pepr 0.14.1 → 0.15.0

package/dist/cli.js

@@ -106,9 +106,25 @@ var banner = `\x1B[0m\x1B[38;2;96;96;96m \x1B[0m\x1B[38;2;96;96;96m \x1B[0m\x1B[
 // src/cli/build.ts
 var import_child_process2 = require("child_process");
 var import_esbuild = require("esbuild");
-var import_fs5 = require("fs");
+var import_fs6 = require("fs");
 var import_path = require("path");
 
+// src/lib/included-files.ts
+var import_fs = require("fs");
+async function createDockerfile(version3, description, includedFiles) {
+  const file = `
+    # Use an official Node.js runtime as the base image
+    FROM ghcr.io/defenseunicorns/pepr/controller:v${version3}
+  
+    LABEL description="${description}"
+    
+    # Add the included files to the image
+    ${includedFiles.map((f) => `ADD ${f} ${f}`).join("\n")}
+  
+    `;
+  await import_fs.promises.writeFile("Dockerfile.controller", file, { encoding: "utf-8" });
+}
+
 // src/lib/assets/index.ts
 var import_crypto3 = __toESM(require("crypto"));
 
@@ -171,7 +187,7 @@ function genCert(key, name2, issuer) {
 
 // src/lib/assets/deploy.ts
 var import_crypto = __toESM(require("crypto"));
-var import_fs = require("fs");
+var import_fs2 = require("fs");
 var import_kubernetes_fluent_client2 = require("kubernetes-fluent-client");
 
 // src/lib/logger.ts
@@ -513,15 +529,45 @@ function moduleSecret(name2, data, hash) {
   };
 }
 
+// src/lib/helpers.ts
+var createRBACMap = (capabilities) => {
+  return capabilities.reduce((acc, capability) => {
+    capability.bindings.forEach((binding) => {
+      const key = `${binding.kind.group}/${binding.kind.version}/${binding.kind.kind}`;
+      acc["pepr.dev/v1/peprstore"] = {
+        verbs: ["create", "get", "patch", "watch"],
+        plural: "peprstores"
+      };
+      if (!acc[key] && binding.isWatch) {
+        acc[key] = {
+          verbs: ["watch"],
+          plural: binding.kind.plural || `${binding.kind.kind.toLowerCase()}s`
+        };
+      }
+    });
+    return acc;
+  }, {});
+};
+
 // src/lib/assets/rbac.ts
-function clusterRole(name2) {
+function clusterRole(name2, capabilities, rbacMode = "") {
+  const rbacMap = createRBACMap(capabilities);
   return {
     apiVersion: "rbac.authorization.k8s.io/v1",
     kind: "ClusterRole",
     metadata: { name: name2 },
-    rules: [
+    rules: rbacMode === "scoped" ? [
+      ...Object.keys(rbacMap).map((key) => {
+        let group2;
+        key.split("/").length < 3 ? group2 = "" : group2 = key.split("/")[0];
+        return {
+          apiGroups: [group2],
+          resources: [rbacMap[key].plural],
+          verbs: rbacMap[key].verbs
+        };
+      })
+    ] : [
       {
-        // @todo: make this configurable
         apiGroups: ["*"],
         resources: ["*"],
         verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
@@ -566,7 +612,7 @@ function storeRole(name2) {
     metadata: { name: name2, namespace: "pepr-system" },
     rules: [
       {
-        apiGroups: ["pepr.dev/*"],
+        apiGroups: ["pepr.dev"],
         resources: ["peprstores"],
         resourceNames: [""],
         verbs: ["create", "get", "patch", "watch"]
@@ -769,21 +815,21 @@ async function deploy(assets, webhookTimeout) {
   if (host) {
     return;
   }
-  const code = await import_fs.promises.readFile(path);
+  const code = await import_fs2.promises.readFile(path);
   const hash = import_crypto.default.createHash("sha256").update(code).digest("hex");
   if (code.length < 1) {
     throw new Error("No code provided");
   }
-  await setupRBAC(name2);
+  await setupRBAC(name2, assets.capabilities);
   await setupController(assets, code, hash);
   await setupWatcher(assets, hash);
 }
-async function setupRBAC(name2) {
+async function setupRBAC(name2, capabilities) {
   logger_default.info("Applying cluster role binding");
   const crb = clusterRoleBinding(name2);
   await (0, import_kubernetes_fluent_client2.K8s)(import_kubernetes_fluent_client2.kind.ClusterRoleBinding).Apply(crb);
   logger_default.info("Applying cluster role");
-  const cr = clusterRole(name2);
+  const cr = clusterRole(name2, capabilities);
   await (0, import_kubernetes_fluent_client2.K8s)(import_kubernetes_fluent_client2.kind.ClusterRole).Apply(cr);
   logger_default.info("Applying service account");
   const sa = serviceAccount(name2);
@@ -851,7 +897,7 @@ function loadCapabilities(path) {
 // src/lib/assets/yaml.ts
 var import_client_node = require("@kubernetes/client-node");
 var import_crypto2 = __toESM(require("crypto"));
-var import_fs2 = require("fs");
+var import_fs3 = require("fs");
 function zarfYaml({ name: name2, image, config }, path) {
   const zarfCfg = {
     kind: "ZarfPackageConfig",
@@ -878,16 +924,16 @@ function zarfYaml({ name: name2, image, config }, path) {
   };
   return (0, import_client_node.dumpYaml)(zarfCfg, { noRefs: true });
 }
-async function allYaml(assets) {
+async function allYaml(assets, rbacMode) {
   const { name: name2, tls, apiToken, path } = assets;
-  const code = await import_fs2.promises.readFile(path);
+  const code = await import_fs3.promises.readFile(path);
   const hash = import_crypto2.default.createHash("sha256").update(code).digest("hex");
   const mutateWebhook = await webhookConfig(assets, "mutate");
   const validateWebhook = await webhookConfig(assets, "validate");
   const watchDeployment = watcher(assets, hash);
   const resources = [
     namespace,
-    clusterRole(name2),
+    clusterRole(name2, assets.capabilities, rbacMode),
     clusterRoleBinding(name2),
     serviceAccount(name2),
     apiTokenSecret(name2, apiToken),
@@ -933,9 +979,9 @@ var Assets = class {
     await deploy(this, webhookTimeout);
   };
   zarfYaml = (path) => zarfYaml(this, path);
-  allYaml = async () => {
+  allYaml = async (rbacMode) => {
     this.capabilities = await loadCapabilities(this.path);
-    return allYaml(this);
+    return allYaml(this, rbacMode);
   };
 };
 
@@ -1145,8 +1191,8 @@ var hello_pepr_samples_default = [
 var gitIgnore = "# Ignore node_modules and Pepr build artifacts\nnode_modules\ndist\ninsecure*\n";
 var readmeMd = '# Pepr Module\n\nThis is a Pepr Module. [Pepr](https://github.com/defenseunicorns/pepr) is a type-safe Kubernetes middleware system.\n\nThe `capabilities` directory contains all the capabilities for this module. By default,\na capability is a single typescript file in the format of `capability-name.ts` that is\nimported in the root `pepr.ts` file as `import { HelloPepr } from "./capabilities/hello-pepr";`.\nBecause this is typescript, you can organize this however you choose, e.g. creating a sub-folder\nper-capability or common logic in shared files or folders.\n\nExample Structure:\n\n```\nModule Root\n\u251C\u2500\u2500 package.json\n\u251C\u2500\u2500 pepr.ts\n\u2514\u2500\u2500 capabilities\n    \u251C\u2500\u2500 example-one.ts\n    \u251C\u2500\u2500 example-three.ts\n    \u2514\u2500\u2500 example-two.ts\n```\n';
 var peprTS = 'import { PeprModule } from "pepr";\n// cfg loads your pepr configuration from package.json\nimport cfg from "./package.json";\n\n// HelloPepr is a demo capability that is included with Pepr. Comment or delete the line below to remove it.\nimport { HelloPepr } from "./capabilities/hello-pepr";\n\n/**\n * This is the main entrypoint for this Pepr module. It is run when the module is started.\n * This is where you register your Pepr configurations and capabilities.\n */\nnew PeprModule(cfg, [\n  // "HelloPepr" is a demo capability that is included with Pepr. Comment or delete the line below to remove it.\n  HelloPepr,\n\n  // Your additional capabilities go here\n]);\n';
-var helloPeprTS = 'import {\n  Capability,\n  K8s,\n  Log,\n  PeprMutateRequest,\n  RegisterKind,\n  a,\n  fetch,\n  fetchStatus,\n  kind,\n} from "pepr";\n\n/**\n *  The HelloPepr Capability is an example capability to demonstrate some general concepts of Pepr.\n *  To test this capability you run `pepr dev`and then run the following command:\n *  `kubectl apply -f capabilities/hello-pepr.samples.yaml`\n */\nexport const HelloPepr = new Capability({\n  name: "hello-pepr",\n  description: "A simple example capability to show how things work.",\n  namespaces: ["pepr-demo", "pepr-demo-2"],\n});\n\n// Use the \'When\' function to create a new action, use \'Store\' to persist data\nconst { When, Store } = HelloPepr;\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Namespace)                                   *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action removes the label `remove-me` when a Namespace is created.\n * Note we don\'t need to specify the namespace here, because we\'ve already specified\n * it in the Capability definition above.\n */\nWhen(a.Namespace)\n  .IsCreated()\n  .Mutate(ns => ns.RemoveLabel("remove-me"));\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Watch Action with K8s SSA (Namespace)                           *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action watches for the `pepr-demo-2` namespace to be created, then creates a ConfigMap with\n * the name `pepr-ssa-demo` and adds the namespace UID to the ConfigMap data. Because Pepr uses\n * server-side apply for this operation, the ConfigMap will be created or updated if it already exists.\n */\nWhen(a.Namespace)\n  .IsCreated()\n  .WithName("pepr-demo-2")\n  .Watch(async ns => {\n    Log.info("Namespace pepr-demo-2 was created.");\n\n    // You can share data between actions using the Store, including between different types of actions\n    Store.setItem("watch-data", "This data was stored by a Watch Action.");\n\n    // Apply the ConfigMap using K8s server-side apply\n    await K8s(kind.ConfigMap).Apply({\n      metadata: {\n        name: "pepr-ssa-demo",\n        namespace: "pepr-demo-2",\n      },\n      data: {\n        "ns-uid": ns.metadata.uid,\n      },\n    });\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 1)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This is a single action. They can be in the same file or put imported from other files.\n * In this example, when a ConfigMap is created with the name `example-1`, then add a label and annotation.\n *\n * Equivalent to manually running:\n * `kubectl label configmap example-1 pepr=was-here`\n * `kubectl annotate configmap example-1 pepr.dev=annotations-work-too`\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-1")\n  .Mutate(request => {\n    request\n      .SetLabel("pepr", "was-here")\n      .SetAnnotation("pepr.dev", "annotations-work-too");\n\n    // Use the Store to persist data between requests and Pepr controller pods\n    Store.setItem("example-1", "was-here");\n\n    // This data is written asynchronously and can be read back via `Store.getItem()` or `Store.subscribe()`\n    Store.setItem("example-1-data", JSON.stringify(request.Raw.data));\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate & Validate Actions (CM Example 2)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This combines 3 different types of actions: \'Mutate\', \'Validate\', and \'Watch\'. The order\n * of the actions is required, but each action is optional. In this example, when a ConfigMap is created\n * with the name `example-2`, then add a label and annotation, validate that the ConfigMap has the label\n * `pepr`, and log the request.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-2")\n  .Mutate(request => {\n    // This Mutate Action will mutate the request before it is persisted to the cluster\n\n    // Use `request.Merge()` to merge the new data with the existing data\n    request.Merge({\n      metadata: {\n        labels: {\n          pepr: "was-here",\n        },\n        annotations: {\n          "pepr.dev": "annotations-work-too",\n        },\n      },\n    });\n  })\n  .Validate(request => {\n    // This Validate Action will validate the request before it is persisted to the cluster\n\n    // Approve the request if the ConfigMap has the label \'pepr\'\n    if (request.HasLabel("pepr")) {\n      return request.Approve();\n    }\n\n    // Otherwise, deny the request with an error message (optional)\n    return request.Deny("ConfigMap must have label \'pepr\'");\n  })\n  .Watch((cm, phase) => {\n    // This Watch Action will watch the ConfigMap after it has been persisted to the cluster\n    Log.info(cm, `ConfigMap was ${phase} with the name example-2`);\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 2a)                               *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action shows a simple validation that will deny any ConfigMap that has the\n * annotation `evil`. Note that the `Deny()` function takes an optional second parameter that is a\n * user-defined status code to return.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .Validate(request => {\n    if (request.HasAnnotation("evil")) {\n      return request.Deny("No evil CM annotations allowed.", 400);\n    }\n\n    return request.Approve();\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 3)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action combines different styles. Unlike the previous actions, this one will look\n * for any ConfigMap in the `pepr-demo` namespace that has the label `change=by-label` during either\n * CREATE or UPDATE. Note that all conditions added such as `WithName()`, `WithLabel()`, `InNamespace()`,\n * are ANDs so all conditions must be true for the request to be processed.\n */\nWhen(a.ConfigMap)\n  .IsCreatedOrUpdated()\n  .WithLabel("change", "by-label")\n  .Mutate(request => {\n    // The K8s object e are going to mutate\n    const cm = request.Raw;\n\n    // Get the username and uid of the K8s request\n    const { username, uid } = request.Request.userInfo;\n\n    // Store some data about the request in the configmap\n    cm.data["username"] = username;\n    cm.data["uid"] = uid;\n\n    // You can still mix other ways of making changes too\n    request.SetAnnotation("pepr.dev", "making-waves");\n  });\n\n// This action validates the label `change=by-label` is deleted\nWhen(a.ConfigMap)\n  .IsDeleted()\n  .WithLabel("change", "by-label")\n  .Validate(request => {\n    // Log and then always approve the request\n    Log.info("CM with label \'change=by-label\' was deleted.");\n    return request.Approve();\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 4)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action show how you can use the `Mutate()` function without an inline function.\n * This is useful if you want to keep your actions small and focused on a single task,\n * or if you want to reuse the same function in multiple actions.\n */\nWhen(a.ConfigMap).IsCreated().WithName("example-4").Mutate(example4Cb);\n\n// This function uses the complete type definition, but is not required.\nfunction example4Cb(cm: PeprMutateRequest<a.ConfigMap>) {\n  cm.SetLabel("pepr.dev/first", "true");\n  cm.SetLabel("pepr.dev/second", "true");\n  cm.SetLabel("pepr.dev/third", "true");\n}\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 4a)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This is the same as Example 4, except this only operates on a CM in the `pepr-demo-2` namespace.\n * Note because the Capability defines namespaces, the namespace specified here must be one of those.\n * Alternatively, you can remove the namespace from the Capability definition and specify it here.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .InNamespace("pepr-demo-2")\n  .WithName("example-4a")\n  .Mutate(example4Cb);\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 5)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action is a bit more complex. It will look for any ConfigMap in the `pepr-demo`\n * namespace that has the label `chuck-norris` during CREATE. When it finds one, it will fetch a\n * random Chuck Norris joke from the API and add it to the ConfigMap. This is a great example of how\n * you can use Pepr to make changes to your K8s objects based on external data.\n *\n * Note the use of the `async` keyword. This is required for any action that uses `await` or `fetch()`.\n *\n * Also note we are passing a type to the `fetch()` function. This is optional, but it will help you\n * avoid mistakes when working with the data returned from the API. You can also use the `as` keyword to\n * cast the data returned from the API.\n *\n * These are equivalent:\n * ```ts\n * const joke = await fetch<TheChuckNorrisJoke>("https://api.chucknorris.io/jokes/random?category=dev");\n * const joke = await fetch("https://api.chucknorris.io/jokes/random?category=dev") as TheChuckNorrisJoke;\n * ```\n *\n * Alternatively, you can drop the type completely:\n *\n * ```ts\n * fetch("https://api.chucknorris.io/jokes/random?category=dev")\n * ```\n */\ninterface TheChuckNorrisJoke {\n  icon_url: string;\n  id: string;\n  url: string;\n  value: string;\n}\n\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithLabel("chuck-norris")\n  .Mutate(async change => {\n    // Try/catch is not needed as a response object will always be returned\n    const response = await fetch<TheChuckNorrisJoke>(\n      "https://api.chucknorris.io/jokes/random?category=dev",\n    );\n\n    // Instead, check the `response.ok` field\n    if (response.ok) {\n      // Add the Chuck Norris joke to the configmap\n      change.Raw.data["chuck-says"] = response.data.value;\n      return;\n    }\n\n    // You can also assert on different HTTP response codes\n    if (response.status === fetchStatus.NOT_FOUND) {\n      // Do something else\n      return;\n    }\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Secret Base64 Handling)                      *\n * ---------------------------------------------------------------------------------------------------\n *\n * The K8s JS client provides incomplete support for base64 encoding/decoding handling for secrets,\n * unlike the GO client. To make this less painful, Pepr automatically handles base64 encoding/decoding\n * secret data before and after the action is executed.\n */\nWhen(a.Secret)\n  .IsCreated()\n  .WithName("secret-1")\n  .Mutate(request => {\n    const secret = request.Raw;\n\n    // This will be encoded at the end of all processing back to base64: "Y2hhbmdlLXdpdGhvdXQtZW5jb2Rpbmc="\n    secret.data.magic = "change-without-encoding";\n\n    // You can modify the data directly, and it will be encoded at the end of all processing\n    secret.data.example += " - modified by Pepr";\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Untyped Custom Resource)                     *\n * ---------------------------------------------------------------------------------------------------\n *\n * Out of the box, Pepr supports all the standard Kubernetes objects. However, you can also create\n * your own types. This is useful if you are working with an Operator that creates custom resources.\n * There are two ways to do this, the first is to use the `When()` function with a `GenericKind`,\n * the second is to create a new class that extends `GenericKind` and use the `RegisterKind()` function.\n *\n * This example shows how to use the `When()` function with a `GenericKind`. Note that you\n * must specify the `group`, `version`, and `kind` of the object (if applicable). This is how Pepr knows\n * if the action should be triggered or not. Since we are using a `GenericKind`,\n * Pepr will not be able to provide any intellisense for the object, so you will need to refer to the\n * Kubernetes API documentation for the object you are working with.\n *\n * You will need to wait for the CRD in `hello-pepr.samples.yaml` to be created, then you can apply\n *\n * ```yaml\n * apiVersion: pepr.dev/v1\n * kind: Unicorn\n * metadata:\n *   name: example-1\n *   namespace: pepr-demo\n * spec:\n *   message: replace-me\n *   counter: 0\n * ```\n */\nWhen(a.GenericKind, {\n  group: "pepr.dev",\n  version: "v1",\n  kind: "Unicorn",\n})\n  .IsCreated()\n  .WithName("example-1")\n  .Mutate(request => {\n    request.Merge({\n      spec: {\n        message: "Hello Pepr without type data!",\n        counter: Math.random(),\n      },\n    });\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Typed Custom Resource)                       *\n * ---------------------------------------------------------------------------------------------------\n *\n * This example shows how to use the `RegisterKind()` function to create a new type. This is useful\n * if you are working with an Operator that creates custom resources and you want to have intellisense\n * for the object. Note that you must specify the `group`, `version`, and `kind` of the object (if applicable)\n * as this is how Pepr knows if the action should be triggered or not.\n *\n * Once you register a new Kind with Pepr, you can use the `When()` function with the new Kind. Ideally,\n * you should register custom Kinds at the top of your Capability file or Pepr Module so they are available\n * to all actions, but we are putting it here for demonstration purposes.\n *\n * You will need to wait for the CRD in `hello-pepr.samples.yaml` to be created, then you can apply\n *\n * ```yaml\n * apiVersion: pepr.dev/v1\n * kind: Unicorn\n * metadata:\n *   name: example-2\n *   namespace: pepr-demo\n * spec:\n *   message: replace-me\n *   counter: 0\n * ```*\n */\nclass UnicornKind extends a.GenericKind {\n  spec: {\n    /**\n     * JSDoc comments can be added to explain more details about the field.\n     *\n     * @example\n     * ```ts\n     * request.Raw.spec.message = "Hello Pepr!";\n     * ```\n     * */\n    message: string;\n    counter: number;\n  };\n}\n\nRegisterKind(UnicornKind, {\n  group: "pepr.dev",\n  version: "v1",\n  kind: "Unicorn",\n});\n\nWhen(UnicornKind)\n  .IsCreated()\n  .WithName("example-2")\n  .Mutate(request => {\n    request.Merge({\n      spec: {\n        message: "Hello Pepr with type data!",\n        counter: Math.random(),\n      },\n    });\n  });\n\n/**\n * A callback function that is called once the Pepr Store is fully loaded.\n */\nStore.onReady(data => {\n  Log.info(data, "Pepr Store Ready");\n});\n';
-var packageJSON = { name: "pepr", description: "Kubernetes application engine", author: "Defense Unicorns", homepage: "https://github.com/defenseunicorns/pepr", license: "Apache-2.0", bin: "dist/cli.js", repository: "defenseunicorns/pepr", engines: { node: ">=18.0.0" }, version: "0.14.1", main: "dist/lib.js", types: "dist/lib.d.ts", scripts: { "gen-data-json": "node hack/build-template-data.js", prebuild: "rm -fr dist/* && npm run gen-data-json", build: "tsc && node build.mjs", test: "npm run test:unit && npm run test:journey", "test:unit": "npm run gen-data-json && jest src --coverage", "test:journey": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run", "test:journey:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0'", "test:journey:build": "npm run build && npm pack", "test:journey:image": "docker buildx build --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev", "test:journey:run": "jest journey/entrypoint.test.ts", "format:check": "eslint src && prettier src --check", "format:fix": "eslint src --fix && prettier src --write" }, dependencies: { express: "4.18.2", "fast-json-patch": "3.1.1", "kubernetes-fluent-client": "1.6.0", pino: "8.16.0", "pino-pretty": "10.2.3", "prom-client": "15.0.0", ramda: "0.29.1" }, devDependencies: { "@commitlint/cli": "17.7.2", "@commitlint/config-conventional": "17.7.0", "@jest/globals": "29.7.0", "@types/eslint": "8.44.4", "@types/express": "4.17.19", "@types/node": "18.x.x", "@types/node-forge": "1.3.7", "@types/prompts": "2.4.6", "@types/ramda": "0.29.6", "@types/uuid": "9.0.5", jest: "29.7.0", nock: "13.3.4", "ts-jest": "29.1.1" }, peerDependencies: { "@typescript-eslint/eslint-plugin": "6.7.3", "@typescript-eslint/parser": "6.7.3", commander: "11.0.0", esbuild: "0.19.4", eslint: "8.50.0", "node-forge": "1.3.1", prettier: "3.0.3", prompts: "2.4.2", typescript: "5.2.2", uuid: "9.0.1" } };
+var helloPeprTS = 'import {\n  Capability,\n  K8s,\n  Log,\n  PeprMutateRequest,\n  RegisterKind,\n  a,\n  fetch,\n  fetchStatus,\n  kind,\n} from "pepr";\n\n/**\n *  The HelloPepr Capability is an example capability to demonstrate some general concepts of Pepr.\n *  To test this capability you run `pepr dev`and then run the following command:\n *  `kubectl apply -f capabilities/hello-pepr.samples.yaml`\n */\nexport const HelloPepr = new Capability({\n  name: "hello-pepr",\n  description: "A simple example capability to show how things work.",\n  namespaces: ["pepr-demo", "pepr-demo-2"],\n});\n\n// Use the \'When\' function to create a new action, use \'Store\' to persist data\nconst { When, Store } = HelloPepr;\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Namespace)                                   *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action removes the label `remove-me` when a Namespace is created.\n * Note we don\'t need to specify the namespace here, because we\'ve already specified\n * it in the Capability definition above.\n */\nWhen(a.Namespace)\n  .IsCreated()\n  .Mutate(ns => ns.RemoveLabel("remove-me"));\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Watch Action with K8s SSA (Namespace)                           *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action watches for the `pepr-demo-2` namespace to be created, then creates a ConfigMap with\n * the name `pepr-ssa-demo` and adds the namespace UID to the ConfigMap data. Because Pepr uses\n * server-side apply for this operation, the ConfigMap will be created or updated if it already exists.\n */\nWhen(a.Namespace)\n  .IsCreated()\n  .WithName("pepr-demo-2")\n  .Watch(async ns => {\n    Log.info("Namespace pepr-demo-2 was created.");\n\n    try {\n      // Apply the ConfigMap using K8s server-side apply\n      await K8s(kind.ConfigMap).Apply({\n        metadata: {\n          name: "pepr-ssa-demo",\n          namespace: "pepr-demo-2",\n        },\n        data: {\n          "ns-uid": ns.metadata.uid,\n        },\n      });\n    } catch (error) {\n      // You can use the Log object to log messages to the Pepr controller pod\n      Log.error(error, "Failed to apply ConfigMap using server-side apply.");\n    }\n\n    // You can share data between actions using the Store, including between different types of actions\n    Store.setItem("watch-data", "This data was stored by a Watch Action.");\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 1)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This is a single action. They can be in the same file or put imported from other files.\n * In this example, when a ConfigMap is created with the name `example-1`, then add a label and annotation.\n *\n * Equivalent to manually running:\n * `kubectl label configmap example-1 pepr=was-here`\n * `kubectl annotate configmap example-1 pepr.dev=annotations-work-too`\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-1")\n  .Mutate(request => {\n    request\n      .SetLabel("pepr", "was-here")\n      .SetAnnotation("pepr.dev", "annotations-work-too");\n\n    // Use the Store to persist data between requests and Pepr controller pods\n    Store.setItem("example-1", "was-here");\n\n    // This data is written asynchronously and can be read back via `Store.getItem()` or `Store.subscribe()`\n    Store.setItem("example-1-data", JSON.stringify(request.Raw.data));\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate & Validate Actions (CM Example 2)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This combines 3 different types of actions: \'Mutate\', \'Validate\', and \'Watch\'. The order\n * of the actions is required, but each action is optional. In this example, when a ConfigMap is created\n * with the name `example-2`, then add a label and annotation, validate that the ConfigMap has the label\n * `pepr`, and log the request.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-2")\n  .Mutate(request => {\n    // This Mutate Action will mutate the request before it is persisted to the cluster\n\n    // Use `request.Merge()` to merge the new data with the existing data\n    request.Merge({\n      metadata: {\n        labels: {\n          pepr: "was-here",\n        },\n        annotations: {\n          "pepr.dev": "annotations-work-too",\n        },\n      },\n    });\n  })\n  .Validate(request => {\n    // This Validate Action will validate the request before it is persisted to the cluster\n\n    // Approve the request if the ConfigMap has the label \'pepr\'\n    if (request.HasLabel("pepr")) {\n      return request.Approve();\n    }\n\n    // Otherwise, deny the request with an error message (optional)\n    return request.Deny("ConfigMap must have label \'pepr\'");\n  })\n  .Watch((cm, phase) => {\n    // This Watch Action will watch the ConfigMap after it has been persisted to the cluster\n    Log.info(cm, `ConfigMap was ${phase} with the name example-2`);\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 2a)                               *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action shows a simple validation that will deny any ConfigMap that has the\n * annotation `evil`. Note that the `Deny()` function takes an optional second parameter that is a\n * user-defined status code to return.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .Validate(request => {\n    if (request.HasAnnotation("evil")) {\n      return request.Deny("No evil CM annotations allowed.", 400);\n    }\n\n    return request.Approve();\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 3)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action combines different styles. Unlike the previous actions, this one will look\n * for any ConfigMap in the `pepr-demo` namespace that has the label `change=by-label` during either\n * CREATE or UPDATE. Note that all conditions added such as `WithName()`, `WithLabel()`, `InNamespace()`,\n * are ANDs so all conditions must be true for the request to be processed.\n */\nWhen(a.ConfigMap)\n  .IsCreatedOrUpdated()\n  .WithLabel("change", "by-label")\n  .Mutate(request => {\n    // The K8s object e are going to mutate\n    const cm = request.Raw;\n\n    // Get the username and uid of the K8s request\n    const { username, uid } = request.Request.userInfo;\n\n    // Store some data about the request in the configmap\n    cm.data["username"] = username;\n    cm.data["uid"] = uid;\n\n    // You can still mix other ways of making changes too\n    request.SetAnnotation("pepr.dev", "making-waves");\n  });\n\n// This action validates the label `change=by-label` is deleted\nWhen(a.ConfigMap)\n  .IsDeleted()\n  .WithLabel("change", "by-label")\n  .Validate(request => {\n    // Log and then always approve the request\n    Log.info("CM with label \'change=by-label\' was deleted.");\n    return request.Approve();\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 4)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action show how you can use the `Mutate()` function without an inline function.\n * This is useful if you want to keep your actions small and focused on a single task,\n * or if you want to reuse the same function in multiple actions.\n */\nWhen(a.ConfigMap).IsCreated().WithName("example-4").Mutate(example4Cb);\n\n// This function uses the complete type definition, but is not required.\nfunction example4Cb(cm: PeprMutateRequest<a.ConfigMap>) {\n  cm.SetLabel("pepr.dev/first", "true");\n  cm.SetLabel("pepr.dev/second", "true");\n  cm.SetLabel("pepr.dev/third", "true");\n}\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 4a)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This is the same as Example 4, except this only operates on a CM in the `pepr-demo-2` namespace.\n * Note because the Capability defines namespaces, the namespace specified here must be one of those.\n * Alternatively, you can remove the namespace from the Capability definition and specify it here.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .InNamespace("pepr-demo-2")\n  .WithName("example-4a")\n  .Mutate(example4Cb);\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 5)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action is a bit more complex. It will look for any ConfigMap in the `pepr-demo`\n * namespace that has the label `chuck-norris` during CREATE. When it finds one, it will fetch a\n * random Chuck Norris joke from the API and add it to the ConfigMap. This is a great example of how\n * you can use Pepr to make changes to your K8s objects based on external data.\n *\n * Note the use of the `async` keyword. This is required for any action that uses `await` or `fetch()`.\n *\n * Also note we are passing a type to the `fetch()` function. This is optional, but it will help you\n * avoid mistakes when working with the data returned from the API. You can also use the `as` keyword to\n * cast the data returned from the API.\n *\n * These are equivalent:\n * ```ts\n * const joke = await fetch<TheChuckNorrisJoke>("https://api.chucknorris.io/jokes/random?category=dev");\n * const joke = await fetch("https://api.chucknorris.io/jokes/random?category=dev") as TheChuckNorrisJoke;\n * ```\n *\n * Alternatively, you can drop the type completely:\n *\n * ```ts\n * fetch("https://api.chucknorris.io/jokes/random?category=dev")\n * ```\n */\ninterface TheChuckNorrisJoke {\n  icon_url: string;\n  id: string;\n  url: string;\n  value: string;\n}\n\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithLabel("chuck-norris")\n  .Mutate(async change => {\n    // Try/catch is not needed as a response object will always be returned\n    const response = await fetch<TheChuckNorrisJoke>(\n      "https://api.chucknorris.io/jokes/random?category=dev",\n    );\n\n    // Instead, check the `response.ok` field\n    if (response.ok) {\n      // Add the Chuck Norris joke to the configmap\n      change.Raw.data["chuck-says"] = response.data.value;\n      return;\n    }\n\n    // You can also assert on different HTTP response codes\n    if (response.status === fetchStatus.NOT_FOUND) {\n      // Do something else\n      return;\n    }\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Secret Base64 Handling)                      *\n * ---------------------------------------------------------------------------------------------------\n *\n * The K8s JS client provides incomplete support for base64 encoding/decoding handling for secrets,\n * unlike the GO client. To make this less painful, Pepr automatically handles base64 encoding/decoding\n * secret data before and after the action is executed.\n */\nWhen(a.Secret)\n  .IsCreated()\n  .WithName("secret-1")\n  .Mutate(request => {\n    const secret = request.Raw;\n\n    // This will be encoded at the end of all processing back to base64: "Y2hhbmdlLXdpdGhvdXQtZW5jb2Rpbmc="\n    secret.data.magic = "change-without-encoding";\n\n    // You can modify the data directly, and it will be encoded at the end of all processing\n    secret.data.example += " - modified by Pepr";\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Untyped Custom Resource)                     *\n * ---------------------------------------------------------------------------------------------------\n *\n * Out of the box, Pepr supports all the standard Kubernetes objects. However, you can also create\n * your own types. This is useful if you are working with an Operator that creates custom resources.\n * There are two ways to do this, the first is to use the `When()` function with a `GenericKind`,\n * the second is to create a new class that extends `GenericKind` and use the `RegisterKind()` function.\n *\n * This example shows how to use the `When()` function with a `GenericKind`. Note that you\n * must specify the `group`, `version`, and `kind` of the object (if applicable). This is how Pepr knows\n * if the action should be triggered or not. Since we are using a `GenericKind`,\n * Pepr will not be able to provide any intellisense for the object, so you will need to refer to the\n * Kubernetes API documentation for the object you are working with.\n *\n * You will need to wait for the CRD in `hello-pepr.samples.yaml` to be created, then you can apply\n *\n * ```yaml\n * apiVersion: pepr.dev/v1\n * kind: Unicorn\n * metadata:\n *   name: example-1\n *   namespace: pepr-demo\n * spec:\n *   message: replace-me\n *   counter: 0\n * ```\n */\nWhen(a.GenericKind, {\n  group: "pepr.dev",\n  version: "v1",\n  kind: "Unicorn",\n})\n  .IsCreated()\n  .WithName("example-1")\n  .Mutate(request => {\n    request.Merge({\n      spec: {\n        message: "Hello Pepr without type data!",\n        counter: Math.random(),\n      },\n    });\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Typed Custom Resource)                       *\n * ---------------------------------------------------------------------------------------------------\n *\n * This example shows how to use the `RegisterKind()` function to create a new type. This is useful\n * if you are working with an Operator that creates custom resources and you want to have intellisense\n * for the object. Note that you must specify the `group`, `version`, and `kind` of the object (if applicable)\n * as this is how Pepr knows if the action should be triggered or not.\n *\n * Once you register a new Kind with Pepr, you can use the `When()` function with the new Kind. Ideally,\n * you should register custom Kinds at the top of your Capability file or Pepr Module so they are available\n * to all actions, but we are putting it here for demonstration purposes.\n *\n * You will need to wait for the CRD in `hello-pepr.samples.yaml` to be created, then you can apply\n *\n * ```yaml\n * apiVersion: pepr.dev/v1\n * kind: Unicorn\n * metadata:\n *   name: example-2\n *   namespace: pepr-demo\n * spec:\n *   message: replace-me\n *   counter: 0\n * ```*\n */\nclass UnicornKind extends a.GenericKind {\n  spec: {\n    /**\n     * JSDoc comments can be added to explain more details about the field.\n     *\n     * @example\n     * ```ts\n     * request.Raw.spec.message = "Hello Pepr!";\n     * ```\n     * */\n    message: string;\n    counter: number;\n  };\n}\n\nRegisterKind(UnicornKind, {\n  group: "pepr.dev",\n  version: "v1",\n  kind: "Unicorn",\n});\n\nWhen(UnicornKind)\n  .IsCreated()\n  .WithName("example-2")\n  .Mutate(request => {\n    request.Merge({\n      spec: {\n        message: "Hello Pepr with type data!",\n        counter: Math.random(),\n      },\n    });\n  });\n\n/**\n * A callback function that is called once the Pepr Store is fully loaded.\n */\nStore.onReady(data => {\n  Log.info(data, "Pepr Store Ready");\n});\n';
+var packageJSON = { name: "pepr", description: "Kubernetes application engine", author: "Defense Unicorns", homepage: "https://github.com/defenseunicorns/pepr", license: "Apache-2.0", bin: "dist/cli.js", repository: "defenseunicorns/pepr", engines: { node: ">=18.0.0" }, version: "0.15.0", main: "dist/lib.js", types: "dist/lib.d.ts", scripts: { "gen-data-json": "node hack/build-template-data.js", prebuild: "rm -fr dist/* && npm run gen-data-json", build: "tsc && node build.mjs", test: "npm run test:unit && npm run test:journey", "test:unit": "npm run gen-data-json && jest src --coverage", "test:journey": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run", "test:journey-wasm": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run-wasm", "test:journey:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0' --wait && kubectl rollout status deployment -n kube-system", "test:journey:build": "npm run build && npm pack", "test:journey:image": "docker buildx build --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev", "test:journey:run": "jest --detectOpenHandles journey/entrypoint.test.ts", "test:journey:run-wasm": "jest --detectOpenHandles journey/entrypoint-wasm.test.ts", "format:check": "eslint src && prettier src --check", "format:fix": "eslint src --fix && prettier src --write" }, dependencies: { express: "4.18.2", "fast-json-patch": "3.1.1", "kubernetes-fluent-client": "1.8.0", pino: "8.16.1", "pino-pretty": "10.2.3", "prom-client": "15.0.0", ramda: "0.29.1" }, devDependencies: { "@commitlint/cli": "18.2.0", "@commitlint/config-conventional": "18.1.0", "@jest/globals": "29.7.0", "@types/eslint": "8.44.6", "@types/express": "4.17.20", "@types/node": "18.x.x", "@types/node-forge": "1.3.8", "@types/prompts": "2.4.7", "@types/ramda": "0.29.7", "@types/uuid": "9.0.6", jest: "29.7.0", nock: "13.3.6", "ts-jest": "29.1.1" }, peerDependencies: { "@typescript-eslint/eslint-plugin": "6.7.3", "@typescript-eslint/parser": "6.7.3", commander: "11.0.0", esbuild: "0.19.4", eslint: "8.50.0", "node-forge": "1.3.1", prettier: "3.0.3", prompts: "2.4.2", typescript: "5.2.2", uuid: "9.0.1" } };
 
 // src/templates/pepr.code-snippets.json
 var pepr_code_snippets_default = {
@@ -1204,7 +1250,7 @@ var tsconfig_module_default = {
 };
 
 // src/cli/init/utils.ts
-var import_fs3 = require("fs");
+var import_fs4 = require("fs");
 function sanitizeName(name2) {
   let sanitized = name2.toLowerCase().replace(/[^a-z0-9-]+/gi, "-");
   sanitized = sanitized.replace(/^-+|-+$/g, "");
@@ -1213,7 +1259,7 @@ function sanitizeName(name2) {
 }
 async function createDir(dir) {
   try {
-    await import_fs3.promises.mkdir(dir);
+    await import_fs4.promises.mkdir(dir);
   } catch (err) {
     if (err && err.code === "EEXIST") {
       throw new Error(`Directory ${dir} already exists`);
@@ -1226,7 +1272,7 @@ function write(path, data) {
   if (typeof data !== "string") {
     data = JSON.stringify(data, null, 2);
   }
-  return import_fs3.promises.writeFile(path, data);
+  return import_fs4.promises.writeFile(path, data);
 }
 
 // src/cli/init/templates.ts
@@ -1250,7 +1296,8 @@ function genPkgJSON(opts, pgkVerOverride) {
       alwaysIgnore: {
         namespaces: [],
         labels: []
-      }
+      },
+      includedFiles: []
     },
     scripts: {
       "k3d-setup": scripts["test:journey:k3d"]
@@ -1313,7 +1360,7 @@ var eslint = {
 
 // src/cli/format.ts
 var import_eslint = require("eslint");
-var import_fs4 = require("fs");
+var import_fs5 = require("fs");
 var import_prettier = require("prettier");
 function format_default(program2) {
   program2.command("format").description("Lint and format this Pepr module").option("-v, --validate-only", "Do not modify files, only validate formatting").action(async (opts) => {
@@ -1346,7 +1393,7 @@ async function peprFormat(validateOnly) {
         await import_eslint.ESLint.outputFixes(results);
       }
       for (const { filePath } of results) {
-        const content = await import_fs4.promises.readFile(filePath, "utf8");
+        const content = await import_fs5.promises.readFile(filePath, "utf8");
         const cfg = await (0, import_prettier.resolveConfig)(filePath);
         const formatted = await (0, import_prettier.format)(content, { filepath: filePath, ...cfg });
         if (validateOnly) {
@@ -1355,7 +1402,7 @@ async function peprFormat(validateOnly) {
             console.error(`File ${filePath} is not formatted correctly`);
           }
         } else {
-          await import_fs4.promises.writeFile(filePath, formatted);
+          await import_fs5.promises.writeFile(filePath, formatted);
         }
       }
       return !hasFailure;
@@ -1367,14 +1414,31 @@ async function peprFormat(validateOnly) {
 }
 
 // src/cli/build.ts
+var import_commander = require("commander");
 var peprTS2 = "pepr.ts";
 function build_default(program2) {
   program2.command("build").description("Build a Pepr Module for deployment").option(
     "-e, --entry-point [file]",
     "Specify the entry point file to build with. Note that changing this disables embedding of NPM packages.",
     peprTS2
+  ).option(
+    "-r, --registry-info [<registry>/<username>]",
+    "Registry Info: Image registry and username. Note: You must be signed into the registry"
+  ).addOption(
+    new import_commander.Option("--rbac-mode [admin|scoped]", "Rbac Mode: admin, scoped (default: admin)").choices(["admin", "scoped"]).default("admin")
   ).action(async (opts) => {
     const { cfg, path, uuid } = await buildModule(void 0, opts.entryPoint);
+    const { includedFiles } = cfg.pepr;
+    let image = "";
+    if (opts.registryInfo !== void 0) {
+      console.info(`Including ${includedFiles.length} files in controller image.`);
+      image = `${opts.registryInfo}/custom-pepr-controller:${cfg.dependencies.pepr}`;
+      if (includedFiles.length > 0) {
+        await createDockerfile(cfg.dependencies.pepr, cfg.description, includedFiles);
+        (0, import_child_process2.execSync)(`docker build --tag ${image} -f Dockerfile.controller .`, { stdio: "inherit" });
+        (0, import_child_process2.execSync)(`docker push ${image}`, { stdio: "inherit" });
+      }
+    }
     if (opts.entryPoint !== peprTS2) {
       console.info(`\u2705 Module built successfully at ${path}`);
       return;
@@ -1387,13 +1451,16 @@ function build_default(program2) {
       },
       path
     );
+    if (image !== "") {
+      assets.image = image;
+    }
     const yamlFile = `pepr-module-${uuid}.yaml`;
     const yamlPath = (0, import_path.resolve)("dist", yamlFile);
-    const yaml = await assets.allYaml();
+    const yaml = await assets.allYaml(opts.rbacMode);
     const zarfPath = (0, import_path.resolve)("dist", "zarf.yaml");
     const zarf = assets.zarfYaml(yamlFile);
-    await import_fs5.promises.writeFile(yamlPath, yaml);
-    await import_fs5.promises.writeFile(zarfPath, zarf);
+    await import_fs6.promises.writeFile(yamlPath, yaml);
+    await import_fs6.promises.writeFile(zarfPath, zarf);
     console.info(`\u2705 K8s resource for the module saved to ${yamlPath}`);
   });
 }
@@ -1404,15 +1471,15 @@ async function loadModule(entryPoint = peprTS2) {
   const cfgPath = (0, import_path.resolve)(".", "package.json");
   const input = (0, import_path.resolve)(".", entryPoint);
   try {
-    await import_fs5.promises.access(cfgPath);
-    await import_fs5.promises.access(input);
+    await import_fs6.promises.access(cfgPath);
+    await import_fs6.promises.access(input);
   } catch (e) {
     console.error(
       `Could not find ${cfgPath} or ${input} in the current directory. Please run this command from the root of your module's directory.`
     );
     process.exit(1);
   }
-  const moduleText = await import_fs5.promises.readFile(cfgPath, { encoding: "utf-8" });
+  const moduleText = await import_fs6.promises.readFile(cfgPath, { encoding: "utf-8" });
   const cfg = JSON.parse(moduleText);
   const { uuid } = cfg.pepr;
   const name2 = `pepr-${uuid}.js`;
@@ -1555,7 +1622,7 @@ function deploy_default(program2) {
 
 // src/cli/dev.ts
 var import_child_process3 = require("child_process");
-var import_fs6 = require("fs");
+var import_fs7 = require("fs");
 var import_prompts2 = __toESM(require("prompts"));
 function dev_default(program2) {
   program2.command("dev").description("Setup a local webhook development environment").option("-h, --host [host]", "Host to listen on", "host.k3d.internal").option("--confirm", "Skip confirmation prompt").action(async (opts) => {
@@ -1578,8 +1645,8 @@ function dev_default(program2) {
       path,
       opts.host
     );
-    await import_fs6.promises.writeFile("insecure-tls.crt", webhook.tls.pem.crt);
-    await import_fs6.promises.writeFile("insecure-tls.key", webhook.tls.pem.key);
+    await import_fs7.promises.writeFile("insecure-tls.crt", webhook.tls.pem.crt);
+    await import_fs7.promises.writeFile("insecure-tls.key", webhook.tls.pem.key);
     try {
       let program3;
       const runFork = async () => {
@@ -1623,7 +1690,7 @@ var import_path2 = require("path");
 var import_prompts4 = __toESM(require("prompts"));
 
 // src/cli/init/walkthrough.ts
-var import_fs7 = require("fs");
+var import_fs8 = require("fs");
 var import_prompts3 = __toESM(require("prompts"));
 
 // src/lib/errors.ts
@@ -1643,7 +1710,7 @@ function walkthrough() {
     validate: async (val) => {
       try {
         const name2 = sanitizeName(val);
-        await import_fs7.promises.access(name2, import_fs7.promises.constants.F_OK);
+        await import_fs8.promises.access(name2, import_fs8.promises.constants.F_OK);
         return "A directory with this name already exists";
       } catch (e) {
         return val.length > 2 || "The name must be at least 3 characters long";
@@ -1763,11 +1830,11 @@ function init_default(program2) {
 }
 
 // src/cli/root.ts
-var import_commander = require("commander");
-var RootCmd = class extends import_commander.Command {
+var import_commander2 = require("commander");
+var RootCmd = class extends import_commander2.Command {
   // eslint-disable-next-line class-methods-use-this
   createCommand(name2) {
-    const cmd = new import_commander.Command(name2);
+    const cmd = new import_commander2.Command(name2);
     cmd.option("-l, --log-level [level]", "Log level: debug, info, warn, error", "info");
     cmd.hook("preAction", (run) => {
       logger_default.level = run.opts().logLevel;
@@ -1778,7 +1845,7 @@ var RootCmd = class extends import_commander.Command {
 
 // src/cli/update.ts
 var import_child_process5 = require("child_process");
-var import_fs8 = __toESM(require("fs"));
+var import_fs9 = __toESM(require("fs"));
 var import_path3 = require("path");
 var import_prompts5 = __toESM(require("prompts"));
 function update_default(program2) {
@@ -1818,12 +1885,12 @@ function update_default(program2) {
         await write((0, import_path3.resolve)(".vscode", snippet.path), snippet.data);
         await write((0, import_path3.resolve)(".vscode", codeSettings.path), codeSettings.data);
         const samplePath = (0, import_path3.resolve)("capabilities", samplesYaml.path);
-        if (import_fs8.default.existsSync(samplePath)) {
-          import_fs8.default.unlinkSync(samplePath);
+        if (import_fs9.default.existsSync(samplePath)) {
+          import_fs9.default.unlinkSync(samplePath);
           await write(samplePath, samplesYaml.data);
         }
         const tsPath = (0, import_path3.resolve)("capabilities", helloPepr.path);
-        if (import_fs8.default.existsSync(tsPath)) {
+        if (import_fs9.default.existsSync(tsPath)) {
           await write(tsPath, helloPepr.data);
         }
       }

package/dist/controller.js

@@ -48,7 +48,7 @@ if (process.env.LOG_LEVEL) {
 var logger_default = Log;
 
 // src/templates/data.json
-var packageJSON = { name: "pepr", description: "Kubernetes application engine", author: "Defense Unicorns", homepage: "https://github.com/defenseunicorns/pepr", license: "Apache-2.0", bin: "dist/cli.js", repository: "defenseunicorns/pepr", engines: { node: ">=18.0.0" }, version: "0.14.1", main: "dist/lib.js", types: "dist/lib.d.ts", scripts: { "gen-data-json": "node hack/build-template-data.js", prebuild: "rm -fr dist/* && npm run gen-data-json", build: "tsc && node build.mjs", test: "npm run test:unit && npm run test:journey", "test:unit": "npm run gen-data-json && jest src --coverage", "test:journey": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run", "test:journey:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0'", "test:journey:build": "npm run build && npm pack", "test:journey:image": "docker buildx build --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev", "test:journey:run": "jest journey/entrypoint.test.ts", "format:check": "eslint src && prettier src --check", "format:fix": "eslint src --fix && prettier src --write" }, dependencies: { express: "4.18.2", "fast-json-patch": "3.1.1", "kubernetes-fluent-client": "1.6.0", pino: "8.16.0", "pino-pretty": "10.2.3", "prom-client": "15.0.0", ramda: "0.29.1" }, devDependencies: { "@commitlint/cli": "17.7.2", "@commitlint/config-conventional": "17.7.0", "@jest/globals": "29.7.0", "@types/eslint": "8.44.4", "@types/express": "4.17.19", "@types/node": "18.x.x", "@types/node-forge": "1.3.7", "@types/prompts": "2.4.6", "@types/ramda": "0.29.6", "@types/uuid": "9.0.5", jest: "29.7.0", nock: "13.3.4", "ts-jest": "29.1.1" }, peerDependencies: { "@typescript-eslint/eslint-plugin": "6.7.3", "@typescript-eslint/parser": "6.7.3", commander: "11.0.0", esbuild: "0.19.4", eslint: "8.50.0", "node-forge": "1.3.1", prettier: "3.0.3", prompts: "2.4.2", typescript: "5.2.2", uuid: "9.0.1" } };
+var packageJSON = { name: "pepr", description: "Kubernetes application engine", author: "Defense Unicorns", homepage: "https://github.com/defenseunicorns/pepr", license: "Apache-2.0", bin: "dist/cli.js", repository: "defenseunicorns/pepr", engines: { node: ">=18.0.0" }, version: "0.15.0", main: "dist/lib.js", types: "dist/lib.d.ts", scripts: { "gen-data-json": "node hack/build-template-data.js", prebuild: "rm -fr dist/* && npm run gen-data-json", build: "tsc && node build.mjs", test: "npm run test:unit && npm run test:journey", "test:unit": "npm run gen-data-json && jest src --coverage", "test:journey": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run", "test:journey-wasm": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run-wasm", "test:journey:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0' --wait && kubectl rollout status deployment -n kube-system", "test:journey:build": "npm run build && npm pack", "test:journey:image": "docker buildx build --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev", "test:journey:run": "jest --detectOpenHandles journey/entrypoint.test.ts", "test:journey:run-wasm": "jest --detectOpenHandles journey/entrypoint-wasm.test.ts", "format:check": "eslint src && prettier src --check", "format:fix": "eslint src --fix && prettier src --write" }, dependencies: { express: "4.18.2", "fast-json-patch": "3.1.1", "kubernetes-fluent-client": "1.8.0", pino: "8.16.1", "pino-pretty": "10.2.3", "prom-client": "15.0.0", ramda: "0.29.1" }, devDependencies: { "@commitlint/cli": "18.2.0", "@commitlint/config-conventional": "18.1.0", "@jest/globals": "29.7.0", "@types/eslint": "8.44.6", "@types/express": "4.17.20", "@types/node": "18.x.x", "@types/node-forge": "1.3.8", "@types/prompts": "2.4.7", "@types/ramda": "0.29.7", "@types/uuid": "9.0.6", jest: "29.7.0", nock: "13.3.6", "ts-jest": "29.1.1" }, peerDependencies: { "@typescript-eslint/eslint-plugin": "6.7.3", "@typescript-eslint/parser": "6.7.3", commander: "11.0.0", esbuild: "0.19.4", eslint: "8.50.0", "node-forge": "1.3.1", prettier: "3.0.3", prompts: "2.4.2", typescript: "5.2.2", uuid: "9.0.1" } };
 
 // src/runtime/controller.ts
 var { version } = packageJSON;

package/dist/lib/assets/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../../src/lib/assets/deploy.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC;AAQ3B,wBAAsB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,iBA8CnE"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../../src/lib/assets/deploy.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC;AAS3B,wBAAsB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,iBA8CnE"}

package/dist/lib/assets/index.d.ts

@@ -13,6 +13,6 @@ export declare class Assets {
     constructor(config: ModuleConfig, path: string, host?: string | undefined);
     deploy: (webhookTimeout?: number) => Promise<void>;
     zarfYaml: (path: string) => string;
-    allYaml: () => Promise<string>;
+    allYaml: (rbacMode: string) => Promise<string>;
 }
 //# sourceMappingURL=index.d.ts.map

package/dist/lib/assets/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/assets/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,MAAM,EAAU,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAK5C,qBAAa,MAAM;IAQf,QAAQ,CAAC,MAAM,EAAE,YAAY;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,IAAI,CAAC;IAThB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAG,gBAAgB,EAAE,CAAC;IAClC,KAAK,EAAE,MAAM,CAAC;gBAGH,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,oBAAQ;IAaxB,MAAM,oBAA2B,MAAM,mBAGrC;IAEF,QAAQ,SAAU,MAAM,YAA0B;IAElD,OAAO,wBAGL;CACH"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/assets/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,MAAM,EAAU,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAK5C,qBAAa,MAAM;IAQf,QAAQ,CAAC,MAAM,EAAE,YAAY;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,IAAI,CAAC;IAThB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAG,gBAAgB,EAAE,CAAC;IAClC,KAAK,EAAE,MAAM,CAAC;gBAGH,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,oBAAQ;IAaxB,MAAM,oBAA2B,MAAM,mBAGrC;IAEF,QAAQ,SAAU,MAAM,YAA0B;IAElD,OAAO,aAAoB,MAAM,qBAG/B;CACH"}

package/dist/lib/assets/rbac.d.ts

@@ -1,11 +1,12 @@
 import { kind } from "kubernetes-fluent-client";
+import { CapabilityExport } from "../types";
 /**
  * Grants the controller access to cluster resources beyond the mutating webhook.
  *
  * @todo: should dynamically generate this based on resources used by the module. will also need to explore how this should work for multiple modules.
  * @returns
  */
-export declare function clusterRole(name: string): kind.ClusterRole;
+export declare function clusterRole(name: string, capabilities: CapabilityExport[], rbacMode?: string): kind.ClusterRole;
 export declare function clusterRoleBinding(name: string): kind.ClusterRoleBinding;
 export declare function serviceAccount(name: string): kind.ServiceAccount;
 export declare function storeRole(name: string): kind.Role;

package/dist/lib/assets/rbac.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rbac.d.ts","sourceRoot":"","sources":["../../../src/lib/assets/rbac.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,0BAA0B,CAAC;AAEhD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,WAAW,CAc1D;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAkBxE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,cAAc,CAShE;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,IAAI,CAejD;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,WAAW,CAmB/D"}
+{"version":3,"file":"rbac.d.ts","sourceRoot":"","sources":["../../../src/lib/assets/rbac.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,0BAA0B,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAE5C;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,gBAAgB,EAAE,EAAE,QAAQ,GAAE,MAAW,GAAG,IAAI,CAAC,WAAW,CA6BnH;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAkBxE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,cAAc,CAShE;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,IAAI,CAejD;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,WAAW,CAmB/D"}

package/dist/lib/assets/yaml.d.ts

@@ -1,4 +1,4 @@
 import { Assets } from ".";
 export declare function zarfYaml({ name, image, config }: Assets, path: string): string;
-export declare function allYaml(assets: Assets): Promise<string>;
+export declare function allYaml(assets: Assets, rbacMode: string): Promise<string>;
 //# sourceMappingURL=yaml.d.ts.map

package/dist/lib/assets/yaml.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"yaml.d.ts","sourceRoot":"","sources":["../../../src/lib/assets/yaml.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC;AAO3B,wBAAgB,QAAQ,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,UA0BrE;AAED,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,mBA0C3C"}
+{"version":3,"file":"yaml.d.ts","sourceRoot":"","sources":["../../../src/lib/assets/yaml.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC;AAO3B,wBAAgB,QAAQ,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,UA0BrE;AAED,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,mBA0C7D"}

package/dist/lib/helpers.d.ts

@@ -0,0 +1,11 @@
+import { CapabilityExport } from "./types";
+type RBACMap = {
+    [key: string]: {
+        verbs: string[];
+        plural: string;
+    };
+};
+export declare const addVerbIfNotExists: (verbs: string[], verb: string) => void;
+export declare const createRBACMap: (capabilities: CapabilityExport[]) => RBACMap;
+export {};
+//# sourceMappingURL=helpers.d.ts.map

package/dist/lib/helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../src/lib/helpers.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAE3C,KAAK,OAAO,GAAG;IACb,CAAC,GAAG,EAAE,MAAM,GAAG;QACb,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH,CAAC;AAEF,eAAO,MAAM,kBAAkB,UAAW,MAAM,EAAE,QAAQ,MAAM,SAI/D,CAAC;AAEF,eAAO,MAAM,aAAa,iBAAkB,gBAAgB,EAAE,KAAG,OAoBhE,CAAC"}

package/dist/lib/included-files.d.ts

@@ -0,0 +1,2 @@
+export declare function createDockerfile(version: string, description: string, includedFiles: string[]): Promise<void>;
+//# sourceMappingURL=included-files.d.ts.map

package/dist/lib/included-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"included-files.d.ts","sourceRoot":"","sources":["../../src/lib/included-files.ts"],"names":[],"mappings":"AAKA,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,iBAanG"}

package/package.json

@@ -9,7 +9,7 @@
   "engines": {
     "node": ">=18.0.0"
   },
-  "version": "0.14.1",
+  "version": "0.15.0",
   "main": "dist/lib.js",
   "types": "dist/lib.d.ts",
   "scripts": {
@@ -19,35 +19,37 @@
     "test": "npm run test:unit && npm run test:journey",
     "test:unit": "npm run gen-data-json && jest src --coverage",
     "test:journey": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run",
-    "test:journey:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0'",
+    "test:journey-wasm": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run-wasm",
+    "test:journey:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0' --wait && kubectl rollout status deployment -n kube-system",
     "test:journey:build": "npm run build && npm pack",
     "test:journey:image": "docker buildx build --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev",
-    "test:journey:run": "jest journey/entrypoint.test.ts",
+    "test:journey:run": "jest --detectOpenHandles journey/entrypoint.test.ts",
+    "test:journey:run-wasm": "jest --detectOpenHandles journey/entrypoint-wasm.test.ts",
     "format:check": "eslint src && prettier src --check",
     "format:fix": "eslint src --fix && prettier src --write"
   },
   "dependencies": {
     "express": "4.18.2",
     "fast-json-patch": "3.1.1",
-    "kubernetes-fluent-client": "1.6.0",
-    "pino": "8.16.0",
+    "kubernetes-fluent-client": "1.8.0",
+    "pino": "8.16.1",
     "pino-pretty": "10.2.3",
     "prom-client": "15.0.0",
     "ramda": "0.29.1"
   },
   "devDependencies": {
-    "@commitlint/cli": "17.7.2",
-    "@commitlint/config-conventional": "17.7.0",
+    "@commitlint/cli": "18.2.0",
+    "@commitlint/config-conventional": "18.1.0",
     "@jest/globals": "29.7.0",
-    "@types/eslint": "8.44.4",
-    "@types/express": "4.17.19",
+    "@types/eslint": "8.44.6",
+    "@types/express": "4.17.20",
     "@types/node": "18.x.x",
-    "@types/node-forge": "1.3.7",
-    "@types/prompts": "2.4.6",
-    "@types/ramda": "0.29.6",
-    "@types/uuid": "9.0.5",
+    "@types/node-forge": "1.3.8",
+    "@types/prompts": "2.4.7",
+    "@types/ramda": "0.29.7",
+    "@types/uuid": "9.0.6",
     "jest": "29.7.0",
-    "nock": "13.3.4",
+    "nock": "13.3.6",
     "ts-jest": "29.1.1"
   },
   "peerDependencies": {