@skyhook-io/radar-app 1.12.2 → 1.12.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skyhook-io/radar-app",
-  "version": "1.12.2",
+  "version": "1.12.3",
   "description": "Radar's full web UI as a reusable React component. Used by Radar's own binary and by external consumers like Radar Cloud.",
   "repository": {
     "type": "git",
@@ -41,7 +41,7 @@
     "yaml": "^2.9.0"
   },
   "peerDependencies": {
-    "@skyhook-io/k8s-ui": ">=1.14.0",
+    "@skyhook-io/k8s-ui": ">=1.13.4",
     "@tanstack/react-query": ">=5",
     "@xyflow/react": ">=12.0.0",
     "clsx": ">=2",

package/src/App.tsx

@@ -64,7 +64,7 @@ import { Tooltip } from './components/ui/Tooltip'
 import { LargeClusterNamespacePicker } from './components/shared/LargeClusterNamespacePicker'
 import { SettingsDialog, type SettingsSectionId } from './components/settings/SettingsDialog'
 import type { APIResource, TopologyNode, GroupingMode, MainView, SelectedResource, SelectedHelmRelease, NodeKind, TopologyMode, Topology, K8sEvent } from './types'
-import { kindToPlural, pluralToKind, openExternal, apiVersionToGroup, relatedResourcePath, searchHitToSelectedResource } from './utils/navigation'
+import { kindToPluralWithGroup, pluralToKind, openExternal, apiVersionToGroup, relatedResourcePath, searchHitToSelectedResource } from './utils/navigation'
 import { findSelectedTopologyNode } from './utils/topology-selection'
 import { type OmnibarHandle } from './components/ui/Omnibar'
 import { RadarOmnibar } from './components/ui/RadarOmnibar'
@@ -604,7 +604,7 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
   const peekOwnerKeyRef = useRef<string | null>(null)
   const currentResourceKindSlug = normalizedResourcesKindSlug.toLowerCase()
   const currentResourceGroup = searchParams.get('apiGroup') ?? ''
-  const selectedResourceKindSlug = selectedResource ? kindToPlural(selectedResource.kind).toLowerCase() : ''
+  const selectedResourceKindSlug = selectedResource ? kindToPluralWithGroup(selectedResource.kind, selectedResource.group ?? '').toLowerCase() : ''
   const selectedResourceGroup = selectedResource?.group ?? ''
   const selectedResourceRouteMismatch = mainView === 'resources' && !!selectedResource && (
     selectedResourceKindSlug !== currentResourceKindSlug ||
@@ -707,7 +707,7 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
   // URL (?resource=ns/name) — the same deep-link shape the resources view
   // round-trips — so refresh/share keeps the drawer open instead of dropping it.
   const navigateToResourceList = useCallback((resource: SelectedResource) => {
-    const pluralKind = kindToPlural(resource.kind)
+    const pluralKind = kindToPluralWithGroup(resource.kind, resource.group ?? '')
     setSelectedResource({ ...resource, kind: pluralKind })
     const newParams = new URLSearchParams(searchParams)
     newParams.delete('kind')
@@ -1027,8 +1027,9 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
     // Skip K8s Event kind — informational, not resource mutations
     if (event.kind === 'Event') return
 
-    const kind = kindToPlural(event.kind)
+    const kind = kindToPluralWithGroup(event.kind, event.group ?? '')
     const structural = event.operation === 'add' || event.operation === 'delete'
+    const applicationWorkload = ['deployments', 'statefulsets', 'daemonsets', 'rollouts'].includes(kind)
 
     const fast = fastInvalidationRef.current
     fast.changedKinds.add(kind)
@@ -1042,7 +1043,7 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
     }
 
     const slow = slowInvalidationRef.current
-    if (!structural) slow.updatedKinds.add(kind)
+    if (!structural || applicationWorkload) slow.updatedKinds.add(kind)
 
     // FAST tier — membership-sensitive + cheap, bounded 3s latency.
     if (fast.timer === null) {
@@ -1077,14 +1078,17 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
       }, 3000)
     }
 
-    // SLOW tier — throttle the expensive queries for status-only churn. Only
-    // updates schedule it; structural changes are fully handled by the fast tier.
-    if (!structural && slow.timer === null) {
+    // SLOW tier — throttle expensive status churn. Workload membership changes
+    // also pass through here so the Applications refetch lands after its cache TTL.
+    if ((!structural || applicationWorkload) && slow.timer === null) {
       slow.timer = window.setTimeout(() => {
         const s = slowInvalidationRef.current
         for (const k of s.updatedKinds) {
           queryClient.invalidateQueries({ queryKey: ['resources', k] })
         }
+        if ([...s.updatedKinds].some((k) => ['deployments', 'statefulsets', 'daemonsets', 'rollouts'].includes(k))) {
+          queryClient.invalidateQueries({ queryKey: ['applications'] })
+        }
         queryClient.invalidateQueries({ queryKey: ['dashboard'] }) // health reflects status updates
         slowInvalidationRef.current = { updatedKinds: new Set(), timer: null }
       }, 15000)
@@ -1250,9 +1254,10 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
     // Skip Internet node - it's not a real resource
     if (node.kind === 'Internet') return
 
-    // For PodGroup, we can't open a single resource drawer
-    // TODO: Could show a list of pods in the group
-    if (node.kind === 'PodGroup') return
+    const nodeGroup = apiVersionToGroup(node.data.apiVersion as string | undefined)
+    // Radar's topology PodGroup is a virtual pod aggregate. A Kubernetes
+    // scheduling.k8s.io PodGroup carries apiVersion and is a real resource.
+    if (node.kind === 'PodGroup' && !nodeGroup) return
 
     const namespace = (node.data.namespace as string) || ''
     // GitOps CRs (Application/Kustomization/HelmRelease/etc.) have a dedicated
@@ -1266,10 +1271,10 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
     }
 
     navigateToResource({
-      kind: kindToPlural(node.kind),
+      kind: kindToPluralWithGroup(node.kind, nodeGroup),
       namespace,
       name: node.name,
-      group: apiVersionToGroup(node.data.apiVersion as string | undefined),
+      group: nodeGroup,
     })
   }, [navigate, navigateToResource])
 
@@ -2031,7 +2036,10 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
           retained background list out of the focus order + a11y tree (the visual
           cover already blocks pointer events). */}
       {contentReady && <div className="flex-1 flex overflow-hidden" inert={expandedView}>
-        <ErrorBoundary>
+        {/* Search included, not just the path: selection inside a view rides in
+            the query (?resource=, ?release=), so a path-only key would still
+            strand a crash on the view that produced it. */}
+        <ErrorBoundary resetKey={location.pathname + location.search}>
         {/* Home dashboard */}
         {mainView === 'home' && (
           <HomeView
@@ -2039,6 +2047,17 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
             topology={topology}
             fallbackClusterLoadState={showHomeClusterLoadFallback ? clusterLoadState : undefined}
             onNavigateToView={setMainView}
+            onNavigateToHelmRelease={navCustomization.embedded ? undefined : navigateToHelmRelease}
+            onNavigateToManagerPath={navCustomization.embedded || takeover.gitops ? undefined : (path) => navigate(path)}
+            // Upgrade impact lives under /checks, which a Cloud host takes
+            // over wholesale — its fleet pages have no upgrade sub-route, so
+            // the version line stays plain text there.
+            onNavigateToUpgradeImpact={takeover.checks ? undefined : () => {
+              const newParams = new URLSearchParams()
+              const globalNamespaces = searchParams.get('namespaces')
+              if (globalNamespaces) newParams.set('namespaces', globalNamespaces)
+              navigate({ pathname: '/checks/upgrade', search: newParams.toString() })
+            }}
             onNavigateToResourceKind={(kind, apiGroup, filters) => {
               // Navigate to resources view with kind in URL path
               console.debug('[filters] App.onNavigateToResourceKind:', { kind, apiGroup, filters })
@@ -2375,7 +2394,7 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
             // Drill into a related resource while expanded: stay in the over-list
             // overlay for the new resource (pushed, so Back walks resource→resource
             // still expanded). The backdrop list follows to the new kind.
-            const pluralKind = kindToPlural(resource.kind)
+            const pluralKind = kindToPluralWithGroup(resource.kind, resource.group ?? '')
             setSelectedResource({ ...resource, kind: pluralKind })
             const p = new URLSearchParams()
             const ns = searchParams.get('namespaces')

package/src/api/client.images.test.ts

@@ -0,0 +1,63 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+import { ApiError, fetchResourceWithRelationships, fetchWorkloadImages, setWorkloadImages } from './client'
+
+afterEach(() => {
+  vi.unstubAllGlobals()
+})
+
+describe('workload image API', () => {
+  it('loads the exact referenced workload and API group for ownership checks', async () => {
+    const response = { resource: { kind: 'Deployment' }, relationships: { managedBy: [] } }
+    const fetchMock = vi.fn((input: RequestInfo | URL) => {
+      expect(input).toBe('/api/resources/deployments/prod/shared?group=apps')
+      return Promise.resolve(new Response(JSON.stringify(response), { status: 200 }))
+    })
+    vi.stubGlobal('fetch', fetchMock)
+
+    await expect(
+      fetchResourceWithRelationships('deployments', 'prod', 'shared', 'apps'),
+    ).resolves.toEqual(response)
+  })
+
+  it('loads the authoritative image inventory', async () => {
+    const inventory = {
+      target: { group: 'apps', resource: 'deployments', kind: 'Deployment', namespace: 'prod', name: 'web' },
+      containers: [{ type: 'container', name: 'app', image: 'repo/app:v1' }],
+      behavior: { type: 'rolling' },
+    }
+    const fetchMock = vi.fn((input: RequestInfo | URL) => {
+      expect(input).toBe('/api/workloads/deployments/prod/web/images')
+      return Promise.resolve(new Response(JSON.stringify(inventory), { status: 200 }))
+    })
+    vi.stubGlobal('fetch', fetchMock)
+
+    await expect(fetchWorkloadImages('deployments', 'prod', 'web')).resolves.toEqual(inventory)
+    expect(fetchMock.mock.calls[0]?.[0]).toBe('/api/workloads/deployments/prod/web/images')
+  })
+
+  it('posts compare-and-swap image updates and preserves conflict status', async () => {
+    const fetchMock = vi.fn((input: RequestInfo | URL, init?: RequestInit) => {
+      expect(input).toBe('/api/workloads/deployments/prod/web/images')
+      expect(init?.method).toBe('POST')
+      return Promise.resolve(new Response(JSON.stringify({
+        error: 'image for container "app" changed; review the latest images before applying',
+      }), { status: 409, headers: { 'Content-Type': 'application/json' } }))
+    })
+    vi.stubGlobal('fetch', fetchMock)
+
+    const promise = setWorkloadImages({
+      kind: 'deployments',
+      namespace: 'prod',
+      name: 'web',
+      updates: [{ type: 'container', name: 'app', previousImage: 'repo/app:v1', image: 'repo/app:v2' }],
+    })
+    await expect(promise).rejects.toMatchObject({ status: 409 } satisfies Partial<ApiError>)
+
+    const init = fetchMock.mock.calls[0]?.[1] as RequestInit
+    expect(init.method).toBe('POST')
+    expect(JSON.parse(String(init.body))).toEqual({
+      updates: [{ type: 'container', name: 'app', previousImage: 'repo/app:v1', image: 'repo/app:v2' }],
+    })
+  })
+})

package/src/api/client.ts

@@ -11,6 +11,9 @@ import type {
   CapacityOverviewResponse,
   CapacityPoolDetailResponse,
   CapacityPoolListResponse,
+  SetWorkloadImagesResult,
+  WorkloadImageInventory,
+  WorkloadImageUpdate,
   YamlDocumentIdentity,
   YamlSchemaLoadResult,
 } from '@skyhook-io/k8s-ui'
@@ -52,8 +55,9 @@ import type {
   PodEnvironmentRevealResponse,
 } from '../types'
 import type { GitOpsOperationResponse } from '../types/gitops'
-import { getApiBase, getAuthHeaders, getCredentialsMode, getBasename, routePath, stripBasename } from './config'
-import { pluralToKind } from '../utils/navigation'
+import { apiUrl, getApiBase, getAuthHeaders, getCredentialsMode, getBasename, routePath, stripBasename } from './config'
+import { apiVersionToGroup, pluralToKind } from '../utils/navigation'
+import type { DeploymentMode } from '../types'
 
 // Auto-refresh cadences (ms) — named constants for each polled hook's
 // refetchInterval below, so the poll rate reads clearly at each call site.
@@ -292,6 +296,9 @@ export interface DashboardCluster {
   platform: string;
   version: string;
   connected: boolean;
+  // Newest Kubernetes minor the upgrade-impact catalog covers (e.g. "1.37").
+  // Static catalog fact — safe to compare against `version` without a scan.
+  upgradeReviewedThrough?: string;
 }
 
 export interface DashboardHealth {
@@ -1510,13 +1517,68 @@ export interface VersionInfo {
   error?: string;
 }
 
+const UPDATE_CHECK_STORAGE_KEY_PREFIX = 'radar-update-check';
+
+export function utcDay(now: Date): string {
+  return now.toISOString().slice(0, 10)
+}
+
+export function markDailyUpdateCheckAttempt(
+  storage: Pick<Storage, 'getItem' | 'setItem'>,
+  apiBase: string,
+  now: Date,
+): boolean {
+  const storageKey = `${UPDATE_CHECK_STORAGE_KEY_PREFIX}:${apiBase}`
+  const day = utcDay(now)
+  try {
+    if (storage.getItem(storageKey) === day) return false
+
+    storage.setItem(storageKey, day)
+    return true
+  } catch {
+    return false
+  }
+}
+
+function markUpdateCheckAttempt(): boolean {
+  try {
+    return markDailyUpdateCheckAttempt(localStorage, getApiBase(), new Date())
+  } catch {
+    return false
+  }
+}
+
+export async function triggerDailyUpdateCheck(
+  deploymentMode: DeploymentMode | undefined,
+): Promise<void> {
+  if (deploymentMode !== 'in-cluster' || !markUpdateCheckAttempt()) return
+  await fetch(apiUrl('/version-check/browser'), {
+    method: 'POST',
+    headers: getAuthHeaders(),
+    credentials: getCredentialsMode(),
+    keepalive: true,
+  })
+}
+
 export function useVersionCheck() {
-  return useQuery<VersionInfo>({
-    queryKey: ["version-check"],
-    queryFn: () => fetchJSON("/version-check"),
+  const capabilities = useCapabilities()
+  const apiBase = getApiBase()
+  const deploymentMode = capabilities.data
+    ? (capabilities.data.deployment?.mode ?? 'local')
+    : undefined
+
+  const query = useQuery<VersionInfo>({
+    queryKey: ["version-check", apiBase],
+    queryFn: () => fetchJSON('/version-check'),
     staleTime: 60 * 60 * 1000, // 1 hour
     retry: false, // Don't retry on failure
   });
+
+  useEffect(() => {
+    if (query.isSuccess) void triggerDailyUpdateCheck(deploymentMode).catch(() => {})
+  }, [apiBase, deploymentMode, query.isSuccess])
+
+  return query;
 }
 
 // ============================================================================
@@ -1789,6 +1851,11 @@ export const cloudInstallActive = (state: CloudInstallState | undefined): boolea
 export interface CloudConnectInfo {
   assurances?: string[]
   notice?: string
+  // Free-tier terms as a prose fragment completing "Radar Cloud is ___."
+  // (e.g. "free for 3 clusters"). Separate from assurances: chip copy and
+  // sentence copy have different grammar, and reusing one as the other breaks
+  // whenever either is reworded.
+  freeTier?: string
 }
 
 // Deliberately a bare cross-origin GET: no credentials, no identifiers, no
@@ -1836,6 +1903,12 @@ export interface CloudConnectSelf {
   deploymentName?: string
   chart?: string
   controller?: string
+  controllerRef?: {
+    group?: string
+    kind: string
+    namespace?: string
+    name: string
+  }
   wizardUrl?: string
 }
 
@@ -2219,25 +2292,32 @@ export function useArgoRevisionMetadata(
 
 // Generic resource fetching - returns resource with relationships
 // Uses '_' as placeholder for cluster-scoped resources (empty namespace)
-export function useResource<T>(
+export function fetchResourceWithRelationships<T>(
   kind: string,
   namespace: string,
   name: string,
   group?: string,
-  options?: { enabled?: boolean; refetchInterval?: number | false },
-) {
-  // For cluster-scoped resources, use '_' as namespace placeholder
+): Promise<ResourceWithRelationships<T>> {
   const ns = namespace || "_";
   const params = new URLSearchParams();
   if (group) params.set("group", group);
   const queryString = params.toString();
 
+  return fetchJSON(
+    `/resources/${kind}/${ns}/${name}${queryString ? `?${queryString}` : ""}`,
+  );
+}
+
+export function useResource<T>(
+  kind: string,
+  namespace: string,
+  name: string,
+  group?: string,
+  options?: { enabled?: boolean; refetchInterval?: number | false },
+) {
   const query = useQuery<ResourceWithRelationships<T>>({
     queryKey: ["resource", kind, namespace, name, group],
-    queryFn: () =>
-      fetchJSON(
-        `/resources/${kind}/${ns}/${name}${queryString ? `?${queryString}` : ""}`,
-      ),
+    queryFn: () => fetchResourceWithRelationships<T>(kind, namespace, name, group),
     enabled: (options?.enabled ?? true) && Boolean(kind && name), // namespace can be empty for cluster-scoped resources
     refetchInterval: options?.refetchInterval,
   });
@@ -2259,17 +2339,9 @@ export function useResourceWithRelationships<T>(
   name: string,
   group?: string,
 ) {
-  const ns = namespace || "_";
-  const params = new URLSearchParams();
-  if (group) params.set("group", group);
-  const queryString = params.toString();
-
   return useQuery<ResourceWithRelationships<T>>({
     queryKey: ["resource", kind, namespace, name, group],
-    queryFn: () =>
-      fetchJSON(
-        `/resources/${kind}/${ns}/${name}${queryString ? `?${queryString}` : ""}`,
-      ),
+    queryFn: () => fetchResourceWithRelationships<T>(kind, namespace, name, group),
     enabled: Boolean(kind && name),
   });
 }
@@ -3638,6 +3710,7 @@ export function useUpdateResource() {
         queryKey: ["resources", variables.kind],
       });
       queryClient.invalidateQueries({ queryKey: ["topology"] });
+      queryClient.invalidateQueries({ queryKey: ["applications"] });
     },
   });
 }
@@ -3959,6 +4032,7 @@ export interface ApplyResourceResult {
   name: string;
   namespace: string;
   kind: string;
+  apiVersion: string;
   created: boolean;
 }
 
@@ -4346,6 +4420,90 @@ export function useRestartWorkload() {
   });
 }
 
+export function fetchWorkloadImages(
+  kind: string,
+  namespace: string,
+  name: string,
+): Promise<WorkloadImageInventory> {
+  return fetchJSON(`/workloads/${kind}/${namespace}/${name}/images`);
+}
+
+export function setWorkloadImages(params: {
+  kind: string;
+  namespace: string;
+  name: string;
+  updates: WorkloadImageUpdate[];
+}): Promise<SetWorkloadImagesResult> {
+  return fetchJSON<SetWorkloadImagesResult>(
+    `/workloads/${params.kind}/${params.namespace}/${params.name}/images`,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ updates: params.updates }),
+    },
+  );
+}
+
+export function useSetWorkloadImages() {
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationFn: (params: {
+      kind: string;
+      namespace: string;
+      name: string;
+      updates: WorkloadImageUpdate[];
+    }) => setWorkloadImages(params),
+    meta: {
+      successMessage: "Container images updated",
+    },
+    onSuccess: async (result, variables) => {
+      await queryClient.cancelQueries({
+        queryKey: ["resource", result.target.resource, result.target.namespace, result.target.name],
+      });
+      queryClient.setQueriesData<ResourceWithRelationships<Record<string, unknown>>>(
+        {
+          predicate: (query) => {
+            const [scope, resource, namespace, name, group] = query.queryKey;
+            return scope === "resource" &&
+              resource === result.target.resource &&
+              namespace === result.target.namespace &&
+              name === result.target.name &&
+              (group === result.target.group || group === undefined || group === "");
+          },
+        },
+        (current) => {
+          if (!current) return current;
+          const apiVersion = current.resource.apiVersion;
+          if (typeof apiVersion !== "string" || apiVersionToGroup(apiVersion) !== result.target.group) {
+            return current;
+          }
+          return { ...current, resource: result.object };
+        },
+      );
+      if (result.target.resource !== variables.kind || result.target.name !== variables.name) {
+        queryClient.invalidateQueries({
+          queryKey: ["resource", variables.kind, variables.namespace, variables.name],
+        });
+      }
+      queryClient.invalidateQueries({ queryKey: ["resources", variables.kind] });
+      if (result.target.resource !== variables.kind) {
+        queryClient.invalidateQueries({ queryKey: ["resources", result.target.resource] });
+      }
+      queryClient.invalidateQueries({ queryKey: ["applications"] });
+      queryClient.invalidateQueries({
+        queryKey: [
+          "workload-revisions",
+          variables.kind,
+          variables.namespace,
+          variables.name,
+        ],
+      });
+      queryClient.invalidateQueries({ queryKey: ["topology"] });
+    },
+  });
+}
+
 // Scale a workload (Deployment, StatefulSet)
 export function useScaleWorkload() {
   const queryClient = useQueryClient();
@@ -4509,6 +4667,7 @@ export interface RolloutCapabilities {
   skipStep: boolean;
   rollback: boolean;
   restart: boolean;
+  setImage?: boolean;
   strategy: string;
   terminating: boolean;
 }
@@ -4525,33 +4684,35 @@ export function useRolloutCapabilities(
   });
 }
 
+// Fallbacks only. The server reports what it actually did — including when it found
+// nothing to do — so its message is preferred over anything asserted here.
 const ROLLOUT_ACTION_MESSAGES: Record<
   RolloutAction,
   { errorMessage: string; successMessage: string }
 > = {
   abort: {
     errorMessage: "Failed to abort rollout",
-    successMessage: "Rollout aborted — traffic reverted to the stable version",
+    successMessage: "Abort sent",
   },
   retry: {
     errorMessage: "Failed to retry rollout",
-    successMessage: "Rollout retried",
+    successMessage: "Retry sent",
   },
   promote: {
     errorMessage: "Failed to promote rollout",
-    successMessage: "Rollout promoted",
+    successMessage: "Promote sent",
   },
   "promote-full": {
     errorMessage: "Failed to promote rollout",
-    successMessage: "Rollout promoted to full — remaining steps skipped",
+    successMessage: "Promote full sent",
   },
   "skip-step": {
     errorMessage: "Failed to skip step",
-    successMessage: "Skipped to the next step",
+    successMessage: "Skip step sent",
   },
 };
 
-export function useRolloutAction() {
+export function useRolloutAction(options?: { reportErrors?: boolean }) {
   const queryClient = useQueryClient();
   return useMutation({
     mutationFn: async ({
@@ -4571,14 +4732,26 @@ export function useRolloutAction() {
         const error = await response
           .json()
           .catch(() => ({ error: "Unknown error" }));
-        throw new Error(error.error || `HTTP ${response.status}`);
+        // The code, not the status, says whether retrying can help: a lost cluster
+        // connection answers 503 on this route too.
+        throw new ApiError(
+          error.error || `HTTP ${response.status}`,
+          response.status,
+          error,
+        );
       }
       return response.json();
     },
-    // meta is static, so per-action success wording goes through onSuccess.
-    meta: { errorMessage: "Rollout action failed" },
-    onSuccess: (_, variables) => {
-      showApiSuccess(ROLLOUT_ACTION_MESSAGES[variables.action].successMessage);
+    // meta is static, so per-action success wording goes through onSuccess. Callers that
+    // render the failure themselves opt out, so the toast handler stays silent.
+    meta:
+      options?.reportErrors === false
+        ? undefined
+        : { errorMessage: "Rollout action failed" },
+    onSuccess: (data, variables) => {
+      showApiSuccess(
+        data?.message || ROLLOUT_ACTION_MESSAGES[variables.action].successMessage,
+      );
       queryClient.invalidateQueries({ queryKey: ["resources", "rollouts"] });
       queryClient.invalidateQueries({
         queryKey: ["resource", "rollouts", variables.namespace, variables.name],
@@ -5966,6 +6139,8 @@ export interface NamespaceScope {
    */
   mode: "cluster-wide" | "namespace" | "restricted";
   accessibleNamespaces: string[];
+  /** Namespaces where Radar cannot list pods or deployments. */
+  deniedNamespaces: string[];
   /** false when accessibleNamespaces is a best-effort short list (no list perm). */
   authoritative: boolean;
   /** false when clearing would leave no usable namespace fallback. */

package/src/api/client.yaml.test.ts

@@ -10,8 +10,8 @@ describe('formatApplyResourceError', () => {
           failedIndex: 2,
           total: 4,
           results: [
-            { kind: 'Namespace', namespace: '', name: 'checkout', created: true },
-            { kind: 'Deployment', namespace: 'checkout', name: 'api', created: true },
+            { apiVersion: 'v1', kind: 'Namespace', namespace: '', name: 'checkout', created: true },
+            { apiVersion: 'apps/v1', kind: 'Deployment', namespace: 'checkout', name: 'api', created: true },
           ],
         },
         422,
@@ -26,7 +26,7 @@ describe('formatApplyResourceError', () => {
   })
 
   it('preserves structured partial-apply results for recovery', () => {
-    const result = { kind: 'Namespace', namespace: '', name: 'checkout', created: true }
+    const result = { apiVersion: 'v1', kind: 'Namespace', namespace: '', name: 'checkout', created: true }
     const error = new ApplyResourceError(
       {
         error: 'document 2: admission denied',