deploymentInventoryFromGitOps(inventory())!, 'Argo CD')
+
+    expect(result.managedRuntimeCount).toBe(1)
+    expect(result.runtimeOnlyCount).toBe(1)
+    expect(result.managedOnly.map((node) => node.name)).toEqual(['api-config'])
+    expect(result.topology.nodes[0].data?.deploymentMembership).toBeUndefined()
+    expect(result.topology.nodes[1].data?.deploymentMembership).toBe('runtime-only')
+    expect(result.topology.nodes[2]).toMatchObject({ kind: 'ConfigMap', name: 'api-config', data: { deploymentMembership: 'source-only' } })
+  })
+
+  it('does not claim runtime-only membership for a partial inventory', () => {
+    const result = layerDeploymentInventory(topology, deploymentInventoryFromGitOps(inventory(['Some resources are hidden']))!, 'Argo CD')
+
+    expect(result.inventoryComplete).toBe(false)
+    expect(result.runtimeOnlyCount).toBe(0)
+    expect(result.topology.nodes[1].data?.deploymentMembership).toBeUndefined()
+  })
+
+  it('does not claim runtime-only membership for Helm without a completeness signal', () => {
+    const helmInventory = deploymentInventoryFromHelm([{
+      apiVersion: 'apps/v1',
+      kind: 'Deployment',
+      namespace: 'default',
+      name: 'api',
+      status: 'ready',
+    }])!
+    const result = layerDeploymentInventory(topology, helmInventory, 'Helm')
+
+    expect(result.inventoryComplete).toBe(false)
+    expect(result.runtimeOnlyCount).toBe(0)
+    expect(result.topology.nodes[1].data?.deploymentMembership).toBeUndefined()
+  })
+
+  it('adds no membership markers when source and runtime agree', () => {
+    const matchingTopology: Topology = {
+      nodes: [topology.nodes[0]],
+      edges: [],
+    }
+    const matchingInventory = inventory()
+    matchingInventory.nodes = matchingInventory.nodes.filter((node) => node.id !== 'config')
+
+    const result = layerDeploymentInventory(matchingTopology, deploymentInventoryFromGitOps(matchingInventory)!, 'Argo CD')
+
+    expect(result.runtimeOnlyCount).toBe(0)
+    expect(result.managedOnly).toEqual([])
+    expect(result.topology.nodes[0].data?.deploymentMembership).toBeUndefined()
+  })
+
+  it('does not merge same-named resources from different CRD groups', () => {
+    const collisionTopology: Topology = {
+      nodes: [{ id: 'service/default/api', kind: 'Service', name: 'api', status: 'healthy', data: { namespace: 'default', apiVersion: 'serving.knative.dev/v1' } }],
+      edges: [],
+    }
+    const result = layerDeploymentInventory(collisionTopology, deploymentInventoryFromGitOps({
+      root: inventory().root,
+      edges: [],
+      nodes: [
+        inventory().root,
+        { id: 'core-service', ref: { kind: 'Service', namespace: 'default', name: 'api' }, role: 'declared', tool: 'argocd' },
+      ],
+    })!, 'Argo CD')
+
+    expect(result.managedRuntimeCount).toBe(0)
+    expect(result.runtimeOnlyCount).toBe(1)
+    expect(result.managedOnly.map((node) => node.id)).toEqual(['core-service'])
+  })
+
+  it('does not classify synthetic graph nodes as runtime-only resources', () => {
+    const syntheticTopology: Topology = {
+      nodes: [
+        { id: 'podgroup/default/api', kind: 'PodGroup', name: 'api', status: 'healthy', data: { namespace: 'default' } },
+        { id: 'internet', kind: 'Internet', name: 'Internet', status: 'healthy', data: {} },
+      ],
+      edges: [],
+    }
+    const result = layerDeploymentInventory(syntheticTopology, deploymentInventoryFromGitOps(inventory())!, 'Argo CD')
+
+    expect(result.runtimeOnlyCount).toBe(0)
+    expect(result.topology.nodes.slice(0, 2).every((node) => node.data?.deploymentMembership === undefined)).toBe(true)
+  })
+
+  it('groups repeated source-only resources so large bundles remain readable', () => {
+    const largeInventory = inventory()
+    largeInventory.nodes = [
+      largeInventory.root,
+      ...Array.from({ length: 5 }, (_, index) => ({
+        id: `rule-${index}`,
+        ref: { group: 'monitoring.coreos.com', kind: 'PrometheusRule', namespace: 'monitoring', name: `rule-${index}` },
+        role: 'declared' as const,
+        tool: 'argocd' as const,
+      })),
+    ]
+
+    const result = layerDeploymentInventory({ nodes: [], edges: [] }, deploymentInventoryFromGitOps(largeInventory)!, 'Argo CD')
+
+    expect(result.managedOnly).toHaveLength(5)
+    expect(result.topology.nodes).toHaveLength(1)
+    expect(result.topology.nodes[0]).toMatchObject({ kind: 'PrometheusRule', data: { sourceInventoryGroup: true, sourceInventoryCount: 5 } })
+  })
+
+  it('summarizes a large source-only inventory outside the graph', () => {
+    const largeInventory = inventory()
+    largeInventory.nodes = [
+      largeInventory.root,
+      ...Array.from({ length: 10 }, (_, index) => ({
+        id: `rule-${index}`,
+        ref: { group: 'monitoring.coreos.com', kind: 'PrometheusRule', namespace: 'monitoring', name: `rule-${index}` },
+        role: 'declared' as const,
+        tool: 'argocd' as const,
+      })),
+      ...Array.from({ length: 5 }, (_, index) => ({
+        id: `config-${index}`,
+        ref: { kind: 'ConfigMap', namespace: 'monitoring', name: `config-${index}` },
+        role: 'declared' as const,
+        tool: 'argocd' as const,
+      })),
+    ]
+
+    const result = layerDeploymentInventory({ nodes: [], edges: [] }, deploymentInventoryFromGitOps(largeInventory)!, 'Argo CD')
+
+    expect(result.managedOnly).toHaveLength(15)
+    expect(result.topology.nodes).toHaveLength(0)
+    expect(result.managedOnlySummary).toBe('10 PrometheusRules · 5 ConfigMaps')
+  })
+})
+
+describe('collapseStableReplicaSets', () => {
+  const replicaSetTopology: Topology = {
+    nodes: [
+      { id: 'deployment/default/api', kind: 'Deployment', name: 'api', status: 'healthy', data: { namespace: 'default' } },
+      { id: 'replicaset/default/api-abc', kind: 'ReplicaSet', name: 'api-abc', status: 'healthy', data: { namespace: 'default', readyReplicas: 2, totalReplicas: 2 } },
+      { id: 'pod/default/api-1', kind: 'Pod', name: 'api-1', status: 'healthy', data: { namespace: 'default' } },
+    ],
+    edges: [
+      { id: 'deployment-rs', source: 'deployment/default/api', target: 'replicaset/default/api-abc', type: 'manages' },
+      { id: 'rs-pod', source: 'replicaset/default/api-abc', target: 'pod/default/api-1', type: 'manages' },
+    ],
+  }
+
+  it('collapses a stable single ReplicaSet and rewires its pods', () => {
+    const result = collapseStableReplicaSets(replicaSetTopology, new Set())
+    expect(result.nodes.map((node) => node.kind)).toEqual(['Deployment', 'Pod'])
+    expect(result.edges).toContainEqual(expect.objectContaining({ source: 'deployment/default/api', target: 'pod/default/api-1' }))
+    expect(result.nodes[0].data).toMatchObject({ replicaSetCount: 1, replicaSetsCollapsed: true })
+  })
+
+  it('shows the ReplicaSet when the developer expands it', () => {
+    const result = collapseStableReplicaSets(replicaSetTopology, new Set(['deployment/default/api']))
+    expect(result.nodes.map((node) => node.kind)).toEqual(['Deployment', 'ReplicaSet', 'Pod'])
+    expect(result.nodes[0].data).toMatchObject({ replicaSetCount: 1, replicaSetsCollapsed: false })
+  })
+
+  it('keeps an unhealthy ReplicaSet visible automatically', () => {
+    const unhealthy = {
+      ...replicaSetTopology,
+      nodes: replicaSetTopology.nodes.map((node) => node.kind === 'ReplicaSet' ? { ...node, status: 'degraded' as const } : node),
+    }
+    expect(collapseStableReplicaSets(unhealthy, new Set()).nodes.map((node) => node.kind)).toContain('ReplicaSet')
+  })
+})

package/src/utils/application-topology.ts

@@ -0,0 +1,261 @@
+import type { GitOpsResourceTree, HealthStatus, HelmOwnedResource, Topology, TopologyNode } from '../types'
+import { apiVersionToGroup, groupQualifiesLaneId } from './navigation'
+import { pluralize } from './pluralize'
+
+export type DeploymentMembership = 'runtime-only' | 'source-only'
+
+export interface DeploymentInventoryNode {
+  id: string
+  kind: string
+  group?: string
+  namespace: string
+  name: string
+  role: 'declared' | 'generated'
+  status?: HealthStatus
+}
+
+export interface DeploymentInventory {
+  nodes: DeploymentInventoryNode[]
+  warnings?: string[]
+  complete?: boolean
+}
+
+export interface DeploymentTopologyLayer {
+  topology: Topology
+  managedRuntimeCount: number
+  runtimeOnlyCount: number
+  managedOnly: DeploymentInventoryNode[]
+  managedOnlySummary?: string
+  inventoryComplete: boolean
+}
+
+export function collapseStableReplicaSets(topology: Topology, expandedOwners: ReadonlySet<string>): Topology {
+  const nodesByID = new Map(topology.nodes.map((node) => [node.id, node]))
+  const replicaSetsByOwner = new Map<string, string[]>()
+  for (const edge of topology.edges) {
+    if (edge.type !== 'manages' || nodesByID.get(edge.target)?.kind !== 'ReplicaSet') continue
+    replicaSetsByOwner.set(edge.source, [...(replicaSetsByOwner.get(edge.source) ?? []), edge.target])
+  }
+
+  const collapsedReplicaSets = new Set<string>()
+  const rewiredEdges = [] as Topology['edges']
+  const parentData = new Map<string, Record<string, unknown>>()
+
+  for (const [ownerID, replicaSetIDs] of replicaSetsByOwner) {
+    const owner = nodesByID.get(ownerID)
+    const replicaSet = replicaSetIDs.length === 1 ? nodesByID.get(replicaSetIDs[0]) : undefined
+    const ready = Number(replicaSet?.data?.readyReplicas ?? 0)
+    const total = Number(replicaSet?.data?.totalReplicas ?? 0)
+    const incoming = topology.edges.filter((edge) => edge.target === replicaSet?.id)
+    const stable = owner?.status === 'healthy'
+      && replicaSet?.status === 'healthy'
+      && total > 0
+      && ready >= total
+      && incoming.every((edge) => edge.source === ownerID && edge.type === 'manages')
+    const shouldCollapse = replicaSetIDs.length === 1 && stable && !expandedOwners.has(ownerID)
+    parentData.set(ownerID, {
+      replicaSetCount: replicaSetIDs.length,
+      replicaSetsCollapsed: shouldCollapse,
+      replicaSetsExpandable: stable && replicaSetIDs.length === 1,
+    })
+    if (shouldCollapse && replicaSet) collapsedReplicaSets.add(replicaSet.id)
+  }
+
+  for (const edge of topology.edges) {
+    if (collapsedReplicaSets.has(edge.target)) continue
+    if (!collapsedReplicaSets.has(edge.source)) {
+      rewiredEdges.push(edge)
+      continue
+    }
+    const ownerEdge = topology.edges.find((candidate) => candidate.target === edge.source && candidate.type === 'manages')
+    if (!ownerEdge) continue
+    rewiredEdges.push({
+      ...edge,
+      id: `${ownerEdge.source}-to-${edge.target}`,
+      source: ownerEdge.source,
+      type: 'manages',
+    })
+  }
+
+  return {
+    ...topology,
+    nodes: topology.nodes
+      .filter((node) => !collapsedReplicaSets.has(node.id))
+      .map((node) => parentData.has(node.id) ? { ...node, data: { ...node.data, ...parentData.get(node.id) } } : node),
+    edges: rewiredEdges,
+  }
+}
+
+const GENERATED_RUNTIME_KINDS = new Set(['pod', 'podgroup', 'replicaset'])
+const MAX_INDIVIDUAL_SOURCE_ONLY_RESOURCES = 12
+
+function identityKey(kind: string, group: string | undefined, namespace: string, name: string): string {
+  const identityGroup = groupQualifiesLaneId(group) ? group!.toLowerCase() : ''
+  return `${identityGroup}/${kind.toLowerCase()}/${namespace}/${name}`
+}
+
+export function topologyGroup(node: TopologyNode): string | undefined {
+  return apiVersionToGroup(node.data?.apiVersion as string | undefined) || (node.data?.sourceGroup as string | undefined)
+}
+
+export function deploymentInventoryFromGitOps(tree: GitOpsResourceTree | undefined): DeploymentInventory | undefined {
+  if (!tree) return undefined
+  return {
+    nodes: tree.nodes
+      .filter((node) => node.role === 'declared' || node.role === 'generated')
+      .map((node) => ({
+        id: node.id,
+        kind: node.ref.kind,
+        group: node.ref.group,
+        namespace: node.ref.namespace,
+        name: node.ref.name,
+        role: node.role as 'declared' | 'generated',
+        status: node.topologyStatus,
+      })),
+    warnings: tree.warnings,
+  }
+}
+
+export function deploymentInventoryFromHelm(resources: HelmOwnedResource[] | undefined): DeploymentInventory | undefined {
+  if (!resources) return undefined
+  return {
+    complete: false,
+    nodes: resources.map((resource) => ({
+      id: `helm/${resource.kind.toLowerCase()}/${resource.namespace}/${resource.name}`,
+      kind: resource.kind,
+      group: apiVersionToGroup(resource.apiVersion),
+      namespace: resource.namespace,
+      name: resource.name,
+      role: 'declared',
+      status: helmResourceStatus(resource.status),
+    })),
+  }
+}
+
+function helmResourceStatus(status: string | undefined): HealthStatus {
+  const normalized = status?.toLowerCase() ?? ''
+  if (['running', 'active', 'ready', 'succeeded', 'completed', 'bound'].includes(normalized)) return 'healthy'
+  if (['failed', 'error', 'unhealthy'].includes(normalized)) return 'unhealthy'
+  if (['pending', 'degraded'].includes(normalized)) return 'degraded'
+  return 'unknown'
+}
+
+export function layerDeploymentInventory(
+  topology: Topology,
+  inventory: DeploymentInventory,
+  sourceLabel: string,
+): DeploymentTopologyLayer {
+  const inventoryByExact = new Map(inventory.nodes.map((node) => [
+    identityKey(node.kind, node.group, node.namespace, node.name),
+    node,
+  ]))
+  const matchedInventoryIds = new Set<string>()
+  let managedRuntimeCount = 0
+  let runtimeOnlyCount = 0
+  const inventoryComplete = inventory.complete !== false && (inventory.warnings?.length ?? 0) === 0
+
+  const runtimeNodes = topology.nodes.map((node) => {
+    if (node.kind === 'PodGroup' || node.kind === 'Internet') return node
+    const namespace = (node.data?.namespace as string) || ''
+    const match = inventoryByExact.get(identityKey(node.kind, topologyGroup(node), namespace, node.name))
+    if (match) {
+      matchedInventoryIds.add(match.id)
+      managedRuntimeCount += 1
+      return node
+    }
+    if (!inventoryComplete || GENERATED_RUNTIME_KINDS.has(node.kind.toLowerCase())) return node
+    runtimeOnlyCount += 1
+    return {
+      ...node,
+      data: {
+        ...node.data,
+        deploymentMembership: 'runtime-only' satisfies DeploymentMembership,
+        deploymentSourceLabel: sourceLabel,
+      },
+    }
+  })
+
+  const managedOnly = inventory.nodes.filter((node) => node.role === 'declared' && !matchedInventoryIds.has(node.id))
+  const managedOnlySummary = managedOnly.length > MAX_INDIVIDUAL_SOURCE_ONLY_RESOURCES
+    ? summarizeInventory(managedOnly)
+    : undefined
+  const sourceOnlyNodes = managedOnlySummary
+    ? []
+    : groupedSourceOnlyNodes(managedOnly, sourceLabel)
+
+  return {
+    topology: { ...topology, nodes: [...runtimeNodes, ...sourceOnlyNodes] },
+    managedRuntimeCount,
+    runtimeOnlyCount,
+    managedOnly,
+    managedOnlySummary,
+    inventoryComplete,
+  }
+}
+
+function groupedSourceOnlyNodes(nodes: DeploymentInventoryNode[], sourceLabel: string): TopologyNode[] {
+  const groups = new Map<string, DeploymentInventoryNode[]>()
+  for (const node of nodes) {
+    const key = `${node.group ?? ''}/${node.kind}/${node.namespace}`
+    groups.set(key, [...(groups.get(key) ?? []), node])
+  }
+
+  const result: TopologyNode[] = []
+  for (const [groupKey, group] of groups) {
+    if (group.length <= 3) {
+      result.push(...group.map((node) => sourceOnlyNode(node, sourceLabel)))
+      continue
+    }
+    const representative = group[0]
+    result.push({
+      id: `source-group/${groupKey}`,
+      kind: representative.kind,
+      name: pluralize(group.length, representative.kind),
+      status: worstTopologyStatus(group.map((node) => node.status)),
+      data: {
+        namespace: representative.namespace,
+        sourceGroup: representative.group,
+        sourceInventoryGroup: true,
+        sourceInventoryCount: group.length,
+        deploymentMembership: 'source-only' satisfies DeploymentMembership,
+        deploymentSourceLabel: sourceLabel,
+      },
+    })
+  }
+  return result
+}
+
+function summarizeInventory(nodes: DeploymentInventoryNode[]): string {
+  const counts = new Map<string, number>()
+  for (const node of nodes) counts.set(node.kind, (counts.get(node.kind) ?? 0) + 1)
+  const leadingKinds = [...counts.entries()]
+    .sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]))
+    .slice(0, 2)
+  const summarizedCount = leadingKinds.reduce((total, [, count]) => total + count, 0)
+  const summary = [
+    ...leadingKinds.map(([kind, count]) => pluralize(count, kind)),
+    ...(nodes.length > summarizedCount ? [`${nodes.length - summarizedCount} more`] : []),
+  ].join(' · ')
+
+  return summary
+}
+
+function sourceOnlyNode(node: DeploymentInventoryNode, sourceLabel: string): TopologyNode {
+  return {
+    id: `source/${node.id}`,
+    kind: node.kind,
+    name: node.name,
+    status: node.status ?? 'unknown',
+    data: {
+      namespace: node.namespace,
+      sourceGroup: node.group,
+      deploymentMembership: 'source-only' satisfies DeploymentMembership,
+      deploymentSourceLabel: sourceLabel,
+    },
+  }
+}
+
+function worstTopologyStatus(statuses: Array<HealthStatus | undefined>): HealthStatus {
+  const rank: Record<HealthStatus, number> = { unknown: 0, neutral: 1, healthy: 2, degraded: 3, unhealthy: 4 }
+  return statuses.reduce<HealthStatus>((worst, status) => status && rank[status] > rank[worst] ? status : worst, 'unknown')
+}