pepr 0.26.2 → 0.27.0

package/dist/cli.js

@@ -106,8 +106,8 @@ var banner = `\x1B[0m\x1B[38;2;96;96;96m \x1B[0m\x1B[38;2;96;96;96m \x1B[0m\x1B[
 // src/cli/build.ts
 var import_child_process2 = require("child_process");
 var import_esbuild = require("esbuild");
-var import_fs7 = require("fs");
-var import_path = require("path");
+var import_fs8 = require("fs");
+var import_path2 = require("path");
 
 // src/lib/included-files.ts
 var import_fs = require("fs");
@@ -127,6 +127,7 @@ async function createDockerfile(version3, description, includedFiles) {
 
 // src/lib/assets/index.ts
 var import_crypto3 = __toESM(require("crypto"));
+var import_client_node2 = require("@kubernetes/client-node");
 
 // src/lib/tls.ts
 var import_node_forge = __toESM(require("node-forge"));
@@ -404,7 +405,7 @@ async function namespaceDeploymentsReady(namespace2 = "pepr-system") {
     if (ready) {
       return ready;
     }
-    await new Promise((resolve4) => setTimeout(resolve4, 1e3));
+    await new Promise((resolve5) => setTimeout(resolve5, 1e3));
   }
   logger_default.info(`All ${namespace2} deployments are ready`);
 }
@@ -427,19 +428,48 @@ var parseTimeout = (value, previous) => {
   }
   return parsedValue;
 };
+function dedent(file) {
+  const lines = file.split("\n");
+  if (lines[0].trim() === "") {
+    lines.shift();
+    file = lines.join("\n");
+  }
+  const match = file.match(/^[ \t]*(?=\S)/gm);
+  const indent = match && Math.min(...match.map((el) => el.length));
+  if (indent && indent > 0) {
+    const re = new RegExp(`^[ \\t]{${indent}}`, "gm");
+    return file.replace(re, "");
+  }
+  return file;
+}
+function replaceString(str, stringA, stringB) {
+  const escapedStringA = stringA.replace(/[-\/\\^$*+?.()|[\]{}]/g, "\\$&");
+  const regExp = new RegExp(escapedStringA, "g");
+  return str.replace(regExp, stringB);
+}
 
 // src/lib/assets/pods.ts
 function namespace(namespaceLabels) {
-  return {
-    apiVersion: "v1",
-    kind: "Namespace",
-    metadata: {
-      name: "pepr-system",
-      labels: namespaceLabels ?? {}
-    }
-  };
+  if (namespaceLabels) {
+    return {
+      apiVersion: "v1",
+      kind: "Namespace",
+      metadata: {
+        name: "pepr-system",
+        labels: namespaceLabels ?? {}
+      }
+    };
+  } else {
+    return {
+      apiVersion: "v1",
+      kind: "Namespace",
+      metadata: {
+        name: "pepr-system"
+      }
+    };
+  }
 }
-function watcher(assets, hash) {
+function watcher(assets, hash, buildTimestamp) {
   const { name: name2, image, capabilities, config } = assets;
   let hasSchedule = false;
   const app = `${name2}-watcher`;
@@ -483,7 +513,7 @@ function watcher(assets, hash) {
       template: {
         metadata: {
           annotations: {
-            buildTimestamp: `${Date.now()}`
+            buildTimestamp: `${buildTimestamp}`
           },
           labels: {
             app,
@@ -576,7 +606,7 @@ function watcher(assets, hash) {
     }
   };
 }
-function deployment(assets, hash) {
+function deployment(assets, hash, buildTimestamp) {
   const { name: name2, image, config } = assets;
   const app = name2;
   return {
@@ -605,7 +635,7 @@ function deployment(assets, hash) {
       template: {
         metadata: {
           annotations: {
-            buildTimestamp: `${Date.now()}`
+            buildTimestamp: `${buildTimestamp}`
           },
           labels: {
             app,
@@ -1058,11 +1088,11 @@ async function setupController(assets, code, hash, force) {
   const apiToken = apiTokenSecret(name2, assets.apiToken);
   await (0, import_kubernetes_fluent_client3.K8s)(import_kubernetes_fluent_client3.kind.Secret).Apply(apiToken, { force });
   logger_default.info("Applying deployment");
-  const dep = deployment(assets, hash);
+  const dep = deployment(assets, hash, assets.buildTimestamp);
   await (0, import_kubernetes_fluent_client3.K8s)(import_kubernetes_fluent_client3.kind.Deployment).Apply(dep, { force });
 }
 async function setupWatcher(assets, hash, force) {
-  const watchDeployment = watcher(assets, hash);
+  const watchDeployment = watcher(assets, hash, assets.buildTimestamp);
   if (watchDeployment) {
     logger_default.info("Applying watcher deployment");
     await (0, import_kubernetes_fluent_client3.K8s)(import_kubernetes_fluent_client3.kind.Deployment).Apply(watchDeployment, { force });
@@ -1075,7 +1105,7 @@ async function setupWatcher(assets, hash, force) {
 // src/lib/assets/loader.ts
 var import_child_process = require("child_process");
 function loadCapabilities(path) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     const program2 = (0, import_child_process.fork)(path, {
       env: {
         ...process.env,
@@ -1088,7 +1118,7 @@ function loadCapabilities(path) {
       for (const capability of capabilities) {
         console.info(`Registered Pepr Capability "${capability.name}"`);
       }
-      resolve4(capabilities);
+      resolve5(capabilities);
     });
     program2.on("error", (error) => {
       reject(error);
@@ -1100,6 +1130,116 @@ function loadCapabilities(path) {
 var import_client_node = require("@kubernetes/client-node");
 var import_crypto2 = __toESM(require("crypto"));
 var import_fs4 = require("fs");
+async function overridesFile({ hash, name: name2, image, config, apiToken }, path) {
+  const overrides = {
+    secrets: {
+      apiToken: Buffer.from(apiToken).toString("base64")
+    },
+    hash,
+    namespace: {
+      annotations: {},
+      labels: {
+        "pepr.dev": ""
+      }
+    },
+    uuid: name2,
+    admission: {
+      failurePolicy: config.onError === "reject" ? "Fail" : "Ignore",
+      webhookTimeout: config.webhookTimeout,
+      env: [
+        { name: "PEPR_WATCH_MODE", value: "false" },
+        { name: "PEPR_PRETTY_LOG", value: "false" },
+        { name: "LOG_LEVEL", value: "debug" },
+        process.env.PEPR_MODE === "dev" && { name: "MY_CUSTOM_VAR", value: "example-value" },
+        process.env.PEPR_MODE === "dev" && { name: "ZARF_VAR", value: "###ZARF_VAR_THING###" }
+      ],
+      image,
+      annotations: {
+        "pepr.dev/description": `${config.description}` || ""
+      },
+      labels: {
+        app: name2,
+        "pepr.dev/controller": "admission",
+        "pepr.dev/uuid": config.uuid
+      },
+      securityContext: {
+        runAsUser: 65532,
+        runAsGroup: 65532,
+        runAsNonRoot: true,
+        fsGroup: 65532
+      },
+      resources: {
+        requests: {
+          memory: "64Mi",
+          cpu: "100m"
+        },
+        limits: {
+          memory: "256Mi",
+          cpu: "500m"
+        }
+      },
+      containerSecurityContext: {
+        runAsUser: 65532,
+        runAsGroup: 65532,
+        runAsNonRoot: true,
+        allowPrivilegeEscalation: false,
+        capabilities: {
+          drop: ["ALL"]
+        }
+      },
+      nodeSelector: {},
+      tolerations: [],
+      affinity: {}
+    },
+    watcher: {
+      env: [
+        { name: "PEPR_WATCH_MODE", value: "true" },
+        { name: "PEPR_PRETTY_LOG", value: "false" },
+        { name: "LOG_LEVEL", value: "debug" },
+        process.env.PEPR_MODE === "dev" && { name: "MY_CUSTOM_VAR", value: "example-value" },
+        process.env.PEPR_MODE === "dev" && { name: "ZARF_VAR", value: "###ZARF_VAR_THING###" }
+      ],
+      image,
+      annotations: {
+        "pepr.dev/description": `${config.description}` || ""
+      },
+      labels: {
+        app: `${name2}-watcher`,
+        "pepr.dev/controller": "watcher",
+        "pepr.dev/uuid": config.uuid
+      },
+      securityContext: {
+        runAsUser: 65532,
+        runAsGroup: 65532,
+        runAsNonRoot: true,
+        fsGroup: 65532
+      },
+      resources: {
+        requests: {
+          memory: "64Mi",
+          cpu: "100m"
+        },
+        limits: {
+          memory: "256Mi",
+          cpu: "500m"
+        }
+      },
+      containerSecurityContext: {
+        runAsUser: 65532,
+        runAsGroup: 65532,
+        runAsNonRoot: true,
+        allowPrivilegeEscalation: false,
+        capabilities: {
+          drop: ["ALL"]
+        }
+      },
+      nodeSelector: {},
+      tolerations: [],
+      affinity: {}
+    }
+  };
+  await import_fs4.promises.writeFile(path, (0, import_client_node.dumpYaml)(overrides, { noRefs: true, forceQuotes: true }));
+}
 function zarfYaml({ name: name2, image, config }, path) {
   const zarfCfg = {
     kind: "ZarfPackageConfig",
@@ -1129,10 +1269,10 @@ function zarfYaml({ name: name2, image, config }, path) {
 async function allYaml(assets, rbacMode) {
   const { name: name2, tls, apiToken, path } = assets;
   const code = await import_fs4.promises.readFile(path);
-  const hash = import_crypto2.default.createHash("sha256").update(code).digest("hex");
+  assets.hash = import_crypto2.default.createHash("sha256").update(code).digest("hex");
   const mutateWebhook = await webhookConfig(assets, "mutate", assets.config.webhookTimeout);
   const validateWebhook = await webhookConfig(assets, "validate", assets.config.webhookTimeout);
-  const watchDeployment = watcher(assets, hash);
+  const watchDeployment = watcher(assets, assets.hash, assets.buildTimestamp);
   const resources = [
     namespace(assets.config.customLabels?.namespace),
     clusterRole(name2, assets.capabilities, rbacMode),
@@ -1140,10 +1280,10 @@ async function allYaml(assets, rbacMode) {
     serviceAccount(name2),
     apiTokenSecret(name2, apiToken),
     tlsSecret(name2, tls),
-    deployment(assets, hash),
+    deployment(assets, assets.hash, assets.buildTimestamp),
     service(name2),
     watcherService(name2),
-    moduleSecret(name2, code, hash),
+    moduleSecret(name2, code, assets.hash),
     storeRole(name2),
     storeRoleBinding(name2)
   ];
@@ -1160,14 +1300,215 @@ async function allYaml(assets, rbacMode) {
 }
 
 // src/lib/assets/index.ts
+var import_path = require("path");
+
+// src/lib/assets/helm.ts
+function nsTemplate() {
+  return `
+    apiVersion: v1
+    kind: Namespace
+    metadata:
+        name: pepr-system
+        {{- if .Values.namespace.annotations }}
+        annotations:
+            {{- toYaml .Values.namespace.annotations | nindent 6 }}
+        {{- end }}
+        {{- if .Values.namespace.labels }}
+        labels:
+            {{- toYaml .Values.namespace.labels | nindent 6 }}
+        {{- end }}
+    `;
+}
+function chartYaml(name2, description) {
+  return `
+    apiVersion: v2
+    name: ${name2}
+    description: ${description || ""}
+
+    # A chart can be either an 'application' or a 'library' chart.
+    #
+    # Application charts are a collection of templates that can be packaged into versioned archives
+    # to be deployed.
+    #
+    # Library charts provide useful utilities or functions for the chart developer. They're included as
+    # a dependency of application charts to inject those utilities and functions into the rendering
+    # pipeline. Library charts do not define any templates and therefore cannot be deployed.
+    type: application
+
+    # This is the chart version. This version number should be incremented each time you make changes
+    # to the chart and its templates, including the app version.
+    # Versions are expected to follow Semantic Versioning (https://semver.org/)
+    version: 0.1.0
+
+    # This is the version number of the application being deployed. This version number should be
+    # incremented each time you make changes to the application. Versions are not expected to
+    # follow Semantic Versioning. They should reflect the version the application is using.
+    # It is recommended to use it with quotes.
+    appVersion: "1.16.0"
+`;
+}
+function watcherDeployTemplate(buildTimestamp) {
+  return `
+      apiVersion: apps/v1
+      kind: Deployment
+      metadata:
+        name: {{ .Values.uuid }}-watcher
+        namespace: pepr-system
+        annotations:
+          {{- toYaml .Values.watcher.annotations | nindent 4 }}
+        labels:
+          {{- toYaml .Values.watcher.labels | nindent 4 }}
+      spec:
+        replicas: 1
+        strategy:
+          type: Recreate
+        selector:
+          matchLabels:
+            app: {{ .Values.uuid }}-watcher
+            pepr.dev/controller: watcher
+        template:
+          metadata:
+            annotations: 
+              buildTimestamp: "${buildTimestamp}"
+            labels:
+              app: {{ .Values.uuid }}-watcher
+              pepr.dev/controller: watcher
+          spec:
+            serviceAccountName: {{ .Values.uuid }}
+            securityContext:
+              {{- toYaml .Values.admission.securityContext | nindent 8 }}
+            containers:
+              - name: watcher
+                image: {{ .Values.watcher.image }}
+                imagePullPolicy: IfNotPresent
+                command:
+                  - node
+                  - /app/node_modules/pepr/dist/controller.js
+                  - {{ .Values.hash }}
+                readinessProbe:
+                  httpGet:
+                    path: /healthz
+                    port: 3000
+                    scheme: HTTPS
+                livenessProbe:
+                  httpGet:
+                    path: /healthz
+                    port: 3000
+                    scheme: HTTPS
+                ports:
+                  - containerPort: 3000
+                resources:
+                  {{- toYaml .Values.watcher.resources | nindent 12 }}
+                env:
+                  {{- toYaml .Values.watcher.env | nindent 12 }}
+                securityContext:
+                  {{- toYaml .Values.watcher.containerSecurityContext | nindent 12 }}
+                volumeMounts:
+                  - name: tls-certs
+                    mountPath: /etc/certs
+                    readOnly: true
+                  - name: module
+                    mountPath: /app/load
+                    readOnly: true
+            volumes:
+              - name: tls-certs
+                secret:
+                  secretName: {{ .Values.uuid }}-tls
+              - name: module
+                secret:
+                  secretName: {{ .Values.uuid }}-module
+    `;
+}
+function admissionDeployTemplate(buildTimestamp) {
+  return `
+      apiVersion: apps/v1
+      kind: Deployment
+      metadata:
+        name: {{ .Values.uuid }}
+        namespace: pepr-system
+        annotations:
+          {{- toYaml .Values.admission.annotations | nindent 4 }}
+        labels:
+          {{- toYaml .Values.admission.labels | nindent 4 }}
+      spec:
+        replicas: 2
+        selector:
+          matchLabels:
+            app: {{ .Values.uuid }}
+            pepr.dev/controller: admission
+        template:
+          metadata:
+            annotations:
+              buildTimestamp: "${buildTimestamp}"
+            labels:
+              app: {{ .Values.uuid }}
+              pepr.dev/controller: admission
+          spec:
+            priorityClassName: system-node-critical
+            serviceAccountName: {{ .Values.uuid }}
+            securityContext:
+              {{- toYaml .Values.admission.securityContext | nindent 8 }}
+            containers:
+              - name: server
+                image: {{ .Values.admission.image }}
+                imagePullPolicy: IfNotPresent
+                command:
+                  - node
+                  - /app/node_modules/pepr/dist/controller.js
+                  - {{ .Values.hash }}
+                readinessProbe:
+                  httpGet:
+                    path: /healthz
+                    port: 3000
+                    scheme: HTTPS
+                livenessProbe:
+                  httpGet:
+                    path: /healthz
+                    port: 3000
+                    scheme: HTTPS
+                ports:
+                  - containerPort: 3000
+                resources:
+                  {{- toYaml .Values.admission.resources | nindent 12 }}
+                env:
+                  {{- toYaml .Values.admission.env | nindent 12 }}
+                securityContext:
+                  {{- toYaml .Values.admission.containerSecurityContext | nindent 12 }}
+                volumeMounts:
+                  - name: tls-certs
+                    mountPath: /etc/certs
+                    readOnly: true
+                  - name: api-token
+                    mountPath: /app/api-token
+                    readOnly: true
+                  - name: module
+                    mountPath: /app/load
+                    readOnly: true
+            volumes:
+              - name: tls-certs
+                secret:
+                  secretName: {{ .Values.uuid }}-tls
+              - name: api-token
+                secret:
+                  secretName: {{ .Values.uuid }}-api-token
+              - name: module
+                secret:
+                  secretName: {{ .Values.uuid }}-module  
+    `;
+}
+
+// src/lib/assets/index.ts
+var import_fs5 = require("fs");
 var Assets = class {
   constructor(config, path, host) {
     this.config = config;
     this.path = path;
     this.host = host;
     this.name = `pepr-${config.uuid}`;
+    this.buildTimestamp = `${Date.now()}`;
     this.alwaysIgnore = config.alwaysIgnore;
     this.image = `ghcr.io/defenseunicorns/pepr/controller:v${config.peprVersion}`;
+    this.hash = "";
     this.tls = genTLS(this.host || `${this.name}.pepr-system.svc`);
     this.apiToken = import_crypto3.default.randomBytes(32).toString("hex");
   }
@@ -1177,6 +1518,11 @@ var Assets = class {
   alwaysIgnore;
   capabilities;
   image;
+  buildTimestamp;
+  hash;
+  setHash = (hash) => {
+    this.hash = hash;
+  };
   deploy = async (force, webhookTimeout) => {
     this.capabilities = await loadCapabilities(this.path);
     await deploy(this, force, webhookTimeout);
@@ -1189,10 +1535,91 @@ var Assets = class {
     }
     return allYaml(this, rbacMode);
   };
+  generateHelmChart = async (basePath) => {
+    const CHART_DIR = `${basePath}/${this.config.uuid}-chart`;
+    const CHAR_TEMPLATES_DIR = `${CHART_DIR}/templates`;
+    const valuesPath = (0, import_path.resolve)(CHART_DIR, `values.yaml`);
+    const chartPath = (0, import_path.resolve)(CHART_DIR, `Chart.yaml`);
+    const nsPath = (0, import_path.resolve)(CHAR_TEMPLATES_DIR, `namespace.yaml`);
+    const watcherSVCPath = (0, import_path.resolve)(CHAR_TEMPLATES_DIR, `watcher-service.yaml`);
+    const admissionSVCPath = (0, import_path.resolve)(CHAR_TEMPLATES_DIR, `admission-service.yaml`);
+    const mutationWebhookPath = (0, import_path.resolve)(CHAR_TEMPLATES_DIR, `mutation-webhook.yaml`);
+    const validationWebhookPath = (0, import_path.resolve)(CHAR_TEMPLATES_DIR, `validation-webhook.yaml`);
+    const admissionDeployPath = (0, import_path.resolve)(CHAR_TEMPLATES_DIR, `admission-deployment.yaml`);
+    const watcherDeployPath = (0, import_path.resolve)(CHAR_TEMPLATES_DIR, `watcher-deployment.yaml`);
+    const tlsSecretPath = (0, import_path.resolve)(CHAR_TEMPLATES_DIR, `tls-secret.yaml`);
+    const apiTokenSecretPath = (0, import_path.resolve)(CHAR_TEMPLATES_DIR, `api-token-secret.yaml`);
+    const moduleSecretPath = (0, import_path.resolve)(CHAR_TEMPLATES_DIR, `module-secret.yaml`);
+    const storeRolePath = (0, import_path.resolve)(CHAR_TEMPLATES_DIR, `store-role.yaml`);
+    const storeRoleBindingPath = (0, import_path.resolve)(CHAR_TEMPLATES_DIR, `store-role-binding.yaml`);
+    const clusterRolePath = (0, import_path.resolve)(CHAR_TEMPLATES_DIR, `cluster-role.yaml`);
+    const clusterRoleBindingPath = (0, import_path.resolve)(CHAR_TEMPLATES_DIR, `cluster-role-binding.yaml`);
+    const serviceAccountPath = (0, import_path.resolve)(CHAR_TEMPLATES_DIR, `service-account.yaml`);
+    try {
+      await createDirectoryIfNotExists(CHART_DIR);
+      await createDirectoryIfNotExists(`${CHART_DIR}/charts`);
+      await createDirectoryIfNotExists(`${CHAR_TEMPLATES_DIR}`);
+      await overridesFile(this, valuesPath);
+      await import_fs5.promises.writeFile(chartPath, dedent(chartYaml(this.config.uuid, this.config.description || "")));
+      await import_fs5.promises.writeFile(nsPath, dedent(nsTemplate()));
+      const code = await import_fs5.promises.readFile(this.path);
+      await import_fs5.promises.writeFile(watcherSVCPath, (0, import_client_node2.dumpYaml)(watcherService(this.name), { noRefs: true }));
+      await import_fs5.promises.writeFile(admissionSVCPath, (0, import_client_node2.dumpYaml)(service(this.name), { noRefs: true }));
+      await import_fs5.promises.writeFile(tlsSecretPath, (0, import_client_node2.dumpYaml)(tlsSecret(this.name, this.tls), { noRefs: true }));
+      await import_fs5.promises.writeFile(apiTokenSecretPath, (0, import_client_node2.dumpYaml)(apiTokenSecret(this.name, this.apiToken), { noRefs: true }));
+      await import_fs5.promises.writeFile(moduleSecretPath, (0, import_client_node2.dumpYaml)(moduleSecret(this.name, code, this.hash), { noRefs: true }));
+      await import_fs5.promises.writeFile(storeRolePath, (0, import_client_node2.dumpYaml)(storeRole(this.name), { noRefs: true }));
+      await import_fs5.promises.writeFile(storeRoleBindingPath, (0, import_client_node2.dumpYaml)(storeRoleBinding(this.name), { noRefs: true }));
+      await import_fs5.promises.writeFile(
+        clusterRolePath,
+        (0, import_client_node2.dumpYaml)(clusterRole(this.name, this.capabilities, "rbac"), { noRefs: true })
+      );
+      await import_fs5.promises.writeFile(clusterRoleBindingPath, (0, import_client_node2.dumpYaml)(clusterRoleBinding(this.name), { noRefs: true }));
+      await import_fs5.promises.writeFile(serviceAccountPath, (0, import_client_node2.dumpYaml)(serviceAccount(this.name), { noRefs: true }));
+      const mutateWebhook = await webhookConfig(this, "mutate", this.config.webhookTimeout);
+      const validateWebhook = await webhookConfig(this, "validate", this.config.webhookTimeout);
+      const watchDeployment = watcher(this, this.hash, this.buildTimestamp);
+      if (validateWebhook || mutateWebhook) {
+        await import_fs5.promises.writeFile(admissionDeployPath, dedent(admissionDeployTemplate(this.buildTimestamp)));
+      }
+      if (mutateWebhook) {
+        const yamlMutateWebhook = (0, import_client_node2.dumpYaml)(mutateWebhook, { noRefs: true });
+        const mutateWebhookTemplate = replaceString(
+          replaceString(
+            replaceString(yamlMutateWebhook, this.name, "{{ .Values.uuid }}"),
+            this.config.onError === "reject" ? "Fail" : "Ignore",
+            "{{ .Values.admission.failurePolicy }}"
+          ),
+          `${this.config.webhookTimeout}` || "10",
+          "{{ .Values.admission.webhookTimeout }}"
+        );
+        await import_fs5.promises.writeFile(mutationWebhookPath, mutateWebhookTemplate);
+      }
+      if (validateWebhook) {
+        const yamlValidateWebhook = (0, import_client_node2.dumpYaml)(validateWebhook, { noRefs: true });
+        const validateWebhookTemplate = replaceString(
+          replaceString(
+            replaceString(yamlValidateWebhook, this.name, "{{ .Values.uuid }}"),
+            this.config.onError === "reject" ? "Fail" : "Ignore",
+            "{{ .Values.admission.failurePolicy }}"
+          ),
+          `${this.config.webhookTimeout}` || "10",
+          "{{ .Values.admission.webhookTimeout }}"
+        );
+        await import_fs5.promises.writeFile(validationWebhookPath, validateWebhookTemplate);
+      }
+      if (watchDeployment) {
+        await import_fs5.promises.writeFile(watcherDeployPath, dedent(watcherDeployTemplate(this.buildTimestamp)));
+      }
+    } catch (err) {
+      console.error(`Error generating helm chart: ${err.message}`);
+      process.exit(1);
+    }
+  };
 };
 
 // src/cli/init/templates.ts
-var import_client_node2 = require("@kubernetes/client-node");
+var import_client_node3 = require("@kubernetes/client-node");
 var import_util = require("util");
 var import_uuid = require("uuid");
 
@@ -1398,7 +1825,7 @@ var gitIgnore = "# Ignore node_modules and Pepr build artifacts\nnode_modules\nd
 var readmeMd = '# Pepr Module\n\nThis is a Pepr Module. [Pepr](https://github.com/defenseunicorns/pepr) is a type-safe Kubernetes middleware system.\n\nThe `capabilities` directory contains all the capabilities for this module. By default,\na capability is a single typescript file in the format of `capability-name.ts` that is\nimported in the root `pepr.ts` file as `import { HelloPepr } from "./capabilities/hello-pepr";`.\nBecause this is typescript, you can organize this however you choose, e.g. creating a sub-folder\nper-capability or common logic in shared files or folders.\n\nExample Structure:\n\n```\nModule Root\n\u251C\u2500\u2500 package.json\n\u251C\u2500\u2500 pepr.ts\n\u2514\u2500\u2500 capabilities\n    \u251C\u2500\u2500 example-one.ts\n    \u251C\u2500\u2500 example-three.ts\n    \u2514\u2500\u2500 example-two.ts\n```\n';
 var peprTS = 'import { PeprModule } from "pepr";\n// cfg loads your pepr configuration from package.json\nimport cfg from "./package.json";\n\n// HelloPepr is a demo capability that is included with Pepr. Comment or delete the line below to remove it.\nimport { HelloPepr } from "./capabilities/hello-pepr";\n\n/**\n * This is the main entrypoint for this Pepr module. It is run when the module is started.\n * This is where you register your Pepr configurations and capabilities.\n */\nnew PeprModule(cfg, [\n  // "HelloPepr" is a demo capability that is included with Pepr. Comment or delete the line below to remove it.\n  HelloPepr,\n\n  // Your additional capabilities go here\n]);\n';
 var helloPeprTS = 'import {\n  Capability,\n  K8s,\n  Log,\n  PeprMutateRequest,\n  RegisterKind,\n  a,\n  fetch,\n  fetchStatus,\n  kind,\n} from "pepr";\n\n/**\n *  The HelloPepr Capability is an example capability to demonstrate some general concepts of Pepr.\n *  To test this capability you run `pepr dev`and then run the following command:\n *  `kubectl apply -f capabilities/hello-pepr.samples.yaml`\n */\nexport const HelloPepr = new Capability({\n  name: "hello-pepr",\n  description: "A simple example capability to show how things work.",\n  namespaces: ["pepr-demo", "pepr-demo-2"],\n});\n\n// Use the \'When\' function to create a new action, use \'Store\' to persist data\nconst { When, Store } = HelloPepr;\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Namespace)                                   *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action removes the label `remove-me` when a Namespace is created.\n * Note we don\'t need to specify the namespace here, because we\'ve already specified\n * it in the Capability definition above.\n */\nWhen(a.Namespace)\n  .IsCreated()\n  .Mutate(ns => ns.RemoveLabel("remove-me"));\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Watch Action with K8s SSA (Namespace)                           *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action watches for the `pepr-demo-2` namespace to be created, then creates a ConfigMap with\n * the name `pepr-ssa-demo` and adds the namespace UID to the ConfigMap data. Because Pepr uses\n * server-side apply for this operation, the ConfigMap will be created or updated if it already exists.\n */\nWhen(a.Namespace)\n  .IsCreated()\n  .WithName("pepr-demo-2")\n  .Watch(async ns => {\n    Log.info("Namespace pepr-demo-2 was created.");\n\n    try {\n      // Apply the ConfigMap using K8s server-side apply\n      await K8s(kind.ConfigMap).Apply({\n        metadata: {\n          name: "pepr-ssa-demo",\n          namespace: "pepr-demo-2",\n        },\n        data: {\n          "ns-uid": ns.metadata.uid,\n        },\n      });\n    } catch (error) {\n      // You can use the Log object to log messages to the Pepr controller pod\n      Log.error(error, "Failed to apply ConfigMap using server-side apply.");\n    }\n\n    // You can share data between actions using the Store, including between different types of actions\n    Store.setItem("watch-data", "This data was stored by a Watch Action.");\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 1)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This is a single action. They can be in the same file or put imported from other files.\n * In this example, when a ConfigMap is created with the name `example-1`, then add a label and annotation.\n *\n * Equivalent to manually running:\n * `kubectl label configmap example-1 pepr=was-here`\n * `kubectl annotate configmap example-1 pepr.dev=annotations-work-too`\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-1")\n  .Mutate(request => {\n    request\n      .SetLabel("pepr", "was-here")\n      .SetAnnotation("pepr.dev", "annotations-work-too");\n\n    // Use the Store to persist data between requests and Pepr controller pods\n    Store.setItem("example-1", "was-here");\n\n    // This data is written asynchronously and can be read back via `Store.getItem()` or `Store.subscribe()`\n    Store.setItem("example-1-data", JSON.stringify(request.Raw.data));\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate & Validate Actions (CM Example 2)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This combines 3 different types of actions: \'Mutate\', \'Validate\', and \'Watch\'. The order\n * of the actions is required, but each action is optional. In this example, when a ConfigMap is created\n * with the name `example-2`, then add a label and annotation, validate that the ConfigMap has the label\n * `pepr`, and log the request.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-2")\n  .Mutate(request => {\n    // This Mutate Action will mutate the request before it is persisted to the cluster\n\n    // Use `request.Merge()` to merge the new data with the existing data\n    request.Merge({\n      metadata: {\n        labels: {\n          pepr: "was-here",\n        },\n        annotations: {\n          "pepr.dev": "annotations-work-too",\n        },\n      },\n    });\n  })\n  .Validate(request => {\n    // This Validate Action will validate the request before it is persisted to the cluster\n\n    // Approve the request if the ConfigMap has the label \'pepr\'\n    if (request.HasLabel("pepr")) {\n      return request.Approve();\n    }\n\n    // Otherwise, deny the request with an error message (optional)\n    return request.Deny("ConfigMap must have label \'pepr\'");\n  })\n  .Watch((cm, phase) => {\n    // This Watch Action will watch the ConfigMap after it has been persisted to the cluster\n    Log.info(cm, `ConfigMap was ${phase} with the name example-2`);\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 2a)                               *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action shows a simple validation that will deny any ConfigMap that has the\n * annotation `evil`. Note that the `Deny()` function takes an optional second parameter that is a\n * user-defined status code to return.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .Validate(request => {\n    if (request.HasAnnotation("evil")) {\n      return request.Deny("No evil CM annotations allowed.", 400);\n    }\n\n    return request.Approve();\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 3)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action combines different styles. Unlike the previous actions, this one will look\n * for any ConfigMap in the `pepr-demo` namespace that has the label `change=by-label` during either\n * CREATE or UPDATE. Note that all conditions added such as `WithName()`, `WithLabel()`, `InNamespace()`,\n * are ANDs so all conditions must be true for the request to be processed.\n */\nWhen(a.ConfigMap)\n  .IsCreatedOrUpdated()\n  .WithLabel("change", "by-label")\n  .Mutate(request => {\n    // The K8s object e are going to mutate\n    const cm = request.Raw;\n\n    // Get the username and uid of the K8s request\n    const { username, uid } = request.Request.userInfo;\n\n    // Store some data about the request in the configmap\n    cm.data["username"] = username;\n    cm.data["uid"] = uid;\n\n    // You can still mix other ways of making changes too\n    request.SetAnnotation("pepr.dev", "making-waves");\n  });\n\n// This action validates the label `change=by-label` is deleted\nWhen(a.ConfigMap)\n  .IsDeleted()\n  .WithLabel("change", "by-label")\n  .Validate(request => {\n    // Log and then always approve the request\n    Log.info("CM with label \'change=by-label\' was deleted.");\n    return request.Approve();\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 4)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action show how you can use the `Mutate()` function without an inline function.\n * This is useful if you want to keep your actions small and focused on a single task,\n * or if you want to reuse the same function in multiple actions.\n */\nWhen(a.ConfigMap).IsCreated().WithName("example-4").Mutate(example4Cb);\n\n// This function uses the complete type definition, but is not required.\nfunction example4Cb(cm: PeprMutateRequest<a.ConfigMap>) {\n  cm.SetLabel("pepr.dev/first", "true");\n  cm.SetLabel("pepr.dev/second", "true");\n  cm.SetLabel("pepr.dev/third", "true");\n}\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 4a)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This is the same as Example 4, except this only operates on a CM in the `pepr-demo-2` namespace.\n * Note because the Capability defines namespaces, the namespace specified here must be one of those.\n * Alternatively, you can remove the namespace from the Capability definition and specify it here.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .InNamespace("pepr-demo-2")\n  .WithName("example-4a")\n  .Mutate(example4Cb);\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 5)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action is a bit more complex. It will look for any ConfigMap in the `pepr-demo`\n * namespace that has the label `chuck-norris` during CREATE. When it finds one, it will fetch a\n * random Chuck Norris joke from the API and add it to the ConfigMap. This is a great example of how\n * you can use Pepr to make changes to your K8s objects based on external data.\n *\n * Note the use of the `async` keyword. This is required for any action that uses `await` or `fetch()`.\n *\n * Also note we are passing a type to the `fetch()` function. This is optional, but it will help you\n * avoid mistakes when working with the data returned from the API. You can also use the `as` keyword to\n * cast the data returned from the API.\n *\n * These are equivalent:\n * ```ts\n * const joke = await fetch<TheChuckNorrisJoke>("https://api.chucknorris.io/jokes/random?category=dev");\n * const joke = await fetch("https://api.chucknorris.io/jokes/random?category=dev") as TheChuckNorrisJoke;\n * ```\n *\n * Alternatively, you can drop the type completely:\n *\n * ```ts\n * fetch("https://api.chucknorris.io/jokes/random?category=dev")\n * ```\n */\ninterface TheChuckNorrisJoke {\n  icon_url: string;\n  id: string;\n  url: string;\n  value: string;\n}\n\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithLabel("chuck-norris")\n  .Mutate(async change => {\n    // Try/catch is not needed as a response object will always be returned\n    const response = await fetch<TheChuckNorrisJoke>(\n      "https://api.chucknorris.io/jokes/random?category=dev",\n    );\n\n    // Instead, check the `response.ok` field\n    if (response.ok) {\n      // Add the Chuck Norris joke to the configmap\n      change.Raw.data["chuck-says"] = response.data.value;\n      return;\n    }\n\n    // You can also assert on different HTTP response codes\n    if (response.status === fetchStatus.NOT_FOUND) {\n      // Do something else\n      return;\n    }\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Secret Base64 Handling)                      *\n * ---------------------------------------------------------------------------------------------------\n *\n * The K8s JS client provides incomplete support for base64 encoding/decoding handling for secrets,\n * unlike the GO client. To make this less painful, Pepr automatically handles base64 encoding/decoding\n * secret data before and after the action is executed.\n */\nWhen(a.Secret)\n  .IsCreated()\n  .WithName("secret-1")\n  .Mutate(request => {\n    const secret = request.Raw;\n\n    // This will be encoded at the end of all processing back to base64: "Y2hhbmdlLXdpdGhvdXQtZW5jb2Rpbmc="\n    secret.data.magic = "change-without-encoding";\n\n    // You can modify the data directly, and it will be encoded at the end of all processing\n    secret.data.example += " - modified by Pepr";\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Untyped Custom Resource)                     *\n * ---------------------------------------------------------------------------------------------------\n *\n * Out of the box, Pepr supports all the standard Kubernetes objects. However, you can also create\n * your own types. This is useful if you are working with an Operator that creates custom resources.\n * There are two ways to do this, the first is to use the `When()` function with a `GenericKind`,\n * the second is to create a new class that extends `GenericKind` and use the `RegisterKind()` function.\n *\n * This example shows how to use the `When()` function with a `GenericKind`. Note that you\n * must specify the `group`, `version`, and `kind` of the object (if applicable). This is how Pepr knows\n * if the action should be triggered or not. Since we are using a `GenericKind`,\n * Pepr will not be able to provide any intellisense for the object, so you will need to refer to the\n * Kubernetes API documentation for the object you are working with.\n *\n * You will need to wait for the CRD in `hello-pepr.samples.yaml` to be created, then you can apply\n *\n * ```yaml\n * apiVersion: pepr.dev/v1\n * kind: Unicorn\n * metadata:\n *   name: example-1\n *   namespace: pepr-demo\n * spec:\n *   message: replace-me\n *   counter: 0\n * ```\n */\nWhen(a.GenericKind, {\n  group: "pepr.dev",\n  version: "v1",\n  kind: "Unicorn",\n})\n  .IsCreated()\n  .WithName("example-1")\n  .Mutate(request => {\n    request.Merge({\n      spec: {\n        message: "Hello Pepr without type data!",\n        counter: Math.random(),\n      },\n    });\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Typed Custom Resource)                       *\n * ---------------------------------------------------------------------------------------------------\n *\n * This example shows how to use the `RegisterKind()` function to create a new type. This is useful\n * if you are working with an Operator that creates custom resources and you want to have intellisense\n * for the object. Note that you must specify the `group`, `version`, and `kind` of the object (if applicable)\n * as this is how Pepr knows if the action should be triggered or not.\n *\n * Once you register a new Kind with Pepr, you can use the `When()` function with the new Kind. Ideally,\n * you should register custom Kinds at the top of your Capability file or Pepr Module so they are available\n * to all actions, but we are putting it here for demonstration purposes.\n *\n * You will need to wait for the CRD in `hello-pepr.samples.yaml` to be created, then you can apply\n *\n * ```yaml\n * apiVersion: pepr.dev/v1\n * kind: Unicorn\n * metadata:\n *   name: example-2\n *   namespace: pepr-demo\n * spec:\n *   message: replace-me\n *   counter: 0\n * ```*\n */\nclass UnicornKind extends a.GenericKind {\n  spec: {\n    /**\n     * JSDoc comments can be added to explain more details about the field.\n     *\n     * @example\n     * ```ts\n     * request.Raw.spec.message = "Hello Pepr!";\n     * ```\n     * */\n    message: string;\n    counter: number;\n  };\n}\n\nRegisterKind(UnicornKind, {\n  group: "pepr.dev",\n  version: "v1",\n  kind: "Unicorn",\n});\n\nWhen(UnicornKind)\n  .IsCreated()\n  .WithName("example-2")\n  .Mutate(request => {\n    request.Merge({\n      spec: {\n        message: "Hello Pepr with type data!",\n        counter: Math.random(),\n      },\n    });\n  });\n\n/**\n * A callback function that is called once the Pepr Store is fully loaded.\n */\nStore.onReady(data => {\n  Log.info(data, "Pepr Store Ready");\n});\n';
-var packageJSON = { name: "pepr", description: "Kubernetes application engine", author: "Defense Unicorns", homepage: "https://github.com/defenseunicorns/pepr", license: "Apache-2.0", bin: "dist/cli.js", repository: "defenseunicorns/pepr", engines: { node: ">=18.0.0" }, version: "0.26.2", main: "dist/lib.js", types: "dist/lib.d.ts", scripts: { "gen-data-json": "node hack/build-template-data.js", prebuild: "rm -fr dist/* && npm run gen-data-json", build: "tsc && node build.mjs", test: "npm run test:unit && npm run test:journey", "test:unit": "npm run gen-data-json && jest src --coverage --detectOpenHandles --coverageDirectory=./coverage", "test:journey": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run", "test:journey:prep": "git clone https://github.com/defenseunicorns/pepr-upgrade-test.git", "test:journey-wasm": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run-wasm", "test:journey:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0' --wait && kubectl rollout status deployment -n kube-system", "test:journey:build": "npm run build && npm pack", "test:journey:image": "docker buildx build --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev", "test:journey:run": "jest --detectOpenHandles journey/entrypoint.test.ts && npm run test:journey:prep && npm run test:journey:upgrade", "test:journey:run-wasm": "jest --detectOpenHandles journey/entrypoint-wasm.test.ts", "test:journey:upgrade": "npm run test:journey:k3d && npm run test:journey:image && jest --detectOpenHandles journey/pepr-upgrade.test.ts", "format:check": "eslint src && prettier src --check", "format:fix": "eslint src --fix && prettier src --write" }, dependencies: { "@types/ramda": "0.29.10", express: "4.18.2", "fast-json-patch": "3.1.1", "kubernetes-fluent-client": "2.2.0", pino: "8.19.0", "pino-pretty": "10.3.1", "prom-client": "15.1.0", ramda: "0.29.1" }, devDependencies: { "@commitlint/cli": "18.6.1", "@commitlint/config-conventional": "18.6.2", "@jest/globals": "29.7.0", "@types/eslint": "8.56.2", "@types/express": "4.17.21", "@types/node": "18.x.x", "@types/node-forge": "1.3.11", "@types/prompts": "2.4.9", "@types/uuid": "9.0.8", jest: "29.7.0", nock: "13.5.3", "ts-jest": "29.1.2" }, peerDependencies: { "@typescript-eslint/eslint-plugin": "6.15.0", "@typescript-eslint/parser": "6.15.0", commander: "11.1.0", esbuild: "0.19.10", eslint: "8.56.0", "node-forge": "1.3.1", prettier: "3.1.1", prompts: "2.4.2", typescript: "5.3.3", uuid: "9.0.1" } };
+var packageJSON = { name: "pepr", description: "Kubernetes application engine", author: "Defense Unicorns", homepage: "https://github.com/defenseunicorns/pepr", license: "Apache-2.0", bin: "dist/cli.js", repository: "defenseunicorns/pepr", engines: { node: ">=18.0.0" }, version: "0.27.0", main: "dist/lib.js", types: "dist/lib.d.ts", scripts: { "gen-data-json": "node hack/build-template-data.js", prebuild: "rm -fr dist/* && npm run gen-data-json", build: "tsc && node build.mjs", test: "npm run test:unit && npm run test:journey", "test:unit": "npm run gen-data-json && jest src --coverage --detectOpenHandles --coverageDirectory=./coverage", "test:journey": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run", "test:journey:prep": "git clone https://github.com/defenseunicorns/pepr-upgrade-test.git", "test:journey-wasm": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run-wasm", "test:journey:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0' --wait && kubectl rollout status deployment -n kube-system", "test:journey:build": "npm run build && npm pack", "test:journey:image": "docker buildx build --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev", "test:journey:run": "jest --detectOpenHandles journey/entrypoint.test.ts && npm run test:journey:prep && npm run test:journey:upgrade", "test:journey:run-wasm": "jest --detectOpenHandles journey/entrypoint-wasm.test.ts", "test:journey:upgrade": "npm run test:journey:k3d && npm run test:journey:image && jest --detectOpenHandles journey/pepr-upgrade.test.ts", "format:check": "eslint src && prettier src --check", "format:fix": "eslint src --fix && prettier src --write" }, dependencies: { "@types/ramda": "0.29.10", express: "4.18.2", "fast-json-patch": "3.1.1", "kubernetes-fluent-client": "2.2.1", pino: "8.19.0", "pino-pretty": "10.3.1", "prom-client": "15.1.0", ramda: "0.29.1" }, devDependencies: { "@commitlint/cli": "19.0.1", "@commitlint/config-conventional": "19.0.0", "@jest/globals": "29.7.0", "@types/eslint": "8.56.4", "@types/express": "4.17.21", "@types/node": "18.x.x", "@types/node-forge": "1.3.11", "@types/prompts": "2.4.9", "@types/uuid": "9.0.8", jest: "29.7.0", nock: "13.5.4", "ts-jest": "29.1.2" }, peerDependencies: { "@typescript-eslint/eslint-plugin": "6.15.0", "@typescript-eslint/parser": "6.15.0", commander: "11.1.0", esbuild: "0.19.10", eslint: "8.56.0", "node-forge": "1.3.1", prettier: "3.1.1", prompts: "2.4.2", typescript: "5.3.3", uuid: "9.0.1" } };
 
 // src/templates/pepr.code-snippets.json
 var pepr_code_snippets_default = {
@@ -1457,7 +1884,7 @@ var tsconfig_module_default = {
 };
 
 // src/cli/init/utils.ts
-var import_fs5 = require("fs");
+var import_fs6 = require("fs");
 function sanitizeName(name2) {
   let sanitized = name2.toLowerCase().replace(/[^a-z0-9-]+/gi, "-");
   sanitized = sanitized.replace(/^-+|-+$/g, "");
@@ -1466,7 +1893,7 @@ function sanitizeName(name2) {
 }
 async function createDir(dir) {
   try {
-    await import_fs5.promises.mkdir(dir);
+    await import_fs6.promises.mkdir(dir);
   } catch (err) {
     if (err && err.code === "EEXIST") {
       throw new Error(`Directory ${dir} already exists`);
@@ -1479,7 +1906,7 @@ function write(path, data) {
   if (typeof data !== "string") {
     data = JSON.stringify(data, null, 2);
   }
-  return import_fs5.promises.writeFile(path, data);
+  return import_fs6.promises.writeFile(path, data);
 }
 
 // src/cli/init/templates.ts
@@ -1506,7 +1933,9 @@ function genPkgJSON(opts, pgkVerOverride) {
       onError: opts.errorBehavior,
       webhookTimeout: 10,
       customLabels: {
-        namespace: {}
+        namespace: {
+          "pepr.dev": ""
+        }
       },
       alwaysIgnore: {
         namespaces: [],
@@ -1551,7 +1980,7 @@ var gitignore = {
 };
 var samplesYaml = {
   path: "hello-pepr.samples.yaml",
-  data: hello_pepr_samples_default.map((r) => (0, import_client_node2.dumpYaml)(r, { noRefs: true })).join("---\n")
+  data: hello_pepr_samples_default.map((r) => (0, import_client_node3.dumpYaml)(r, { noRefs: true })).join("---\n")
 };
 var snippet = {
   path: "pepr.code-snippets",
@@ -1576,7 +2005,7 @@ var eslint = {
 
 // src/cli/format.ts
 var import_eslint = require("eslint");
-var import_fs6 = require("fs");
+var import_fs7 = require("fs");
 var import_prettier = require("prettier");
 function format_default(program2) {
   program2.command("format").description("Lint and format this Pepr module").option("-v, --validate-only", "Do not modify files, only validate formatting").action(async (opts) => {
@@ -1609,7 +2038,7 @@ async function peprFormat(validateOnly) {
         await import_eslint.ESLint.outputFixes(results);
       }
       for (const { filePath } of results) {
-        const content = await import_fs6.promises.readFile(filePath, "utf8");
+        const content = await import_fs7.promises.readFile(filePath, "utf8");
         const cfg = await (0, import_prettier.resolveConfig)(filePath);
         const formatted = await (0, import_prettier.format)(content, { filepath: filePath, ...cfg });
         if (validateOnly) {
@@ -1618,7 +2047,7 @@ async function peprFormat(validateOnly) {
             console.error(`File ${filePath} is not formatted correctly`);
           }
         } else {
-          await import_fs6.promises.writeFile(filePath, formatted);
+          await import_fs7.promises.writeFile(filePath, formatted);
         }
       }
       return !hasFailure;
@@ -1708,12 +2137,13 @@ function build_default(program2) {
       assets.image = image;
     }
     const yamlFile = `pepr-module-${uuid}.yaml`;
-    const yamlPath = (0, import_path.resolve)(outputDir, yamlFile);
+    const yamlPath = (0, import_path2.resolve)(outputDir, yamlFile);
     const yaml = await assets.allYaml(opts.rbacMode);
-    const zarfPath = (0, import_path.resolve)(outputDir, "zarf.yaml");
+    const zarfPath = (0, import_path2.resolve)(outputDir, "zarf.yaml");
     const zarf = assets.zarfYaml(yamlFile);
-    await import_fs7.promises.writeFile(yamlPath, yaml);
-    await import_fs7.promises.writeFile(zarfPath, zarf);
+    await import_fs8.promises.writeFile(yamlPath, yaml);
+    await import_fs8.promises.writeFile(zarfPath, zarf);
+    await assets.generateHelmChart(outputDir);
     console.info(`\u2705 K8s resource for the module saved to ${yamlPath}`);
   });
 }
@@ -1721,19 +2151,19 @@ var externalLibs = Object.keys(dependencies);
 externalLibs.push("pepr");
 externalLibs.push("@kubernetes/client-node");
 async function loadModule(entryPoint = peprTS2) {
-  const entryPointPath = (0, import_path.resolve)(".", entryPoint);
-  const modulePath = (0, import_path.dirname)(entryPointPath);
-  const cfgPath = (0, import_path.resolve)(modulePath, "package.json");
+  const entryPointPath = (0, import_path2.resolve)(".", entryPoint);
+  const modulePath = (0, import_path2.dirname)(entryPointPath);
+  const cfgPath = (0, import_path2.resolve)(modulePath, "package.json");
   try {
-    await import_fs7.promises.access(cfgPath);
-    await import_fs7.promises.access(entryPointPath);
+    await import_fs8.promises.access(cfgPath);
+    await import_fs8.promises.access(entryPointPath);
   } catch (e) {
     console.error(
       `Could not find ${cfgPath} or ${entryPointPath} in the current directory. Please run this command from the root of your module's directory.`
     );
     process.exit(1);
   }
-  const moduleText = await import_fs7.promises.readFile(cfgPath, { encoding: "utf-8" });
+  const moduleText = await import_fs8.promises.readFile(cfgPath, { encoding: "utf-8" });
   const cfg = JSON.parse(moduleText);
   const { uuid } = cfg.pepr;
   const name2 = `pepr-${uuid}.js`;
@@ -1746,7 +2176,7 @@ async function loadModule(entryPoint = peprTS2) {
     entryPointPath,
     modulePath,
     name: name2,
-    path: (0, import_path.resolve)(outputDir, name2),
+    path: (0, import_path2.resolve)(outputDir, name2),
     uuid
   };
 }
@@ -1797,7 +2227,7 @@ async function buildModule(reloader, entryPoint = peprTS2, embed = true) {
     }
     if (!embed) {
       ctxCfg.minify = false;
-      ctxCfg.outfile = (0, import_path.resolve)(outputDir, (0, import_path.basename)(entryPoint, (0, import_path.extname)(entryPoint))) + ".js";
+      ctxCfg.outfile = (0, import_path2.resolve)(outputDir, (0, import_path2.basename)(entryPoint, (0, import_path2.extname)(entryPoint))) + ".js";
       ctxCfg.packages = "external";
       ctxCfg.treeShaking = false;
     }
@@ -1880,7 +2310,7 @@ function deploy_default(program2) {
 
 // src/cli/dev.ts
 var import_child_process3 = require("child_process");
-var import_fs8 = require("fs");
+var import_fs9 = require("fs");
 var import_prompts2 = __toESM(require("prompts"));
 function dev_default(program2) {
   program2.command("dev").description("Setup a local webhook development environment").option("-h, --host [host]", "Host to listen on", "host.k3d.internal").option("--confirm", "Skip confirmation prompt").action(async (opts) => {
@@ -1903,8 +2333,8 @@ function dev_default(program2) {
       path,
       opts.host
     );
-    await import_fs8.promises.writeFile("insecure-tls.crt", webhook.tls.pem.crt);
-    await import_fs8.promises.writeFile("insecure-tls.key", webhook.tls.pem.key);
+    await import_fs9.promises.writeFile("insecure-tls.crt", webhook.tls.pem.crt);
+    await import_fs9.promises.writeFile("insecure-tls.key", webhook.tls.pem.key);
     try {
       let program3;
       const runFork = async () => {
@@ -1943,7 +2373,7 @@ function dev_default(program2) {
 }
 
 // src/cli/monitor.ts
-var import_client_node3 = require("@kubernetes/client-node");
+var import_client_node4 = require("@kubernetes/client-node");
 var import_kubernetes_fluent_client4 = require("kubernetes-fluent-client");
 var import_stream = __toESM(require("stream"));
 function monitor_default(program2) {
@@ -1963,9 +2393,9 @@ function monitor_default(program2) {
       console.error(errorMessage);
       process.exit(1);
     }
-    const kc = new import_client_node3.KubeConfig();
+    const kc = new import_client_node4.KubeConfig();
     kc.loadFromDefault();
-    const log = new import_client_node3.Log(kc);
+    const log = new import_client_node4.Log(kc);
     const logStream = new import_stream.default.PassThrough();
     logStream.on("data", (chunk) => {
       const respMsg = `"msg":"Check response"`;
@@ -1978,16 +2408,23 @@ function monitor_default(program2) {
             const name2 = `${payload.namespace}${payload.name}`;
             const uid = payload.uid;
             if (isMutate) {
-              const allowOrDeny = payload.res.allowed ? "\u2705" : "\u274C";
+              const plainPatch = atob(payload.res.patch) || "";
+              const patch = JSON.stringify(JSON.parse(plainPatch), null, 2);
+              const patchType = payload.res.patchType || payload.res.warnings || "";
+              const allowOrDeny = payload.res.allowed ? "\u{1F500}" : "\u{1F6AB}";
               console.log(`
 ${allowOrDeny}  MUTATE     ${name2} (${uid})`);
+              if (patchType.length > 0) {
+                console.log(`
+\x1B[1;34m${patch}\x1B[0m`);
+              }
             } else {
               const failures = Array.isArray(payload.res) ? payload.res : [payload.res];
               const filteredFailures = failures.filter((r) => !r.allowed).map((r) => r.status.message);
               if (filteredFailures.length > 0) {
                 console.log(`
 \u274C  VALIDATE   ${name2} (${uid})`);
-                console.debug(filteredFailures);
+                console.debug(`\x1B[1;31m${filteredFailures}\x1B[0m`);
               } else {
                 console.log(`
 \u2705  VALIDATE   ${name2} (${uid})`);
@@ -2012,11 +2449,11 @@ IGNORED - Unable to parse line: ${line}.`);
 
 // src/cli/init/index.ts
 var import_child_process4 = require("child_process");
-var import_path2 = require("path");
+var import_path3 = require("path");
 var import_prompts4 = __toESM(require("prompts"));
 
 // src/cli/init/walkthrough.ts
-var import_fs9 = require("fs");
+var import_fs10 = require("fs");
 var import_prompts3 = __toESM(require("prompts"));
 
 // src/lib/errors.ts
@@ -2036,7 +2473,7 @@ function walkthrough() {
     validate: async (val) => {
       try {
         const name2 = sanitizeName(val);
-        await import_fs9.promises.access(name2, import_fs9.promises.constants.F_OK);
+        await import_fs10.promises.access(name2, import_fs10.promises.constants.F_OK);
         return "A directory with this name already exists";
       } catch (e) {
         return val.length > 2 || "The name must be at least 3 characters long";
@@ -2115,19 +2552,19 @@ function init_default(program2) {
       console.log("Creating new Pepr module...");
       try {
         await createDir(dirName);
-        await createDir((0, import_path2.resolve)(dirName, ".vscode"));
-        await createDir((0, import_path2.resolve)(dirName, "capabilities"));
-        await write((0, import_path2.resolve)(dirName, gitignore.path), gitignore.data);
-        await write((0, import_path2.resolve)(dirName, eslint.path), eslint.data);
-        await write((0, import_path2.resolve)(dirName, prettier.path), prettier.data);
-        await write((0, import_path2.resolve)(dirName, packageJSON2.path), packageJSON2.data);
-        await write((0, import_path2.resolve)(dirName, readme.path), readme.data);
-        await write((0, import_path2.resolve)(dirName, tsConfig.path), tsConfig.data);
-        await write((0, import_path2.resolve)(dirName, peprTS3.path), peprTS3.data);
-        await write((0, import_path2.resolve)(dirName, ".vscode", snippet.path), snippet.data);
-        await write((0, import_path2.resolve)(dirName, ".vscode", codeSettings.path), codeSettings.data);
-        await write((0, import_path2.resolve)(dirName, "capabilities", samplesYaml.path), samplesYaml.data);
-        await write((0, import_path2.resolve)(dirName, "capabilities", helloPepr.path), helloPepr.data);
+        await createDir((0, import_path3.resolve)(dirName, ".vscode"));
+        await createDir((0, import_path3.resolve)(dirName, "capabilities"));
+        await write((0, import_path3.resolve)(dirName, gitignore.path), gitignore.data);
+        await write((0, import_path3.resolve)(dirName, eslint.path), eslint.data);
+        await write((0, import_path3.resolve)(dirName, prettier.path), prettier.data);
+        await write((0, import_path3.resolve)(dirName, packageJSON2.path), packageJSON2.data);
+        await write((0, import_path3.resolve)(dirName, readme.path), readme.data);
+        await write((0, import_path3.resolve)(dirName, tsConfig.path), tsConfig.data);
+        await write((0, import_path3.resolve)(dirName, peprTS3.path), peprTS3.data);
+        await write((0, import_path3.resolve)(dirName, ".vscode", snippet.path), snippet.data);
+        await write((0, import_path3.resolve)(dirName, ".vscode", codeSettings.path), codeSettings.data);
+        await write((0, import_path3.resolve)(dirName, "capabilities", samplesYaml.path), samplesYaml.data);
+        await write((0, import_path3.resolve)(dirName, "capabilities", helloPepr.path), helloPepr.data);
         if (!opts.skipPostInit) {
           process.chdir(dirName);
           (0, import_child_process4.execSync)("npm install", {
@@ -2197,8 +2634,8 @@ var RootCmd = class extends import_commander3.Command {
 
 // src/cli/update.ts
 var import_child_process5 = require("child_process");
-var import_fs10 = __toESM(require("fs"));
-var import_path3 = require("path");
+var import_fs11 = __toESM(require("fs"));
+var import_path4 = require("path");
 var import_prompts5 = __toESM(require("prompts"));
 function update_default(program2) {
   program2.command("update").description("Update this Pepr module").option("--skip-template-update", "Skip updating the template files").action(async (opts) => {
@@ -2232,17 +2669,17 @@ function update_default(program2) {
     console.log("Updating Pepr config and template tiles...");
     try {
       if (!opts.skipTemplateUpdate) {
-        await write((0, import_path3.resolve)(prettier.path), prettier.data);
-        await write((0, import_path3.resolve)(tsConfig.path), tsConfig.data);
-        await write((0, import_path3.resolve)(".vscode", snippet.path), snippet.data);
-        await write((0, import_path3.resolve)(".vscode", codeSettings.path), codeSettings.data);
-        const samplePath = (0, import_path3.resolve)("capabilities", samplesYaml.path);
-        if (import_fs10.default.existsSync(samplePath)) {
-          import_fs10.default.unlinkSync(samplePath);
+        await write((0, import_path4.resolve)(prettier.path), prettier.data);
+        await write((0, import_path4.resolve)(tsConfig.path), tsConfig.data);
+        await write((0, import_path4.resolve)(".vscode", snippet.path), snippet.data);
+        await write((0, import_path4.resolve)(".vscode", codeSettings.path), codeSettings.data);
+        const samplePath = (0, import_path4.resolve)("capabilities", samplesYaml.path);
+        if (import_fs11.default.existsSync(samplePath)) {
+          import_fs11.default.unlinkSync(samplePath);
           await write(samplePath, samplesYaml.data);
         }
-        const tsPath = (0, import_path3.resolve)("capabilities", helloPepr.path);
-        if (import_fs10.default.existsSync(tsPath)) {
+        const tsPath = (0, import_path4.resolve)("capabilities", helloPepr.path);
+        if (import_fs11.default.existsSync(tsPath)) {
           await write(tsPath, helloPepr.data);
         }
       }