@intentius/chant-lexicon-k8s 0.30.0 → 0.32.0

package/src/kube/source.test.ts

@@ -0,0 +1,138 @@
+import { describe, test, expect, vi, afterEach } from "vitest";
+import { ClusterBindingMismatchError } from "@intentius/chant/kubectl-context";
+import { fakeCluster, objectKey } from "../api/fake-cluster";
+import { runSource } from "./source";
+import { fakeDeclarable, fakeProjectContext } from "./testing";
+
+afterEach(() => vi.restoreAllMocks());
+
+function spyConsole() {
+  const log = vi.spyOn(console, "log").mockImplementation(() => {});
+  const error = vi.spyOn(console, "error").mockImplementation(() => {});
+  return { log, error };
+}
+
+describe("chant kube source (#1079)", () => {
+  test("happy path: resolves a live object to its declaring file and composite", async () => {
+    const cluster = fakeCluster({
+      objects: {
+        [objectKey("apps/v1", "Deployment", "web", "prod")]: {
+          apiVersion: "apps/v1",
+          kind: "Deployment",
+          metadata: { name: "web", namespace: "prod", uid: "u1" },
+        },
+      },
+    });
+    const project = fakeProjectContext({
+      web: fakeDeclarable(
+        "K8s::Apps::Deployment",
+        { metadata: { name: "web", namespace: "prod" } },
+        { sourceFile: "/project/src/infra.ts", composite: "WebApp", compositeInstance: "web" },
+      ),
+    });
+    const { log } = spyConsole();
+
+    const code = await runSource(["deployment", "web", "-n", "prod"], { connect: cluster.connector, loadProject: async () => project });
+
+    expect(code).toBe(0);
+    const out = log.mock.calls.map((c) => c[0]).join("\n");
+    expect(out).toContain("web <- web");
+    expect(out).toContain("src/infra.ts");
+    expect(out).toContain("composite: WebApp");
+    expect(out).toContain("line:      not tracked");
+  });
+
+  test("-o json emits a machine-readable envelope", async () => {
+    const cluster = fakeCluster({
+      objects: {
+        [objectKey("apps/v1", "Deployment", "web", "prod")]: {
+          apiVersion: "apps/v1",
+          kind: "Deployment",
+          metadata: { name: "web", namespace: "prod", uid: "u1" },
+        },
+      },
+    });
+    const project = fakeProjectContext({
+      web: fakeDeclarable("K8s::Apps::Deployment", { metadata: { name: "web", namespace: "prod" } }, { sourceFile: "/project/src/infra.ts" }),
+    });
+    const { log } = spyConsole();
+
+    await runSource(["deployment", "web", "-n", "prod", "-o", "json"], { connect: cluster.connector, loadProject: async () => project });
+
+    const parsed = JSON.parse(log.mock.calls[0][0] as string);
+    expect(parsed).toMatchObject({ found: true, entity: "web", file: "src/infra.ts" });
+  });
+
+  test("a live object with no declared source reports found:false, not an error", async () => {
+    const cluster = fakeCluster({
+      objects: {
+        [objectKey("apps/v1", "Deployment", "unrelated", "prod")]: {
+          apiVersion: "apps/v1",
+          kind: "Deployment",
+          metadata: { name: "unrelated", namespace: "prod", uid: "u2" },
+        },
+      },
+    });
+    const project = fakeProjectContext({});
+    const { log } = spyConsole();
+
+    const code = await runSource(["deployment", "unrelated", "-n", "prod"], { connect: cluster.connector, loadProject: async () => project });
+
+    expect(code).toBe(0);
+    expect(log.mock.calls[0][0]).toContain("no declared entity");
+  });
+
+  test("degrades gracefully outside a chant project — reports unavailable, does not connect", async () => {
+    const { log } = spyConsole();
+    const connect = vi.fn();
+
+    const code = await runSource(["deployment", "web"], { connect, loadProject: async () => undefined });
+
+    expect(code).toBe(1);
+    expect(log.mock.calls[0][0]).toContain("unavailable");
+    expect(connect).not.toHaveBeenCalled();
+  });
+
+  test("binding mismatch refuses loudly", async () => {
+    const project = fakeProjectContext({});
+    const { error } = spyConsole();
+    const connect = async () => {
+      throw new ClusterBindingMismatchError("prod", "prod-eks", "dev-eks");
+    };
+
+    const code = await runSource(["deployment", "web", "--env", "prod"], { connect, loadProject: async () => project });
+
+    expect(code).toBe(1);
+    expect(error.mock.calls[0][0]).toContain("no binding for this environment");
+  });
+
+  test("unknown flag is rejected before loading the project or connecting", async () => {
+    const { error } = spyConsole();
+    const loadProject = vi.fn();
+    const connect = vi.fn();
+
+    const code = await runSource(["deployment", "web", "--bogus"], { connect, loadProject });
+
+    expect(code).toBe(1);
+    expect(error.mock.calls[0][0]).toContain("Unknown flag");
+    expect(loadProject).not.toHaveBeenCalled();
+    expect(connect).not.toHaveBeenCalled();
+  });
+
+  test("tri-state: an RBAC-denied read renders NOT-OBSERVED, not a false negative", async () => {
+    const project = fakeProjectContext({});
+    const cluster = fakeCluster({
+      respond: (req) =>
+        req.path === "/apis/apps/v1/namespaces/prod/deployments/web"
+          ? { status: 403, body: { kind: "Status", reason: "Forbidden", message: "forbidden" } }
+          : undefined,
+    });
+    const { error, log } = spyConsole();
+
+    const code = await runSource(["deployment", "web", "-n", "prod"], { connect: cluster.connector, loadProject: async () => project });
+
+    expect(code).toBe(1);
+    expect(error.mock.calls[0][0]).toContain("no credentials");
+    expect(log).not.toHaveBeenCalled();
+  });
+});

package/src/kube/source.ts

@@ -0,0 +1,139 @@
+/**
+ * `chant kube source` (chant #1079) — resolve a live object back to the
+ * `.ts` file and composite that declared it, reusing the exact build
+ * provenance the gitlab/forgejo lexicons' own `:source` context tools already
+ * expose (`@intentius/chant/provenance`, stamped during discovery — chant
+ * #1064). That precedent is explicit that provenance here is **entity-level
+ * (file + composite), not a YAML-line source map** — chant does not carry
+ * one, for k8s or for anything else — so this verb reports the same two
+ * facts (never a fabricated line number) and says so plainly rather than
+ * silently coming up one field short of the issue's wording.
+ */
+
+import { formatUnobserved } from "@intentius/chant/observation";
+import { defaultK8sConnector, type K8sConnector } from "../api/connect";
+import { classifyApiFailure } from "../api/classify";
+import { kubeConnect } from "./connect";
+import { parseKubeFlags, connectOptionsFrom } from "./flags";
+import { loadKubeProjectContext, relativeProvenance, type KubeProjectContext } from "./project";
+import { resolveKubeTarget, matchLiveObject, isTargetError, type KubeTarget } from "./target";
+
+export interface SourceDeps {
+  connect?: K8sConnector;
+  loadProject?: (cwd?: string) => Promise<KubeProjectContext | undefined>;
+}
+
+function targetLabel(target: KubeTarget): string {
+  return "apiVersion" in target.selector ? target.selector.kind : target.selector.resource;
+}
+
+export async function runSource(rawArgs: string[], deps: SourceDeps = {}): Promise<number> {
+  const connect = deps.connect ?? defaultK8sConnector;
+  const loadProject = deps.loadProject ?? loadKubeProjectContext;
+
+  let flags;
+  try {
+    flags = parseKubeFlags(rawArgs);
+  } catch (err) {
+    console.error(err instanceof Error ? err.message : String(err));
+    return 1;
+  }
+
+  const json = flags.values.output === "json";
+
+  const project = await loadProject();
+  if (!project) {
+    if (json) console.log(JSON.stringify({ available: false, note: "not running inside a chant project (no chant.config.ts, or the project has build errors)" }));
+    else console.log("chant source: unavailable — not running inside a chant project (no chant.config.ts, or the project has build errors)");
+    return 1;
+  }
+
+  const target = resolveKubeTarget(flags.positional, flags.values.namespace, project);
+  if (isTargetError(target)) {
+    console.error(`error: ${target.error}`);
+    return 1;
+  }
+  if (!target.name) {
+    console.error("error: chant kube source requires a single named resource, e.g. `chant kube source deployment web`");
+    return 1;
+  }
+
+  const connected = await kubeConnect(connectOptionsFrom(flags.values), connect);
+  if (connected.kind === "unobserved") {
+    console.error(formatUnobserved(targetLabel(target), { reason: connected.reason, detail: connected.detail }));
+    return 1;
+  }
+  const { client } = connected;
+
+  let info;
+  try {
+    info = await client.resolve(target.selector);
+  } catch (err) {
+    const outcome = classifyApiFailure(err);
+    console.error(
+      formatUnobserved(targetLabel(target), {
+        reason: outcome.kind === "unobserved" ? outcome.reason : "read-failed",
+        detail: outcome.kind === "unobserved" ? outcome.detail : String(err),
+      }),
+    );
+    return 1;
+  }
+  if (!info) {
+    console.error(`error: the server doesn't have a resource type "${targetLabel(target)}"`);
+    return 1;
+  }
+
+  const namespace = target.namespace ?? client.defaultNamespace;
+  let obj;
+  try {
+    obj = await client.readIfPresent({ apiVersion: info.apiVersion, kind: info.kind, name: target.name, namespace });
+  } catch (err) {
+    const outcome = classifyApiFailure(err);
+    console.error(
+      formatUnobserved(`${info.kind}/${target.name}`, {
+        reason: outcome.kind === "unobserved" ? outcome.reason : "read-failed",
+        detail: outcome.kind === "unobserved" ? outcome.detail : String(err),
+      }),
+    );
+    return 1;
+  }
+  if (!obj) {
+    console.error(`Error from server (NotFound): ${info.name} "${target.name}" not found`);
+    return 1;
+  }
+
+  const match =
+    target.declaredMatch ??
+    matchLiveObject(project, {
+      apiVersion: obj.apiVersion ?? info.apiVersion,
+      kind: obj.kind ?? info.kind,
+      name: obj.metadata?.name ?? target.name,
+      namespace: obj.metadata?.namespace ?? namespace,
+    });
+
+  if (!match) {
+    const note = `no declared entity in this project names ${info.kind}/${target.name}`;
+    if (json) console.log(JSON.stringify({ found: false, note }));
+    else console.log(`${info.kind}/${target.name}: ${note}`);
+    return 0;
+  }
+
+  const prov = relativeProvenance(project, match.entity);
+  if (json) {
+    console.log(
+      JSON.stringify({
+        found: true,
+        entity: match.entityName,
+        file: prov?.sourceFile ?? null,
+        composite: prov?.composite ?? null,
+        compositeInstance: prov?.compositeInstance ?? null,
+      }),
+    );
+  } else {
+    console.log(`${info.kind}/${target.name} <- ${match.entityName}`);
+    console.log(`  file:      ${prov?.sourceFile ?? "(unknown)"}`);
+    console.log(`  composite: ${prov?.composite ?? "(none — declared directly)"}`);
+    console.log(`  line:      not tracked — chant's build provenance is entity-level (file + composite), not a source map`);
+  }
+  return 0;
+}

package/src/kube/target.test.ts

@@ -0,0 +1,67 @@
+import { describe, test, expect } from "vitest";
+import { resolveKubeTarget, isTargetError, matchLiveObject } from "./target";
+import { fakeDeclarable, fakeProjectContext } from "./testing";
+
+describe("resolveKubeTarget (chant #1079)", () => {
+  test("kubectl-style: <kind> <name> — never consults the project even when a project is present", () => {
+    const project = fakeProjectContext({
+      web: fakeDeclarable("K8s::Apps::Deployment", { metadata: { name: "different-name", namespace: "prod" } }),
+    });
+    const target = resolveKubeTarget(["deployment", "web"], undefined, project);
+    expect(isTargetError(target)).toBe(false);
+    if (!isTargetError(target)) {
+      expect(target.selector).toEqual({ resource: "deployment" });
+      expect(target.name).toBe("web");
+      expect(target.declaredMatch).toBeUndefined();
+    }
+  });
+
+  test("kubectl-style: a bare <kind> lists — name is undefined", () => {
+    const target = resolveKubeTarget(["deployments"], undefined, undefined);
+    if (!isTargetError(target)) {
+      expect(target.name).toBeUndefined();
+    } else {
+      throw new Error("expected a resolved target");
+    }
+  });
+
+  test("chant vocabulary: a single token matching a declared entity resolves via its own metadata", () => {
+    const project = fakeProjectContext({
+      myWeb: fakeDeclarable("K8s::Apps::Deployment", { metadata: { name: "web", namespace: "prod" } }),
+    });
+    const target = resolveKubeTarget(["myWeb"], undefined, project);
+    if (isTargetError(target)) throw new Error("expected a resolved target");
+    expect(target.selector).toEqual({ apiVersion: "apps/v1", kind: "Deployment" });
+    expect(target.name).toBe("web");
+    expect(target.namespace).toBe("prod");
+    expect(target.declaredMatch?.entityName).toBe("myWeb");
+  });
+
+  test("an explicit -n overrides the declared namespace", () => {
+    const project = fakeProjectContext({
+      myWeb: fakeDeclarable("K8s::Apps::Deployment", { metadata: { name: "web", namespace: "prod" } }),
+    });
+    const target = resolveKubeTarget(["myWeb"], "staging", project);
+    if (isTargetError(target)) throw new Error("expected a resolved target");
+    expect(target.namespace).toBe("staging");
+  });
+
+  test("no arguments is an error, not a crash", () => {
+    const target = resolveKubeTarget([], undefined, undefined);
+    expect(isTargetError(target)).toBe(true);
+  });
+});
+
+describe("matchLiveObject", () => {
+  test("undefined project means no match, cheaply (no iteration)", () => {
+    expect(matchLiveObject(undefined, { apiVersion: "v1", kind: "Pod", name: "a" })).toBeUndefined();
+  });
+
+  test("matches on apiVersion + kind + name + namespace, all four", () => {
+    const project = fakeProjectContext({
+      web: fakeDeclarable("K8s::Apps::Deployment", { metadata: { name: "web", namespace: "prod" } }),
+    });
+    expect(matchLiveObject(project, { apiVersion: "apps/v1", kind: "Deployment", name: "web", namespace: "prod" })?.entityName).toBe("web");
+    expect(matchLiveObject(project, { apiVersion: "apps/v1", kind: "Deployment", name: "web", namespace: "staging" })).toBeUndefined();
+  });
+});

package/src/kube/target.ts

@@ -0,0 +1,89 @@
+/**
+ * Resolving `chant kube <verb> <target...>`'s positional arguments to an
+ * addressable resource (chant #1079).
+ *
+ * "Every verb resolves entity names through chant's own vocabulary where
+ * applicable ... while also accepting raw kind/name kubectl-style." Both
+ * forms share one positional shape, disambiguated by arity:
+ *
+ * - One token, and it names a declared entity in this project → chant's own
+ *   vocabulary: the entity's `metadata.name`(/`namespace`) is looked up in
+ *   its own source, not typed twice.
+ * - One or two tokens otherwise → kubectl's own shape, `<kind> [name]`; a
+ *   bare kind with no name is a list, matching `kubectl get <kind>`.
+ *
+ * `<kind>` is never parsed here beyond splitting the `.group` suffix — that
+ * job belongs to the typed client's own `resolve()` (kubectl's own
+ * plural/singular/kind/short-name precedence, `packages/k8s-client/src/client.ts`),
+ * so a raw kind string reaches the cluster exactly as `kubectl get raycluster.ray.io`
+ * would.
+ */
+
+import type { ResourceSelector } from "@intentius/chant-k8s-client";
+import { findDeclaredMatch, type DeclaredMatch, type KubeProjectContext } from "./project";
+import { operationFor } from "../api/operation-surface";
+
+export interface KubeTarget {
+  selector: ResourceSelector;
+  /** Object name. Undefined means "list every object this selector addresses". */
+  name?: string;
+  namespace?: string;
+  /** Set when resolution went through chant's own vocabulary rather than a kubectl kind string. */
+  declaredMatch?: DeclaredMatch;
+}
+
+export interface KubeTargetError {
+  error: string;
+}
+
+export function isTargetError(t: KubeTarget | KubeTargetError): t is KubeTargetError {
+  return "error" in t;
+}
+
+/**
+ * Resolve `positional` (whatever's left after flags) plus an explicit
+ * `-n/--namespace`, against `project`'s declared entities when available.
+ */
+export function resolveKubeTarget(
+  positional: readonly string[],
+  namespaceFlag: string | undefined,
+  project: KubeProjectContext | undefined,
+): KubeTarget | KubeTargetError {
+  if (positional.length === 0) {
+    return { error: "a resource kind (and, usually, a name) is required — e.g. `chant kube get deployments` or `chant kube get deployment web`" };
+  }
+  const [first, second] = positional;
+
+  if (project && second === undefined) {
+    const entity = project.entities.get(first);
+    if (entity && entity.lexicon === "k8s") {
+      const operation = operationFor(entity.entityType);
+      const props = "props" in entity ? ((entity as { props: unknown }).props as Record<string, unknown>) : undefined;
+      const metadata = props?.metadata as { name?: string; namespace?: string } | undefined;
+      if (operation && metadata?.name) {
+        return {
+          selector: { apiVersion: operation.apiVersion, kind: operation.kind },
+          name: metadata.name,
+          namespace: namespaceFlag ?? metadata.namespace,
+          declaredMatch: { entityName: first, entity, props },
+        };
+      }
+    }
+  }
+
+  return { selector: { resource: first }, name: second, namespace: namespaceFlag };
+}
+
+/**
+ * After a live read resolves an object's real `apiVersion`/`kind` (a kubectl
+ * kind string like `deploy` isn't one), reverse-map it against the project
+ * for the verdict column / `source` — reusing the exact match `resolveKubeTarget`
+ * would have made had the caller spelled out the entity name.
+ */
+export function matchLiveObject(
+  project: KubeProjectContext | undefined,
+  ref: { apiVersion: string; kind: string; name: string; namespace?: string },
+): DeclaredMatch | undefined {
+  if (!project) return undefined;
+  return findDeclaredMatch(project.entities, ref);
+}

package/src/kube/testing.ts

@@ -0,0 +1,42 @@
+/**
+ * Test doubles for `chant kube` (chant #1079).
+ *
+ * `./project.ts`'s real `loadKubeProjectContext` builds an actual project
+ * (`chant.config.ts` read, source discovered, serialized) — every verb takes
+ * it as an injectable dependency for exactly this reason: a unit test builds
+ * a `KubeProjectContext` by hand instead, the same way `../api/fake-cluster.ts`
+ * lets a test build a client without a socket.
+ */
+
+import { DECLARABLE_MARKER, type Declarable } from "@intentius/chant/declarable";
+import { setProvenance, type EntityProvenance } from "@intentius/chant/provenance";
+import type { ChantConfig } from "@intentius/chant/config";
+import type { KubeProjectContext } from "./project";
+
+export type FakeDeclarable = Declarable & { props: Record<string, unknown> };
+
+/** A minimal `Declarable` carrying `props`, optionally stamped with build provenance. */
+export function fakeDeclarable(
+  entityType: string,
+  props: Record<string, unknown>,
+  provenance?: EntityProvenance,
+): FakeDeclarable {
+  const entity: FakeDeclarable = {
+    lexicon: "k8s",
+    entityType,
+    kind: "resource",
+    props,
+    [DECLARABLE_MARKER]: true,
+  };
+  if (provenance) setProvenance(entity, provenance);
+  return entity;
+}
+
+/** A `KubeProjectContext` built from a plain name → entity map, no disk I/O. */
+export function fakeProjectContext(
+  entities: Record<string, Declarable>,
+  config: ChantConfig = {},
+  cwd = "/project",
+): KubeProjectContext {
+  return { cwd, config, entities: new Map(Object.entries(entities)) };
+}

package/src/kube/top.test.ts

@@ -0,0 +1,149 @@
+import { describe, test, expect, vi, afterEach } from "vitest";
+import { ClusterBindingMismatchError } from "@intentius/chant/kubectl-context";
+import { fakeCluster } from "../api/fake-cluster";
+import { runTop } from "./top";
+
+afterEach(() => vi.restoreAllMocks());
+
+function spyConsole() {
+  const log = vi.spyOn(console, "log").mockImplementation(() => {});
+  const error = vi.spyOn(console, "error").mockImplementation(() => {});
+  return { log, error };
+}
+
+const METRICS_DISCOVERY = {
+  path: "/apis/metrics.k8s.io/v1beta1",
+  body: {
+    kind: "APIResourceList",
+    apiVersion: "v1",
+    groupVersion: "metrics.k8s.io/v1beta1",
+    resources: [
+      { name: "pods", singularName: "", namespaced: true, kind: "PodMetrics", verbs: ["get", "list"] },
+      { name: "nodes", singularName: "", namespaced: false, kind: "NodeMetrics", verbs: ["get", "list"] },
+    ],
+  },
+};
+
+function withMetricsGroup(respond: (req: { path: string }) => { status?: number; body?: unknown } | undefined) {
+  return (req: { path: string }) => {
+    if (req.path === "/apis") {
+      return {
+        body: {
+          kind: "APIGroupList",
+          groups: [
+            {
+              name: "metrics.k8s.io",
+              preferredVersion: { groupVersion: "metrics.k8s.io/v1beta1" },
+              versions: [{ groupVersion: "metrics.k8s.io/v1beta1" }],
+            },
+          ],
+        },
+      };
+    }
+    if (req.path === METRICS_DISCOVERY.path) return { body: METRICS_DISCOVERY.body };
+    return respond(req);
+  };
+}
+
+describe("chant kube top (#1079)", () => {
+  test("happy path: pods usage, per container, unsummed", async () => {
+    const cluster = fakeCluster({
+      serves: [],
+      respond: withMetricsGroup((req) =>
+        req.path === "/apis/metrics.k8s.io/v1beta1/namespaces/prod/pods"
+          ? {
+              body: {
+                items: [
+                  {
+                    metadata: { name: "web", namespace: "prod" },
+                    containers: [{ name: "app", usage: { cpu: "250m", memory: "128Mi" } }],
+                  },
+                ],
+              },
+            }
+          : undefined,
+      ),
+    });
+    const { log } = spyConsole();
+
+    const code = await runTop(["pods", "-n", "prod"], { connect: cluster.connector });
+
+    expect(code).toBe(0);
+    const out = log.mock.calls[0][0] as string;
+    expect(out).toContain("web");
+    expect(out).toContain("app:250m");
+    expect(out).toContain("app:128Mi");
+  });
+
+  test("nodes usage", async () => {
+    const cluster = fakeCluster({
+      serves: [],
+      respond: withMetricsGroup((req) =>
+        req.path === "/apis/metrics.k8s.io/v1beta1/nodes"
+          ? { body: { items: [{ metadata: { name: "node-1" }, usage: { cpu: "500m", memory: "2Gi" } }] } }
+          : undefined,
+      ),
+    });
+    const { log } = spyConsole();
+
+    const code = await runTop(["nodes"], { connect: cluster.connector });
+
+    expect(code).toBe(0);
+    const out = log.mock.calls[0][0] as string;
+    expect(out).toContain("node-1");
+    expect(out).toContain("500m");
+    expect(out).toContain("2Gi");
+  });
+
+  test("metrics-server absent renders a clear message, not an empty table", async () => {
+    const cluster = fakeCluster({ serves: [] });
+    const { error, log } = spyConsole();
+
+    const code = await runTop(["pods"], { connect: cluster.connector });
+
+    expect(code).toBe(1);
+    expect(error.mock.calls[0][0]).toContain("metrics-server");
+    expect(log).not.toHaveBeenCalled();
+  });
+
+  test("binding mismatch refuses loudly", async () => {
+    const { error } = spyConsole();
+    const connect = async () => {
+      throw new ClusterBindingMismatchError("prod", "prod-eks", "dev-eks");
+    };
+
+    const code = await runTop(["pods", "--env", "prod"], { connect });
+
+    expect(code).toBe(1);
+    expect(error.mock.calls[0][0]).toContain("no binding for this environment");
+  });
+
+  test("unknown flag is rejected before any connection", async () => {
+    const { error } = spyConsole();
+    const connect = vi.fn();
+
+    const code = await runTop(["pods", "--bogus"], { connect });
+
+    expect(code).toBe(1);
+    expect(error.mock.calls[0][0]).toContain("Unknown flag");
+    expect(connect).not.toHaveBeenCalled();
+  });
+
+  test("tri-state: an RBAC-denied metrics read renders NOT-OBSERVED", async () => {
+    const cluster = fakeCluster({
+      serves: [],
+      respond: withMetricsGroup((req) =>
+        req.path === "/apis/metrics.k8s.io/v1beta1/namespaces/prod/pods"
+          ? { status: 403, body: { kind: "Status", reason: "Forbidden", message: "forbidden" } }
+          : undefined,
+      ),
+    });
+    const { error, log } = spyConsole();
+
+    const code = await runTop(["pods", "-n", "prod"], { connect: cluster.connector });
+
+    expect(code).toBe(1);
+    expect(error.mock.calls[0][0]).toContain("no credentials");
+    expect(log).not.toHaveBeenCalled();
+  });
+});