@skyhook-io/radar-app 1.8.6 → 1.8.8

package/src/api/client.ts

@@ -1,5 +1,5 @@
 import { useEffect, useRef } from 'react'
-import type { AppRow } from '@skyhook-io/k8s-ui'
+import type { AppHistory, AppRow, ArgoSyncOpts } from '@skyhook-io/k8s-ui'
 import { useQuery, useMutation, useQueryClient, skipToken } from '@tanstack/react-query'
 import { showApiError, showApiSuccess } from '../components/ui/Toast'
 import { useCanHelmWrite } from '../contexts/CapabilitiesContext'
@@ -31,6 +31,9 @@ import type {
   ArtifactHubChartDetail,
   GitOpsResourceTree,
   GitOpsInsight,
+  GitOpsInsightRef,
+  GitOpsResourceDiff,
+  ArgoRevisionMetadata,
 } from '../types'
 import type { GitOpsOperationResponse } from '../types/gitops'
 import { getApiBase, getAuthHeaders, getCredentialsMode, getBasename, routePath } from './config'
@@ -42,6 +45,9 @@ const DASHBOARD_REFRESH_INTERVAL_MS = 30_000
 const AUDIT_REFRESH_INTERVAL_MS = 60_000
 const ISSUES_REFRESH_INTERVAL_MS = 30_000
 const COST_REFRESH_INTERVAL_MS = 60_000
+const COST_DISCOVERY_RETRY_INTERVAL_MS = 5_000
+export const COST_DISCOVERY_GRACE_MS = 30_000
+const COST_TREND_REFRESH_INTERVAL_MS = 120_000
 const CHANGES_REFRESH_INTERVAL_MS = 60_000
 const APPLICATIONS_REFRESH_INTERVAL_MS = 60_000
 
@@ -54,12 +60,23 @@ export function apiFetch(input: RequestInfo | URL, init?: RequestInit): Promise<
   for (const [k, v] of Object.entries(getAuthHeaders())) {
     if (!headers.has(k)) headers.set(k, v)
   }
-  return fetch(input, { credentials: getCredentialsMode(), ...init, headers }).then(async response => {
+  return fetch(input, {
+    credentials: getCredentialsMode(),
+    ...init,
+    headers,
+  }).then(async (response) => {
     const authPrefix = `${getBasename()}/auth`
     if (response.status === 401 && !window.location.pathname.startsWith(authPrefix)) {
       // Save current location so user returns to where they were after re-auth.
       // Editor draft is auto-saved by EditableYamlView via sessionStorage.
-      try { sessionStorage.setItem('radar_return_path', window.location.pathname + window.location.search) } catch { /* best-effort */ }
+      try {
+        sessionStorage.setItem(
+          'radar_return_path',
+          window.location.pathname + window.location.search,
+        )
+      } catch {
+        /* best-effort */
+      }
 
       let authMode: string | undefined
       try {
@@ -78,7 +95,11 @@ export function apiFetch(input: RequestInfo | URL, init?: RequestInit): Promise<
         const lastReload = sessionStorage.getItem('radar_proxy_reload')
         const now = Date.now()
         if (!lastReload || now - parseInt(lastReload) > 5000) {
-          try { sessionStorage.setItem('radar_proxy_reload', String(now)) } catch { /* best-effort */ }
+          try {
+            sessionStorage.setItem('radar_proxy_reload', String(now))
+          } catch {
+            /* best-effort */
+          }
           window.location.reload()
         }
       }
@@ -107,11 +128,12 @@ const METRICS_API_GROUP_TOKENS = ['metrics', 'k8s', 'io'] as const
 
 function mentionsMetricsAPIGroup(message: string): boolean {
   const tokens = message.split(/[^a-z0-9]+/).filter(Boolean)
-  return tokens.some((token, index) => (
-    token === METRICS_API_GROUP_TOKENS[0] &&
-    tokens[index + 1] === METRICS_API_GROUP_TOKENS[1] &&
-    tokens[index + 2] === METRICS_API_GROUP_TOKENS[2]
-  ))
+  return tokens.some(
+    (token, index) =>
+      token === METRICS_API_GROUP_TOKENS[0] &&
+      tokens[index + 1] === METRICS_API_GROUP_TOKENS[1] &&
+      tokens[index + 2] === METRICS_API_GROUP_TOKENS[2],
+  )
 }
 
 function hasMetricsUnavailablePhrase(message: string): boolean {
@@ -134,18 +156,18 @@ export function isMetricsUnavailableError(error: unknown): boolean {
   return [error.message, error.data?.error].some((message) => {
     if (typeof message !== 'string') return false
     const normalized = message.toLowerCase()
-    const hasMetricsSignal = (
+    const hasMetricsSignal =
       normalized.includes('metrics-server') ||
       mentionsMetricsAPIGroup(normalized) ||
       normalized.includes('pod metrics') ||
       normalized.includes('node metrics')
-    )
     return hasMetricsSignal && hasMetricsUnavailablePhrase(normalized)
   })
 }
 
-export async function fetchJSON<T>(path: string, signal?: AbortSignal): Promise<T> {
-  const response = await apiFetch(`${getApiBase()}${path}`, signal ? { signal } : undefined)
+export async function fetchJSON<T>(path: string, init?: RequestInit | AbortSignal): Promise<T> {
+  const requestInit = init instanceof AbortSignal ? { signal: init } : init
+  const response = await apiFetch(`${getApiBase()}${path}`, requestInit)
   if (!response.ok) {
     const errorData = await response.json().catch(() => ({ error: 'Unknown error' }))
     throw new ApiError(errorData.error || `HTTP ${response.status}`, response.status, errorData)
@@ -209,7 +231,13 @@ export interface MetricSummary {
 }
 
 export interface DashboardResourceCounts {
-  pods: { total: number; running: number; pending: number; failed: number; succeeded: number }
+  pods: {
+    total: number
+    running: number
+    pending: number
+    failed: number
+    succeeded: number
+  }
   deployments: { total: number; available: number; unavailable: number }
   statefulSets: WorkloadCount
   daemonSets: WorkloadCount
@@ -292,7 +320,15 @@ export interface DashboardCRDCount {
 }
 
 // Re-export shared types from k8s-ui — single source of truth
-import type { AuditCardData, AuditFinding, ResourceGroup, CheckMeta, Check, Issue, IssueRecentChange } from '@skyhook-io/k8s-ui'
+import type {
+  AuditCardData,
+  AuditFinding,
+  ResourceGroup,
+  CheckMeta,
+  Check,
+  Issue,
+  IssueRecentChange,
+} from '@skyhook-io/k8s-ui'
 export type DashboardAudit = AuditCardData
 export type { AuditFinding, ResourceGroup, CheckMeta, Check }
 
@@ -361,7 +397,11 @@ export interface DashboardResponse {
   networkPolicyCoverage: DashboardNetworkPolicyCoverage | null
   audit: DashboardAudit | null
   gitopsControllers: DashboardGitOpsControllers | null
-  nodeVersionSkew: { versions: Record<string, string[]>; minVersion: string; maxVersion: string } | null
+  nodeVersionSkew: {
+    versions: Record<string, string[]>
+    minVersion: string
+    maxVersion: string
+  } | null
   deferredLoading?: boolean // True while deferred informers (secrets, events, etc.) are still syncing
   partialData?: string[] // Critical kinds promoted at first paint that haven't yet finished syncing (live-filtered)
   accessRestricted?: boolean // True when user has no namespace access (RBAC)
@@ -371,11 +411,12 @@ export interface DashboardCRDsResponse {
   topCRDs: DashboardCRDCount[]
 }
 
-export function useDashboard(namespaces: string[] = []) {
+export function useDashboard(namespaces: string[] = [], options?: { enabled?: boolean }) {
   const params = namespaces.length > 0 ? `?namespaces=${namespaces.join(',')}` : ''
   return useQuery<DashboardResponse>({
     queryKey: ['dashboard', namespaces],
     queryFn: () => fetchJSON(`/dashboard${params}`),
+    enabled: options?.enabled ?? true,
     staleTime: 15000, // 15 seconds
     refetchInterval: DASHBOARD_REFRESH_INTERVAL_MS,
   })
@@ -436,7 +477,13 @@ export function useResourceAudit(kind: string, namespace: string, name: string)
 // the "Operational Issues" section in the resource detail. Cluster-scoped
 // resources pass "_" for namespace; namespaced ones also scope the scan via
 // ?namespaces= for a cheap, bounded Compose.
-export function useResourceIssues(kind: string, group: string | undefined, namespace: string, name: string, enabled = true) {
+export function useResourceIssues(
+  kind: string,
+  group: string | undefined,
+  namespace: string,
+  name: string,
+  enabled = true,
+) {
   const clusterScoped = !namespace
   const pathNs = clusterScoped ? '_' : encodeURIComponent(namespace)
   const params = new URLSearchParams()
@@ -549,7 +596,8 @@ export interface OpenCostNamespaceCost {
   idleCost?: number
 }
 
-export type CostUnavailableReason = 'no_prometheus' | 'no_metrics' | 'query_error'
+export type CostUnavailableReason =
+  'no_prometheus' | 'no_metrics' | 'query_error' | 'access_denied' | 'not_found'
 
 export interface OpenCostSummary {
   available: boolean
@@ -563,11 +611,41 @@ export interface OpenCostSummary {
   namespaces?: OpenCostNamespaceCost[]
 }
 
+const noPrometheusFirstSeenAt = new Map<string, number>()
+
+function costRefetchInterval(
+  defaultInterval: number | false = COST_REFRESH_INTERVAL_MS,
+  contextName?: string,
+) {
+  return (query: {
+    queryHash?: string
+    queryKey?: unknown
+    state: {
+      data?: { available?: boolean; reason?: CostUnavailableReason }
+      dataUpdatedAt?: number
+    }
+  }) => {
+    const data = query.state.data
+    const queryID = `${contextName ?? 'unknown'}:${query.queryHash ?? JSON.stringify(query.queryKey ?? 'opencost')}`
+    if (data?.available === false && data.reason === 'no_prometheus') {
+      const now = Date.now()
+      const firstSeenAt = noPrometheusFirstSeenAt.get(queryID) ?? now
+      noPrometheusFirstSeenAt.set(queryID, firstSeenAt)
+      return now - firstSeenAt < COST_DISCOVERY_GRACE_MS
+        ? COST_DISCOVERY_RETRY_INTERVAL_MS
+        : defaultInterval
+    }
+    noPrometheusFirstSeenAt.delete(queryID)
+    return defaultInterval
+  }
+}
+
 export function useOpenCostSummary() {
+  const clusterInfo = useClusterInfo()
   return useQuery<OpenCostSummary>({
     queryKey: ['opencost-summary'],
     queryFn: () => fetchJSON('/opencost/summary'),
-    refetchInterval: COST_REFRESH_INTERVAL_MS,
+    refetchInterval: costRefetchInterval(COST_REFRESH_INTERVAL_MS, clusterInfo.data?.context),
     staleTime: 30000,
     placeholderData: (prev) => prev, // Keep previous data visible during refetch
   })
@@ -583,6 +661,10 @@ export interface OpenCostWorkloadCost {
   replicas: number
   cpuUsageCost?: number
   memoryUsageCost?: number
+  cpuUsageAvailable: boolean
+  memoryUsageAvailable: boolean
+  cpuAllocationUse: number
+  memoryAllocationUse: number
   efficiency?: number
   idleCost?: number
 }
@@ -595,11 +677,41 @@ export interface OpenCostWorkloadResponse {
 }
 
 export function useOpenCostWorkloads(namespace: string, options?: { enabled?: boolean }) {
+  const clusterInfo = useClusterInfo()
   return useQuery<OpenCostWorkloadResponse>({
     queryKey: ['opencost-workloads', namespace],
     queryFn: () => fetchJSON(`/opencost/workloads?namespace=${encodeURIComponent(namespace)}`),
     enabled: (options?.enabled ?? true) && Boolean(namespace),
+    refetchInterval: costRefetchInterval(COST_REFRESH_INTERVAL_MS, clusterInfo.data?.context),
+    staleTime: 30000,
+  })
+}
+
+export interface OpenCostWorkloadDetailResponse {
+  available: boolean
+  reason?: CostUnavailableReason
+  namespace: string
+  kind: string
+  name: string
+  current?: OpenCostWorkloadCost
+}
+
+export function useOpenCostWorkload(
+  kind: string,
+  namespace: string,
+  name: string,
+  options?: { enabled?: boolean },
+) {
+  const clusterInfo = useClusterInfo()
+  return useQuery<OpenCostWorkloadDetailResponse>({
+    queryKey: ['opencost-workload', kind, namespace, name],
+    queryFn: () =>
+      fetchJSON(
+        `/opencost/workload/${encodeURIComponent(kind)}/${encodeURIComponent(namespace)}/${encodeURIComponent(name)}`,
+      ),
+    enabled: (options?.enabled ?? true) && Boolean(kind && namespace && name),
     staleTime: 30000,
+    refetchInterval: costRefetchInterval(COST_REFRESH_INTERVAL_MS, clusterInfo.data?.context),
   })
 }
 
@@ -624,18 +736,175 @@ export interface OpenCostTrendResponse {
 }
 
 export function useOpenCostTrend(range_: CostTimeRange = '24h') {
+  const clusterInfo = useClusterInfo()
   return useQuery<OpenCostTrendResponse>({
     queryKey: ['opencost-trend', range_],
     queryFn: () => fetchJSON(`/opencost/trend?range=${range_}`),
     staleTime: 60000,
-    refetchInterval: 120000, // Refresh every 2 minutes
+    refetchInterval: costRefetchInterval(COST_TREND_REFRESH_INTERVAL_MS, clusterInfo.data?.context),
     placeholderData: (prev) => prev,
   })
 }
 
+export interface OpenCostWorkloadTrendResponse {
+  available: boolean
+  reason?: CostUnavailableReason
+  namespace: string
+  kind: string
+  name: string
+  range: string
+  windowTotalCost?: number
+  dataPoints?: OpenCostTrendDataPoint[]
+}
+
+export function useOpenCostWorkloadTrend(
+  kind: string,
+  namespace: string,
+  name: string,
+  range_: CostTimeRange = '24h',
+  options?: { enabled?: boolean },
+) {
+  const clusterInfo = useClusterInfo()
+  return useQuery<OpenCostWorkloadTrendResponse>({
+    queryKey: ['opencost-workload-trend', kind, namespace, name, range_],
+    queryFn: () =>
+      fetchJSON(
+        `/opencost/workload/${encodeURIComponent(kind)}/${encodeURIComponent(namespace)}/${encodeURIComponent(name)}/trend?range=${range_}`,
+      ),
+    enabled: (options?.enabled ?? true) && Boolean(kind && namespace && name),
+    staleTime: 60000,
+    refetchInterval: costRefetchInterval(COST_TREND_REFRESH_INTERVAL_MS, clusterInfo.data?.context),
+  })
+}
+
+export interface OpenCostApplicationWorkloadRef {
+  kind: string
+  namespace: string
+  name: string
+}
+
+export interface OpenCostApplicationWorkloadStatus extends OpenCostApplicationWorkloadRef {
+  reason: CostUnavailableReason
+  scaledToZero?: boolean
+}
+
+export interface OpenCostApplicationCostCoverage {
+  total: number
+  included: number
+  unavailable?: OpenCostApplicationWorkloadStatus[]
+  unsupported?: OpenCostApplicationWorkloadRef[]
+}
+
+export interface OpenCostApplicationCostTotals {
+  hourlyCost: number
+  cpuCost: number
+  memoryCost: number
+  replicas: number
+  cpuUsageCost?: number
+  memoryUsageCost?: number
+  cpuUsageAvailable: boolean
+  memoryUsageAvailable: boolean
+  cpuAllocationUse: number
+  memoryAllocationUse: number
+}
+
+export interface OpenCostApplicationWorkloadCost extends OpenCostApplicationWorkloadRef {
+  available: boolean
+  reason?: CostUnavailableReason
+  scaledToZero?: boolean
+  current?: OpenCostWorkloadCost
+}
+
+export interface OpenCostApplicationCostResponse {
+  available: boolean
+  reason?: CostUnavailableReason
+  partial?: boolean
+  totals: OpenCostApplicationCostTotals
+  coverage: OpenCostApplicationCostCoverage
+  workloads?: OpenCostApplicationWorkloadCost[]
+}
+
+export interface OpenCostApplicationCostTrendSeries extends OpenCostApplicationWorkloadRef {
+  windowTotalCost?: number
+  dataPoints?: OpenCostTrendDataPoint[]
+}
+
+export interface OpenCostApplicationCostTrendResponse {
+  available: boolean
+  reason?: CostUnavailableReason
+  range: string
+  partial?: boolean
+  windowTotalCost?: number
+  dataPoints?: OpenCostTrendDataPoint[]
+  series?: OpenCostApplicationCostTrendSeries[]
+  coverage: OpenCostApplicationCostCoverage
+}
+
+function stableOpenCostWorkloadRefs(
+  workloads: OpenCostApplicationWorkloadRef[],
+): OpenCostApplicationWorkloadRef[] {
+  const byKey = new Map<string, OpenCostApplicationWorkloadRef>()
+  for (const workload of workloads) {
+    if (!workload.kind || !workload.namespace || !workload.name) continue
+    const ref = {
+      kind: workload.kind,
+      namespace: workload.namespace,
+      name: workload.name,
+    }
+    byKey.set(`${ref.namespace}/${ref.kind}/${ref.name}`, ref)
+  }
+  return [...byKey.values()].sort((a, b) =>
+    `${a.namespace}/${a.kind}/${a.name}`.localeCompare(`${b.namespace}/${b.kind}/${b.name}`),
+  )
+}
+
+export function useOpenCostApplicationCost(
+  workloads: OpenCostApplicationWorkloadRef[],
+  options?: { enabled?: boolean },
+) {
+  const clusterInfo = useClusterInfo()
+  const refs = stableOpenCostWorkloadRefs(workloads)
+  return useQuery<OpenCostApplicationCostResponse>({
+    queryKey: ['opencost-application', refs],
+    queryFn: ({ signal }) =>
+      fetchJSON('/opencost/application', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ workloads: refs }),
+        signal,
+      }),
+    enabled: (options?.enabled ?? true) && refs.length > 0,
+    staleTime: 30000,
+    refetchInterval: costRefetchInterval(COST_REFRESH_INTERVAL_MS, clusterInfo.data?.context),
+  })
+}
+
+export function useOpenCostApplicationCostTrend(
+  workloads: OpenCostApplicationWorkloadRef[],
+  range_: CostTimeRange = '24h',
+  options?: { enabled?: boolean },
+) {
+  const clusterInfo = useClusterInfo()
+  const refs = stableOpenCostWorkloadRefs(workloads)
+  return useQuery<OpenCostApplicationCostTrendResponse>({
+    queryKey: ['opencost-application-trend', refs, range_],
+    queryFn: ({ signal }) =>
+      fetchJSON('/opencost/application/trend', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ workloads: refs, range: range_ }),
+        signal,
+      }),
+    enabled: (options?.enabled ?? true) && refs.length > 0,
+    staleTime: 60000,
+    refetchInterval: costRefetchInterval(COST_TREND_REFRESH_INTERVAL_MS, clusterInfo.data?.context),
+  })
+}
+
 // Node cost breakdown
 export interface OpenCostNodeCost {
   name: string
+  providerID?: string
   instanceType?: string
   region?: string
   hourlyCost: number
@@ -650,11 +919,12 @@ export interface OpenCostNodeResponse {
 }
 
 export function useOpenCostNodes() {
+  const clusterInfo = useClusterInfo()
   return useQuery<OpenCostNodeResponse>({
     queryKey: ['opencost-nodes'],
     queryFn: () => fetchJSON('/opencost/nodes'),
     staleTime: 60000,
-    refetchInterval: 120000,
+    refetchInterval: costRefetchInterval(COST_TREND_REFRESH_INTERVAL_MS, clusterInfo.data?.context),
     placeholderData: (prev) => prev,
   })
 }
@@ -815,7 +1085,15 @@ const SEARCH_MIN_QUERY = 2
 // health/issueCount per hit (rich rows). React Query's AbortSignal cancels
 // overlapping scans on a new query. keepPreviousData avoids flicker while the
 // next query resolves.
-export function useSearch(query: string, opts?: { limit?: number; context?: 'summary' | 'none'; enabled?: boolean; globalNs?: boolean }) {
+export function useSearch(
+  query: string,
+  opts?: {
+    limit?: number
+    context?: 'summary' | 'none'
+    enabled?: boolean
+    globalNs?: boolean
+  },
+) {
   const trimmed = query.trim()
   const enabled = (opts?.enabled ?? true) && trimmed.length >= SEARCH_MIN_QUERY
   const limit = opts?.limit ?? 20
@@ -827,7 +1105,10 @@ export function useSearch(query: string, opts?: { limit?: number; context?: 'sum
   return useQuery<SearchResult>({
     queryKey: ['search', trimmed, limit, context, globalNs],
     queryFn: ({ signal }) =>
-      fetchJSON<SearchResult>(`/search?q=${encodeURIComponent(trimmed)}&limit=${limit}&include=none&context=${context}${globalNs ? '&globalNs=1' : ''}`, signal),
+      fetchJSON<SearchResult>(
+        `/search?q=${encodeURIComponent(trimmed)}&limit=${limit}&include=none&context=${context}${globalNs ? '&globalNs=1' : ''}`,
+        signal,
+      ),
     enabled,
     staleTime: 2000,
     placeholderData: (prev) => prev, // keepPreviousData
@@ -862,7 +1143,10 @@ export function useCapabilities() {
 
 // Namespace-scoped capabilities. Users with namespace-scoped RoleBindings may
 // have these permissions in specific namespaces.
-export function useNamespaceCapabilities(namespace: string | undefined, globalCaps: Capabilities | undefined) {
+export function useNamespaceCapabilities(
+  namespace: string | undefined,
+  globalCaps: Capabilities | undefined,
+) {
   const needsCheck = namespace && globalCaps
   return useQuery<Capabilities>({
     queryKey: ['capabilities', namespace],
@@ -901,7 +1185,11 @@ export function useAuthMe() {
 // CloudRole.AtLeast — the frontend must agree with the backend on what
 // "member-or-higher" means; otherwise we'd hide a button the
 // backend would happily honor (or vice versa).
-const CLOUD_ROLE_RANK: Record<string, number> = { viewer: 1, member: 2, owner: 3 }
+const CLOUD_ROLE_RANK: Record<string, number> = {
+  viewer: 1,
+  member: 2,
+  owner: 3,
+}
 
 /**
  * useCloudRole returns the caller's Cloud tier (`owner` / `member` /
@@ -982,34 +1270,74 @@ export function useNamespaces() {
 }
 
 // Topology (for manual refresh)
-export function useTopology(namespaces: string[], viewMode: string = 'resources', options?: { enabled?: boolean }) {
+export function useTopology(
+  namespaces: string[],
+  viewMode: string = 'resources',
+  options?: {
+    enabled?: boolean
+    includeReplicaSets?: boolean
+    refetchInterval?: number | false
+  },
+) {
   const params = new URLSearchParams()
   if (namespaces.length > 0) params.set('namespaces', namespaces.join(','))
   if (viewMode) params.set('view', viewMode)
+  if (options?.includeReplicaSets) params.set('includeReplicaSets', 'true')
   const queryString = params.toString()
 
   return useQuery<Topology>({
-    queryKey: ['topology', namespaces, viewMode],
+    queryKey: ['topology', namespaces, viewMode, options?.includeReplicaSets ?? false],
     queryFn: () => fetchJSON(`/topology${queryString ? `?${queryString}` : ''}`),
     staleTime: 5000, // 5 seconds
     enabled: options?.enabled !== false,
+    refetchInterval: options?.refetchInterval,
   })
 }
 
-export function useApplications(namespaces: string[]) {
+export function useApplications(namespaces: string[], options?: { enabled?: boolean }) {
   const params = new URLSearchParams()
   if (namespaces.length > 0) params.set('namespaces', namespaces.join(','))
   const queryString = params.toString()
 
+  const enabled = options?.enabled !== false
   return useQuery<{ applications: AppRow[] }>({
     queryKey: ['applications', namespaces],
     queryFn: () => fetchJSON(`/applications${queryString ? `?${queryString}` : ''}`),
     staleTime: 30_000,
+    // Only poll while a consumer needs the index; gated off it must not keep the
+    // background refetch alive.
+    enabled,
+    refetchInterval: enabled ? APPLICATIONS_REFRESH_INTERVAL_MS : false,
+  })
+}
+
+export function useApplicationHistory(
+  appKey: string | undefined,
+  namespaces: string[],
+  options?: { enabled?: boolean },
+) {
+  const params = new URLSearchParams()
+  if (appKey) params.set('app', appKey)
+  if (namespaces.length > 0) params.set('namespaces', namespaces.join(','))
+  const queryString = params.toString()
+
+  return useQuery<AppHistory>({
+    queryKey: ['application-history', appKey, namespaces],
+    queryFn: appKey ? () => fetchJSON(`/applications/history?${queryString}`) : skipToken,
+    enabled: Boolean(appKey) && (options?.enabled ?? true),
+    staleTime: 15_000,
     refetchInterval: APPLICATIONS_REFRESH_INTERVAL_MS,
   })
 }
 
-export function useGitOpsTree(kind: string, namespace: string, name: string, group?: string, namespaces: string[] = []) {
+export function useGitOpsTree(
+  kind: string,
+  namespace: string,
+  name: string,
+  group?: string,
+  namespaces: string[] = [],
+  options?: { enabled?: boolean },
+) {
   const ns = namespace || '_'
   const params = new URLSearchParams()
   if (group) params.set('group', group)
@@ -1018,19 +1346,26 @@ export function useGitOpsTree(kind: string, namespace: string, name: string, gro
 
   return useQuery<GitOpsResourceTree>({
     queryKey: ['gitops-tree', kind, namespace, name, group, namespaces],
-    queryFn: () => fetchJSON(`/gitops/tree/${kind}/${ns}/${name}${queryString ? `?${queryString}` : ''}`),
-    enabled: Boolean(kind && name),
+    queryFn: () =>
+      fetchJSON(`/gitops/tree/${kind}/${ns}/${name}${queryString ? `?${queryString}` : ''}`),
+    enabled: Boolean(kind && name) && (options?.enabled ?? true),
     staleTime: 5000,
   })
 }
 
 // Poll fast (2s) while a sync/rollback is in flight so the user sees the
 // outcome quickly; otherwise rely on staleTime + manual refetch. Argo flips
-// operationState.phase from "Running" -> Succeeded/Failed when done, so this
+// operationState.phase from Running/Terminating to a terminal phase, so this
 // auto-quiesces on completion.
 const INSIGHTS_RUNNING_POLL_MS = 2000
 
-export function useGitOpsInsights(kind: string, namespace: string, name: string, group?: string, namespaces: string[] = []) {
+export function useGitOpsInsights(
+  kind: string,
+  namespace: string,
+  name: string,
+  group?: string,
+  namespaces: string[] = [],
+) {
   const ns = namespace || '_'
   const params = new URLSearchParams()
   if (group) params.set('group', group)
@@ -1039,19 +1374,71 @@ export function useGitOpsInsights(kind: string, namespace: string, name: string,
 
   return useQuery<GitOpsInsight>({
     queryKey: ['gitops-insights', kind, namespace, name, group, namespaces],
-    queryFn: () => fetchJSON(`/gitops/insights/${kind}/${ns}/${name}${queryString ? `?${queryString}` : ''}`),
+    queryFn: () =>
+      fetchJSON(`/gitops/insights/${kind}/${ns}/${name}${queryString ? `?${queryString}` : ''}`),
     enabled: Boolean(kind && name),
     staleTime: 5000,
     refetchInterval: (query) => {
       const phase = query.state.data?.summary?.operationPhase
-      return phase === 'Running' ? INSIGHTS_RUNNING_POLL_MS : false
+      return phase === 'Running' || phase === 'Terminating' ? INSIGHTS_RUNNING_POLL_MS : false
     },
   })
 }
 
+// Full Git-rendered desired-vs-live diff for one Argo CD managed resource.
+// ns/name identify the Application; the ref identifies the managed resource.
+// Fetched on demand — the caller mounts this only when the user opens "Full
+// diff", so it's enabled whenever the ref is resolvable. Errors surface via
+// fetchJSON's ApiError (server {"error"} string as .message).
+export function useArgoResourceDiff(appNamespace: string, appName: string, ref: GitOpsInsightRef) {
+  const ns = appNamespace || '_'
+  const params = new URLSearchParams()
+  if (ref.group) params.set('group', ref.group)
+  params.set('kind', ref.kind)
+  if (ref.namespace) params.set('resourceNamespace', ref.namespace)
+  params.set('resourceName', ref.name)
+
+  return useQuery<GitOpsResourceDiff>({
+    queryKey: ['argo-resource-diff', appNamespace, appName, ref.group, ref.kind, ref.namespace, ref.name],
+    queryFn: () => fetchJSON(`/argo/applications/${ns}/${appName}/resource-diff?${params.toString()}`),
+    enabled: Boolean(appName && ref.kind && ref.name),
+    staleTime: 15_000,
+  })
+}
+
+// Git commit metadata for one deployed revision of an Argo CD Application.
+// Enabled only when a revision is known and the caller passes `enabled` (gated
+// on capabilities.revisionMetadataAvailable). Cached long — a resolved SHA's
+// metadata is effectively immutable.
+export function useArgoRevisionMetadata(
+  appNamespace: string,
+  appName: string,
+  revision: string | undefined,
+  opts?: { sourceIndex?: number; project?: string; enabled?: boolean },
+) {
+  const ns = appNamespace || '_'
+  const params = new URLSearchParams()
+  if (revision) params.set('revision', revision)
+  if (opts?.sourceIndex != null) params.set('sourceIndex', String(opts.sourceIndex))
+  if (opts?.project) params.set('project', opts.project)
+
+  return useQuery<ArgoRevisionMetadata>({
+    queryKey: ['argo-revision-metadata', appNamespace, appName, revision, opts?.sourceIndex, opts?.project],
+    queryFn: () => fetchJSON(`/argo/applications/${ns}/${appName}/revision-metadata?${params.toString()}`),
+    enabled: Boolean(appName && revision) && (opts?.enabled ?? true),
+    staleTime: 5 * 60_000,
+  })
+}
+
 // Generic resource fetching - returns resource with relationships
 // Uses '_' as placeholder for cluster-scoped resources (empty namespace)
-export function useResource<T>(kind: string, namespace: string, name: string, group?: string) {
+export function useResource<T>(
+  kind: string,
+  namespace: string,
+  name: string,
+  group?: string,
+  options?: { enabled?: boolean; refetchInterval?: number | false },
+) {
   // For cluster-scoped resources, use '_' as namespace placeholder
   const ns = namespace || '_'
   const params = new URLSearchParams()
@@ -1060,8 +1447,10 @@ export function useResource<T>(kind: string, namespace: string, name: string, gr
 
   const query = useQuery<ResourceWithRelationships<T>>({
     queryKey: ['resource', kind, namespace, name, group],
-    queryFn: () => fetchJSON(`/resources/${kind}/${ns}/${name}${queryString ? `?${queryString}` : ''}`),
-    enabled: Boolean(kind && name),  // namespace can be empty for cluster-scoped resources
+    queryFn: () =>
+      fetchJSON(`/resources/${kind}/${ns}/${name}${queryString ? `?${queryString}` : ''}`),
+    enabled: (options?.enabled ?? true) && Boolean(kind && name), // namespace can be empty for cluster-scoped resources
+    refetchInterval: options?.refetchInterval,
   })
 
   // Extract resource and relationships from the response
@@ -1075,7 +1464,12 @@ export function useResource<T>(kind: string, namespace: string, name: string, gr
 }
 
 // Hook that returns full response with relationships explicitly
-export function useResourceWithRelationships<T>(kind: string, namespace: string, name: string, group?: string) {
+export function useResourceWithRelationships<T>(
+  kind: string,
+  namespace: string,
+  name: string,
+  group?: string,
+) {
   const ns = namespace || '_'
   const params = new URLSearchParams()
   if (group) params.set('group', group)
@@ -1083,7 +1477,8 @@ export function useResourceWithRelationships<T>(kind: string, namespace: string,
 
   return useQuery<ResourceWithRelationships<T>>({
     queryKey: ['resource', kind, namespace, name, group],
-    queryFn: () => fetchJSON(`/resources/${kind}/${ns}/${name}${queryString ? `?${queryString}` : ''}`),
+    queryFn: () =>
+      fetchJSON(`/resources/${kind}/${ns}/${name}${queryString ? `?${queryString}` : ''}`),
     enabled: Boolean(kind && name),
   })
 }
@@ -1112,7 +1507,10 @@ export function useResources<T>(
 // Timeline changes (unified view of changes + K8s events)
 export interface UseChangesOptions {
   namespaces?: string[]
-  kind?: string
+  // Kind filter. The server narrows to a single kind (tighter result caps), so
+  // exactly one selected kind is pushed server-side; a multi-kind selection
+  // fetches unfiltered and is narrowed client-side by the caller.
+  kinds?: string[]
   timeRange?: TimeRange
   filter?: string // Filter preset name ('default', 'all', 'warnings-only', 'workloads')
   includeK8sEvents?: boolean
@@ -1120,6 +1518,133 @@ export interface UseChangesOptions {
   includeDeleted?: boolean
   limit?: number
   enabled?: boolean
+  // Cursor-aware refetches: after the first full load, refetches ask the
+  // server only for events that arrived after the highest seq already cached
+  // and merge them in, instead of re-pulling the whole ring. Intended for the
+  // timeline's full-ring (10k) query, where every SSE nudge would otherwise
+  // re-transfer megabytes for a handful of new events.
+  deltaSync?: boolean
+}
+
+// The store epoch guards delta cursors: a restarted store restarts seq
+// numbering, so an epoch change forces a full resync. A periodic full resync
+// also runs as anti-entropy for anything a dropped SSE connection or a
+// server-side eviction could leave behind in the cached copy.
+const FULL_RESYNC_MS = 5 * 60_000
+
+export interface ChangesDeltaMeta {
+  epoch: string
+  lastFullMs: number
+  // Highest seq observed in ANY response for this query — not just what
+  // survived the cap. A delta event older than everything cached gets capped
+  // out of the merge; deriving the cursor from cached rows alone would then
+  // re-request that same event on every refetch until the next full resync.
+  highWaterSeq: number
+}
+const changesDeltaMeta = new Map<string, ChangesDeltaMeta>()
+
+// The since_seq cursor for the next refetch, or 0 for a full fetch. Delta
+// requires an epoch-stamped prior full load, a cached page to merge into, and
+// the anti-entropy full resync not being due.
+export function deltaFetchCursor(
+  meta: ChangesDeltaMeta | undefined,
+  cached: TimelineEvent[] | undefined,
+  nowMs: number,
+): number {
+  if (!meta?.epoch || !cached) return 0
+  if (nowMs - meta.lastFullMs > FULL_RESYNC_MS) return 0
+  return Math.max(meta.highWaterSeq, maxEventSeq(cached))
+}
+
+async function fetchChangesPage(
+  path: string,
+  signal?: AbortSignal,
+): Promise<{ events: TimelineEvent[]; epoch: string; maxSeq: number }> {
+  const response = await apiFetch(`${getApiBase()}${path}`, signal ? { signal } : undefined)
+  if (!response.ok) {
+    const errorData = await response.json().catch(() => ({ error: 'Unknown error' }))
+    throw new ApiError(errorData.error || `HTTP ${response.status}`, response.status, errorData)
+  }
+  const events = (await response.json()) as TimelineEvent[]
+  // maxSeq is the page's frontier computed before the server's
+  // cluster-scoped-RBAC filter — rows dropped THERE still advance the cursor.
+  // (Rows dropped by content filters inside the store query do not; see the
+  // known limitation on the server's handleChanges.)
+  const maxSeq = Number(response.headers.get('X-Radar-Timeline-Max-Seq') ?? '0') || 0
+  return {
+    events,
+    epoch: response.headers.get('X-Radar-Timeline-Epoch') ?? '',
+    maxSeq,
+  }
+}
+
+// Highest store-assigned arrival number in the cached page — the delta cursor.
+export function maxEventSeq(events: TimelineEvent[]): number {
+  let max = 0
+  for (const event of events) {
+    if (event.seq && event.seq > max) max = event.seq
+  }
+  return max
+}
+
+// Merge a delta page into the cached page: a delta row replaces its cached id
+// (a K8s Event count bump re-arrives under the same id), new ids are added,
+// order stays newest-first (arrival number breaks timestamp ties), and the
+// result is capped to the query's limit by dropping the oldest.
+export function mergeDeltaEvents(
+  prev: TimelineEvent[],
+  delta: TimelineEvent[],
+  cap: number,
+): TimelineEvent[] {
+  if (delta.length === 0) return prev
+  const replaced = new Set(delta.map((event) => event.id))
+  const merged = [...delta, ...prev.filter((event) => !replaced.has(event.id))]
+  merged.sort((a, b) => {
+    const byTime = new Date(b.timestamp).getTime() - new Date(a.timestamp).getTime()
+    if (byTime !== 0) return byTime
+    return (b.seq ?? 0) - (a.seq ?? 0)
+  })
+  return merged.length > cap ? merged.slice(0, cap) : merged
+}
+
+// Delta-sync orchestration for useChanges, extracted so the
+// full-fetch → delta-poll → epoch-mismatch-resync contract is exercisable
+// without a React render. State is passed in explicitly — the cached page and
+// the shared meta store — rather than closed over from module scope, so a
+// caller (and a test) drives it with fresh state each invocation.
+export async function runDeltaSyncFetch(deps: {
+  path: string
+  queryString: string
+  limit: number
+  metaKey: string
+  cached: TimelineEvent[] | undefined
+  metaStore: Map<string, ChangesDeltaMeta>
+  now: number
+  signal?: AbortSignal
+}): Promise<TimelineEvent[]> {
+  const { path, queryString, limit, metaKey, cached, metaStore, now, signal } = deps
+  const meta = metaStore.get(metaKey)
+  const cursor = deltaFetchCursor(meta, cached, now)
+  if (cursor > 0) {
+    const delta = await fetchChangesPage(
+      `${path}${queryString ? '&' : '?'}since_seq=${cursor}`,
+      signal,
+    )
+    if (delta.epoch && delta.epoch === meta!.epoch) {
+      meta!.highWaterSeq = Math.max(meta!.highWaterSeq, delta.maxSeq, maxEventSeq(delta.events))
+      // Returning the cached reference on an empty delta skips re-renders.
+      return delta.events.length ? mergeDeltaEvents(cached!, delta.events, limit) : cached!
+    }
+    // Epoch changed — the store restarted and seq numbering reset, so the
+    // cursor is meaningless. Fall through to a full resync.
+  }
+  const full = await fetchChangesPage(path, signal)
+  metaStore.set(metaKey, {
+    epoch: full.epoch,
+    lastFullMs: now,
+    highWaterSeq: Math.max(full.maxSeq, maxEventSeq(full.events)),
+  })
+  return full.events
 }
 
 function getTimeRangeDate(range: TimeRange): Date | null {
@@ -1136,17 +1661,37 @@ function getTimeRangeDate(range: TimeRange): Date | null {
       return new Date(now.getTime() - 6 * 60 * 60 * 1000)
     case '24h':
       return new Date(now.getTime() - 24 * 60 * 60 * 1000)
+    case '7d':
+      return new Date(now.getTime() - 7 * 24 * 60 * 60 * 1000)
+    case '30d':
+      return new Date(now.getTime() - 30 * 24 * 60 * 60 * 1000)
     default:
       return null
   }
 }
 
 export function useChanges(options: UseChangesOptions = {}) {
-  const { namespaces = [], kind, timeRange = '1h', filter = 'all', includeK8sEvents = true, includeManaged = false, includeDeleted = true, limit = 200, enabled = true } = options
+  const {
+    namespaces = [],
+    kinds,
+    timeRange = '1h',
+    filter = 'all',
+    includeK8sEvents = true,
+    includeManaged = false,
+    includeDeleted = true,
+    limit = 200,
+    enabled = true,
+    deltaSync = false,
+  } = options
+  const queryClient = useQueryClient()
+
+  // Only a single-kind selection narrows the server query; a multi-kind
+  // selection is filtered client-side so the server cap isn't spent on one kind.
+  const serverKind = kinds && kinds.length === 1 ? kinds[0] : undefined
 
   const params = new URLSearchParams()
   if (namespaces.length > 0) params.set('namespaces', namespaces.join(','))
-  if (kind) params.set('kind', kind)
+  if (serverKind) params.set('kind', serverKind)
   if (filter) params.set('filter', filter)
   if (!includeK8sEvents) params.set('include_k8s_events', 'false')
   if (includeManaged) params.set('include_managed', 'true')
@@ -1159,18 +1704,50 @@ export function useChanges(options: UseChangesOptions = {}) {
   }
 
   const queryString = params.toString()
+  const path = `/changes${queryString ? `?${queryString}` : ''}`
+  const queryKey = [
+    'changes',
+    namespaces,
+    serverKind,
+    timeRange,
+    filter,
+    includeK8sEvents,
+    includeManaged,
+    includeDeleted,
+    limit,
+  ]
 
   return useQuery<TimelineEvent[]>({
-    queryKey: ['changes', namespaces, kind, timeRange, filter, includeK8sEvents, includeManaged, includeDeleted, limit],
-    queryFn: () => fetchJSON(`/changes${queryString ? `?${queryString}` : ''}`),
+    queryKey,
+    queryFn: async ({ signal }) => {
+      if (!deltaSync) return fetchJSON(path, signal)
+
+      const metaKey = JSON.stringify(queryKey)
+      const cached = queryClient.getQueryData<TimelineEvent[]>(queryKey)
+      return runDeltaSyncFetch({
+        path,
+        queryString,
+        limit,
+        metaKey,
+        cached,
+        metaStore: changesDeltaMeta,
+        now: Date.now(),
+        signal,
+      })
+    },
     staleTime: 5000, // Consider data stale after 5 seconds to ensure fresh data on navigation
-    refetchInterval: CHANGES_REFRESH_INTERVAL_MS, // SSE handles real-time updates; this is a fallback
+    refetchInterval: CHANGES_REFRESH_INTERVAL_MS, // SSE-driven invalidation handles real-time updates; this is the no-SSE fallback
     enabled,
   })
 }
 
 // Children changes for a parent workload (e.g., ReplicaSets and Pods under a Deployment)
-export function useResourceChildren(kind: string, namespace: string, name: string, timeRange: TimeRange = '1h') {
+export function useResourceChildren(
+  kind: string,
+  namespace: string,
+  name: string,
+  timeRange: TimeRange = '1h',
+) {
   const sinceDate = getTimeRangeDate(timeRange)
   const params = new URLSearchParams()
   if (sinceDate) {
@@ -1199,7 +1776,11 @@ export interface ResourceEventsResult {
 // K8s events and resource updates are fetched separately so a high-frequency
 // informer update stream (e.g. a CrashLoop status field flapping every few
 // seconds) can never starve out user-meaningful K8s events under a shared limit.
-export function useResourceEvents(kind: string, namespace: string, name: string): ResourceEventsResult {
+export function useResourceEvents(
+  kind: string,
+  namespace: string,
+  name: string,
+): ResourceEventsResult {
   // The timeline store keys events by their K8s Kind (singular PascalCase, e.g. "Pod"),
   // but callers pass the URL-form kind ("pods").
   const singularKind = pluralToKind(kind)
@@ -1265,8 +1846,8 @@ export function useResourceEvents(kind: string, namespace: string, name: string)
 export interface ContainerMetrics {
   name: string
   usage: {
-    cpu: string      // e.g., "10m" (millicores)
-    memory: string   // e.g., "128Mi"
+    cpu: string // e.g., "10m" (millicores)
+    memory: string // e.g., "128Mi"
   }
 }
 
@@ -1341,8 +1922,8 @@ export function useNodeMetrics(nodeName: string, options?: { enabled?: boolean }
 
 export interface MetricsDataPoint {
   timestamp: string
-  cpu: number      // CPU in nanocores
-  memory: number   // Memory in bytes
+  cpu: number // CPU in nanocores
+  memory: number // Memory in bytes
 }
 
 export interface ContainerMetricsHistory {
@@ -1371,7 +1952,9 @@ export interface NodeMetricsHistory {
   metricsUnavailableReason?: string
 }
 
-function withoutCollectionError<T extends { collectionError?: string; rawCollectionError?: string }>(history: T): T {
+function withoutCollectionError<
+  T extends { collectionError?: string; rawCollectionError?: string },
+>(history: T): T {
   const next = { ...history }
   delete next.collectionError
   delete next.rawCollectionError
@@ -1380,15 +1963,26 @@ function withoutCollectionError<T extends { collectionError?: string; rawCollect
 
 export function normalizePodMetricsHistory(history: PodMetricsHistory): PodMetricsHistory {
   if (history.metricsUnavailable !== true) return history
-  return { ...withoutCollectionError(history), metricsUnavailable: true, metricsUnavailableReason: history.rawCollectionError || history.collectionError }
+  return {
+    ...withoutCollectionError(history),
+    metricsUnavailable: true,
+    metricsUnavailableReason: history.rawCollectionError || history.collectionError,
+  }
 }
 
 export function normalizeNodeMetricsHistory(history: NodeMetricsHistory): NodeMetricsHistory {
   if (history.metricsUnavailable !== true) return history
-  return { ...withoutCollectionError(history), metricsUnavailable: true, metricsUnavailableReason: history.rawCollectionError || history.collectionError }
+  return {
+    ...withoutCollectionError(history),
+    metricsUnavailable: true,
+    metricsUnavailableReason: history.rawCollectionError || history.collectionError,
+  }
 }
 
-export function shouldFetchLiveMetrics(historySettled: boolean, metricsUnavailable: boolean): boolean {
+export function shouldFetchLiveMetrics(
+  historySettled: boolean,
+  metricsUnavailable: boolean,
+): boolean {
   return historySettled && !metricsUnavailable
 }
 
@@ -1396,7 +1990,11 @@ export function isLiveMetricsUnavailable(liveMetricsEnabled: boolean, metrics: u
   return liveMetricsEnabled && metrics === null
 }
 
-export function getVisibleLiveMetrics<T>(liveMetricsEnabled: boolean, metricsUnavailable: boolean, metrics: T | null | undefined): T | undefined {
+export function getVisibleLiveMetrics<T>(
+  liveMetricsEnabled: boolean,
+  metricsUnavailable: boolean,
+  metrics: T | null | undefined,
+): T | undefined {
   if (!liveMetricsEnabled || metricsUnavailable) return undefined
   return metrics ?? undefined
 }
@@ -1405,7 +2003,10 @@ export function getVisibleLiveMetrics<T>(liveMetricsEnabled: boolean, metricsUna
 export function usePodMetricsHistory(namespace: string, podName: string) {
   return useQuery<PodMetricsHistory>({
     queryKey: ['pod-metrics-history', namespace, podName],
-    queryFn: async () => normalizePodMetricsHistory(await fetchJSON<PodMetricsHistory>(`/metrics/pods/${namespace}/${podName}/history`)),
+    queryFn: async () =>
+      normalizePodMetricsHistory(
+        await fetchJSON<PodMetricsHistory>(`/metrics/pods/${namespace}/${podName}/history`),
+      ),
     enabled: Boolean(namespace && podName),
     staleTime: 25000, // Slightly less than poll interval
     refetchInterval: 30000, // Match the backend poll interval
@@ -1416,7 +2017,10 @@ export function usePodMetricsHistory(namespace: string, podName: string) {
 export function useNodeMetricsHistory(nodeName: string) {
   return useQuery<NodeMetricsHistory>({
     queryKey: ['node-metrics-history', nodeName],
-    queryFn: async () => normalizeNodeMetricsHistory(await fetchJSON<NodeMetricsHistory>(`/metrics/nodes/${nodeName}/history`)),
+    queryFn: async () =>
+      normalizeNodeMetricsHistory(
+        await fetchJSON<NodeMetricsHistory>(`/metrics/nodes/${nodeName}/history`),
+      ),
     enabled: Boolean(nodeName),
     staleTime: 25000,
     refetchInterval: 30000,
@@ -1427,20 +2031,20 @@ export function useNodeMetricsHistory(nodeName: string) {
 export interface TopPodMetrics {
   namespace: string
   name: string
-  cpu: number           // nanocores (usage)
-  memory: number        // bytes (usage)
-  cpuRequest: number    // nanocores (sum across containers)
-  cpuLimit: number      // nanocores (sum across containers)
+  cpu: number // nanocores (usage)
+  memory: number // bytes (usage)
+  cpuRequest: number // nanocores (sum across containers)
+  cpuLimit: number // nanocores (sum across containers)
   memoryRequest: number // bytes (sum across containers)
-  memoryLimit: number   // bytes (sum across containers)
+  memoryLimit: number // bytes (sum across containers)
 }
 
 export interface TopNodeMetrics {
   name: string
-  cpu: number              // nanocores (usage)
-  memory: number           // bytes (usage)
-  podCount: number         // pods scheduled on this node
-  cpuAllocatable: number   // nanocores
+  cpu: number // nanocores (usage)
+  memory: number // bytes (usage)
+  podCount: number // pods scheduled on this node
+  cpuAllocatable: number // nanocores
   memoryAllocatable: number // bytes
 }
 
@@ -1516,11 +2120,13 @@ export interface PrometheusResourceMetrics {
   range: string
   result: PrometheusQueryResult
   query?: string // PromQL query (included when result is empty, for diagnostics)
-  hint?: string  // Contextual hint when results are empty (e.g. cri-docker label issues)
+  hint?: string // Contextual hint when results are empty (e.g. cri-docker label issues)
 }
 
-export type PrometheusMetricCategory = 'cpu' | 'memory' | 'network_rx' | 'network_tx' | 'filesystem' | 'restarts'
-export type PrometheusTimeRange = '10m' | '30m' | '1h' | '3h' | '6h' | '12h' | '24h' | '48h' | '7d' | '14d'
+export type PrometheusMetricCategory =
+  'cpu' | 'memory' | 'network_rx' | 'network_tx' | 'filesystem' | 'restarts'
+export type PrometheusTimeRange =
+  '10m' | '30m' | '1h' | '3h' | '6h' | '12h' | '24h' | '48h' | '7d' | '14d'
 
 // PVC usage at a moment in time, derived from kubelet_volume_stats_*.
 // HasData=false silently indicates the CSI driver doesn't report or Prom
@@ -1534,17 +2140,49 @@ export interface PrometheusPVCUsage {
   hasData: boolean
 }
 
-export type RightsizingTone = 'ok' | 'info' | 'warning' | 'alert' | 'critical'
+export type RightsizingFit =
+  'balanced' | 'oversized' | 'under_requested' | 'missing_request' | 'insufficient_history'
+export type RightsizingConfidence = 'low' | 'medium' | 'high'
+export type RightsizingOwnerCoverage = 'ksm_history' | 'current_pods'
 
 export interface RightsizingRow {
   container: string
   resource: 'cpu' | 'memory'
+  fit: RightsizingFit
+  confidence: RightsizingConfidence
   currentRequest?: string
+  currentRequestValue?: number
   currentLimit?: string
-  p95?: string
+  currentLimitValue?: number
+  observed?: {
+    name: 'P95' | 'P99' | 'Max'
+    value: number
+    formatted: string
+  }
+  peak?: {
+    name: 'P99'
+    value: number
+    formatted: string
+  }
+  calculatedRequest?: string
+  calculatedRequestValue?: number
   recommendedRequest?: string
-  tone: RightsizingTone
-  message: string
+  recommendedRequestValue?: number
+  reductionLimited?: boolean
+  bursty?: boolean
+  recommendationReason?: string
+  sampleCount: number
+  expectedSamples: number
+  coverage: number
+  hpaManaged: boolean
+  hpaEvidenceAvailable: boolean
+  throttleAvailable?: boolean
+  throttleRatio?: number
+  currentPodOOM?: boolean
+  windowOomEvidence?: boolean
+  oomEvidenceAvailable: boolean
+  limitConflict?: boolean
+  queryError?: string
 }
 
 export interface PrometheusRightsizing {
@@ -1552,11 +2190,46 @@ export interface PrometheusRightsizing {
   namespace: string
   name: string
   window: string
+  source: 'radar'
+  ownerCoverage: RightsizingOwnerCoverage
+  scaledToZero: boolean
   sampleAvailable: boolean
   rows: RightsizingRow[]
   reason?: string
 }
 
+export type RightsizingScanState = 'complete' | 'partial' | 'unavailable'
+
+export interface RightsizingScanWorkload {
+  kind: string
+  namespace: string
+  name: string
+  replicas: number
+  scaledToZero: boolean
+  rows: RightsizingRow[]
+}
+
+export interface RightsizingScanCoverage {
+  workloadsDiscovered: number
+  workloadsEvaluated: number
+  workloadsWithData: number
+  batches: number
+  completedBatches: number
+  restrictedKinds?: string[]
+  unavailableKinds?: string[]
+}
+
+export interface RightsizingScanResponse {
+  state: RightsizingScanState
+  scannedAt: string
+  window: string
+  source: 'radar'
+  coverage: RightsizingScanCoverage
+  workloads: RightsizingScanWorkload[]
+  warnings?: { code: string; message: string }[]
+  reason?: string
+}
+
 // Check Prometheus availability
 export function usePrometheusStatus() {
   return useQuery<PrometheusStatus>({
@@ -1567,12 +2240,32 @@ export function usePrometheusStatus() {
   })
 }
 
+export interface ArgoStatus {
+  // configured = a URL or token is set; connected = a probe has landed and the
+  // client is live. The two differ right after a restart (configured, reconnecting).
+  configured: boolean
+  connected: boolean
+  address?: string
+}
+
+export function useArgoStatus(enabled = true) {
+  return useQuery<ArgoStatus>({
+    queryKey: ['argocd-status'],
+    queryFn: () => fetchJSON('/integrations/argocd/status'),
+    enabled,
+    staleTime: 30000,
+    refetchInterval: 60000,
+  })
+}
+
 // Connect to Prometheus (trigger discovery)
 export function usePrometheusConnect() {
   const queryClient = useQueryClient()
   return useMutation({
     mutationFn: async () => {
-      const resp = await apiFetch(`${getApiBase()}/prometheus/connect`, { method: 'POST' })
+      const resp = await apiFetch(`${getApiBase()}/prometheus/connect`, {
+        method: 'POST',
+      })
       if (!resp.ok) {
         const body = await resp.json().catch(() => ({ error: 'Unknown error' }))
         throw new Error(body.error || `HTTP ${resp.status}`)
@@ -1633,7 +2326,9 @@ export function useAutoPromConnect(): void {
 
     // Persist the "we've connected here before" signal once a connection lands.
     if (status?.connected) {
-      try { window.localStorage.setItem(promAutoConnectKey(context), '1') } catch {
+      try {
+        window.localStorage.setItem(promAutoConnectKey(context), '1')
+      } catch {
         // localStorage can throw in some restricted browser modes — fail open.
       }
       return
@@ -1641,7 +2336,9 @@ export function useAutoPromConnect(): void {
 
     if (attemptedRef.current === context) return
     let cached: string | null = null
-    try { cached = window.localStorage.getItem(promAutoConnectKey(context)) } catch {
+    try {
+      cached = window.localStorage.getItem(promAutoConnectKey(context))
+    } catch {
       // keep the null fallback
     }
 
@@ -1653,16 +2350,20 @@ export function useAutoPromConnect(): void {
     const timeout = window.setTimeout(() => {
       // Direct apiFetch (not via the usePrometheusConnect mutation) so the
       // meta-driven toast handler stays silent — the user didn't click anything.
-      apiFetch(`${getApiBase()}/prometheus/connect?optional=true`, { method: 'POST' })
-        .then(async resp => {
+      apiFetch(`${getApiBase()}/prometheus/connect?optional=true`, {
+        method: 'POST',
+      })
+        .then(async (resp) => {
           if (!resp.ok) throw new Error(`HTTP ${resp.status}`)
-          const nextStatus = await resp.json() as PrometheusStatus
+          const nextStatus = (await resp.json()) as PrometheusStatus
           queryClient.setQueryData(['prometheus-status'], nextStatus)
           if (!nextStatus.connected) throw new Error(nextStatus.error || 'Prometheus unavailable')
           queryClient.invalidateQueries({ queryKey: ['prometheus-status'] })
         })
         .catch(() => {
-          try { window.localStorage.removeItem(promAutoConnectKey(context)) } catch {
+          try {
+            window.localStorage.removeItem(promAutoConnectKey(context))
+          } catch {
             // ignore — manual CTA will render once status refreshes
           }
           attemptedRef.current = null
@@ -1720,8 +2421,7 @@ export function usePrometheusClusterMetrics(
 ) {
   return useQuery<PrometheusResourceMetrics>({
     queryKey: ['prometheus-cluster-metrics', category, range],
-    queryFn: () =>
-      fetchJSON(`/prometheus/cluster?category=${category}&range=${range}`),
+    queryFn: () => fetchJSON(`/prometheus/cluster?category=${category}&range=${range}`),
     enabled,
     staleTime: 30000,
     refetchInterval: 60000,
@@ -1740,22 +2440,75 @@ export function usePrometheusPVCUsage(namespace: string, name: string, enabled =
 }
 
 // Fetch rightsizing recommendations for a workload (Deployment / StatefulSet / DaemonSet).
-export function usePrometheusRightsizing(kind: string, namespace: string, name: string, enabled = true) {
+export function usePrometheusRightsizing(
+  kind: string,
+  namespace: string,
+  name: string,
+  enabled = true,
+) {
   return useQuery<PrometheusRightsizing>({
     queryKey: ['prometheus-rightsizing', kind, namespace, name],
     queryFn: () => fetchJSON(`/prometheus/rightsizing/${kind}/${namespace}/${name}`),
     enabled: enabled && Boolean(kind && namespace && name),
-    staleTime: 5 * 60 * 1000, // P95 over 24h is slow to shift; cache aggressively
+    staleTime: 5 * 60 * 1000,
     refetchInterval: 10 * 60 * 1000,
   })
 }
 
+const RIGHTSIZING_SCAN_CACHE_TIME = 5 * 60 * 1000
+
+export function getRightsizingScanCacheConfig(
+  namespaces: string[],
+  context = '',
+): {
+  namespaceKey: string
+  queryKey: readonly ['prometheus-rightsizing-scan', string, string]
+  queryFn: typeof skipToken
+  gcTime: number
+} {
+  const namespaceKey = [...namespaces].sort().join(',')
+  return {
+    namespaceKey,
+    queryKey: ['prometheus-rightsizing-scan', context, namespaceKey] as const,
+    queryFn: skipToken,
+    gcTime: RIGHTSIZING_SCAN_CACHE_TIME,
+  }
+}
+
+// A fleet rightsizing scan is intentionally manual. It can query seven days of
+// Prometheus history for many containers, so navigation alone must never run it.
+export function useRightsizingScan(namespaces: string[], context = '') {
+  const queryClient = useQueryClient()
+  const { namespaceKey, ...snapshotOptions } = getRightsizingScanCacheConfig(namespaces, context)
+  const scanScope = { namespaceKey, queryKey: snapshotOptions.queryKey }
+  const snapshot = useQuery<RightsizingScanResponse>(snapshotOptions)
+  const mutation = useMutation({
+    mutationFn: async (startedScope: typeof scanScope) => {
+      const params = new URLSearchParams()
+      if (startedScope.namespaceKey) params.set('namespaces', startedScope.namespaceKey)
+      const query = params.toString()
+      return fetchJSON<RightsizingScanResponse>(
+        `/prometheus/rightsizing/scan${query ? `?${query}` : ''}`,
+        {
+          method: 'POST',
+        },
+      )
+    },
+    onSuccess: (result, startedScope) => queryClient.setQueryData(startedScope.queryKey, result),
+  })
+  return {
+    ...mutation,
+    data: snapshot.data,
+    mutate: () => mutation.mutate(scanScope),
+    mutateAsync: () => mutation.mutateAsync(scanScope),
+  }
+}
+
 // Raw PromQL query (range). Used by HPA charts for status_current_replicas etc.
 export function usePromQLRange(query: string, range: PrometheusTimeRange = '1h', enabled = true) {
   return useQuery<PrometheusQueryResult>({
     queryKey: ['promql-range', query, range],
-    queryFn: () =>
-      fetchJSON(`/prometheus/query?query=${encodeURIComponent(query)}&range=${range}`),
+    queryFn: () => fetchJSON(`/prometheus/query?query=${encodeURIComponent(query)}&range=${range}`),
     enabled: enabled && Boolean(query),
     staleTime: 30000,
     refetchInterval: 60000,
@@ -1788,12 +2541,16 @@ export interface LogStreamEvent {
 }
 
 // Fetch pod logs (non-streaming)
-export function usePodLogs(namespace: string, podName: string, options?: {
-  container?: string
-  tailLines?: number
-  previous?: boolean
-  sinceSeconds?: number
-}) {
+export function usePodLogs(
+  namespace: string,
+  podName: string,
+  options?: {
+    container?: string
+    tailLines?: number
+    previous?: boolean
+    sinceSeconds?: number
+  },
+) {
   const params = new URLSearchParams()
   if (options?.container) params.set('container', options.container)
   if (options?.tailLines) params.set('tailLines', String(options.tailLines))
@@ -1802,8 +2559,17 @@ export function usePodLogs(namespace: string, podName: string, options?: {
   const queryString = params.toString()
 
   return useQuery<LogsResponse>({
-    queryKey: ['pod-logs', namespace, podName, options?.container, options?.tailLines, options?.previous, options?.sinceSeconds],
-    queryFn: () => fetchJSON(`/pods/${namespace}/${podName}/logs${queryString ? `?${queryString}` : ''}`),
+    queryKey: [
+      'pod-logs',
+      namespace,
+      podName,
+      options?.container,
+      options?.tailLines,
+      options?.previous,
+      options?.sinceSeconds,
+    ],
+    queryFn: () =>
+      fetchJSON(`/pods/${namespace}/${podName}/logs${queryString ? `?${queryString}` : ''}`),
     enabled: Boolean(namespace && podName),
     staleTime: 5000, // Allow refetch after 5 seconds
   })
@@ -1818,7 +2584,7 @@ export function createLogStream(
     tailLines?: number
     previous?: boolean
     sinceSeconds?: number
-  }
+  },
 ): EventSource {
   const params = new URLSearchParams()
   if (options?.container) params.set('container', options.container)
@@ -1827,9 +2593,12 @@ export function createLogStream(
   if (options?.sinceSeconds) params.set('sinceSeconds', String(options.sinceSeconds))
   const queryString = params.toString()
 
-  return new EventSource(`${getApiBase()}/pods/${namespace}/${podName}/logs/stream${queryString ? `?${queryString}` : ''}`, {
-    withCredentials: getCredentialsMode() === 'include',
-  })
+  return new EventSource(
+    `${getApiBase()}/pods/${namespace}/${podName}/logs/stream${queryString ? `?${queryString}` : ''}`,
+    {
+      withCredentials: getCredentialsMode() === 'include',
+    },
+  )
 }
 
 // ============================================================================
@@ -1862,8 +2631,23 @@ export function useUpdateResource() {
   const queryClient = useQueryClient()
 
   return useMutation({
-    mutationFn: async ({ kind, namespace, name, yaml, force = true }: { kind: string; namespace: string; name: string; yaml: string; force?: boolean }) => {
-      const url = new URL(`${getApiBase()}/resources/${kind}/${namespace}/${name}`, window.location.origin)
+    mutationFn: async ({
+      kind,
+      namespace,
+      name,
+      yaml,
+      force = true,
+    }: {
+      kind: string
+      namespace: string
+      name: string
+      yaml: string
+      force?: boolean
+    }) => {
+      const url = new URL(
+        `${getApiBase()}/resources/${kind}/${namespace}/${name}`,
+        window.location.origin,
+      )
       if (!force) {
         url.searchParams.set('force', 'false')
       }
@@ -1891,16 +2675,22 @@ export function useUpdateResource() {
       // lagging cache — the change appears not to have taken effect.
       if (updated && typeof updated === 'object' && updated.metadata) {
         queryClient.setQueriesData(
-          { queryKey: ['resource', variables.kind, variables.namespace, variables.name] },
+          {
+            queryKey: ['resource', variables.kind, variables.namespace, variables.name],
+          },
           (old: any) =>
             old && typeof old === 'object' && 'resource' in old
               ? { ...old, resource: updated }
-              : { resource: updated }
+              : { resource: updated },
         )
       } else {
-        queryClient.invalidateQueries({ queryKey: ['resource', variables.kind, variables.namespace, variables.name] })
+        queryClient.invalidateQueries({
+          queryKey: ['resource', variables.kind, variables.namespace, variables.name],
+        })
       }
-      queryClient.invalidateQueries({ queryKey: ['resources', variables.kind] })
+      queryClient.invalidateQueries({
+        queryKey: ['resources', variables.kind],
+      })
       queryClient.invalidateQueries({ queryKey: ['topology'] })
     },
   })
@@ -1909,13 +2699,24 @@ export function useUpdateResource() {
 // Cascade delete preview — shows resources that will be garbage-collected
 export interface CascadeDeletePreview {
   root: { kind: string; namespace: string; name: string; group?: string }
-  dependents: { kind: string; namespace: string; name: string; group?: string }[]
+  dependents: {
+    kind: string
+    namespace: string
+    name: string
+    group?: string
+  }[]
 }
 
-export function useCascadeDeletePreview(kind: string, namespace: string, name: string, enabled: boolean) {
+export function useCascadeDeletePreview(
+  kind: string,
+  namespace: string,
+  name: string,
+  enabled: boolean,
+) {
   return useQuery<CascadeDeletePreview>({
     queryKey: ['cascade-preview', kind, namespace, name],
-    queryFn: () => fetchJSON<CascadeDeletePreview>(`/resources/${kind}/${namespace}/${name}/cascade-preview`),
+    queryFn: () =>
+      fetchJSON<CascadeDeletePreview>(`/resources/${kind}/${namespace}/${name}/cascade-preview`),
     enabled,
     staleTime: 30_000,
   })
@@ -1926,8 +2727,23 @@ export function useDeleteResource() {
   const queryClient = useQueryClient()
 
   return useMutation({
-    mutationFn: async ({ kind, group, namespace, name, force }: { kind: string; group?: string; namespace: string; name: string; force?: boolean }) => {
-      const url = new URL(`${getApiBase()}/resources/${kind}/${namespace}/${name}`, window.location.origin)
+    mutationFn: async ({
+      kind,
+      group,
+      namespace,
+      name,
+      force,
+    }: {
+      kind: string
+      group?: string
+      namespace: string
+      name: string
+      force?: boolean
+    }) => {
+      const url = new URL(
+        `${getApiBase()}/resources/${kind}/${namespace}/${name}`,
+        window.location.origin,
+      )
       if (group) {
         url.searchParams.set('group', group)
       }
@@ -1949,7 +2765,9 @@ export function useDeleteResource() {
       successMessage: 'Resource deleted',
     },
     onSuccess: (_, variables) => {
-      queryClient.invalidateQueries({ queryKey: ['resources', variables.kind] })
+      queryClient.invalidateQueries({
+        queryKey: ['resources', variables.kind],
+      })
       queryClient.invalidateQueries({ queryKey: ['topology'] })
     },
   })
@@ -1959,10 +2777,24 @@ export function useBulkDeleteResources() {
   const queryClient = useQueryClient()
 
   return useMutation({
-    mutationFn: async ({ items, force }: { items: Array<{ kind: string; group?: string; namespace: string; name: string }>; force?: boolean }) => {
+    mutationFn: async ({
+      items,
+      force,
+    }: {
+      items: Array<{
+        kind: string
+        group?: string
+        namespace: string
+        name: string
+      }>
+      force?: boolean
+    }) => {
       const results = await Promise.allSettled(
         items.map(async ({ kind, group, namespace, name }) => {
-          const url = new URL(`${getApiBase()}/resources/${kind}/${namespace}/${name}`, window.location.origin)
+          const url = new URL(
+            `${getApiBase()}/resources/${kind}/${namespace}/${name}`,
+            window.location.origin,
+          )
           if (group) url.searchParams.set('group', group)
           if (force) url.searchParams.set('force', 'true')
           const response = await apiFetch(url.toString(), { method: 'DELETE' })
@@ -1971,9 +2803,9 @@ export function useBulkDeleteResources() {
             throw new Error(error.error || `Failed to delete ${namespace}/${name}`)
           }
           return { kind, namespace, name }
-        })
+        }),
       )
-      const failed = results.filter(r => r.status === 'rejected')
+      const failed = results.filter((r) => r.status === 'rejected')
       if (failed.length > 0) {
         throw new Error(`Failed to delete ${failed.length} of ${items.length} resources`)
       }
@@ -2006,13 +2838,19 @@ interface BulkWorkloadMutationResult {
 }
 
 function failedBulkWorkloadMessages(results: PromiseSettledResult<unknown>[]): string[] {
-  return results.flatMap(r => r.status === 'rejected'
-    ? [r.reason instanceof Error ? r.reason.message : String(r.reason)]
-    : []
+  return results.flatMap((r) =>
+    r.status === 'rejected'
+      ? [r.reason instanceof Error ? r.reason.message : String(r.reason)]
+      : [],
   )
 }
 
-function bulkWorkloadFailureMessage(action: string, failed: number, total: number, messages: string[]): string {
+function bulkWorkloadFailureMessage(
+  action: string,
+  failed: number,
+  total: number,
+  messages: string[],
+): string {
   return `Failed to ${action} ${failed} of ${total} workloads:\n${messages.join('\n')}`
 }
 
@@ -2020,27 +2858,45 @@ export function useBulkRestartWorkloads() {
   const queryClient = useQueryClient()
 
   return useMutation({
-    mutationFn: async ({ items }: { items: BulkWorkloadItem[] }): Promise<BulkWorkloadMutationResult> => {
+    mutationFn: async ({
+      items,
+    }: {
+      items: BulkWorkloadItem[]
+    }): Promise<BulkWorkloadMutationResult> => {
       if (items.length === 0) {
         return { requested: 0, succeeded: 0, failedMessages: [] }
       }
       const results = await Promise.allSettled(
         items.map(async ({ kind, namespace, name }) => {
-          const response = await apiFetch(`${getApiBase()}/workloads/${kind}/${namespace}/${name}/restart`, {
-            method: 'POST',
-          })
+          const response = await apiFetch(
+            `${getApiBase()}/workloads/${kind}/${namespace}/${name}/restart`,
+            {
+              method: 'POST',
+            },
+          )
           if (!response.ok) {
             const error = await response.json().catch(() => ({ error: 'Unknown error' }))
             throw new Error(`${namespace}/${name}: ${error.error || `HTTP ${response.status}`}`)
           }
           return { kind, namespace, name }
-        })
+        }),
       )
       const failedMessages = failedBulkWorkloadMessages(results)
       if (failedMessages.length === items.length) {
-        throw new Error(bulkWorkloadFailureMessage('restart', failedMessages.length, items.length, failedMessages))
+        throw new Error(
+          bulkWorkloadFailureMessage(
+            'restart',
+            failedMessages.length,
+            items.length,
+            failedMessages,
+          ),
+        )
+      }
+      return {
+        requested: items.length,
+        succeeded: items.length - failedMessages.length,
+        failedMessages,
       }
-      return { requested: items.length, succeeded: items.length - failedMessages.length, failedMessages }
     },
     meta: {
       errorMessage: 'Failed to restart some workloads',
@@ -2066,29 +2922,44 @@ export function useBulkScaleWorkloads() {
   const queryClient = useQueryClient()
 
   return useMutation({
-    mutationFn: async ({ items, replicas }: { items: BulkWorkloadItem[]; replicas: number }): Promise<BulkWorkloadMutationResult> => {
+    mutationFn: async ({
+      items,
+      replicas,
+    }: {
+      items: BulkWorkloadItem[]
+      replicas: number
+    }): Promise<BulkWorkloadMutationResult> => {
       if (items.length === 0) {
         return { requested: 0, succeeded: 0, failedMessages: [] }
       }
       const results = await Promise.allSettled(
         items.map(async ({ kind, namespace, name }) => {
-          const response = await apiFetch(`${getApiBase()}/workloads/${kind}/${namespace}/${name}/scale`, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({ replicas }),
-          })
+          const response = await apiFetch(
+            `${getApiBase()}/workloads/${kind}/${namespace}/${name}/scale`,
+            {
+              method: 'POST',
+              headers: { 'Content-Type': 'application/json' },
+              body: JSON.stringify({ replicas }),
+            },
+          )
           if (!response.ok) {
             const error = await response.json().catch(() => ({ error: 'Unknown error' }))
             throw new Error(`${namespace}/${name}: ${error.error || `HTTP ${response.status}`}`)
           }
           return { kind, namespace, name }
-        })
+        }),
       )
       const failedMessages = failedBulkWorkloadMessages(results)
       if (failedMessages.length === items.length) {
-        throw new Error(bulkWorkloadFailureMessage('scale', failedMessages.length, items.length, failedMessages))
+        throw new Error(
+          bulkWorkloadFailureMessage('scale', failedMessages.length, items.length, failedMessages),
+        )
+      }
+      return {
+        requested: items.length,
+        succeeded: items.length - failedMessages.length,
+        failedMessages,
       }
-      return { requested: items.length, succeeded: items.length - failedMessages.length, failedMessages }
     },
     meta: {
       errorMessage: 'Failed to scale some workloads',
@@ -2122,7 +2993,17 @@ export function useApplyResource() {
   const queryClient = useQueryClient()
 
   return useMutation({
-    mutationFn: async ({ yaml, mode = 'apply', dryRun = false, force = false }: { yaml: string; mode?: 'apply' | 'create'; dryRun?: boolean; force?: boolean }) => {
+    mutationFn: async ({
+      yaml,
+      mode = 'apply',
+      dryRun = false,
+      force = false,
+    }: {
+      yaml: string
+      mode?: 'apply' | 'create'
+      dryRun?: boolean
+      force?: boolean
+    }) => {
       const url = new URL(`${getApiBase()}/resources/apply`, window.location.origin)
       url.searchParams.set('mode', mode)
       if (dryRun) {
@@ -2155,6 +3036,25 @@ export function useApplyResource() {
 // CronJob operations
 // ============================================================================
 
+function invalidateCronJobOperationQueries(
+  queryClient: ReturnType<typeof useQueryClient>,
+  namespace: string,
+  name: string,
+) {
+  queryClient.invalidateQueries({ queryKey: ['resources', 'cronjobs'] })
+  queryClient.invalidateQueries({ queryKey: ['resources', 'jobs'] })
+  queryClient.invalidateQueries({
+    queryKey: ['resource', 'cronjobs', namespace, name],
+  })
+  queryClient.invalidateQueries({
+    queryKey: ['workload-runs', 'cronjobs', namespace, name],
+  })
+  queryClient.invalidateQueries({ queryKey: ['applications'] })
+  queryClient.invalidateQueries({ queryKey: ['dashboard'] })
+  queryClient.invalidateQueries({ queryKey: ['resource-counts'] })
+  queryClient.invalidateQueries({ queryKey: ['topology'] })
+}
+
 // Trigger a CronJob (create a Job from it)
 export function useTriggerCronJob() {
   const queryClient = useQueryClient()
@@ -2174,10 +3074,8 @@ export function useTriggerCronJob() {
       errorMessage: 'Failed to trigger CronJob',
       successMessage: 'CronJob triggered',
     },
-    onSuccess: () => {
-      queryClient.invalidateQueries({ queryKey: ['resources', 'cronjobs'] })
-      queryClient.invalidateQueries({ queryKey: ['resources', 'jobs'] })
-      queryClient.invalidateQueries({ queryKey: ['topology'] })
+    onSuccess: (_, variables) => {
+      invalidateCronJobOperationQueries(queryClient, variables.namespace, variables.name)
     },
   })
 }
@@ -2201,9 +3099,8 @@ export function useSuspendCronJob() {
       errorMessage: 'Failed to suspend CronJob',
       successMessage: 'CronJob suspended',
     },
-    onSuccess: () => {
-      queryClient.invalidateQueries({ queryKey: ['resources', 'cronjobs'] })
-      queryClient.invalidateQueries({ queryKey: ['topology'] })
+    onSuccess: (_, variables) => {
+      invalidateCronJobOperationQueries(queryClient, variables.namespace, variables.name)
     },
   })
 }
@@ -2227,9 +3124,8 @@ export function useResumeCronJob() {
       errorMessage: 'Failed to resume CronJob',
       successMessage: 'CronJob resumed',
     },
-    onSuccess: () => {
-      queryClient.invalidateQueries({ queryKey: ['resources', 'cronjobs'] })
-      queryClient.invalidateQueries({ queryKey: ['topology'] })
+    onSuccess: (_, variables) => {
+      invalidateCronJobOperationQueries(queryClient, variables.namespace, variables.name)
     },
   })
 }
@@ -2243,10 +3139,21 @@ export function useRestartWorkload() {
   const queryClient = useQueryClient()
 
   return useMutation({
-    mutationFn: async ({ kind, namespace, name }: { kind: string; namespace: string; name: string }) => {
-      const response = await apiFetch(`${getApiBase()}/workloads/${kind}/${namespace}/${name}/restart`, {
-        method: 'POST',
-      })
+    mutationFn: async ({
+      kind,
+      namespace,
+      name,
+    }: {
+      kind: string
+      namespace: string
+      name: string
+    }) => {
+      const response = await apiFetch(
+        `${getApiBase()}/workloads/${kind}/${namespace}/${name}/restart`,
+        {
+          method: 'POST',
+        },
+      )
       if (!response.ok) {
         const error = await response.json().catch(() => ({ error: 'Unknown error' }))
         throw new Error(error.error || `HTTP ${response.status}`)
@@ -2258,7 +3165,9 @@ export function useRestartWorkload() {
       successMessage: 'Workload restarting',
     },
     onSuccess: (_, variables) => {
-      queryClient.invalidateQueries({ queryKey: ['resources', variables.kind] })
+      queryClient.invalidateQueries({
+        queryKey: ['resources', variables.kind],
+      })
       queryClient.invalidateQueries({ queryKey: ['topology'] })
     },
   })
@@ -2269,12 +3178,25 @@ export function useScaleWorkload() {
   const queryClient = useQueryClient()
 
   return useMutation({
-    mutationFn: async ({ kind, namespace, name, replicas }: { kind: string; namespace: string; name: string; replicas: number }) => {
-      const response = await apiFetch(`${getApiBase()}/workloads/${kind}/${namespace}/${name}/scale`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ replicas }),
-      })
+    mutationFn: async ({
+      kind,
+      namespace,
+      name,
+      replicas,
+    }: {
+      kind: string
+      namespace: string
+      name: string
+      replicas: number
+    }) => {
+      const response = await apiFetch(
+        `${getApiBase()}/workloads/${kind}/${namespace}/${name}/scale`,
+        {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ replicas }),
+        },
+      )
       if (!response.ok) {
         const error = await response.json().catch(() => ({ error: 'Unknown error' }))
         throw new Error(error.error || `HTTP ${response.status}`)
@@ -2286,8 +3208,12 @@ export function useScaleWorkload() {
       successMessage: 'Workload scaled',
     },
     onSuccess: (_, variables) => {
-      queryClient.invalidateQueries({ queryKey: ['resources', variables.kind] })
-      queryClient.invalidateQueries({ queryKey: ['resource', variables.kind, variables.namespace, variables.name] })
+      queryClient.invalidateQueries({
+        queryKey: ['resources', variables.kind],
+      })
+      queryClient.invalidateQueries({
+        queryKey: ['resource', variables.kind, variables.namespace, variables.name],
+      })
       queryClient.invalidateQueries({ queryKey: ['topology'] })
     },
   })
@@ -2307,7 +3233,12 @@ export interface WorkloadRevision {
   template?: string // Pod template spec as YAML (for revision diff)
 }
 
-export function useWorkloadRevisions(kind: string, namespace: string, name: string, enabled = true) {
+export function useWorkloadRevisions(
+  kind: string,
+  namespace: string,
+  name: string,
+  enabled = true,
+) {
   return useQuery<WorkloadRevision[]>({
     queryKey: ['workload-revisions', kind, namespace, name],
     queryFn: () => fetchJSON(`/workloads/${kind}/${namespace}/${name}/revisions`),
@@ -2318,12 +3249,25 @@ export function useWorkloadRevisions(kind: string, namespace: string, name: stri
 export function useRollbackWorkload() {
   const queryClient = useQueryClient()
   return useMutation({
-    mutationFn: async ({ kind, namespace, name, revision }: { kind: string; namespace: string; name: string; revision: number }) => {
-      const response = await apiFetch(`${getApiBase()}/workloads/${kind}/${namespace}/${name}/rollback`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ revision }),
-      })
+    mutationFn: async ({
+      kind,
+      namespace,
+      name,
+      revision,
+    }: {
+      kind: string
+      namespace: string
+      name: string
+      revision: number
+    }) => {
+      const response = await apiFetch(
+        `${getApiBase()}/workloads/${kind}/${namespace}/${name}/rollback`,
+        {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ revision }),
+        },
+      )
       if (!response.ok) {
         const error = await response.json().catch(() => ({ error: 'Unknown error' }))
         throw new Error(error.error || `HTTP ${response.status}`)
@@ -2335,9 +3279,15 @@ export function useRollbackWorkload() {
       successMessage: 'Rollback initiated',
     },
     onSuccess: (_, variables) => {
-      queryClient.invalidateQueries({ queryKey: ['resources', variables.kind] })
-      queryClient.invalidateQueries({ queryKey: ['resource', variables.kind, variables.namespace, variables.name] })
-      queryClient.invalidateQueries({ queryKey: ['workload-revisions', variables.kind, variables.namespace, variables.name] })
+      queryClient.invalidateQueries({
+        queryKey: ['resources', variables.kind],
+      })
+      queryClient.invalidateQueries({
+        queryKey: ['resource', variables.kind, variables.namespace, variables.name],
+      })
+      queryClient.invalidateQueries({
+        queryKey: ['workload-revisions', variables.kind, variables.namespace, variables.name],
+      })
       queryClient.invalidateQueries({ queryKey: ['topology'] })
     },
   })
@@ -2367,7 +3317,9 @@ export function useCordonNode() {
     },
     onSuccess: (_, variables) => {
       queryClient.invalidateQueries({ queryKey: ['resources', 'nodes'] })
-      queryClient.invalidateQueries({ queryKey: ['resource', 'nodes', '', variables.name] })
+      queryClient.invalidateQueries({
+        queryKey: ['resource', 'nodes', '', variables.name],
+      })
       queryClient.invalidateQueries({ queryKey: ['topology'] })
     },
   })
@@ -2393,7 +3345,9 @@ export function useUncordonNode() {
     },
     onSuccess: (_, variables) => {
       queryClient.invalidateQueries({ queryKey: ['resources', 'nodes'] })
-      queryClient.invalidateQueries({ queryKey: ['resource', 'nodes', '', variables.name] })
+      queryClient.invalidateQueries({
+        queryKey: ['resource', 'nodes', '', variables.name],
+      })
       queryClient.invalidateQueries({ queryKey: ['topology'] })
     },
   })
@@ -2426,7 +3380,9 @@ export function useDrainNode() {
     },
     onSuccess: (data: { evictedPods?: string[]; errors?: string[] }, variables) => {
       queryClient.invalidateQueries({ queryKey: ['resources', 'nodes'] })
-      queryClient.invalidateQueries({ queryKey: ['resource', 'nodes', '', variables.name] })
+      queryClient.invalidateQueries({
+        queryKey: ['resource', 'nodes', '', variables.name],
+      })
       queryClient.invalidateQueries({ queryKey: ['topology'] })
 
       const evicted = data?.evictedPods?.length ?? 0
@@ -2462,11 +3418,11 @@ export function useHelmReleases(namespaces: string[] = []) {
 }
 
 // Get details for a specific Helm release
-export function useHelmRelease(namespace: string, name: string) {
+export function useHelmRelease(namespace: string, name: string, options?: { enabled?: boolean }) {
   return useQuery<HelmReleaseDetail>({
     queryKey: ['helm-release', namespace, name],
     queryFn: () => fetchJSON(`/helm/releases/${namespace}/${name}`),
-    enabled: Boolean(namespace && name),
+    enabled: Boolean(namespace && name) && (options?.enabled ?? true),
     staleTime: 5000,
     refetchInterval: 10000, // Poll for live resource status updates (post-upgrade/rollback)
   })
@@ -2476,12 +3432,19 @@ export function useHelmRelease(namespace: string, name: string) {
 // `enabled` lets callers skip the query when the user's Cloud role
 // would 403 the read — saves a round-trip and avoids a transient
 // "error" state that the role-gated empty panel doesn't need.
-export function useHelmManifest(namespace: string, name: string, revision?: number, enabled = true) {
+export function useHelmManifest(
+  namespace: string,
+  name: string,
+  revision?: number,
+  enabled = true,
+) {
   const params = revision ? `?revision=${revision}` : ''
   return useQuery<string>({
     queryKey: ['helm-manifest', namespace, name, revision],
     queryFn: async () => {
-      const response = await apiFetch(`${getApiBase()}/helm/releases/${namespace}/${name}/manifest${params}`)
+      const response = await apiFetch(
+        `${getApiBase()}/helm/releases/${namespace}/${name}/manifest${params}`,
+      )
       if (!response.ok) {
         const error = await response.json().catch(() => ({ error: 'Unknown error' }))
         throw new Error(error.error || `HTTP ${response.status}`)
@@ -2494,7 +3457,13 @@ export function useHelmManifest(namespace: string, name: string, revision?: numb
 }
 
 // Get values for a Helm release. `enabled` see useHelmManifest.
-export function useHelmValues(namespace: string, name: string, allValues?: boolean, enabled = true, revision?: number) {
+export function useHelmValues(
+  namespace: string,
+  name: string,
+  allValues?: boolean,
+  enabled = true,
+  revision?: number,
+) {
   const params = new URLSearchParams()
   if (allValues) params.set('all', 'true')
   if (revision && revision > 0) params.set('revision', String(revision))
@@ -2518,8 +3487,12 @@ export function useHelmManifestDiff(
   return useQuery<ManifestDiff>({
     queryKey: ['helm-diff', namespace, name, revision1, revision2],
     queryFn: () =>
-      fetchJSON(`/helm/releases/${namespace}/${name}/diff?revision1=${revision1}&revision2=${revision2}`),
-    enabled: Boolean(namespace && name && revision1 > 0 && revision2 > 0 && revision1 !== revision2 && enabled),
+      fetchJSON(
+        `/helm/releases/${namespace}/${name}/diff?revision1=${revision1}&revision2=${revision2}`,
+      ),
+    enabled: Boolean(
+      namespace && name && revision1 > 0 && revision2 > 0 && revision1 !== revision2 && enabled,
+    ),
     staleTime: 60000,
   })
 }
@@ -2542,7 +3515,9 @@ export function useHelmValuesDiff(
       if (allValues) params.set('all', 'true')
       return fetchJSON(`/helm/releases/${namespace}/${name}/values/diff?${params.toString()}`)
     },
-    enabled: Boolean(namespace && name && revision1 > 0 && revision2 > 0 && revision1 !== revision2 && enabled),
+    enabled: Boolean(
+      namespace && name && revision1 > 0 && revision2 > 0 && revision1 !== revision2 && enabled,
+    ),
     staleTime: 60000,
   })
 }
@@ -2557,8 +3532,12 @@ export function useHelmNotesDiff(
   return useQuery<NotesDiff>({
     queryKey: ['helm-notes-diff', namespace, name, revision1, revision2],
     queryFn: () =>
-      fetchJSON(`/helm/releases/${namespace}/${name}/notes/diff?revision1=${revision1}&revision2=${revision2}`),
-    enabled: Boolean(namespace && name && revision1 > 0 && revision2 > 0 && revision1 !== revision2 && enabled),
+      fetchJSON(
+        `/helm/releases/${namespace}/${name}/notes/diff?revision1=${revision1}&revision2=${revision2}`,
+      ),
+    enabled: Boolean(
+      namespace && name && revision1 > 0 && revision2 > 0 && revision1 !== revision2 && enabled,
+    ),
     staleTime: 60000,
   })
 }
@@ -2573,8 +3552,12 @@ export function useHelmHooksDiff(
   return useQuery<HooksDiff>({
     queryKey: ['helm-hooks-diff', namespace, name, revision1, revision2],
     queryFn: () =>
-      fetchJSON(`/helm/releases/${namespace}/${name}/hooks/diff?revision1=${revision1}&revision2=${revision2}`),
-    enabled: Boolean(namespace && name && revision1 > 0 && revision2 > 0 && revision1 !== revision2 && enabled),
+      fetchJSON(
+        `/helm/releases/${namespace}/${name}/hooks/diff?revision1=${revision1}&revision2=${revision2}`,
+      ),
+    enabled: Boolean(
+      namespace && name && revision1 > 0 && revision2 > 0 && revision1 !== revision2 && enabled,
+    ),
     staleTime: 60000,
   })
 }
@@ -2589,8 +3572,12 @@ export function useHelmResourceDiff(
   return useQuery<ResourceDiff>({
     queryKey: ['helm-resource-diff', namespace, name, revision1, revision2],
     queryFn: () =>
-      fetchJSON(`/helm/releases/${namespace}/${name}/resources/diff?revision1=${revision1}&revision2=${revision2}`),
-    enabled: Boolean(namespace && name && revision1 > 0 && revision2 > 0 && revision1 !== revision2 && enabled),
+      fetchJSON(
+        `/helm/releases/${namespace}/${name}/resources/diff?revision1=${revision1}&revision2=${revision2}`,
+      ),
+    enabled: Boolean(
+      namespace && name && revision1 > 0 && revision2 > 0 && revision1 !== revision2 && enabled,
+    ),
     staleTime: 60000,
   })
 }
@@ -2640,10 +3627,21 @@ export function useHelmRollback() {
   const queryClient = useQueryClient()
 
   return useMutation({
-    mutationFn: async ({ namespace, name, revision }: { namespace: string; name: string; revision: number }) => {
-      const response = await apiFetch(`${getApiBase()}/helm/releases/${namespace}/${name}/rollback?revision=${revision}`, {
-        method: 'POST',
-      })
+    mutationFn: async ({
+      namespace,
+      name,
+      revision,
+    }: {
+      namespace: string
+      name: string
+      revision: number
+    }) => {
+      const response = await apiFetch(
+        `${getApiBase()}/helm/releases/${namespace}/${name}/rollback?revision=${revision}`,
+        {
+          method: 'POST',
+        },
+      )
       if (!response.ok) {
         const error = await response.json().catch(() => ({ error: 'Unknown error' }))
         throw new Error(error.error || `HTTP ${response.status}`)
@@ -2656,7 +3654,9 @@ export function useHelmRollback() {
     },
     onSuccess: (_, variables) => {
       queryClient.invalidateQueries({ queryKey: ['helm-releases'] })
-      queryClient.invalidateQueries({ queryKey: ['helm-release', variables.namespace, variables.name] })
+      queryClient.invalidateQueries({
+        queryKey: ['helm-release', variables.namespace, variables.name],
+      })
     },
   })
 }
@@ -2740,7 +3740,9 @@ function streamHelmProgress(
                   return
                 }
               } catch (err) {
-                reject(err instanceof Error ? err : new Error(`${failureLabel}: invalid progress event`))
+                reject(
+                  err instanceof Error ? err : new Error(`${failureLabel}: invalid progress event`),
+                )
                 return
               }
             }
@@ -2753,19 +3755,28 @@ function streamHelmProgress(
   })
 }
 
-// Upgrade a release with progress streaming via SSE
+// When `values` is provided, the upgrade applies exactly those edited values
+// instead of carrying the release's prior values over blindly.
 export function upgradeWithProgress(
   namespace: string,
   name: string,
   version: string,
   repositoryName: string | undefined,
-  onProgress: (event: InstallProgressEvent) => void
+  onProgress: (event: InstallProgressEvent) => void,
+  values?: Record<string, unknown>,
 ): Promise<void> {
   const params = new URLSearchParams({ version })
   if (repositoryName) params.set('repository', repositoryName)
+  const options: RequestInit = values
+    ? {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ values }),
+      }
+    : { method: 'POST' }
   return streamHelmProgress(
     `${getApiBase()}/helm/releases/${namespace}/${name}/upgrade-stream?${params.toString()}`,
-    { method: 'POST' },
+    options,
     onProgress,
     'Upgrade failed',
   ).then(() => {})
@@ -2776,7 +3787,7 @@ export function rollbackWithProgress(
   namespace: string,
   name: string,
   revision: number,
-  onProgress: (event: InstallProgressEvent) => void
+  onProgress: (event: InstallProgressEvent) => void,
 ): Promise<void> {
   return streamHelmProgress(
     `${getApiBase()}/helm/releases/${namespace}/${name}/rollback-stream?revision=${revision}`,
@@ -2786,15 +3797,29 @@ export function rollbackWithProgress(
   ).then(() => {})
 }
 
-// Preview values change (dry-run upgrade)
+// When `version` is supplied, preview renders against that target chart version
+// instead of the release's current chart.
 export function useHelmPreviewValues() {
-  return useMutation<ValuesPreviewResponse, Error, { namespace: string; name: string; values: Record<string, unknown> }>({
-    mutationFn: async ({ namespace, name, values }) => {
-      const response = await apiFetch(`${getApiBase()}/helm/releases/${namespace}/${name}/values/preview`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ values }),
-      })
+  return useMutation<
+    ValuesPreviewResponse,
+    Error,
+    {
+      namespace: string
+      name: string
+      values: Record<string, unknown>
+      version?: string
+      repository?: string
+    }
+  >({
+    mutationFn: async ({ namespace, name, values, version, repository }) => {
+      const response = await apiFetch(
+        `${getApiBase()}/helm/releases/${namespace}/${name}/values/preview`,
+        {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ values, version, repository }),
+        },
+      )
       if (!response.ok) {
         const error = await response.json().catch(() => ({ error: 'Unknown error' }))
         throw new Error(error.error || `HTTP ${response.status}`)
@@ -2809,7 +3834,15 @@ export function useHelmApplyValues() {
   const queryClient = useQueryClient()
 
   return useMutation({
-    mutationFn: async ({ namespace, name, values }: { namespace: string; name: string; values: Record<string, unknown> }) => {
+    mutationFn: async ({
+      namespace,
+      name,
+      values,
+    }: {
+      namespace: string
+      name: string
+      values: Record<string, unknown>
+    }) => {
       const response = await apiFetch(`${getApiBase()}/helm/releases/${namespace}/${name}/values`, {
         method: 'PUT',
         headers: { 'Content-Type': 'application/json' },
@@ -2827,8 +3860,12 @@ export function useHelmApplyValues() {
     },
     onSuccess: (_, variables) => {
       queryClient.invalidateQueries({ queryKey: ['helm-releases'] })
-      queryClient.invalidateQueries({ queryKey: ['helm-release', variables.namespace, variables.name] })
-      queryClient.invalidateQueries({ queryKey: ['helm-values', variables.namespace, variables.name] })
+      queryClient.invalidateQueries({
+        queryKey: ['helm-release', variables.namespace, variables.name],
+      })
+      queryClient.invalidateQueries({
+        queryKey: ['helm-values', variables.namespace, variables.name],
+      })
     },
   })
 }
@@ -2925,7 +3962,10 @@ export function useAddOCISource() {
   const queryClient = useQueryClient()
   return useMutation({
     mutationFn: (source: string) => mutateOCISource('POST', source),
-    meta: { errorMessage: 'Failed to add chart source', successMessage: 'Chart source added' },
+    meta: {
+      errorMessage: 'Failed to add chart source',
+      successMessage: 'Chart source added',
+    },
     onSuccess: () => invalidateHelmAfterSourceChange(queryClient),
   })
 }
@@ -2934,7 +3974,10 @@ export function useRemoveOCISource() {
   const queryClient = useQueryClient()
   return useMutation({
     mutationFn: (source: string) => mutateOCISource('DELETE', source),
-    meta: { errorMessage: 'Failed to remove chart source', successMessage: 'Chart source removed' },
+    meta: {
+      errorMessage: 'Failed to remove chart source',
+      successMessage: 'Chart source removed',
+    },
     onSuccess: () => invalidateHelmAfterSourceChange(queryClient),
   })
 }
@@ -3006,11 +4049,15 @@ export interface InstallProgressEvent {
 // Install a chart with progress streaming via SSE
 export function installChartWithProgress(
   req: InstallChartRequest,
-  onProgress: (event: InstallProgressEvent) => void
+  onProgress: (event: InstallProgressEvent) => void,
 ): Promise<HelmRelease> {
   return streamHelmProgress(
     `${getApiBase()}/helm/releases/install-stream`,
-    { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(req) },
+    {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(req),
+    },
     onProgress,
     'Install failed',
   ).then((event) => event.release as HelmRelease)
@@ -3026,8 +4073,14 @@ export type ArtifactHubSortOption = 'relevance' | 'stars' | 'last_updated'
 // Search charts on ArtifactHub
 export function useArtifactHubSearch(
   query: string,
-  options?: { offset?: number; limit?: number; official?: boolean; verified?: boolean; sort?: ArtifactHubSortOption },
-  enabled = true
+  options?: {
+    offset?: number
+    limit?: number
+    official?: boolean
+    verified?: boolean
+    sort?: ArtifactHubSortOption
+  },
+  enabled = true,
 ) {
   const params = new URLSearchParams()
   if (query) params.set('query', query)
@@ -3038,7 +4091,15 @@ export function useArtifactHubSearch(
   if (options?.sort && options.sort !== 'relevance') params.set('sort', options.sort)
 
   return useQuery<ArtifactHubSearchResult>({
-    queryKey: ['artifacthub-search', query, options?.offset, options?.limit, options?.official, options?.verified, options?.sort],
+    queryKey: [
+      'artifacthub-search',
+      query,
+      options?.offset,
+      options?.limit,
+      options?.official,
+      options?.verified,
+      options?.sort,
+    ],
     queryFn: () => fetchJSON(`/helm/artifacthub/search?${params.toString()}`),
     enabled: enabled && query.length > 0,
     staleTime: 60000, // 1 minute
@@ -3046,7 +4107,12 @@ export function useArtifactHubSearch(
 }
 
 // Get chart detail from ArtifactHub
-export function useArtifactHubChart(repoName: string, chartName: string, version?: string, enabled = true) {
+export function useArtifactHubChart(
+  repoName: string,
+  chartName: string,
+  version?: string,
+  enabled = true,
+) {
   const path = version
     ? `/helm/artifacthub/charts/${repoName}/${chartName}/${version}`
     : `/helm/artifacthub/charts/${repoName}/${chartName}`
@@ -3067,7 +4133,8 @@ interface GitOpsMutationConfig<TVariables> {
   getPath: (variables: TVariables) => string
   getBody?: (variables: TVariables) => unknown
   errorMessage: string
-  successMessage: string
+  successMessage?: string
+  getSuccessMessage?: (data: GitOpsOperationResponse) => string
   getInvalidateKeys: (variables: TVariables) => (string | undefined)[][]
 }
 
@@ -3095,9 +4162,10 @@ function createGitOpsMutation<TVariables>(config: GitOpsMutationConfig<TVariable
         errorMessage: config.errorMessage,
         successMessage: config.successMessage,
       },
-      onSuccess: (_, variables) => {
-        config.getInvalidateKeys(variables).forEach(key =>
-          queryClient.invalidateQueries({ queryKey: key })
+      onSuccess: (data, variables) => {
+        if (config.getSuccessMessage) showApiSuccess(config.getSuccessMessage(data))
+        config.getInvalidateKeys(variables).forEach((key) =>
+          queryClient.invalidateQueries({ queryKey: key }),
         )
       },
     })
@@ -3112,8 +4180,13 @@ type ArgoAppVars = { namespace: string; name: string }
 // ArgoSyncVars extends ArgoAppVars with the sync request body fields. Only
 // useArgoSync sends these — splitting the type prevents callers from passing
 // resources/revision/prune to mutations that would silently drop them.
-type ArgoSyncVars = ArgoAppVars & {
-  resources?: Array<{ group?: string; kind: string; namespace?: string; name: string }>
+export type ArgoSyncVars = ArgoAppVars & {
+  resources?: Array<{
+    group?: string
+    kind: string
+    namespace?: string
+    name: string
+  }>
   revision?: string
   prune?: boolean
   dryRun?: boolean
@@ -3125,6 +4198,31 @@ type ArgoSyncVars = ArgoAppVars & {
   syncOptions?: string[]
 }
 
+export interface ArgoResourceValidationResult {
+  outcome: 'succeeded' | 'failed' | 'inconclusive'
+  message: string
+  resource?: {
+    group?: string
+    kind: string
+    namespace?: string
+    name: string
+    status?: string
+    message?: string
+  }
+}
+
+export function buildArgoResourceSyncVars(namespace: string, name: string, resource: GitOpsInsightRef, opts: ArgoSyncOpts): ArgoSyncVars {
+  return {
+    namespace,
+    name,
+    ...opts,
+    resources: [{ group: resource.group, kind: resource.kind, namespace: resource.namespace, name: resource.name }],
+    revision: undefined,
+    prune: false,
+    applyOnly: false,
+  }
+}
+
 // ArgoRollbackVars targets a specific Argo history entry by ID. Prune and
 // DryRun mirror the sync flags so the rollback dialog can offer the same
 // safety net.
@@ -3206,6 +4304,31 @@ export const useArgoSync = createGitOpsMutation<ArgoSyncVars>({
   getInvalidateKeys: argoInvalidateKeys,
 })
 
+export function useArgoResourceValidation() {
+  const queryClient = useQueryClient()
+  return useMutation<ArgoResourceValidationResult, Error, ArgoSyncVars>({
+    mutationFn: async (variables) => {
+      const response = await apiFetch(`${getApiBase()}/argo/applications/${variables.namespace}/${variables.name}/validate-resource`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          resources: variables.resources,
+          force: variables.force,
+          syncOptions: variables.syncOptions,
+        }),
+      })
+      if (!response.ok) {
+        const error = await response.json().catch(() => ({ error: 'Unknown error' }))
+        throw new Error(error.error || `HTTP ${response.status}`)
+      }
+      return response.json() as Promise<ArgoResourceValidationResult>
+    },
+    onSettled: (_, __, variables) => {
+      argoInvalidateKeys(variables).forEach(key => queryClient.invalidateQueries({ queryKey: key }))
+    },
+  })
+}
+
 export const useArgoRollback = createGitOpsMutation<ArgoRollbackVars>({
   getPath: (v) => `/argo/applications/${v.namespace}/${v.name}/rollback`,
   getBody: (v) => ({ id: v.id, prune: v.prune, dryRun: v.dryRun }),
@@ -3217,7 +4340,7 @@ export const useArgoRollback = createGitOpsMutation<ArgoRollbackVars>({
 export const useArgoTerminate = createGitOpsMutation<ArgoAppVars>({
   getPath: (v) => `/argo/applications/${v.namespace}/${v.name}/terminate`,
   errorMessage: 'Failed to terminate sync',
-  successMessage: 'Sync terminated',
+  getSuccessMessage: (data) => data.message,
   getInvalidateKeys: argoInvalidateKeys,
 })
 
@@ -3240,11 +4363,22 @@ export function useArgoRefresh() {
   const queryClient = useQueryClient()
 
   return useMutation({
-    mutationFn: async ({ namespace, name, hard = false }: { namespace: string; name: string; hard?: boolean }) => {
+    mutationFn: async ({
+      namespace,
+      name,
+      hard = false,
+    }: {
+      namespace: string
+      name: string
+      hard?: boolean
+    }) => {
       const params = hard ? '?type=hard' : ''
-      const response = await apiFetch(`${getApiBase()}/argo/applications/${namespace}/${name}/refresh${params}`, {
-        method: 'POST',
-      })
+      const response = await apiFetch(
+        `${getApiBase()}/argo/applications/${namespace}/${name}/refresh${params}`,
+        {
+          method: 'POST',
+        },
+      )
       if (!response.ok) {
         const error = await response.json().catch(() => ({ error: 'Unknown error' }))
         throw new Error(error.error || `HTTP ${response.status}`)
@@ -3261,7 +4395,7 @@ export function useArgoRefresh() {
       // Refresh — without these two extra keys the user clicks Refresh and
       // sees stale insight/tree data until the next staleTime tick.
       argoInvalidateKeys(variables).forEach((key) =>
-        queryClient.invalidateQueries({ queryKey: key })
+        queryClient.invalidateQueries({ queryKey: key }),
       )
     },
   })
@@ -3319,7 +4453,9 @@ export function useSwitchContext() {
       } catch (error) {
         clearTimeout(timeoutId)
         if (error instanceof Error && error.name === 'AbortError') {
-          throw new Error('Context switch timed out. The cluster may be unreachable.', { cause: error })
+          throw new Error('Context switch timed out. The cluster may be unreachable.', {
+            cause: error,
+          })
         }
         throw error
       }
@@ -3437,9 +4573,12 @@ export function useSetActiveNamespace() {
           error: error instanceof Error ? error.message : String(error),
         })
         if (error instanceof Error && error.name === 'AbortError') {
-          throw new Error(isRescope
-            ? 'Namespace rescope timed out. The cluster may still be loading.'
-            : 'Namespace switch timed out. The cluster may be unreachable.', { cause: error })
+          throw new Error(
+            isRescope
+              ? 'Namespace rescope timed out. The cluster may still be loading.'
+              : 'Namespace switch timed out. The cluster may be unreachable.',
+            { cause: error },
+          )
         }
         throw error
       }
@@ -3451,7 +4590,9 @@ export function useSetActiveNamespace() {
         accessibleCount: scope.accessibleNamespaces.length,
       })
       if (scope.cacheScoped) {
-        queryClient.removeQueries({ predicate: query => query.queryKey[0] !== 'namespace-scope' })
+        queryClient.removeQueries({
+          predicate: (query) => query.queryKey[0] !== 'namespace-scope',
+        })
       }
       queryClient.setQueryData<NamespaceScope>(['namespace-scope'], scope)
       if (scope.cacheScoped) {
@@ -3482,7 +4623,7 @@ export function useImageMetadata(
   namespace: string,
   podName: string,
   pullSecrets: string[],
-  enabled = true
+  enabled = true,
 ) {
   const params = new URLSearchParams()
   params.set('image', image)
@@ -3505,7 +4646,7 @@ export function useImageFilesystem(
   namespace: string,
   podName: string,
   pullSecrets: string[],
-  enabled = true
+  enabled = true,
 ) {
   const params = new URLSearchParams()
   params.set('image', image)
@@ -3518,9 +4659,7 @@ export function useImageFilesystem(
   return useQuery<ImageFilesystem>({
     queryKey: ['image-filesystem', image, namespace, podName, pullSecrets.join(',')],
     // Use skipToken to completely prevent the query from running when disabled
-    queryFn: shouldFetch
-      ? () => fetchJSON(`/images/inspect?${params.toString()}`)
-      : skipToken,
+    queryFn: shouldFetch ? () => fetchJSON(`/images/inspect?${params.toString()}`) : skipToken,
     staleTime: 300000, // 5 minutes - image content doesn't change
     retry: false, // Don't retry on auth errors
   })
@@ -3544,6 +4683,44 @@ export interface WorkloadLogsResponse {
     timestamp: string
     content: string
   }[]
+  emptyReason?: string
+  emptyMessage?: string
+  command?: string
+}
+
+export interface WorkloadRun {
+  kind: string
+  namespace: string
+  name: string
+  phase: string
+  active: boolean
+  startedAt?: string
+  finishedAt?: string
+  scheduledAt?: string
+  trigger?: 'manual' | 'schedule' | string
+  message?: string
+  succeeded?: number
+  failed?: number
+  running?: number
+  desired?: number
+  parallelism?: number
+  progress?: string
+  template?: string
+  launcher?: {
+    kind: string
+    namespace?: string
+    name: string
+    group?: string
+  }
+  podTotal?: number
+  podSucceeded?: number
+  podFailed?: number
+  podRunning?: number
+  podPending?: number
+}
+
+export interface WorkloadRunsResponse {
+  runs: WorkloadRun[]
 }
 
 // Fetch pods for a workload
@@ -3556,6 +4733,31 @@ export function useWorkloadPods(kind: string, namespace: string, name: string) {
   })
 }
 
+export function useWorkloadRuns(
+  kind: string,
+  namespace: string,
+  name: string,
+  enabled = true,
+  options?: { refetchActive?: boolean; clusterScoped?: boolean },
+) {
+  const clusterScoped = options?.clusterScoped ?? false
+  const ns = clusterScoped ? '_' : namespace
+  const params = new URLSearchParams()
+  if (clusterScoped) params.set('clusterScoped', 'true')
+  const queryString = params.toString()
+
+  return useQuery<WorkloadRunsResponse>({
+    queryKey: ['workload-runs', kind, namespace, name, clusterScoped],
+    queryFn: () =>
+      fetchJSON(`/workloads/${kind}/${ns}/${name}/runs${queryString ? `?${queryString}` : ''}`),
+    enabled: enabled && Boolean(kind && name && (namespace || clusterScoped)),
+    staleTime: 10000,
+    refetchInterval: options?.refetchActive
+      ? (query) => (query.state.data?.runs?.some((run) => run.active) ? 5000 : 30000)
+      : false,
+  })
+}
+
 // Fetch logs for a workload (non-streaming)
 export function useWorkloadLogs(
   kind: string,
@@ -3565,7 +4767,7 @@ export function useWorkloadLogs(
     container?: string
     tailLines?: number
     sinceSeconds?: number
-  }
+  },
 ) {
   const params = new URLSearchParams()
   if (options?.container) params.set('container', options.container)
@@ -3574,8 +4776,19 @@ export function useWorkloadLogs(
   const queryString = params.toString()
 
   return useQuery<WorkloadLogsResponse>({
-    queryKey: ['workload-logs', kind, namespace, name, options?.container, options?.tailLines, options?.sinceSeconds],
-    queryFn: () => fetchJSON(`/workloads/${kind}/${namespace}/${name}/logs${queryString ? `?${queryString}` : ''}`),
+    queryKey: [
+      'workload-logs',
+      kind,
+      namespace,
+      name,
+      options?.container,
+      options?.tailLines,
+      options?.sinceSeconds,
+    ],
+    queryFn: () =>
+      fetchJSON(
+        `/workloads/${kind}/${namespace}/${name}/logs${queryString ? `?${queryString}` : ''}`,
+      ),
     enabled: Boolean(kind && namespace && name),
     staleTime: 5000,
   })
@@ -3590,7 +4803,7 @@ export function createWorkloadLogStream(
     container?: string
     tailLines?: number
     sinceSeconds?: number
-  }
+  },
 ): EventSource {
   const params = new URLSearchParams()
   if (options?.container) params.set('container', options.container)
@@ -3598,9 +4811,12 @@ export function createWorkloadLogStream(
   if (options?.sinceSeconds) params.set('sinceSeconds', String(options.sinceSeconds))
   const queryString = params.toString()
 
-  return new EventSource(`${getApiBase()}/workloads/${kind}/${namespace}/${name}/logs/stream${queryString ? `?${queryString}` : ''}`, {
-    withCredentials: getCredentialsMode() === 'include',
-  })
+  return new EventSource(
+    `${getApiBase()}/workloads/${kind}/${namespace}/${name}/logs/stream${queryString ? `?${queryString}` : ''}`,
+    {
+      withCredentials: getCredentialsMode() === 'include',
+    },
+  )
 }
 
 // ============================================================================