pepr 0.12.1 → 0.13.0

package/dist/lib.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
-  "sources": ["../src/lib.ts", "../src/lib/k8s/upstream.ts", "../src/lib/k8s/types.ts", "../src/lib/k8s/kinds.ts", "../src/lib/logger.ts", "../src/lib/capability.ts", "../src/lib/fetch.ts", "../src/lib/module.ts", "../src/lib/controller.ts", "../src/lib/processor.ts", "../src/lib/filter.ts", "../src/lib/request.ts", "../src/lib/utils.ts", "../src/lib/metrics.ts"],
-  "sourcesContent": ["import * as k8s from \"@kubernetes/client-node\";\nimport { StatusCodes as fetchStatus } from \"http-status-codes\";\nimport * as R from \"ramda\";\nimport { Capability } from \"./lib/capability\";\nimport { fetch, fetchRaw } from \"./lib/fetch\";\nimport { RegisterKind, a } from \"./lib/k8s/index\";\nimport Log from \"./lib/logger\";\nimport { PeprModule } from \"./lib/module\";\nimport { PeprRequest } from \"./lib/request\";\nimport * as PeprUtils from \"./lib/utils\";\n\n// Import type information for external packages\nimport type * as K8sTypes from \"@kubernetes/client-node\";\nimport type * as RTypes from \"ramda\";\n\nexport {\n  a,\n  /** PeprModule is used to setup a complete Pepr Module: `new PeprModule(cfg, {...capabilities})` */\n  PeprModule,\n  PeprRequest,\n  PeprUtils,\n  RegisterKind,\n  Capability,\n  Log,\n  R,\n  fetch,\n  fetchRaw,\n  fetchStatus,\n  k8s,\n\n  // Export the imported type information for external packages\n  RTypes,\n  K8sTypes,\n};\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\n/** a is a collection of K8s types to be used within a CapabilityAction: `When(a.Configmap)` */\nexport {\n  V1APIService as APIService,\n  V1CertificateSigningRequest as CertificateSigningRequest,\n  V1ConfigMap as ConfigMap,\n  V1ControllerRevision as ControllerRevision,\n  V1CronJob as CronJob,\n  V1CSIDriver as CSIDriver,\n  V1CSIStorageCapacity as CSIStorageCapacity,\n  V1CustomResourceDefinition as CustomResourceDefinition,\n  V1DaemonSet as DaemonSet,\n  V1Deployment as Deployment,\n  V1EndpointSlice as EndpointSlice,\n  V1HorizontalPodAutoscaler as HorizontalPodAutoscaler,\n  V1Ingress as Ingress,\n  V1IngressClass as IngressClass,\n  V1Job as Job,\n  V1LimitRange as LimitRange,\n  V1LocalSubjectAccessReview as LocalSubjectAccessReview,\n  V1MutatingWebhookConfiguration as MutatingWebhookConfiguration,\n  V1Namespace as Namespace,\n  V1NetworkPolicy as NetworkPolicy,\n  V1Node as Node,\n  V1PersistentVolume as PersistentVolume,\n  V1PersistentVolumeClaim as PersistentVolumeClaim,\n  V1Pod as Pod,\n  V1PodDisruptionBudget as PodDisruptionBudget,\n  V1PodTemplate as PodTemplate,\n  V1ReplicaSet as ReplicaSet,\n  V1ReplicationController as ReplicationController,\n  V1ResourceQuota as ResourceQuota,\n  V1RuntimeClass as RuntimeClass,\n  V1Secret as Secret,\n  V1SelfSubjectAccessReview as SelfSubjectAccessReview,\n  V1SelfSubjectRulesReview as SelfSubjectRulesReview,\n  V1Service as Service,\n  V1ServiceAccount as ServiceAccount,\n  V1StatefulSet as StatefulSet,\n  V1StorageClass as StorageClass,\n  V1SubjectAccessReview as SubjectAccessReview,\n  V1TokenReview as TokenReview,\n  V1ValidatingWebhookConfiguration as ValidatingWebhookConfiguration,\n  V1VolumeAttachment as VolumeAttachment,\n} from \"@kubernetes/client-node\";\n\nexport { GenericKind } from \"./types\";\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { V1ListMeta, V1ObjectMeta } from \"@kubernetes/client-node\";\n\nexport enum Operation {\n  CREATE = \"CREATE\",\n  UPDATE = \"UPDATE\",\n  DELETE = \"DELETE\",\n  CONNECT = \"CONNECT\",\n}\n\nexport interface KubernetesObject {\n  apiVersion?: string;\n  kind?: string;\n  metadata?: V1ObjectMeta;\n}\nexport interface KubernetesListObject<T extends KubernetesObject> {\n  apiVersion?: string;\n  kind?: string;\n  metadata?: V1ListMeta;\n  items: T[];\n}\n\n/**\n * GenericKind is a generic Kubernetes object that can be used to represent any Kubernetes object\n * that is not explicitly supported by Pepr. This can be used on its own or as a base class for\n * other types. See the examples in `HelloPepr.ts` for more information.\n */\nexport class GenericKind {\n  apiVersion?: string;\n  kind?: string;\n  metadata?: V1ObjectMeta;\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  [key: string]: any;\n}\n\n/**\n * GroupVersionKind unambiguously identifies a kind. It doesn't anonymously include GroupVersion\n * to avoid automatic coercion. It doesn't use a GroupVersion to avoid custom marshalling\n **/\nexport interface GroupVersionKind {\n  /** The K8s resource kind, e..g \"Pod\". */\n  readonly kind: string;\n  readonly group: string;\n  readonly version?: string;\n  /** Optional, override the plural name for use in Webhook rules generation */\n  readonly plural?: string;\n}\n\n/**\n * GroupVersionResource unambiguously identifies a resource. It doesn't anonymously include GroupVersion\n * to avoid automatic coercion. It doesn't use a GroupVersion to avoid custom marshalling\n */\nexport interface GroupVersionResource {\n  readonly group: string;\n  readonly version: string;\n  readonly resource: string;\n}\n\n/**\n * A Kubernetes admission request to be processed by a capability.\n */\nexport interface Request<T = KubernetesObject> {\n  /** UID is an identifier for the individual request/response. */\n  readonly uid: string;\n\n  /** Kind is the fully-qualified type of object being submitted (for example, v1.Pod or autoscaling.v1.Scale) */\n  readonly kind: GroupVersionKind;\n\n  /** Resource is the fully-qualified resource being requested (for example, v1.pods) */\n  readonly resource: GroupVersionResource;\n\n  /** SubResource is the sub-resource being requested, if any (for example, \"status\" or \"scale\") */\n  readonly subResource?: string;\n\n  /** RequestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale). */\n  readonly requestKind?: GroupVersionKind;\n\n  /** RequestResource is the fully-qualified resource of the original API request (for example, v1.pods). */\n  readonly requestResource?: GroupVersionResource;\n\n  /** RequestSubResource is the sub-resource of the original API request, if any (for example, \"status\" or \"scale\"). */\n  readonly requestSubResource?: string;\n\n  /**\n   * Name is the name of the object as presented in the request. On a CREATE operation, the client may omit name and\n   * rely on the server to generate the name. If that is the case, this method will return the empty string.\n   */\n  readonly name: string;\n\n  /** Namespace is the namespace associated with the request (if any). */\n  readonly namespace?: string;\n\n  /**\n   * Operation is the operation being performed. This may be different than the operation\n   * requested. e.g. a patch can result in either a CREATE or UPDATE Operation.\n   */\n  readonly operation: Operation;\n\n  /** UserInfo is information about the requesting user */\n  readonly userInfo: {\n    /** The name that uniquely identifies this user among all active users. */\n    username?: string;\n\n    /**\n     * A unique value that identifies this user across time. If this user is deleted\n     * and another user by the same name is added, they will have different UIDs.\n     */\n    uid?: string;\n\n    /** The names of groups this user is a part of. */\n    groups?: string[];\n\n    /** Any additional information provided by the authenticator. */\n    extra?: {\n      [key: string]: string[];\n    };\n  };\n\n  /** Object is the object from the incoming request prior to default values being applied */\n  readonly object: T;\n\n  /** OldObject is the existing object. Only populated for UPDATE or DELETE requests. */\n  readonly oldObject?: T;\n\n  /** DryRun indicates that modifications will definitely not be persisted for this request. Defaults to false. */\n  readonly dryRun?: boolean;\n\n  /**\n   * Options contains the options for the operation being performed.\n   * e.g. `meta.k8s.io/v1.DeleteOptions` or `meta.k8s.io/v1.CreateOptions`. This may be\n   * different than the options the caller provided. e.g. for a patch request the performed\n   * Operation might be a CREATE, in which case the Options will a\n   * `meta.k8s.io/v1.CreateOptions` even though the caller provided `meta.k8s.io/v1.PatchOptions`.\n   */\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  readonly options?: any;\n}\n\nexport interface Response {\n  /** UID is an identifier for the individual request/response. This must be copied over from the corresponding AdmissionRequest. */\n  uid: string;\n\n  /** Allowed indicates whether or not the admission request was permitted. */\n  allowed: boolean;\n\n  /** Result contains extra details into why an admission request was denied. This field IS NOT consulted in any way if \"Allowed\" is \"true\". */\n  result?: string;\n\n  /** The patch body. Currently we only support \"JSONPatch\" which implements RFC 6902. */\n  patch?: string;\n\n  /** The type of Patch. Currently we only allow \"JSONPatch\". */\n  patchType?: \"JSONPatch\";\n\n  /** AuditAnnotations is an unstructured key value map set by remote admission controller (e.g. error=image-blacklisted). */\n  auditAnnotations?: {\n    [key: string]: string;\n  };\n\n  /** warnings is a list of warning messages to return to the requesting API client. */\n  warnings?: string[];\n}\n\nexport type WebhookIgnore = {\n  /**\n   * List of Kubernetes namespaces to always ignore.\n   * Any resources in these namespaces will be ignored by Pepr.\n   *\n   * Note: `kube-system` and `pepr-system` are always ignored.\n   */\n  namespaces?: string[];\n  /**\n   * List of Kubernetes labels to always ignore.\n   * Any resources with these labels will be ignored by Pepr.\n   *\n   * The example below will ignore any resources with the label `my-label=ulta-secret`:\n   * ```\n   * alwaysIgnore:\n   *   labels: [{ \"my-label\": \"ultra-secret\" }]\n   * ```\n   */\n  labels?: Record<string, string>[];\n};\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { GenericClass } from \"../types\";\nimport { GroupVersionKind } from \"./types\";\n\nexport const gvkMap: Record<string, GroupVersionKind> = {\n  /**\n   * Represents a K8s ConfigMap resource.\n   * ConfigMap holds configuration data for pods to consume.\n   * @see {@link https://kubernetes.io/docs/concepts/configuration/configmap/}\n   */\n  V1ConfigMap: {\n    kind: \"ConfigMap\",\n    version: \"v1\",\n    group: \"\",\n  },\n\n  /**\n   * Represents a K8s Endpoints resource.\n   * Endpoints expose a service's IP addresses and ports to other resources.\n   * @see {@link https://kubernetes.io/docs/concepts/services-networking/service/#endpoints}\n   */\n  V1Endpoint: {\n    kind: \"Endpoints\",\n    version: \"v1\",\n    group: \"\",\n    plural: \"endpoints\",\n  },\n\n  /**\n   * Represents a K8s LimitRange resource.\n   * LimitRange enforces constraints on the resource consumption of objects in a namespace.\n   * @see {@link https://kubernetes.io/docs/concepts/policy/limit-range/}\n   */\n  V1LimitRange: {\n    kind: \"LimitRange\",\n    version: \"v1\",\n    group: \"\",\n  },\n\n  /**\n   * Represents a K8s Namespace resource.\n   * Namespace is a way to divide cluster resources between multiple users.\n   * @see {@link https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/}\n   */\n  V1Namespace: {\n    kind: \"Namespace\",\n    version: \"v1\",\n    group: \"\",\n  },\n\n  /**\n   * Represents a K8s Node resource.\n   * Node is a worker machine in Kubernetes.\n   * @see {@link https://kubernetes.io/docs/concepts/architecture/nodes/}\n   */\n  V1Node: {\n    kind: \"Node\",\n    version: \"v1\",\n    group: \"\",\n  },\n\n  /**\n   * Represents a K8s PersistentVolumeClaim resource.\n   * PersistentVolumeClaim is a user's request for and claim to a persistent volume.\n   * @see {@link https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims}\n   */\n  V1PersistentVolumeClaim: {\n    kind: \"PersistentVolumeClaim\",\n    version: \"v1\",\n    group: \"\",\n  },\n\n  /**\n   * Represents a K8s PersistentVolume resource.\n   * PersistentVolume is a piece of storage in the cluster that has been provisioned by an administrator.\n   * @see {@link https://kubernetes.io/docs/concepts/storage/persistent-volumes/}\n   */\n  V1PersistentVolume: {\n    kind: \"PersistentVolume\",\n    version: \"v1\",\n    group: \"\",\n  },\n\n  /**\n   * Represents a K8s Pod resource.\n   * Pod is the smallest and simplest unit in the Kubernetes object model.\n   * @see {@link https://kubernetes.io/docs/concepts/workloads/pods/}\n   */\n  V1Pod: {\n    kind: \"Pod\",\n    version: \"v1\",\n    group: \"\",\n  },\n  /**\n   * Represents a K8s PodTemplate resource.\n   * PodTemplate is an object that describes the pod that will be created from a higher level abstraction.\n   * @see {@link https://kubernetes.io/docs/concepts/workloads/controllers/#pod-template}\n   */\n  V1PodTemplate: {\n    kind: \"PodTemplate\",\n    version: \"v1\",\n    group: \"\",\n  },\n\n  /**\n   * Represents a K8s ReplicationController resource.\n   * ReplicationController ensures that a specified number of pod replicas are running at any given time.\n   * @see {@link https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller/}\n   */\n  V1ReplicationController: {\n    kind: \"ReplicationController\",\n    version: \"v1\",\n    group: \"\",\n  },\n\n  /**\n   * Represents a K8s ResourceQuota resource.\n   * ResourceQuota provides constraints that limit resource consumption per namespace.\n   * @see {@link https://kubernetes.io/docs/concepts/policy/resource-quotas/}\n   */\n  V1ResourceQuota: {\n    kind: \"ResourceQuota\",\n    version: \"v1\",\n    group: \"\",\n  },\n\n  /**\n   * Represents a K8s Secret resource.\n   * Secret holds secret data of a certain type.\n   * @see {@link https://kubernetes.io/docs/concepts/configuration/secret/}\n   */\n  V1Secret: {\n    kind: \"Secret\",\n    version: \"v1\",\n    group: \"\",\n  },\n\n  /**\n   * Represents a K8s ServiceAccount resource.\n   * ServiceAccount is an identity that processes in a pod can use to access the Kubernetes API.\n   * @see {@link https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/}\n   */\n  V1ServiceAccount: {\n    kind: \"ServiceAccount\",\n    version: \"v1\",\n    group: \"\",\n  },\n\n  /**\n   * Represents a K8s Service resource.\n   * Service is an abstraction which defines a logical set of Pods and a policy by which to access them.\n   * @see {@link https://kubernetes.io/docs/concepts/services-networking/service/}\n   */\n  V1Service: {\n    kind: \"Service\",\n    version: \"v1\",\n    group: \"\",\n  },\n\n  /**\n   * Represents a K8s MutatingWebhookConfiguration resource.\n   * MutatingWebhookConfiguration configures a mutating admission webhook.\n   * @see {@link https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#configure-admission-webhooks-on-the-fly}\n   */\n  V1MutatingWebhookConfiguration: {\n    kind: \"MutatingWebhookConfiguration\",\n    version: \"v1\",\n    group: \"admissionregistration.k8s.io\",\n  },\n\n  /**\n   * Represents a K8s ValidatingWebhookConfiguration resource.\n   * ValidatingWebhookConfiguration configures a validating admission webhook.\n   * @see {@link https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#configure-admission-webhooks-on-the-fly}\n   */\n  V1ValidatingWebhookConfiguration: {\n    kind: \"ValidatingWebhookConfiguration\",\n    version: \"v1\",\n    group: \"admissionregistration.k8s.io\",\n  },\n  /**\n   * Represents a K8s CustomResourceDefinition resource.\n   * CustomResourceDefinition is a custom resource in a Kubernetes cluster.\n   * @see {@link https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/}\n   */\n  V1CustomResourceDefinition: {\n    kind: \"CustomResourceDefinition\",\n    version: \"v1\",\n    group: \"apiextensions.k8s.io\",\n  },\n\n  /**\n   * Represents a K8s APIService resource.\n   * APIService represents a server for a particular API version and group.\n   * @see {@link https://kubernetes.io/docs/tasks/access-kubernetes-api/setup-extension-api-server/}\n   */\n  V1APIService: {\n    kind: \"APIService\",\n    version: \"v1\",\n    group: \"apiregistration.k8s.io\",\n  },\n\n  /**\n   * Represents a K8s ControllerRevision resource.\n   * ControllerRevision is used to manage the history of a StatefulSet or DaemonSet.\n   * @see {@link https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#revision-history}\n   */\n  V1ControllerRevision: {\n    kind: \"ControllerRevision\",\n    version: \"v1\",\n    group: \"apps\",\n  },\n\n  /**\n   * Represents a K8s DaemonSet resource.\n   * DaemonSet ensures that all (or some) nodes run a copy of a Pod.\n   * @see {@link https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/}\n   */\n  V1DaemonSet: {\n    kind: \"DaemonSet\",\n    version: \"v1\",\n    group: \"apps\",\n  },\n\n  /**\n   * Represents a K8s Deployment resource.\n   * Deployment provides declarative updates for Pods and ReplicaSets.\n   * @see {@link https://kubernetes.io/docs/concepts/workloads/controllers/deployment/}\n   */\n  V1Deployment: {\n    kind: \"Deployment\",\n    version: \"v1\",\n    group: \"apps\",\n  },\n\n  /**\n   * Represents a K8s ReplicaSet resource.\n   * ReplicaSet ensures that a specified number of pod replicas are running at any given time.\n   * @see {@link https://kubernetes.io/docs/concepts/workloads/controllers/replicaset/}\n   */\n  V1ReplicaSet: {\n    kind: \"ReplicaSet\",\n    version: \"v1\",\n    group: \"apps\",\n  },\n\n  /**\n   * Represents a K8s StatefulSet resource.\n   * StatefulSet is used to manage stateful applications.\n   * @see {@link https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/}\n   */\n  V1StatefulSet: {\n    kind: \"StatefulSet\",\n    version: \"v1\",\n    group: \"apps\",\n  },\n\n  /**\n   * Represents a K8s TokenReview resource.\n   * TokenReview attempts to authenticate a token to a known user.\n   * @see {@link https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#tokenreview-v1-authentication-k8s-io}\n   */\n  V1TokenReview: {\n    kind: \"TokenReview\",\n    version: \"v1\",\n    group: \"authentication.k8s.io\",\n  },\n\n  /**\n   * Represents a K8s LocalSubjectAccessReview resource.\n   * LocalSubjectAccessReview checks whether a specific user can perform a specific action in a specific namespace.\n   * @see {@link https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#localsubjectaccessreview-v1-authorization-k8s-io}\n   */\n  V1LocalSubjectAccessReview: {\n    kind: \"LocalSubjectAccessReview\",\n    version: \"v1\",\n    group: \"authorization.k8s.io\",\n  },\n\n  /**\n   * Represents a K8s SelfSubjectAccessReview resource.\n   * SelfSubjectAccessReview checks whether the current user can perform a specific action.\n   * @see {@link https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#selfsubjectaccessreview-v1-authorization-k8s-io}\n   */\n  V1SelfSubjectAccessReview: {\n    kind: \"SelfSubjectAccessReview\",\n    version: \"v1\",\n    group: \"authorization.k8s.io\",\n  },\n\n  /**\n   * Represents a K8s SelfSubjectRulesReview resource.\n   * SelfSubjectRulesReview lists the permissions a specific user has within a namespace.\n   * @see {@link https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#selfsubjectrulesreview-v1-authorization-k8s-io}\n   */\n  V1SelfSubjectRulesReview: {\n    kind: \"SelfSubjectRulesReview\",\n    version: \"v1\",\n    group: \"authorization.k8s.io\",\n  },\n\n  /**\n   * Represents a K8s SubjectAccessReview resource.\n   * SubjectAccessReview checks whether a specific user can perform a specific action.\n   * @see {@link https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#subjectaccessreview-v1-authorization-k8s-io}\n   */\n  V1SubjectAccessReview: {\n    kind: \"SubjectAccessReview\",\n    version: \"v1\",\n    group: \"authorization.k8s.io\",\n  },\n\n  /**\n   * Represents a K8s HorizontalPodAutoscaler resource.\n   * HorizontalPodAutoscaler automatically scales the number of Pods in a replication controller, deployment, or replica set.\n   * @see {@link https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/}\n   */\n  V1HorizontalPodAutoscaler: {\n    kind: \"HorizontalPodAutoscaler\",\n    version: \"v2\",\n    group: \"autoscaling\",\n  },\n\n  /**\n   * Represents a K8s CronJob resource.\n   * CronJob manages time-based jobs, specifically those that run periodically and complete after a successful execution.\n   * @see {@link https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/}\n   */\n  V1CronJob: {\n    kind: \"CronJob\",\n    version: \"v1\",\n    group: \"batch\",\n  },\n\n  /**\n   * Represents a K8s Job resource.\n   * Job represents the configuration of a single job.\n   * @see {@link https://kubernetes.io/docs/concepts/workloads/controllers/job/}\n   */\n  V1Job: {\n    kind: \"Job\",\n    version: \"v1\",\n    group: \"batch\",\n  },\n\n  /**\n   * Represents a K8s CertificateSigningRequest resource.\n   * CertificateSigningRequest represents a certificate signing request.\n   * @see {@link https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/}\n   */\n  V1CertificateSigningRequest: {\n    kind: \"CertificateSigningRequest\",\n    version: \"v1\",\n    group: \"certificates.k8s.io\",\n  },\n\n  /**\n   * Represents a K8s EndpointSlice resource.\n   * EndpointSlice represents a scalable set of network endpoints for a Kubernetes Service.\n   * @see {@link https://kubernetes.io/docs/concepts/services-networking/endpoint-slices/}\n   */\n  V1EndpointSlice: {\n    kind: \"EndpointSlice\",\n    version: \"v1\",\n    group: \"discovery.k8s.io\",\n  },\n\n  /**\n   * Represents a K8s IngressClass resource.\n   * IngressClass represents the class of the Ingress, referenced by the Ingress spec.\n   * @see {@link https://kubernetes.io/docs/concepts/services-networking/ingress/}\n   */\n  V1IngressClass: {\n    kind: \"IngressClass\",\n    version: \"v1\",\n    group: \"networking.k8s.io\",\n  },\n\n  /**\n   * Represents a K8s Ingress resource.\n   * Ingress exposes HTTP and HTTPS routes from outside the cluster to services within the cluster.\n   * @see {@link https://kubernetes.io/docs/concepts/services-networking/ingress/}\n   */\n  V1Ingress: {\n    kind: \"Ingress\",\n    version: \"v1\",\n    group: \"networking.k8s.io\",\n    plural: \"ingresses\",\n  },\n\n  /**\n   * Represents a K8s NetworkPolicy resource.\n   * NetworkPolicy defines a set of rules for how pods communicate with each other.\n   * @see {@link https://kubernetes.io/docs/concepts/services-networking/network-policies/}\n   */\n  V1NetworkPolicy: {\n    kind: \"NetworkPolicy\",\n    version: \"v1\",\n    group: \"networking.k8s.io\",\n  },\n\n  /**\n   * Represents a K8s RuntimeClass resource.\n   * RuntimeClass is a cluster-scoped resource that surfaces container runtime properties to the control plane.\n   * @see {@link https://kubernetes.io/docs/concepts/containers/runtime-class/}\n   */\n  V1RuntimeClass: {\n    kind: \"RuntimeClass\",\n    version: \"v1\",\n    group: \"node.k8s.io\",\n  },\n\n  /**\n   * Represents a K8s PodDisruptionBudget resource.\n   * PodDisruptionBudget is an API object that limits the number of pods of a replicated application that are down simultaneously.\n   * @see {@link https://kubernetes.io/docs/concepts/workloads/pods/disruptions/}\n   */\n  V1PodDisruptionBudget: {\n    kind: \"PodDisruptionBudget\",\n    version: \"v1\",\n    group: \"policy\",\n  },\n\n  /**\n   * Represents a K8s VolumeAttachment resource.\n   * VolumeAttachment captures the intent to attach or detach the specified volume to/from the specified node.\n   * @see {@link https://kubernetes.io/docs/concepts/storage/storage-classes/}\n   */\n  V1VolumeAttachment: {\n    kind: \"VolumeAttachment\",\n    version: \"v1\",\n    group: \"storage.k8s.io\",\n  },\n\n  /**\n   * Represents a K8s CSIDriver resource.\n   * CSIDriver captures information about a Container Storage Interface (CSI) volume driver.\n   * @see {@link https://kubernetes.io/docs/concepts/storage/volumes/}\n   */\n  V1CSIDriver: {\n    kind: \"CSIDriver\",\n    version: \"v1\",\n    group: \"storage.k8s.io\",\n  },\n\n  /**\n   * Represents a K8s CSIStorageCapacity resource.\n   * CSIStorageCapacity stores the reported storage capacity of a CSI node or storage class.\n   * @see {@link https://kubernetes.io/docs/concepts/storage/csi/}\n   */\n  V1CSIStorageCapacity: {\n    kind: \"CSIStorageCapacity\",\n    version: \"v1\",\n    group: \"storage.k8s.io\",\n  },\n\n  /**\n   * Represents a K8s StorageClass resource.\n   * StorageClass is a cluster-scoped resource that provides a way for administrators to describe the classes of storage they offer.\n   * @see {@link https://kubernetes.io/docs/concepts/storage/storage-classes/}\n   */\n  V1StorageClass: {\n    kind: \"StorageClass\",\n    version: \"v1\",\n    group: \"storage.k8s.io\",\n  },\n};\n\nexport function modelToGroupVersionKind(key: string): GroupVersionKind {\n  return gvkMap[key];\n}\n\n/**\n * Registers a new model and GroupVersionKind with Pepr for use with `When(a.<Kind>)`\n *\n * @param model Used to match the GroupVersionKind and define the type-data for the request\n * @param groupVersionKind Contains the match parameters to determine the request should be handled\n */\nexport const RegisterKind = (model: GenericClass, groupVersionKind: GroupVersionKind) => {\n  const name = model.name;\n\n  // Do not allow overwriting existing GVKs\n  if (gvkMap[name]) {\n    throw new Error(`GVK ${name} already registered`);\n  }\n\n  // Set the GVK\n  gvkMap[name] = groupVersionKind;\n};\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\n/**\n * Enumeration representing different logging levels.\n */\nexport enum LogLevel {\n  debug = 0,\n  info = 1,\n  warn = 2,\n  error = 3,\n}\n\nenum ConsoleColors {\n  Reset = \"\\x1b[0m\",\n  Bright = \"\\x1b[1m\",\n  Dim = \"\\x1b[2m\",\n  Underscore = \"\\x1b[4m\",\n  Blink = \"\\x1b[5m\",\n  Reverse = \"\\x1b[7m\",\n  Hidden = \"\\x1b[8m\",\n\n  FgBlack = \"\\x1b[30m\",\n  FgRed = \"\\x1b[31m\",\n  FgGreen = \"\\x1b[32m\",\n  FgYellow = \"\\x1b[33m\",\n  FgBlue = \"\\x1b[34m\",\n  FgMagenta = \"\\x1b[35m\",\n  FgCyan = \"\\x1b[36m\",\n  FgWhite = \"\\x1b[37m\",\n\n  BgBlack = \"\\x1b[40m\",\n  BgRed = \"\\x1b[41m\",\n  BgGreen = \"\\x1b[42m\",\n  BgYellow = \"\\x1b[43m\",\n  BgBlue = \"\\x1b[44m\",\n  BgMagenta = \"\\x1b[45m\",\n  BgCyan = \"\\x1b[46m\",\n  BgWhite = \"\\x1b[47m\",\n}\n\n/**\n * Simple logger class that logs messages at different log levels.\n */\nexport class Logger {\n  private _logLevel: LogLevel;\n\n  /**\n   * Create a new logger instance.\n   * @param logLevel - The minimum log level to log messages for.\n   */\n  constructor(logLevel: LogLevel) {\n    this._logLevel = logLevel;\n  }\n\n  /**\n   * Change the log level of the logger.\n   * @param logLevel - The log level to log the message at.\n   */\n  public SetLogLevel(logLevel: string): void {\n    this._logLevel = LogLevel[logLevel as keyof typeof LogLevel];\n    this.debug(`Log level set to ${logLevel}`);\n  }\n\n  /**\n   * Log a debug message.\n   * @param message - The message to log.\n   */\n  public debug<T>(message: T, prefix?: string): void {\n    this.log(LogLevel.debug, message, prefix);\n  }\n\n  /**\n   * Log an info message.\n   * @param message - The message to log.\n   */\n  public info<T>(message: T, prefix?: string): void {\n    this.log(LogLevel.info, message, prefix);\n  }\n\n  /**\n   * Log a warning message.\n   * @param message - The message to log.\n   */\n  public warn<T>(message: T, prefix?: string): void {\n    this.log(LogLevel.warn, message, prefix);\n  }\n\n  /**\n   * Log an error message.\n   * @param message - The message to log.\n   */\n  public error<T>(message: T, prefix?: string): void {\n    this.log(LogLevel.error, message, prefix);\n  }\n\n  /**\n   * Log a message at the specified log level.\n   * @param logLevel - The log level of the message.\n   * @param message - The message to log.\n   */\n  private log<T>(logLevel: LogLevel, message: T, callerPrefix = \"\"): void {\n    const color = {\n      [LogLevel.debug]: ConsoleColors.FgBlack,\n      [LogLevel.info]: ConsoleColors.FgCyan,\n      [LogLevel.warn]: ConsoleColors.FgYellow,\n      [LogLevel.error]: ConsoleColors.FgRed,\n    };\n\n    if (logLevel >= this._logLevel) {\n      // Prefix the message with the colored log level.\n      let prefix = \"[\" + LogLevel[logLevel] + \"]\\t\" + callerPrefix;\n\n      prefix = this.colorize(prefix, color[logLevel]);\n\n      // If the message is not a string, use the debug method to log the object.\n      if (typeof message !== \"string\") {\n        console.log(prefix);\n        console.debug(\"%o\", message);\n      } else {\n        console.log(prefix + \"\\t\" + message);\n      }\n    }\n  }\n\n  private colorize(text: string, color: ConsoleColors): string {\n    return color + text + ConsoleColors.Reset;\n  }\n}\n\n/** Log is an instance of Logger used to generate log entries. */\nconst Log = new Logger(LogLevel.info);\nif (process.env.LOG_LEVEL) {\n  Log.SetLogLevel(process.env.LOG_LEVEL);\n}\nexport default Log;\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { modelToGroupVersionKind } from \"./k8s/index\";\nimport { GroupVersionKind } from \"./k8s/types\";\nimport logger from \"./logger\";\nimport {\n  BindToAction,\n  Binding,\n  BindingFilter,\n  BindingWithName,\n  CapabilityAction,\n  CapabilityCfg,\n  DeepPartial,\n  Event,\n  GenericClass,\n  HookPhase,\n  WhenSelector,\n} from \"./types\";\n\n/**\n * A capability is a unit of functionality that can be registered with the Pepr runtime.\n */\nexport class Capability implements CapabilityCfg {\n  private _name: string;\n  private _description: string;\n  private _namespaces?: string[] | undefined;\n\n  // Currently everything is considered a mutation\n  private _mutateOrValidate = HookPhase.mutate;\n\n  private _bindings: Binding[] = [];\n\n  get bindings(): Binding[] {\n    return this._bindings;\n  }\n\n  get name() {\n    return this._name;\n  }\n\n  get description() {\n    return this._description;\n  }\n\n  get namespaces() {\n    return this._namespaces || [];\n  }\n\n  get mutateOrValidate() {\n    return this._mutateOrValidate;\n  }\n\n  constructor(cfg: CapabilityCfg) {\n    this._name = cfg.name;\n    this._description = cfg.description;\n    this._namespaces = cfg.namespaces;\n    logger.info(`Capability ${this._name} registered`);\n    logger.debug(cfg);\n  }\n\n  /**\n   * The When method is used to register a capability action to be executed when a Kubernetes resource is\n   * processed by Pepr. The action will be executed if the resource matches the specified kind and any\n   * filters that are applied.\n   *\n   * @param model the KubernetesObject model to match\n   * @param kind if using a custom KubernetesObject not available in `a.*`, specify the GroupVersionKind\n   * @returns\n   */\n  When = <T extends GenericClass>(model: T, kind?: GroupVersionKind): WhenSelector<T> => {\n    const matchedKind = modelToGroupVersionKind(model.name);\n\n    // If the kind is not specified and the model is not a KubernetesObject, throw an error\n    if (!matchedKind && !kind) {\n      throw new Error(`Kind not specified for ${model.name}`);\n    }\n\n    const binding: Binding = {\n      // If the kind is not specified, use the matched kind from the model\n      kind: kind || matchedKind,\n      event: Event.Any,\n      filters: {\n        name: \"\",\n        namespaces: [],\n        labels: {},\n        annotations: {},\n      },\n      callback: () => undefined,\n    };\n\n    const prefix = `${this._name}: ${model.name}`;\n\n    logger.info(`Binding created`, prefix);\n\n    const Then = (cb: CapabilityAction<T>): BindToAction<T> => {\n      logger.info(`Binding action created`, prefix);\n      logger.debug(cb.toString(), prefix);\n      // Push the binding to the list of bindings for this capability as a new BindingAction\n      // with the callback function to preserve\n      this._bindings.push({\n        ...binding,\n        callback: cb,\n      });\n\n      // Now only allow adding actions to the same binding\n      return { Then };\n    };\n\n    const ThenSet = (merge: DeepPartial<InstanceType<T>>): BindToAction<T> => {\n      // Add the new action to the binding\n      Then(req => req.Merge(merge));\n\n      return { Then };\n    };\n\n    function InNamespace(...namespaces: string[]): BindingWithName<T> {\n      logger.debug(`Add namespaces filter ${namespaces}`, prefix);\n      binding.filters.namespaces.push(...namespaces);\n      return { WithLabel, WithAnnotation, WithName, Then, ThenSet };\n    }\n\n    function WithName(name: string): BindingFilter<T> {\n      logger.debug(`Add name filter ${name}`, prefix);\n      binding.filters.name = name;\n      return { WithLabel, WithAnnotation, Then, ThenSet };\n    }\n\n    function WithLabel(key: string, value = \"\"): BindingFilter<T> {\n      logger.debug(`Add label filter ${key}=${value}`, prefix);\n      binding.filters.labels[key] = value;\n      return { WithLabel, WithAnnotation, Then, ThenSet };\n    }\n\n    const WithAnnotation = (key: string, value = \"\"): BindingFilter<T> => {\n      logger.debug(`Add annotation filter ${key}=${value}`, prefix);\n      binding.filters.annotations[key] = value;\n      return { WithLabel, WithAnnotation, Then, ThenSet };\n    };\n\n    const bindEvent = (event: Event) => {\n      binding.event = event;\n      return {\n        InNamespace,\n        Then,\n        ThenSet,\n        WithAnnotation,\n        WithLabel,\n        WithName,\n      };\n    };\n\n    return {\n      IsCreatedOrUpdated: () => bindEvent(Event.CreateOrUpdate),\n      IsCreated: () => bindEvent(Event.Create),\n      IsUpdated: () => bindEvent(Event.Update),\n      IsDeleted: () => bindEvent(Event.Delete),\n    };\n  };\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { StatusCodes } from \"http-status-codes\";\nimport f, { FetchError, RequestInfo, RequestInit } from \"node-fetch\";\nimport logger from \"./logger\";\n\nexport const fetchRaw = f;\n\nexport type FetchResponse<T> = {\n  data: T;\n  ok: boolean;\n  status: number;\n  statusText: string;\n};\n\n/**\n * Perform an async HTTP call and return the parsed JSON response, optionally\n * as a specific type.\n *\n * @example\n * ```ts\n * fetch<string[]>(\"https://example.com/api/foo\");\n * ```\n *\n * @param url The URL or Request object to fetch\n * @param init Additional options for the request\n * @returns\n */\nexport async function fetch<T>(url: URL | RequestInfo, init?: RequestInit): Promise<FetchResponse<T>> {\n  let data = undefined as unknown as T;\n  try {\n    logger.debug(`Fetching ${url}`);\n\n    const resp = await fetchRaw(url, init);\n    const contentType = resp.headers.get(\"content-type\") || \"\";\n\n    if (resp.ok) {\n      // Parse the response as JSON if the content type is JSON\n      if (contentType.includes(\"application/json\")) {\n        data = await resp.json();\n      } else {\n        // Otherwise, return however the response was read\n        data = (await resp.text()) as unknown as T;\n      }\n    }\n\n    return {\n      data,\n      ok: resp.ok,\n      status: resp.status,\n      statusText: resp.statusText,\n    };\n  } catch (e) {\n    if (e instanceof FetchError) {\n      logger.debug(`Fetch failed: ${e instanceof Error ? e.message : e}`);\n\n      // Parse the error code from the FetchError or default to 400 (Bad Request)\n      const status = parseInt(e.code || \"400\");\n\n      return {\n        data,\n        ok: false,\n        status,\n        statusText: e.message,\n      };\n    }\n\n    return {\n      data,\n      ok: false,\n      status: StatusCodes.BAD_REQUEST,\n      statusText: \"Unknown error\",\n    };\n  }\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { concat, mergeDeepWith } from \"ramda\";\n\nimport { Capability } from \"./capability\";\nimport { Controller } from \"./controller\";\nimport { Request, Response } from \"./k8s/types\";\nimport { ModuleConfig } from \"./types\";\n\nconst alwaysIgnore = {\n  namespaces: [\"kube-system\", \"pepr-system\"],\n  labels: [{ \"pepr.dev\": \"ignore\" }],\n};\n\nexport type PackageJSON = {\n  description: string;\n  pepr: ModuleConfig;\n};\n\nexport type PeprModuleOptions = {\n  deferStart?: boolean;\n\n  /** A user-defined callback to pre-process or intercept a Pepr request from K8s immediately before it is processed */\n  beforeHook?: (req: Request) => void;\n\n  /** A user-defined callback to post-process or intercept a Pepr response just before it is returned to K8s */\n  afterHook?: (res: Response) => void;\n};\n\nexport class PeprModule {\n  private _controller!: Controller;\n\n  /**\n   * Create a new Pepr runtime\n   *\n   * @param config The configuration for the Pepr runtime\n   * @param capabilities The capabilities to be loaded into the Pepr runtime\n   * @param _deferStart (optional) If set to `true`, the Pepr runtime will not be started automatically. This can be used to start the Pepr runtime manually with `start()`.\n   */\n  constructor({ description, pepr }: PackageJSON, capabilities: Capability[] = [], opts: PeprModuleOptions = {}) {\n    const config: ModuleConfig = mergeDeepWith(concat, pepr, alwaysIgnore);\n    config.description = description;\n\n    // Handle build mode\n    if (process.env.PEPR_MODE === \"build\") {\n      process.send?.({ capabilities });\n      return;\n    }\n\n    this._controller = new Controller(config, capabilities, opts.beforeHook, opts.afterHook);\n\n    // Stop processing if deferStart is set to true\n    if (opts.deferStart) {\n      return;\n    }\n\n    this.start();\n  }\n\n  /**\n   * Start the Pepr runtime manually.\n   * Normally this is called automatically when the Pepr module is instantiated, but can be called manually if `deferStart` is set to `true` in the constructor.\n   *\n   * @param port\n   */\n  start(port = 3000) {\n    this._controller.startServer(port);\n  }\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport express from \"express\";\nimport fs from \"fs\";\nimport https from \"https\";\n\nimport { Capability } from \"./capability\";\nimport { Request, Response } from \"./k8s/types\";\nimport Log from \"./logger\";\nimport { processor } from \"./processor\";\nimport { ModuleConfig } from \"./types\";\nimport { MetricsCollector } from \"./metrics\";\n\nexport class Controller {\n  private readonly app = express();\n  private running = false;\n  private metricsCollector = new MetricsCollector(\"pepr\");\n\n  // The token used to authenticate requests\n  private token = \"\";\n\n  constructor(\n    private readonly config: ModuleConfig,\n    private readonly capabilities: Capability[],\n    private readonly beforeHook?: (req: Request) => void,\n    private readonly afterHook?: (res: Response) => void\n  ) {\n    // Middleware for logging requests\n    this.app.use(this.logger);\n\n    // Middleware for parsing JSON, limit to 2mb vs 100K for K8s compatibility\n    this.app.use(express.json({ limit: \"2mb\" }));\n\n    // Health check endpoint\n    this.app.get(\"/healthz\", this.healthz);\n\n    // Metrics endpoint\n    this.app.get(\"/metrics\", this.metrics);\n\n    // Mutate endpoint\n    this.app.post(\"/mutate/:token\", this.mutate);\n\n    if (beforeHook) {\n      console.info(`Using beforeHook: ${beforeHook}`);\n    }\n\n    if (afterHook) {\n      console.info(`Using afterHook: ${afterHook}`);\n    }\n  }\n\n  /** Start the webhook server */\n  public startServer = (port: number) => {\n    if (this.running) {\n      throw new Error(\"Cannot start Pepr module: Pepr module was not instantiated with deferStart=true\");\n    }\n\n    // Load SSL certificate and key\n    const options = {\n      key: fs.readFileSync(process.env.SSL_KEY_PATH || \"/etc/certs/tls.key\"),\n      cert: fs.readFileSync(process.env.SSL_CERT_PATH || \"/etc/certs/tls.crt\"),\n    };\n\n    // Get the API token from the environment variable or the mounted secret\n    this.token = process.env.PEPR_API_TOKEN || fs.readFileSync(\"/app/api-token/value\").toString().trim();\n    console.info(`Using API token: ${this.token}`);\n\n    if (!this.token) {\n      throw new Error(\"API token not found\");\n    }\n\n    // Create HTTPS server\n    const server = https.createServer(options, this.app).listen(port);\n\n    // Handle server listening event\n    server.on(\"listening\", () => {\n      console.log(`Server listening on port ${port}`);\n      // Track that the server is running\n      this.running = true;\n    });\n\n    // Handle EADDRINUSE errors\n    server.on(\"error\", (e: { code: string }) => {\n      if (e.code === \"EADDRINUSE\") {\n        console.log(\n          `Address in use, retrying in 2 seconds. If this persists, ensure ${port} is not in use, e.g. \"lsof -i :${port}\"`\n        );\n        setTimeout(() => {\n          server.close();\n          server.listen(port);\n        }, 2000);\n      }\n    });\n\n    // Listen for the SIGTERM signal and gracefully close the server\n    process.on(\"SIGTERM\", () => {\n      console.log(\"Received SIGTERM, closing server\");\n      server.close(() => {\n        console.log(\"Server closed\");\n        process.exit(0);\n      });\n    });\n  };\n\n  private logger = (req: express.Request, res: express.Response, next: express.NextFunction) => {\n    const startTime = Date.now();\n\n    res.on(\"finish\", () => {\n      const now = new Date().toISOString();\n      const elapsedTime = Date.now() - startTime;\n      const message = `[${now}] ${req.method} ${req.originalUrl} [${res.statusCode}] ${elapsedTime} ms\\n`;\n\n      res.statusCode >= 400 ? console.error(message) : console.info(message);\n    });\n\n    next();\n  };\n\n  private healthz = (req: express.Request, res: express.Response) => {\n    try {\n      res.send(\"OK\");\n    } catch (err) {\n      console.error(err);\n      res.status(500).send(\"Internal Server Error\");\n    }\n  };\n\n  private metrics = async (req: express.Request, res: express.Response) => {\n    try {\n      res.send(await this.metricsCollector.getMetrics());\n    } catch (err) {\n      console.error(err);\n      res.status(500).send(\"Internal Server Error\");\n    }\n  };\n\n  private mutate = async (req: express.Request, res: express.Response) => {\n    const startTime = this.metricsCollector.observeStart();\n\n    try {\n      // Validate the token\n      const { token } = req.params;\n      if (token !== this.token) {\n        const err = `Unauthorized: invalid token '${token.replace(/[^\\w]/g, \"_\")}'`;\n        console.warn(err);\n        res.status(401).send(err);\n        this.metricsCollector.alert();\n        return;\n      }\n\n      const request: Request = req.body?.request || ({} as Request);\n\n      // Run the before hook if it exists\n      this.beforeHook && this.beforeHook(request || {});\n\n      const name = request?.name ? `/${request.name}` : \"\";\n      const namespace = request?.namespace || \"\";\n      const gvk = request?.kind || { group: \"\", version: \"\", kind: \"\" };\n      const prefix = `${request.uid} ${namespace}${name}`;\n\n      Log.info(`Mutate [${request.operation}] ${gvk.group}/${gvk.version}/${gvk.kind}`, prefix);\n\n      // Process the request\n      const response = await processor(this.config, this.capabilities, request, prefix);\n\n      // Run the after hook if it exists\n      this.afterHook && this.afterHook(response);\n\n      // Log the response\n      Log.debug(response, prefix);\n\n      // Send a no prob bob response\n      res.send({\n        apiVersion: \"admission.k8s.io/v1\",\n        kind: \"AdmissionReview\",\n        response,\n      });\n      this.metricsCollector.observeEnd(startTime);\n    } catch (err) {\n      console.error(err);\n      res.status(500).send(\"Internal Server Error\");\n      this.metricsCollector.error();\n    }\n  };\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport jsonPatch from \"fast-json-patch\";\n\nimport { Capability } from \"./capability\";\nimport { shouldSkipRequest } from \"./filter\";\nimport { Request, Response } from \"./k8s/types\";\nimport { Secret } from \"./k8s/upstream\";\nimport Log from \"./logger\";\nimport { PeprRequest } from \"./request\";\nimport { ModuleConfig } from \"./types\";\nimport { convertFromBase64Map, convertToBase64Map } from \"./utils\";\n\nexport async function processor(\n  config: ModuleConfig,\n  capabilities: Capability[],\n  req: Request,\n  parentPrefix: string\n): Promise<Response> {\n  const wrapped = new PeprRequest(req);\n  const response: Response = {\n    uid: req.uid,\n    warnings: [],\n    allowed: false,\n  };\n\n  // Track whether any capability matched the request\n  let matchedCapabilityAction = false;\n\n  // Track data fields that should be skipped during decoding\n  let skipDecode: string[] = [];\n\n  // If the resource is a secret, decode the data\n  const isSecret = req.kind.version == \"v1\" && req.kind.kind == \"Secret\";\n  if (isSecret) {\n    skipDecode = convertFromBase64Map(wrapped.Raw as unknown as Secret);\n  }\n\n  Log.info(`Processing request`, parentPrefix);\n\n  for (const { name, bindings } of capabilities) {\n    const prefix = `${parentPrefix} ${name}:`;\n\n    for (const action of bindings) {\n      // Continue to the next action without doing anything if this one should be skipped\n      if (shouldSkipRequest(action, req)) {\n        continue;\n      }\n\n      const label = action.callback.name;\n      Log.info(`Processing matched action ${label}`, prefix);\n\n      matchedCapabilityAction = true;\n\n      // Add annotations to the request to indicate that the capability started processing\n      // this will allow tracking of failed mutations that were permitted to continue\n      const updateStatus = (status: string) => {\n        // Only update the status if the request is a CREATE or UPDATE (we don't use CONNECT)\n        if (req.operation == \"DELETE\") {\n          return;\n        }\n\n        const identifier = `${config.uuid}.pepr.dev/${name}`;\n        wrapped.Raw.metadata = wrapped.Raw.metadata || {};\n        wrapped.Raw.metadata.annotations = wrapped.Raw.metadata.annotations || {};\n        wrapped.Raw.metadata.annotations[identifier] = status;\n      };\n\n      updateStatus(\"started\");\n\n      try {\n        // Run the action\n        await action.callback(wrapped);\n\n        Log.info(`Action succeeded`, prefix);\n\n        // Add annotations to the request to indicate that the capability succeeded\n        updateStatus(\"succeeded\");\n      } catch (e) {\n        // Annoying ts false positive\n        response.warnings = response.warnings || [];\n        response.warnings.push(`Action failed: ${e}`);\n\n        // If errors are not allowed, note the failure in the Response\n        if (config.onError) {\n          Log.error(`Action failed: ${e}`, prefix);\n          response.result = \"Pepr module configured to reject on error\";\n          return response;\n        } else {\n          Log.warn(`Action failed: ${e}`, prefix);\n          updateStatus(\"warning\");\n        }\n      }\n    }\n  }\n\n  // If we've made it this far, the request is allowed\n  response.allowed = true;\n\n  // If no capability matched the request, exit early\n  if (!matchedCapabilityAction) {\n    Log.info(`No matching capability action found`, parentPrefix);\n    return response;\n  }\n\n  // delete operations can't be mutate, just return before the transformation\n  if (req.operation == \"DELETE\") {\n    return response;\n  }\n\n  const transformed = wrapped.Raw;\n\n  // Post-process the Secret requests to convert it back to the original format\n  if (isSecret) {\n    convertToBase64Map(transformed as unknown as Secret, skipDecode);\n  }\n\n  // Compare the original request to the modified request to get the patches\n  const patches = jsonPatch.compare(req.object, transformed);\n\n  // Only add the patch if there are patches to apply\n  if (patches.length > 0) {\n    response.patchType = \"JSONPatch\";\n    // Webhook must be base64-encoded\n    // https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#response\n    response.patch = Buffer.from(JSON.stringify(patches)).toString(\"base64\");\n  }\n\n  // Remove the warnings array if it's empty\n  if (response.warnings && response.warnings.length < 1) {\n    delete response.warnings;\n  }\n\n  Log.debug(patches, parentPrefix);\n\n  return response;\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { Operation, Request } from \"./k8s/types\";\nimport logger from \"./logger\";\nimport { Binding, Event } from \"./types\";\n\n/**\n * shouldSkipRequest determines if a request should be skipped based on the binding filters.\n *\n * @param binding the capability action binding\n * @param req the incoming request\n * @returns\n */\nexport function shouldSkipRequest(binding: Binding, req: Request) {\n  const { group, kind, version } = binding.kind || {};\n  const { namespaces, labels, annotations, name } = binding.filters || {};\n  const operation = req.operation.toUpperCase();\n  // Use the old object if the request is a DELETE operation\n  const srcObject = operation === Operation.DELETE ? req.oldObject : req.object;\n  const { metadata } = srcObject || {};\n\n  console.log(metadata);\n\n  // Test for matching operation\n  if (!binding.event.includes(operation) && !binding.event.includes(Event.Any)) {\n    return true;\n  }\n\n  // Test name first, since it's the most specific\n  if (name && name !== req.name) {\n    return true;\n  }\n\n  // Test for matching kinds\n  if (kind !== req.kind.kind) {\n    return true;\n  }\n\n  // Test for matching groups\n  if (group && group !== req.kind.group) {\n    return true;\n  }\n\n  // Test for matching versions\n  if (version && version !== req.kind.version) {\n    return true;\n  }\n\n  // Test for matching namespaces\n  if (namespaces.length && !namespaces.includes(req.namespace || \"\")) {\n    logger.debug(\"Namespace does not match\");\n    return true;\n  }\n\n  // Test for matching labels\n  for (const [key, value] of Object.entries(labels)) {\n    const testKey = metadata?.labels?.[key];\n\n    // First check if the label exists\n    if (!testKey) {\n      logger.debug(`Label ${key} does not exist`);\n      return true;\n    }\n\n    // Then check if the value matches, if specified\n    if (value && testKey !== value) {\n      logger.debug(`${testKey} does not match ${value}`);\n      return true;\n    }\n  }\n\n  // Test for matching annotations\n  for (const [key, value] of Object.entries(annotations)) {\n    const testKey = metadata?.annotations?.[key];\n\n    // First check if the annotation exists\n    if (!testKey) {\n      logger.debug(`Annotation ${key} does not exist`);\n      return true;\n    }\n\n    // Then check if the value matches, if specified\n    if (value && testKey !== value) {\n      logger.debug(`${testKey} does not match ${value}`);\n      return true;\n    }\n  }\n\n  // No failed filters, so we should not skip this request\n  return false;\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { clone, mergeDeepRight } from \"ramda\";\n\nimport { KubernetesObject, Operation, Request } from \"./k8s/types\";\nimport { DeepPartial } from \"./types\";\n\n/**\n * The RequestWrapper class provides methods to modify Kubernetes objects in the context\n * of a mutating webhook request.\n */\nexport class PeprRequest<T extends KubernetesObject> {\n  public Raw: T;\n\n  get PermitSideEffects() {\n    return !this._input.dryRun;\n  }\n\n  /**\n   * Indicates whether the request is a dry run.\n   * @returns true if the request is a dry run, false otherwise.\n   */\n  get IsDryRun() {\n    return this._input.dryRun;\n  }\n\n  /**\n   * Provides access to the old resource in the request if available.\n   * @returns The old Kubernetes resource object or null if not available.\n   */\n  get OldResource() {\n    return this._input.oldObject;\n  }\n\n  /**\n   * Provides access to the request object.\n   * @returns The request object containing the Kubernetes resource.\n   */\n  get Request() {\n    return this._input;\n  }\n\n  /**\n   * Creates a new instance of the Action class.\n   * @param input - The request object containing the Kubernetes resource to modify.\n   */\n  constructor(private _input: Request<T>) {\n    // If this is a DELETE operation, use the oldObject instead\n    if (_input.operation.toUpperCase() === Operation.DELETE) {\n      this.Raw = clone(_input.oldObject as T);\n    } else {\n      // Otherwise, use the incoming object\n      this.Raw = clone(_input.object);\n    }\n\n    if (!this.Raw) {\n      throw new Error(\"unable to load the request object into PeprRequest.RawP\");\n    }\n  }\n\n  /**\n   * Deep merges the provided object with the current resource.\n   *\n   * @param obj - The object to merge with the current resource.\n   */\n  Merge(obj: DeepPartial<T>) {\n    this.Raw = mergeDeepRight(this.Raw, obj) as unknown as T;\n  }\n\n  /**\n   * Updates a label on the Kubernetes resource.\n   * @param key - The key of the label to update.\n   * @param value - The value of the label.\n   * @returns The current Action instance for method chaining.\n   */\n  SetLabel(key: string, value: string) {\n    const ref = this.Raw;\n\n    ref.metadata = ref.metadata ?? {};\n    ref.metadata.labels = ref.metadata.labels ?? {};\n    ref.metadata.labels[key] = value;\n\n    return this;\n  }\n\n  /**\n   * Updates an annotation on the Kubernetes resource.\n   * @param key - The key of the annotation to update.\n   * @param value - The value of the annotation.\n   * @returns The current Action instance for method chaining.\n   */\n  SetAnnotation(key: string, value: string) {\n    const ref = this.Raw;\n\n    ref.metadata = ref.metadata ?? {};\n    ref.metadata.annotations = ref.metadata.annotations ?? {};\n    ref.metadata.annotations[key] = value;\n\n    return this;\n  }\n\n  /**\n   * Removes a label from the Kubernetes resource.\n   * @param key - The key of the label to remove.\n   * @returns The current Action instance for method chaining.\n   */\n  RemoveLabel(key: string) {\n    if (this.Raw.metadata?.labels?.[key]) {\n      delete this.Raw.metadata.labels[key];\n    }\n\n    return this;\n  }\n\n  /**\n   * Removes an annotation from the Kubernetes resource.\n   * @param key - The key of the annotation to remove.\n   * @returns The current Action instance for method chaining.\n   */\n  RemoveAnnotation(key: string) {\n    if (this.Raw.metadata?.annotations?.[key]) {\n      delete this.Raw.metadata.annotations[key];\n    }\n\n    return this;\n  }\n\n  /**\n   * Check if a label exists on the Kubernetes resource.\n   *\n   * @param key the label key to check\n   * @returns\n   */\n  HasLabel(key: string) {\n    return this.Raw.metadata?.labels?.[key] !== undefined;\n  }\n\n  /**\n   * Check if an annotation exists on the Kubernetes resource.\n   *\n   * @param key the annotation key to check\n   * @returns\n   */\n  HasAnnotation(key: string) {\n    return this.Raw.metadata?.annotations?.[key] !== undefined;\n  }\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport Log from \"./logger\";\n\n/** Test if a string is ascii or not */\nexport const isAscii = /^[\\s\\x20-\\x7E]*$/;\n\n/**\n * Encode all ascii values in a map to base64\n * @param obj The object to encode\n * @param skip A list of keys to skip encoding\n */\nexport function convertToBase64Map(obj: { data?: Record<string, string> }, skip: string[]) {\n  obj.data = obj.data ?? {};\n  for (const key in obj.data) {\n    const value = obj.data[key];\n    // Only encode ascii values\n    obj.data[key] = skip.includes(key) ? value : base64Encode(value);\n  }\n}\n\n/**\n * Decode all ascii values in a map from base64 to utf-8\n * @param obj The object to decode\n * @returns A list of keys that were skipped\n */\nexport function convertFromBase64Map(obj: { data?: Record<string, string> }) {\n  const skip: string[] = [];\n\n  obj.data = obj.data ?? {};\n  for (const key in obj.data) {\n    const decoded = base64Decode(obj.data[key]);\n    if (isAscii.test(decoded)) {\n      // Only decode ascii values\n      obj.data[key] = decoded;\n    } else {\n      skip.push(key);\n    }\n  }\n\n  Log.debug(`Non-ascii data detected in keys: ${skip}, skipping automatic base64 decoding`);\n\n  return skip;\n}\n\n/** Decode a base64 string */\nexport function base64Decode(data: string) {\n  return Buffer.from(data, \"base64\").toString(\"utf-8\");\n}\n\n/** Encode a string to base64 */\nexport function base64Encode(data: string) {\n  return Buffer.from(data).toString(\"base64\");\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport promClient from \"prom-client\";\nimport { performance } from \"perf_hooks\";\n\n/**\n * MetricsCollector class handles metrics collection using prom-client and performance hooks.\n */\nexport class MetricsCollector {\n  private _registry: promClient.Registry;\n  private _errors: promClient.Counter<string>;\n  private _alerts: promClient.Counter<string>;\n  private _summary: promClient.Summary<string>;\n\n  /**\n   * Creates a MetricsCollector instance with prefixed metrics.\n   * @param {string} [prefix='pepr'] - The prefix for the metric names.\n   */\n  constructor(prefix = \"pepr\") {\n    this._registry = new promClient.Registry();\n\n    this._errors = new promClient.Counter({\n      name: `${prefix}_errors`,\n      help: \"error counter\",\n      registers: [this._registry],\n    });\n\n    this._alerts = new promClient.Counter({\n      name: `${prefix}_alerts`,\n      help: \"alerts counter\",\n      registers: [this._registry],\n    });\n\n    this._summary = new promClient.Summary({\n      name: `${prefix}_summary`,\n      help: \"summary\",\n      registers: [this._registry],\n    });\n  }\n\n  /**\n   * Increments the error counter.\n   */\n  error() {\n    this._errors.inc();\n  }\n\n  /**\n   * Increments the alerts counter.\n   */\n  alert() {\n    this._alerts.inc();\n  }\n\n  /**\n   * Returns the current timestamp from performance.now() method. Useful for start timing an operation.\n   * @returns {number} The timestamp.\n   */\n  observeStart() {\n    return performance.now();\n  }\n\n  /**\n   * Observes the duration since the provided start time and updates the summary.\n   * @param {number} startTime - The start time.\n   */\n  observeEnd(startTime: number) {\n    this._summary.observe(performance.now() - startTime);\n  }\n\n  /**\n   * Fetches the current metrics from the registry.\n   * @returns {Promise<string>} The metrics.\n   */\n  async getMetrics() {\n    return this._registry.metrics();\n  }\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,+CAAAA;AAAA,EAAA;AAAA;AAAA;AAAA,UAAqB;AACrB,IAAAC,4BAA2C;AAC3C,QAAmB;;;ACFnB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,yBA0CO;;;ACjBA,IAAM,cAAN,MAAkB;AAAA,EACvB;AAAA,EACA;AAAA,EACA;AAGF;;;AC7BO,IAAM,SAA2C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtD,aAAa;AAAA,IACX,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,YAAY;AAAA,IACV,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,IACP,QAAQ;AAAA,EACV;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,cAAc;AAAA,IACZ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,aAAa;AAAA,IACX,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,QAAQ;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,yBAAyB;AAAA,IACvB,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,oBAAoB;AAAA,IAClB,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,eAAe;AAAA,IACb,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,yBAAyB;AAAA,IACvB,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,iBAAiB;AAAA,IACf,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,UAAU;AAAA,IACR,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,kBAAkB;AAAA,IAChB,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,WAAW;AAAA,IACT,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,gCAAgC;AAAA,IAC9B,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,kCAAkC;AAAA,IAChC,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,4BAA4B;AAAA,IAC1B,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,cAAc;AAAA,IACZ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,sBAAsB;AAAA,IACpB,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,aAAa;AAAA,IACX,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,cAAc;AAAA,IACZ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,cAAc;AAAA,IACZ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,eAAe;AAAA,IACb,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,eAAe;AAAA,IACb,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,4BAA4B;AAAA,IAC1B,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,2BAA2B;AAAA,IACzB,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,0BAA0B;AAAA,IACxB,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,uBAAuB;AAAA,IACrB,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,2BAA2B;AAAA,IACzB,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,WAAW;AAAA,IACT,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,6BAA6B;AAAA,IAC3B,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,iBAAiB;AAAA,IACf,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,gBAAgB;AAAA,IACd,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,WAAW;AAAA,IACT,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,IACP,QAAQ;AAAA,EACV;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,iBAAiB;AAAA,IACf,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,gBAAgB;AAAA,IACd,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,uBAAuB;AAAA,IACrB,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,oBAAoB;AAAA,IAClB,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,aAAa;AAAA,IACX,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,sBAAsB;AAAA,IACpB,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,gBAAgB;AAAA,IACd,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AACF;AAEO,SAAS,wBAAwB,KAA+B;AACrE,SAAO,OAAO,GAAG;AACnB;AAQO,IAAM,eAAe,CAAC,OAAqB,qBAAuC;AACvF,QAAM,OAAO,MAAM;AAGnB,MAAI,OAAO,IAAI,GAAG;AAChB,UAAM,IAAI,MAAM,OAAO,yBAAyB;AAAA,EAClD;AAGA,SAAO,IAAI,IAAI;AACjB;;;ACpeO,IAAK,WAAL,kBAAKC,cAAL;AACL,EAAAA,oBAAA,WAAQ,KAAR;AACA,EAAAA,oBAAA,UAAO,KAAP;AACA,EAAAA,oBAAA,UAAO,KAAP;AACA,EAAAA,oBAAA,WAAQ,KAAR;AAJU,SAAAA;AAAA,GAAA;AAsCL,IAAM,SAAN,MAAa;AAAA,EACV;AAAA;AAAA;AAAA;AAAA;AAAA,EAMR,YAAY,UAAoB;AAC9B,SAAK,YAAY;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMO,YAAY,UAAwB;AACzC,SAAK,YAAY,SAAS,QAAiC;AAC3D,SAAK,MAAM,oBAAoB,UAAU;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMO,MAAS,SAAY,QAAuB;AACjD,SAAK,IAAI,eAAgB,SAAS,MAAM;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMO,KAAQ,SAAY,QAAuB;AAChD,SAAK,IAAI,cAAe,SAAS,MAAM;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMO,KAAQ,SAAY,QAAuB;AAChD,SAAK,IAAI,cAAe,SAAS,MAAM;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMO,MAAS,SAAY,QAAuB;AACjD,SAAK,IAAI,eAAgB,SAAS,MAAM;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,IAAO,UAAoB,SAAY,eAAe,IAAU;AACtE,UAAM,QAAQ;AAAA,MACZ,CAAC,aAAc,GAAG;AAAA,MAClB,CAAC,YAAa,GAAG;AAAA,MACjB,CAAC,YAAa,GAAG;AAAA,MACjB,CAAC,aAAc,GAAG;AAAA,IACpB;AAEA,QAAI,YAAY,KAAK,WAAW;AAE9B,UAAI,SAAS,MAAM,SAAS,QAAQ,IAAI,OAAQ;AAEhD,eAAS,KAAK,SAAS,QAAQ,MAAM,QAAQ,CAAC;AAG9C,UAAI,OAAO,YAAY,UAAU;AAC/B,gBAAQ,IAAI,MAAM;AAClB,gBAAQ,MAAM,MAAM,OAAO;AAAA,MAC7B,OAAO;AACL,gBAAQ,IAAI,SAAS,MAAO,OAAO;AAAA,MACrC;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,SAAS,MAAc,OAA8B;AAC3D,WAAO,QAAQ,OAAO;AAAA,EACxB;AACF;AAGA,IAAM,MAAM,IAAI,OAAO,YAAa;AACpC,IAAI,QAAQ,IAAI,WAAW;AACzB,MAAI,YAAY,QAAQ,IAAI,SAAS;AACvC;AACA,IAAO,iBAAQ;;;AChHR,IAAM,aAAN,MAA0C;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EAEA,YAAuB,CAAC;AAAA,EAEhC,IAAI,WAAsB;AACxB,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,IAAI,OAAO;AACT,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,IAAI,cAAc;AAChB,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,IAAI,aAAa;AACf,WAAO,KAAK,eAAe,CAAC;AAAA,EAC9B;AAAA,EAEA,IAAI,mBAAmB;AACrB,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,YAAY,KAAoB;AAC9B,SAAK,QAAQ,IAAI;AACjB,SAAK,eAAe,IAAI;AACxB,SAAK,cAAc,IAAI;AACvB,mBAAO,KAAK,cAAc,KAAK,kBAAkB;AACjD,mBAAO,MAAM,GAAG;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,OAAO,CAAyB,OAAU,SAA6C;AACrF,UAAM,cAAc,wBAAwB,MAAM,IAAI;AAGtD,QAAI,CAAC,eAAe,CAAC,MAAM;AACzB,YAAM,IAAI,MAAM,0BAA0B,MAAM,MAAM;AAAA,IACxD;AAEA,UAAM,UAAmB;AAAA;AAAA,MAEvB,MAAM,QAAQ;AAAA,MACd;AAAA,MACA,SAAS;AAAA,QACP,MAAM;AAAA,QACN,YAAY,CAAC;AAAA,QACb,QAAQ,CAAC;AAAA,QACT,aAAa,CAAC;AAAA,MAChB;AAAA,MACA,UAAU,MAAM;AAAA,IAClB;AAEA,UAAM,SAAS,GAAG,KAAK,UAAU,MAAM;AAEvC,mBAAO,KAAK,mBAAmB,MAAM;AAErC,UAAM,OAAO,CAAC,OAA6C;AACzD,qBAAO,KAAK,0BAA0B,MAAM;AAC5C,qBAAO,MAAM,GAAG,SAAS,GAAG,MAAM;AAGlC,WAAK,UAAU,KAAK;AAAA,QAClB,GAAG;AAAA,QACH,UAAU;AAAA,MACZ,CAAC;AAGD,aAAO,EAAE,KAAK;AAAA,IAChB;AAEA,UAAM,UAAU,CAAC,UAAyD;AAExE,WAAK,SAAO,IAAI,MAAM,KAAK,CAAC;AAE5B,aAAO,EAAE,KAAK;AAAA,IAChB;AAEA,aAAS,eAAe,YAA0C;AAChE,qBAAO,MAAM,yBAAyB,cAAc,MAAM;AAC1D,cAAQ,QAAQ,WAAW,KAAK,GAAG,UAAU;AAC7C,aAAO,EAAE,WAAW,gBAAgB,UAAU,MAAM,QAAQ;AAAA,IAC9D;AAEA,aAAS,SAAS,MAAgC;AAChD,qBAAO,MAAM,mBAAmB,QAAQ,MAAM;AAC9C,cAAQ,QAAQ,OAAO;AACvB,aAAO,EAAE,WAAW,gBAAgB,MAAM,QAAQ;AAAA,IACpD;AAEA,aAAS,UAAU,KAAa,QAAQ,IAAsB;AAC5D,qBAAO,MAAM,oBAAoB,OAAO,SAAS,MAAM;AACvD,cAAQ,QAAQ,OAAO,GAAG,IAAI;AAC9B,aAAO,EAAE,WAAW,gBAAgB,MAAM,QAAQ;AAAA,IACpD;AAEA,UAAM,iBAAiB,CAAC,KAAa,QAAQ,OAAyB;AACpE,qBAAO,MAAM,yBAAyB,OAAO,SAAS,MAAM;AAC5D,cAAQ,QAAQ,YAAY,GAAG,IAAI;AACnC,aAAO,EAAE,WAAW,gBAAgB,MAAM,QAAQ;AAAA,IACpD;AAEA,UAAM,YAAY,CAAC,UAAiB;AAClC,cAAQ,QAAQ;AAChB,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL,oBAAoB,MAAM,+CAA8B;AAAA,MACxD,WAAW,MAAM,+BAAsB;AAAA,MACvC,WAAW,MAAM,+BAAsB;AAAA,MACvC,WAAW,MAAM,+BAAsB;AAAA,IACzC;AAAA,EACF;AACF;;;AC5JA,+BAA4B;AAC5B,wBAAwD;AAGjD,IAAM,WAAW,kBAAAC;AAsBxB,eAAsB,MAAS,KAAwB,MAA+C;AACpG,MAAI,OAAO;AACX,MAAI;AACF,mBAAO,MAAM,YAAY,KAAK;AAE9B,UAAM,OAAO,MAAM,SAAS,KAAK,IAAI;AACrC,UAAM,cAAc,KAAK,QAAQ,IAAI,cAAc,KAAK;AAExD,QAAI,KAAK,IAAI;AAEX,UAAI,YAAY,SAAS,kBAAkB,GAAG;AAC5C,eAAO,MAAM,KAAK,KAAK;AAAA,MACzB,OAAO;AAEL,eAAQ,MAAM,KAAK,KAAK;AAAA,MAC1B;AAAA,IACF;AAEA,WAAO;AAAA,MACL;AAAA,MACA,IAAI,KAAK;AAAA,MACT,QAAQ,KAAK;AAAA,MACb,YAAY,KAAK;AAAA,IACnB;AAAA,EACF,SAAS,GAAP;AACA,QAAI,aAAa,8BAAY;AAC3B,qBAAO,MAAM,iBAAiB,aAAa,QAAQ,EAAE,UAAU,GAAG;AAGlE,YAAM,SAAS,SAAS,EAAE,QAAQ,KAAK;AAEvC,aAAO;AAAA,QACL;AAAA,QACA,IAAI;AAAA,QACJ;AAAA,QACA,YAAY,EAAE;AAAA,MAChB;AAAA,IACF;AAEA,WAAO;AAAA,MACL;AAAA,MACA,IAAI;AAAA,MACJ,QAAQ,qCAAY;AAAA,MACpB,YAAY;AAAA,IACd;AAAA,EACF;AACF;;;ACxEA,IAAAC,gBAAsC;;;ACAtC,qBAAoB;AACpB,gBAAe;AACf,mBAAkB;;;ACFlB,6BAAsB;;;ACWf,SAAS,kBAAkB,SAAkB,KAAc;AAChE,QAAM,EAAE,OAAO,MAAM,QAAQ,IAAI,QAAQ,QAAQ,CAAC;AAClD,QAAM,EAAE,YAAY,QAAQ,aAAa,KAAK,IAAI,QAAQ,WAAW,CAAC;AACtE,QAAM,YAAY,IAAI,UAAU,YAAY;AAE5C,QAAM,YAAY,sCAAiC,IAAI,YAAY,IAAI;AACvE,QAAM,EAAE,SAAS,IAAI,aAAa,CAAC;AAEnC,UAAQ,IAAI,QAAQ;AAGpB,MAAI,CAAC,QAAQ,MAAM,SAAS,SAAS,KAAK,CAAC,QAAQ,MAAM,sBAAkB,GAAG;AAC5E,WAAO;AAAA,EACT;AAGA,MAAI,QAAQ,SAAS,IAAI,MAAM;AAC7B,WAAO;AAAA,EACT;AAGA,MAAI,SAAS,IAAI,KAAK,MAAM;AAC1B,WAAO;AAAA,EACT;AAGA,MAAI,SAAS,UAAU,IAAI,KAAK,OAAO;AACrC,WAAO;AAAA,EACT;AAGA,MAAI,WAAW,YAAY,IAAI,KAAK,SAAS;AAC3C,WAAO;AAAA,EACT;AAGA,MAAI,WAAW,UAAU,CAAC,WAAW,SAAS,IAAI,aAAa,EAAE,GAAG;AAClE,mBAAO,MAAM,0BAA0B;AACvC,WAAO;AAAA,EACT;AAGA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,UAAM,UAAU,UAAU,SAAS,GAAG;AAGtC,QAAI,CAAC,SAAS;AACZ,qBAAO,MAAM,SAAS,oBAAoB;AAC1C,aAAO;AAAA,IACT;AAGA,QAAI,SAAS,YAAY,OAAO;AAC9B,qBAAO,MAAM,GAAG,0BAA0B,OAAO;AACjD,aAAO;AAAA,IACT;AAAA,EACF;AAGA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,WAAW,GAAG;AACtD,UAAM,UAAU,UAAU,cAAc,GAAG;AAG3C,QAAI,CAAC,SAAS;AACZ,qBAAO,MAAM,cAAc,oBAAoB;AAC/C,aAAO;AAAA,IACT;AAGA,QAAI,SAAS,YAAY,OAAO;AAC9B,qBAAO,MAAM,GAAG,0BAA0B,OAAO;AACjD,aAAO;AAAA,IACT;AAAA,EACF;AAGA,SAAO;AACT;;;ACxFA,mBAAsC;AAS/B,IAAM,cAAN,MAA8C;AAAA;AAAA;AAAA;AAAA;AAAA,EAmCnD,YAAoB,QAAoB;AAApB;AAElB,QAAI,OAAO,UAAU,YAAY,6BAAwB;AACvD,WAAK,UAAM,oBAAM,OAAO,SAAc;AAAA,IACxC,OAAO;AAEL,WAAK,UAAM,oBAAM,OAAO,MAAM;AAAA,IAChC;AAEA,QAAI,CAAC,KAAK,KAAK;AACb,YAAM,IAAI,MAAM,yDAAyD;AAAA,IAC3E;AAAA,EACF;AAAA,EA9CO;AAAA,EAEP,IAAI,oBAAoB;AACtB,WAAO,CAAC,KAAK,OAAO;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,WAAW;AACb,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,cAAc;AAChB,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,UAAU;AACZ,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAyBA,MAAM,KAAqB;AACzB,SAAK,UAAM,6BAAe,KAAK,KAAK,GAAG;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,SAAS,KAAa,OAAe;AACnC,UAAM,MAAM,KAAK;AAEjB,QAAI,WAAW,IAAI,YAAY,CAAC;AAChC,QAAI,SAAS,SAAS,IAAI,SAAS,UAAU,CAAC;AAC9C,QAAI,SAAS,OAAO,GAAG,IAAI;AAE3B,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,cAAc,KAAa,OAAe;AACxC,UAAM,MAAM,KAAK;AAEjB,QAAI,WAAW,IAAI,YAAY,CAAC;AAChC,QAAI,SAAS,cAAc,IAAI,SAAS,eAAe,CAAC;AACxD,QAAI,SAAS,YAAY,GAAG,IAAI;AAEhC,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,YAAY,KAAa;AACvB,QAAI,KAAK,IAAI,UAAU,SAAS,GAAG,GAAG;AACpC,aAAO,KAAK,IAAI,SAAS,OAAO,GAAG;AAAA,IACrC;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,iBAAiB,KAAa;AAC5B,QAAI,KAAK,IAAI,UAAU,cAAc,GAAG,GAAG;AACzC,aAAO,KAAK,IAAI,SAAS,YAAY,GAAG;AAAA,IAC1C;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,SAAS,KAAa;AACpB,WAAO,KAAK,IAAI,UAAU,SAAS,GAAG,MAAM;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,cAAc,KAAa;AACzB,WAAO,KAAK,IAAI,UAAU,cAAc,GAAG,MAAM;AAAA,EACnD;AACF;;;ACnJA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAMO,IAAM,UAAU;AAOhB,SAAS,mBAAmB,KAAwC,MAAgB;AACzF,MAAI,OAAO,IAAI,QAAQ,CAAC;AACxB,aAAW,OAAO,IAAI,MAAM;AAC1B,UAAM,QAAQ,IAAI,KAAK,GAAG;AAE1B,QAAI,KAAK,GAAG,IAAI,KAAK,SAAS,GAAG,IAAI,QAAQ,aAAa,KAAK;AAAA,EACjE;AACF;AAOO,SAAS,qBAAqB,KAAwC;AAC3E,QAAM,OAAiB,CAAC;AAExB,MAAI,OAAO,IAAI,QAAQ,CAAC;AACxB,aAAW,OAAO,IAAI,MAAM;AAC1B,UAAM,UAAU,aAAa,IAAI,KAAK,GAAG,CAAC;AAC1C,QAAI,QAAQ,KAAK,OAAO,GAAG;AAEzB,UAAI,KAAK,GAAG,IAAI;AAAA,IAClB,OAAO;AACL,WAAK,KAAK,GAAG;AAAA,IACf;AAAA,EACF;AAEA,iBAAI,MAAM,oCAAoC,0CAA0C;AAExF,SAAO;AACT;AAGO,SAAS,aAAa,MAAc;AACzC,SAAO,OAAO,KAAK,MAAM,QAAQ,EAAE,SAAS,OAAO;AACrD;AAGO,SAAS,aAAa,MAAc;AACzC,SAAO,OAAO,KAAK,IAAI,EAAE,SAAS,QAAQ;AAC5C;;;AHxCA,eAAsB,UACpB,QACA,cACA,KACA,cACmB;AACnB,QAAM,UAAU,IAAI,YAAY,GAAG;AACnC,QAAM,WAAqB;AAAA,IACzB,KAAK,IAAI;AAAA,IACT,UAAU,CAAC;AAAA,IACX,SAAS;AAAA,EACX;AAGA,MAAI,0BAA0B;AAG9B,MAAI,aAAuB,CAAC;AAG5B,QAAM,WAAW,IAAI,KAAK,WAAW,QAAQ,IAAI,KAAK,QAAQ;AAC9D,MAAI,UAAU;AACZ,iBAAa,qBAAqB,QAAQ,GAAwB;AAAA,EACpE;AAEA,iBAAI,KAAK,sBAAsB,YAAY;AAE3C,aAAW,EAAE,MAAM,SAAS,KAAK,cAAc;AAC7C,UAAM,SAAS,GAAG,gBAAgB;AAElC,eAAW,UAAU,UAAU;AAE7B,UAAI,kBAAkB,QAAQ,GAAG,GAAG;AAClC;AAAA,MACF;AAEA,YAAM,QAAQ,OAAO,SAAS;AAC9B,qBAAI,KAAK,6BAA6B,SAAS,MAAM;AAErD,gCAA0B;AAI1B,YAAM,eAAe,CAAC,WAAmB;AAEvC,YAAI,IAAI,aAAa,UAAU;AAC7B;AAAA,QACF;AAEA,cAAM,aAAa,GAAG,OAAO,iBAAiB;AAC9C,gBAAQ,IAAI,WAAW,QAAQ,IAAI,YAAY,CAAC;AAChD,gBAAQ,IAAI,SAAS,cAAc,QAAQ,IAAI,SAAS,eAAe,CAAC;AACxE,gBAAQ,IAAI,SAAS,YAAY,UAAU,IAAI;AAAA,MACjD;AAEA,mBAAa,SAAS;AAEtB,UAAI;AAEF,cAAM,OAAO,SAAS,OAAO;AAE7B,uBAAI,KAAK,oBAAoB,MAAM;AAGnC,qBAAa,WAAW;AAAA,MAC1B,SAAS,GAAP;AAEA,iBAAS,WAAW,SAAS,YAAY,CAAC;AAC1C,iBAAS,SAAS,KAAK,kBAAkB,GAAG;AAG5C,YAAI,OAAO,SAAS;AAClB,yBAAI,MAAM,kBAAkB,KAAK,MAAM;AACvC,mBAAS,SAAS;AAClB,iBAAO;AAAA,QACT,OAAO;AACL,yBAAI,KAAK,kBAAkB,KAAK,MAAM;AACtC,uBAAa,SAAS;AAAA,QACxB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,WAAS,UAAU;AAGnB,MAAI,CAAC,yBAAyB;AAC5B,mBAAI,KAAK,uCAAuC,YAAY;AAC5D,WAAO;AAAA,EACT;AAGA,MAAI,IAAI,aAAa,UAAU;AAC7B,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,QAAQ;AAG5B,MAAI,UAAU;AACZ,uBAAmB,aAAkC,UAAU;AAAA,EACjE;AAGA,QAAM,UAAU,uBAAAC,QAAU,QAAQ,IAAI,QAAQ,WAAW;AAGzD,MAAI,QAAQ,SAAS,GAAG;AACtB,aAAS,YAAY;AAGrB,aAAS,QAAQ,OAAO,KAAK,KAAK,UAAU,OAAO,CAAC,EAAE,SAAS,QAAQ;AAAA,EACzE;AAGA,MAAI,SAAS,YAAY,SAAS,SAAS,SAAS,GAAG;AACrD,WAAO,SAAS;AAAA,EAClB;AAEA,iBAAI,MAAM,SAAS,YAAY;AAE/B,SAAO;AACT;;;AItIA,yBAAuB;AACvB,wBAA4B;AAKrB,IAAM,mBAAN,MAAuB;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMR,YAAY,SAAS,QAAQ;AAC3B,SAAK,YAAY,IAAI,mBAAAC,QAAW,SAAS;AAEzC,SAAK,UAAU,IAAI,mBAAAA,QAAW,QAAQ;AAAA,MACpC,MAAM,GAAG;AAAA,MACT,MAAM;AAAA,MACN,WAAW,CAAC,KAAK,SAAS;AAAA,IAC5B,CAAC;AAED,SAAK,UAAU,IAAI,mBAAAA,QAAW,QAAQ;AAAA,MACpC,MAAM,GAAG;AAAA,MACT,MAAM;AAAA,MACN,WAAW,CAAC,KAAK,SAAS;AAAA,IAC5B,CAAC;AAED,SAAK,WAAW,IAAI,mBAAAA,QAAW,QAAQ;AAAA,MACrC,MAAM,GAAG;AAAA,MACT,MAAM;AAAA,MACN,WAAW,CAAC,KAAK,SAAS;AAAA,IAC5B,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,QAAQ;AACN,SAAK,QAAQ,IAAI;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA,EAKA,QAAQ;AACN,SAAK,QAAQ,IAAI;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,eAAe;AACb,WAAO,8BAAY,IAAI;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,WAAW,WAAmB;AAC5B,SAAK,SAAS,QAAQ,8BAAY,IAAI,IAAI,SAAS;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,aAAa;AACjB,WAAO,KAAK,UAAU,QAAQ;AAAA,EAChC;AACF;;;ALhEO,IAAM,aAAN,MAAiB;AAAA,EAQtB,YACmB,QACA,cACA,YACA,WACjB;AAJiB;AACA;AACA;AACA;AAGjB,SAAK,IAAI,IAAI,KAAK,MAAM;AAGxB,SAAK,IAAI,IAAI,eAAAC,QAAQ,KAAK,EAAE,OAAO,MAAM,CAAC,CAAC;AAG3C,SAAK,IAAI,IAAI,YAAY,KAAK,OAAO;AAGrC,SAAK,IAAI,IAAI,YAAY,KAAK,OAAO;AAGrC,SAAK,IAAI,KAAK,kBAAkB,KAAK,MAAM;AAE3C,QAAI,YAAY;AACd,cAAQ,KAAK,qBAAqB,YAAY;AAAA,IAChD;AAEA,QAAI,WAAW;AACb,cAAQ,KAAK,oBAAoB,WAAW;AAAA,IAC9C;AAAA,EACF;AAAA,EAnCiB,UAAM,eAAAA,SAAQ;AAAA,EACvB,UAAU;AAAA,EACV,mBAAmB,IAAI,iBAAiB,MAAM;AAAA;AAAA,EAG9C,QAAQ;AAAA;AAAA,EAiCT,cAAc,CAAC,SAAiB;AACrC,QAAI,KAAK,SAAS;AAChB,YAAM,IAAI,MAAM,iFAAiF;AAAA,IACnG;AAGA,UAAM,UAAU;AAAA,MACd,KAAK,UAAAC,QAAG,aAAa,QAAQ,IAAI,gBAAgB,oBAAoB;AAAA,MACrE,MAAM,UAAAA,QAAG,aAAa,QAAQ,IAAI,iBAAiB,oBAAoB;AAAA,IACzE;AAGA,SAAK,QAAQ,QAAQ,IAAI,kBAAkB,UAAAA,QAAG,aAAa,sBAAsB,EAAE,SAAS,EAAE,KAAK;AACnG,YAAQ,KAAK,oBAAoB,KAAK,OAAO;AAE7C,QAAI,CAAC,KAAK,OAAO;AACf,YAAM,IAAI,MAAM,qBAAqB;AAAA,IACvC;AAGA,UAAM,SAAS,aAAAC,QAAM,aAAa,SAAS,KAAK,GAAG,EAAE,OAAO,IAAI;AAGhE,WAAO,GAAG,aAAa,MAAM;AAC3B,cAAQ,IAAI,4BAA4B,MAAM;AAE9C,WAAK,UAAU;AAAA,IACjB,CAAC;AAGD,WAAO,GAAG,SAAS,CAAC,MAAwB;AAC1C,UAAI,EAAE,SAAS,cAAc;AAC3B,gBAAQ;AAAA,UACN,mEAAmE,sCAAsC;AAAA,QAC3G;AACA,mBAAW,MAAM;AACf,iBAAO,MAAM;AACb,iBAAO,OAAO,IAAI;AAAA,QACpB,GAAG,GAAI;AAAA,MACT;AAAA,IACF,CAAC;AAGD,YAAQ,GAAG,WAAW,MAAM;AAC1B,cAAQ,IAAI,kCAAkC;AAC9C,aAAO,MAAM,MAAM;AACjB,gBAAQ,IAAI,eAAe;AAC3B,gBAAQ,KAAK,CAAC;AAAA,MAChB,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAAA,EAEQ,SAAS,CAAC,KAAsB,KAAuB,SAA+B;AAC5F,UAAM,YAAY,KAAK,IAAI;AAE3B,QAAI,GAAG,UAAU,MAAM;AACrB,YAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,YAAM,cAAc,KAAK,IAAI,IAAI;AACjC,YAAM,UAAU,IAAI,QAAQ,IAAI,UAAU,IAAI,gBAAgB,IAAI,eAAe;AAAA;AAEjF,UAAI,cAAc,MAAM,QAAQ,MAAM,OAAO,IAAI,QAAQ,KAAK,OAAO;AAAA,IACvE,CAAC;AAED,SAAK;AAAA,EACP;AAAA,EAEQ,UAAU,CAAC,KAAsB,QAA0B;AACjE,QAAI;AACF,UAAI,KAAK,IAAI;AAAA,IACf,SAAS,KAAP;AACA,cAAQ,MAAM,GAAG;AACjB,UAAI,OAAO,GAAG,EAAE,KAAK,uBAAuB;AAAA,IAC9C;AAAA,EACF;AAAA,EAEQ,UAAU,OAAO,KAAsB,QAA0B;AACvE,QAAI;AACF,UAAI,KAAK,MAAM,KAAK,iBAAiB,WAAW,CAAC;AAAA,IACnD,SAAS,KAAP;AACA,cAAQ,MAAM,GAAG;AACjB,UAAI,OAAO,GAAG,EAAE,KAAK,uBAAuB;AAAA,IAC9C;AAAA,EACF;AAAA,EAEQ,SAAS,OAAO,KAAsB,QAA0B;AACtE,UAAM,YAAY,KAAK,iBAAiB,aAAa;AAErD,QAAI;AAEF,YAAM,EAAE,MAAM,IAAI,IAAI;AACtB,UAAI,UAAU,KAAK,OAAO;AACxB,cAAM,MAAM,gCAAgC,MAAM,QAAQ,UAAU,GAAG;AACvE,gBAAQ,KAAK,GAAG;AAChB,YAAI,OAAO,GAAG,EAAE,KAAK,GAAG;AACxB,aAAK,iBAAiB,MAAM;AAC5B;AAAA,MACF;AAEA,YAAM,UAAmB,IAAI,MAAM,WAAY,CAAC;AAGhD,WAAK,cAAc,KAAK,WAAW,WAAW,CAAC,CAAC;AAEhD,YAAM,OAAO,SAAS,OAAO,IAAI,QAAQ,SAAS;AAClD,YAAM,YAAY,SAAS,aAAa;AACxC,YAAM,MAAM,SAAS,QAAQ,EAAE,OAAO,IAAI,SAAS,IAAI,MAAM,GAAG;AAChE,YAAM,SAAS,GAAG,QAAQ,OAAO,YAAY;AAE7C,qBAAI,KAAK,WAAW,QAAQ,cAAc,IAAI,SAAS,IAAI,WAAW,IAAI,QAAQ,MAAM;AAGxF,YAAM,WAAW,MAAM,UAAU,KAAK,QAAQ,KAAK,cAAc,SAAS,MAAM;AAGhF,WAAK,aAAa,KAAK,UAAU,QAAQ;AAGzC,qBAAI,MAAM,UAAU,MAAM;AAG1B,UAAI,KAAK;AAAA,QACP,YAAY;AAAA,QACZ,MAAM;AAAA,QACN;AAAA,MACF,CAAC;AACD,WAAK,iBAAiB,WAAW,SAAS;AAAA,IAC5C,SAAS,KAAP;AACA,cAAQ,MAAM,GAAG;AACjB,UAAI,OAAO,GAAG,EAAE,KAAK,uBAAuB;AAC5C,WAAK,iBAAiB,MAAM;AAAA,IAC9B;AAAA,EACF;AACF;;;AD/KA,IAAM,eAAe;AAAA,EACnB,YAAY,CAAC,eAAe,aAAa;AAAA,EACzC,QAAQ,CAAC,EAAE,YAAY,SAAS,CAAC;AACnC;AAiBO,IAAM,aAAN,MAAiB;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASR,YAAY,EAAE,aAAa,KAAK,GAAgB,eAA6B,CAAC,GAAG,OAA0B,CAAC,GAAG;AAC7G,UAAM,aAAuB,6BAAc,sBAAQ,MAAM,YAAY;AACrE,WAAO,cAAc;AAGrB,QAAI,QAAQ,IAAI,cAAc,SAAS;AACrC,cAAQ,OAAO,EAAE,aAAa,CAAC;AAC/B;AAAA,IACF;AAEA,SAAK,cAAc,IAAI,WAAW,QAAQ,cAAc,KAAK,YAAY,KAAK,SAAS;AAGvF,QAAI,KAAK,YAAY;AACnB;AAAA,IACF;AAEA,SAAK,MAAM;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,OAAO,KAAM;AACjB,SAAK,YAAY,YAAY,IAAI;AAAA,EACnC;AACF;",
-  "names": ["fetchStatus", "import_http_status_codes", "LogLevel", "f", "import_ramda", "jsonPatch", "promClient", "express", "fs", "https"]
+  "sources": ["../src/lib.ts", "../src/lib/capability.ts", "../src/lib/k8s/upstream.ts", "../src/lib/k8s/types.ts", "../src/lib/k8s/kinds.ts", "../src/lib/k8s/index.ts", "../src/lib/logger.ts", "../src/lib/fetch.ts", "../src/lib/module.ts", "../src/lib/controller.ts", "../src/lib/metrics.ts", "../src/lib/mutate-processor.ts", "../src/lib/filter.ts", "../src/lib/mutate-request.ts", "../src/lib/utils.ts", "../src/lib/validate-request.ts", "../src/lib/validate-processor.ts"],
+  "sourcesContent": ["import * as k8s from \"@kubernetes/client-node\";\nimport { StatusCodes as fetchStatus } from \"http-status-codes\";\nimport * as R from \"ramda\";\nimport { Capability } from \"./lib/capability\";\nimport { fetch, fetchRaw } from \"./lib/fetch\";\nimport { RegisterKind, a } from \"./lib/k8s/index\";\nimport Log from \"./lib/logger\";\nimport { PeprModule } from \"./lib/module\";\nimport { PeprMutateRequest } from \"./lib/mutate-request\";\nimport { PeprValidateRequest } from \"./lib/validate-request\";\nimport * as PeprUtils from \"./lib/utils\";\n\n// Import type information for external packages\nimport type * as K8sTypes from \"@kubernetes/client-node\";\nimport type * as RTypes from \"ramda\";\n\nexport {\n  a,\n  /** PeprModule is used to setup a complete Pepr Module: `new PeprModule(cfg, {...capabilities})` */\n  PeprModule,\n  PeprMutateRequest,\n  PeprValidateRequest,\n  PeprUtils,\n  RegisterKind,\n  Capability,\n  Log,\n  R,\n  fetch,\n  fetchRaw,\n  fetchStatus,\n  k8s,\n\n  // Export the imported type information for external packages\n  RTypes,\n  K8sTypes,\n};\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { pickBy } from \"ramda\";\n\nimport { isWatchMode, modelToGroupVersionKind } from \"./k8s/index\";\nimport { GroupVersionKind } from \"./k8s/types\";\nimport Log from \"./logger\";\nimport {\n  Binding,\n  BindingFilter,\n  BindingWithName,\n  CapabilityCfg,\n  Event,\n  GenericClass,\n  MutateAction,\n  MutateActionChain,\n  ValidateAction,\n  WhenSelector,\n} from \"./types\";\n\n/**\n * A capability is a unit of functionality that can be registered with the Pepr runtime.\n */\nexport class Capability implements CapabilityCfg {\n  private _name: string;\n  private _description: string;\n  private _namespaces?: string[] | undefined;\n\n  private _bindings: Binding[] = [];\n\n  get bindings(): Binding[] {\n    return this._bindings;\n  }\n\n  get name() {\n    return this._name;\n  }\n\n  get description() {\n    return this._description;\n  }\n\n  get namespaces() {\n    return this._namespaces || [];\n  }\n\n  constructor(cfg: CapabilityCfg) {\n    this._name = cfg.name;\n    this._description = cfg.description;\n    this._namespaces = cfg.namespaces;\n\n    Log.info(`Capability ${this._name} registered`);\n    Log.debug(cfg);\n  }\n\n  /**\n   * The When method is used to register a capability action to be executed when a Kubernetes resource is\n   * processed by Pepr. The action will be executed if the resource matches the specified kind and any\n   * filters that are applied.\n   *\n   * @param model the KubernetesObject model to match\n   * @param kind if using a custom KubernetesObject not available in `a.*`, specify the GroupVersionKind\n   * @returns\n   */\n  When = <T extends GenericClass>(model: T, kind?: GroupVersionKind): WhenSelector<T> => {\n    const matchedKind = modelToGroupVersionKind(model.name);\n\n    // If the kind is not specified and the model is not a KubernetesObject, throw an error\n    if (!matchedKind && !kind) {\n      throw new Error(`Kind not specified for ${model.name}`);\n    }\n\n    const binding: Binding = {\n      // If the kind is not specified, use the matched kind from the model\n      kind: kind || matchedKind,\n      event: Event.Any,\n      filters: {\n        name: \"\",\n        namespaces: [],\n        labels: {},\n        annotations: {},\n      },\n    };\n\n    const prefix = `${this._name}: ${model.name}`;\n\n    const isNotEmpty = (value: object) => Object.keys(value).length > 0;\n    const log = (message: string, cbString: string) => {\n      const filteredObj = pickBy(isNotEmpty, binding.filters);\n\n      Log.info(`${message} configured for ${binding.event}`, prefix);\n      Log.info(filteredObj, prefix);\n      Log.debug(cbString, prefix);\n    };\n\n    const Validate = (validateCallback: ValidateAction<T>): void => {\n      if (!isWatchMode) {\n        log(\"Validate Action\", validateCallback.toString());\n\n        // Push the binding to the list of bindings for this capability as a new BindingAction\n        // with the callback function to preserve\n        this._bindings.push({\n          ...binding,\n          isValidate: true,\n          validateCallback,\n        });\n      }\n    };\n\n    const Mutate = (mutateCallback: MutateAction<T>): MutateActionChain<T> => {\n      if (!isWatchMode) {\n        log(\"Mutate Action\", mutateCallback.toString());\n\n        // Push the binding to the list of bindings for this capability as a new BindingAction\n        // with the callback function to preserve\n        this._bindings.push({\n          ...binding,\n          isMutate: true,\n          mutateCallback,\n        });\n      }\n\n      // Now only allow adding actions to the same binding\n      return { Validate };\n    };\n\n    function InNamespace(...namespaces: string[]): BindingWithName<T> {\n      Log.debug(`Add namespaces filter ${namespaces}`, prefix);\n      binding.filters.namespaces.push(...namespaces);\n      return { ...commonChain, WithName };\n    }\n\n    function WithName(name: string): BindingFilter<T> {\n      Log.debug(`Add name filter ${name}`, prefix);\n      binding.filters.name = name;\n      return commonChain;\n    }\n\n    function WithLabel(key: string, value = \"\"): BindingFilter<T> {\n      Log.debug(`Add label filter ${key}=${value}`, prefix);\n      binding.filters.labels[key] = value;\n      return commonChain;\n    }\n\n    const WithAnnotation = (key: string, value = \"\"): BindingFilter<T> => {\n      Log.debug(`Add annotation filter ${key}=${value}`, prefix);\n      binding.filters.annotations[key] = value;\n      return commonChain;\n    };\n\n    const commonChain = { WithLabel, WithAnnotation, Mutate, Validate };\n\n    const bindEvent = (event: Event) => {\n      binding.event = event;\n      return {\n        ...commonChain,\n        InNamespace,\n        WithName,\n      };\n    };\n\n    return {\n      IsCreatedOrUpdated: () => bindEvent(Event.CreateOrUpdate),\n      IsCreated: () => bindEvent(Event.Create),\n      IsUpdated: () => bindEvent(Event.Update),\n      IsDeleted: () => bindEvent(Event.Delete),\n    };\n  };\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\n/** a is a collection of K8s types to be used within an action: `When(a.Configmap)` */\nexport {\n  V1APIService as APIService,\n  V1CertificateSigningRequest as CertificateSigningRequest,\n  V1ClusterRole as ClusterRole,\n  V1ClusterRoleBinding as ClusterRoleBinding,\n  V1ConfigMap as ConfigMap,\n  V1ControllerRevision as ControllerRevision,\n  V1CronJob as CronJob,\n  V1CSIDriver as CSIDriver,\n  V1CSIStorageCapacity as CSIStorageCapacity,\n  V1CustomResourceDefinition as CustomResourceDefinition,\n  V1DaemonSet as DaemonSet,\n  V1Deployment as Deployment,\n  V1EndpointSlice as EndpointSlice,\n  V1HorizontalPodAutoscaler as HorizontalPodAutoscaler,\n  V1Ingress as Ingress,\n  V1IngressClass as IngressClass,\n  V1Job as Job,\n  V1LimitRange as LimitRange,\n  V1LocalSubjectAccessReview as LocalSubjectAccessReview,\n  V1MutatingWebhookConfiguration as MutatingWebhookConfiguration,\n  V1Namespace as Namespace,\n  V1NetworkPolicy as NetworkPolicy,\n  V1Node as Node,\n  V1PersistentVolume as PersistentVolume,\n  V1PersistentVolumeClaim as PersistentVolumeClaim,\n  V1Pod as Pod,\n  V1PodDisruptionBudget as PodDisruptionBudget,\n  V1PodTemplate as PodTemplate,\n  V1ReplicaSet as ReplicaSet,\n  V1ReplicationController as ReplicationController,\n  V1ResourceQuota as ResourceQuota,\n  V1Role as Role,\n  V1RoleBinding as RoleBinding,\n  V1RuntimeClass as RuntimeClass,\n  V1Secret as Secret,\n  V1SelfSubjectAccessReview as SelfSubjectAccessReview,\n  V1SelfSubjectRulesReview as SelfSubjectRulesReview,\n  V1Service as Service,\n  V1ServiceAccount as ServiceAccount,\n  V1StatefulSet as StatefulSet,\n  V1StorageClass as StorageClass,\n  V1SubjectAccessReview as SubjectAccessReview,\n  V1TokenReview as TokenReview,\n  V1ValidatingWebhookConfiguration as ValidatingWebhookConfiguration,\n  V1VolumeAttachment as VolumeAttachment,\n} from \"@kubernetes/client-node\";\n\nexport { GenericKind } from \"./types\";\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { KubernetesListObject, KubernetesObject, V1ObjectMeta } from \"@kubernetes/client-node\";\n\nexport { KubernetesListObject, KubernetesObject };\n\nexport enum Operation {\n  CREATE = \"CREATE\",\n  UPDATE = \"UPDATE\",\n  DELETE = \"DELETE\",\n  CONNECT = \"CONNECT\",\n}\n\n/**\n * GenericKind is a generic Kubernetes object that can be used to represent any Kubernetes object\n * that is not explicitly supported by Pepr. This can be used on its own or as a base class for\n * other types. See the examples in `HelloPepr.ts` for more information.\n */\nexport class GenericKind {\n  apiVersion?: string;\n  kind?: string;\n  metadata?: V1ObjectMeta;\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  [key: string]: any;\n}\n\n/**\n * GroupVersionKind unambiguously identifies a kind. It doesn't anonymously include GroupVersion\n * to avoid automatic coercion. It doesn't use a GroupVersion to avoid custom marshalling\n **/\nexport interface GroupVersionKind {\n  /** The K8s resource kind, e..g \"Pod\". */\n  readonly kind: string;\n  readonly group: string;\n  readonly version?: string;\n  /** Optional, override the plural name for use in Webhook rules generation */\n  readonly plural?: string;\n}\n\n/**\n * GroupVersionResource unambiguously identifies a resource. It doesn't anonymously include GroupVersion\n * to avoid automatic coercion. It doesn't use a GroupVersion to avoid custom marshalling\n */\nexport interface GroupVersionResource {\n  readonly group: string;\n  readonly version: string;\n  readonly resource: string;\n}\n\n/**\n * A Kubernetes admission request to be processed by a capability.\n */\nexport interface Request<T = KubernetesObject> {\n  /** UID is an identifier for the individual request/response. */\n  readonly uid: string;\n\n  /** Kind is the fully-qualified type of object being submitted (for example, v1.Pod or autoscaling.v1.Scale) */\n  readonly kind: GroupVersionKind;\n\n  /** Resource is the fully-qualified resource being requested (for example, v1.pods) */\n  readonly resource: GroupVersionResource;\n\n  /** SubResource is the sub-resource being requested, if any (for example, \"status\" or \"scale\") */\n  readonly subResource?: string;\n\n  /** RequestKind is the fully-qualified type of the original API request (for example, v1.Pod or autoscaling.v1.Scale). */\n  readonly requestKind?: GroupVersionKind;\n\n  /** RequestResource is the fully-qualified resource of the original API request (for example, v1.pods). */\n  readonly requestResource?: GroupVersionResource;\n\n  /** RequestSubResource is the sub-resource of the original API request, if any (for example, \"status\" or \"scale\"). */\n  readonly requestSubResource?: string;\n\n  /**\n   * Name is the name of the object as presented in the request. On a CREATE operation, the client may omit name and\n   * rely on the server to generate the name. If that is the case, this method will return the empty string.\n   */\n  readonly name: string;\n\n  /** Namespace is the namespace associated with the request (if any). */\n  readonly namespace?: string;\n\n  /**\n   * Operation is the operation being performed. This may be different than the operation\n   * requested. e.g. a patch can result in either a CREATE or UPDATE Operation.\n   */\n  readonly operation: Operation;\n\n  /** UserInfo is information about the requesting user */\n  readonly userInfo: {\n    /** The name that uniquely identifies this user among all active users. */\n    username?: string;\n\n    /**\n     * A unique value that identifies this user across time. If this user is deleted\n     * and another user by the same name is added, they will have different UIDs.\n     */\n    uid?: string;\n\n    /** The names of groups this user is a part of. */\n    groups?: string[];\n\n    /** Any additional information provided by the authenticator. */\n    extra?: {\n      [key: string]: string[];\n    };\n  };\n\n  /** Object is the object from the incoming request prior to default values being applied */\n  readonly object: T;\n\n  /** OldObject is the existing object. Only populated for UPDATE or DELETE requests. */\n  readonly oldObject?: T;\n\n  /** DryRun indicates that modifications will definitely not be persisted for this request. Defaults to false. */\n  readonly dryRun?: boolean;\n\n  /**\n   * Options contains the options for the operation being performed.\n   * e.g. `meta.k8s.io/v1.DeleteOptions` or `meta.k8s.io/v1.CreateOptions`. This may be\n   * different than the options the caller provided. e.g. for a patch request the performed\n   * Operation might be a CREATE, in which case the Options will a\n   * `meta.k8s.io/v1.CreateOptions` even though the caller provided `meta.k8s.io/v1.PatchOptions`.\n   */\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  readonly options?: any;\n}\n\nexport interface MutateResponse {\n  /** UID is an identifier for the individual request/response. This must be copied over from the corresponding AdmissionRequest. */\n  uid: string;\n\n  /** Allowed indicates whether or not the admission request was permitted. */\n  allowed: boolean;\n\n  /** Result contains extra details into why an admission request was denied. This field IS NOT consulted in any way if \"Allowed\" is \"true\". */\n  result?: string;\n\n  /** The patch body. Currently we only support \"JSONPatch\" which implements RFC 6902. */\n  patch?: string;\n\n  /** The type of Patch. Currently we only allow \"JSONPatch\". */\n  patchType?: \"JSONPatch\";\n\n  /** AuditAnnotations is an unstructured key value map set by remote admission controller (e.g. error=image-blacklisted). */\n  auditAnnotations?: {\n    [key: string]: string;\n  };\n\n  /** warnings is a list of warning messages to return to the requesting API client. */\n  warnings?: string[];\n}\n\nexport interface ValidateResponse extends MutateResponse {\n  /** Status contains extra details into why an admission request was denied. This field IS NOT consulted in any way if \"Allowed\" is \"true\". */\n  status?: {\n    /** A machine-readable description of why this operation is in the\n       \"Failure\" status. If this value is empty there is no information available. */\n    code: number;\n\n    /** A human-readable description of the status of this operation. */\n    message: string;\n  };\n}\n\nexport type WebhookIgnore = {\n  /**\n   * List of Kubernetes namespaces to always ignore.\n   * Any resources in these namespaces will be ignored by Pepr.\n   *\n   * Note: `kube-system` and `pepr-system` are always ignored.\n   */\n  namespaces?: string[];\n  /**\n   * List of Kubernetes labels to always ignore.\n   * Any resources with these labels will be ignored by Pepr.\n   *\n   * The example below will ignore any resources with the label `my-label=ulta-secret`:\n   * ```\n   * alwaysIgnore:\n   *   labels: [{ \"my-label\": \"ultra-secret\" }]\n   * ```\n   */\n  labels?: Record<string, string>[];\n};\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { GenericClass } from \"../types\";\nimport { GroupVersionKind } from \"./types\";\n\nexport const gvkMap: Record<string, GroupVersionKind> = {\n  /**\n   * Represents a K8s ClusterRole resource.\n   * ClusterRole is a set of permissions that can be bound to a user or group in a cluster-wide scope.\n   * @see {@link https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole}\n   */\n  V1ClusterRole: {\n    kind: \"ClusterRole\",\n    version: \"v1\",\n    group: \"rbac.authorization.k8s.io\",\n  },\n  /**\n   * Represents a K8s ClusterRoleBinding resource.\n   * ClusterRoleBinding binds a ClusterRole to a user or group in a cluster-wide scope.\n   * @see {@link https://kubernetes.io/docs/reference/access-authn-authz/rbac/#rolebinding-and-clusterrolebinding}\n   */\n  V1ClusterRoleBinding: {\n    kind: \"ClusterRoleBinding\",\n    version: \"v1\",\n    group: \"rbac.authorization.k8s.io\",\n  },\n  /**\n   * Represents a K8s Role resource.\n   * Role is a set of permissions that can be bound to a user or group in a namespace scope.\n   * @see {@link https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole}\n   */\n  V1Role: {\n    kind: \"Role\",\n    version: \"v1\",\n    group: \"rbac.authorization.k8s.io\",\n  },\n  /**\n   * Represents a K8s RoleBinding resource.\n   * RoleBinding binds a Role to a user or group in a namespace scope.\n   * @see {@link https://kubernetes.io/docs/reference/access-authn-authz/rbac/#rolebinding-and-clusterrolebinding}\n   */\n  V1RoleBinding: {\n    kind: \"RoleBinding\",\n    version: \"v1\",\n    group: \"rbac.authorization.k8s.io\",\n  },\n  /**\n   * Represents a K8s ConfigMap resource.\n   * ConfigMap holds configuration data for pods to consume.\n   * @see {@link https://kubernetes.io/docs/concepts/configuration/configmap/}\n   */\n  V1ConfigMap: {\n    kind: \"ConfigMap\",\n    version: \"v1\",\n    group: \"\",\n  },\n\n  /**\n   * Represents a K8s Endpoints resource.\n   * Endpoints expose a service's IP addresses and ports to other resources.\n   * @see {@link https://kubernetes.io/docs/concepts/services-networking/service/#endpoints}\n   */\n  V1Endpoint: {\n    kind: \"Endpoints\",\n    version: \"v1\",\n    group: \"\",\n    plural: \"endpoints\",\n  },\n\n  /**\n   * Represents a K8s LimitRange resource.\n   * LimitRange enforces constraints on the resource consumption of objects in a namespace.\n   * @see {@link https://kubernetes.io/docs/concepts/policy/limit-range/}\n   */\n  V1LimitRange: {\n    kind: \"LimitRange\",\n    version: \"v1\",\n    group: \"\",\n  },\n\n  /**\n   * Represents a K8s Namespace resource.\n   * Namespace is a way to divide cluster resources between multiple users.\n   * @see {@link https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/}\n   */\n  V1Namespace: {\n    kind: \"Namespace\",\n    version: \"v1\",\n    group: \"\",\n  },\n\n  /**\n   * Represents a K8s Node resource.\n   * Node is a worker machine in Kubernetes.\n   * @see {@link https://kubernetes.io/docs/concepts/architecture/nodes/}\n   */\n  V1Node: {\n    kind: \"Node\",\n    version: \"v1\",\n    group: \"\",\n  },\n\n  /**\n   * Represents a K8s PersistentVolumeClaim resource.\n   * PersistentVolumeClaim is a user's request for and claim to a persistent volume.\n   * @see {@link https://kubernetes.io/docs/concepts/storage/persistent-volumes/#persistentvolumeclaims}\n   */\n  V1PersistentVolumeClaim: {\n    kind: \"PersistentVolumeClaim\",\n    version: \"v1\",\n    group: \"\",\n  },\n\n  /**\n   * Represents a K8s PersistentVolume resource.\n   * PersistentVolume is a piece of storage in the cluster that has been provisioned by an administrator.\n   * @see {@link https://kubernetes.io/docs/concepts/storage/persistent-volumes/}\n   */\n  V1PersistentVolume: {\n    kind: \"PersistentVolume\",\n    version: \"v1\",\n    group: \"\",\n  },\n\n  /**\n   * Represents a K8s Pod resource.\n   * Pod is the smallest and simplest unit in the Kubernetes object model.\n   * @see {@link https://kubernetes.io/docs/concepts/workloads/pods/}\n   */\n  V1Pod: {\n    kind: \"Pod\",\n    version: \"v1\",\n    group: \"\",\n  },\n  /**\n   * Represents a K8s PodTemplate resource.\n   * PodTemplate is an object that describes the pod that will be created from a higher level abstraction.\n   * @see {@link https://kubernetes.io/docs/concepts/workloads/controllers/#pod-template}\n   */\n  V1PodTemplate: {\n    kind: \"PodTemplate\",\n    version: \"v1\",\n    group: \"\",\n  },\n\n  /**\n   * Represents a K8s ReplicationController resource.\n   * ReplicationController ensures that a specified number of pod replicas are running at any given time.\n   * @see {@link https://kubernetes.io/docs/concepts/workloads/controllers/replicationcontroller/}\n   */\n  V1ReplicationController: {\n    kind: \"ReplicationController\",\n    version: \"v1\",\n    group: \"\",\n  },\n\n  /**\n   * Represents a K8s ResourceQuota resource.\n   * ResourceQuota provides constraints that limit resource consumption per namespace.\n   * @see {@link https://kubernetes.io/docs/concepts/policy/resource-quotas/}\n   */\n  V1ResourceQuota: {\n    kind: \"ResourceQuota\",\n    version: \"v1\",\n    group: \"\",\n  },\n\n  /**\n   * Represents a K8s Secret resource.\n   * Secret holds secret data of a certain type.\n   * @see {@link https://kubernetes.io/docs/concepts/configuration/secret/}\n   */\n  V1Secret: {\n    kind: \"Secret\",\n    version: \"v1\",\n    group: \"\",\n  },\n\n  /**\n   * Represents a K8s ServiceAccount resource.\n   * ServiceAccount is an identity that processes in a pod can use to access the Kubernetes API.\n   * @see {@link https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/}\n   */\n  V1ServiceAccount: {\n    kind: \"ServiceAccount\",\n    version: \"v1\",\n    group: \"\",\n  },\n\n  /**\n   * Represents a K8s Service resource.\n   * Service is an abstraction which defines a logical set of Pods and a policy by which to access them.\n   * @see {@link https://kubernetes.io/docs/concepts/services-networking/service/}\n   */\n  V1Service: {\n    kind: \"Service\",\n    version: \"v1\",\n    group: \"\",\n  },\n\n  /**\n   * Represents a K8s MutatingWebhookConfiguration resource.\n   * MutatingWebhookConfiguration configures a mutating admission webhook.\n   * @see {@link https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#configure-admission-webhooks-on-the-fly}\n   */\n  V1MutatingWebhookConfiguration: {\n    kind: \"MutatingWebhookConfiguration\",\n    version: \"v1\",\n    group: \"admissionregistration.k8s.io\",\n  },\n\n  /**\n   * Represents a K8s ValidatingWebhookConfiguration resource.\n   * ValidatingWebhookConfiguration configures a validating admission webhook.\n   * @see {@link https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#configure-admission-webhooks-on-the-fly}\n   */\n  V1ValidatingWebhookConfiguration: {\n    kind: \"ValidatingWebhookConfiguration\",\n    version: \"v1\",\n    group: \"admissionregistration.k8s.io\",\n  },\n  /**\n   * Represents a K8s CustomResourceDefinition resource.\n   * CustomResourceDefinition is a custom resource in a Kubernetes cluster.\n   * @see {@link https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/}\n   */\n  V1CustomResourceDefinition: {\n    kind: \"CustomResourceDefinition\",\n    version: \"v1\",\n    group: \"apiextensions.k8s.io\",\n  },\n\n  /**\n   * Represents a K8s APIService resource.\n   * APIService represents a server for a particular API version and group.\n   * @see {@link https://kubernetes.io/docs/tasks/access-kubernetes-api/setup-extension-api-server/}\n   */\n  V1APIService: {\n    kind: \"APIService\",\n    version: \"v1\",\n    group: \"apiregistration.k8s.io\",\n  },\n\n  /**\n   * Represents a K8s ControllerRevision resource.\n   * ControllerRevision is used to manage the history of a StatefulSet or DaemonSet.\n   * @see {@link https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#revision-history}\n   */\n  V1ControllerRevision: {\n    kind: \"ControllerRevision\",\n    version: \"v1\",\n    group: \"apps\",\n  },\n\n  /**\n   * Represents a K8s DaemonSet resource.\n   * DaemonSet ensures that all (or some) nodes run a copy of a Pod.\n   * @see {@link https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/}\n   */\n  V1DaemonSet: {\n    kind: \"DaemonSet\",\n    version: \"v1\",\n    group: \"apps\",\n  },\n\n  /**\n   * Represents a K8s Deployment resource.\n   * Deployment provides declarative updates for Pods and ReplicaSets.\n   * @see {@link https://kubernetes.io/docs/concepts/workloads/controllers/deployment/}\n   */\n  V1Deployment: {\n    kind: \"Deployment\",\n    version: \"v1\",\n    group: \"apps\",\n  },\n\n  /**\n   * Represents a K8s ReplicaSet resource.\n   * ReplicaSet ensures that a specified number of pod replicas are running at any given time.\n   * @see {@link https://kubernetes.io/docs/concepts/workloads/controllers/replicaset/}\n   */\n  V1ReplicaSet: {\n    kind: \"ReplicaSet\",\n    version: \"v1\",\n    group: \"apps\",\n  },\n\n  /**\n   * Represents a K8s StatefulSet resource.\n   * StatefulSet is used to manage stateful applications.\n   * @see {@link https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/}\n   */\n  V1StatefulSet: {\n    kind: \"StatefulSet\",\n    version: \"v1\",\n    group: \"apps\",\n  },\n\n  /**\n   * Represents a K8s TokenReview resource.\n   * TokenReview attempts to authenticate a token to a known user.\n   * @see {@link https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#tokenreview-v1-authentication-k8s-io}\n   */\n  V1TokenReview: {\n    kind: \"TokenReview\",\n    version: \"v1\",\n    group: \"authentication.k8s.io\",\n  },\n\n  /**\n   * Represents a K8s LocalSubjectAccessReview resource.\n   * LocalSubjectAccessReview checks whether a specific user can perform a specific action in a specific namespace.\n   * @see {@link https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#localsubjectaccessreview-v1-authorization-k8s-io}\n   */\n  V1LocalSubjectAccessReview: {\n    kind: \"LocalSubjectAccessReview\",\n    version: \"v1\",\n    group: \"authorization.k8s.io\",\n  },\n\n  /**\n   * Represents a K8s SelfSubjectAccessReview resource.\n   * SelfSubjectAccessReview checks whether the current user can perform a specific action.\n   * @see {@link https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#selfsubjectaccessreview-v1-authorization-k8s-io}\n   */\n  V1SelfSubjectAccessReview: {\n    kind: \"SelfSubjectAccessReview\",\n    version: \"v1\",\n    group: \"authorization.k8s.io\",\n  },\n\n  /**\n   * Represents a K8s SelfSubjectRulesReview resource.\n   * SelfSubjectRulesReview lists the permissions a specific user has within a namespace.\n   * @see {@link https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#selfsubjectrulesreview-v1-authorization-k8s-io}\n   */\n  V1SelfSubjectRulesReview: {\n    kind: \"SelfSubjectRulesReview\",\n    version: \"v1\",\n    group: \"authorization.k8s.io\",\n  },\n\n  /**\n   * Represents a K8s SubjectAccessReview resource.\n   * SubjectAccessReview checks whether a specific user can perform a specific action.\n   * @see {@link https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#subjectaccessreview-v1-authorization-k8s-io}\n   */\n  V1SubjectAccessReview: {\n    kind: \"SubjectAccessReview\",\n    version: \"v1\",\n    group: \"authorization.k8s.io\",\n  },\n\n  /**\n   * Represents a K8s HorizontalPodAutoscaler resource.\n   * HorizontalPodAutoscaler automatically scales the number of Pods in a replication controller, deployment, or replica set.\n   * @see {@link https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/}\n   */\n  V1HorizontalPodAutoscaler: {\n    kind: \"HorizontalPodAutoscaler\",\n    version: \"v2\",\n    group: \"autoscaling\",\n  },\n\n  /**\n   * Represents a K8s CronJob resource.\n   * CronJob manages time-based jobs, specifically those that run periodically and complete after a successful execution.\n   * @see {@link https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/}\n   */\n  V1CronJob: {\n    kind: \"CronJob\",\n    version: \"v1\",\n    group: \"batch\",\n  },\n\n  /**\n   * Represents a K8s Job resource.\n   * Job represents the configuration of a single job.\n   * @see {@link https://kubernetes.io/docs/concepts/workloads/controllers/job/}\n   */\n  V1Job: {\n    kind: \"Job\",\n    version: \"v1\",\n    group: \"batch\",\n  },\n\n  /**\n   * Represents a K8s CertificateSigningRequest resource.\n   * CertificateSigningRequest represents a certificate signing request.\n   * @see {@link https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/}\n   */\n  V1CertificateSigningRequest: {\n    kind: \"CertificateSigningRequest\",\n    version: \"v1\",\n    group: \"certificates.k8s.io\",\n  },\n\n  /**\n   * Represents a K8s EndpointSlice resource.\n   * EndpointSlice represents a scalable set of network endpoints for a Kubernetes Service.\n   * @see {@link https://kubernetes.io/docs/concepts/services-networking/endpoint-slices/}\n   */\n  V1EndpointSlice: {\n    kind: \"EndpointSlice\",\n    version: \"v1\",\n    group: \"discovery.k8s.io\",\n  },\n\n  /**\n   * Represents a K8s IngressClass resource.\n   * IngressClass represents the class of the Ingress, referenced by the Ingress spec.\n   * @see {@link https://kubernetes.io/docs/concepts/services-networking/ingress/}\n   */\n  V1IngressClass: {\n    kind: \"IngressClass\",\n    version: \"v1\",\n    group: \"networking.k8s.io\",\n  },\n\n  /**\n   * Represents a K8s Ingress resource.\n   * Ingress exposes HTTP and HTTPS routes from outside the cluster to services within the cluster.\n   * @see {@link https://kubernetes.io/docs/concepts/services-networking/ingress/}\n   */\n  V1Ingress: {\n    kind: \"Ingress\",\n    version: \"v1\",\n    group: \"networking.k8s.io\",\n    plural: \"ingresses\",\n  },\n\n  /**\n   * Represents a K8s NetworkPolicy resource.\n   * NetworkPolicy defines a set of rules for how pods communicate with each other.\n   * @see {@link https://kubernetes.io/docs/concepts/services-networking/network-policies/}\n   */\n  V1NetworkPolicy: {\n    kind: \"NetworkPolicy\",\n    version: \"v1\",\n    group: \"networking.k8s.io\",\n  },\n\n  /**\n   * Represents a K8s RuntimeClass resource.\n   * RuntimeClass is a cluster-scoped resource that surfaces container runtime properties to the control plane.\n   * @see {@link https://kubernetes.io/docs/concepts/containers/runtime-class/}\n   */\n  V1RuntimeClass: {\n    kind: \"RuntimeClass\",\n    version: \"v1\",\n    group: \"node.k8s.io\",\n  },\n\n  /**\n   * Represents a K8s PodDisruptionBudget resource.\n   * PodDisruptionBudget is an API object that limits the number of pods of a replicated application that are down simultaneously.\n   * @see {@link https://kubernetes.io/docs/concepts/workloads/pods/disruptions/}\n   */\n  V1PodDisruptionBudget: {\n    kind: \"PodDisruptionBudget\",\n    version: \"v1\",\n    group: \"policy\",\n  },\n\n  /**\n   * Represents a K8s VolumeAttachment resource.\n   * VolumeAttachment captures the intent to attach or detach the specified volume to/from the specified node.\n   * @see {@link https://kubernetes.io/docs/concepts/storage/storage-classes/}\n   */\n  V1VolumeAttachment: {\n    kind: \"VolumeAttachment\",\n    version: \"v1\",\n    group: \"storage.k8s.io\",\n  },\n\n  /**\n   * Represents a K8s CSIDriver resource.\n   * CSIDriver captures information about a Container Storage Interface (CSI) volume driver.\n   * @see {@link https://kubernetes.io/docs/concepts/storage/volumes/}\n   */\n  V1CSIDriver: {\n    kind: \"CSIDriver\",\n    version: \"v1\",\n    group: \"storage.k8s.io\",\n  },\n\n  /**\n   * Represents a K8s CSIStorageCapacity resource.\n   * CSIStorageCapacity stores the reported storage capacity of a CSI node or storage class.\n   * @see {@link https://kubernetes.io/docs/concepts/storage/csi/}\n   */\n  V1CSIStorageCapacity: {\n    kind: \"CSIStorageCapacity\",\n    version: \"v1\",\n    group: \"storage.k8s.io\",\n  },\n\n  /**\n   * Represents a K8s StorageClass resource.\n   * StorageClass is a cluster-scoped resource that provides a way for administrators to describe the classes of storage they offer.\n   * @see {@link https://kubernetes.io/docs/concepts/storage/storage-classes/}\n   */\n  V1StorageClass: {\n    kind: \"StorageClass\",\n    version: \"v1\",\n    group: \"storage.k8s.io\",\n  },\n};\n\nexport function modelToGroupVersionKind(key: string): GroupVersionKind {\n  return gvkMap[key];\n}\n\n/**\n * Registers a new model and GroupVersionKind with Pepr for use with `When(a.<Kind>)`\n *\n * @param model Used to match the GroupVersionKind and define the type-data for the request\n * @param groupVersionKind Contains the match parameters to determine the request should be handled\n */\nexport const RegisterKind = (model: GenericClass, groupVersionKind: GroupVersionKind) => {\n  const name = model.name;\n\n  // Do not allow overwriting existing GVKs\n  if (gvkMap[name]) {\n    throw new Error(`GVK ${name} already registered`);\n  }\n\n  // Set the GVK\n  gvkMap[name] = groupVersionKind;\n};\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\n// Export kinds as a single object\nimport * as kind from \"./upstream\";\n/** a is a collection of K8s types to be used within a action: `When(a.Configmap)` */\nexport { kind as a };\n\nexport { modelToGroupVersionKind, gvkMap, RegisterKind } from \"./kinds\";\n\n// If the hostname is pepr-static-test-watcher-0, then we are running in watch mode\nexport const isWatchMode = process.env.PEPR_WATCH_MODE === \"true\";\n\nexport * from \"./types\";\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { pino } from \"pino\";\n\nconst isPrettyLog = process.env.PEPR_PRETTY_LOGS === \"true\";\n\nconst pretty = {\n  target: \"pino-pretty\",\n  options: {\n    colorize: true,\n  },\n};\n\nconst transport = isPrettyLog ? pretty : undefined;\n\nconst Log = pino({\n  transport,\n});\n\nif (process.env.LOG_LEVEL) {\n  Log.level = process.env.LOG_LEVEL;\n}\n\nexport default Log;\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { StatusCodes } from \"http-status-codes\";\nimport f, { FetchError, RequestInfo, RequestInit } from \"node-fetch\";\nimport logger from \"./logger\";\n\nexport const fetchRaw = f;\n\nexport type FetchResponse<T> = {\n  data: T;\n  ok: boolean;\n  status: number;\n  statusText: string;\n};\n\n/**\n * Perform an async HTTP call and return the parsed JSON response, optionally\n * as a specific type.\n *\n * @example\n * ```ts\n * fetch<string[]>(\"https://example.com/api/foo\");\n * ```\n *\n * @param url The URL or Request object to fetch\n * @param init Additional options for the request\n * @returns\n */\nexport async function fetch<T>(url: URL | RequestInfo, init?: RequestInit): Promise<FetchResponse<T>> {\n  let data = undefined as unknown as T;\n  try {\n    logger.debug(init, `Fetching ${url}`);\n\n    const resp = await fetchRaw(url, init);\n    const contentType = resp.headers.get(\"content-type\") || \"\";\n\n    if (resp.ok) {\n      // Parse the response as JSON if the content type is JSON\n      if (contentType.includes(\"application/json\")) {\n        data = await resp.json();\n      } else {\n        // Otherwise, return however the response was read\n        data = (await resp.text()) as unknown as T;\n      }\n    }\n\n    return {\n      data,\n      ok: resp.ok,\n      status: resp.status,\n      statusText: resp.statusText,\n    };\n  } catch (e) {\n    if (e instanceof FetchError) {\n      logger.debug(`Fetch failed: ${e instanceof Error ? e.message : e}`);\n\n      // Parse the error code from the FetchError or default to 400 (Bad Request)\n      const status = parseInt(e.code || \"400\");\n\n      return {\n        data,\n        ok: false,\n        status,\n        statusText: e.message,\n      };\n    }\n\n    return {\n      data,\n      ok: false,\n      status: StatusCodes.BAD_REQUEST,\n      statusText: \"Unknown error\",\n    };\n  }\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { clone } from \"ramda\";\n\nimport { Capability } from \"./capability\";\nimport { Controller } from \"./controller\";\nimport { MutateResponse, Request, ValidateResponse } from \"./k8s/types\";\nimport { ModuleConfig } from \"./types\";\n\nexport type PackageJSON = {\n  description: string;\n  pepr: ModuleConfig;\n};\n\nexport type PeprModuleOptions = {\n  deferStart?: boolean;\n\n  /** A user-defined callback to pre-process or intercept a Pepr request from K8s immediately before it is processed */\n  beforeHook?: (req: Request) => void;\n\n  /** A user-defined callback to post-process or intercept a Pepr response just before it is returned to K8s */\n  afterHook?: (res: MutateResponse | ValidateResponse) => void;\n};\n\nexport class PeprModule {\n  private _controller!: Controller;\n\n  /**\n   * Create a new Pepr runtime\n   *\n   * @param config The configuration for the Pepr runtime\n   * @param capabilities The capabilities to be loaded into the Pepr runtime\n   * @param _deferStart (optional) If set to `true`, the Pepr runtime will not be started automatically. This can be used to start the Pepr runtime manually with `start()`.\n   */\n  constructor({ description, pepr }: PackageJSON, capabilities: Capability[] = [], opts: PeprModuleOptions = {}) {\n    const config: ModuleConfig = clone(pepr);\n    config.description = description;\n\n    // Need to validate at runtime since TS gets sad about parsing the package.json\n    const validOnErrors = [\"ignore\", \"warn\", \"fail\"];\n    if (!validOnErrors.includes(config.onError || \"\")) {\n      throw new Error(`Invalid onErrors value: ${config.onError}`);\n    }\n\n    // Handle build mode\n    if (process.env.PEPR_MODE === \"build\" && process.send) {\n      // Send capability map to parent process\n      process.send(capabilities);\n      return;\n    }\n\n    this._controller = new Controller(config, capabilities, opts.beforeHook, opts.afterHook);\n\n    // Stop processing if deferStart is set to true\n    if (opts.deferStart) {\n      return;\n    }\n\n    this.start();\n  }\n\n  /**\n   * Start the Pepr runtime manually.\n   * Normally this is called automatically when the Pepr module is instantiated, but can be called manually if `deferStart` is set to `true` in the constructor.\n   *\n   * @param port\n   */\n  start(port = 3000) {\n    this._controller.startServer(port);\n  }\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport express, { NextFunction } from \"express\";\nimport fs from \"fs\";\nimport https from \"https\";\n\nimport { Capability } from \"./capability\";\nimport { isWatchMode } from \"./k8s\";\nimport { MutateResponse, Request, ValidateResponse } from \"./k8s/types\";\nimport Log from \"./logger\";\nimport { MetricsCollector } from \"./metrics\";\nimport { mutateProcessor } from \"./mutate-processor\";\nimport { ModuleConfig } from \"./types\";\nimport { validateProcessor } from \"./validate-processor\";\n\nexport class Controller {\n  private readonly _app = express();\n  private _running = false;\n  private metricsCollector = new MetricsCollector(\"pepr\");\n\n  // The token used to authenticate requests\n  private _token = \"\";\n\n  constructor(\n    private readonly _config: ModuleConfig,\n    private readonly _capabilities: Capability[],\n    private readonly _beforeHook?: (req: Request) => void,\n    private readonly _afterHook?: (res: MutateResponse) => void,\n  ) {\n    // Middleware for logging requests\n    this._app.use(this.logger);\n\n    // Middleware for parsing JSON, limit to 2mb vs 100K for K8s compatibility\n    this._app.use(express.json({ limit: \"2mb\" }));\n\n    if (_beforeHook) {\n      Log.info(`Using beforeHook: ${_beforeHook}`);\n    }\n\n    if (_afterHook) {\n      Log.info(`Using afterHook: ${_afterHook}`);\n    }\n\n    // Bind endpoints\n    this.bindEndpoints();\n  }\n\n  private bindEndpoints = () => {\n    // Health check endpoint\n    this._app.get(\"/healthz\", this.healthz);\n\n    // Metrics endpoint\n    this._app.get(\"/metrics\", this.metrics);\n\n    if (isWatchMode) {\n      return;\n    }\n\n    // Require auth for webhook endpoints\n    this._app.use([\"/mutate/:token\", \"/validate/:token\"], this.validateToken);\n\n    // Mutate endpoint\n    this._app.post(\"/mutate/:token\", this.admissionReq(\"Mutate\"));\n\n    // Validate endpoint\n    this._app.post(\"/validate/:token\", this.admissionReq(\"Validate\"));\n  };\n\n  /** Start the webhook server */\n  public startServer = (port: number) => {\n    if (this._running) {\n      throw new Error(\"Cannot start Pepr module: Pepr module was not instantiated with deferStart=true\");\n    }\n\n    // Load SSL certificate and key\n    const options = {\n      key: fs.readFileSync(process.env.SSL_KEY_PATH || \"/etc/certs/tls.key\"),\n      cert: fs.readFileSync(process.env.SSL_CERT_PATH || \"/etc/certs/tls.crt\"),\n    };\n\n    // Get the API token if not in watch mode\n    if (!isWatchMode) {\n      // Get the API token from the environment variable or the mounted secret\n      this._token = process.env.PEPR_API_TOKEN || fs.readFileSync(\"/app/api-token/value\").toString().trim();\n      Log.info(`Using API token: ${this._token}`);\n\n      if (!this._token) {\n        throw new Error(\"API token not found\");\n      }\n    }\n\n    // Create HTTPS server\n    const server = https.createServer(options, this._app).listen(port);\n\n    // Handle server listening event\n    server.on(\"listening\", () => {\n      Log.info(`Server listening on port ${port}`);\n      // Track that the server is running\n      this._running = true;\n    });\n\n    // Handle EADDRINUSE errors\n    server.on(\"error\", (e: { code: string }) => {\n      if (e.code === \"EADDRINUSE\") {\n        Log.warn(\n          `Address in use, retrying in 2 seconds. If this persists, ensure ${port} is not in use, e.g. \"lsof -i :${port}\"`,\n        );\n        setTimeout(() => {\n          server.close();\n          server.listen(port);\n        }, 2000);\n      }\n    });\n\n    // Listen for the SIGTERM signal and gracefully close the server\n    process.on(\"SIGTERM\", () => {\n      Log.info(\"Received SIGTERM, closing server\");\n      server.close(() => {\n        Log.info(\"Server closed\");\n        process.exit(0);\n      });\n    });\n  };\n\n  /**\n   * Middleware for logging requests\n   *\n   * @param req the incoming request\n   * @param res the outgoing response\n   * @param next the next middleware function\n   */\n  private logger = (req: express.Request, res: express.Response, next: express.NextFunction) => {\n    const startTime = Date.now();\n\n    res.on(\"finish\", () => {\n      const elapsedTime = Date.now() - startTime;\n      const message = {\n        uid: req.body?.request?.uid,\n        method: req.method,\n        url: req.originalUrl,\n        status: res.statusCode,\n        duration: `${elapsedTime} ms`,\n      };\n\n      res.statusCode >= 300 ? Log.warn(message) : Log.info(message);\n    });\n\n    next();\n  };\n\n  /**\n   * Validate the token in the request path\n   *\n   * @param req The incoming request\n   * @param res The outgoing response\n   * @param next The next middleware function\n   * @returns\n   */\n  private validateToken = (req: express.Request, res: express.Response, next: NextFunction) => {\n    // Validate the token\n    const { token } = req.params;\n    if (token !== this._token) {\n      const err = `Unauthorized: invalid token '${token.replace(/[^\\w]/g, \"_\")}'`;\n      Log.warn(err);\n      res.status(401).send(err);\n      this.metricsCollector.alert();\n      return;\n    }\n\n    // Token is valid, continue\n    next();\n  };\n\n  /**\n   * Health check endpoint handler\n   *\n   * @param req the incoming request\n   * @param res the outgoing response\n   */\n  private healthz = (req: express.Request, res: express.Response) => {\n    try {\n      res.send(\"OK\");\n    } catch (err) {\n      Log.error(err);\n      res.status(500).send(\"Internal Server Error\");\n    }\n  };\n\n  /**\n   * Metrics endpoint handler\n   *\n   * @param req the incoming request\n   * @param res the outgoing response\n   */\n  private metrics = async (req: express.Request, res: express.Response) => {\n    try {\n      res.send(await this.metricsCollector.getMetrics());\n    } catch (err) {\n      Log.error(err);\n      res.status(500).send(\"Internal Server Error\");\n    }\n  };\n\n  /**\n   * Admission request handler for both mutate and validate requests\n   *\n   * @param admissionKind the type of admission request\n   * @returns the request handler\n   */\n  private admissionReq = (admissionKind: \"Mutate\" | \"Validate\") => {\n    // Create the admission request handler\n    return async (req: express.Request, res: express.Response) => {\n      // Start the metrics timer\n      const startTime = this.metricsCollector.observeStart();\n\n      try {\n        // Get the request from the body or create an empty request\n        const request: Request = req.body?.request || ({} as Request);\n\n        // Run the before hook if it exists\n        this._beforeHook && this._beforeHook(request || {});\n\n        // Setup identifiers for logging\n        const name = request?.name ? `/${request.name}` : \"\";\n        const namespace = request?.namespace || \"\";\n        const gvk = request?.kind || { group: \"\", version: \"\", kind: \"\" };\n\n        const reqMetadata = {\n          uid: request.uid,\n          namespace,\n          name,\n        };\n\n        Log.info({ ...reqMetadata, gvk, operation: request.operation, admissionKind }, \"Incoming request\");\n        Log.debug({ ...reqMetadata, request }, \"Incoming request body\");\n\n        // Process the request\n        let response: MutateResponse | ValidateResponse;\n\n        // Call mutate or validate based on the admission kind\n        if (admissionKind === \"Mutate\") {\n          response = await mutateProcessor(this._config, this._capabilities, request, reqMetadata);\n        } else {\n          response = await validateProcessor(this._capabilities, request, reqMetadata);\n        }\n\n        // Run the after hook if it exists\n        this._afterHook && this._afterHook(response);\n\n        // Log the response\n        Log.debug({ ...reqMetadata, response }, \"Outgoing response\");\n\n        // Send a no prob bob response\n        res.send({\n          apiVersion: \"admission.k8s.io/v1\",\n          kind: \"AdmissionReview\",\n          response,\n        });\n        this.metricsCollector.observeEnd(startTime, admissionKind);\n      } catch (err) {\n        Log.error(err);\n        res.status(500).send(\"Internal Server Error\");\n        this.metricsCollector.error();\n      }\n    };\n  };\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport promClient, { Counter, Summary, Registry } from \"prom-client\";\nimport { performance } from \"perf_hooks\";\nimport Log from \"./logger\";\n\nconst loggingPrefix = \"MetricsCollector\";\n\ninterface MetricNames {\n  errors: string;\n  alerts: string;\n  mutate: string;\n  validate: string;\n}\n\ninterface MetricArgs {\n  name: string;\n  help: string;\n  registers: Registry[];\n}\n\n/**\n * MetricsCollector class handles metrics collection using prom-client and performance hooks.\n */\nexport class MetricsCollector {\n  private _registry: Registry;\n  private _counters: Map<string, Counter<string>> = new Map();\n  private _summaries: Map<string, Summary<string>> = new Map();\n  private _prefix: string;\n\n  private _metricNames: MetricNames = {\n    errors: \"errors\",\n    alerts: \"alerts\",\n    mutate: \"Mutate\",\n    validate: \"Validate\",\n  };\n\n  /**\n   * Creates a MetricsCollector instance with prefixed metrics.\n   * @param {string} [prefix='pepr'] - The prefix for the metric names.\n   */\n  constructor(prefix = \"pepr\") {\n    this._registry = new Registry();\n    this._prefix = prefix;\n    this.addCounter(this._metricNames.errors, \"Mutation/Validate errors encountered\");\n    this.addCounter(this._metricNames.alerts, \"Mutation/Validate bad api token received\");\n    this.addSummary(this._metricNames.mutate, \"Mutation operation summary\");\n    this.addSummary(this._metricNames.validate, \"Validation operation summary\");\n  }\n  private getMetricName(name: string) {\n    return `${this._prefix}_${name}`;\n  }\n\n  private addMetric<T extends Counter<string> | Summary<string>>(\n    collection: Map<string, T>,\n    MetricType: new (args: MetricArgs) => T,\n    name: string,\n    help: string,\n  ) {\n    if (collection.has(this.getMetricName(name))) {\n      Log.debug(`Metric for ${name} already exists`, loggingPrefix);\n      return;\n    }\n    const metric = new MetricType({\n      name: this.getMetricName(name),\n      help,\n      registers: [this._registry],\n    });\n    collection.set(this.getMetricName(name), metric);\n  }\n\n  addCounter(name: string, help: string) {\n    this.addMetric(this._counters, promClient.Counter, name, help);\n  }\n\n  addSummary(name: string, help: string) {\n    this.addMetric(this._summaries, promClient.Summary, name, help);\n  }\n\n  incCounter(name: string) {\n    this._counters.get(this.getMetricName(name))?.inc();\n  }\n\n  /**\n   * Increments the error counter.\n   */\n  error() {\n    this.incCounter(this._metricNames.errors);\n  }\n\n  /**\n   * Increments the alerts counter.\n   */\n  alert() {\n    this.incCounter(this._metricNames.alerts);\n  }\n\n  /**\n   * Returns the current timestamp from performance.now() method. Useful for start timing an operation.\n   * @returns {number} The timestamp.\n   */\n  observeStart() {\n    return performance.now();\n  }\n\n  /**\n   * Observes the duration since the provided start time and updates the summary.\n   * @param {number} startTime - The start time.\n   * @param {string} name - The metrics summary to increment.\n   */\n  observeEnd(startTime: number, name: string = this._metricNames.mutate) {\n    this._summaries.get(this.getMetricName(name))?.observe(performance.now() - startTime);\n  }\n\n  /**\n   * Fetches the current metrics from the registry.\n   * @returns {Promise<string>} The metrics.\n   */\n  async getMetrics() {\n    return this._registry.metrics();\n  }\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport jsonPatch from \"fast-json-patch\";\n\nimport { Capability } from \"./capability\";\nimport { shouldSkipRequest } from \"./filter\";\nimport { MutateResponse, Request } from \"./k8s/types\";\nimport { Secret } from \"./k8s/upstream\";\nimport Log from \"./logger\";\nimport { PeprMutateRequest } from \"./mutate-request\";\nimport { ModuleConfig } from \"./types\";\nimport { base64Encode, convertFromBase64Map, convertToBase64Map } from \"./utils\";\n\nexport async function mutateProcessor(\n  config: ModuleConfig,\n  capabilities: Capability[],\n  req: Request,\n  reqMetadata: Record<string, string>,\n): Promise<MutateResponse> {\n  const wrapped = new PeprMutateRequest(req);\n  const response: MutateResponse = {\n    uid: req.uid,\n    warnings: [],\n    allowed: false,\n  };\n\n  // Track whether any capability matched the request\n  let matchedAction = false;\n\n  // Track data fields that should be skipped during decoding\n  let skipDecode: string[] = [];\n\n  // If the resource is a secret, decode the data\n  const isSecret = req.kind.version == \"v1\" && req.kind.kind == \"Secret\";\n  if (isSecret) {\n    skipDecode = convertFromBase64Map(wrapped.Raw as unknown as Secret);\n  }\n\n  Log.info(reqMetadata, `Processing request`);\n\n  for (const { name, bindings } of capabilities) {\n    const actionMetadata = { ...reqMetadata, name };\n\n    for (const action of bindings) {\n      // Skip this action if it's not a mutate action\n      if (!action.mutateCallback) {\n        continue;\n      }\n\n      // Continue to the next action without doing anything if this one should be skipped\n      if (shouldSkipRequest(action, req)) {\n        continue;\n      }\n\n      const label = action.mutateCallback.name;\n      Log.info(actionMetadata, `Processing matched action ${label}`);\n\n      matchedAction = true;\n\n      // Add annotations to the request to indicate that the capability started processing\n      // this will allow tracking of failed mutations that were permitted to continue\n      const updateStatus = (status: string) => {\n        // Only update the status if the request is a CREATE or UPDATE (we don't use CONNECT)\n        if (req.operation == \"DELETE\") {\n          return;\n        }\n\n        const identifier = `${config.uuid}.pepr.dev/${name}`;\n        wrapped.Raw.metadata = wrapped.Raw.metadata || {};\n        wrapped.Raw.metadata.annotations = wrapped.Raw.metadata.annotations || {};\n        wrapped.Raw.metadata.annotations[identifier] = status;\n      };\n\n      updateStatus(\"started\");\n\n      try {\n        // Run the action\n        await action.mutateCallback(wrapped);\n\n        Log.info(actionMetadata, `Action succeeded`);\n\n        // Add annotations to the request to indicate that the capability succeeded\n        updateStatus(\"succeeded\");\n      } catch (e) {\n        Log.warn(actionMetadata, `Action failed: ${e}`);\n        updateStatus(\"warning\");\n\n        // Annoying ts false positive\n        response.warnings = response.warnings || [];\n        response.warnings.push(`Action failed: ${e}`);\n\n        switch (config.onError) {\n          case \"reject\":\n            Log.error(actionMetadata, `Action failed: ${e}`);\n            response.result = \"Pepr module configured to reject on error\";\n            return response;\n\n          case \"audit\":\n            // @todo: implement audit logging\n            break;\n        }\n      }\n    }\n  }\n\n  // If we've made it this far, the request is allowed\n  response.allowed = true;\n\n  // If no capability matched the request, exit early\n  if (!matchedAction) {\n    Log.info(reqMetadata, `No matching actions found`);\n    return response;\n  }\n\n  // delete operations can't be mutate, just return before the transformation\n  if (req.operation == \"DELETE\") {\n    return response;\n  }\n\n  const transformed = wrapped.Raw;\n\n  // Post-process the Secret requests to convert it back to the original format\n  if (isSecret) {\n    convertToBase64Map(transformed as unknown as Secret, skipDecode);\n  }\n\n  // Compare the original request to the modified request to get the patches\n  const patches = jsonPatch.compare(req.object, transformed);\n\n  // Only add the patch if there are patches to apply\n  if (patches.length > 0) {\n    response.patchType = \"JSONPatch\";\n    // Webhook must be base64-encoded\n    // https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#response\n    response.patch = base64Encode(JSON.stringify(patches));\n  }\n\n  // Remove the warnings array if it's empty\n  if (response.warnings && response.warnings.length < 1) {\n    delete response.warnings;\n  }\n\n  Log.debug({ ...reqMetadata, patches }, `Patches generated`);\n\n  return response;\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { Operation, Request } from \"./k8s/types\";\nimport logger from \"./logger\";\nimport { Binding, Event } from \"./types\";\n\n/**\n * shouldSkipRequest determines if a request should be skipped based on the binding filters.\n *\n * @param binding the action binding\n * @param req the incoming request\n * @returns\n */\nexport function shouldSkipRequest(binding: Binding, req: Request) {\n  const { group, kind, version } = binding.kind || {};\n  const { namespaces, labels, annotations, name } = binding.filters || {};\n  const operation = req.operation.toUpperCase();\n  // Use the old object if the request is a DELETE operation\n  const srcObject = operation === Operation.DELETE ? req.oldObject : req.object;\n  const { metadata } = srcObject || {};\n\n  // Test for matching operation\n  if (!binding.event.includes(operation) && !binding.event.includes(Event.Any)) {\n    return true;\n  }\n\n  // Test name first, since it's the most specific\n  if (name && name !== req.name) {\n    return true;\n  }\n\n  // Test for matching kinds\n  if (kind !== req.kind.kind) {\n    return true;\n  }\n\n  // Test for matching groups\n  if (group && group !== req.kind.group) {\n    return true;\n  }\n\n  // Test for matching versions\n  if (version && version !== req.kind.version) {\n    return true;\n  }\n\n  // Test for matching namespaces\n  if (namespaces.length && !namespaces.includes(req.namespace || \"\")) {\n    logger.debug(\"Namespace does not match\");\n    return true;\n  }\n\n  // Test for matching labels\n  for (const [key, value] of Object.entries(labels)) {\n    const testKey = metadata?.labels?.[key];\n\n    // First check if the label exists\n    if (!testKey) {\n      logger.debug(`Label ${key} does not exist`);\n      return true;\n    }\n\n    // Then check if the value matches, if specified\n    if (value && testKey !== value) {\n      logger.debug(`${testKey} does not match ${value}`);\n      return true;\n    }\n  }\n\n  // Test for matching annotations\n  for (const [key, value] of Object.entries(annotations)) {\n    const testKey = metadata?.annotations?.[key];\n\n    // First check if the annotation exists\n    if (!testKey) {\n      logger.debug(`Annotation ${key} does not exist`);\n      return true;\n    }\n\n    // Then check if the value matches, if specified\n    if (value && testKey !== value) {\n      logger.debug(`${testKey} does not match ${value}`);\n      return true;\n    }\n  }\n\n  // No failed filters, so we should not skip this request\n  return false;\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { clone, mergeDeepRight } from \"ramda\";\n\nimport { KubernetesObject, Operation, Request } from \"./k8s/types\";\nimport { DeepPartial } from \"./types\";\n\n/**\n * The RequestWrapper class provides methods to modify Kubernetes objects in the context\n * of a mutating webhook request.\n */\nexport class PeprMutateRequest<T extends KubernetesObject> {\n  public Raw: T;\n\n  get PermitSideEffects() {\n    return !this._input.dryRun;\n  }\n\n  /**\n   * Indicates whether the request is a dry run.\n   * @returns true if the request is a dry run, false otherwise.\n   */\n  get IsDryRun() {\n    return this._input.dryRun;\n  }\n\n  /**\n   * Provides access to the old resource in the request if available.\n   * @returns The old Kubernetes resource object or null if not available.\n   */\n  get OldResource() {\n    return this._input.oldObject;\n  }\n\n  /**\n   * Provides access to the request object.\n   * @returns The request object containing the Kubernetes resource.\n   */\n  get Request() {\n    return this._input;\n  }\n\n  /**\n   * Creates a new instance of the action class.\n   * @param input - The request object containing the Kubernetes resource to modify.\n   */\n  constructor(private _input: Request<T>) {\n    // If this is a DELETE operation, use the oldObject instead\n    if (_input.operation.toUpperCase() === Operation.DELETE) {\n      this.Raw = clone(_input.oldObject as T);\n    } else {\n      // Otherwise, use the incoming object\n      this.Raw = clone(_input.object);\n    }\n\n    if (!this.Raw) {\n      throw new Error(\"unable to load the request object into PeprRequest.RawP\");\n    }\n  }\n\n  /**\n   * Deep merges the provided object with the current resource.\n   *\n   * @param obj - The object to merge with the current resource.\n   */\n  Merge(obj: DeepPartial<T>) {\n    this.Raw = mergeDeepRight(this.Raw, obj) as unknown as T;\n  }\n\n  /**\n   * Updates a label on the Kubernetes resource.\n   * @param key - The key of the label to update.\n   * @param value - The value of the label.\n   * @returns The current action instance for method chaining.\n   */\n  SetLabel(key: string, value: string) {\n    const ref = this.Raw;\n\n    ref.metadata = ref.metadata ?? {};\n    ref.metadata.labels = ref.metadata.labels ?? {};\n    ref.metadata.labels[key] = value;\n\n    return this;\n  }\n\n  /**\n   * Updates an annotation on the Kubernetes resource.\n   * @param key - The key of the annotation to update.\n   * @param value - The value of the annotation.\n   * @returns The current action instance for method chaining.\n   */\n  SetAnnotation(key: string, value: string) {\n    const ref = this.Raw;\n\n    ref.metadata = ref.metadata ?? {};\n    ref.metadata.annotations = ref.metadata.annotations ?? {};\n    ref.metadata.annotations[key] = value;\n\n    return this;\n  }\n\n  /**\n   * Removes a label from the Kubernetes resource.\n   * @param key - The key of the label to remove.\n   * @returns The current Action instance for method chaining.\n   */\n  RemoveLabel(key: string) {\n    if (this.Raw.metadata?.labels?.[key]) {\n      delete this.Raw.metadata.labels[key];\n    }\n\n    return this;\n  }\n\n  /**\n   * Removes an annotation from the Kubernetes resource.\n   * @param key - The key of the annotation to remove.\n   * @returns The current Action instance for method chaining.\n   */\n  RemoveAnnotation(key: string) {\n    if (this.Raw.metadata?.annotations?.[key]) {\n      delete this.Raw.metadata.annotations[key];\n    }\n\n    return this;\n  }\n\n  /**\n   * Check if a label exists on the Kubernetes resource.\n   *\n   * @param key the label key to check\n   * @returns\n   */\n  HasLabel(key: string) {\n    return this.Raw.metadata?.labels?.[key] !== undefined;\n  }\n\n  /**\n   * Check if an annotation exists on the Kubernetes resource.\n   *\n   * @param key the annotation key to check\n   * @returns\n   */\n  HasAnnotation(key: string) {\n    return this.Raw.metadata?.annotations?.[key] !== undefined;\n  }\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport Log from \"./logger\";\n\n/** Test if a string is ascii or not */\nexport const isAscii = /^[\\s\\x20-\\x7E]*$/;\n\n/**\n * Encode all ascii values in a map to base64\n * @param obj The object to encode\n * @param skip A list of keys to skip encoding\n */\nexport function convertToBase64Map(obj: { data?: Record<string, string> }, skip: string[]) {\n  obj.data = obj.data ?? {};\n  for (const key in obj.data) {\n    const value = obj.data[key];\n    // Only encode ascii values\n    obj.data[key] = skip.includes(key) ? value : base64Encode(value);\n  }\n}\n\n/**\n * Decode all ascii values in a map from base64 to utf-8\n * @param obj The object to decode\n * @returns A list of keys that were skipped\n */\nexport function convertFromBase64Map(obj: { data?: Record<string, string> }) {\n  const skip: string[] = [];\n\n  obj.data = obj.data ?? {};\n  for (const key in obj.data) {\n    if (obj.data[key] == undefined) {\n      obj.data[key] = \"\";\n    } else {\n      const decoded = base64Decode(obj.data[key]);\n      if (isAscii.test(decoded)) {\n        // Only decode ascii values\n        obj.data[key] = decoded;\n      } else {\n        skip.push(key);\n      }\n    }\n  }\n  Log.debug(`Non-ascii data detected in keys: ${skip}, skipping automatic base64 decoding`);\n  return skip;\n}\n\n/** Decode a base64 string */\nexport function base64Decode(data: string) {\n  return Buffer.from(data, \"base64\").toString(\"utf-8\");\n}\n\n/** Encode a string to base64 */\nexport function base64Encode(data: string) {\n  return Buffer.from(data).toString(\"base64\");\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { clone } from \"ramda\";\nimport { KubernetesObject, Operation, Request } from \"./k8s/types\";\nimport { ValidateResponse } from \"./types\";\n\n/**\n * The RequestWrapper class provides methods to modify Kubernetes objects in the context\n * of a mutating webhook request.\n */\nexport class PeprValidateRequest<T extends KubernetesObject> {\n  public Raw: T;\n\n  /**\n   * Provides access to the old resource in the request if available.\n   * @returns The old Kubernetes resource object or null if not available.\n   */\n  get OldResource() {\n    return this._input.oldObject;\n  }\n\n  /**\n   * Provides access to the request object.\n   * @returns The request object containing the Kubernetes resource.\n   */\n  get Request() {\n    return this._input;\n  }\n\n  /**\n   * Creates a new instance of the Action class.\n   * @param input - The request object containing the Kubernetes resource to modify.\n   */\n  constructor(protected _input: Request<T>) {\n    // If this is a DELETE operation, use the oldObject instead\n    if (_input.operation.toUpperCase() === Operation.DELETE) {\n      this.Raw = clone(_input.oldObject as T);\n    } else {\n      // Otherwise, use the incoming object\n      this.Raw = clone(_input.object);\n    }\n\n    if (!this.Raw) {\n      throw new Error(\"unable to load the request object into PeprRequest.RawP\");\n    }\n  }\n\n  /**\n   * Check if a label exists on the Kubernetes resource.\n   *\n   * @param key the label key to check\n   * @returns\n   */\n  HasLabel(key: string) {\n    return this.Raw.metadata?.labels?.[key] !== undefined;\n  }\n\n  /**\n   * Check if an annotation exists on the Kubernetes resource.\n   *\n   * @param key the annotation key to check\n   * @returns\n   */\n  HasAnnotation(key: string) {\n    return this.Raw.metadata?.annotations?.[key] !== undefined;\n  }\n\n  /**\n   * Create a validation response that allows the request.\n   *\n   * @returns The validation response.\n   */\n  Approve(): ValidateResponse {\n    return {\n      allowed: true,\n    };\n  }\n\n  /**\n   * Create a validation response that denies the request.\n   *\n   * @param statusMessage Optional status message to return to the user.\n   * @param statusCode Optional status code to return to the user.\n   * @returns The validation response.\n   */\n  Deny(statusMessage?: string, statusCode?: number): ValidateResponse {\n    return {\n      allowed: false,\n      statusCode,\n      statusMessage,\n    };\n  }\n}\n", "// SPDX-License-Identifier: Apache-2.0\n// SPDX-FileCopyrightText: 2023-Present The Pepr Authors\n\nimport { Capability } from \"./capability\";\nimport { shouldSkipRequest } from \"./filter\";\nimport { Request, ValidateResponse } from \"./k8s/types\";\nimport Log from \"./logger\";\nimport { PeprValidateRequest } from \"./validate-request\";\n\nexport async function validateProcessor(\n  capabilities: Capability[],\n  req: Request,\n  reqMetadata: Record<string, string>,\n): Promise<ValidateResponse> {\n  const wrapped = new PeprValidateRequest(req);\n  const response: ValidateResponse = {\n    uid: req.uid,\n    allowed: true, // Assume it's allowed until a validation check fails\n  };\n\n  Log.info(reqMetadata, `Processing validation request`);\n\n  for (const { name, bindings } of capabilities) {\n    const actionMetadata = { ...reqMetadata, name };\n\n    for (const action of bindings) {\n      // Skip this action if it's not a validation action\n      if (!action.validateCallback) {\n        continue;\n      }\n\n      // Continue to the next action without doing anything if this one should be skipped\n      if (shouldSkipRequest(action, req)) {\n        continue;\n      }\n\n      const label = action.validateCallback.name;\n      Log.info(actionMetadata, `Processing matched action ${label}`);\n\n      try {\n        // Run the validation callback, if it fails set allowed to false\n        const resp = await action.validateCallback(wrapped);\n        response.allowed = resp.allowed;\n\n        // If the validation callback returned a status code or message, set it in the Response\n        if (resp.statusCode || resp.statusMessage) {\n          response.status = {\n            code: resp.statusCode || 400,\n            message: resp.statusMessage || `Validation failed for ${name}`,\n          };\n        }\n\n        Log.info(actionMetadata, `Validation Action completed: ${resp.allowed ? \"allowed\" : \"denied\"}`);\n      } catch (e) {\n        // If any validation throws an error, note the failure in the Response\n        Log.error(actionMetadata, `Action failed: ${e}`);\n        response.allowed = false;\n        response.status = {\n          code: 500,\n          message: `Action failed with error: ${e}`,\n        };\n        return response;\n      }\n    }\n  }\n\n  return response;\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,+CAAAA;AAAA,EAAA;AAAA;AAAA;AAAA,UAAqB;AACrB,IAAAC,4BAA2C;AAC3C,QAAmB;;;ACCnB,mBAAuB;;;ACHvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,IAAAC,sBA8CO;;;AC/CP,yBAAqE;AAgB9D,IAAM,cAAN,MAAkB;AAAA,EACvB;AAAA,EACA;AAAA,EACA;AAGF;;;ACnBO,IAAM,SAA2C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtD,eAAe;AAAA,IACb,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,sBAAsB;AAAA,IACpB,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,QAAQ;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,eAAe;AAAA,IACb,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAa;AAAA,IACX,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,YAAY;AAAA,IACV,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,IACP,QAAQ;AAAA,EACV;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,cAAc;AAAA,IACZ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,aAAa;AAAA,IACX,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,QAAQ;AAAA,IACN,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,yBAAyB;AAAA,IACvB,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,oBAAoB;AAAA,IAClB,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,eAAe;AAAA,IACb,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,yBAAyB;AAAA,IACvB,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,iBAAiB;AAAA,IACf,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,UAAU;AAAA,IACR,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,kBAAkB;AAAA,IAChB,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,WAAW;AAAA,IACT,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,gCAAgC;AAAA,IAC9B,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,kCAAkC;AAAA,IAChC,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,4BAA4B;AAAA,IAC1B,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,cAAc;AAAA,IACZ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,sBAAsB;AAAA,IACpB,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,aAAa;AAAA,IACX,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,cAAc;AAAA,IACZ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,cAAc;AAAA,IACZ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,eAAe;AAAA,IACb,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,eAAe;AAAA,IACb,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,4BAA4B;AAAA,IAC1B,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,2BAA2B;AAAA,IACzB,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,0BAA0B;AAAA,IACxB,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,uBAAuB;AAAA,IACrB,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,2BAA2B;AAAA,IACzB,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,WAAW;AAAA,IACT,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,6BAA6B;AAAA,IAC3B,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,iBAAiB;AAAA,IACf,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,gBAAgB;AAAA,IACd,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,WAAW;AAAA,IACT,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,IACP,QAAQ;AAAA,EACV;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,iBAAiB;AAAA,IACf,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,gBAAgB;AAAA,IACd,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,uBAAuB;AAAA,IACrB,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,oBAAoB;AAAA,IAClB,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,aAAa;AAAA,IACX,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,sBAAsB;AAAA,IACpB,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,gBAAgB;AAAA,IACd,MAAM;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AACF;AAEO,SAAS,wBAAwB,KAA+B;AACrE,SAAO,OAAO,GAAG;AACnB;AAQO,IAAM,eAAe,CAAC,OAAqB,qBAAuC;AACvF,QAAM,OAAO,MAAM;AAGnB,MAAI,OAAO,IAAI,GAAG;AAChB,UAAM,IAAI,MAAM,OAAO,IAAI,qBAAqB;AAAA,EAClD;AAGA,SAAO,IAAI,IAAI;AACjB;;;ACvgBO,IAAM,cAAc,QAAQ,IAAI,oBAAoB;;;ACR3D,kBAAqB;AAErB,IAAM,cAAc,QAAQ,IAAI,qBAAqB;AAErD,IAAM,SAAS;AAAA,EACb,QAAQ;AAAA,EACR,SAAS;AAAA,IACP,UAAU;AAAA,EACZ;AACF;AAEA,IAAM,YAAY,cAAc,SAAS;AAEzC,IAAM,UAAM,kBAAK;AAAA,EACf;AACF,CAAC;AAED,IAAI,QAAQ,IAAI,WAAW;AACzB,MAAI,QAAQ,QAAQ,IAAI;AAC1B;AAEA,IAAO,iBAAQ;;;ALAR,IAAM,aAAN,MAA0C;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EAEA,YAAuB,CAAC;AAAA,EAEhC,IAAI,WAAsB;AACxB,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,IAAI,OAAO;AACT,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,IAAI,cAAc;AAChB,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,IAAI,aAAa;AACf,WAAO,KAAK,eAAe,CAAC;AAAA,EAC9B;AAAA,EAEA,YAAY,KAAoB;AAC9B,SAAK,QAAQ,IAAI;AACjB,SAAK,eAAe,IAAI;AACxB,SAAK,cAAc,IAAI;AAEvB,mBAAI,KAAK,cAAc,KAAK,KAAK,aAAa;AAC9C,mBAAI,MAAM,GAAG;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,OAAO,CAAyB,OAAU,SAA6C;AACrF,UAAM,cAAc,wBAAwB,MAAM,IAAI;AAGtD,QAAI,CAAC,eAAe,CAAC,MAAM;AACzB,YAAM,IAAI,MAAM,0BAA0B,MAAM,IAAI,EAAE;AAAA,IACxD;AAEA,UAAM,UAAmB;AAAA;AAAA,MAEvB,MAAM,QAAQ;AAAA,MACd;AAAA,MACA,SAAS;AAAA,QACP,MAAM;AAAA,QACN,YAAY,CAAC;AAAA,QACb,QAAQ,CAAC;AAAA,QACT,aAAa,CAAC;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,SAAS,GAAG,KAAK,KAAK,KAAK,MAAM,IAAI;AAE3C,UAAM,aAAa,CAAC,UAAkB,OAAO,KAAK,KAAK,EAAE,SAAS;AAClE,UAAM,MAAM,CAAC,SAAiB,aAAqB;AACjD,YAAM,kBAAc,qBAAO,YAAY,QAAQ,OAAO;AAEtD,qBAAI,KAAK,GAAG,OAAO,mBAAmB,QAAQ,KAAK,IAAI,MAAM;AAC7D,qBAAI,KAAK,aAAa,MAAM;AAC5B,qBAAI,MAAM,UAAU,MAAM;AAAA,IAC5B;AAEA,UAAM,WAAW,CAAC,qBAA8C;AAC9D,UAAI,CAAC,aAAa;AAChB,YAAI,mBAAmB,iBAAiB,SAAS,CAAC;AAIlD,aAAK,UAAU,KAAK;AAAA,UAClB,GAAG;AAAA,UACH,YAAY;AAAA,UACZ;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAEA,UAAM,SAAS,CAAC,mBAA0D;AACxE,UAAI,CAAC,aAAa;AAChB,YAAI,iBAAiB,eAAe,SAAS,CAAC;AAI9C,aAAK,UAAU,KAAK;AAAA,UAClB,GAAG;AAAA,UACH,UAAU;AAAA,UACV;AAAA,QACF,CAAC;AAAA,MACH;AAGA,aAAO,EAAE,SAAS;AAAA,IACpB;AAEA,aAAS,eAAe,YAA0C;AAChE,qBAAI,MAAM,yBAAyB,UAAU,IAAI,MAAM;AACvD,cAAQ,QAAQ,WAAW,KAAK,GAAG,UAAU;AAC7C,aAAO,EAAE,GAAG,aAAa,SAAS;AAAA,IACpC;AAEA,aAAS,SAAS,MAAgC;AAChD,qBAAI,MAAM,mBAAmB,IAAI,IAAI,MAAM;AAC3C,cAAQ,QAAQ,OAAO;AACvB,aAAO;AAAA,IACT;AAEA,aAAS,UAAU,KAAa,QAAQ,IAAsB;AAC5D,qBAAI,MAAM,oBAAoB,GAAG,IAAI,KAAK,IAAI,MAAM;AACpD,cAAQ,QAAQ,OAAO,GAAG,IAAI;AAC9B,aAAO;AAAA,IACT;AAEA,UAAM,iBAAiB,CAAC,KAAa,QAAQ,OAAyB;AACpE,qBAAI,MAAM,yBAAyB,GAAG,IAAI,KAAK,IAAI,MAAM;AACzD,cAAQ,QAAQ,YAAY,GAAG,IAAI;AACnC,aAAO;AAAA,IACT;AAEA,UAAM,cAAc,EAAE,WAAW,gBAAgB,QAAQ,SAAS;AAElE,UAAM,YAAY,CAAC,UAAiB;AAClC,cAAQ,QAAQ;AAChB,aAAO;AAAA,QACL,GAAG;AAAA,QACH;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL,oBAAoB,MAAM,+CAA8B;AAAA,MACxD,WAAW,MAAM,+BAAsB;AAAA,MACvC,WAAW,MAAM,+BAAsB;AAAA,MACvC,WAAW,MAAM,+BAAsB;AAAA,IACzC;AAAA,EACF;AACF;;;AMtKA,+BAA4B;AAC5B,wBAAwD;AAGjD,IAAM,WAAW,kBAAAC;AAsBxB,eAAsB,MAAS,KAAwB,MAA+C;AACpG,MAAI,OAAO;AACX,MAAI;AACF,mBAAO,MAAM,MAAM,YAAY,GAAG,EAAE;AAEpC,UAAM,OAAO,MAAM,SAAS,KAAK,IAAI;AACrC,UAAM,cAAc,KAAK,QAAQ,IAAI,cAAc,KAAK;AAExD,QAAI,KAAK,IAAI;AAEX,UAAI,YAAY,SAAS,kBAAkB,GAAG;AAC5C,eAAO,MAAM,KAAK,KAAK;AAAA,MACzB,OAAO;AAEL,eAAQ,MAAM,KAAK,KAAK;AAAA,MAC1B;AAAA,IACF;AAEA,WAAO;AAAA,MACL;AAAA,MACA,IAAI,KAAK;AAAA,MACT,QAAQ,KAAK;AAAA,MACb,YAAY,KAAK;AAAA,IACnB;AAAA,EACF,SAAS,GAAG;AACV,QAAI,aAAa,8BAAY;AAC3B,qBAAO,MAAM,iBAAiB,aAAa,QAAQ,EAAE,UAAU,CAAC,EAAE;AAGlE,YAAM,SAAS,SAAS,EAAE,QAAQ,KAAK;AAEvC,aAAO;AAAA,QACL;AAAA,QACA,IAAI;AAAA,QACJ;AAAA,QACA,YAAY,EAAE;AAAA,MAChB;AAAA,IACF;AAEA,WAAO;AAAA,MACL;AAAA,MACA,IAAI;AAAA,MACJ,QAAQ,qCAAY;AAAA,MACpB,YAAY;AAAA,IACd;AAAA,EACF;AACF;;;ACxEA,IAAAC,gBAAsB;;;ACAtB,qBAAsC;AACtC,gBAAe;AACf,mBAAkB;;;ACFlB,yBAAuD;AACvD,wBAA4B;AAG5B,IAAM,gBAAgB;AAkBf,IAAM,mBAAN,MAAuB;AAAA,EACpB;AAAA,EACA,YAA0C,oBAAI,IAAI;AAAA,EAClD,aAA2C,oBAAI,IAAI;AAAA,EACnD;AAAA,EAEA,eAA4B;AAAA,IAClC,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,UAAU;AAAA,EACZ;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,YAAY,SAAS,QAAQ;AAC3B,SAAK,YAAY,IAAI,4BAAS;AAC9B,SAAK,UAAU;AACf,SAAK,WAAW,KAAK,aAAa,QAAQ,sCAAsC;AAChF,SAAK,WAAW,KAAK,aAAa,QAAQ,0CAA0C;AACpF,SAAK,WAAW,KAAK,aAAa,QAAQ,4BAA4B;AACtE,SAAK,WAAW,KAAK,aAAa,UAAU,8BAA8B;AAAA,EAC5E;AAAA,EACQ,cAAc,MAAc;AAClC,WAAO,GAAG,KAAK,OAAO,IAAI,IAAI;AAAA,EAChC;AAAA,EAEQ,UACN,YACA,YACA,MACA,MACA;AACA,QAAI,WAAW,IAAI,KAAK,cAAc,IAAI,CAAC,GAAG;AAC5C,qBAAI,MAAM,cAAc,IAAI,mBAAmB,aAAa;AAC5D;AAAA,IACF;AACA,UAAM,SAAS,IAAI,WAAW;AAAA,MAC5B,MAAM,KAAK,cAAc,IAAI;AAAA,MAC7B;AAAA,MACA,WAAW,CAAC,KAAK,SAAS;AAAA,IAC5B,CAAC;AACD,eAAW,IAAI,KAAK,cAAc,IAAI,GAAG,MAAM;AAAA,EACjD;AAAA,EAEA,WAAW,MAAc,MAAc;AACrC,SAAK,UAAU,KAAK,WAAW,mBAAAC,QAAW,SAAS,MAAM,IAAI;AAAA,EAC/D;AAAA,EAEA,WAAW,MAAc,MAAc;AACrC,SAAK,UAAU,KAAK,YAAY,mBAAAA,QAAW,SAAS,MAAM,IAAI;AAAA,EAChE;AAAA,EAEA,WAAW,MAAc;AACvB,SAAK,UAAU,IAAI,KAAK,cAAc,IAAI,CAAC,GAAG,IAAI;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA,EAKA,QAAQ;AACN,SAAK,WAAW,KAAK,aAAa,MAAM;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA,EAKA,QAAQ;AACN,SAAK,WAAW,KAAK,aAAa,MAAM;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,eAAe;AACb,WAAO,8BAAY,IAAI;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,WAAW,WAAmB,OAAe,KAAK,aAAa,QAAQ;AACrE,SAAK,WAAW,IAAI,KAAK,cAAc,IAAI,CAAC,GAAG,QAAQ,8BAAY,IAAI,IAAI,SAAS;AAAA,EACtF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,aAAa;AACjB,WAAO,KAAK,UAAU,QAAQ;AAAA,EAChC;AACF;;;ACvHA,6BAAsB;;;ACWf,SAAS,kBAAkB,SAAkB,KAAc;AAChE,QAAM,EAAE,OAAO,MAAM,QAAQ,IAAI,QAAQ,QAAQ,CAAC;AAClD,QAAM,EAAE,YAAY,QAAQ,aAAa,KAAK,IAAI,QAAQ,WAAW,CAAC;AACtE,QAAM,YAAY,IAAI,UAAU,YAAY;AAE5C,QAAM,YAAY,sCAAiC,IAAI,YAAY,IAAI;AACvE,QAAM,EAAE,SAAS,IAAI,aAAa,CAAC;AAGnC,MAAI,CAAC,QAAQ,MAAM,SAAS,SAAS,KAAK,CAAC,QAAQ,MAAM,sBAAkB,GAAG;AAC5E,WAAO;AAAA,EACT;AAGA,MAAI,QAAQ,SAAS,IAAI,MAAM;AAC7B,WAAO;AAAA,EACT;AAGA,MAAI,SAAS,IAAI,KAAK,MAAM;AAC1B,WAAO;AAAA,EACT;AAGA,MAAI,SAAS,UAAU,IAAI,KAAK,OAAO;AACrC,WAAO;AAAA,EACT;AAGA,MAAI,WAAW,YAAY,IAAI,KAAK,SAAS;AAC3C,WAAO;AAAA,EACT;AAGA,MAAI,WAAW,UAAU,CAAC,WAAW,SAAS,IAAI,aAAa,EAAE,GAAG;AAClE,mBAAO,MAAM,0BAA0B;AACvC,WAAO;AAAA,EACT;AAGA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,UAAM,UAAU,UAAU,SAAS,GAAG;AAGtC,QAAI,CAAC,SAAS;AACZ,qBAAO,MAAM,SAAS,GAAG,iBAAiB;AAC1C,aAAO;AAAA,IACT;AAGA,QAAI,SAAS,YAAY,OAAO;AAC9B,qBAAO,MAAM,GAAG,OAAO,mBAAmB,KAAK,EAAE;AACjD,aAAO;AAAA,IACT;AAAA,EACF;AAGA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,WAAW,GAAG;AACtD,UAAM,UAAU,UAAU,cAAc,GAAG;AAG3C,QAAI,CAAC,SAAS;AACZ,qBAAO,MAAM,cAAc,GAAG,iBAAiB;AAC/C,aAAO;AAAA,IACT;AAGA,QAAI,SAAS,YAAY,OAAO;AAC9B,qBAAO,MAAM,GAAG,OAAO,mBAAmB,KAAK,EAAE;AACjD,aAAO;AAAA,IACT;AAAA,EACF;AAGA,SAAO;AACT;;;ACtFA,IAAAC,gBAAsC;AAS/B,IAAM,oBAAN,MAAoD;AAAA;AAAA;AAAA;AAAA;AAAA,EAmCzD,YAAoB,QAAoB;AAApB;AAElB,QAAI,OAAO,UAAU,YAAY,6BAAwB;AACvD,WAAK,UAAM,qBAAM,OAAO,SAAc;AAAA,IACxC,OAAO;AAEL,WAAK,UAAM,qBAAM,OAAO,MAAM;AAAA,IAChC;AAEA,QAAI,CAAC,KAAK,KAAK;AACb,YAAM,IAAI,MAAM,yDAAyD;AAAA,IAC3E;AAAA,EACF;AAAA,EA9CO;AAAA,EAEP,IAAI,oBAAoB;AACtB,WAAO,CAAC,KAAK,OAAO;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,WAAW;AACb,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,cAAc;AAChB,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,UAAU;AACZ,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAyBA,MAAM,KAAqB;AACzB,SAAK,UAAM,8BAAe,KAAK,KAAK,GAAG;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,SAAS,KAAa,OAAe;AACnC,UAAM,MAAM,KAAK;AAEjB,QAAI,WAAW,IAAI,YAAY,CAAC;AAChC,QAAI,SAAS,SAAS,IAAI,SAAS,UAAU,CAAC;AAC9C,QAAI,SAAS,OAAO,GAAG,IAAI;AAE3B,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,cAAc,KAAa,OAAe;AACxC,UAAM,MAAM,KAAK;AAEjB,QAAI,WAAW,IAAI,YAAY,CAAC;AAChC,QAAI,SAAS,cAAc,IAAI,SAAS,eAAe,CAAC;AACxD,QAAI,SAAS,YAAY,GAAG,IAAI;AAEhC,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,YAAY,KAAa;AACvB,QAAI,KAAK,IAAI,UAAU,SAAS,GAAG,GAAG;AACpC,aAAO,KAAK,IAAI,SAAS,OAAO,GAAG;AAAA,IACrC;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,iBAAiB,KAAa;AAC5B,QAAI,KAAK,IAAI,UAAU,cAAc,GAAG,GAAG;AACzC,aAAO,KAAK,IAAI,SAAS,YAAY,GAAG;AAAA,IAC1C;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,SAAS,KAAa;AACpB,WAAO,KAAK,IAAI,UAAU,SAAS,GAAG,MAAM;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,cAAc,KAAa;AACzB,WAAO,KAAK,IAAI,UAAU,cAAc,GAAG,MAAM;AAAA,EACnD;AACF;;;ACnJA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAMO,IAAM,UAAU;AAOhB,SAAS,mBAAmB,KAAwC,MAAgB;AACzF,MAAI,OAAO,IAAI,QAAQ,CAAC;AACxB,aAAW,OAAO,IAAI,MAAM;AAC1B,UAAM,QAAQ,IAAI,KAAK,GAAG;AAE1B,QAAI,KAAK,GAAG,IAAI,KAAK,SAAS,GAAG,IAAI,QAAQ,aAAa,KAAK;AAAA,EACjE;AACF;AAOO,SAAS,qBAAqB,KAAwC;AAC3E,QAAM,OAAiB,CAAC;AAExB,MAAI,OAAO,IAAI,QAAQ,CAAC;AACxB,aAAW,OAAO,IAAI,MAAM;AAC1B,QAAI,IAAI,KAAK,GAAG,KAAK,QAAW;AAC9B,UAAI,KAAK,GAAG,IAAI;AAAA,IAClB,OAAO;AACL,YAAM,UAAU,aAAa,IAAI,KAAK,GAAG,CAAC;AAC1C,UAAI,QAAQ,KAAK,OAAO,GAAG;AAEzB,YAAI,KAAK,GAAG,IAAI;AAAA,MAClB,OAAO;AACL,aAAK,KAAK,GAAG;AAAA,MACf;AAAA,IACF;AAAA,EACF;AACA,iBAAI,MAAM,oCAAoC,IAAI,sCAAsC;AACxF,SAAO;AACT;AAGO,SAAS,aAAa,MAAc;AACzC,SAAO,OAAO,KAAK,MAAM,QAAQ,EAAE,SAAS,OAAO;AACrD;AAGO,SAAS,aAAa,MAAc;AACzC,SAAO,OAAO,KAAK,IAAI,EAAE,SAAS,QAAQ;AAC5C;;;AH1CA,eAAsB,gBACpB,QACA,cACA,KACA,aACyB;AACzB,QAAM,UAAU,IAAI,kBAAkB,GAAG;AACzC,QAAM,WAA2B;AAAA,IAC/B,KAAK,IAAI;AAAA,IACT,UAAU,CAAC;AAAA,IACX,SAAS;AAAA,EACX;AAGA,MAAI,gBAAgB;AAGpB,MAAI,aAAuB,CAAC;AAG5B,QAAM,WAAW,IAAI,KAAK,WAAW,QAAQ,IAAI,KAAK,QAAQ;AAC9D,MAAI,UAAU;AACZ,iBAAa,qBAAqB,QAAQ,GAAwB;AAAA,EACpE;AAEA,iBAAI,KAAK,aAAa,oBAAoB;AAE1C,aAAW,EAAE,MAAM,SAAS,KAAK,cAAc;AAC7C,UAAM,iBAAiB,EAAE,GAAG,aAAa,KAAK;AAE9C,eAAW,UAAU,UAAU;AAE7B,UAAI,CAAC,OAAO,gBAAgB;AAC1B;AAAA,MACF;AAGA,UAAI,kBAAkB,QAAQ,GAAG,GAAG;AAClC;AAAA,MACF;AAEA,YAAM,QAAQ,OAAO,eAAe;AACpC,qBAAI,KAAK,gBAAgB,6BAA6B,KAAK,EAAE;AAE7D,sBAAgB;AAIhB,YAAM,eAAe,CAAC,WAAmB;AAEvC,YAAI,IAAI,aAAa,UAAU;AAC7B;AAAA,QACF;AAEA,cAAM,aAAa,GAAG,OAAO,IAAI,aAAa,IAAI;AAClD,gBAAQ,IAAI,WAAW,QAAQ,IAAI,YAAY,CAAC;AAChD,gBAAQ,IAAI,SAAS,cAAc,QAAQ,IAAI,SAAS,eAAe,CAAC;AACxE,gBAAQ,IAAI,SAAS,YAAY,UAAU,IAAI;AAAA,MACjD;AAEA,mBAAa,SAAS;AAEtB,UAAI;AAEF,cAAM,OAAO,eAAe,OAAO;AAEnC,uBAAI,KAAK,gBAAgB,kBAAkB;AAG3C,qBAAa,WAAW;AAAA,MAC1B,SAAS,GAAG;AACV,uBAAI,KAAK,gBAAgB,kBAAkB,CAAC,EAAE;AAC9C,qBAAa,SAAS;AAGtB,iBAAS,WAAW,SAAS,YAAY,CAAC;AAC1C,iBAAS,SAAS,KAAK,kBAAkB,CAAC,EAAE;AAE5C,gBAAQ,OAAO,SAAS;AAAA,UACtB,KAAK;AACH,2BAAI,MAAM,gBAAgB,kBAAkB,CAAC,EAAE;AAC/C,qBAAS,SAAS;AAClB,mBAAO;AAAA,UAET,KAAK;AAEH;AAAA,QACJ;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,WAAS,UAAU;AAGnB,MAAI,CAAC,eAAe;AAClB,mBAAI,KAAK,aAAa,2BAA2B;AACjD,WAAO;AAAA,EACT;AAGA,MAAI,IAAI,aAAa,UAAU;AAC7B,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,QAAQ;AAG5B,MAAI,UAAU;AACZ,uBAAmB,aAAkC,UAAU;AAAA,EACjE;AAGA,QAAM,UAAU,uBAAAC,QAAU,QAAQ,IAAI,QAAQ,WAAW;AAGzD,MAAI,QAAQ,SAAS,GAAG;AACtB,aAAS,YAAY;AAGrB,aAAS,QAAQ,aAAa,KAAK,UAAU,OAAO,CAAC;AAAA,EACvD;AAGA,MAAI,SAAS,YAAY,SAAS,SAAS,SAAS,GAAG;AACrD,WAAO,SAAS;AAAA,EAClB;AAEA,iBAAI,MAAM,EAAE,GAAG,aAAa,QAAQ,GAAG,mBAAmB;AAE1D,SAAO;AACT;;;AI/IA,IAAAC,gBAAsB;AAQf,IAAM,sBAAN,MAAsD;AAAA;AAAA;AAAA;AAAA;AAAA,EAuB3D,YAAsB,QAAoB;AAApB;AAEpB,QAAI,OAAO,UAAU,YAAY,6BAAwB;AACvD,WAAK,UAAM,qBAAM,OAAO,SAAc;AAAA,IACxC,OAAO;AAEL,WAAK,UAAM,qBAAM,OAAO,MAAM;AAAA,IAChC;AAEA,QAAI,CAAC,KAAK,KAAK;AACb,YAAM,IAAI,MAAM,yDAAyD;AAAA,IAC3E;AAAA,EACF;AAAA,EAlCO;AAAA;AAAA;AAAA;AAAA;AAAA,EAMP,IAAI,cAAc;AAChB,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,UAAU;AACZ,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA0BA,SAAS,KAAa;AACpB,WAAO,KAAK,IAAI,UAAU,SAAS,GAAG,MAAM;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,cAAc,KAAa;AACzB,WAAO,KAAK,IAAI,UAAU,cAAc,GAAG,MAAM;AAAA,EACnD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,UAA4B;AAC1B,WAAO;AAAA,MACL,SAAS;AAAA,IACX;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,KAAK,eAAwB,YAAuC;AAClE,WAAO;AAAA,MACL,SAAS;AAAA,MACT;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;;;ACpFA,eAAsB,kBACpB,cACA,KACA,aAC2B;AAC3B,QAAM,UAAU,IAAI,oBAAoB,GAAG;AAC3C,QAAM,WAA6B;AAAA,IACjC,KAAK,IAAI;AAAA,IACT,SAAS;AAAA;AAAA,EACX;AAEA,iBAAI,KAAK,aAAa,+BAA+B;AAErD,aAAW,EAAE,MAAM,SAAS,KAAK,cAAc;AAC7C,UAAM,iBAAiB,EAAE,GAAG,aAAa,KAAK;AAE9C,eAAW,UAAU,UAAU;AAE7B,UAAI,CAAC,OAAO,kBAAkB;AAC5B;AAAA,MACF;AAGA,UAAI,kBAAkB,QAAQ,GAAG,GAAG;AAClC;AAAA,MACF;AAEA,YAAM,QAAQ,OAAO,iBAAiB;AACtC,qBAAI,KAAK,gBAAgB,6BAA6B,KAAK,EAAE;AAE7D,UAAI;AAEF,cAAM,OAAO,MAAM,OAAO,iBAAiB,OAAO;AAClD,iBAAS,UAAU,KAAK;AAGxB,YAAI,KAAK,cAAc,KAAK,eAAe;AACzC,mBAAS,SAAS;AAAA,YAChB,MAAM,KAAK,cAAc;AAAA,YACzB,SAAS,KAAK,iBAAiB,yBAAyB,IAAI;AAAA,UAC9D;AAAA,QACF;AAEA,uBAAI,KAAK,gBAAgB,gCAAgC,KAAK,UAAU,YAAY,QAAQ,EAAE;AAAA,MAChG,SAAS,GAAG;AAEV,uBAAI,MAAM,gBAAgB,kBAAkB,CAAC,EAAE;AAC/C,iBAAS,UAAU;AACnB,iBAAS,SAAS;AAAA,UAChB,MAAM;AAAA,UACN,SAAS,6BAA6B,CAAC;AAAA,QACzC;AACA,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;;;APnDO,IAAM,aAAN,MAAiB;AAAA,EAQtB,YACmB,SACA,eACA,aACA,YACjB;AAJiB;AACA;AACA;AACA;AAGjB,SAAK,KAAK,IAAI,KAAK,MAAM;AAGzB,SAAK,KAAK,IAAI,eAAAC,QAAQ,KAAK,EAAE,OAAO,MAAM,CAAC,CAAC;AAE5C,QAAI,aAAa;AACf,qBAAI,KAAK,qBAAqB,WAAW,EAAE;AAAA,IAC7C;AAEA,QAAI,YAAY;AACd,qBAAI,KAAK,oBAAoB,UAAU,EAAE;AAAA,IAC3C;AAGA,SAAK,cAAc;AAAA,EACrB;AAAA,EA7BiB,WAAO,eAAAA,SAAQ;AAAA,EACxB,WAAW;AAAA,EACX,mBAAmB,IAAI,iBAAiB,MAAM;AAAA;AAAA,EAG9C,SAAS;AAAA,EA0BT,gBAAgB,MAAM;AAE5B,SAAK,KAAK,IAAI,YAAY,KAAK,OAAO;AAGtC,SAAK,KAAK,IAAI,YAAY,KAAK,OAAO;AAEtC,QAAI,aAAa;AACf;AAAA,IACF;AAGA,SAAK,KAAK,IAAI,CAAC,kBAAkB,kBAAkB,GAAG,KAAK,aAAa;AAGxE,SAAK,KAAK,KAAK,kBAAkB,KAAK,aAAa,QAAQ,CAAC;AAG5D,SAAK,KAAK,KAAK,oBAAoB,KAAK,aAAa,UAAU,CAAC;AAAA,EAClE;AAAA;AAAA,EAGO,cAAc,CAAC,SAAiB;AACrC,QAAI,KAAK,UAAU;AACjB,YAAM,IAAI,MAAM,iFAAiF;AAAA,IACnG;AAGA,UAAM,UAAU;AAAA,MACd,KAAK,UAAAC,QAAG,aAAa,QAAQ,IAAI,gBAAgB,oBAAoB;AAAA,MACrE,MAAM,UAAAA,QAAG,aAAa,QAAQ,IAAI,iBAAiB,oBAAoB;AAAA,IACzE;AAGA,QAAI,CAAC,aAAa;AAEhB,WAAK,SAAS,QAAQ,IAAI,kBAAkB,UAAAA,QAAG,aAAa,sBAAsB,EAAE,SAAS,EAAE,KAAK;AACpG,qBAAI,KAAK,oBAAoB,KAAK,MAAM,EAAE;AAE1C,UAAI,CAAC,KAAK,QAAQ;AAChB,cAAM,IAAI,MAAM,qBAAqB;AAAA,MACvC;AAAA,IACF;AAGA,UAAM,SAAS,aAAAC,QAAM,aAAa,SAAS,KAAK,IAAI,EAAE,OAAO,IAAI;AAGjE,WAAO,GAAG,aAAa,MAAM;AAC3B,qBAAI,KAAK,4BAA4B,IAAI,EAAE;AAE3C,WAAK,WAAW;AAAA,IAClB,CAAC;AAGD,WAAO,GAAG,SAAS,CAAC,MAAwB;AAC1C,UAAI,EAAE,SAAS,cAAc;AAC3B,uBAAI;AAAA,UACF,mEAAmE,IAAI,kCAAkC,IAAI;AAAA,QAC/G;AACA,mBAAW,MAAM;AACf,iBAAO,MAAM;AACb,iBAAO,OAAO,IAAI;AAAA,QACpB,GAAG,GAAI;AAAA,MACT;AAAA,IACF,CAAC;AAGD,YAAQ,GAAG,WAAW,MAAM;AAC1B,qBAAI,KAAK,kCAAkC;AAC3C,aAAO,MAAM,MAAM;AACjB,uBAAI,KAAK,eAAe;AACxB,gBAAQ,KAAK,CAAC;AAAA,MAChB,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,SAAS,CAAC,KAAsB,KAAuB,SAA+B;AAC5F,UAAM,YAAY,KAAK,IAAI;AAE3B,QAAI,GAAG,UAAU,MAAM;AACrB,YAAM,cAAc,KAAK,IAAI,IAAI;AACjC,YAAM,UAAU;AAAA,QACd,KAAK,IAAI,MAAM,SAAS;AAAA,QACxB,QAAQ,IAAI;AAAA,QACZ,KAAK,IAAI;AAAA,QACT,QAAQ,IAAI;AAAA,QACZ,UAAU,GAAG,WAAW;AAAA,MAC1B;AAEA,UAAI,cAAc,MAAM,eAAI,KAAK,OAAO,IAAI,eAAI,KAAK,OAAO;AAAA,IAC9D,CAAC;AAED,SAAK;AAAA,EACP;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUQ,gBAAgB,CAAC,KAAsB,KAAuB,SAAuB;AAE3F,UAAM,EAAE,MAAM,IAAI,IAAI;AACtB,QAAI,UAAU,KAAK,QAAQ;AACzB,YAAM,MAAM,gCAAgC,MAAM,QAAQ,UAAU,GAAG,CAAC;AACxE,qBAAI,KAAK,GAAG;AACZ,UAAI,OAAO,GAAG,EAAE,KAAK,GAAG;AACxB,WAAK,iBAAiB,MAAM;AAC5B;AAAA,IACF;AAGA,SAAK;AAAA,EACP;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,UAAU,CAAC,KAAsB,QAA0B;AACjE,QAAI;AACF,UAAI,KAAK,IAAI;AAAA,IACf,SAAS,KAAK;AACZ,qBAAI,MAAM,GAAG;AACb,UAAI,OAAO,GAAG,EAAE,KAAK,uBAAuB;AAAA,IAC9C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,UAAU,OAAO,KAAsB,QAA0B;AACvE,QAAI;AACF,UAAI,KAAK,MAAM,KAAK,iBAAiB,WAAW,CAAC;AAAA,IACnD,SAAS,KAAK;AACZ,qBAAI,MAAM,GAAG;AACb,UAAI,OAAO,GAAG,EAAE,KAAK,uBAAuB;AAAA,IAC9C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,eAAe,CAAC,kBAAyC;AAE/D,WAAO,OAAO,KAAsB,QAA0B;AAE5D,YAAM,YAAY,KAAK,iBAAiB,aAAa;AAErD,UAAI;AAEF,cAAM,UAAmB,IAAI,MAAM,WAAY,CAAC;AAGhD,aAAK,eAAe,KAAK,YAAY,WAAW,CAAC,CAAC;AAGlD,cAAM,OAAO,SAAS,OAAO,IAAI,QAAQ,IAAI,KAAK;AAClD,cAAM,YAAY,SAAS,aAAa;AACxC,cAAM,MAAM,SAAS,QAAQ,EAAE,OAAO,IAAI,SAAS,IAAI,MAAM,GAAG;AAEhE,cAAM,cAAc;AAAA,UAClB,KAAK,QAAQ;AAAA,UACb;AAAA,UACA;AAAA,QACF;AAEA,uBAAI,KAAK,EAAE,GAAG,aAAa,KAAK,WAAW,QAAQ,WAAW,cAAc,GAAG,kBAAkB;AACjG,uBAAI,MAAM,EAAE,GAAG,aAAa,QAAQ,GAAG,uBAAuB;AAG9D,YAAI;AAGJ,YAAI,kBAAkB,UAAU;AAC9B,qBAAW,MAAM,gBAAgB,KAAK,SAAS,KAAK,eAAe,SAAS,WAAW;AAAA,QACzF,OAAO;AACL,qBAAW,MAAM,kBAAkB,KAAK,eAAe,SAAS,WAAW;AAAA,QAC7E;AAGA,aAAK,cAAc,KAAK,WAAW,QAAQ;AAG3C,uBAAI,MAAM,EAAE,GAAG,aAAa,SAAS,GAAG,mBAAmB;AAG3D,YAAI,KAAK;AAAA,UACP,YAAY;AAAA,UACZ,MAAM;AAAA,UACN;AAAA,QACF,CAAC;AACD,aAAK,iBAAiB,WAAW,WAAW,aAAa;AAAA,MAC3D,SAAS,KAAK;AACZ,uBAAI,MAAM,GAAG;AACb,YAAI,OAAO,GAAG,EAAE,KAAK,uBAAuB;AAC5C,aAAK,iBAAiB,MAAM;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AACF;;;ADlPO,IAAM,aAAN,MAAiB;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASR,YAAY,EAAE,aAAa,KAAK,GAAgB,eAA6B,CAAC,GAAG,OAA0B,CAAC,GAAG;AAC7G,UAAM,aAAuB,qBAAM,IAAI;AACvC,WAAO,cAAc;AAGrB,UAAM,gBAAgB,CAAC,UAAU,QAAQ,MAAM;AAC/C,QAAI,CAAC,cAAc,SAAS,OAAO,WAAW,EAAE,GAAG;AACjD,YAAM,IAAI,MAAM,2BAA2B,OAAO,OAAO,EAAE;AAAA,IAC7D;AAGA,QAAI,QAAQ,IAAI,cAAc,WAAW,QAAQ,MAAM;AAErD,cAAQ,KAAK,YAAY;AACzB;AAAA,IACF;AAEA,SAAK,cAAc,IAAI,WAAW,QAAQ,cAAc,KAAK,YAAY,KAAK,SAAS;AAGvF,QAAI,KAAK,YAAY;AACnB;AAAA,IACF;AAEA,SAAK,MAAM;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,OAAO,KAAM;AACjB,SAAK,YAAY,YAAY,IAAI;AAAA,EACnC;AACF;",
+  "names": ["fetchStatus", "import_http_status_codes", "import_client_node", "f", "import_ramda", "promClient", "import_ramda", "jsonPatch", "import_ramda", "express", "fs", "https"]
 }

package/package.json

@@ -9,7 +9,7 @@
   "engines": {
     "node": ">=18.0.0"
   },
-  "version": "0.12.1",
+  "version": "0.13.0",
   "main": "dist/lib.js",
   "types": "dist/lib.d.ts",
   "scripts": {
@@ -30,16 +30,19 @@
     "express": "4.18.2",
     "fast-json-patch": "3.1.1",
     "http-status-codes": "2.2.0",
-    "node-fetch": "2.6.12",
-    "prom-client": "^14.2.0",
+    "node-fetch": "2.7.0",
+    "pino": "8.15.0",
+    "pino-pretty": "10.2.0",
+    "prom-client": "14.2.0",
     "ramda": "0.29.0"
   },
   "devDependencies": {
-    "@types/eslint": "8.44.1",
+    "@types/eslint": "8.44.2",
     "@types/express": "4.17.17",
+    "@types/node": "18.x.x",
     "@types/node-fetch": "2.6.4",
     "@types/node-forge": "1.3.4",
-    "@types/prettier": "2.7.3",
+    "@types/prettier": "3.0.0",
     "@types/prompts": "2.4.4",
     "@types/ramda": "0.29.3",
     "@types/uuid": "9.0.2",
@@ -47,15 +50,15 @@
     "nock": "13.3.2"
   },
   "peerDependencies": {
-    "@typescript-eslint/eslint-plugin": "5.59.7",
-    "@typescript-eslint/parser": "5.59.7",
-    "commander": "10.0.1",
-    "esbuild": "0.17.19",
-    "eslint": "8.41.0",
+    "@typescript-eslint/eslint-plugin": "6.4.0",
+    "@typescript-eslint/parser": "6.4.0",
+    "commander": "11.0.0",
+    "esbuild": "0.19.2",
+    "eslint": "8.47.0",
     "node-forge": "1.3.1",
-    "prettier": "2.8.8",
+    "prettier": "3.0.1",
     "prompts": "2.4.2",
-    "typescript": "5.0.4",
+    "typescript": "5.1.6",
     "uuid": "9.0.0"
   },
   "ava": {

package/src/cli.ts

@@ -12,14 +12,9 @@ import init from "./cli/init/index";
 import { version } from "./cli/init/templates";
 import { RootCmd } from "./cli/root";
 import update from "./cli/update";
-import { Log } from "./lib";
 
 if (process.env.npm_lifecycle_event !== "npx") {
-  Log.error(
-    "Pepr should be run via `npx pepr <command>` instead of `pepr <command>`.",
-    "npx required"
-  );
-  process.exit(1);
+  console.warn("Pepr should be run via `npx pepr <command>` instead of `pepr <command>`.");
 }
 
 const program = new RootCmd();
@@ -32,7 +27,7 @@ program
       console.log(banner);
       program.help();
     } else {
-      Log.error(`Invalid command '${program.args.join(" ")}'\n`);
+      console.error(`Invalid command '${program.args.join(" ")}'\n`);
       program.outputHelp();
       process.exitCode = 1;
     }
@@ -45,8 +40,4 @@ dev(program);
 update(program);
 format(program);
 
-// @todo: finish/re-evaluate these commands
-// test(program);
-// capability(program);
-
 program.parse();