pepr 0.12.2 → 0.13.0

package/dist/cli.js

@@ -106,110 +106,11 @@ var banner = `\x1B[0m\x1B[38;2;96;96;96m \x1B[0m\x1B[38;2;96;96;96m \x1B[0m\x1B[
 // src/cli/build.ts
 var import_child_process2 = require("child_process");
 var import_esbuild = require("esbuild");
-var import_fs3 = require("fs");
+var import_fs4 = require("fs");
 var import_path = require("path");
 
-// src/lib/k8s/webhook.ts
-var import_client_node = require("@kubernetes/client-node");
-var import_child_process = require("child_process");
-var import_crypto = __toESM(require("crypto"));
-var import_fs = require("fs");
-var import_ramda = require("ramda");
-var import_zlib = require("zlib");
-
-// src/lib/logger.ts
-var LogLevel = /* @__PURE__ */ ((LogLevel2) => {
-  LogLevel2[LogLevel2["debug"] = 0] = "debug";
-  LogLevel2[LogLevel2["info"] = 1] = "info";
-  LogLevel2[LogLevel2["warn"] = 2] = "warn";
-  LogLevel2[LogLevel2["error"] = 3] = "error";
-  return LogLevel2;
-})(LogLevel || {});
-var Logger = class {
-  _logLevel;
-  /**
-   * Create a new logger instance.
-   * @param logLevel - The minimum log level to log messages for.
-   */
-  constructor(logLevel) {
-    this._logLevel = logLevel;
-  }
-  /**
-   * Change the log level of the logger.
-   * @param logLevel - The log level to log the message at.
-   */
-  SetLogLevel(logLevel) {
-    this._logLevel = LogLevel[logLevel];
-    this.debug(`Log level set to ${logLevel}`);
-  }
-  /**
-   * Log a debug message.
-   * @param message - The message to log.
-   */
-  debug(message, prefix) {
-    this.log(0 /* debug */, message, prefix);
-  }
-  /**
-   * Log an info message.
-   * @param message - The message to log.
-   */
-  info(message, prefix) {
-    this.log(1 /* info */, message, prefix);
-  }
-  /**
-   * Log a warning message.
-   * @param message - The message to log.
-   */
-  warn(message, prefix) {
-    this.log(2 /* warn */, message, prefix);
-  }
-  /**
-   * Log an error message.
-   * @param message - The message to log.
-   */
-  error(message, prefix) {
-    this.log(3 /* error */, message, prefix);
-  }
-  /**
-   * Log a message at the specified log level.
-   * @param logLevel - The log level of the message.
-   * @param message - The message to log.
-   */
-  log(logLevel, message, callerPrefix = "") {
-    const color = {
-      [0 /* debug */]: "\x1B[30m" /* FgBlack */,
-      [1 /* info */]: "\x1B[36m" /* FgCyan */,
-      [2 /* warn */]: "\x1B[33m" /* FgYellow */,
-      [3 /* error */]: "\x1B[31m" /* FgRed */
-    };
-    if (logLevel >= this._logLevel) {
-      let prefix = "[" + LogLevel[logLevel] + "]	" + callerPrefix;
-      prefix = this.colorize(prefix, color[logLevel]);
-      if (typeof message !== "string") {
-        console.log(prefix);
-        console.debug("%o", message);
-      } else {
-        console.log(prefix + "	" + message);
-      }
-    }
-  }
-  colorize(text, color) {
-    return color + text + "\x1B[0m" /* Reset */;
-  }
-};
-var Log = new Logger(1 /* info */);
-if (process.env.LOG_LEVEL) {
-  Log.SetLogLevel(process.env.LOG_LEVEL);
-}
-var logger_default = Log;
-
-// src/lib/types.ts
-var ErrorBehavior = /* @__PURE__ */ ((ErrorBehavior2) => {
-  ErrorBehavior2["ignore"] = "ignore";
-  ErrorBehavior2["audit"] = "audit";
-  ErrorBehavior2["reject"] = "reject";
-  return ErrorBehavior2;
-})(ErrorBehavior || {});
+// src/lib/assets/index.ts
+var import_crypto3 = __toESM(require("crypto"));
 
 // src/lib/k8s/tls.ts
 var import_node_forge = __toESM(require("node-forge"));
@@ -268,529 +169,604 @@ function genCert(key, name, issuer) {
   return crt;
 }
 
-// src/lib/k8s/webhook.ts
-var peprIgnore = {
-  key: "pepr.dev",
-  operator: "NotIn",
-  values: ["ignore"]
-};
-var Webhook = class {
-  constructor(config, host) {
-    this.config = config;
-    this.host = host;
-    this.name = `pepr-${config.uuid}`;
-    this.image = `ghcr.io/defenseunicorns/pepr/controller:v${config.peprVersion}`;
-    this._tls = genTLS(this.host || `${this.name}.pepr-system.svc`);
-    this._apiToken = import_crypto.default.randomBytes(32).toString("hex");
-  }
-  name;
-  _tls;
-  _apiToken;
-  image;
-  get tls() {
-    return this._tls;
-  }
-  get apiToken() {
-    return this._apiToken;
-  }
-  /** Generate the pepr-system namespace */
-  namespace() {
-    return {
-      apiVersion: "v1",
-      kind: "Namespace",
-      metadata: { name: "pepr-system" }
-    };
-  }
-  /**
-   * Grants the controller access to cluster resources beyond the mutating webhook.
-   *
-   * @todo: should dynamically generate this based on resources used by the module. will also need to explore how this should work for multiple modules.
-   * @returns
-   */
-  clusterRole() {
-    return {
-      apiVersion: "rbac.authorization.k8s.io/v1",
-      kind: "ClusterRole",
-      metadata: { name: this.name },
-      rules: [
-        {
-          // @todo: make this configurable
-          apiGroups: ["*"],
-          resources: ["*"],
-          verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
-        }
-      ]
-    };
-  }
-  clusterRoleBinding() {
-    const name = this.name;
-    return {
-      apiVersion: "rbac.authorization.k8s.io/v1",
-      kind: "ClusterRoleBinding",
-      metadata: { name },
-      roleRef: {
-        apiGroup: "rbac.authorization.k8s.io",
-        kind: "ClusterRole",
-        name
-      },
-      subjects: [
-        {
-          kind: "ServiceAccount",
-          name,
-          namespace: "pepr-system"
-        }
-      ]
-    };
-  }
-  serviceAccount() {
-    return {
-      apiVersion: "v1",
-      kind: "ServiceAccount",
-      metadata: {
-        name: this.name,
-        namespace: "pepr-system"
-      }
-    };
-  }
-  apiTokenSecret() {
-    return {
-      apiVersion: "v1",
-      kind: "Secret",
-      metadata: {
-        name: `${this.name}-api-token`,
-        namespace: "pepr-system"
-      },
-      type: "Opaque",
-      data: {
-        value: Buffer.from(this._apiToken).toString("base64")
-      }
-    };
-  }
-  tlsSecret() {
-    return {
-      apiVersion: "v1",
-      kind: "Secret",
-      metadata: {
-        name: `${this.name}-tls`,
-        namespace: "pepr-system"
-      },
-      type: "kubernetes.io/tls",
-      data: {
-        "tls.crt": this._tls.crt,
-        "tls.key": this._tls.key
-      }
-    };
-  }
-  generateWebhookRules(path) {
-    return new Promise((resolve4, reject) => {
-      const rules = [];
-      const defaultRule = {
-        apiGroups: ["*"],
-        apiVersions: ["*"],
-        operations: ["CREATE", "UPDATE", "DELETE"],
-        resources: ["*/*"]
-      };
-      const program2 = (0, import_child_process.fork)(path, {
-        env: {
-          ...process.env,
-          LOG_LEVEL: "warn",
-          PEPR_MODE: "build"
-        }
-      });
-      program2.on("message", (message) => {
-        const { capabilities } = message.valueOf();
-        for (const capability of capabilities) {
-          logger_default.info(`Module ${this.config.uuid} has capability: ${capability._name}`);
-          const { _bindings } = capability;
-          for (const binding of _bindings) {
-            const { event, kind } = binding;
-            const operations = [];
-            if (event === "CREATEORUPDATE" /* CreateOrUpdate */) {
-              operations.push("CREATE" /* Create */, "UPDATE" /* Update */);
-            } else {
-              operations.push(event);
-            }
-            const resource = kind.plural || `${kind.kind.toLowerCase()}s`;
-            rules.push({
-              apiGroups: [kind.group],
-              apiVersions: [kind.version || "*"],
-              operations,
-              resources: [resource]
-            });
-          }
-        }
-      });
-      program2.on("exit", (code) => {
-        if (code !== 0) {
-          reject(new Error(`Child process exited with code ${code}`));
-        } else {
-          if (rules.length < 1) {
-            resolve4([defaultRule]);
-          } else {
-            const reducedRules = (0, import_ramda.uniqWith)(import_ramda.equals, rules);
-            resolve4(reducedRules);
-          }
-        }
-      });
-      program2.on("error", (error) => {
-        reject(error);
-      });
-    });
+// src/lib/assets/deploy.ts
+var import_client_node = require("@kubernetes/client-node");
+var import_crypto = __toESM(require("crypto"));
+var import_fs = require("fs");
+
+// src/lib/logger.ts
+var import_pino = require("pino");
+var isPrettyLog = process.env.PEPR_PRETTY_LOGS === "true";
+var pretty = {
+  target: "pino-pretty",
+  options: {
+    colorize: true
   }
-  async mutatingWebhook(path, timeoutSeconds = 10) {
-    const { name } = this;
-    const ignore = [peprIgnore];
-    if (this.config.alwaysIgnore.namespaces && this.config.alwaysIgnore.namespaces.length > 0) {
-      ignore.push({
-        key: "kubernetes.io/metadata.name",
-        operator: "NotIn",
-        values: this.config.alwaysIgnore.namespaces
-      });
+};
+var transport = isPrettyLog ? pretty : void 0;
+var Log = (0, import_pino.pino)({
+  transport
+});
+if (process.env.LOG_LEVEL) {
+  Log.level = process.env.LOG_LEVEL;
+}
+var logger_default = Log;
+
+// src/lib/assets/networking.ts
+function apiTokenSecret(name, apiToken) {
+  return {
+    apiVersion: "v1",
+    kind: "Secret",
+    metadata: {
+      name: `${name}-api-token`,
+      namespace: "pepr-system"
+    },
+    type: "Opaque",
+    data: {
+      value: Buffer.from(apiToken).toString("base64")
     }
-    const clientConfig = {
-      caBundle: this._tls.ca
-    };
-    const mutatePath = `/mutate/${this._apiToken}`;
-    if (this.host) {
-      clientConfig.url = `https://${this.host}:3000${mutatePath}`;
-    } else {
-      clientConfig.service = {
-        name: this.name,
-        namespace: "pepr-system",
-        path: mutatePath
-      };
+  };
+}
+function tlsSecret(name, tls) {
+  return {
+    apiVersion: "v1",
+    kind: "Secret",
+    metadata: {
+      name: `${name}-tls`,
+      namespace: "pepr-system"
+    },
+    type: "kubernetes.io/tls",
+    data: {
+      "tls.crt": tls.crt,
+      "tls.key": tls.key
     }
-    const rules = await this.generateWebhookRules(path);
-    return {
-      apiVersion: "admissionregistration.k8s.io/v1",
-      kind: "MutatingWebhookConfiguration",
-      metadata: { name },
-      webhooks: [
+  };
+}
+function service(name) {
+  return {
+    apiVersion: "v1",
+    kind: "Service",
+    metadata: {
+      name,
+      namespace: "pepr-system"
+    },
+    spec: {
+      selector: {
+        app: name
+      },
+      ports: [
         {
-          name: `${name}.pepr.dev`,
-          admissionReviewVersions: ["v1", "v1beta1"],
-          clientConfig,
-          failurePolicy: "Ignore",
-          matchPolicy: "Equivalent",
-          timeoutSeconds,
-          namespaceSelector: {
-            matchExpressions: ignore
-          },
-          objectSelector: {
-            matchExpressions: ignore
-          },
-          rules,
-          // @todo: track side effects state
-          sideEffects: "None"
+          port: 443,
+          targetPort: 3e3
         }
       ]
-    };
-  }
-  deployment(hash) {
-    return {
-      apiVersion: "apps/v1",
-      kind: "Deployment",
-      metadata: {
-        name: this.name,
-        namespace: "pepr-system",
-        labels: {
-          app: this.name
+    }
+  };
+}
+
+// src/lib/assets/pods.ts
+var import_zlib = require("zlib");
+var namespace = {
+  apiVersion: "v1",
+  kind: "Namespace",
+  metadata: { name: "pepr-system" }
+};
+function deployment(assets, hash) {
+  const { name, image } = assets;
+  const app = name;
+  return {
+    apiVersion: "apps/v1",
+    kind: "Deployment",
+    metadata: {
+      name,
+      namespace: "pepr-system",
+      labels: {
+        app
+      }
+    },
+    spec: {
+      replicas: 2,
+      selector: {
+        matchLabels: {
+          app
         }
       },
-      spec: {
-        replicas: 2,
-        selector: {
-          matchLabels: {
-            app: this.name
+      template: {
+        metadata: {
+          labels: {
+            app
           }
         },
-        template: {
-          metadata: {
-            labels: {
-              app: this.name
-            }
-          },
-          spec: {
-            priorityClassName: "system-node-critical",
-            serviceAccountName: this.name,
-            containers: [
-              {
-                name: "server",
-                image: this.image,
-                imagePullPolicy: "IfNotPresent",
-                command: ["node", "/app/node_modules/pepr/dist/controller.js", hash],
-                livenessProbe: {
-                  httpGet: {
-                    path: "/healthz",
-                    port: 3e3,
-                    scheme: "HTTPS"
-                  }
-                },
-                ports: [
-                  {
-                    containerPort: 3e3
-                  }
-                ],
-                resources: {
-                  requests: {
-                    memory: "64Mi",
-                    cpu: "100m"
-                  },
-                  limits: {
-                    memory: "256Mi",
-                    cpu: "500m"
-                  }
-                },
-                volumeMounts: [
-                  {
-                    name: "tls-certs",
-                    mountPath: "/etc/certs",
-                    readOnly: true
-                  },
-                  {
-                    name: "api-token",
-                    mountPath: "/app/api-token",
-                    readOnly: true
-                  },
-                  {
-                    name: "module",
-                    mountPath: `/app/load`,
-                    readOnly: true
-                  }
-                ]
-              }
-            ],
-            volumes: [
-              {
-                name: "tls-certs",
-                secret: {
-                  secretName: `${this.name}-tls`
+        spec: {
+          priorityClassName: "system-node-critical",
+          serviceAccountName: name,
+          containers: [
+            {
+              name: "server",
+              image,
+              imagePullPolicy: "IfNotPresent",
+              command: ["node", "/app/node_modules/pepr/dist/controller.js", hash],
+              readinessProbe: {
+                httpGet: {
+                  path: "/healthz",
+                  port: 3e3,
+                  scheme: "HTTPS"
+                }
+              },
+              livenessProbe: {
+                httpGet: {
+                  path: "/healthz",
+                  port: 3e3,
+                  scheme: "HTTPS"
                 }
               },
-              {
-                name: "api-token",
-                secret: {
-                  secretName: `${this.name}-api-token`
+              ports: [
+                {
+                  containerPort: 3e3
+                }
+              ],
+              env: [
+                {
+                  name: "PEPR_PRETTY_LOG",
+                  value: "false"
+                }
+              ],
+              resources: {
+                requests: {
+                  memory: "64Mi",
+                  cpu: "100m"
+                },
+                limits: {
+                  memory: "256Mi",
+                  cpu: "500m"
                 }
               },
-              {
-                name: "module",
-                secret: {
-                  secretName: `${this.name}-module`
+              volumeMounts: [
+                {
+                  name: "tls-certs",
+                  mountPath: "/etc/certs",
+                  readOnly: true
+                },
+                {
+                  name: "api-token",
+                  mountPath: "/app/api-token",
+                  readOnly: true
+                },
+                {
+                  name: "module",
+                  mountPath: `/app/load`,
+                  readOnly: true
                 }
+              ]
+            }
+          ],
+          volumes: [
+            {
+              name: "tls-certs",
+              secret: {
+                secretName: `${name}-tls`
               }
-            ]
-          }
+            },
+            {
+              name: "api-token",
+              secret: {
+                secretName: `${name}-api-token`
+              }
+            },
+            {
+              name: "module",
+              secret: {
+                secretName: `${name}-module`
+              }
+            }
+          ]
         }
       }
-    };
-  }
-  service() {
-    return {
-      apiVersion: "v1",
-      kind: "Service",
-      metadata: {
-        name: this.name,
-        namespace: "pepr-system"
-      },
-      spec: {
-        selector: {
-          app: this.name
-        },
-        ports: [
-          {
-            port: 443,
-            targetPort: 3e3
-          }
-        ]
+    }
+  };
+}
+function moduleSecret(name, data, hash) {
+  const compressed = (0, import_zlib.gzipSync)(data);
+  const path = `module-${hash}.js.gz`;
+  return {
+    apiVersion: "v1",
+    kind: "Secret",
+    metadata: {
+      name: `${name}-module`,
+      namespace: "pepr-system"
+    },
+    type: "Opaque",
+    data: {
+      [path]: compressed.toString("base64")
+    }
+  };
+}
+
+// src/lib/assets/rbac.ts
+function clusterRole(name) {
+  return {
+    apiVersion: "rbac.authorization.k8s.io/v1",
+    kind: "ClusterRole",
+    metadata: { name },
+    rules: [
+      {
+        // @todo: make this configurable
+        apiGroups: ["*"],
+        resources: ["*"],
+        verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
       }
-    };
-  }
-  moduleSecret(data, hash) {
-    const compressed = (0, import_zlib.gzipSync)(data);
-    const path = `module-${hash}.js.gz`;
-    return {
-      apiVersion: "v1",
-      kind: "Secret",
-      metadata: {
-        name: `${this.name}-module`,
+    ]
+  };
+}
+function clusterRoleBinding(name) {
+  return {
+    apiVersion: "rbac.authorization.k8s.io/v1",
+    kind: "ClusterRoleBinding",
+    metadata: { name },
+    roleRef: {
+      apiGroup: "rbac.authorization.k8s.io",
+      kind: "ClusterRole",
+      name
+    },
+    subjects: [
+      {
+        kind: "ServiceAccount",
+        name,
         namespace: "pepr-system"
-      },
-      type: "Opaque",
-      data: {
-        [path]: compressed.toString("base64")
       }
-    };
+    ]
+  };
+}
+function serviceAccount(name) {
+  return {
+    apiVersion: "v1",
+    kind: "ServiceAccount",
+    metadata: {
+      name,
+      namespace: "pepr-system"
+    }
+  };
+}
+
+// src/lib/assets/webhooks.ts
+var import_ramda = require("ramda");
+var peprIgnoreLabel = {
+  key: "pepr.dev",
+  operator: "NotIn",
+  values: ["ignore"]
+};
+var peprIgnoreNamespaces = ["kube-system", "pepr-system"];
+async function generateWebhookRules(assets, isMutateWebhook) {
+  const { config, capabilities } = assets;
+  const rules = [];
+  for (const capability of capabilities) {
+    console.info(`Module ${config.uuid} has capability: ${capability._name}`);
+    for (const binding of capability._bindings) {
+      const { event, kind, isMutate, isValidate } = binding;
+      if (isMutateWebhook && !isMutate) {
+        continue;
+      }
+      if (!isMutateWebhook && !isValidate) {
+        continue;
+      }
+      const operations = [];
+      if (event === "CREATEORUPDATE" /* CreateOrUpdate */) {
+        operations.push("CREATE" /* Create */, "UPDATE" /* Update */);
+      } else {
+        operations.push(event);
+      }
+      const resource = kind.plural || `${kind.kind.toLowerCase()}s`;
+      rules.push({
+        apiGroups: [kind.group],
+        apiVersions: [kind.version || "*"],
+        operations,
+        resources: [resource]
+      });
+    }
   }
-  zarfYaml(path) {
-    const zarfCfg = {
-      kind: "ZarfPackageConfig",
-      metadata: {
-        name: this.name,
-        description: `Pepr Module: ${this.config.description}`,
-        url: "https://github.com/defenseunicorns/pepr",
-        version: `${this.config.appVersion || "0.0.1"}`
-      },
-      components: [
-        {
-          name: "module",
-          required: true,
-          manifests: [
-            {
-              name: "module",
-              namespace: "pepr-system",
-              files: [path]
-            }
-          ],
-          images: [this.image]
-        }
-      ]
+  return (0, import_ramda.uniqWith)(import_ramda.equals, rules);
+}
+async function webhookConfig(assets, mutateOrValidate, timeoutSeconds = 10) {
+  const ignore = [peprIgnoreLabel];
+  const { name, tls, config, apiToken, host } = assets;
+  const ignoreNS = (0, import_ramda.concat)(peprIgnoreNamespaces, config.alwaysIgnore.namespaces || []);
+  if (ignoreNS) {
+    ignore.push({
+      key: "kubernetes.io/metadata.name",
+      operator: "NotIn",
+      values: ignoreNS
+    });
+  }
+  const clientConfig = {
+    caBundle: tls.ca
+  };
+  const apiPath = `/${mutateOrValidate}/${apiToken}`;
+  if (host) {
+    clientConfig.url = `https://${host}:3000${apiPath}`;
+  } else {
+    clientConfig.service = {
+      name,
+      namespace: "pepr-system",
+      path: apiPath
     };
-    return (0, import_client_node.dumpYaml)(zarfCfg, { noRefs: true });
   }
-  async allYaml(path) {
-    const code = await import_fs.promises.readFile(path);
-    const hash = import_crypto.default.createHash("sha256").update(code).digest("hex");
-    const webhook = await this.mutatingWebhook(path);
-    const resources = [
-      this.namespace(),
-      this.clusterRole(),
-      this.clusterRoleBinding(),
-      this.serviceAccount(),
-      this.apiTokenSecret(),
-      this.tlsSecret(),
-      webhook,
-      this.deployment(hash),
-      this.service(),
-      this.moduleSecret(code, hash)
-    ];
-    return resources.map((r) => (0, import_client_node.dumpYaml)(r, { noRefs: true })).join("---\n");
+  const isMutate = mutateOrValidate === "mutate";
+  const rules = await generateWebhookRules(assets, isMutate);
+  if (rules.length < 1) {
+    return null;
   }
-  async deploy(path, webhookTimeout) {
-    logger_default.info("Establishing connection to Kubernetes");
-    const namespace = "pepr-system";
-    const kubeConfig = new import_client_node.KubeConfig();
-    kubeConfig.loadFromDefault();
-    const coreV1Api = kubeConfig.makeApiClient(import_client_node.CoreV1Api);
-    const admissionApi = kubeConfig.makeApiClient(import_client_node.AdmissionregistrationV1Api);
-    const ns = this.namespace();
-    try {
-      logger_default.info("Checking for namespace");
-      await coreV1Api.readNamespace(namespace);
-    } catch (e) {
-      logger_default.debug(e instanceof import_client_node.HttpError ? e.body : e);
-      logger_default.info("Creating namespace");
-      await coreV1Api.createNamespace(ns);
-    }
-    const wh = await this.mutatingWebhook(path, webhookTimeout);
+  return {
+    apiVersion: "admissionregistration.k8s.io/v1",
+    kind: isMutate ? "MutatingWebhookConfiguration" : "ValidatingWebhookConfiguration",
+    metadata: { name },
+    webhooks: [
+      {
+        name: `${name}.pepr.dev`,
+        admissionReviewVersions: ["v1", "v1beta1"],
+        clientConfig,
+        failurePolicy: "Ignore",
+        matchPolicy: "Equivalent",
+        timeoutSeconds,
+        namespaceSelector: {
+          matchExpressions: ignore
+        },
+        objectSelector: {
+          matchExpressions: ignore
+        },
+        rules,
+        // @todo: track side effects state
+        sideEffects: "None"
+      }
+    ]
+  };
+}
+
+// src/lib/assets/deploy.ts
+async function deploy(assets, webhookTimeout) {
+  logger_default.info("Establishing connection to Kubernetes");
+  const peprNS = "pepr-system";
+  const { name, host, path } = assets;
+  const kubeConfig = new import_client_node.KubeConfig();
+  kubeConfig.loadFromDefault();
+  const coreV1Api = kubeConfig.makeApiClient(import_client_node.CoreV1Api);
+  const admissionApi = kubeConfig.makeApiClient(import_client_node.AdmissionregistrationV1Api);
+  try {
+    logger_default.info("Checking for namespace");
+    await coreV1Api.readNamespace(peprNS);
+  } catch (e) {
+    logger_default.debug(e instanceof import_client_node.HttpError ? e.body : e);
+    logger_default.info("Creating namespace");
+    await coreV1Api.createNamespace(namespace);
+  }
+  const mutateWebhook = await webhookConfig(assets, "mutate", webhookTimeout);
+  if (mutateWebhook) {
     try {
       logger_default.info("Creating mutating webhook");
-      await admissionApi.createMutatingWebhookConfiguration(wh);
+      await admissionApi.createMutatingWebhookConfiguration(mutateWebhook);
     } catch (e) {
       logger_default.debug(e instanceof import_client_node.HttpError ? e.body : e);
       logger_default.info("Removing and re-creating mutating webhook");
-      await admissionApi.deleteMutatingWebhookConfiguration(wh.metadata?.name ?? "");
-      await admissionApi.createMutatingWebhookConfiguration(wh);
-    }
-    if (this.host) {
-      return;
-    }
-    if (!path) {
-      throw new Error("No code provided");
+      await admissionApi.deleteMutatingWebhookConfiguration(mutateWebhook.metadata?.name ?? "");
+      await admissionApi.createMutatingWebhookConfiguration(mutateWebhook);
     }
-    const code = await import_fs.promises.readFile(path);
-    const hash = import_crypto.default.createHash("sha256").update(code).digest("hex");
-    const appsApi = kubeConfig.makeApiClient(import_client_node.AppsV1Api);
-    const rbacApi = kubeConfig.makeApiClient(import_client_node.RbacAuthorizationV1Api);
-    const crb = this.clusterRoleBinding();
+  }
+  const validateWebhook = await webhookConfig(assets, "validate", webhookTimeout);
+  if (validateWebhook) {
     try {
-      logger_default.info("Creating cluster role binding");
-      await rbacApi.createClusterRoleBinding(crb);
+      logger_default.info("Creating validating webhook");
+      await admissionApi.createValidatingWebhookConfiguration(validateWebhook);
     } catch (e) {
       logger_default.debug(e instanceof import_client_node.HttpError ? e.body : e);
-      logger_default.info("Removing and re-creating cluster role binding");
-      await rbacApi.deleteClusterRoleBinding(crb.metadata?.name ?? "");
-      await rbacApi.createClusterRoleBinding(crb);
+      logger_default.info("Removing and re-creating validating webhook");
+      await admissionApi.deleteValidatingWebhookConfiguration(validateWebhook.metadata?.name ?? "");
+      await admissionApi.createValidatingWebhookConfiguration(validateWebhook);
     }
-    const cr = this.clusterRole();
+  }
+  if (host) {
+    return;
+  }
+  if (!path) {
+    throw new Error("No code provided");
+  }
+  const code = await import_fs.promises.readFile(path);
+  const hash = import_crypto.default.createHash("sha256").update(code).digest("hex");
+  const appsApi = kubeConfig.makeApiClient(import_client_node.AppsV1Api);
+  const rbacApi = kubeConfig.makeApiClient(import_client_node.RbacAuthorizationV1Api);
+  const crb = clusterRoleBinding(name);
+  try {
+    logger_default.info("Creating cluster role binding");
+    await rbacApi.createClusterRoleBinding(crb);
+  } catch (e) {
+    logger_default.debug(e instanceof import_client_node.HttpError ? e.body : e);
+    logger_default.info("Removing and re-creating cluster role binding");
+    await rbacApi.deleteClusterRoleBinding(crb.metadata?.name ?? "");
+    await rbacApi.createClusterRoleBinding(crb);
+  }
+  const cr = clusterRole(name);
+  try {
+    logger_default.info("Creating cluster role");
+    await rbacApi.createClusterRole(cr);
+  } catch (e) {
+    logger_default.debug(e instanceof import_client_node.HttpError ? e.body : e);
+    logger_default.info("Removing and re-creating  the cluster role");
     try {
-      logger_default.info("Creating cluster role");
+      await rbacApi.deleteClusterRole(cr.metadata?.name ?? "");
       await rbacApi.createClusterRole(cr);
-    } catch (e) {
-      logger_default.debug(e instanceof import_client_node.HttpError ? e.body : e);
-      logger_default.info("Removing and re-creating  the cluster role");
-      try {
-        await rbacApi.deleteClusterRole(cr.metadata?.name ?? "");
-        await rbacApi.createClusterRole(cr);
-      } catch (e2) {
-        logger_default.debug(e2 instanceof import_client_node.HttpError ? e2.body : e2);
-      }
-    }
-    const sa = this.serviceAccount();
-    try {
-      logger_default.info("Creating service account");
-      await coreV1Api.createNamespacedServiceAccount(namespace, sa);
-    } catch (e) {
-      logger_default.debug(e instanceof import_client_node.HttpError ? e.body : e);
-      logger_default.info("Removing and re-creating service account");
-      await coreV1Api.deleteNamespacedServiceAccount(sa.metadata?.name ?? "", namespace);
-      await coreV1Api.createNamespacedServiceAccount(namespace, sa);
-    }
-    const mod = this.moduleSecret(code, hash);
-    try {
-      logger_default.info("Creating module secret");
-      await coreV1Api.createNamespacedSecret(namespace, mod);
-    } catch (e) {
-      logger_default.debug(e instanceof import_client_node.HttpError ? e.body : e);
-      logger_default.info("Removing and re-creating module secret");
-      await coreV1Api.deleteNamespacedSecret(mod.metadata?.name ?? "", namespace);
-      await coreV1Api.createNamespacedSecret(namespace, mod);
-    }
-    const svc = this.service();
-    try {
-      logger_default.info("Creating service");
-      await coreV1Api.createNamespacedService(namespace, svc);
-    } catch (e) {
-      logger_default.debug(e instanceof import_client_node.HttpError ? e.body : e);
-      logger_default.info("Removing and re-creating service");
-      await coreV1Api.deleteNamespacedService(svc.metadata?.name ?? "", namespace);
-      await coreV1Api.createNamespacedService(namespace, svc);
-    }
-    const tls = this.tlsSecret();
-    try {
-      logger_default.info("Creating TLS secret");
-      await coreV1Api.createNamespacedSecret(namespace, tls);
-    } catch (e) {
-      logger_default.debug(e instanceof import_client_node.HttpError ? e.body : e);
-      logger_default.info("Removing and re-creating TLS secret");
-      await coreV1Api.deleteNamespacedSecret(tls.metadata?.name ?? "", namespace);
-      await coreV1Api.createNamespacedSecret(namespace, tls);
-    }
-    const apiToken = this.apiTokenSecret();
-    try {
-      logger_default.info("Creating API token secret");
-      await coreV1Api.createNamespacedSecret(namespace, apiToken);
-    } catch (e) {
-      logger_default.debug(e instanceof import_client_node.HttpError ? e.body : e);
-      logger_default.info("Removing and re-creating API token secret");
-      await coreV1Api.deleteNamespacedSecret(apiToken.metadata?.name ?? "", namespace);
-      await coreV1Api.createNamespacedSecret(namespace, apiToken);
-    }
-    const dep = this.deployment(hash);
-    try {
-      logger_default.info("Creating deployment");
-      await appsApi.createNamespacedDeployment(namespace, dep);
-    } catch (e) {
-      logger_default.debug(e instanceof import_client_node.HttpError ? e.body : e);
-      logger_default.info("Removing and re-creating deployment");
-      await appsApi.deleteNamespacedDeployment(dep.metadata?.name ?? "", namespace);
-      await appsApi.createNamespacedDeployment(namespace, dep);
+    } catch (e2) {
+      logger_default.debug(e2 instanceof import_client_node.HttpError ? e2.body : e2);
     }
   }
+  const sa = serviceAccount(name);
+  try {
+    logger_default.info("Creating service account");
+    await coreV1Api.createNamespacedServiceAccount(peprNS, sa);
+  } catch (e) {
+    logger_default.debug(e instanceof import_client_node.HttpError ? e.body : e);
+    logger_default.info("Removing and re-creating service account");
+    await coreV1Api.deleteNamespacedServiceAccount(sa.metadata?.name ?? "", peprNS);
+    await coreV1Api.createNamespacedServiceAccount(peprNS, sa);
+  }
+  const mod = moduleSecret(name, code, hash);
+  try {
+    logger_default.info("Creating module secret");
+    await coreV1Api.createNamespacedSecret(peprNS, mod);
+  } catch (e) {
+    logger_default.debug(e instanceof import_client_node.HttpError ? e.body : e);
+    logger_default.info("Removing and re-creating module secret");
+    await coreV1Api.deleteNamespacedSecret(mod.metadata?.name ?? "", peprNS);
+    await coreV1Api.createNamespacedSecret(peprNS, mod);
+  }
+  const svc = service(name);
+  try {
+    logger_default.info("Creating service");
+    await coreV1Api.createNamespacedService(peprNS, svc);
+  } catch (e) {
+    logger_default.debug(e instanceof import_client_node.HttpError ? e.body : e);
+    logger_default.info("Removing and re-creating service");
+    await coreV1Api.deleteNamespacedService(svc.metadata?.name ?? "", peprNS);
+    await coreV1Api.createNamespacedService(peprNS, svc);
+  }
+  const tls = tlsSecret(name, assets.tls);
+  try {
+    logger_default.info("Creating TLS secret");
+    await coreV1Api.createNamespacedSecret(peprNS, tls);
+  } catch (e) {
+    logger_default.debug(e instanceof import_client_node.HttpError ? e.body : e);
+    logger_default.info("Removing and re-creating TLS secret");
+    await coreV1Api.deleteNamespacedSecret(tls.metadata?.name ?? "", peprNS);
+    await coreV1Api.createNamespacedSecret(peprNS, tls);
+  }
+  const apiToken = apiTokenSecret(name, assets.apiToken);
+  try {
+    logger_default.info("Creating API token secret");
+    await coreV1Api.createNamespacedSecret(peprNS, apiToken);
+  } catch (e) {
+    logger_default.debug(e instanceof import_client_node.HttpError ? e.body : e);
+    logger_default.info("Removing and re-creating API token secret");
+    await coreV1Api.deleteNamespacedSecret(apiToken.metadata?.name ?? "", peprNS);
+    await coreV1Api.createNamespacedSecret(peprNS, apiToken);
+  }
+  const dep = deployment(assets, hash);
+  try {
+    logger_default.info("Creating deployment");
+    await appsApi.createNamespacedDeployment(peprNS, dep);
+  } catch (e) {
+    logger_default.debug(e instanceof import_client_node.HttpError ? e.body : e);
+    logger_default.info("Removing and re-creating deployment");
+    await appsApi.deleteNamespacedDeployment(dep.metadata?.name ?? "", peprNS);
+    await appsApi.createNamespacedDeployment(peprNS, dep);
+  }
+}
+
+// src/lib/assets/loader.ts
+var import_child_process = require("child_process");
+function loadCapabilities(path) {
+  return new Promise((resolve4, reject) => {
+    const program2 = (0, import_child_process.fork)(path, {
+      env: {
+        ...process.env,
+        LOG_LEVEL: "warn",
+        PEPR_MODE: "build"
+      }
+    });
+    program2.on("message", (message) => {
+      const capabilities = message.valueOf();
+      for (const capability of capabilities) {
+        console.info(`Registered Pepr Capability "${capability._name}"`);
+      }
+      resolve4(capabilities);
+    });
+    program2.on("error", (error) => {
+      reject(error);
+    });
+  });
+}
+
+// src/lib/assets/yaml.ts
+var import_client_node2 = require("@kubernetes/client-node");
+var import_crypto2 = __toESM(require("crypto"));
+var import_fs2 = require("fs");
+function zarfYaml({ name, image, config }, path) {
+  const zarfCfg = {
+    kind: "ZarfPackageConfig",
+    metadata: {
+      name,
+      description: `Pepr Module: ${config.description}`,
+      url: "https://github.com/defenseunicorns/pepr",
+      version: `${config.appVersion || "0.0.1"}`
+    },
+    components: [
+      {
+        name: "module",
+        required: true,
+        manifests: [
+          {
+            name: "module",
+            namespace: "pepr-system",
+            files: [path]
+          }
+        ],
+        images: [image]
+      }
+    ]
+  };
+  return (0, import_client_node2.dumpYaml)(zarfCfg, { noRefs: true });
+}
+async function allYaml(assets) {
+  const { name, tls, apiToken, path } = assets;
+  const code = await import_fs2.promises.readFile(path);
+  const hash = import_crypto2.default.createHash("sha256").update(code).digest("hex");
+  const mutateWebhook = await webhookConfig(assets, "mutate");
+  const validateWebhook = await webhookConfig(assets, "validate");
+  const resources = [
+    namespace,
+    clusterRole(name),
+    clusterRoleBinding(name),
+    serviceAccount(name),
+    apiTokenSecret(name, apiToken),
+    tlsSecret(name, tls),
+    deployment(assets, hash),
+    service(name),
+    moduleSecret(name, code, hash)
+  ];
+  if (mutateWebhook) {
+    resources.push(mutateWebhook);
+  }
+  if (validateWebhook) {
+    resources.push(validateWebhook);
+  }
+  return resources.map((r) => (0, import_client_node2.dumpYaml)(r, { noRefs: true })).join("---\n");
+}
+
+// src/lib/assets/index.ts
+var Assets = class {
+  constructor(config, path, host) {
+    this.config = config;
+    this.path = path;
+    this.host = host;
+    this.name = `pepr-${config.uuid}`;
+    this.image = `ghcr.io/defenseunicorns/pepr/controller:v${config.peprVersion}`;
+    this.tls = genTLS(this.host || `${this.name}.pepr-system.svc`);
+    this.apiToken = import_crypto3.default.randomBytes(32).toString("hex");
+  }
+  name;
+  tls;
+  apiToken;
+  capabilities;
+  image;
+  deploy = async (webhookTimeout) => {
+    this.capabilities = await loadCapabilities(this.path);
+    await deploy(this, webhookTimeout);
+  };
+  zarfYaml = (path) => zarfYaml(this, path);
+  allYaml = async () => {
+    this.capabilities = await loadCapabilities(this.path);
+    return allYaml(this);
+  };
 };
 
 // src/cli/init/templates.ts
-var import_client_node2 = require("@kubernetes/client-node");
+var import_client_node3 = require("@kubernetes/client-node");
 var import_util = require("util");
 var import_uuid = require("uuid");
 
@@ -880,6 +856,20 @@ var hello_pepr_samples_default = [
       key: "ex-2-val"
     }
   },
+  {
+    apiVersion: "v1",
+    kind: "ConfigMap",
+    metadata: {
+      name: "example-evil-cm",
+      namespace: "pepr-demo",
+      annotations: {
+        evil: "true"
+      }
+    },
+    data: {
+      key: "ex-evil-cm-val"
+    }
+  },
   {
     apiVersion: "v1",
     kind: "ConfigMap",
@@ -977,8 +967,8 @@ var hello_pepr_samples_default = [
 var gitIgnore = "# Ignore node_modules and Pepr build artifacts\nnode_modules\ndist\ninsecure*\n";
 var readmeMd = '# Pepr Module\n\nThis is a Pepr Module. [Pepr](https://github.com/defenseunicorns/pepr) is a Kubernetes transformation system\nwritten in Typescript.\n\nThe `capabilities` directory contains all the capabilities for this module. By default,\na capability is a single typescript file in the format of `capability-name.ts` that is\nimported in the root `pepr.ts` file as `import { HelloPepr } from "./capabilities/hello-pepr";`.\nBecause this is typescript, you can organize this however you choose, e.g. creating a sub-folder\nper-capability or common logic in shared files or folders.\n\nExample Structure:\n\n```\nModule Root\n\u251C\u2500\u2500 package.json\n\u251C\u2500\u2500 pepr.ts\n\u2514\u2500\u2500 capabilities\n    \u251C\u2500\u2500 example-one.ts\n    \u251C\u2500\u2500 example-three.ts\n    \u2514\u2500\u2500 example-two.ts\n```\n';
 var peprTS = 'import { PeprModule } from "pepr";\n// cfg loads your pepr configuration from package.json\nimport cfg from "./package.json";\n\n// HelloPepr is a demo capability that is included with Pepr. Comment or delete the line below to remove it.\nimport { HelloPepr } from "./capabilities/hello-pepr";\n\n/**\n * This is the main entrypoint for this Pepr module. It is run when the module is started.\n * This is where you register your Pepr configurations and capabilities.\n */\nnew PeprModule(cfg, [\n  // "HelloPepr" is a demo capability that is included with Pepr. Comment or delete the line below to remove it.\n  HelloPepr,\n\n  // Your additional capabilities go here\n]);\n';
-var helloPeprTS = 'import {\n  Capability,\n  Log,\n  PeprRequest,\n  RegisterKind,\n  a,\n  fetch,\n  fetchStatus,\n} from "pepr";\n\n/**\n *  The HelloPepr Capability is an example capability to demonstrate some general concepts of Pepr.\n *  To test this capability you run `pepr dev`and then run the following command:\n *  `kubectl apply -f capabilities/hello-pepr.samples.yaml`\n */\nexport const HelloPepr = new Capability({\n  name: "hello-pepr",\n  description: "A simple example capability to show how things work.",\n  namespaces: ["pepr-demo", "pepr-demo-2"],\n});\n\n// Use the \'When\' function to create a new Capability Action\nconst { When } = HelloPepr;\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   CAPABILITY ACTION (Namespace)                                   *\n * ---------------------------------------------------------------------------------------------------\n *\n * This Capability Action removes the label `remove-me` when a Namespace is created.\n * Note we don\'t need to specify the namespace here, because we\'ve already specified\n * it in the Capability definition above.\n */\nWhen(a.Namespace)\n  .IsCreated()\n  .Then(ns => ns.RemoveLabel("remove-me"));\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   CAPABILITY ACTION (CM Example 1)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This is a single Capability Action. They can be in the same file or put imported from other files.\n * In this example, when a ConfigMap is created with the name `example-1`, then add a label and annotation.\n *\n * Equivalent to manually running:\n * `kubectl label configmap example-1 pepr=was-here`\n * `kubectl annotate configmap example-1 pepr.dev=annotations-work-too`\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-1")\n  .Then(request =>\n    request\n      .SetLabel("pepr", "was-here")\n      .SetAnnotation("pepr.dev", "annotations-work-too")\n  );\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   CAPABILITY ACTION (CM Example 2)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This Capability Action does the exact same changes for example-2, except this time it uses\n * the `.ThenSet()` feature. You can stack multiple `.Then()` calls, but only a single `.ThenSet()`\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-2")\n  .ThenSet({\n    metadata: {\n      labels: {\n        pepr: "was-here",\n      },\n      annotations: {\n        "pepr.dev": "annotations-work-too",\n      },\n    },\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   CAPABILITY ACTION (CM Example 3)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This Capability Action combines different styles. Unlike the previous actions, this one will look\n * for any ConfigMap in the `pepr-demo` namespace that has the label `change=by-label` during either\n * CREATE or UPDATE. Note that all conditions added such as `WithName()`, `WithLabel()`, `InNamespace()`,\n * are ANDs so all conditions must be true for the request to be processed.\n */\nWhen(a.ConfigMap)\n  .IsCreatedOrUpdated()\n  .WithLabel("change", "by-label")\n  .Then(request => {\n    // The K8s object e are going to mutate\n    const cm = request.Raw;\n\n    // Get the username and uid of the K8s request\n    const { username, uid } = request.Request.userInfo;\n\n    // Store some data about the request in the configmap\n    cm.data["username"] = username;\n    cm.data["uid"] = uid;\n\n    // You can still mix other ways of making changes too\n    request.SetAnnotation("pepr.dev", "making-waves");\n  });\n\n// This action will log an entry when a CM with the label `change=by-label` is deleted\nWhen(a.ConfigMap)\n  .IsDeleted()\n  .WithLabel("change", "by-label")\n  .Then(() => Log.info("CM with label \'change=by-label\' was deleted."));\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   CAPABILITY ACTION (CM Example 4)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This Capability Action show how you can use the `Then()` function to make multiple changes to the\n * same object from different functions. This is useful if you want to keep your Capability Actions\n * small and focused on a single task, or if you want to reuse the same function in multiple\n * Capability Actions.\n *\n * Note that the order of the `.Then()` calls matters. The first call will be executed first,\n * then the second, and so on. Also note the functions are not called until the Capability Action\n * is triggered.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-4")\n  .Then(cm => cm.SetLabel("pepr.dev/first", "true"))\n  .Then(addSecond)\n  .Then(addThird);\n\n//This function uses the complete type definition, but is not required.\nfunction addSecond(cm: PeprRequest<a.ConfigMap>) {\n  cm.SetLabel("pepr.dev/second", "true");\n}\n\n// This function has no type definition, so you won\'t have intellisense in the function body.\nfunction addThird(cm) {\n  cm.SetLabel("pepr.dev/third", "true");\n}\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   CAPABILITY ACTION (CM Example 4a)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This is the same as Example 4, except this only operates on a CM in the `pepr-demo-2` namespace.\n * Note because the Capability defines namespaces, the namespace specified here must be one of those.\n * Alternatively, you can remove the namespace from the Capability definition and specify it here.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .InNamespace("pepr-demo-2")\n  .WithName("example-4a")\n  .Then(cm => cm.SetLabel("pepr.dev/first", "true"))\n  .Then(addSecond)\n  .Then(addThird);\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   CAPABILITY ACTION (CM Example 5)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This Capability Action is a bit more complex. It will look for any ConfigMap in the `pepr-demo`\n * namespace that has the label `chuck-norris` during CREATE. When it finds one, it will fetch a\n * random Chuck Norris joke from the API and add it to the ConfigMap. This is a great example of how\n * you can use Pepr to make changes to your K8s objects based on external data.\n *\n * Note the use of the `async` keyword. This is required for any Capability Action that uses `await` or `fetch()`.\n *\n * Also note we are passing a type to the `fetch()` function. This is optional, but it will help you\n * avoid mistakes when working with the data returned from the API. You can also use the `as` keyword to\n * cast the data returned from the API.\n *\n * These are equivalent:\n * ```ts\n * const joke = await fetch<TheChuckNorrisJoke>("https://api.chucknorris.io/jokes/random?category=dev");\n * const joke = await fetch("https://api.chucknorris.io/jokes/random?category=dev") as TheChuckNorrisJoke;\n * ```\n *\n * Alternatively, you can drop the type completely:\n *\n * ```ts\n * fetch("https://api.chucknorris.io/jokes/random?category=dev")\n * ```\n */\ninterface TheChuckNorrisJoke {\n  icon_url: string;\n  id: string;\n  url: string;\n  value: string;\n}\n\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithLabel("chuck-norris")\n  .Then(async change => {\n    // Try/catch is not needed as a response object will always be returned\n    const response = await fetch<TheChuckNorrisJoke>(\n      "https://api.chucknorris.io/jokes/random?category=dev"\n    );\n\n    // Instead, check the `response.ok` field\n    if (response.ok) {\n      // Add the Chuck Norris joke to the configmap\n      change.Raw.data["chuck-says"] = response.data.value;\n      return;\n    }\n\n    // You can also assert on different HTTP response codes\n    if (response.status === fetchStatus.NOT_FOUND) {\n      // Do something else\n      return;\n    }\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   CAPABILITY ACTION (Secret Base64 Handling)                      *\n * ---------------------------------------------------------------------------------------------------\n *\n * The K8s JS client provides incomplete support for base64 encoding/decoding handling for secrets,\n * unlike the GO client. To make this less painful, Pepr automatically handles base64 encoding/decoding\n * secret data before and after the Capability Action is executed.\n */\nWhen(a.Secret)\n  .IsCreated()\n  .WithName("secret-1")\n  .Then(request => {\n    const secret = request.Raw;\n\n    // This will be encoded at the end of all processing back to base64: "Y2hhbmdlLXdpdGhvdXQtZW5jb2Rpbmc="\n    secret.data.magic = "change-without-encoding";\n\n    // You can modify the data directly, and it will be encoded at the end of all processing\n    secret.data.example += " - modified by Pepr";\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   CAPABILITY ACTION (Untyped Custom Resource)                     *\n * ---------------------------------------------------------------------------------------------------\n *\n * Out of the box, Pepr supports all the standard Kubernetes objects. However, you can also create\n * your own types. This is useful if you are working with an Operator that creates custom resources.\n * There are two ways to do this, the first is to use the `When()` function with a `GenericKind`,\n * the second is to create a new class that extends `GenericKind` and use the `RegisterKind()` function.\n *\n * This example shows how to use the `When()` function with a `GenericKind`. Note that you\n * must specify the `group`, `version`, and `kind` of the object (if applicable). This is how Pepr knows\n * if the Capability Action should be triggered or not. Since we are using a `GenericKind`,\n * Pepr will not be able to provide any intellisense for the object, so you will need to refer to the\n * Kubernetes API documentation for the object you are working with.\n *\n * You will need to wait for the CRD in `hello-pepr.samples.yaml` to be created, then you can apply\n *\n * ```yaml\n * apiVersion: pepr.dev/v1\n * kind: Unicorn\n * metadata:\n *   name: example-1\n *   namespace: pepr-demo\n * spec:\n *   message: replace-me\n *   counter: 0\n * ```\n */\nWhen(a.GenericKind, {\n  group: "pepr.dev",\n  version: "v1",\n  kind: "Unicorn",\n})\n  .IsCreated()\n  .WithName("example-1")\n  .ThenSet({\n    spec: {\n      message: "Hello Pepr without type data!",\n      counter: Math.random(),\n    },\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   CAPABILITY ACTION (Typed Custom Resource)                       *\n * ---------------------------------------------------------------------------------------------------\n *\n * This example shows how to use the `RegisterKind()` function to create a new type. This is useful\n * if you are working with an Operator that creates custom resources and you want to have intellisense\n * for the object. Note that you must specify the `group`, `version`, and `kind` of the object (if applicable)\n * as this is how Pepr knows if the Capability Action should be triggered or not.\n *\n * Once you register a new Kind with Pepr, you can use the `When()` function with the new Kind. Ideally,\n * you should register custom Kinds at the top of your Capability file or Pepr Module so they are available\n * to all Capability Actions, but we are putting it here for demonstration purposes.\n *\n * You will need to wait for the CRD in `hello-pepr.samples.yaml` to be created, then you can apply\n *\n * ```yaml\n * apiVersion: pepr.dev/v1\n * kind: Unicorn\n * metadata:\n *   name: example-2\n *   namespace: pepr-demo\n * spec:\n *   message: replace-me\n *   counter: 0\n * ```*\n */\nclass UnicornKind extends a.GenericKind {\n  spec: {\n    /**\n     * JSDoc comments can be added to explain more details about the field.\n     *\n     * @example\n     * ```ts\n     * request.Raw.spec.message = "Hello Pepr!";\n     * ```\n     * */\n    message: string;\n    counter: number;\n  };\n}\n\nRegisterKind(UnicornKind, {\n  group: "pepr.dev",\n  version: "v1",\n  kind: "Unicorn",\n});\n\nWhen(UnicornKind)\n  .IsCreated()\n  .WithName("example-2")\n  .ThenSet({\n    spec: {\n      message: "Hello Pepr now with type data!",\n      counter: Math.random(),\n    },\n  });\n';
-var packageJSON = { name: "pepr", description: "Kubernetes application engine", author: "Defense Unicorns", homepage: "https://github.com/defenseunicorns/pepr", license: "Apache-2.0", bin: "dist/cli.js", repository: "defenseunicorns/pepr", engines: { node: ">=18.0.0" }, version: "0.12.2", main: "dist/lib.js", types: "dist/lib.d.ts", scripts: { prebuild: "rm -fr dist/* && node hack/build-template-data.js", build: "tsc && node build.mjs", test: "npm run test:unit && npm run test:e2e", "test:unit": "npm run build && tsc -p tsconfig.tests.json && ava dist/**/*.test.js", "test:e2e": "npm run test:e2e:k3d && npm run test:e2e:build && npm run test:e2e:image && npm run test:e2e:run", "test:e2e:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0'", "test:e2e:build": "npm run build && npm pack", "test:e2e:image": "docker buildx build --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev", "test:e2e:run": "ava hack/e2e.test.mjs --sequential --timeout=2m", "format:check": "eslint src && prettier src --check", "format:fix": "eslint src --fix && prettier src --write" }, dependencies: { "@kubernetes/client-node": "0.18.1", express: "4.18.2", "fast-json-patch": "3.1.1", "http-status-codes": "2.2.0", "node-fetch": "2.6.12", "prom-client": "^14.2.0", ramda: "0.29.0" }, devDependencies: { "@types/eslint": "8.44.1", "@types/express": "4.17.17", "@types/node-fetch": "2.6.4", "@types/node-forge": "1.3.4", "@types/prettier": "2.7.3", "@types/prompts": "2.4.4", "@types/ramda": "0.29.3", "@types/uuid": "9.0.2", ava: "5.3.1", nock: "13.3.2" }, peerDependencies: { "@typescript-eslint/eslint-plugin": "5.59.7", "@typescript-eslint/parser": "5.59.7", commander: "10.0.1", esbuild: "0.17.19", eslint: "8.41.0", "node-forge": "1.3.1", prettier: "2.8.8", prompts: "2.4.2", typescript: "5.0.4", uuid: "9.0.0" }, ava: { failFast: true, verbose: true } };
+var helloPeprTS = 'import {\n  Capability,\n  Log,\n  PeprMutateRequest,\n  RegisterKind,\n  a,\n  fetch,\n  fetchStatus,\n} from "pepr";\n\n/**\n *  The HelloPepr Capability is an example capability to demonstrate some general concepts of Pepr.\n *  To test this capability you run `pepr dev`and then run the following command:\n *  `kubectl apply -f capabilities/hello-pepr.samples.yaml`\n */\nexport const HelloPepr = new Capability({\n  name: "hello-pepr",\n  description: "A simple example capability to show how things work.",\n  namespaces: ["pepr-demo", "pepr-demo-2"],\n});\n\n// Use the \'When\' function to create a new Action\nconst { When } = HelloPepr;\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Namespace)                                   *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action removes the label `remove-me` when a Namespace is created.\n * Note we don\'t need to specify the namespace here, because we\'ve already specified\n * it in the Capability definition above.\n */\nWhen(a.Namespace)\n  .IsCreated()\n  .Mutate(ns => ns.RemoveLabel("remove-me"));\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 1)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This is a single action. They can be in the same file or put imported from other files.\n * In this example, when a ConfigMap is created with the name `example-1`, then add a label and annotation.\n *\n * Equivalent to manually running:\n * `kubectl label configmap example-1 pepr=was-here`\n * `kubectl annotate configmap example-1 pepr.dev=annotations-work-too`\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-1")\n  .Mutate(request => {\n    request\n      .SetLabel("pepr", "was-here")\n      .SetAnnotation("pepr.dev", "annotations-work-too");\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate & Validate Actions (CM Example 2)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This combines 2 different types of actions: \'Mutate\', and \'Validate\'. The order\n * of the actions is required, but each action is optional. In this example, when a ConfigMap is created\n * with the name `example-2`, then add a label and annotation and finally validate that the ConfigMap has the label\n * `pepr`.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-2")\n  .Mutate(request => {\n    // This Mutate Action will mutate the request before it is persisted to the cluster\n\n    // Use `request.Merge()` to merge the new data with the existing data\n    request.Merge({\n      metadata: {\n        labels: {\n          pepr: "was-here",\n        },\n        annotations: {\n          "pepr.dev": "annotations-work-too",\n        },\n      },\n    });\n  })\n  .Validate(request => {\n    // This Validate Action will validate the request before it is persisted to the cluster\n\n    // Approve the request if the ConfigMap has the label \'pepr\'\n    if (request.HasLabel("pepr")) {\n      return request.Approve();\n    }\n\n    // Otherwise, deny the request with an error message (optional)\n    return request.Deny("ConfigMap must have label \'pepr\'");\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 2a)                               *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action shows a simple validation that will deny any ConfigMap that has the\n * annotation `evil`. Note that the `Deny()` function takes an optional second parameter that is a\n * user-defined status code to return.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .Validate(request => {\n    if (request.HasAnnotation("evil")) {\n      return request.Deny("No evil CM annotations allowed.", 400);\n    }\n\n    return request.Approve();\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 3)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action combines different styles. Unlike the previous actions, this one will look\n * for any ConfigMap in the `pepr-demo` namespace that has the label `change=by-label` during either\n * CREATE or UPDATE. Note that all conditions added such as `WithName()`, `WithLabel()`, `InNamespace()`,\n * are ANDs so all conditions must be true for the request to be processed.\n */\nWhen(a.ConfigMap)\n  .IsCreatedOrUpdated()\n  .WithLabel("change", "by-label")\n  .Mutate(request => {\n    // The K8s object e are going to mutate\n    const cm = request.Raw;\n\n    // Get the username and uid of the K8s request\n    const { username, uid } = request.Request.userInfo;\n\n    // Store some data about the request in the configmap\n    cm.data["username"] = username;\n    cm.data["uid"] = uid;\n\n    // You can still mix other ways of making changes too\n    request.SetAnnotation("pepr.dev", "making-waves");\n  });\n\n// This action validates the label `change=by-label` is deleted\nWhen(a.ConfigMap)\n  .IsDeleted()\n  .WithLabel("change", "by-label")\n  .Validate(request => {\n    // Log and then always approve the request\n    Log.info("CM with label \'change=by-label\' was deleted.");\n    return request.Approve();\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 4)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action show how you can use the `Mutate()` function without an inline function.\n * This is useful if you want to keep your actions small and focused on a single task,\n * or if you want to reuse the same function in multiple actions.\n */\nWhen(a.ConfigMap).IsCreated().WithName("example-4").Mutate(example4Cb);\n\n// This function uses the complete type definition, but is not required.\nfunction example4Cb(cm: PeprMutateRequest<a.ConfigMap>) {\n  cm.SetLabel("pepr.dev/first", "true");\n  cm.SetLabel("pepr.dev/second", "true");\n  cm.SetLabel("pepr.dev/third", "true");\n}\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 4a)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This is the same as Example 4, except this only operates on a CM in the `pepr-demo-2` namespace.\n * Note because the Capability defines namespaces, the namespace specified here must be one of those.\n * Alternatively, you can remove the namespace from the Capability definition and specify it here.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .InNamespace("pepr-demo-2")\n  .WithName("example-4a")\n  .Mutate(example4Cb);\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 5)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action is a bit more complex. It will look for any ConfigMap in the `pepr-demo`\n * namespace that has the label `chuck-norris` during CREATE. When it finds one, it will fetch a\n * random Chuck Norris joke from the API and add it to the ConfigMap. This is a great example of how\n * you can use Pepr to make changes to your K8s objects based on external data.\n *\n * Note the use of the `async` keyword. This is required for any action that uses `await` or `fetch()`.\n *\n * Also note we are passing a type to the `fetch()` function. This is optional, but it will help you\n * avoid mistakes when working with the data returned from the API. You can also use the `as` keyword to\n * cast the data returned from the API.\n *\n * These are equivalent:\n * ```ts\n * const joke = await fetch<TheChuckNorrisJoke>("https://api.chucknorris.io/jokes/random?category=dev");\n * const joke = await fetch("https://api.chucknorris.io/jokes/random?category=dev") as TheChuckNorrisJoke;\n * ```\n *\n * Alternatively, you can drop the type completely:\n *\n * ```ts\n * fetch("https://api.chucknorris.io/jokes/random?category=dev")\n * ```\n */\ninterface TheChuckNorrisJoke {\n  icon_url: string;\n  id: string;\n  url: string;\n  value: string;\n}\n\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithLabel("chuck-norris")\n  .Mutate(async change => {\n    // Try/catch is not needed as a response object will always be returned\n    const response = await fetch<TheChuckNorrisJoke>(\n      "https://api.chucknorris.io/jokes/random?category=dev",\n    );\n\n    // Instead, check the `response.ok` field\n    if (response.ok) {\n      // Add the Chuck Norris joke to the configmap\n      change.Raw.data["chuck-says"] = response.data.value;\n      return;\n    }\n\n    // You can also assert on different HTTP response codes\n    if (response.status === fetchStatus.NOT_FOUND) {\n      // Do something else\n      return;\n    }\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Secret Base64 Handling)                      *\n * ---------------------------------------------------------------------------------------------------\n *\n * The K8s JS client provides incomplete support for base64 encoding/decoding handling for secrets,\n * unlike the GO client. To make this less painful, Pepr automatically handles base64 encoding/decoding\n * secret data before and after the action is executed.\n */\nWhen(a.Secret)\n  .IsCreated()\n  .WithName("secret-1")\n  .Mutate(request => {\n    const secret = request.Raw;\n\n    // This will be encoded at the end of all processing back to base64: "Y2hhbmdlLXdpdGhvdXQtZW5jb2Rpbmc="\n    secret.data.magic = "change-without-encoding";\n\n    // You can modify the data directly, and it will be encoded at the end of all processing\n    secret.data.example += " - modified by Pepr";\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Untyped Custom Resource)                     *\n * ---------------------------------------------------------------------------------------------------\n *\n * Out of the box, Pepr supports all the standard Kubernetes objects. However, you can also create\n * your own types. This is useful if you are working with an Operator that creates custom resources.\n * There are two ways to do this, the first is to use the `When()` function with a `GenericKind`,\n * the second is to create a new class that extends `GenericKind` and use the `RegisterKind()` function.\n *\n * This example shows how to use the `When()` function with a `GenericKind`. Note that you\n * must specify the `group`, `version`, and `kind` of the object (if applicable). This is how Pepr knows\n * if the action should be triggered or not. Since we are using a `GenericKind`,\n * Pepr will not be able to provide any intellisense for the object, so you will need to refer to the\n * Kubernetes API documentation for the object you are working with.\n *\n * You will need to wait for the CRD in `hello-pepr.samples.yaml` to be created, then you can apply\n *\n * ```yaml\n * apiVersion: pepr.dev/v1\n * kind: Unicorn\n * metadata:\n *   name: example-1\n *   namespace: pepr-demo\n * spec:\n *   message: replace-me\n *   counter: 0\n * ```\n */\nWhen(a.GenericKind, {\n  group: "pepr.dev",\n  version: "v1",\n  kind: "Unicorn",\n})\n  .IsCreated()\n  .WithName("example-1")\n  .Mutate(request => {\n    request.Merge({\n      spec: {\n        message: "Hello Pepr without type data!",\n        counter: Math.random(),\n      },\n    });\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Typed Custom Resource)                       *\n * ---------------------------------------------------------------------------------------------------\n *\n * This example shows how to use the `RegisterKind()` function to create a new type. This is useful\n * if you are working with an Operator that creates custom resources and you want to have intellisense\n * for the object. Note that you must specify the `group`, `version`, and `kind` of the object (if applicable)\n * as this is how Pepr knows if the action should be triggered or not.\n *\n * Once you register a new Kind with Pepr, you can use the `When()` function with the new Kind. Ideally,\n * you should register custom Kinds at the top of your Capability file or Pepr Module so they are available\n * to all actions, but we are putting it here for demonstration purposes.\n *\n * You will need to wait for the CRD in `hello-pepr.samples.yaml` to be created, then you can apply\n *\n * ```yaml\n * apiVersion: pepr.dev/v1\n * kind: Unicorn\n * metadata:\n *   name: example-2\n *   namespace: pepr-demo\n * spec:\n *   message: replace-me\n *   counter: 0\n * ```*\n */\nclass UnicornKind extends a.GenericKind {\n  spec: {\n    /**\n     * JSDoc comments can be added to explain more details about the field.\n     *\n     * @example\n     * ```ts\n     * request.Raw.spec.message = "Hello Pepr!";\n     * ```\n     * */\n    message: string;\n    counter: number;\n  };\n}\n\nRegisterKind(UnicornKind, {\n  group: "pepr.dev",\n  version: "v1",\n  kind: "Unicorn",\n});\n\nWhen(UnicornKind)\n  .IsCreated()\n  .WithName("example-2")\n  .Mutate(request => {\n    request.Merge({\n      spec: {\n        message: "Hello Pepr with type data!",\n        counter: Math.random(),\n      },\n    });\n  });\n';
+var packageJSON = { name: "pepr", description: "Kubernetes application engine", author: "Defense Unicorns", homepage: "https://github.com/defenseunicorns/pepr", license: "Apache-2.0", bin: "dist/cli.js", repository: "defenseunicorns/pepr", engines: { node: ">=18.0.0" }, version: "0.13.0", main: "dist/lib.js", types: "dist/lib.d.ts", scripts: { prebuild: "rm -fr dist/* && node hack/build-template-data.js", build: "tsc && node build.mjs", test: "npm run test:unit && npm run test:e2e", "test:unit": "npm run build && tsc -p tsconfig.tests.json && ava dist/**/*.test.js", "test:e2e": "npm run test:e2e:k3d && npm run test:e2e:build && npm run test:e2e:image && npm run test:e2e:run", "test:e2e:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0'", "test:e2e:build": "npm run build && npm pack", "test:e2e:image": "docker buildx build --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev", "test:e2e:run": "ava hack/e2e.test.mjs --sequential --timeout=2m", "format:check": "eslint src && prettier src --check", "format:fix": "eslint src --fix && prettier src --write" }, dependencies: { "@kubernetes/client-node": "0.18.1", express: "4.18.2", "fast-json-patch": "3.1.1", "http-status-codes": "2.2.0", "node-fetch": "2.7.0", pino: "8.15.0", "pino-pretty": "10.2.0", "prom-client": "14.2.0", ramda: "0.29.0" }, devDependencies: { "@types/eslint": "8.44.2", "@types/express": "4.17.17", "@types/node": "18.x.x", "@types/node-fetch": "2.6.4", "@types/node-forge": "1.3.4", "@types/prettier": "3.0.0", "@types/prompts": "2.4.4", "@types/ramda": "0.29.3", "@types/uuid": "9.0.2", ava: "5.3.1", nock: "13.3.2" }, peerDependencies: { "@typescript-eslint/eslint-plugin": "6.4.0", "@typescript-eslint/parser": "6.4.0", commander: "11.0.0", esbuild: "0.19.2", eslint: "8.47.0", "node-forge": "1.3.1", prettier: "3.0.1", prompts: "2.4.2", typescript: "5.1.6", uuid: "9.0.0" }, ava: { failFast: true, verbose: true } };
 
 // src/cli/init/templates/pepr.code-snippets.json
 var pepr_code_snippets_default = {
@@ -993,13 +983,13 @@ var pepr_code_snippets_default = {
       "	namespaces: [${2:}],",
       "});",
       "",
-      "// Use the 'When' function to create a new Capability Action",
+      "// Use the 'When' function to create a new action",
       "const { When } = ${TM_FILENAME_BASE/(.*)/${1:/pascalcase}/};",
       "",
       "// When(a.<Kind>).Is<Event>().Then(change => change.<changes>",
       "When(${3:})"
     ],
-    description: "Creates a new Pepr capability with a specified description, and optional namespaces, and adds a When statement for the specified value."
+    description: "Creates a new Pepr capability with a specified description, optional namespaces, and adds a When statement for the specified value."
   }
 };
 
@@ -1025,7 +1015,7 @@ var tsconfig_module_default = {
 };
 
 // src/cli/init/utils.ts
-var import_fs2 = require("fs");
+var import_fs3 = require("fs");
 function sanitizeName(name) {
   let sanitized = name.toLowerCase().replace(/[^a-z0-9-]+/gi, "-");
   sanitized = sanitized.replace(/^-+|-+$/g, "");
@@ -1034,7 +1024,7 @@ function sanitizeName(name) {
 }
 async function createDir(dir) {
   try {
-    await import_fs2.promises.mkdir(dir);
+    await import_fs3.promises.mkdir(dir);
   } catch (err) {
     if (err && err.code === "EEXIST") {
       throw new Error(`Directory ${dir} already exists`);
@@ -1047,7 +1037,7 @@ function write(path, data) {
   if (typeof data !== "string") {
     data = JSON.stringify(data, null, 2);
   }
-  return import_fs2.promises.writeFile(path, data);
+  return import_fs3.promises.writeFile(path, data);
 }
 
 // src/cli/init/templates.ts
@@ -1109,7 +1099,7 @@ var gitignore = {
 };
 var samplesYaml = {
   path: "hello-pepr.samples.yaml",
-  data: hello_pepr_samples_default.map((r) => (0, import_client_node2.dumpYaml)(r, { noRefs: true })).join("---\n")
+  data: hello_pepr_samples_default.map((r) => (0, import_client_node3.dumpYaml)(r, { noRefs: true })).join("---\n")
 };
 var snippet = {
   path: "pepr.code-snippets",
@@ -1138,23 +1128,26 @@ function build_default(program2) {
   ).action(async (opts) => {
     const { cfg, path, uuid } = await buildModule(void 0, opts.entryPoint);
     if (opts.entryPoint !== peprTS2) {
-      logger_default.info(`Module built successfully at ${path}`);
+      console.info(`\u2705 Module built successfully at ${path}`);
       return;
     }
-    const webhook = new Webhook({
-      ...cfg.pepr,
-      appVersion: cfg.version,
-      description: cfg.description
-    });
+    const assets = new Assets(
+      {
+        ...cfg.pepr,
+        appVersion: cfg.version,
+        description: cfg.description
+      },
+      path
+    );
     const yamlFile = `pepr-module-${uuid}.yaml`;
     const yamlPath = (0, import_path.resolve)("dist", yamlFile);
-    const yaml = await webhook.allYaml(path);
+    const yaml = await assets.allYaml();
     const zarfPath = (0, import_path.resolve)("dist", "zarf.yaml");
-    const zarf = webhook.zarfYaml(yamlFile);
-    await import_fs3.promises.writeFile(yamlPath, yaml);
-    await import_fs3.promises.writeFile(zarfPath, zarf);
+    const zarf = assets.zarfYaml(yamlFile);
+    await import_fs4.promises.writeFile(yamlPath, yaml);
+    await import_fs4.promises.writeFile(zarfPath, zarf);
     logger_default.debug(`Module compiled successfully at ${path}`);
-    logger_default.info(`K8s resource for the module saved to ${yamlPath}`);
+    console.info(`\u2705 K8s resource for the module saved to ${yamlPath}`);
   });
 }
 var externalLibs = Object.keys(dependencies);
@@ -1163,15 +1156,15 @@ async function loadModule(entryPoint = peprTS2) {
   const cfgPath = (0, import_path.resolve)(".", "package.json");
   const input = (0, import_path.resolve)(".", entryPoint);
   try {
-    await import_fs3.promises.access(cfgPath);
-    await import_fs3.promises.access(input);
+    await import_fs4.promises.access(cfgPath);
+    await import_fs4.promises.access(input);
   } catch (e) {
-    logger_default.error(
+    console.error(
       `Could not find ${cfgPath} or ${input} in the current directory. Please run this command from the root of your module's directory.`
     );
     process.exit(1);
   }
-  const moduleText = await import_fs3.promises.readFile(cfgPath, { encoding: "utf-8" });
+  const moduleText = await import_fs4.promises.readFile(cfgPath, { encoding: "utf-8" });
   const cfg = JSON.parse(moduleText);
   const { uuid } = cfg.pepr;
   const name = `pepr-${uuid}.js`;
@@ -1249,7 +1242,7 @@ async function buildModule(reloader, entryPoint = peprTS2) {
         out.matchAll(pgkErrMatch);
         const conflicts = [...out.matchAll(pgkErrMatch)];
         if (conflicts.length < 1) {
-          logger_default.error(
+          console.warn(
             `
 	One or more imported Pepr Capabilities seem to be using an incompatible version of Pepr.
 	Try updating your Pepr Capabilities to their latest versions.`,
@@ -1257,7 +1250,7 @@ async function buildModule(reloader, entryPoint = peprTS2) {
           );
         }
         conflicts.forEach((match) => {
-          logger_default.error(
+          console.warn(
             `
 	Package '${match[1]}' seems to be incompatible with your current version of Pepr.
 	Try updating to the latest version.`,
@@ -1285,18 +1278,21 @@ function deploy_default(program2) {
       }
     }
     const { cfg, path } = await buildModule();
-    const webhook = new Webhook({
-      ...cfg.pepr,
-      description: cfg.description
-    });
+    const webhook = new Assets(
+      {
+        ...cfg.pepr,
+        description: cfg.description
+      },
+      path
+    );
     if (opts.image) {
       webhook.image = opts.image;
     }
     try {
-      await webhook.deploy(path);
-      logger_default.info(`Module deployed successfully`);
+      await webhook.deploy();
+      console.info(`\u2705 Module deployed successfully`);
     } catch (e) {
-      logger_default.error(`Error deploying module: ${e}`);
+      console.error(`Error deploying module: ${e}`);
       process.exit(1);
     }
   });
@@ -1304,7 +1300,7 @@ function deploy_default(program2) {
 
 // src/cli/dev.ts
 var import_child_process3 = require("child_process");
-var import_fs4 = require("fs");
+var import_fs5 = require("fs");
 var import_prompts2 = __toESM(require("prompts"));
 function dev_default(program2) {
   program2.command("dev").description("Setup a local webhook development environment").option("-h, --host [host]", "Host to listen on", "host.k3d.internal").option("--confirm", "Skip confirmation prompt").action(async (opts) => {
@@ -1319,25 +1315,27 @@ function dev_default(program2) {
       }
     }
     const { cfg, path } = await loadModule();
-    const webhook = new Webhook(
+    const webhook = new Assets(
       {
         ...cfg.pepr,
         description: cfg.description
       },
+      path,
       opts.host
     );
-    await import_fs4.promises.writeFile("insecure-tls.crt", webhook.tls.pem.crt);
-    await import_fs4.promises.writeFile("insecure-tls.key", webhook.tls.pem.key);
+    await import_fs5.promises.writeFile("insecure-tls.crt", webhook.tls.pem.crt);
+    await import_fs5.promises.writeFile("insecure-tls.key", webhook.tls.pem.key);
     try {
       let program3;
       const runFork = async () => {
-        logger_default.info(`Running module ${path}`);
-        await webhook.deploy(path, 30);
+        console.info(`Running module ${path}`);
+        await webhook.deploy(30);
         program3 = (0, import_child_process3.fork)(path, {
           env: {
             ...process.env,
             LOG_LEVEL: "debug",
             PEPR_API_TOKEN: webhook.apiToken,
+            PEPR_PRETTY_LOGS: "true",
             SSL_KEY_PATH: "insecure-tls.key",
             SSL_CERT_PATH: "insecure-tls.crt"
           }
@@ -1345,7 +1343,7 @@ function dev_default(program2) {
       };
       await buildModule(async (r) => {
         if (r.errors.length > 0) {
-          logger_default.error(`Error compiling module: ${r.errors}`);
+          console.error(`Error compiling module: ${r.errors}`);
           return;
         }
         if (program3) {
@@ -1356,7 +1354,7 @@ function dev_default(program2) {
         }
       });
     } catch (e) {
-      logger_default.error(`Error deploying module: ${e}`);
+      console.error(`Error deploying module: ${e}`);
       process.exit(1);
     }
   });
@@ -1364,7 +1362,7 @@ function dev_default(program2) {
 
 // src/cli/format.ts
 var import_eslint = require("eslint");
-var import_fs5 = require("fs");
+var import_fs6 = require("fs");
 var import_prettier = require("prettier");
 function format_default(program2) {
   program2.command("format").description("Lint and format this Pepr module").option("-v, --validate-only", "Do not modify files, only validate formatting").action(async (opts) => {
@@ -1387,25 +1385,25 @@ function format_default(program2) {
         await import_eslint.ESLint.outputFixes(results);
       }
       for (const { filePath } of results) {
-        const content = await import_fs5.promises.readFile(filePath, "utf8");
+        const content = await import_fs6.promises.readFile(filePath, "utf8");
         const cfg = await (0, import_prettier.resolveConfig)(filePath);
-        const formatted = (0, import_prettier.format)(content, { filepath: filePath, ...cfg });
+        const formatted = await (0, import_prettier.format)(content, { filepath: filePath, ...cfg });
         if (opts.validateOnly) {
           if (formatted !== content) {
             hasFailure = true;
-            logger_default.error(`File ${filePath} is not formatted correctly`);
+            console.error(`File ${filePath} is not formatted correctly`);
           }
         } else {
-          await import_fs5.promises.writeFile(filePath, formatted);
+          await import_fs6.promises.writeFile(filePath, formatted);
         }
       }
       if (opts.validateOnly && hasFailure) {
         process.exit(1);
       }
-      logger_default.info("Module formatted");
+      console.info("\u2705 Module formatted");
     } catch (e) {
       logger_default.debug(e);
-      logger_default.error(e.message);
+      console.error(e.message);
       process.exit(1);
     }
   });
@@ -1417,7 +1415,7 @@ var import_path2 = require("path");
 var import_prompts4 = __toESM(require("prompts"));
 
 // src/cli/init/walkthrough.ts
-var import_fs6 = require("fs");
+var import_fs7 = require("fs");
 var import_prompts3 = __toESM(require("prompts"));
 function walkthrough() {
   const askName = {
@@ -1427,7 +1425,7 @@ function walkthrough() {
     validate: async (val) => {
       try {
         const name = sanitizeName(val);
-        await import_fs6.promises.access(name, import_fs6.promises.constants.F_OK);
+        await import_fs7.promises.access(name, import_fs7.promises.constants.F_OK);
         return "A directory with this name already exists";
       } catch (e) {
         return val.length > 2 || "The name must be at least 3 characters long";
@@ -1442,23 +1440,22 @@ function walkthrough() {
   const askErrorBehavior = {
     type: "select",
     name: "errorBehavior",
-    validate: (val) => ErrorBehavior[val],
     message: "How do you want Pepr to handle errors encountered during K8s operations?",
     choices: [
       {
         title: "Ignore",
-        value: "ignore" /* ignore */,
+        value: "ignore",
         description: "Pepr will continue processing and generate an entry in the Pepr Controller log.",
         selected: true
       },
       {
         title: "Log an audit event",
-        value: "audit" /* audit */,
+        value: "audit",
         description: "Pepr will continue processing and generate an entry in the Pepr Controller log as well as an audit event in the cluster."
       },
       {
         title: "Reject the operation",
-        value: "reject" /* reject */,
+        value: "reject",
         description: "Pepr will reject the operation and return an error to the client."
       }
     ]
@@ -1537,9 +1534,8 @@ function init_default(program2) {
         console.log(`New Pepr module created at ${dirName}`);
         console.log(`Open VSCode or your editor of choice in ${dirName} to get started!`);
       } catch (e) {
-        logger_default.debug(e);
         if (e instanceof Error) {
-          logger_default.error(e.message);
+          console.error(e.message);
         }
         process.exit(1);
       }
@@ -1554,7 +1550,7 @@ var RootCmd = class extends import_commander.Command {
     const cmd = new import_commander.Command(name);
     cmd.option("-l, --log-level [level]", "Log level: debug, info, warn, error", "info");
     cmd.hook("preAction", (run) => {
-      logger_default.SetLogLevel(run.opts().logLevel);
+      logger_default.level = run.opts().logLevel;
     });
     return cmd;
   }
@@ -1562,7 +1558,7 @@ var RootCmd = class extends import_commander.Command {
 
 // src/cli/update.ts
 var import_child_process5 = require("child_process");
-var import_fs7 = __toESM(require("fs"));
+var import_fs8 = __toESM(require("fs"));
 var import_path3 = require("path");
 var import_prompts5 = __toESM(require("prompts"));
 function update_default(program2) {
@@ -1587,11 +1583,11 @@ function update_default(program2) {
           stdio: "inherit"
         });
       }
-      console.log(`Module updated!`);
+      console.log(`\u2705 Module updated successfully`);
     } catch (e) {
       logger_default.debug(e);
       if (e instanceof Error) {
-        logger_default.error(e.message);
+        console.error(e.message);
       }
       process.exit(1);
     }
@@ -1604,59 +1600,28 @@ function update_default(program2) {
         await write((0, import_path3.resolve)(tsConfig.path), tsConfig.data);
         await write((0, import_path3.resolve)(".vscode", snippet.path), snippet.data);
         const samplePath = (0, import_path3.resolve)("capabilities", samplesYaml.path);
-        if (import_fs7.default.existsSync(samplePath)) {
-          import_fs7.default.unlinkSync(samplePath);
+        if (import_fs8.default.existsSync(samplePath)) {
+          import_fs8.default.unlinkSync(samplePath);
           await write(samplePath, samplesYaml.data);
         }
         const tsPath = (0, import_path3.resolve)("capabilities", helloPepr.path);
-        if (import_fs7.default.existsSync(tsPath)) {
+        if (import_fs8.default.existsSync(tsPath)) {
           await write(tsPath, helloPepr.data);
         }
       }
     } catch (e) {
       logger_default.debug(e);
       if (e instanceof Error) {
-        logger_default.error(e.message);
+        console.error(e.message);
       }
       process.exit(1);
     }
   });
 }
 
-// src/lib.ts
-var k8s = __toESM(require("@kubernetes/client-node"));
-var import_http_status_codes2 = require("http-status-codes");
-var R = __toESM(require("ramda"));
-
-// src/lib/k8s/upstream.ts
-var import_client_node3 = require("@kubernetes/client-node");
-
-// src/lib/fetch.ts
-var import_http_status_codes = require("http-status-codes");
-var import_node_fetch = __toESM(require("node-fetch"));
-
-// src/lib/module.ts
-var import_ramda3 = require("ramda");
-
-// src/lib/controller.ts
-var import_express = __toESM(require("express"));
-
-// src/lib/processor.ts
-var import_fast_json_patch = __toESM(require("fast-json-patch"));
-
-// src/lib/request.ts
-var import_ramda2 = require("ramda");
-
-// src/lib/metrics.ts
-var import_prom_client = __toESM(require("prom-client"));
-
 // src/cli.ts
 if (process.env.npm_lifecycle_event !== "npx") {
-  logger_default.error(
-    "Pepr should be run via `npx pepr <command>` instead of `pepr <command>`.",
-    "npx required"
-  );
-  process.exit(1);
+  console.warn("Pepr should be run via `npx pepr <command>` instead of `pepr <command>`.");
 }
 var program = new RootCmd();
 program.version(version).description(`Pepr (v${version}) - Type safe K8s middleware for humans`).action(() => {
@@ -1664,7 +1629,7 @@ program.version(version).description(`Pepr (v${version}) - Type safe K8s middlew
     console.log(banner);
     program.help();
   } else {
-    logger_default.error(`Invalid command '${program.args.join(" ")}'
+    console.error(`Invalid command '${program.args.join(" ")}'
 `);
     program.outputHelp();
     process.exitCode = 1;