pepr 0.14.2 → 0.16.0

package/BEST_PRACTICES.md

@@ -0,0 +1,37 @@
+# Pepr Best Practices (WIP)
+
+## TOC
+
+- [Store](#pepr-store)
+- [OnSchedule](#onschedule)
+- [Watch](#watch)
+
+
+## Pepr Store
+
+The store is backed by ETCD in a `PeprStore` resource, and updates happen at 5-second intervals when an array of patches is sent to the Kubernetes API Server. The store is intentionally not designed to be `transactional`; instead, it is built to be eventually consistent, meaning that the last operation within the interval will be persisted, potentially overwriting other operations. In simpler terms, changes to the data are made without a guarantee that they will occur simultaneously, so caution is needed in managing errors and ensuring consistency.  
+
+
+## OnSchedule
+
+`OnSchedule` is supported by a `PeprStore` to safeguard against schedule loss following a pod restart. It is utilized at the top level, distinct from being within a `Validate`, `Mutate`, or `Watch`. Recommended intervals are 30 seconds or longer, and jobs are advised to be idempotent, meaning that if the code is applied or executed multiple times, the outcome should be the same as if it had been executed only once. A major use-case for `OnSchedule` is day 2 operations.
+
+## Watch
+
+Pepr facilitates efficient change notifications on resources through `Watch`. It is recommended to use `Watch` instead of `Mutate` or `Validate` when longer running operations are needed, as there is no [timeout limitation](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#timeouts). An instance where `Watch` is beneficial is when API calls need to be chained together. `Watch` operations can be sequentially executed after `Mutate` and `Validate`.
+
+```typescript
+When(a.Pod)
+  .IsCreated()
+  .InNamespace("my-app")
+  .WithName("database")
+  .Mutate(pod => // .... )
+  .Validate(pod => // .... )
+  .Watch(async (pod, phase) => {
+    Log.info(pod, `Pod was ${phase}.`);
+
+    // do consecutive api calls
+```
+
+
+[TOP](#pepr-best-practices)

package/dist/cli.js

@@ -106,7 +106,7 @@ var banner = `\x1B[0m\x1B[38;2;96;96;96m \x1B[0m\x1B[38;2;96;96;96m \x1B[0m\x1B[
 // src/cli/build.ts
 var import_child_process2 = require("child_process");
 var import_esbuild = require("esbuild");
-var import_fs6 = require("fs");
+var import_fs7 = require("fs");
 var import_path = require("path");
 
 // src/lib/included-files.ts
@@ -187,7 +187,7 @@ function genCert(key, name2, issuer) {
 
 // src/lib/assets/deploy.ts
 var import_crypto = __toESM(require("crypto"));
-var import_fs2 = require("fs");
+var import_fs3 = require("fs");
 var import_kubernetes_fluent_client2 = require("kubernetes-fluent-client");
 
 // src/lib/logger.ts
@@ -529,15 +529,57 @@ function moduleSecret(name2, data, hash) {
   };
 }
 
+// src/lib/helpers.ts
+var import_fs2 = require("fs");
+var createRBACMap = (capabilities) => {
+  return capabilities.reduce((acc, capability) => {
+    capability.bindings.forEach((binding) => {
+      const key = `${binding.kind.group}/${binding.kind.version}/${binding.kind.kind}`;
+      acc["pepr.dev/v1/peprstore"] = {
+        verbs: ["create", "get", "patch", "watch"],
+        plural: "peprstores"
+      };
+      if (!acc[key] && binding.isWatch) {
+        acc[key] = {
+          verbs: ["watch"],
+          plural: binding.kind.plural || `${binding.kind.kind.toLowerCase()}s`
+        };
+      }
+    });
+    return acc;
+  }, {});
+};
+async function createDirectoryIfNotExists(path) {
+  try {
+    await import_fs2.promises.access(path);
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      await import_fs2.promises.mkdir(path, { recursive: true });
+    } else {
+      throw error;
+    }
+  }
+}
+
 // src/lib/assets/rbac.ts
-function clusterRole(name2) {
+function clusterRole(name2, capabilities, rbacMode = "") {
+  const rbacMap = createRBACMap(capabilities);
   return {
     apiVersion: "rbac.authorization.k8s.io/v1",
     kind: "ClusterRole",
     metadata: { name: name2 },
-    rules: [
+    rules: rbacMode === "scoped" ? [
+      ...Object.keys(rbacMap).map((key) => {
+        let group2;
+        key.split("/").length < 3 ? group2 = "" : group2 = key.split("/")[0];
+        return {
+          apiGroups: [group2],
+          resources: [rbacMap[key].plural],
+          verbs: rbacMap[key].verbs
+        };
+      })
+    ] : [
       {
-        // @todo: make this configurable
         apiGroups: ["*"],
         resources: ["*"],
         verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
@@ -582,7 +624,7 @@ function storeRole(name2) {
     metadata: { name: name2, namespace: "pepr-system" },
     rules: [
       {
-        apiGroups: ["pepr.dev/*"],
+        apiGroups: ["pepr.dev"],
         resources: ["peprstores"],
         resourceNames: [""],
         verbs: ["create", "get", "patch", "watch"]
@@ -785,21 +827,21 @@ async function deploy(assets, webhookTimeout) {
   if (host) {
     return;
   }
-  const code = await import_fs2.promises.readFile(path);
+  const code = await import_fs3.promises.readFile(path);
   const hash = import_crypto.default.createHash("sha256").update(code).digest("hex");
   if (code.length < 1) {
     throw new Error("No code provided");
   }
-  await setupRBAC(name2);
+  await setupRBAC(name2, assets.capabilities);
   await setupController(assets, code, hash);
   await setupWatcher(assets, hash);
 }
-async function setupRBAC(name2) {
+async function setupRBAC(name2, capabilities) {
   logger_default.info("Applying cluster role binding");
   const crb = clusterRoleBinding(name2);
   await (0, import_kubernetes_fluent_client2.K8s)(import_kubernetes_fluent_client2.kind.ClusterRoleBinding).Apply(crb);
   logger_default.info("Applying cluster role");
-  const cr = clusterRole(name2);
+  const cr = clusterRole(name2, capabilities);
   await (0, import_kubernetes_fluent_client2.K8s)(import_kubernetes_fluent_client2.kind.ClusterRole).Apply(cr);
   logger_default.info("Applying service account");
   const sa = serviceAccount(name2);
@@ -867,7 +909,7 @@ function loadCapabilities(path) {
 // src/lib/assets/yaml.ts
 var import_client_node = require("@kubernetes/client-node");
 var import_crypto2 = __toESM(require("crypto"));
-var import_fs3 = require("fs");
+var import_fs4 = require("fs");
 function zarfYaml({ name: name2, image, config }, path) {
   const zarfCfg = {
     kind: "ZarfPackageConfig",
@@ -894,16 +936,16 @@ function zarfYaml({ name: name2, image, config }, path) {
   };
   return (0, import_client_node.dumpYaml)(zarfCfg, { noRefs: true });
 }
-async function allYaml(assets) {
+async function allYaml(assets, rbacMode) {
   const { name: name2, tls, apiToken, path } = assets;
-  const code = await import_fs3.promises.readFile(path);
+  const code = await import_fs4.promises.readFile(path);
   const hash = import_crypto2.default.createHash("sha256").update(code).digest("hex");
   const mutateWebhook = await webhookConfig(assets, "mutate");
   const validateWebhook = await webhookConfig(assets, "validate");
   const watchDeployment = watcher(assets, hash);
   const resources = [
     namespace,
-    clusterRole(name2),
+    clusterRole(name2, assets.capabilities, rbacMode),
     clusterRoleBinding(name2),
     serviceAccount(name2),
     apiTokenSecret(name2, apiToken),
@@ -949,9 +991,9 @@ var Assets = class {
     await deploy(this, webhookTimeout);
   };
   zarfYaml = (path) => zarfYaml(this, path);
-  allYaml = async () => {
+  allYaml = async (rbacMode) => {
     this.capabilities = await loadCapabilities(this.path);
-    return allYaml(this);
+    return allYaml(this, rbacMode);
   };
 };
 
@@ -1161,8 +1203,8 @@ var hello_pepr_samples_default = [
 var gitIgnore = "# Ignore node_modules and Pepr build artifacts\nnode_modules\ndist\ninsecure*\n";
 var readmeMd = '# Pepr Module\n\nThis is a Pepr Module. [Pepr](https://github.com/defenseunicorns/pepr) is a type-safe Kubernetes middleware system.\n\nThe `capabilities` directory contains all the capabilities for this module. By default,\na capability is a single typescript file in the format of `capability-name.ts` that is\nimported in the root `pepr.ts` file as `import { HelloPepr } from "./capabilities/hello-pepr";`.\nBecause this is typescript, you can organize this however you choose, e.g. creating a sub-folder\nper-capability or common logic in shared files or folders.\n\nExample Structure:\n\n```\nModule Root\n\u251C\u2500\u2500 package.json\n\u251C\u2500\u2500 pepr.ts\n\u2514\u2500\u2500 capabilities\n    \u251C\u2500\u2500 example-one.ts\n    \u251C\u2500\u2500 example-three.ts\n    \u2514\u2500\u2500 example-two.ts\n```\n';
 var peprTS = 'import { PeprModule } from "pepr";\n// cfg loads your pepr configuration from package.json\nimport cfg from "./package.json";\n\n// HelloPepr is a demo capability that is included with Pepr. Comment or delete the line below to remove it.\nimport { HelloPepr } from "./capabilities/hello-pepr";\n\n/**\n * This is the main entrypoint for this Pepr module. It is run when the module is started.\n * This is where you register your Pepr configurations and capabilities.\n */\nnew PeprModule(cfg, [\n  // "HelloPepr" is a demo capability that is included with Pepr. Comment or delete the line below to remove it.\n  HelloPepr,\n\n  // Your additional capabilities go here\n]);\n';
-var helloPeprTS = 'import {\n  Capability,\n  K8s,\n  Log,\n  PeprMutateRequest,\n  RegisterKind,\n  a,\n  fetch,\n  fetchStatus,\n  kind,\n} from "pepr";\n\n/**\n *  The HelloPepr Capability is an example capability to demonstrate some general concepts of Pepr.\n *  To test this capability you run `pepr dev`and then run the following command:\n *  `kubectl apply -f capabilities/hello-pepr.samples.yaml`\n */\nexport const HelloPepr = new Capability({\n  name: "hello-pepr",\n  description: "A simple example capability to show how things work.",\n  namespaces: ["pepr-demo", "pepr-demo-2"],\n});\n\n// Use the \'When\' function to create a new action, use \'Store\' to persist data\nconst { When, Store } = HelloPepr;\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Namespace)                                   *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action removes the label `remove-me` when a Namespace is created.\n * Note we don\'t need to specify the namespace here, because we\'ve already specified\n * it in the Capability definition above.\n */\nWhen(a.Namespace)\n  .IsCreated()\n  .Mutate(ns => ns.RemoveLabel("remove-me"));\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Watch Action with K8s SSA (Namespace)                           *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action watches for the `pepr-demo-2` namespace to be created, then creates a ConfigMap with\n * the name `pepr-ssa-demo` and adds the namespace UID to the ConfigMap data. Because Pepr uses\n * server-side apply for this operation, the ConfigMap will be created or updated if it already exists.\n */\nWhen(a.Namespace)\n  .IsCreated()\n  .WithName("pepr-demo-2")\n  .Watch(async ns => {\n    Log.info("Namespace pepr-demo-2 was created.");\n\n    // You can share data between actions using the Store, including between different types of actions\n    Store.setItem("watch-data", "This data was stored by a Watch Action.");\n\n    // Apply the ConfigMap using K8s server-side apply\n    await K8s(kind.ConfigMap).Apply({\n      metadata: {\n        name: "pepr-ssa-demo",\n        namespace: "pepr-demo-2",\n      },\n      data: {\n        "ns-uid": ns.metadata.uid,\n      },\n    });\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 1)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This is a single action. They can be in the same file or put imported from other files.\n * In this example, when a ConfigMap is created with the name `example-1`, then add a label and annotation.\n *\n * Equivalent to manually running:\n * `kubectl label configmap example-1 pepr=was-here`\n * `kubectl annotate configmap example-1 pepr.dev=annotations-work-too`\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-1")\n  .Mutate(request => {\n    request\n      .SetLabel("pepr", "was-here")\n      .SetAnnotation("pepr.dev", "annotations-work-too");\n\n    // Use the Store to persist data between requests and Pepr controller pods\n    Store.setItem("example-1", "was-here");\n\n    // This data is written asynchronously and can be read back via `Store.getItem()` or `Store.subscribe()`\n    Store.setItem("example-1-data", JSON.stringify(request.Raw.data));\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate & Validate Actions (CM Example 2)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This combines 3 different types of actions: \'Mutate\', \'Validate\', and \'Watch\'. The order\n * of the actions is required, but each action is optional. In this example, when a ConfigMap is created\n * with the name `example-2`, then add a label and annotation, validate that the ConfigMap has the label\n * `pepr`, and log the request.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-2")\n  .Mutate(request => {\n    // This Mutate Action will mutate the request before it is persisted to the cluster\n\n    // Use `request.Merge()` to merge the new data with the existing data\n    request.Merge({\n      metadata: {\n        labels: {\n          pepr: "was-here",\n        },\n        annotations: {\n          "pepr.dev": "annotations-work-too",\n        },\n      },\n    });\n  })\n  .Validate(request => {\n    // This Validate Action will validate the request before it is persisted to the cluster\n\n    // Approve the request if the ConfigMap has the label \'pepr\'\n    if (request.HasLabel("pepr")) {\n      return request.Approve();\n    }\n\n    // Otherwise, deny the request with an error message (optional)\n    return request.Deny("ConfigMap must have label \'pepr\'");\n  })\n  .Watch((cm, phase) => {\n    // This Watch Action will watch the ConfigMap after it has been persisted to the cluster\n    Log.info(cm, `ConfigMap was ${phase} with the name example-2`);\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 2a)                               *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action shows a simple validation that will deny any ConfigMap that has the\n * annotation `evil`. Note that the `Deny()` function takes an optional second parameter that is a\n * user-defined status code to return.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .Validate(request => {\n    if (request.HasAnnotation("evil")) {\n      return request.Deny("No evil CM annotations allowed.", 400);\n    }\n\n    return request.Approve();\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 3)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action combines different styles. Unlike the previous actions, this one will look\n * for any ConfigMap in the `pepr-demo` namespace that has the label `change=by-label` during either\n * CREATE or UPDATE. Note that all conditions added such as `WithName()`, `WithLabel()`, `InNamespace()`,\n * are ANDs so all conditions must be true for the request to be processed.\n */\nWhen(a.ConfigMap)\n  .IsCreatedOrUpdated()\n  .WithLabel("change", "by-label")\n  .Mutate(request => {\n    // The K8s object e are going to mutate\n    const cm = request.Raw;\n\n    // Get the username and uid of the K8s request\n    const { username, uid } = request.Request.userInfo;\n\n    // Store some data about the request in the configmap\n    cm.data["username"] = username;\n    cm.data["uid"] = uid;\n\n    // You can still mix other ways of making changes too\n    request.SetAnnotation("pepr.dev", "making-waves");\n  });\n\n// This action validates the label `change=by-label` is deleted\nWhen(a.ConfigMap)\n  .IsDeleted()\n  .WithLabel("change", "by-label")\n  .Validate(request => {\n    // Log and then always approve the request\n    Log.info("CM with label \'change=by-label\' was deleted.");\n    return request.Approve();\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 4)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action show how you can use the `Mutate()` function without an inline function.\n * This is useful if you want to keep your actions small and focused on a single task,\n * or if you want to reuse the same function in multiple actions.\n */\nWhen(a.ConfigMap).IsCreated().WithName("example-4").Mutate(example4Cb);\n\n// This function uses the complete type definition, but is not required.\nfunction example4Cb(cm: PeprMutateRequest<a.ConfigMap>) {\n  cm.SetLabel("pepr.dev/first", "true");\n  cm.SetLabel("pepr.dev/second", "true");\n  cm.SetLabel("pepr.dev/third", "true");\n}\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 4a)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This is the same as Example 4, except this only operates on a CM in the `pepr-demo-2` namespace.\n * Note because the Capability defines namespaces, the namespace specified here must be one of those.\n * Alternatively, you can remove the namespace from the Capability definition and specify it here.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .InNamespace("pepr-demo-2")\n  .WithName("example-4a")\n  .Mutate(example4Cb);\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 5)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action is a bit more complex. It will look for any ConfigMap in the `pepr-demo`\n * namespace that has the label `chuck-norris` during CREATE. When it finds one, it will fetch a\n * random Chuck Norris joke from the API and add it to the ConfigMap. This is a great example of how\n * you can use Pepr to make changes to your K8s objects based on external data.\n *\n * Note the use of the `async` keyword. This is required for any action that uses `await` or `fetch()`.\n *\n * Also note we are passing a type to the `fetch()` function. This is optional, but it will help you\n * avoid mistakes when working with the data returned from the API. You can also use the `as` keyword to\n * cast the data returned from the API.\n *\n * These are equivalent:\n * ```ts\n * const joke = await fetch<TheChuckNorrisJoke>("https://api.chucknorris.io/jokes/random?category=dev");\n * const joke = await fetch("https://api.chucknorris.io/jokes/random?category=dev") as TheChuckNorrisJoke;\n * ```\n *\n * Alternatively, you can drop the type completely:\n *\n * ```ts\n * fetch("https://api.chucknorris.io/jokes/random?category=dev")\n * ```\n */\ninterface TheChuckNorrisJoke {\n  icon_url: string;\n  id: string;\n  url: string;\n  value: string;\n}\n\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithLabel("chuck-norris")\n  .Mutate(async change => {\n    // Try/catch is not needed as a response object will always be returned\n    const response = await fetch<TheChuckNorrisJoke>(\n      "https://api.chucknorris.io/jokes/random?category=dev",\n    );\n\n    // Instead, check the `response.ok` field\n    if (response.ok) {\n      // Add the Chuck Norris joke to the configmap\n      change.Raw.data["chuck-says"] = response.data.value;\n      return;\n    }\n\n    // You can also assert on different HTTP response codes\n    if (response.status === fetchStatus.NOT_FOUND) {\n      // Do something else\n      return;\n    }\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Secret Base64 Handling)                      *\n * ---------------------------------------------------------------------------------------------------\n *\n * The K8s JS client provides incomplete support for base64 encoding/decoding handling for secrets,\n * unlike the GO client. To make this less painful, Pepr automatically handles base64 encoding/decoding\n * secret data before and after the action is executed.\n */\nWhen(a.Secret)\n  .IsCreated()\n  .WithName("secret-1")\n  .Mutate(request => {\n    const secret = request.Raw;\n\n    // This will be encoded at the end of all processing back to base64: "Y2hhbmdlLXdpdGhvdXQtZW5jb2Rpbmc="\n    secret.data.magic = "change-without-encoding";\n\n    // You can modify the data directly, and it will be encoded at the end of all processing\n    secret.data.example += " - modified by Pepr";\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Untyped Custom Resource)                     *\n * ---------------------------------------------------------------------------------------------------\n *\n * Out of the box, Pepr supports all the standard Kubernetes objects. However, you can also create\n * your own types. This is useful if you are working with an Operator that creates custom resources.\n * There are two ways to do this, the first is to use the `When()` function with a `GenericKind`,\n * the second is to create a new class that extends `GenericKind` and use the `RegisterKind()` function.\n *\n * This example shows how to use the `When()` function with a `GenericKind`. Note that you\n * must specify the `group`, `version`, and `kind` of the object (if applicable). This is how Pepr knows\n * if the action should be triggered or not. Since we are using a `GenericKind`,\n * Pepr will not be able to provide any intellisense for the object, so you will need to refer to the\n * Kubernetes API documentation for the object you are working with.\n *\n * You will need to wait for the CRD in `hello-pepr.samples.yaml` to be created, then you can apply\n *\n * ```yaml\n * apiVersion: pepr.dev/v1\n * kind: Unicorn\n * metadata:\n *   name: example-1\n *   namespace: pepr-demo\n * spec:\n *   message: replace-me\n *   counter: 0\n * ```\n */\nWhen(a.GenericKind, {\n  group: "pepr.dev",\n  version: "v1",\n  kind: "Unicorn",\n})\n  .IsCreated()\n  .WithName("example-1")\n  .Mutate(request => {\n    request.Merge({\n      spec: {\n        message: "Hello Pepr without type data!",\n        counter: Math.random(),\n      },\n    });\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Typed Custom Resource)                       *\n * ---------------------------------------------------------------------------------------------------\n *\n * This example shows how to use the `RegisterKind()` function to create a new type. This is useful\n * if you are working with an Operator that creates custom resources and you want to have intellisense\n * for the object. Note that you must specify the `group`, `version`, and `kind` of the object (if applicable)\n * as this is how Pepr knows if the action should be triggered or not.\n *\n * Once you register a new Kind with Pepr, you can use the `When()` function with the new Kind. Ideally,\n * you should register custom Kinds at the top of your Capability file or Pepr Module so they are available\n * to all actions, but we are putting it here for demonstration purposes.\n *\n * You will need to wait for the CRD in `hello-pepr.samples.yaml` to be created, then you can apply\n *\n * ```yaml\n * apiVersion: pepr.dev/v1\n * kind: Unicorn\n * metadata:\n *   name: example-2\n *   namespace: pepr-demo\n * spec:\n *   message: replace-me\n *   counter: 0\n * ```*\n */\nclass UnicornKind extends a.GenericKind {\n  spec: {\n    /**\n     * JSDoc comments can be added to explain more details about the field.\n     *\n     * @example\n     * ```ts\n     * request.Raw.spec.message = "Hello Pepr!";\n     * ```\n     * */\n    message: string;\n    counter: number;\n  };\n}\n\nRegisterKind(UnicornKind, {\n  group: "pepr.dev",\n  version: "v1",\n  kind: "Unicorn",\n});\n\nWhen(UnicornKind)\n  .IsCreated()\n  .WithName("example-2")\n  .Mutate(request => {\n    request.Merge({\n      spec: {\n        message: "Hello Pepr with type data!",\n        counter: Math.random(),\n      },\n    });\n  });\n\n/**\n * A callback function that is called once the Pepr Store is fully loaded.\n */\nStore.onReady(data => {\n  Log.info(data, "Pepr Store Ready");\n});\n';
-var packageJSON = { name: "pepr", description: "Kubernetes application engine", author: "Defense Unicorns", homepage: "https://github.com/defenseunicorns/pepr", license: "Apache-2.0", bin: "dist/cli.js", repository: "defenseunicorns/pepr", engines: { node: ">=18.0.0" }, version: "0.14.2", main: "dist/lib.js", types: "dist/lib.d.ts", scripts: { "gen-data-json": "node hack/build-template-data.js", prebuild: "rm -fr dist/* && npm run gen-data-json", build: "tsc && node build.mjs", test: "npm run test:unit && npm run test:journey", "test:unit": "npm run gen-data-json && jest src --coverage", "test:journey": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run", "test:journey-wasm": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run-wasm", "test:journey:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0'", "test:journey:build": "npm run build && npm pack", "test:journey:image": "docker buildx build --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev", "test:journey:run": "jest journey/entrypoint.test.ts", "test:journey:run-wasm": "jest journey/entrypoint-wasm.test.ts", "format:check": "eslint src && prettier src --check", "format:fix": "eslint src --fix && prettier src --write" }, dependencies: { express: "4.18.2", "fast-json-patch": "3.1.1", "kubernetes-fluent-client": "1.7.0", pino: "8.16.0", "pino-pretty": "10.2.3", "prom-client": "15.0.0", ramda: "0.29.1" }, devDependencies: { "@commitlint/cli": "17.8.0", "@commitlint/config-conventional": "17.8.0", "@jest/globals": "29.7.0", "@types/eslint": "8.44.6", "@types/express": "4.17.20", "@types/node": "18.x.x", "@types/node-forge": "1.3.8", "@types/prompts": "2.4.7", "@types/ramda": "0.29.7", "@types/uuid": "9.0.6", jest: "29.7.0", nock: "13.3.4", "ts-jest": "29.1.1" }, peerDependencies: { "@typescript-eslint/eslint-plugin": "6.7.3", "@typescript-eslint/parser": "6.7.3", commander: "11.0.0", esbuild: "0.19.4", eslint: "8.50.0", "node-forge": "1.3.1", prettier: "3.0.3", prompts: "2.4.2", typescript: "5.2.2", uuid: "9.0.1" } };
+var helloPeprTS = 'import {\n  Capability,\n  K8s,\n  Log,\n  PeprMutateRequest,\n  RegisterKind,\n  a,\n  fetch,\n  fetchStatus,\n  kind,\n} from "pepr";\n\n/**\n *  The HelloPepr Capability is an example capability to demonstrate some general concepts of Pepr.\n *  To test this capability you run `pepr dev`and then run the following command:\n *  `kubectl apply -f capabilities/hello-pepr.samples.yaml`\n */\nexport const HelloPepr = new Capability({\n  name: "hello-pepr",\n  description: "A simple example capability to show how things work.",\n  namespaces: ["pepr-demo", "pepr-demo-2"],\n});\n\n// Use the \'When\' function to create a new action, use \'Store\' to persist data\nconst { When, Store } = HelloPepr;\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Namespace)                                   *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action removes the label `remove-me` when a Namespace is created.\n * Note we don\'t need to specify the namespace here, because we\'ve already specified\n * it in the Capability definition above.\n */\nWhen(a.Namespace)\n  .IsCreated()\n  .Mutate(ns => ns.RemoveLabel("remove-me"));\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Watch Action with K8s SSA (Namespace)                           *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action watches for the `pepr-demo-2` namespace to be created, then creates a ConfigMap with\n * the name `pepr-ssa-demo` and adds the namespace UID to the ConfigMap data. Because Pepr uses\n * server-side apply for this operation, the ConfigMap will be created or updated if it already exists.\n */\nWhen(a.Namespace)\n  .IsCreated()\n  .WithName("pepr-demo-2")\n  .Watch(async ns => {\n    Log.info("Namespace pepr-demo-2 was created.");\n\n    try {\n      // Apply the ConfigMap using K8s server-side apply\n      await K8s(kind.ConfigMap).Apply({\n        metadata: {\n          name: "pepr-ssa-demo",\n          namespace: "pepr-demo-2",\n        },\n        data: {\n          "ns-uid": ns.metadata.uid,\n        },\n      });\n    } catch (error) {\n      // You can use the Log object to log messages to the Pepr controller pod\n      Log.error(error, "Failed to apply ConfigMap using server-side apply.");\n    }\n\n    // You can share data between actions using the Store, including between different types of actions\n    Store.setItem("watch-data", "This data was stored by a Watch Action.");\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 1)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This is a single action. They can be in the same file or put imported from other files.\n * In this example, when a ConfigMap is created with the name `example-1`, then add a label and annotation.\n *\n * Equivalent to manually running:\n * `kubectl label configmap example-1 pepr=was-here`\n * `kubectl annotate configmap example-1 pepr.dev=annotations-work-too`\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-1")\n  .Mutate(request => {\n    request\n      .SetLabel("pepr", "was-here")\n      .SetAnnotation("pepr.dev", "annotations-work-too");\n\n    // Use the Store to persist data between requests and Pepr controller pods\n    Store.setItem("example-1", "was-here");\n\n    // This data is written asynchronously and can be read back via `Store.getItem()` or `Store.subscribe()`\n    Store.setItem("example-1-data", JSON.stringify(request.Raw.data));\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate & Validate Actions (CM Example 2)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This combines 3 different types of actions: \'Mutate\', \'Validate\', and \'Watch\'. The order\n * of the actions is required, but each action is optional. In this example, when a ConfigMap is created\n * with the name `example-2`, then add a label and annotation, validate that the ConfigMap has the label\n * `pepr`, and log the request.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-2")\n  .Mutate(request => {\n    // This Mutate Action will mutate the request before it is persisted to the cluster\n\n    // Use `request.Merge()` to merge the new data with the existing data\n    request.Merge({\n      metadata: {\n        labels: {\n          pepr: "was-here",\n        },\n        annotations: {\n          "pepr.dev": "annotations-work-too",\n        },\n      },\n    });\n  })\n  .Validate(request => {\n    // This Validate Action will validate the request before it is persisted to the cluster\n\n    // Approve the request if the ConfigMap has the label \'pepr\'\n    if (request.HasLabel("pepr")) {\n      return request.Approve();\n    }\n\n    // Otherwise, deny the request with an error message (optional)\n    return request.Deny("ConfigMap must have label \'pepr\'");\n  })\n  .Watch((cm, phase) => {\n    // This Watch Action will watch the ConfigMap after it has been persisted to the cluster\n    Log.info(cm, `ConfigMap was ${phase} with the name example-2`);\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 2a)                               *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action shows a simple validation that will deny any ConfigMap that has the\n * annotation `evil`. Note that the `Deny()` function takes an optional second parameter that is a\n * user-defined status code to return.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .Validate(request => {\n    if (request.HasAnnotation("evil")) {\n      return request.Deny("No evil CM annotations allowed.", 400);\n    }\n\n    return request.Approve();\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 3)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action combines different styles. Unlike the previous actions, this one will look\n * for any ConfigMap in the `pepr-demo` namespace that has the label `change=by-label` during either\n * CREATE or UPDATE. Note that all conditions added such as `WithName()`, `WithLabel()`, `InNamespace()`,\n * are ANDs so all conditions must be true for the request to be processed.\n */\nWhen(a.ConfigMap)\n  .IsCreatedOrUpdated()\n  .WithLabel("change", "by-label")\n  .Mutate(request => {\n    // The K8s object e are going to mutate\n    const cm = request.Raw;\n\n    // Get the username and uid of the K8s request\n    const { username, uid } = request.Request.userInfo;\n\n    // Store some data about the request in the configmap\n    cm.data["username"] = username;\n    cm.data["uid"] = uid;\n\n    // You can still mix other ways of making changes too\n    request.SetAnnotation("pepr.dev", "making-waves");\n  });\n\n// This action validates the label `change=by-label` is deleted\nWhen(a.ConfigMap)\n  .IsDeleted()\n  .WithLabel("change", "by-label")\n  .Validate(request => {\n    // Log and then always approve the request\n    Log.info("CM with label \'change=by-label\' was deleted.");\n    return request.Approve();\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 4)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action show how you can use the `Mutate()` function without an inline function.\n * This is useful if you want to keep your actions small and focused on a single task,\n * or if you want to reuse the same function in multiple actions.\n */\nWhen(a.ConfigMap).IsCreated().WithName("example-4").Mutate(example4Cb);\n\n// This function uses the complete type definition, but is not required.\nfunction example4Cb(cm: PeprMutateRequest<a.ConfigMap>) {\n  cm.SetLabel("pepr.dev/first", "true");\n  cm.SetLabel("pepr.dev/second", "true");\n  cm.SetLabel("pepr.dev/third", "true");\n}\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 4a)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This is the same as Example 4, except this only operates on a CM in the `pepr-demo-2` namespace.\n * Note because the Capability defines namespaces, the namespace specified here must be one of those.\n * Alternatively, you can remove the namespace from the Capability definition and specify it here.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .InNamespace("pepr-demo-2")\n  .WithName("example-4a")\n  .Mutate(example4Cb);\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 5)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action is a bit more complex. It will look for any ConfigMap in the `pepr-demo`\n * namespace that has the label `chuck-norris` during CREATE. When it finds one, it will fetch a\n * random Chuck Norris joke from the API and add it to the ConfigMap. This is a great example of how\n * you can use Pepr to make changes to your K8s objects based on external data.\n *\n * Note the use of the `async` keyword. This is required for any action that uses `await` or `fetch()`.\n *\n * Also note we are passing a type to the `fetch()` function. This is optional, but it will help you\n * avoid mistakes when working with the data returned from the API. You can also use the `as` keyword to\n * cast the data returned from the API.\n *\n * These are equivalent:\n * ```ts\n * const joke = await fetch<TheChuckNorrisJoke>("https://api.chucknorris.io/jokes/random?category=dev");\n * const joke = await fetch("https://api.chucknorris.io/jokes/random?category=dev") as TheChuckNorrisJoke;\n * ```\n *\n * Alternatively, you can drop the type completely:\n *\n * ```ts\n * fetch("https://api.chucknorris.io/jokes/random?category=dev")\n * ```\n */\ninterface TheChuckNorrisJoke {\n  icon_url: string;\n  id: string;\n  url: string;\n  value: string;\n}\n\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithLabel("chuck-norris")\n  .Mutate(async change => {\n    // Try/catch is not needed as a response object will always be returned\n    const response = await fetch<TheChuckNorrisJoke>(\n      "https://api.chucknorris.io/jokes/random?category=dev",\n    );\n\n    // Instead, check the `response.ok` field\n    if (response.ok) {\n      // Add the Chuck Norris joke to the configmap\n      change.Raw.data["chuck-says"] = response.data.value;\n      return;\n    }\n\n    // You can also assert on different HTTP response codes\n    if (response.status === fetchStatus.NOT_FOUND) {\n      // Do something else\n      return;\n    }\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Secret Base64 Handling)                      *\n * ---------------------------------------------------------------------------------------------------\n *\n * The K8s JS client provides incomplete support for base64 encoding/decoding handling for secrets,\n * unlike the GO client. To make this less painful, Pepr automatically handles base64 encoding/decoding\n * secret data before and after the action is executed.\n */\nWhen(a.Secret)\n  .IsCreated()\n  .WithName("secret-1")\n  .Mutate(request => {\n    const secret = request.Raw;\n\n    // This will be encoded at the end of all processing back to base64: "Y2hhbmdlLXdpdGhvdXQtZW5jb2Rpbmc="\n    secret.data.magic = "change-without-encoding";\n\n    // You can modify the data directly, and it will be encoded at the end of all processing\n    secret.data.example += " - modified by Pepr";\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Untyped Custom Resource)                     *\n * ---------------------------------------------------------------------------------------------------\n *\n * Out of the box, Pepr supports all the standard Kubernetes objects. However, you can also create\n * your own types. This is useful if you are working with an Operator that creates custom resources.\n * There are two ways to do this, the first is to use the `When()` function with a `GenericKind`,\n * the second is to create a new class that extends `GenericKind` and use the `RegisterKind()` function.\n *\n * This example shows how to use the `When()` function with a `GenericKind`. Note that you\n * must specify the `group`, `version`, and `kind` of the object (if applicable). This is how Pepr knows\n * if the action should be triggered or not. Since we are using a `GenericKind`,\n * Pepr will not be able to provide any intellisense for the object, so you will need to refer to the\n * Kubernetes API documentation for the object you are working with.\n *\n * You will need to wait for the CRD in `hello-pepr.samples.yaml` to be created, then you can apply\n *\n * ```yaml\n * apiVersion: pepr.dev/v1\n * kind: Unicorn\n * metadata:\n *   name: example-1\n *   namespace: pepr-demo\n * spec:\n *   message: replace-me\n *   counter: 0\n * ```\n */\nWhen(a.GenericKind, {\n  group: "pepr.dev",\n  version: "v1",\n  kind: "Unicorn",\n})\n  .IsCreated()\n  .WithName("example-1")\n  .Mutate(request => {\n    request.Merge({\n      spec: {\n        message: "Hello Pepr without type data!",\n        counter: Math.random(),\n      },\n    });\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Typed Custom Resource)                       *\n * ---------------------------------------------------------------------------------------------------\n *\n * This example shows how to use the `RegisterKind()` function to create a new type. This is useful\n * if you are working with an Operator that creates custom resources and you want to have intellisense\n * for the object. Note that you must specify the `group`, `version`, and `kind` of the object (if applicable)\n * as this is how Pepr knows if the action should be triggered or not.\n *\n * Once you register a new Kind with Pepr, you can use the `When()` function with the new Kind. Ideally,\n * you should register custom Kinds at the top of your Capability file or Pepr Module so they are available\n * to all actions, but we are putting it here for demonstration purposes.\n *\n * You will need to wait for the CRD in `hello-pepr.samples.yaml` to be created, then you can apply\n *\n * ```yaml\n * apiVersion: pepr.dev/v1\n * kind: Unicorn\n * metadata:\n *   name: example-2\n *   namespace: pepr-demo\n * spec:\n *   message: replace-me\n *   counter: 0\n * ```*\n */\nclass UnicornKind extends a.GenericKind {\n  spec: {\n    /**\n     * JSDoc comments can be added to explain more details about the field.\n     *\n     * @example\n     * ```ts\n     * request.Raw.spec.message = "Hello Pepr!";\n     * ```\n     * */\n    message: string;\n    counter: number;\n  };\n}\n\nRegisterKind(UnicornKind, {\n  group: "pepr.dev",\n  version: "v1",\n  kind: "Unicorn",\n});\n\nWhen(UnicornKind)\n  .IsCreated()\n  .WithName("example-2")\n  .Mutate(request => {\n    request.Merge({\n      spec: {\n        message: "Hello Pepr with type data!",\n        counter: Math.random(),\n      },\n    });\n  });\n\n/**\n * A callback function that is called once the Pepr Store is fully loaded.\n */\nStore.onReady(data => {\n  Log.info(data, "Pepr Store Ready");\n});\n';
+var packageJSON = { name: "pepr", description: "Kubernetes application engine", author: "Defense Unicorns", homepage: "https://github.com/defenseunicorns/pepr", license: "Apache-2.0", bin: "dist/cli.js", repository: "defenseunicorns/pepr", engines: { node: ">=18.0.0" }, version: "0.16.0", main: "dist/lib.js", types: "dist/lib.d.ts", scripts: { "gen-data-json": "node hack/build-template-data.js", prebuild: "rm -fr dist/* && npm run gen-data-json", build: "tsc && node build.mjs", test: "npm run test:unit && npm run test:journey", "test:unit": "npm run gen-data-json && jest src --coverage --detectOpenHandles", "test:journey": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run", "test:journey-wasm": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run-wasm", "test:journey:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0' --wait && kubectl rollout status deployment -n kube-system", "test:journey:build": "npm run build && npm pack", "test:journey:image": "docker buildx build --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev", "test:journey:run": "jest --detectOpenHandles journey/entrypoint.test.ts", "test:journey:run-wasm": "jest --detectOpenHandles journey/entrypoint-wasm.test.ts", "format:check": "eslint src && prettier src --check", "format:fix": "eslint src --fix && prettier src --write" }, dependencies: { "@types/ramda": "0.29.9", express: "4.18.2", "fast-json-patch": "3.1.1", "kubernetes-fluent-client": "1.8.2", pino: "8.16.2", "pino-pretty": "10.2.3", "prom-client": "15.0.0", ramda: "0.29.1" }, devDependencies: { "@commitlint/cli": "18.4.1", "@commitlint/config-conventional": "18.4.0", "@jest/globals": "29.7.0", "@types/eslint": "8.44.7", "@types/express": "4.17.21", "@types/node": "18.x.x", "@types/node-forge": "1.3.9", "@types/prompts": "2.4.8", "@types/uuid": "9.0.7", jest: "29.7.0", nock: "13.3.8", "ts-jest": "29.1.1" }, peerDependencies: { "@typescript-eslint/eslint-plugin": "6.7.3", "@typescript-eslint/parser": "6.7.3", commander: "11.0.0", esbuild: "0.19.4", eslint: "8.50.0", "node-forge": "1.3.1", prettier: "3.0.3", prompts: "2.4.2", typescript: "5.2.2", uuid: "9.0.1" } };
 
 // src/templates/pepr.code-snippets.json
 var pepr_code_snippets_default = {
@@ -1220,7 +1262,7 @@ var tsconfig_module_default = {
 };
 
 // src/cli/init/utils.ts
-var import_fs4 = require("fs");
+var import_fs5 = require("fs");
 function sanitizeName(name2) {
   let sanitized = name2.toLowerCase().replace(/[^a-z0-9-]+/gi, "-");
   sanitized = sanitized.replace(/^-+|-+$/g, "");
@@ -1229,7 +1271,7 @@ function sanitizeName(name2) {
 }
 async function createDir(dir) {
   try {
-    await import_fs4.promises.mkdir(dir);
+    await import_fs5.promises.mkdir(dir);
   } catch (err) {
     if (err && err.code === "EEXIST") {
       throw new Error(`Directory ${dir} already exists`);
@@ -1242,7 +1284,7 @@ function write(path, data) {
   if (typeof data !== "string") {
     data = JSON.stringify(data, null, 2);
   }
-  return import_fs4.promises.writeFile(path, data);
+  return import_fs5.promises.writeFile(path, data);
 }
 
 // src/cli/init/templates.ts
@@ -1330,7 +1372,7 @@ var eslint = {
 
 // src/cli/format.ts
 var import_eslint = require("eslint");
-var import_fs5 = require("fs");
+var import_fs6 = require("fs");
 var import_prettier = require("prettier");
 function format_default(program2) {
   program2.command("format").description("Lint and format this Pepr module").option("-v, --validate-only", "Do not modify files, only validate formatting").action(async (opts) => {
@@ -1363,7 +1405,7 @@ async function peprFormat(validateOnly) {
         await import_eslint.ESLint.outputFixes(results);
       }
       for (const { filePath } of results) {
-        const content = await import_fs5.promises.readFile(filePath, "utf8");
+        const content = await import_fs6.promises.readFile(filePath, "utf8");
         const cfg = await (0, import_prettier.resolveConfig)(filePath);
         const formatted = await (0, import_prettier.format)(content, { filepath: filePath, ...cfg });
         if (validateOnly) {
@@ -1372,7 +1414,7 @@ async function peprFormat(validateOnly) {
             console.error(`File ${filePath} is not formatted correctly`);
           }
         } else {
-          await import_fs5.promises.writeFile(filePath, formatted);
+          await import_fs6.promises.writeFile(filePath, formatted);
         }
       }
       return !hasFailure;
@@ -1384,7 +1426,9 @@ async function peprFormat(validateOnly) {
 }
 
 // src/cli/build.ts
+var import_commander = require("commander");
 var peprTS2 = "pepr.ts";
+var outputDir = "dist";
 function build_default(program2) {
   program2.command("build").description("Build a Pepr Module for deployment").option(
     "-e, --entry-point [file]",
@@ -1392,8 +1436,17 @@ function build_default(program2) {
     peprTS2
   ).option(
     "-r, --registry-info [<registry>/<username>]",
-    "Where to upload the image. Note: You must be signed into the registry"
+    "Registry Info: Image registry and username. Note: You must be signed into the registry"
+  ).option("-o, --output-dir [output directory]", "Define where to place build output").addOption(
+    new import_commander.Option("--rbac-mode [admin|scoped]", "Rbac Mode: admin, scoped (default: admin)").choices(["admin", "scoped"]).default("admin")
   ).action(async (opts) => {
+    if (opts.outputDir) {
+      outputDir = opts.outputDir;
+      createDirectoryIfNotExists(outputDir).catch((error) => {
+        console.error(`Error creating output directory: ${error}`);
+        process.exit(1);
+      });
+    }
     const { cfg, path, uuid } = await buildModule(void 0, opts.entryPoint);
     const { includedFiles } = cfg.pepr;
     let image = "";
@@ -1422,12 +1475,12 @@ function build_default(program2) {
       assets.image = image;
     }
     const yamlFile = `pepr-module-${uuid}.yaml`;
-    const yamlPath = (0, import_path.resolve)("dist", yamlFile);
-    const yaml = await assets.allYaml();
-    const zarfPath = (0, import_path.resolve)("dist", "zarf.yaml");
+    const yamlPath = (0, import_path.resolve)(outputDir, yamlFile);
+    const yaml = await assets.allYaml(opts.rbacMode);
+    const zarfPath = (0, import_path.resolve)(outputDir, "zarf.yaml");
     const zarf = assets.zarfYaml(yamlFile);
-    await import_fs6.promises.writeFile(yamlPath, yaml);
-    await import_fs6.promises.writeFile(zarfPath, zarf);
+    await import_fs7.promises.writeFile(yamlPath, yaml);
+    await import_fs7.promises.writeFile(zarfPath, zarf);
     console.info(`\u2705 K8s resource for the module saved to ${yamlPath}`);
   });
 }
@@ -1438,15 +1491,15 @@ async function loadModule(entryPoint = peprTS2) {
   const cfgPath = (0, import_path.resolve)(".", "package.json");
   const input = (0, import_path.resolve)(".", entryPoint);
   try {
-    await import_fs6.promises.access(cfgPath);
-    await import_fs6.promises.access(input);
+    await import_fs7.promises.access(cfgPath);
+    await import_fs7.promises.access(input);
   } catch (e) {
     console.error(
       `Could not find ${cfgPath} or ${input} in the current directory. Please run this command from the root of your module's directory.`
     );
     process.exit(1);
   }
-  const moduleText = await import_fs6.promises.readFile(cfgPath, { encoding: "utf-8" });
+  const moduleText = await import_fs7.promises.readFile(cfgPath, { encoding: "utf-8" });
   const cfg = JSON.parse(moduleText);
   const { uuid } = cfg.pepr;
   const name2 = `pepr-${uuid}.js`;
@@ -1458,7 +1511,7 @@ async function loadModule(entryPoint = peprTS2) {
     cfg,
     input,
     name: name2,
-    path: (0, import_path.resolve)("dist", name2),
+    path: (0, import_path.resolve)(outputDir, name2),
     uuid
   };
 }
@@ -1507,7 +1560,7 @@ async function buildModule(reloader, entryPoint = peprTS2) {
     }
     if (entryPoint !== peprTS2) {
       ctxCfg.minify = false;
-      ctxCfg.outfile = (0, import_path.resolve)("dist", (0, import_path.basename)(entryPoint, (0, import_path.extname)(entryPoint))) + ".js";
+      ctxCfg.outfile = (0, import_path.resolve)(outputDir, (0, import_path.basename)(entryPoint, (0, import_path.extname)(entryPoint))) + ".js";
       ctxCfg.packages = "external";
       ctxCfg.treeShaking = false;
     }
@@ -1589,7 +1642,7 @@ function deploy_default(program2) {
 
 // src/cli/dev.ts
 var import_child_process3 = require("child_process");
-var import_fs7 = require("fs");
+var import_fs8 = require("fs");
 var import_prompts2 = __toESM(require("prompts"));
 function dev_default(program2) {
   program2.command("dev").description("Setup a local webhook development environment").option("-h, --host [host]", "Host to listen on", "host.k3d.internal").option("--confirm", "Skip confirmation prompt").action(async (opts) => {
@@ -1612,8 +1665,8 @@ function dev_default(program2) {
       path,
       opts.host
     );
-    await import_fs7.promises.writeFile("insecure-tls.crt", webhook.tls.pem.crt);
-    await import_fs7.promises.writeFile("insecure-tls.key", webhook.tls.pem.key);
+    await import_fs8.promises.writeFile("insecure-tls.crt", webhook.tls.pem.crt);
+    await import_fs8.promises.writeFile("insecure-tls.key", webhook.tls.pem.key);
     try {
       let program3;
       const runFork = async () => {
@@ -1657,7 +1710,7 @@ var import_path2 = require("path");
 var import_prompts4 = __toESM(require("prompts"));
 
 // src/cli/init/walkthrough.ts
-var import_fs8 = require("fs");
+var import_fs9 = require("fs");
 var import_prompts3 = __toESM(require("prompts"));
 
 // src/lib/errors.ts
@@ -1677,7 +1730,7 @@ function walkthrough() {
     validate: async (val) => {
       try {
         const name2 = sanitizeName(val);
-        await import_fs8.promises.access(name2, import_fs8.promises.constants.F_OK);
+        await import_fs9.promises.access(name2, import_fs9.promises.constants.F_OK);
         return "A directory with this name already exists";
       } catch (e) {
         return val.length > 2 || "The name must be at least 3 characters long";
@@ -1797,11 +1850,11 @@ function init_default(program2) {
 }
 
 // src/cli/root.ts
-var import_commander = require("commander");
-var RootCmd = class extends import_commander.Command {
+var import_commander2 = require("commander");
+var RootCmd = class extends import_commander2.Command {
   // eslint-disable-next-line class-methods-use-this
   createCommand(name2) {
-    const cmd = new import_commander.Command(name2);
+    const cmd = new import_commander2.Command(name2);
     cmd.option("-l, --log-level [level]", "Log level: debug, info, warn, error", "info");
     cmd.hook("preAction", (run) => {
       logger_default.level = run.opts().logLevel;
@@ -1812,7 +1865,7 @@ var RootCmd = class extends import_commander.Command {
 
 // src/cli/update.ts
 var import_child_process5 = require("child_process");
-var import_fs9 = __toESM(require("fs"));
+var import_fs10 = __toESM(require("fs"));
 var import_path3 = require("path");
 var import_prompts5 = __toESM(require("prompts"));
 function update_default(program2) {
@@ -1852,12 +1905,12 @@ function update_default(program2) {
         await write((0, import_path3.resolve)(".vscode", snippet.path), snippet.data);
         await write((0, import_path3.resolve)(".vscode", codeSettings.path), codeSettings.data);
         const samplePath = (0, import_path3.resolve)("capabilities", samplesYaml.path);
-        if (import_fs9.default.existsSync(samplePath)) {
-          import_fs9.default.unlinkSync(samplePath);
+        if (import_fs10.default.existsSync(samplePath)) {
+          import_fs10.default.unlinkSync(samplePath);
           await write(samplePath, samplesYaml.data);
         }
         const tsPath = (0, import_path3.resolve)("capabilities", helloPepr.path);
-        if (import_fs9.default.existsSync(tsPath)) {
+        if (import_fs10.default.existsSync(tsPath)) {
           await write(tsPath, helloPepr.data);
         }
       }

package/dist/controller.js

@@ -48,7 +48,7 @@ if (process.env.LOG_LEVEL) {
 var logger_default = Log;
 
 // src/templates/data.json
-var packageJSON = { name: "pepr", description: "Kubernetes application engine", author: "Defense Unicorns", homepage: "https://github.com/defenseunicorns/pepr", license: "Apache-2.0", bin: "dist/cli.js", repository: "defenseunicorns/pepr", engines: { node: ">=18.0.0" }, version: "0.14.2", main: "dist/lib.js", types: "dist/lib.d.ts", scripts: { "gen-data-json": "node hack/build-template-data.js", prebuild: "rm -fr dist/* && npm run gen-data-json", build: "tsc && node build.mjs", test: "npm run test:unit && npm run test:journey", "test:unit": "npm run gen-data-json && jest src --coverage", "test:journey": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run", "test:journey-wasm": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run-wasm", "test:journey:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0'", "test:journey:build": "npm run build && npm pack", "test:journey:image": "docker buildx build --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev", "test:journey:run": "jest journey/entrypoint.test.ts", "test:journey:run-wasm": "jest journey/entrypoint-wasm.test.ts", "format:check": "eslint src && prettier src --check", "format:fix": "eslint src --fix && prettier src --write" }, dependencies: { express: "4.18.2", "fast-json-patch": "3.1.1", "kubernetes-fluent-client": "1.7.0", pino: "8.16.0", "pino-pretty": "10.2.3", "prom-client": "15.0.0", ramda: "0.29.1" }, devDependencies: { "@commitlint/cli": "17.8.0", "@commitlint/config-conventional": "17.8.0", "@jest/globals": "29.7.0", "@types/eslint": "8.44.6", "@types/express": "4.17.20", "@types/node": "18.x.x", "@types/node-forge": "1.3.8", "@types/prompts": "2.4.7", "@types/ramda": "0.29.7", "@types/uuid": "9.0.6", jest: "29.7.0", nock: "13.3.4", "ts-jest": "29.1.1" }, peerDependencies: { "@typescript-eslint/eslint-plugin": "6.7.3", "@typescript-eslint/parser": "6.7.3", commander: "11.0.0", esbuild: "0.19.4", eslint: "8.50.0", "node-forge": "1.3.1", prettier: "3.0.3", prompts: "2.4.2", typescript: "5.2.2", uuid: "9.0.1" } };
+var packageJSON = { name: "pepr", description: "Kubernetes application engine", author: "Defense Unicorns", homepage: "https://github.com/defenseunicorns/pepr", license: "Apache-2.0", bin: "dist/cli.js", repository: "defenseunicorns/pepr", engines: { node: ">=18.0.0" }, version: "0.16.0", main: "dist/lib.js", types: "dist/lib.d.ts", scripts: { "gen-data-json": "node hack/build-template-data.js", prebuild: "rm -fr dist/* && npm run gen-data-json", build: "tsc && node build.mjs", test: "npm run test:unit && npm run test:journey", "test:unit": "npm run gen-data-json && jest src --coverage --detectOpenHandles", "test:journey": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run", "test:journey-wasm": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run-wasm", "test:journey:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0' --wait && kubectl rollout status deployment -n kube-system", "test:journey:build": "npm run build && npm pack", "test:journey:image": "docker buildx build --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev", "test:journey:run": "jest --detectOpenHandles journey/entrypoint.test.ts", "test:journey:run-wasm": "jest --detectOpenHandles journey/entrypoint-wasm.test.ts", "format:check": "eslint src && prettier src --check", "format:fix": "eslint src --fix && prettier src --write" }, dependencies: { "@types/ramda": "0.29.9", express: "4.18.2", "fast-json-patch": "3.1.1", "kubernetes-fluent-client": "1.8.2", pino: "8.16.2", "pino-pretty": "10.2.3", "prom-client": "15.0.0", ramda: "0.29.1" }, devDependencies: { "@commitlint/cli": "18.4.1", "@commitlint/config-conventional": "18.4.0", "@jest/globals": "29.7.0", "@types/eslint": "8.44.7", "@types/express": "4.17.21", "@types/node": "18.x.x", "@types/node-forge": "1.3.9", "@types/prompts": "2.4.8", "@types/uuid": "9.0.7", jest: "29.7.0", nock: "13.3.8", "ts-jest": "29.1.1" }, peerDependencies: { "@typescript-eslint/eslint-plugin": "6.7.3", "@typescript-eslint/parser": "6.7.3", commander: "11.0.0", esbuild: "0.19.4", eslint: "8.50.0", "node-forge": "1.3.1", prettier: "3.0.3", prompts: "2.4.2", typescript: "5.2.2", uuid: "9.0.1" } };
 
 // src/runtime/controller.ts
 var { version } = packageJSON;

package/dist/lib/assets/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../../src/lib/assets/deploy.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC;AAQ3B,wBAAsB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,iBA8CnE"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../../src/lib/assets/deploy.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC;AAS3B,wBAAsB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,iBA8CnE"}

package/dist/lib/assets/index.d.ts

@@ -13,6 +13,6 @@ export declare class Assets {
     constructor(config: ModuleConfig, path: string, host?: string | undefined);
     deploy: (webhookTimeout?: number) => Promise<void>;
     zarfYaml: (path: string) => string;
-    allYaml: () => Promise<string>;
+    allYaml: (rbacMode: string) => Promise<string>;
 }
 //# sourceMappingURL=index.d.ts.map

package/dist/lib/assets/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/assets/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,MAAM,EAAU,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAK5C,qBAAa,MAAM;IAQf,QAAQ,CAAC,MAAM,EAAE,YAAY;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,IAAI,CAAC;IAThB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAG,gBAAgB,EAAE,CAAC;IAClC,KAAK,EAAE,MAAM,CAAC;gBAGH,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,oBAAQ;IAaxB,MAAM,oBAA2B,MAAM,mBAGrC;IAEF,QAAQ,SAAU,MAAM,YAA0B;IAElD,OAAO,wBAGL;CACH"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/assets/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,MAAM,EAAU,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAK5C,qBAAa,MAAM;IAQf,QAAQ,CAAC,MAAM,EAAE,YAAY;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,IAAI,CAAC;IAThB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAG,gBAAgB,EAAE,CAAC;IAClC,KAAK,EAAE,MAAM,CAAC;gBAGH,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,oBAAQ;IAaxB,MAAM,oBAA2B,MAAM,mBAGrC;IAEF,QAAQ,SAAU,MAAM,YAA0B;IAElD,OAAO,aAAoB,MAAM,qBAG/B;CACH"}

package/dist/lib/assets/rbac.d.ts

@@ -1,11 +1,12 @@
 import { kind } from "kubernetes-fluent-client";
+import { CapabilityExport } from "../types";
 /**
  * Grants the controller access to cluster resources beyond the mutating webhook.
  *
  * @todo: should dynamically generate this based on resources used by the module. will also need to explore how this should work for multiple modules.
  * @returns
  */
-export declare function clusterRole(name: string): kind.ClusterRole;
+export declare function clusterRole(name: string, capabilities: CapabilityExport[], rbacMode?: string): kind.ClusterRole;
 export declare function clusterRoleBinding(name: string): kind.ClusterRoleBinding;
 export declare function serviceAccount(name: string): kind.ServiceAccount;
 export declare function storeRole(name: string): kind.Role;

package/dist/lib/assets/rbac.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rbac.d.ts","sourceRoot":"","sources":["../../../src/lib/assets/rbac.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,0BAA0B,CAAC;AAEhD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,WAAW,CAc1D;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAkBxE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,cAAc,CAShE;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,IAAI,CAejD;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,WAAW,CAmB/D"}
+{"version":3,"file":"rbac.d.ts","sourceRoot":"","sources":["../../../src/lib/assets/rbac.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,0BAA0B,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAE5C;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,gBAAgB,EAAE,EAAE,QAAQ,GAAE,MAAW,GAAG,IAAI,CAAC,WAAW,CA6BnH;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAkBxE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,cAAc,CAShE;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,IAAI,CAejD;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,WAAW,CAmB/D"}

package/dist/lib/assets/yaml.d.ts

@@ -1,4 +1,4 @@
 import { Assets } from ".";
 export declare function zarfYaml({ name, image, config }: Assets, path: string): string;
-export declare function allYaml(assets: Assets): Promise<string>;
+export declare function allYaml(assets: Assets, rbacMode: string): Promise<string>;
 //# sourceMappingURL=yaml.d.ts.map

package/dist/lib/assets/yaml.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"yaml.d.ts","sourceRoot":"","sources":["../../../src/lib/assets/yaml.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC;AAO3B,wBAAgB,QAAQ,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,UA0BrE;AAED,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,mBA0C3C"}
+{"version":3,"file":"yaml.d.ts","sourceRoot":"","sources":["../../../src/lib/assets/yaml.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC;AAO3B,wBAAgB,QAAQ,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,UA0BrE;AAED,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,mBA0C7D"}

package/dist/lib/capability.d.ts

@@ -1,11 +1,20 @@
 import { GenericClass, GroupVersionKind } from "kubernetes-fluent-client";
 import { PeprStore, Storage } from "./storage";
+import { Schedule } from "./schedule";
 import { Binding, CapabilityCfg, CapabilityExport, WhenSelector } from "./types";
 /**
  * A capability is a unit of functionality that can be registered with the Pepr runtime.
  */
 export declare class Capability implements CapabilityExport {
     #private;
+    hasSchedule: boolean;
+    /**
+     * Run code on a schedule with the capability.
+     *
+     * @param schedule The schedule to run the code on
+     * @returns
+     */
+    OnSchedule: (schedule: Schedule) => void;
     /**
      * Store is a key-value data store that can be used to persist data that should be shared
      * between requests. Each capability has its own store, and the data is persisted in Kubernetes
@@ -14,11 +23,27 @@ export declare class Capability implements CapabilityExport {
      * Note: You should only access the store from within an action.
      */
     Store: PeprStore;
+    /**
+     * ScheduleStore is a key-value data store used to persist schedule data that should be shared
+     * between intervals. Each Schedule shares store, and the data is persisted in Kubernetes
+     * in the `pepr-system` namespace.
+     *
+     * Note: There is no direct access to schedule store
+     */
+    ScheduleStore: PeprStore;
     get bindings(): Binding[];
     get name(): string;
     get description(): string;
     get namespaces(): string[];
     constructor(cfg: CapabilityCfg);
+    /**
+     * Register the store with the capability. This is called automatically by the Pepr controller.
+     *
+     * @param store
+     */
+    registerScheduleStore: () => {
+        scheduleStore: Storage;
+    };
     /**
      * Register the store with the capability. This is called automatically by the Pepr controller.
      *