@skyhook-io/k8s-ui 1.8.9 → 1.8.11

package/src/components/workload/index.ts

@@ -1,2 +1,2 @@
-export { WorkloadView, type WorkloadTabType } from './WorkloadView'
+export { WorkloadView, type ResourceOwnershipContext, type ServingResourceDetail, type WorkloadTabType } from './WorkloadView'
 export { ResourceDetailDrawer } from './ResourceDetailDrawer'

package/src/theme/variables.css

@@ -54,6 +54,10 @@
   --border-default: light-dark(#D8E0EE, #222840);
   --border-light: light-dark(#CDD6E8, #2C324A);
   --border-subtle: light-dark(rgba(74, 100, 180, 0.07), rgba(255, 255, 255, 0.04));
+  /* Emphasis edge for the focused/expanded card in a queue — must read clearly
+     against sibling cards' --border-default, unlike --border-light's one-notch
+     step. */
+  --border-emphasis: light-dark(#96A8CA, rgba(255, 255, 255, 0.22));
   --border-focus: var(--color-brand);
 
   /* ── Accent ── */
@@ -108,6 +112,16 @@
   --group-icon-app: light-dark(#059669, #34d399);
   --group-icon-label: light-dark(#d97706, #fbbf24);
 
+  /* ── Terminal / console surface (intentionally dark in BOTH themes — it's a
+     console, not chrome). The outer border darkens on a light page and lightens
+     on a dark one so the block stays defined; the inner divider and text stay
+     light because the surface is always dark. ── */
+  --terminal-bg: #0F172A;
+  --terminal-border: light-dark(#1E293B, rgba(255, 255, 255, 0.10));
+  --terminal-divider: rgba(255, 255, 255, 0.10);
+  --terminal-label: #94A3B8;
+  --terminal-text: #CBD5E1;
+
   /* ── ANSI terminal colors (theme-aware for log viewer) ── */
   --ansi-black:   light-dark(#3b3b3b, #4c4c4c);
   --ansi-red:     light-dark(#cd3131, #cd3131);
@@ -142,6 +156,6 @@
   --shadow-sm: 0 1px 3px rgba(0,0,0,0.3), 0 1px 2px rgba(0,0,0,0.2), 0 0 0 1px rgba(255,255,255,0.06);
   --shadow-md: 0 4px 12px -2px rgba(0,0,0,0.35), 0 2px 4px rgba(0,0,0,0.15), 0 0 0 1px rgba(255,255,255,0.06);
   --shadow-lg: 0 12px 32px -6px rgba(0,0,0,0.3), 0 4px 8px rgba(0,0,0,0.1);
-  --shadow-drawer: -16px 0 60px rgba(0,0,0,0.6), -6px 0 20px rgba(0,0,0,0.4);
+  --shadow-drawer: -12px 0 36px rgba(0,0,0,0.45), -4px 0 14px rgba(0,0,0,0.3), 0 0 0 1px rgba(255,255,255,0.06);
   --topology-node-shadow: 0 2px 6px rgba(0,0,0,0.2), 0 6px 16px rgba(0,0,0,0.15);
 }

package/src/types/core.ts

@@ -11,6 +11,7 @@ export interface ResourcePermissions {
   statefulSets: boolean
   replicaSets: boolean
   ingresses: boolean
+  ingressClasses: boolean
   configMaps: boolean
   secrets: boolean
   events: boolean
@@ -94,7 +95,6 @@ export interface Deployment {
 // When adding a new kind here, also update:
 // - ALL_NODE_KINDS in App.tsx
 // - TopologyFilterSidebar.tsx RESOURCE_KINDS array
-// - index.css .topology-icon-* class
 // - K8sResourceNode.tsx NODE_DIMENSIONS
 // - resource-icons.ts KIND_ICON_MAP
 // - kindToPlural in navigation.ts (if irregular plural)
@@ -123,9 +123,17 @@ export type CoreNodeKind =
   | 'PodGroup'
   | 'ConfigMap'
   | 'Secret'
+  | 'ServiceAccount'
+  | 'SealedSecret'
+  | 'ServiceMonitor'
+  | 'PodMonitor'
   | 'HorizontalPodAutoscaler'
   | 'Job'
   | 'CronJob'
+  | 'Workflow'
+  | 'CronWorkflow'
+  | 'WorkflowTemplate'
+  | 'ClusterWorkflowTemplate'
   | 'PersistentVolumeClaim'
   | 'Node'
   | 'Namespace'
@@ -168,6 +176,10 @@ export function displayKind(kind: string): string {
   const shortNames: Record<string, string> = {
     HorizontalPodAutoscaler: 'HPA',
     PersistentVolumeClaim: 'PVC',
+    ServiceAccount: 'Service Account',
+    SealedSecret: 'Sealed Secret',
+    ServiceMonitor: 'Service Monitor',
+    PodMonitor: 'Pod Monitor',
     EC2NodeClass: 'NodeClass',
     KnativeService: 'Knative Svc',
     KnativeConfiguration: 'Knative Config',
@@ -275,6 +287,10 @@ export interface TimelineEvent {
   id: string
   timestamp: string // ISO date string
   source: EventSource // Where event originated: 'informer', 'k8s_event', 'historical'
+  // Store-assigned arrival number (monotonic per store instance). The delta
+  // cursor keys on it — arrival order, not event time, so late-arriving
+  // events can't slip behind a client's cursor.
+  seq?: number
 
   // Resource identity
   kind: string
@@ -339,6 +355,20 @@ export function isWorkloadKind(kind: string): boolean {
   ].includes(kind)
 }
 
+export function isDeploymentLikeWorkloadKind(kind: string, group = ''): boolean {
+  switch (kind) {
+    case 'Deployment':
+    case 'ReplicaSet':
+    case 'StatefulSet':
+    case 'DaemonSet':
+      return group === '' || group === 'apps'
+    case 'Rollout':
+      return group === '' || group === 'argoproj.io'
+    default:
+      return false
+  }
+}
+
 // Check if a resource kind is typically managed by another
 export function isManagedKind(kind: string): boolean {
   return ['ReplicaSet', 'Pod', 'Event'].includes(kind)
@@ -353,7 +383,7 @@ export interface TimelineFilters {
   timeRange: TimeRange
 }
 
-export type TimeRange = '5m' | '30m' | '1h' | '6h' | '24h' | 'all'
+export type TimeRange = '5m' | '30m' | '1h' | '6h' | '24h' | '7d' | '30d' | 'all'
 
 // Cluster info
 export interface ClusterInfo {
@@ -445,6 +475,7 @@ export interface Relationships {
   configRefs?: ResourceRef[]
   consumers?: ResourceRef[]
   scalers?: ResourceRef[]
+  storageRefs?: ResourceRef[]
   scaleTarget?: ResourceRef
   pdbs?: ResourceRef[]              // PodDisruptionBudgets protecting this workload
   networkPolicies?: ResourceRef[]   // NetworkPolicy / CiliumNetworkPolicy / ClusterNetworkPolicy variants selecting this workload
@@ -822,9 +853,11 @@ export interface UpgradeInfo {
   // oci:// chart reference an OCI-sourced upgrade lives at (display only).
   chartRef?: string
   error?: string
+  // Machine-readable source-resolution failure, used to make the Helm drawer
+  // explain whether tracking an OCI source can help.
+  sourceIssue?: 'untracked' | 'repo_index_error' | 'ambiguous_repository'
   // True only when the error is a genuinely untracked source (registering a
-  // chart source could fix it) — NOT for repo-side errors like a stale index or
-  // classic ambiguity. Gates the "track source" affordance.
+  // chart source could fix it). Kept for compatibility; prefer sourceIssue.
   untracked?: boolean
 }
 
@@ -836,6 +869,8 @@ export interface BatchUpgradeInfo {
 // Request body for applying new values to a release
 export interface ApplyValuesRequest {
   values: Record<string, unknown>
+  version?: string
+  repository?: string
 }
 
 // Response for previewing values changes
@@ -1234,10 +1269,28 @@ export interface ImageMetadata {
 // ============================================================================
 
 // Pod info returned from workload pods endpoint
+export interface WorkloadPodContainerInfo {
+  name: string
+  init?: boolean
+  ready: boolean
+  restartCount: number
+}
+
 export interface WorkloadPodInfo {
   name: string
   containers: string[]
   ready: boolean
+  phase?: string
+  healthLevel?: HealthStatus
+  reason?: string
+  message?: string
+  restartCount?: number
+  lastTerminationReason?: string
+  createdAt?: string
+  containerStatuses?: WorkloadPodContainerInfo[]
+  stepID?: string
+  stepName?: string
+  stepPhase?: string
 }
 
 // SSE event types for workload log streaming

package/src/utils/api-resources.test.ts

@@ -0,0 +1,54 @@
+import { describe, expect, it } from 'vitest'
+import { categorizeResources, formatGroupName, shortenGroupName } from './api-resources'
+
+describe('formatGroupName', () => {
+  it('uses friendly names for common CRD groups seen in clusters', () => {
+    expect(formatGroupName('policies.kyverno.io')).toBe('Kyverno')
+    expect(formatGroupName('networking.gke.io')).toBe('GKE Networking')
+    expect(formatGroupName('apiregistration.k8s.io')).toBe('API Registration')
+    expect(formatGroupName('monitoring.googleapis.com')).toBe('Google Cloud Monitoring')
+    expect(formatGroupName('sql.cnrm.cloud.google.com')).toBe('Config Connector')
+    expect(formatGroupName('crd.k8s.amazonaws.com')).toBe('AWS VPC CNI')
+    expect(formatGroupName('acid.zalan.do')).toBe('Zalando Postgres')
+  })
+
+  it('formats unmapped API groups without exposing raw domain strings', () => {
+    expect(formatGroupName('widgets.example.io')).toBe('Example Widgets')
+    expect(formatGroupName('api.my-company.dev')).toBe('My Company API')
+    expect(formatGroupName('dns.gke.example.io')).toBe('Example DNS GKE')
+    expect(formatGroupName('widgets.example.io')).not.toMatch(/\./)
+  })
+
+  it('does not promote Kubernetes domain-family suffixes into visible labels', () => {
+    expect(formatGroupName('flowcontrol.apiserver.k8s.io')).toBe('Apiserver Flowcontrol')
+    expect(formatGroupName('addons.cluster.x-k8s.io')).toBe('Cluster API')
+    expect(formatGroupName('ipam.cluster.x-k8s.io')).toBe('Cluster API')
+    expect(formatGroupName('nfd.k8s-sigs.io')).toBe('NFD')
+  })
+
+  it('keeps unmapped CRD groups separate from core categories', () => {
+    expect(formatGroupName('networking.io')).toBe('Networking APIs')
+    expect(formatGroupName('storage.io')).toBe('Storage APIs')
+  })
+
+  it('keeps shortenGroupName as the legacy suffix-stripping helper', () => {
+    expect(shortenGroupName('networking.gke.io')).toBe('networking.gke')
+    expect(shortenGroupName('rbac.authorization.k8s.io')).toBe('rbac.authorization')
+    expect(shortenGroupName('widgets.example.dev')).toBe('widgets.example')
+  })
+})
+
+describe('categorizeResources', () => {
+  it('does not merge unmapped CRDs into matching core categories', () => {
+    const categories = categorizeResources([
+      { group: 'networking.io', version: 'v1', kind: 'WidgetRoute', name: 'widgetroutes', namespaced: true, isCrd: true, verbs: ['list'] },
+    ])
+
+    const networking = categories.find(c => c.name === 'Networking')
+    const networkingAPIs = categories.find(c => c.name === 'Networking APIs')
+
+    expect(networking?.resources.some(r => r.kind === 'Service')).toBe(true)
+    expect(networking?.resources.some(r => r.kind === 'WidgetRoute')).toBe(false)
+    expect(networkingAPIs?.resources.map(r => r.kind)).toEqual(['WidgetRoute'])
+  })
+})

package/src/utils/api-resources.ts

@@ -13,6 +13,7 @@ const CONFIG_KINDS = ['ConfigMap', 'Secret', 'HorizontalPodAutoscaler', 'PodDisr
 const STORAGE_KINDS = ['PersistentVolumeClaim', 'PersistentVolume', 'StorageClass', 'VolumeAttachment']
 const ACCESS_CONTROL_KINDS = ['ServiceAccount', 'Role', 'ClusterRole', 'RoleBinding', 'ClusterRoleBinding']
 const CLUSTER_KINDS = ['Node', 'Namespace', 'Event']
+const CORE_CATEGORY_NAMES = new Set(['Workloads', 'Networking', 'Configuration', 'Storage', 'Access Control', 'Cluster'])
 
 // Core resources that must always be present (fallback if API discovery misses them)
 export const CORE_RESOURCES: APIResource[] = [
@@ -112,6 +113,7 @@ export function categorizeResources(resources: APIResource[]): ResourceCategory[
 export function formatGroupName(group: string): string {
   const knownGroups: Record<string, string> = {
     'argoproj.io': 'Argo',
+    'apiregistration.k8s.io': 'API Registration',
     'cert-manager.io': 'Cert Manager',
     'acme.cert-manager.io': 'Cert Manager',
     'istio.io': 'Istio',
@@ -119,10 +121,12 @@ export function formatGroupName(group: string): string {
     'security.istio.io': 'Istio',
     'telemetry.istio.io': 'Istio',
     'monitoring.coreos.com': 'Prometheus',
+    'monitoring.googleapis.com': 'Google Cloud Monitoring',
     'velero.io': 'Velero',
     'external-secrets.io': 'External Secrets',
     'keda.sh': 'KEDA',
     'gateway.networking.k8s.io': 'Gateway API',
+    'gateway.envoyproxy.io': 'Envoy Gateway',
     'traefik.io': 'Traefik',
     'traefik.containo.us': 'Traefik',
     'crossplane.io': 'Crossplane',
@@ -166,7 +170,11 @@ export function formatGroupName(group: string): string {
     'infrastructure.cluster.x-k8s.io': 'Cluster API',
     'ceph.rook.io': 'Rook',
     'kyverno.io': 'Kyverno',
+    'policies.kyverno.io': 'Kyverno',
     'k8s.nginx.org': 'NGINX',
+    'networking.gke.io': 'GKE Networking',
+    'warden.gke.io': 'GKE Warden',
+    'cloud.google.com': 'Google Cloud',
     'sparkoperator.k8s.io': 'Spark',
     'kubeflow.org': 'Kubeflow',
     'snapshot.storage.k8s.io': 'Snapshots',
@@ -177,6 +185,12 @@ export function formatGroupName(group: string): string {
     'resource.k8s.io': 'Dynamic Resource Allocation',
     'kueue.x-k8s.io': 'Kueue',
     'autoscaling.x-k8s.io': 'Cluster Autoscaler',
+    'crd.k8s.amazonaws.com': 'AWS VPC CNI',
+    'vpcresources.k8s.aws': 'AWS VPC CNI',
+    'elbv2.k8s.aws': 'AWS Load Balancer',
+    'eks.amazonaws.com': 'EKS',
+    'networking.k8s.aws': 'AWS Networking',
+    'acid.zalan.do': 'Zalando Postgres',
     'serving.kserve.io': 'KServe',
     'ray.io': 'KubeRay',
     'leaderworkerset.x-k8s.io': 'LeaderWorkerSet',
@@ -197,7 +211,10 @@ export function formatGroupName(group: string): string {
   // their own per-service groups like s3.aws.upbound.io, compute.gcp.upbound.io).
   if (group.endsWith('.upbound.io')) return 'Crossplane'
   if (group.endsWith('.crossplane.io')) return 'Crossplane'
-  return group
+  if (group === 'cluster.x-k8s.io' || group.endsWith('.cluster.x-k8s.io')) return 'Cluster API'
+  if (group.endsWith('.cnrm.cloud.google.com')) return 'Config Connector'
+  if (group.endsWith('.openshift.io')) return 'OpenShift'
+  return formatUnmappedGroupName(group)
 }
 
 export function shortenGroupName(group: string): string {
@@ -206,6 +223,56 @@ export function shortenGroupName(group: string): string {
     .replace(/\.k8s$/, '')
 }
 
+const GROUP_SUFFIX_LABELS = new Set([
+  'io', 'com', 'org', 'dev', 'sh', 'net', 'do', 'ai', 'cloud', 'co', 'app',
+  'k8s', 'x-k8s', 'k8s-sigs', 'sigs',
+])
+const GROUP_ACRONYMS: Record<string, string> = {
+  api: 'API',
+  aws: 'AWS',
+  amazonaws: 'AWS',
+  cnrm: 'CNRM',
+  crd: 'CRD',
+  csi: 'CSI',
+  dns: 'DNS',
+  gcp: 'GCP',
+  gke: 'GKE',
+  gpu: 'GPU',
+  hpa: 'HPA',
+  ipam: 'IPAM',
+  k8s: 'K8s',
+  nfd: 'NFD',
+  tcp: 'TCP',
+  tls: 'TLS',
+  udp: 'UDP',
+}
+
+function formatUnmappedGroupName(group: string): string {
+  const labels = group
+    .split('.')
+    .map(label => label.trim().toLowerCase())
+    .filter(label => label && !GROUP_SUFFIX_LABELS.has(label))
+
+  if (labels.length === 0) return group
+  if (labels.length === 1) return avoidCoreCategoryCollision(formatGroupToken(labels[0]))
+
+  const owner = labels[labels.length - 1]
+  const descriptors = labels.slice(0, -1)
+  return avoidCoreCategoryCollision([owner, ...descriptors].map(formatGroupToken).join(' '))
+}
+
+function avoidCoreCategoryCollision(label: string): string {
+  return CORE_CATEGORY_NAMES.has(label) ? `${label} APIs` : label
+}
+
+function formatGroupToken(token: string): string {
+  return token
+    .split(/[-_]/)
+    .filter(Boolean)
+    .map(part => GROUP_ACRONYMS[part] ?? part.charAt(0).toUpperCase() + part.slice(1))
+    .join(' ')
+}
+
 function sortResources(resources: APIResource[]): APIResource[] {
   return [...resources].sort((a, b) => a.kind.localeCompare(b.kind))
 }

package/src/utils/application-topology.test.ts

@@ -0,0 +1,198 @@
+import { describe, expect, it } from 'vitest'
+import type { GitOpsResourceTree, Topology } from '../types'
+import { collapseStableReplicaSets, deploymentInventoryFromGitOps, deploymentInventoryFromHelm, layerDeploymentInventory, topologyGroup } from './application-topology'
+
+const topology: Topology = {
+  nodes: [
+    { id: 'deployment/default/api', kind: 'Deployment', name: 'api', status: 'healthy', data: { namespace: 'default', apiVersion: 'apps/v1' } },
+    { id: 'service/default/external', kind: 'Service', name: 'external', status: 'healthy', data: { namespace: 'default', apiVersion: 'v1' } },
+  ],
+  edges: [],
+}
+
+it('resolves the stored API group for source-only CRD nodes', () => {
+  expect(topologyGroup({
+    id: 'source/prometheusrule',
+    kind: 'PrometheusRule',
+    name: 'alerts',
+    status: 'healthy',
+    data: { namespace: 'monitoring', sourceGroup: 'monitoring.coreos.com' },
+  })).toBe('monitoring.coreos.com')
+})
+
+function inventory(warnings?: string[]): GitOpsResourceTree {
+  const root = { id: 'root', ref: { group: 'argoproj.io', kind: 'Application', namespace: 'argocd', name: 'api' }, role: 'root' as const, tool: 'argocd' as const }
+  return {
+    root,
+    warnings,
+    edges: [],
+    nodes: [
+      root,
+      { id: 'deployment', ref: { group: 'apps', kind: 'Deployment', namespace: 'default', name: 'api' }, role: 'declared', tool: 'argocd' },
+      { id: 'config', ref: { kind: 'ConfigMap', namespace: 'default', name: 'api-config' }, role: 'declared', tool: 'argocd' },
+    ],
+  }
+}
+
+describe('layerDeploymentInventory', () => {
+  it('separates overlapping, runtime-only, and managed-only resources', () => {
+    const result = layerDeploymentInventory(topology, deploymentInventoryFromGitOps(inventory())!, 'Argo CD')
+
+    expect(result.managedRuntimeCount).toBe(1)
+    expect(result.runtimeOnlyCount).toBe(1)
+    expect(result.managedOnly.map((node) => node.name)).toEqual(['api-config'])
+    expect(result.topology.nodes[0].data?.deploymentMembership).toBeUndefined()
+    expect(result.topology.nodes[1].data?.deploymentMembership).toBe('runtime-only')
+    expect(result.topology.nodes[2]).toMatchObject({ kind: 'ConfigMap', name: 'api-config', data: { deploymentMembership: 'source-only' } })
+  })
+
+  it('does not claim runtime-only membership for a partial inventory', () => {
+    const result = layerDeploymentInventory(topology, deploymentInventoryFromGitOps(inventory(['Some resources are hidden']))!, 'Argo CD')
+
+    expect(result.inventoryComplete).toBe(false)
+    expect(result.runtimeOnlyCount).toBe(0)
+    expect(result.topology.nodes[1].data?.deploymentMembership).toBeUndefined()
+  })
+
+  it('does not claim runtime-only membership for Helm without a completeness signal', () => {
+    const helmInventory = deploymentInventoryFromHelm([{
+      apiVersion: 'apps/v1',
+      kind: 'Deployment',
+      namespace: 'default',
+      name: 'api',
+      status: 'ready',
+    }])!
+    const result = layerDeploymentInventory(topology, helmInventory, 'Helm')
+
+    expect(result.inventoryComplete).toBe(false)
+    expect(result.runtimeOnlyCount).toBe(0)
+    expect(result.topology.nodes[1].data?.deploymentMembership).toBeUndefined()
+  })
+
+  it('adds no membership markers when source and runtime agree', () => {
+    const matchingTopology: Topology = {
+      nodes: [topology.nodes[0]],
+      edges: [],
+    }
+    const matchingInventory = inventory()
+    matchingInventory.nodes = matchingInventory.nodes.filter((node) => node.id !== 'config')
+
+    const result = layerDeploymentInventory(matchingTopology, deploymentInventoryFromGitOps(matchingInventory)!, 'Argo CD')
+
+    expect(result.runtimeOnlyCount).toBe(0)
+    expect(result.managedOnly).toEqual([])
+    expect(result.topology.nodes[0].data?.deploymentMembership).toBeUndefined()
+  })
+
+  it('does not merge same-named resources from different CRD groups', () => {
+    const collisionTopology: Topology = {
+      nodes: [{ id: 'service/default/api', kind: 'Service', name: 'api', status: 'healthy', data: { namespace: 'default', apiVersion: 'serving.knative.dev/v1' } }],
+      edges: [],
+    }
+    const result = layerDeploymentInventory(collisionTopology, deploymentInventoryFromGitOps({
+      root: inventory().root,
+      edges: [],
+      nodes: [
+        inventory().root,
+        { id: 'core-service', ref: { kind: 'Service', namespace: 'default', name: 'api' }, role: 'declared', tool: 'argocd' },
+      ],
+    })!, 'Argo CD')
+
+    expect(result.managedRuntimeCount).toBe(0)
+    expect(result.runtimeOnlyCount).toBe(1)
+    expect(result.managedOnly.map((node) => node.id)).toEqual(['core-service'])
+  })
+
+  it('does not classify synthetic graph nodes as runtime-only resources', () => {
+    const syntheticTopology: Topology = {
+      nodes: [
+        { id: 'podgroup/default/api', kind: 'PodGroup', name: 'api', status: 'healthy', data: { namespace: 'default' } },
+        { id: 'internet', kind: 'Internet', name: 'Internet', status: 'healthy', data: {} },
+      ],
+      edges: [],
+    }
+    const result = layerDeploymentInventory(syntheticTopology, deploymentInventoryFromGitOps(inventory())!, 'Argo CD')
+
+    expect(result.runtimeOnlyCount).toBe(0)
+    expect(result.topology.nodes.slice(0, 2).every((node) => node.data?.deploymentMembership === undefined)).toBe(true)
+  })
+
+  it('groups repeated source-only resources so large bundles remain readable', () => {
+    const largeInventory = inventory()
+    largeInventory.nodes = [
+      largeInventory.root,
+      ...Array.from({ length: 5 }, (_, index) => ({
+        id: `rule-${index}`,
+        ref: { group: 'monitoring.coreos.com', kind: 'PrometheusRule', namespace: 'monitoring', name: `rule-${index}` },
+        role: 'declared' as const,
+        tool: 'argocd' as const,
+      })),
+    ]
+
+    const result = layerDeploymentInventory({ nodes: [], edges: [] }, deploymentInventoryFromGitOps(largeInventory)!, 'Argo CD')
+
+    expect(result.managedOnly).toHaveLength(5)
+    expect(result.topology.nodes).toHaveLength(1)
+    expect(result.topology.nodes[0]).toMatchObject({ kind: 'PrometheusRule', data: { sourceInventoryGroup: true, sourceInventoryCount: 5 } })
+  })
+
+  it('summarizes a large source-only inventory outside the graph', () => {
+    const largeInventory = inventory()
+    largeInventory.nodes = [
+      largeInventory.root,
+      ...Array.from({ length: 10 }, (_, index) => ({
+        id: `rule-${index}`,
+        ref: { group: 'monitoring.coreos.com', kind: 'PrometheusRule', namespace: 'monitoring', name: `rule-${index}` },
+        role: 'declared' as const,
+        tool: 'argocd' as const,
+      })),
+      ...Array.from({ length: 5 }, (_, index) => ({
+        id: `config-${index}`,
+        ref: { kind: 'ConfigMap', namespace: 'monitoring', name: `config-${index}` },
+        role: 'declared' as const,
+        tool: 'argocd' as const,
+      })),
+    ]
+
+    const result = layerDeploymentInventory({ nodes: [], edges: [] }, deploymentInventoryFromGitOps(largeInventory)!, 'Argo CD')
+
+    expect(result.managedOnly).toHaveLength(15)
+    expect(result.topology.nodes).toHaveLength(0)
+    expect(result.managedOnlySummary).toBe('10 PrometheusRules · 5 ConfigMaps')
+  })
+})
+
+describe('collapseStableReplicaSets', () => {
+  const replicaSetTopology: Topology = {
+    nodes: [
+      { id: 'deployment/default/api', kind: 'Deployment', name: 'api', status: 'healthy', data: { namespace: 'default' } },
+      { id: 'replicaset/default/api-abc', kind: 'ReplicaSet', name: 'api-abc', status: 'healthy', data: { namespace: 'default', readyReplicas: 2, totalReplicas: 2 } },
+      { id: 'pod/default/api-1', kind: 'Pod', name: 'api-1', status: 'healthy', data: { namespace: 'default' } },
+    ],
+    edges: [
+      { id: 'deployment-rs', source: 'deployment/default/api', target: 'replicaset/default/api-abc', type: 'manages' },
+      { id: 'rs-pod', source: 'replicaset/default/api-abc', target: 'pod/default/api-1', type: 'manages' },
+    ],
+  }
+
+  it('collapses a stable single ReplicaSet and rewires its pods', () => {
+    const result = collapseStableReplicaSets(replicaSetTopology, new Set())
+    expect(result.nodes.map((node) => node.kind)).toEqual(['Deployment', 'Pod'])
+    expect(result.edges).toContainEqual(expect.objectContaining({ source: 'deployment/default/api', target: 'pod/default/api-1' }))
+    expect(result.nodes[0].data).toMatchObject({ replicaSetCount: 1, replicaSetsCollapsed: true })
+  })
+
+  it('shows the ReplicaSet when the developer expands it', () => {
+    const result = collapseStableReplicaSets(replicaSetTopology, new Set(['deployment/default/api']))
+    expect(result.nodes.map((node) => node.kind)).toEqual(['Deployment', 'ReplicaSet', 'Pod'])
+    expect(result.nodes[0].data).toMatchObject({ replicaSetCount: 1, replicaSetsCollapsed: false })
+  })
+
+  it('keeps an unhealthy ReplicaSet visible automatically', () => {
+    const unhealthy = {
+      ...replicaSetTopology,
+      nodes: replicaSetTopology.nodes.map((node) => node.kind === 'ReplicaSet' ? { ...node, status: 'degraded' as const } : node),
+    }
+    expect(collapseStableReplicaSets(unhealthy, new Set()).nodes.map((node) => node.kind)).toContain('ReplicaSet')
+  })
+})