pepr 0.38.3 → 0.39.0

package/dist/cli.js

@@ -287,23 +287,28 @@ function sanitizeResourceName(name2) {
   return name2.toLowerCase().replace(/[^a-z0-9]+/g, "-").slice(0, 250).replace(/^[^a-z]+|[^a-z]+$/g, "");
 }
 
-// src/lib/adjudicators.ts
+// src/lib/filter/adjudicators.ts
 var import_ramda = require("ramda");
 var declaredOperation = (0, import_ramda.pipe)((request) => request?.operation, (0, import_ramda.defaultTo)(""));
 var declaredGroup = (0, import_ramda.pipe)((request) => request?.kind?.group, (0, import_ramda.defaultTo)(""));
 var declaredVersion = (0, import_ramda.pipe)((request) => request?.kind?.version, (0, import_ramda.defaultTo)(""));
 var declaredKind = (0, import_ramda.pipe)((request) => request?.kind?.kind, (0, import_ramda.defaultTo)(""));
 var declaredUid = (0, import_ramda.pipe)((request) => request?.uid, (0, import_ramda.defaultTo)(""));
-var carriesDeletionTimestamp = (0, import_ramda.pipe)((obj) => !!obj.metadata?.deletionTimestamp, (0, import_ramda.defaultTo)(false));
+var carriesDeletionTimestamp = (0, import_ramda.pipe)(
+  (kubernetesObject) => !!kubernetesObject.metadata?.deletionTimestamp,
+  (0, import_ramda.defaultTo)(false)
+);
 var missingDeletionTimestamp = (0, import_ramda.complement)(carriesDeletionTimestamp);
-var carriedName = (0, import_ramda.pipe)((obj) => obj?.metadata?.name, (0, import_ramda.defaultTo)(""));
+var carriedKind = (0, import_ramda.pipe)((kubernetesObject) => kubernetesObject?.metadata?.kind, (0, import_ramda.defaultTo)("not set"));
+var carriedVersion = (0, import_ramda.pipe)((kubernetesObject) => kubernetesObject?.metadata?.version, (0, import_ramda.defaultTo)("not set"));
+var carriedName = (0, import_ramda.pipe)((kubernetesObject) => kubernetesObject?.metadata?.name, (0, import_ramda.defaultTo)(""));
 var carriesName = (0, import_ramda.pipe)(carriedName, (0, import_ramda.equals)(""), import_ramda.not);
 var missingName = (0, import_ramda.complement)(carriesName);
-var carriedNamespace = (0, import_ramda.pipe)((obj) => obj?.metadata?.namespace, (0, import_ramda.defaultTo)(""));
+var carriedNamespace = (0, import_ramda.pipe)((kubernetesObject) => kubernetesObject?.metadata?.namespace, (0, import_ramda.defaultTo)(""));
 var carriesNamespace = (0, import_ramda.pipe)(carriedNamespace, (0, import_ramda.equals)(""), import_ramda.not);
-var carriedAnnotations = (0, import_ramda.pipe)((obj) => obj?.metadata?.annotations, (0, import_ramda.defaultTo)({}));
+var carriedAnnotations = (0, import_ramda.pipe)((kubernetesObject) => kubernetesObject?.metadata?.annotations, (0, import_ramda.defaultTo)({}));
 var carriesAnnotations = (0, import_ramda.pipe)(carriedAnnotations, (0, import_ramda.equals)({}), import_ramda.not);
-var carriedLabels = (0, import_ramda.pipe)((obj) => obj?.metadata?.labels, (0, import_ramda.defaultTo)({}));
+var carriedLabels = (0, import_ramda.pipe)((kubernetesObject) => kubernetesObject?.metadata?.labels, (0, import_ramda.defaultTo)({}));
 var carriesLabels = (0, import_ramda.pipe)(carriedLabels, (0, import_ramda.equals)({}), import_ramda.not);
 var definesDeletionTimestamp = (0, import_ramda.pipe)((binding) => binding?.filters?.deletionTimestamp, (0, import_ramda.defaultTo)(false));
 var ignoresDeletionTimestamp = (0, import_ramda.complement)(definesDeletionTimestamp);
@@ -334,46 +339,46 @@ var definedCategory = (0, import_ramda.pipe)((binding) => {
 var definedCallback = (0, import_ramda.pipe)((binding) => {
   return binding.isFinalize ? binding.finalizeCallback : binding.isWatch ? binding.watchCallback : binding.isMutate ? binding.mutateCallback : binding.isValidate ? binding.validateCallback : null;
 });
-var definedCallbackName = (0, import_ramda.pipe)(definedCallback, (0, import_ramda.defaultTo)({ name: "" }), (cb) => cb.name);
+var definedCallbackName = (0, import_ramda.pipe)(definedCallback, (0, import_ramda.defaultTo)({ name: "" }), (callback) => callback.name);
 var mismatchedDeletionTimestamp = (0, import_ramda.allPass)([
   (0, import_ramda.pipe)((0, import_ramda.nthArg)(0), definesDeletionTimestamp),
   (0, import_ramda.pipe)((0, import_ramda.nthArg)(1), missingDeletionTimestamp)
 ]);
 var mismatchedName = (0, import_ramda.allPass)([
   (0, import_ramda.pipe)((0, import_ramda.nthArg)(0), definesName),
-  (0, import_ramda.pipe)((bnd, obj) => definedName(bnd) !== carriedName(obj))
+  (0, import_ramda.pipe)((binding, kubernetesObject) => definedName(binding) !== carriedName(kubernetesObject))
 ]);
 var mismatchedNameRegex = (0, import_ramda.allPass)([
   (0, import_ramda.pipe)((0, import_ramda.nthArg)(0), definesNameRegex),
-  (0, import_ramda.pipe)((bnd, obj) => new RegExp(definedNameRegex(bnd)).test(carriedName(obj)), import_ramda.not)
+  (0, import_ramda.pipe)((binding, kubernetesObject) => new RegExp(definedNameRegex(binding)).test(carriedName(kubernetesObject)), import_ramda.not)
 ]);
 var bindsToKind = (0, import_ramda.curry)(
-  (0, import_ramda.allPass)([(0, import_ramda.pipe)((0, import_ramda.nthArg)(0), definedKind, (0, import_ramda.equals)(""), import_ramda.not), (0, import_ramda.pipe)((bnd, knd) => definedKind(bnd) === knd)])
+  (0, import_ramda.allPass)([(0, import_ramda.pipe)((0, import_ramda.nthArg)(0), definedKind, (0, import_ramda.equals)(""), import_ramda.not), (0, import_ramda.pipe)((binding, kind8) => definedKind(binding) === kind8)])
 );
 var bindsToNamespace = (0, import_ramda.curry)((0, import_ramda.pipe)(bindsToKind(import_ramda.__, "Namespace")));
 var misboundNamespace = (0, import_ramda.allPass)([bindsToNamespace, definesNamespaces]);
 var mismatchedNamespace = (0, import_ramda.allPass)([
   (0, import_ramda.pipe)((0, import_ramda.nthArg)(0), definesNamespaces),
-  (0, import_ramda.pipe)((bnd, obj) => definedNamespaces(bnd).includes(carriedNamespace(obj)), import_ramda.not)
+  (0, import_ramda.pipe)((binding, kubernetesObject) => definedNamespaces(binding).includes(carriedNamespace(kubernetesObject)), import_ramda.not)
 ]);
 var mismatchedNamespaceRegex = (0, import_ramda.allPass)([
   (0, import_ramda.pipe)((0, import_ramda.nthArg)(0), definesNamespaceRegexes),
   (0, import_ramda.pipe)(
-    (bnd, obj) => (0, import_ramda.pipe)(
-      (0, import_ramda.any)((rex) => new RegExp(rex).test(carriedNamespace(obj))),
+    (binding, kubernetesObject) => (0, import_ramda.pipe)(
+      (0, import_ramda.any)((regEx) => new RegExp(regEx).test(carriedNamespace(kubernetesObject))),
       import_ramda.not
-    )(definedNamespaceRegexes(bnd))
+    )(definedNamespaceRegexes(binding))
   )
 ]);
 var metasMismatch = (0, import_ramda.pipe)(
   (defined, carried) => {
     const result = { defined, carried, unalike: {} };
-    result.unalike = Object.entries(result.defined).map(([key, val]) => {
+    result.unalike = Object.entries(result.defined).map(([key, value]) => {
       const keyMissing = !Object.hasOwn(result.carried, key);
-      const noValue = !val;
+      const noValue = !value;
       const valMissing = !result.carried[key];
       const valDiffers = result.carried[key] !== result.defined[key];
-      return keyMissing ? { [key]: val } : noValue ? {} : valMissing ? { [key]: val } : valDiffers ? { [key]: val } : {};
+      return keyMissing ? { [key]: value } : noValue ? {} : valMissing ? { [key]: value } : valDiffers ? { [key]: value } : {};
     }).reduce((acc, cur) => ({ ...acc, ...cur }), {});
     return result.unalike;
   },
@@ -381,32 +386,37 @@ var metasMismatch = (0, import_ramda.pipe)(
 );
 var mismatchedAnnotations = (0, import_ramda.allPass)([
   (0, import_ramda.pipe)((0, import_ramda.nthArg)(0), definesAnnotations),
-  (0, import_ramda.pipe)((bnd, obj) => metasMismatch(definedAnnotations(bnd), carriedAnnotations(obj)))
+  (0, import_ramda.pipe)((binding, kubernetesObject) => metasMismatch(definedAnnotations(binding), carriedAnnotations(kubernetesObject)))
 ]);
 var mismatchedLabels = (0, import_ramda.allPass)([
   (0, import_ramda.pipe)((0, import_ramda.nthArg)(0), definesLabels),
-  (0, import_ramda.pipe)((bnd, obj) => metasMismatch(definedLabels(bnd), carriedLabels(obj)))
+  (0, import_ramda.pipe)((binding, kubernetesObject) => metasMismatch(definedLabels(binding), carriedLabels(kubernetesObject)))
 ]);
 var uncarryableNamespace = (0, import_ramda.allPass)([
   (0, import_ramda.pipe)((0, import_ramda.nthArg)(0), import_ramda.length, (0, import_ramda.gt)(import_ramda.__, 0)),
   (0, import_ramda.pipe)((0, import_ramda.nthArg)(1), carriesNamespace),
-  (0, import_ramda.pipe)((nss, obj) => nss.includes(carriedNamespace(obj)), import_ramda.not)
+  (0, import_ramda.pipe)((namespaceSelector, kubernetesObject) => namespaceSelector.includes(carriedNamespace(kubernetesObject)), import_ramda.not)
 ]);
 var carriesIgnoredNamespace = (0, import_ramda.allPass)([
   (0, import_ramda.pipe)((0, import_ramda.nthArg)(0), import_ramda.length, (0, import_ramda.gt)(import_ramda.__, 0)),
   (0, import_ramda.pipe)((0, import_ramda.nthArg)(1), carriesNamespace),
-  (0, import_ramda.pipe)((nss, obj) => nss.includes(carriedNamespace(obj)))
+  (0, import_ramda.pipe)((namespaceSelector, kubernetesObject) => namespaceSelector.includes(carriedNamespace(kubernetesObject)))
 ]);
 var unbindableNamespaces = (0, import_ramda.allPass)([
   (0, import_ramda.pipe)((0, import_ramda.nthArg)(0), import_ramda.length, (0, import_ramda.gt)(import_ramda.__, 0)),
   (0, import_ramda.pipe)((0, import_ramda.nthArg)(1), definesNamespaces),
-  (0, import_ramda.pipe)((nss, bnd) => (0, import_ramda.difference)(definedNamespaces(bnd), nss), import_ramda.length, (0, import_ramda.equals)(0), import_ramda.not)
+  (0, import_ramda.pipe)(
+    (namespaceSelector, binding) => (0, import_ramda.difference)(definedNamespaces(binding), namespaceSelector),
+    import_ramda.length,
+    (0, import_ramda.equals)(0),
+    import_ramda.not
+  )
 ]);
 var misboundDeleteWithDeletionTimestamp = (0, import_ramda.allPass)([definesDelete, definesDeletionTimestamp]);
 var operationMatchesEvent = (0, import_ramda.anyPass)([
   (0, import_ramda.pipe)((0, import_ramda.nthArg)(1), (0, import_ramda.equals)("*" /* Any */)),
-  (0, import_ramda.pipe)((op, evt) => op === evt),
-  (0, import_ramda.pipe)((op, evt) => op ? evt.includes(op) : false)
+  (0, import_ramda.pipe)((operation, event) => operation === event),
+  (0, import_ramda.pipe)((operation, event) => operation ? event.includes(operation) : false)
 ]);
 var mismatchedEvent = (0, import_ramda.pipe)(
   (binding, request) => operationMatchesEvent(declaredOperation(request), definedEvent(binding)),
@@ -462,6 +472,12 @@ function createRBACMap(capabilities) {
           plural: binding.kind.plural || `${binding.kind.kind.toLowerCase()}s`
         };
       }
+      if (binding.isFinalize) {
+        acc[key] = {
+          verbs: ["patch"],
+          plural: binding.kind.plural || `${binding.kind.kind.toLowerCase()}s`
+        };
+      }
     });
     return acc;
   }, {});
@@ -529,12 +545,7 @@ function namespaceComplianceValidator(capability, ignoredNamespaces) {
   if (bindingRegexNamespaces && bindingRegexNamespaces.length > 0 && capabilityNamespaces && capabilityNamespaces.length > 0) {
     for (const regexNamespace of bindingRegexNamespaces) {
       let matches = false;
-      for (const capabilityNamespace of capabilityNamespaces) {
-        if (regexNamespace !== "" && matchesRegex(regexNamespace, capabilityNamespace)) {
-          matches = true;
-          break;
-        }
-      }
+      matches = regexNamespace !== "" && capabilityNamespaces.some((capabilityNamespace) => matchesRegex(regexNamespace, capabilityNamespace));
       if (!matches) {
         throw new Error(
           `Ignoring Watch Callback: Object namespace does not match any capability namespace with regex ${regexNamespace}.`
@@ -544,12 +555,11 @@ function namespaceComplianceValidator(capability, ignoredNamespaces) {
   }
   if (bindingRegexNamespaces && bindingRegexNamespaces.length > 0 && ignoredNamespaces && ignoredNamespaces.length > 0) {
     for (const regexNamespace of bindingRegexNamespaces) {
-      for (const ignoredNS of ignoredNamespaces) {
-        if (matchesRegex(regexNamespace, ignoredNS)) {
-          throw new Error(
-            `Ignoring Watch Callback: Regex namespace: ${regexNamespace}, is an ignored namespace: ${ignoredNS}.`
-          );
-        }
+      const matchedNS = ignoredNamespaces.find((ignoredNS) => matchesRegex(regexNamespace, ignoredNS));
+      if (matchedNS) {
+        throw new Error(
+          `Ignoring Watch Callback: Regex namespace: ${regexNamespace}, is an ignored namespace: ${matchedNS}.`
+        );
       }
     }
   }
@@ -973,23 +983,33 @@ function genEnv(config, watchMode = false, ignoreWatchMode = false) {
 }
 
 // src/lib/assets/rbac.ts
-function clusterRole(name2, capabilities, rbacMode = "") {
+function clusterRole(name2, capabilities, rbacMode = "admin", customRbac) {
   const rbacMap = createRBACMap(capabilities);
+  const scopedRules = Object.keys(rbacMap).map((key) => {
+    let group2;
+    key.split("/").length < 3 ? group2 = "" : group2 = key.split("/")[0];
+    return {
+      apiGroups: [group2],
+      resources: [rbacMap[key].plural],
+      verbs: rbacMap[key].verbs
+    };
+  });
+  const mergedRBAC = [...Array.isArray(customRbac) ? customRbac : [], ...scopedRules];
+  const deduper = {};
+  mergedRBAC.forEach((rule) => {
+    const key = `${rule.apiGroups}/${rule.resources}`;
+    if (deduper[key]) {
+      deduper[key].verbs = Array.from(/* @__PURE__ */ new Set([...deduper[key].verbs, ...rule.verbs]));
+    } else {
+      deduper[key] = { ...rule, verbs: rule.verbs || [] };
+    }
+  });
+  const deduplicatedRules = Object.values(deduper);
   return {
     apiVersion: "rbac.authorization.k8s.io/v1",
     kind: "ClusterRole",
     metadata: { name: name2 },
-    rules: rbacMode === "scoped" ? [
-      ...Object.keys(rbacMap).map((key) => {
-        let group2;
-        key.split("/").length < 3 ? group2 = "" : group2 = key.split("/")[0];
-        return {
-          apiGroups: [group2],
-          resources: [rbacMap[key].plural],
-          verbs: rbacMap[key].verbs
-        };
-      })
-    ] : [
+    rules: rbacMode === "scoped" ? deduplicatedRules : [
       {
         apiGroups: ["*"],
         resources: ["*"],
@@ -1066,14 +1086,14 @@ function storeRoleBinding(name2) {
 
 // src/lib/k8s.ts
 var import_kubernetes_fluent_client3 = require("kubernetes-fluent-client");
-var PeprStore = class extends import_kubernetes_fluent_client3.GenericKind {
+var Store = class extends import_kubernetes_fluent_client3.GenericKind {
 };
 var peprStoreGVK = {
   kind: "PeprStore",
   version: "v1",
   group: "pepr.dev"
 };
-(0, import_kubernetes_fluent_client3.RegisterKind)(PeprStore, peprStoreGVK);
+(0, import_kubernetes_fluent_client3.RegisterKind)(Store, peprStoreGVK);
 
 // src/lib/assets/store.ts
 var { group, version, kind: kind3 } = peprStoreGVK;
@@ -1273,16 +1293,17 @@ async function deploy(assets, force, webhookTimeout) {
   if (code.length < 1) {
     throw new Error("No code provided");
   }
-  await setupRBAC(name2, assets.capabilities, force);
+  await setupRBAC(name2, assets.capabilities, force, assets.config);
   await setupController(assets, code, hash, force);
   await setupWatcher(assets, hash, force);
 }
-async function setupRBAC(name2, capabilities, force) {
+async function setupRBAC(name2, capabilities, force, config) {
+  const { rbacMode, rbac } = config;
   logger_default.info("Applying cluster role binding");
   const crb = clusterRoleBinding(name2);
   await (0, import_kubernetes_fluent_client4.K8s)(import_kubernetes_fluent_client4.kind.ClusterRoleBinding).Apply(crb, { force });
   logger_default.info("Applying cluster role");
-  const cr = clusterRole(name2, capabilities);
+  const cr = clusterRole(name2, capabilities, rbacMode, rbac);
   await (0, import_kubernetes_fluent_client4.K8s)(import_kubernetes_fluent_client4.kind.ClusterRole).Apply(cr, { force });
   logger_default.info("Applying service account");
   const sa = serviceAccount(name2);
@@ -1352,8 +1373,10 @@ function loadCapabilities(path) {
 var import_client_node = require("@kubernetes/client-node");
 var import_crypto2 = __toESM(require("crypto"));
 var import_fs4 = require("fs");
-async function overridesFile({ hash, name: name2, image, config, apiToken }, path) {
+async function overridesFile({ hash, name: name2, image, config, apiToken, capabilities }, path) {
+  const rbacOverrides = clusterRole(name2, capabilities, config.rbacMode, config.rbac).rules;
   const overrides = {
+    rbac: rbacOverrides,
     secrets: {
       apiToken: Buffer.from(apiToken).toString("base64")
     },
@@ -1555,8 +1578,8 @@ function zarfYamlChart({ name: name2, image, config }, path) {
   };
   return (0, import_client_node.dumpYaml)(zarfCfg, { noRefs: true });
 }
-async function allYaml(assets, rbacMode, imagePullSecret) {
-  const { name: name2, tls, apiToken, path } = assets;
+async function allYaml(assets, imagePullSecret) {
+  const { name: name2, tls, apiToken, path, config } = assets;
   const code = await import_fs4.promises.readFile(path);
   assets.hash = import_crypto2.default.createHash("sha256").update(code).digest("hex");
   const mutateWebhook = await webhookConfig(assets, "mutate", assets.config.webhookTimeout);
@@ -1564,7 +1587,7 @@ async function allYaml(assets, rbacMode, imagePullSecret) {
   const watchDeployment = watcher(assets, assets.hash, assets.buildTimestamp, imagePullSecret);
   const resources = [
     namespace(assets.config.customLabels?.namespace),
-    clusterRole(name2, assets.capabilities, rbacMode),
+    clusterRole(name2, assets.capabilities, config.rbacMode, config.rbac),
     clusterRoleBinding(name2),
     serviceAccount(name2),
     apiTokenSecret(name2, apiToken),
@@ -1592,6 +1615,19 @@ async function allYaml(assets, rbacMode, imagePullSecret) {
 var import_path = require("path");
 
 // src/lib/assets/helm.ts
+function clusterRoleTemplate() {
+  return `
+    apiVersion: rbac.authorization.k8s.io/v1
+    kind: ClusterRole
+    metadata:
+      name: {{ .Values.uuid }}
+      namespace: pepr-system
+    rules: 
+      {{- if .Values.rbac }}
+      {{- toYaml .Values.rbac | nindent 2 }}
+      {{- end }}
+  `;
+}
 function nsTemplate() {
   return `
     apiVersion: v1
@@ -1860,12 +1896,12 @@ var Assets = class {
   };
   zarfYaml = (path) => zarfYaml(this, path);
   zarfYamlChart = (path) => zarfYamlChart(this, path);
-  allYaml = async (rbacMode, imagePullSecret) => {
+  allYaml = async (imagePullSecret) => {
     this.capabilities = await loadCapabilities(this.path);
     for (const capability of this.capabilities) {
       namespaceComplianceValidator(capability, this.alwaysIgnore?.namespaces);
     }
-    return allYaml(this, rbacMode, imagePullSecret);
+    return allYaml(this, imagePullSecret);
   };
   generateHelmChart = async (basePath) => {
     const CHART_DIR = `${basePath}/${this.config.uuid}-chart`;
@@ -1904,10 +1940,7 @@ var Assets = class {
       await import_fs5.promises.writeFile(moduleSecretPath, (0, import_client_node2.dumpYaml)(moduleSecret(this.name, code, this.hash), { noRefs: true }));
       await import_fs5.promises.writeFile(storeRolePath, (0, import_client_node2.dumpYaml)(storeRole(this.name), { noRefs: true }));
       await import_fs5.promises.writeFile(storeRoleBindingPath, (0, import_client_node2.dumpYaml)(storeRoleBinding(this.name), { noRefs: true }));
-      await import_fs5.promises.writeFile(
-        clusterRolePath,
-        (0, import_client_node2.dumpYaml)(clusterRole(this.name, this.capabilities, "rbac"), { noRefs: true })
-      );
+      await import_fs5.promises.writeFile(clusterRolePath, dedent(clusterRoleTemplate()));
       await import_fs5.promises.writeFile(clusterRoleBindingPath, (0, import_client_node2.dumpYaml)(clusterRoleBinding(this.name), { noRefs: true }));
       await import_fs5.promises.writeFile(serviceAccountPath, (0, import_client_node2.dumpYaml)(serviceAccount(this.name), { noRefs: true }));
       const mutateWebhook = await webhookConfig(this, "mutate", this.config.webhookTimeout);
@@ -2161,7 +2194,7 @@ var gitIgnore = "# Ignore node_modules and Pepr build artifacts\nnode_modules\nd
 var readmeMd = '# Pepr Module\n\nThis is a Pepr Module. [Pepr](https://github.com/defenseunicorns/pepr) is a type-safe Kubernetes middleware system.\n\nThe `capabilities` directory contains all the capabilities for this module. By default,\na capability is a single typescript file in the format of `capability-name.ts` that is\nimported in the root `pepr.ts` file as `import { HelloPepr } from "./capabilities/hello-pepr";`.\nBecause this is typescript, you can organize this however you choose, e.g. creating a sub-folder\nper-capability or common logic in shared files or folders.\n\nExample Structure:\n\n```\nModule Root\n\u251C\u2500\u2500 package.json\n\u251C\u2500\u2500 pepr.ts\n\u2514\u2500\u2500 capabilities\n    \u251C\u2500\u2500 example-one.ts\n    \u251C\u2500\u2500 example-three.ts\n    \u2514\u2500\u2500 example-two.ts\n```\n';
 var peprTS = 'import { PeprModule } from "pepr";\n// cfg loads your pepr configuration from package.json\nimport cfg from "./package.json";\n\n// HelloPepr is a demo capability that is included with Pepr. Comment or delete the line below to remove it.\nimport { HelloPepr } from "./capabilities/hello-pepr";\n\n/**\n * This is the main entrypoint for this Pepr module. It is run when the module is started.\n * This is where you register your Pepr configurations and capabilities.\n */\nnew PeprModule(cfg, [\n  // "HelloPepr" is a demo capability that is included with Pepr. Comment or delete the line below to remove it.\n  HelloPepr,\n\n  // Your additional capabilities go here\n]);\n';
 var helloPeprTS = 'import {\n  Capability,\n  K8s,\n  Log,\n  PeprMutateRequest,\n  RegisterKind,\n  a,\n  fetch,\n  fetchStatus,\n  kind,\n} from "pepr";\nimport nock from "nock";\n\n/**\n *  The HelloPepr Capability is an example capability to demonstrate some general concepts of Pepr.\n *  To test this capability you run `pepr dev`and then run the following command:\n *  `kubectl apply -f capabilities/hello-pepr.samples.yaml`\n */\nexport const HelloPepr = new Capability({\n  name: "hello-pepr",\n  description: "A simple example capability to show how things work.",\n  namespaces: ["pepr-demo", "pepr-demo-2"],\n});\n\n// Use the \'When\' function to create a new action, use \'Store\' to persist data\nconst { When, Store } = HelloPepr;\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Namespace)                                   *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action removes the label `remove-me` when a Namespace is created.\n * Note we don\'t need to specify the namespace here, because we\'ve already specified\n * it in the Capability definition above.\n */\nWhen(a.Namespace)\n  .IsCreated()\n  .Mutate(ns => ns.RemoveLabel("remove-me"));\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Watch Action with K8s SSA (Namespace)                           *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action watches for the `pepr-demo-2` namespace to be created, then creates a ConfigMap with\n * the name `pepr-ssa-demo` and adds the namespace UID to the ConfigMap data. Because Pepr uses\n * server-side apply for this operation, the ConfigMap will be created or updated if it already exists.\n */\nWhen(a.Namespace)\n  .IsCreated()\n  .WithName("pepr-demo-2")\n  .Watch(async ns => {\n    Log.info("Namespace pepr-demo-2 was created.");\n\n    try {\n      // Apply the ConfigMap using K8s server-side apply\n      await K8s(kind.ConfigMap).Apply({\n        metadata: {\n          name: "pepr-ssa-demo",\n          namespace: "pepr-demo-2",\n        },\n        data: {\n          "ns-uid": ns.metadata.uid,\n        },\n      });\n    } catch (error) {\n      // You can use the Log object to log messages to the Pepr controller pod\n      Log.error(error, "Failed to apply ConfigMap using server-side apply.");\n    }\n\n    // You can share data between actions using the Store, including between different types of actions\n    Store.setItem("watch-data", "This data was stored by a Watch Action.");\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 1)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This is a single action. They can be in the same file or put imported from other files.\n * In this example, when a ConfigMap is created with the name `example-1`, then add a label and annotation.\n *\n * Equivalent to manually running:\n * `kubectl label configmap example-1 pepr=was-here`\n * `kubectl annotate configmap example-1 pepr.dev=annotations-work-too`\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-1")\n  .Mutate(request => {\n    request\n      .SetLabel("pepr", "was-here")\n      .SetAnnotation("pepr.dev", "annotations-work-too");\n\n    // Use the Store to persist data between requests and Pepr controller pods\n    Store.setItem("example-1", "was-here");\n\n    // This data is written asynchronously and can be read back via `Store.getItem()` or `Store.subscribe()`\n    Store.setItem("example-1-data", JSON.stringify(request.Raw.data));\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate & Validate Actions (CM Example 2)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This combines 3 different types of actions: \'Mutate\', \'Validate\', and \'Watch\'. The order\n * of the actions is required, but each action is optional. In this example, when a ConfigMap is created\n * with the name `example-2`, then add a label and annotation, validate that the ConfigMap has the label\n * `pepr`, and log the request.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-2")\n  .Mutate(request => {\n    // This Mutate Action will mutate the request before it is persisted to the cluster\n\n    // Use `request.Merge()` to merge the new data with the existing data\n    request.Merge({\n      metadata: {\n        labels: {\n          pepr: "was-here",\n        },\n        annotations: {\n          "pepr.dev": "annotations-work-too",\n        },\n      },\n    });\n  })\n  .Validate(request => {\n    // This Validate Action will validate the request before it is persisted to the cluster\n\n    // Approve the request if the ConfigMap has the label \'pepr\'\n    if (request.HasLabel("pepr")) {\n      return request.Approve();\n    }\n\n    // Otherwise, deny the request with an error message (optional)\n    return request.Deny("ConfigMap must have label \'pepr\'");\n  })\n  .Watch((cm, phase) => {\n    // This Watch Action will watch the ConfigMap after it has been persisted to the cluster\n    Log.info(cm, `ConfigMap was ${phase} with the name example-2`);\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 2a)                               *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action shows a simple validation that will deny any ConfigMap that has the\n * annotation `evil`. Note that the `Deny()` function takes an optional second parameter that is a\n * user-defined status code to return.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .Validate(request => {\n    if (request.HasAnnotation("evil")) {\n      return request.Deny("No evil CM annotations allowed.", 400);\n    }\n\n    return request.Approve();\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 3)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action combines different styles. Unlike the previous actions, this one will look\n * for any ConfigMap in the `pepr-demo` namespace that has the label `change=by-label` during either\n * CREATE or UPDATE. Note that all conditions added such as `WithName()`, `WithLabel()`, `InNamespace()`,\n * are ANDs so all conditions must be true for the request to be processed.\n */\nWhen(a.ConfigMap)\n  .IsCreatedOrUpdated()\n  .WithLabel("change", "by-label")\n  .Mutate(request => {\n    // The K8s object e are going to mutate\n    const cm = request.Raw;\n\n    // Get the username and uid of the K8s request\n    const { username, uid } = request.Request.userInfo;\n\n    // Store some data about the request in the configmap\n    cm.data["username"] = username;\n    cm.data["uid"] = uid;\n\n    // You can still mix other ways of making changes too\n    request.SetAnnotation("pepr.dev", "making-waves");\n  });\n\n// This action validates the label `change=by-label` is deleted\nWhen(a.ConfigMap)\n  .IsDeleted()\n  .WithLabel("change", "by-label")\n  .Validate(request => {\n    // Log and then always approve the request\n    Log.info("CM with label \'change=by-label\' was deleted.");\n    return request.Approve();\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 4)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action show how you can use the `Mutate()` function without an inline function.\n * This is useful if you want to keep your actions small and focused on a single task,\n * or if you want to reuse the same function in multiple actions.\n */\nWhen(a.ConfigMap).IsCreated().WithName("example-4").Mutate(example4Cb);\n\n// This function uses the complete type definition, but is not required.\nfunction example4Cb(cm: PeprMutateRequest<a.ConfigMap>) {\n  cm.SetLabel("pepr.dev/first", "true");\n  cm.SetLabel("pepr.dev/second", "true");\n  cm.SetLabel("pepr.dev/third", "true");\n}\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 4a)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This is the same as Example 4, except this only operates on a CM in the `pepr-demo-2` namespace.\n * Note because the Capability defines namespaces, the namespace specified here must be one of those.\n * Alternatively, you can remove the namespace from the Capability definition and specify it here.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .InNamespace("pepr-demo-2")\n  .WithName("example-4a")\n  .Mutate(example4Cb);\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 5)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action is a bit more complex. It will look for any ConfigMap in the `pepr-demo`\n * namespace that has the label `chuck-norris` during CREATE. When it finds one, it will fetch a\n * random Chuck Norris joke from the API and add it to the ConfigMap. This is a great example of how\n * you can use Pepr to make changes to your K8s objects based on external data.\n *\n * Note the use of the `async` keyword. This is required for any action that uses `await` or `fetch()`.\n *\n * Also note we are passing a type to the `fetch()` function. This is optional, but it will help you\n * avoid mistakes when working with the data returned from the API. You can also use the `as` keyword to\n * cast the data returned from the API.\n *\n * These are equivalent:\n * ```ts\n * const joke = await fetch<TheChuckNorrisJoke>("https://icanhazdadjoke.com/");\n * const joke = await fetch("https://icanhazdadjoke.com/") as TheChuckNorrisJoke;\n * ```\n *\n * Alternatively, you can drop the type completely:\n *\n * ```ts\n * fetch("https://icanhazdadjoke.com")\n * ```\n */\ninterface TheChuckNorrisJoke {\n  id: string;\n  joke: string;\n  status: number;\n}\n\nWhen(a.ConfigMap)\n  .IsCreatedOrUpdated()\n  .WithLabel("chuck-norris")\n  .Mutate(cm => cm.SetLabel("got-jokes", "true"))\n  .Watch(async cm => {\n    const jokeURL = "https://icanhazdadjoke.com/";\n\n    // Set up Nock to mock the API calls globally with header matching\n    nock(jokeURL).get("/").reply(200, {\n      id: "R7UfaahVfFd",\n      joke: "Funny joke goes here.",\n      status: 200,\n    });\n\n    // Try/catch is not needed as a response object will always be returned\n    const response = await fetch<TheChuckNorrisJoke>(jokeURL, {\n      headers: {\n        Accept: "application/json",\n      },\n    });\n\n    // Instead, check the `response.ok` field\n    if (response.ok) {\n      const { joke } = response.data;\n      // Add Joke to the Store\n      await Store.setItemAndWait(jokeURL, joke);\n      // Add the Chuck Norris joke to the configmap\n      try {\n        await K8s(kind.ConfigMap).Apply({\n          metadata: {\n            name: cm.metadata.name,\n            namespace: cm.metadata.namespace,\n          },\n          data: {\n            "chuck-says": Store.getItem(jokeURL),\n          },\n        });\n      } catch (error) {\n        Log.error(error, "Failed to apply ConfigMap using server-side apply.", {\n          cm,\n        });\n      }\n    }\n\n    // You can also assert on different HTTP response codes\n    if (response.status === fetchStatus.NOT_FOUND) {\n      // Do something else\n      return;\n    }\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Secret Base64 Handling)                      *\n * ---------------------------------------------------------------------------------------------------\n *\n * The K8s JS client provides incomplete support for base64 encoding/decoding handling for secrets,\n * unlike the GO client. To make this less painful, Pepr automatically handles base64 encoding/decoding\n * secret data before and after the action is executed.\n */\nWhen(a.Secret)\n  .IsCreated()\n  .WithName("secret-1")\n  .Mutate(request => {\n    const secret = request.Raw;\n\n    // This will be encoded at the end of all processing back to base64: "Y2hhbmdlLXdpdGhvdXQtZW5jb2Rpbmc="\n    secret.data.magic = "change-without-encoding";\n\n    // You can modify the data directly, and it will be encoded at the end of all processing\n    secret.data.example += " - modified by Pepr";\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Untyped Custom Resource)                     *\n * ---------------------------------------------------------------------------------------------------\n *\n * Out of the box, Pepr supports all the standard Kubernetes objects. However, you can also create\n * your own types. This is useful if you are working with an Operator that creates custom resources.\n * There are two ways to do this, the first is to use the `When()` function with a `GenericKind`,\n * the second is to create a new class that extends `GenericKind` and use the `RegisterKind()` function.\n *\n * This example shows how to use the `When()` function with a `GenericKind`. Note that you\n * must specify the `group`, `version`, and `kind` of the object (if applicable). This is how Pepr knows\n * if the action should be triggered or not. Since we are using a `GenericKind`,\n * Pepr will not be able to provide any intellisense for the object, so you will need to refer to the\n * Kubernetes API documentation for the object you are working with.\n *\n * You will need to wait for the CRD in `hello-pepr.samples.yaml` to be created, then you can apply\n *\n * ```yaml\n * apiVersion: pepr.dev/v1\n * kind: Unicorn\n * metadata:\n *   name: example-1\n *   namespace: pepr-demo\n * spec:\n *   message: replace-me\n *   counter: 0\n * ```\n */\nWhen(a.GenericKind, {\n  group: "pepr.dev",\n  version: "v1",\n  kind: "Unicorn",\n})\n  .IsCreated()\n  .WithName("example-1")\n  .Mutate(request => {\n    request.Merge({\n      spec: {\n        message: "Hello Pepr without type data!",\n        counter: Math.random(),\n      },\n    });\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Typed Custom Resource)                       *\n * ---------------------------------------------------------------------------------------------------\n *\n * This example shows how to use the `RegisterKind()` function to create a new type. This is useful\n * if you are working with an Operator that creates custom resources and you want to have intellisense\n * for the object. Note that you must specify the `group`, `version`, and `kind` of the object (if applicable)\n * as this is how Pepr knows if the action should be triggered or not.\n *\n * Once you register a new Kind with Pepr, you can use the `When()` function with the new Kind. Ideally,\n * you should register custom Kinds at the top of your Capability file or Pepr Module so they are available\n * to all actions, but we are putting it here for demonstration purposes.\n *\n * You will need to wait for the CRD in `hello-pepr.samples.yaml` to be created, then you can apply\n *\n * ```yaml\n * apiVersion: pepr.dev/v1\n * kind: Unicorn\n * metadata:\n *   name: example-2\n *   namespace: pepr-demo\n * spec:\n *   message: replace-me\n *   counter: 0\n * ```*\n */\nclass UnicornKind extends a.GenericKind {\n  spec: {\n    /**\n     * JSDoc comments can be added to explain more details about the field.\n     *\n     * @example\n     * ```ts\n     * request.Raw.spec.message = "Hello Pepr!";\n     * ```\n     * */\n    message: string;\n    counter: number;\n  };\n}\n\nRegisterKind(UnicornKind, {\n  group: "pepr.dev",\n  version: "v1",\n  kind: "Unicorn",\n});\n\nWhen(UnicornKind)\n  .IsCreated()\n  .WithName("example-2")\n  .Mutate(request => {\n    request.Merge({\n      spec: {\n        message: "Hello Pepr with type data!",\n        counter: Math.random(),\n      },\n    });\n  });\n\n/**\n * A callback function that is called once the Pepr Store is fully loaded.\n */\nStore.onReady(data => {\n  Log.info(data, "Pepr Store Ready");\n});\n';
-var packageJSON = { name: "pepr", description: "Kubernetes application engine", author: "Defense Unicorns", homepage: "https://github.com/defenseunicorns/pepr", license: "Apache-2.0", bin: "dist/cli.js", repository: "defenseunicorns/pepr", engines: { node: ">=18.0.0" }, files: ["/dist", "/src", "!src/**/*.test.ts", "!dist/**/*.test.d.ts*"], version: "0.38.3", main: "dist/lib.js", types: "dist/lib.d.ts", scripts: { ci: "npm ci", "gen-data-json": "node hack/build-template-data.js", prebuild: "rm -fr dist/* && npm run gen-data-json", version: "node scripts/set-version.js", build: "tsc && node build.mjs && npm pack", "build:image": "npm run build && docker buildx build --output type=docker --tag pepr:dev .", test: "npm run test:unit && npm run test:journey", "test:unit": "npm run gen-data-json && jest src --coverage --detectOpenHandles --coverageDirectory=./coverage", "test:journey": "npm run test:journey:k3d && npm run build && npm run test:journey:image && npm run test:journey:run", "test:journey:prep": "if [ ! -d ./pepr-upgrade-test ]; then git clone https://github.com/defenseunicorns/pepr-upgrade-test.git ; fi", "test:journey-wasm": "npm run test:journey:k3d && npm run build && npm run test:journey:image && npm run test:journey:run-wasm", "test:journey:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0' --wait && kubectl rollout status deployment -n kube-system", "test:journey:image": "docker buildx build --output type=docker --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev", "test:journey:run": "jest --detectOpenHandles journey/entrypoint.test.ts && npm run test:journey:prep && npm run test:journey:upgrade", "test:journey:run-wasm": "jest --detectOpenHandles journey/entrypoint-wasm.test.ts", "test:journey:upgrade": "npm run test:journey:k3d && npm run test:journey:image && jest --detectOpenHandles journey/pepr-upgrade.test.ts", "format:check": "eslint src && prettier src --check", "format:fix": "eslint src --fix && prettier src --write", prepare: `if [ "$NODE_ENV" != 'production' ]; then husky; fi` }, dependencies: { "@types/ramda": "0.30.2", express: "4.21.1", "fast-json-patch": "3.1.1", "json-pointer": "^0.6.2", "kubernetes-fluent-client": "3.2.1", pino: "9.5.0", "pino-pretty": "11.3.0", "prom-client": "15.1.3", ramda: "0.30.1" }, devDependencies: { "@commitlint/cli": "19.5.0", "@commitlint/config-conventional": "19.5.0", "@fast-check/jest": "^2.0.1", "@jest/globals": "29.7.0", "@types/eslint": "9.6.1", "@types/express": "5.0.0", "@types/json-pointer": "^1.0.34", "@types/node": "22.x.x", "@types/node-forge": "1.3.11", "@types/uuid": "10.0.0", "fast-check": "^3.19.0", jest: "29.7.0", "js-yaml": "^4.1.0", nock: "^13.5.4", "ts-jest": "29.2.5", husky: "^9.1.6" }, peerDependencies: { "@typescript-eslint/eslint-plugin": "7.18.0", "@typescript-eslint/parser": "7.18.0", commander: "12.1.0", esbuild: "0.23.0", eslint: "8.57.0", "node-forge": "1.3.1", prettier: "3.3.3", "@types/prompts": "2.4.9", prompts: "2.4.2", typescript: "5.3.3", uuid: "10.0.0" } };
+var packageJSON = { name: "pepr", description: "Kubernetes application engine", author: "Defense Unicorns", homepage: "https://github.com/defenseunicorns/pepr", license: "Apache-2.0", bin: "dist/cli.js", repository: "defenseunicorns/pepr", engines: { node: ">=18.0.0" }, files: ["/dist", "/src", "!src/**/*.test.ts", "!dist/**/*.test.d.ts*"], version: "0.39.0", main: "dist/lib.js", types: "dist/lib.d.ts", scripts: { ci: "npm ci", "gen-data-json": "node hack/build-template-data.js", prebuild: "rm -fr dist/* && npm run gen-data-json", version: "node scripts/set-version.js", build: "tsc && node build.mjs && npm pack", "build:image": "npm run build && docker buildx build --output type=docker --tag pepr:dev .", test: "npm run test:unit && npm run test:journey", "test:unit": "npm run gen-data-json && jest src --coverage --detectOpenHandles --coverageDirectory=./coverage --testPathIgnorePatterns='cosign.e2e.test.ts'", "test:journey": "npm run test:journey:k3d && npm run build && npm run test:journey:image && npm run test:journey:run", "test:journey:prep": "if [ ! -d ./pepr-upgrade-test ]; then git clone https://github.com/defenseunicorns/pepr-upgrade-test.git ; fi", "test:journey-wasm": "npm run test:journey:k3d && npm run build && npm run test:journey:image && npm run test:journey:run-wasm", "test:journey:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0' --wait && kubectl rollout status deployment -n kube-system", "test:journey:image": "docker buildx build --output type=docker --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev", "test:journey:run": "jest --detectOpenHandles journey/entrypoint.test.ts && npm run test:journey:prep && npm run test:journey:upgrade", "test:journey:run-wasm": "jest --detectOpenHandles journey/entrypoint-wasm.test.ts", "test:journey:upgrade": "npm run test:journey:k3d && npm run test:journey:image && jest --detectOpenHandles journey/pepr-upgrade.test.ts", "format:check": "eslint src && prettier src --check", "format:fix": "eslint src --fix && prettier src --write", prepare: `if [ "$NODE_ENV" != 'production' ]; then husky; fi` }, dependencies: { "@types/ramda": "0.30.2", express: "4.21.1", "fast-json-patch": "3.1.1", "follow-redirects": "1.15.9", "http-status-codes": "^2.3.0", "json-pointer": "^0.6.2", "kubernetes-fluent-client": "3.3.0", pino: "9.5.0", "pino-pretty": "11.3.0", "prom-client": "15.1.3", ramda: "0.30.1", sigstore: "3.0.0" }, devDependencies: { "@commitlint/cli": "19.5.0", "@commitlint/config-conventional": "19.5.0", "@fast-check/jest": "^2.0.1", "@jest/globals": "29.7.0", "@types/eslint": "9.6.1", "@types/express": "5.0.0", "@types/follow-redirects": "1.14.4", "@types/json-pointer": "^1.0.34", "@types/node": "22.x.x", "@types/node-forge": "1.3.11", "@types/uuid": "10.0.0", "fast-check": "^3.19.0", husky: "^9.1.6", jest: "29.7.0", "js-yaml": "^4.1.0", nock: "^13.5.4", "ts-jest": "29.2.5" }, peerDependencies: { "@types/prompts": "2.4.9", "@typescript-eslint/eslint-plugin": "7.18.0", "@typescript-eslint/parser": "7.18.0", commander: "12.1.0", esbuild: "0.23.0", eslint: "8.57.0", "node-forge": "1.3.1", prettier: "3.3.3", prompts: "2.4.2", typescript: "5.3.3", uuid: "10.0.0" } };
 
 // src/templates/pepr.code-snippets.json
 var pepr_code_snippets_default = {
@@ -2381,11 +2414,9 @@ async function peprFormat(validateOnly) {
         const content = await import_fs7.promises.readFile(filePath, "utf8");
         const cfg = await (0, import_prettier.resolveConfig)(filePath);
         const formatted = await (0, import_prettier.format)(content, { filepath: filePath, ...cfg });
-        if (validateOnly) {
-          if (formatted !== content) {
-            hasFailure = true;
-            console.error(`File ${filePath} is not formatted correctly`);
-          }
+        if (validateOnly && formatted !== content) {
+          hasFailure = true;
+          console.error(`File ${filePath} is not formatted correctly`);
         } else {
           await import_fs7.promises.writeFile(filePath, formatted);
         }
@@ -2400,6 +2431,19 @@ async function peprFormat(validateOnly) {
 
 // src/cli/build.ts
 var import_commander = require("commander");
+
+// src/cli/build.helpers.ts
+function determineRbacMode(opts, cfg) {
+  if (opts.rbacMode) {
+    return opts.rbacMode;
+  }
+  if (cfg.pepr.rbacMode && cfg.pepr.rbacMode !== "scoped") {
+    return "admin";
+  }
+  return cfg.pepr.rbacMode || "admin";
+}
+
+// src/cli/build.ts
 var peprTS2 = "pepr.ts";
 var outputDir = "dist";
 function build_default(program2) {
@@ -2433,7 +2477,9 @@ function build_default(program2) {
       "Zarf package type: manifest, chart (default: manifest)"
     ).choices(["manifest", "chart"]).default("manifest")
   ).addOption(
-    new import_commander.Option("--rbac-mode [admin|scoped]", "Rbac Mode: admin, scoped (default: admin)").choices(["admin", "scoped"]).default("admin")
+    new import_commander.Option("--rbac-mode [admin|scoped]", "Rbac Mode: admin, scoped (default: admin)").choices(
+      ["admin", "scoped"]
+    )
   ).action(async (opts) => {
     if (opts.outputDir) {
       outputDir = opts.outputDir;
@@ -2442,83 +2488,90 @@ function build_default(program2) {
         process.exit(1);
       });
     }
-    const { cfg, path, uuid } = await buildModule(void 0, opts.entryPoint, opts.embed);
-    const { includedFiles } = cfg.pepr;
-    let image = "";
-    if (opts.customImage) {
-      if (opts.registry) {
-        console.error(`Custom Image and registry cannot be used together.`);
-        process.exit(1);
+    const buildModuleResult = await buildModule(void 0, opts.entryPoint, opts.embed);
+    if (buildModuleResult?.cfg && buildModuleResult.path && buildModuleResult.uuid) {
+      const { cfg, path, uuid } = buildModuleResult;
+      const { includedFiles } = cfg.pepr;
+      let image = "";
+      if (opts.customImage) {
+        if (opts.registry) {
+          console.error(`Custom Image and registry cannot be used together.`);
+          process.exit(1);
+        }
+        image = opts.customImage;
       }
-      image = opts.customImage;
-    }
-    if (opts.timeout !== void 0) {
-      cfg.pepr.webhookTimeout = opts.timeout;
-    }
-    if (opts.registryInfo !== void 0) {
-      console.info(`Including ${includedFiles.length} files in controller image.`);
-      image = `${opts.registryInfo}/custom-pepr-controller:${cfg.pepr.peprVersion}`;
-      if (includedFiles.length > 0) {
-        await createDockerfile(cfg.pepr.peprVersion, cfg.description, includedFiles);
-        (0, import_child_process2.execSync)(`docker build --tag ${image} -f Dockerfile.controller .`, { stdio: "inherit" });
-        (0, import_child_process2.execSync)(`docker push ${image}`, { stdio: "inherit" });
+      if (opts.timeout !== void 0) {
+        cfg.pepr.webhookTimeout = opts.timeout;
       }
-    }
-    if (!opts.embed) {
-      console.info(`\u2705 Module built successfully at ${path}`);
-      return;
-    }
-    if (opts.version) {
-      cfg.pepr.peprVersion = opts.version;
-    }
-    const assets = new Assets(
-      {
-        ...cfg.pepr,
-        appVersion: cfg.version,
-        description: cfg.description
-      },
-      path
-    );
-    if (opts?.registry === "Iron Bank") {
-      console.info(
-        `
+      if (opts.registryInfo !== void 0) {
+        console.info(`Including ${includedFiles.length} files in controller image.`);
+        image = `${opts.registryInfo}/custom-pepr-controller:${cfg.pepr.peprVersion}`;
+        if (includedFiles.length > 0) {
+          await createDockerfile(cfg.pepr.peprVersion, cfg.description, includedFiles);
+          (0, import_child_process2.execSync)(`docker build --tag ${image} -f Dockerfile.controller .`, {
+            stdio: "inherit"
+          });
+          (0, import_child_process2.execSync)(`docker push ${image}`, { stdio: "inherit" });
+        }
+      }
+      if (!opts.embed) {
+        console.info(`\u2705 Module built successfully at ${path}`);
+        return;
+      }
+      if (opts.version) {
+        cfg.pepr.peprVersion = opts.version;
+      }
+      const assets = new Assets(
+        {
+          ...cfg.pepr,
+          appVersion: cfg.version,
+          description: cfg.description,
+          // Can override the rbacMode with the CLI option
+          rbacMode: determineRbacMode(opts, cfg)
+        },
+        path
+      );
+      if (opts?.registry === "Iron Bank") {
+        console.info(
+          `
 	This command assumes the latest release. Pepr's Iron Bank image release cycle is dictated by renovate and is typically released a few days after the GitHub release.
 	As an alternative you may consider custom --custom-image to target a specific image and version.`
-      );
-      image = `registry1.dso.mil/ironbank/opensource/defenseunicorns/pepr/controller:v${cfg.pepr.peprVersion}`;
-    }
-    if (image !== "") {
-      assets.image = image;
-    }
-    if (opts.withPullSecret) {
-      if (sanitizeResourceName(opts.withPullSecret) !== opts.withPullSecret) {
-        console.error(
-          "Invalid imagePullSecret. Please provide a valid name as defined in RFC 1123."
         );
+        image = `registry1.dso.mil/ironbank/opensource/defenseunicorns/pepr/controller:v${cfg.pepr.peprVersion}`;
+      }
+      if (image !== "") {
+        assets.image = image;
+      }
+      if (opts.withPullSecret) {
+        if (sanitizeResourceName(opts.withPullSecret) !== opts.withPullSecret) {
+          console.error(
+            "Invalid imagePullSecret. Please provide a valid name as defined in RFC 1123."
+          );
+          process.exit(1);
+        }
+      }
+      const yamlFile = `pepr-module-${uuid}.yaml`;
+      const chartPath = `${uuid}-chart`;
+      const yamlPath = (0, import_path2.resolve)(outputDir, yamlFile);
+      const yaml = await assets.allYaml(opts.withPullSecret);
+      try {
+        validateCapabilityNames(assets.capabilities);
+      } catch (e) {
+        console.error(`Error loading capability:`, e);
         process.exit(1);
       }
+      const zarfPath = (0, import_path2.resolve)(outputDir, "zarf.yaml");
+      let zarf = "";
+      if (opts.zarf === "chart") {
+        zarf = assets.zarfYamlChart(chartPath);
+      } else {
+        zarf = assets.zarfYaml(yamlFile);
+      }
+      await import_fs8.promises.writeFile(yamlPath, yaml);
+      await import_fs8.promises.writeFile(zarfPath, zarf);
+      await assets.generateHelmChart(outputDir);
+      console.info(`\u2705 K8s resource for the module saved to ${yamlPath}`);
     }
-    const yamlFile = `pepr-module-${uuid}.yaml`;
-    const chartPath = `${uuid}-chart`;
-    const yamlPath = (0, import_path2.resolve)(outputDir, yamlFile);
-    const yaml = await assets.allYaml(opts.rbacMode, opts.withPullSecret);
-    try {
-      validateCapabilityNames(assets.capabilities);
-    } catch (e) {
-      console.error(`Error loading capability:`, e);
-      process.exit(1);
-    }
-    const zarfPath = (0, import_path2.resolve)(outputDir, "zarf.yaml");
-    let zarf = "";
-    if (opts.zarf === "chart") {
-      zarf = assets.zarfYamlChart(chartPath);
-    } else {
-      zarf = assets.zarfYaml(yamlFile);
-    }
-    await import_fs8.promises.writeFile(yamlPath, yaml);
-    await import_fs8.promises.writeFile(zarfPath, zarf);
-    await assets.generateHelmChart(outputDir);
-    console.info(`\u2705 K8s resource for the module saved to ${yamlPath}`);
   });
 }
 var externalLibs = Object.keys(dependencies);
@@ -2615,34 +2668,32 @@ async function buildModule(reloader, entryPoint = peprTS2, embed = true) {
     return { ctx, path, cfg, uuid };
   } catch (e) {
     console.error(`Error building module:`, e);
-    if (e.stdout) {
-      const out = e.stdout.toString();
-      const err = e.stderr.toString();
-      console.log(out);
-      console.error(err);
-      if (out.includes("Types have separate declarations of a private property '_name'.")) {
-        const pgkErrMatch = /error TS2322: .*? 'import\("\/.*?\/node_modules\/(.*?)\/node_modules/g;
-        out.matchAll(pgkErrMatch);
-        const conflicts = [...out.matchAll(pgkErrMatch)];
-        if (conflicts.length < 1) {
-          console.info(
-            `
+    if (!e.stdout) process.exit(1);
+    const out = e.stdout.toString();
+    const err = e.stderr.toString();
+    console.log(out);
+    console.error(err);
+    if (out.includes("Types have separate declarations of a private property '_name'.")) {
+      const pgkErrMatch = /error TS2322: .*? 'import\("\/.*?\/node_modules\/(.*?)\/node_modules/g;
+      out.matchAll(pgkErrMatch);
+      const conflicts = [...out.matchAll(pgkErrMatch)];
+      if (conflicts.length < 1) {
+        console.info(
+          `
 	One or more imported Pepr Capabilities seem to be using an incompatible version of Pepr.
 	Try updating your Pepr Capabilities to their latest versions.`,
-            "Version Conflict"
-          );
-        }
-        conflicts.forEach((match) => {
-          console.info(
-            `
+          "Version Conflict"
+        );
+      }
+      conflicts.forEach((match) => {
+        console.info(
+          `
 	Package '${match[1]}' seems to be incompatible with your current version of Pepr.
 	Try updating to the latest version.`,
-            "Version Conflict"
-          );
-        });
-      }
+          "Version Conflict"
+        );
+      });
     }
-    process.exit(1);
   }
 }
 
@@ -2685,26 +2736,29 @@ function deploy_default(program2) {
         process.exit(0);
       }
     }
-    const { cfg, path } = await buildModule();
-    const webhook = new Assets(
-      {
-        ...cfg.pepr,
-        description: cfg.description
-      },
-      path
-    );
-    if (opts.image) {
-      webhook.image = opts.image;
-    }
-    const timeout = cfg.pepr.webhookTimeout ? cfg.pepr.webhookTimeout : 10;
-    try {
-      await webhook.deploy(opts.force, timeout);
-      validateCapabilityNames(webhook.capabilities);
-      await namespaceDeploymentsReady();
-      console.info(`\u2705 Module deployed successfully`);
-    } catch (e) {
-      console.error(`Error deploying module:`, e);
-      process.exit(1);
+    const buildModuleResult = await buildModule();
+    if (buildModuleResult?.cfg && buildModuleResult?.path) {
+      const { cfg, path } = buildModuleResult;
+      const webhook = new Assets(
+        {
+          ...cfg.pepr,
+          description: cfg.description
+        },
+        path
+      );
+      if (opts.image) {
+        webhook.image = opts.image;
+      }
+      const timeout = cfg.pepr.webhookTimeout ? cfg.pepr.webhookTimeout : 10;
+      try {
+        await webhook.deploy(opts.force, timeout);
+        validateCapabilityNames(webhook.capabilities);
+        await namespaceDeploymentsReady();
+        console.info(`\u2705 Module deployed successfully`);
+      } catch (e) {
+        console.error(`Error deploying module:`, e);
+        process.exit(1);
+      }
     }
   });
 }
@@ -2767,8 +2821,8 @@ function dev_default(program2) {
           await Promise.all([
             (0, import_kubernetes_fluent_client5.K8s)(import_kubernetes_fluent_client5.kind.MutatingWebhookConfiguration).Delete(name2),
             (0, import_kubernetes_fluent_client5.K8s)(import_kubernetes_fluent_client5.kind.ValidatingWebhookConfiguration).Delete(name2),
-            (0, import_kubernetes_fluent_client5.K8s)(PeprStore).InNamespace("pepr-system").Delete(scheduleStore),
-            (0, import_kubernetes_fluent_client5.K8s)(PeprStore).InNamespace("pepr-system").Delete(store)
+            (0, import_kubernetes_fluent_client5.K8s)(Store).InNamespace("pepr-system").Delete(scheduleStore),
+            (0, import_kubernetes_fluent_client5.K8s)(Store).InNamespace("pepr-system").Delete(store)
           ]);
         });
         process.on("SIGINT", () => {
@@ -2823,37 +2877,33 @@ function monitor_default(program2) {
       const respMsg = `"msg":"Check response"`;
       const lines = await chunk.toString().split("\n");
       for (const line of lines) {
-        if (line.includes(respMsg)) {
-          try {
-            const payload = JSON.parse(line.trim());
-            const isMutate = payload.res.patchType || payload.res.warnings;
-            const name2 = `${payload.namespace}${payload.name}`;
-            const uid = payload.res.uid;
-            if (isMutate) {
-              const plainPatch = payload.res?.patch !== void 0 && payload.res?.patch !== null ? atob(payload.res.patch) : "";
-              const patch = plainPatch !== "" && JSON.stringify(JSON.parse(plainPatch), null, 2);
-              const patchType = payload.res.patchType || payload.res.warnings || "";
-              const allowOrDeny = payload.res.allowed ? "\u{1F500}" : "\u{1F6AB}";
-              console.log(`
+        if (!line.includes(respMsg)) continue;
+        try {
+          const payload = JSON.parse(line.trim());
+          const isMutate = payload.res.patchType || payload.res.warnings;
+          const name2 = `${payload.namespace}${payload.name}`;
+          const uid = payload.res.uid;
+          if (isMutate) {
+            const plainPatch = payload.res?.patch !== void 0 && payload.res?.patch !== null ? atob(payload.res.patch) : "";
+            const patch = plainPatch !== "" && JSON.stringify(JSON.parse(plainPatch), null, 2);
+            const patchType = payload.res.patchType || payload.res.warnings || "";
+            const allowOrDeny = payload.res.allowed ? "\u{1F500}" : "\u{1F6AB}";
+            console.log(`
 ${allowOrDeny}  MUTATE     ${name2} (${uid})`);
-              if (patchType.length > 0) {
-                console.log(`
+            patchType.length > 0 && console.log(`
 \x1B[1;34m${patch}\x1B[0m`);
-              }
-            } else {
-              const failures = Array.isArray(payload.res) ? payload.res : [payload.res];
-              const filteredFailures = failures.filter((r) => !r.allowed).map((r) => r.status.message);
-              if (filteredFailures.length > 0) {
-                console.log(`
-\u274C  VALIDATE   ${name2} (${uid})`);
-                console.log(`\x1B[1;31m${filteredFailures}\x1B[0m`);
-              } else {
-                console.log(`
-\u2705  VALIDATE   ${name2} (${uid})`);
-              }
-            }
-          } catch {
+          } else {
+            const failures = Array.isArray(payload.res) ? payload.res : [payload.res];
+            const filteredFailures = failures.filter((r) => !r.allowed).map((r) => r.status.message);
+            console.log(
+              `
+${filteredFailures.length > 0 ? "\u274C" : "\u2705"}  VALIDATE   ${name2} (${uid})`
+            );
+            console.log(
+              filteredFailures.length > 0 ? `\x1B[1;31m${filteredFailures}\x1B[0m` : ""
+            );
           }
+        } catch {
         }
       }
     });
@@ -3029,19 +3079,7 @@ function init_default(program2) {
         await write((0, import_path3.resolve)(dirName, "capabilities", samplesYaml.path), samplesYaml.data);
         await write((0, import_path3.resolve)(dirName, "capabilities", helloPepr.path), helloPepr.data);
         if (!opts.skipPostInit) {
-          process.chdir(dirName);
-          (0, import_child_process4.execSync)("npm install", {
-            stdio: "inherit"
-          });
-          (0, import_child_process4.execSync)("git init --initial-branch=main", {
-            stdio: "inherit"
-          });
-          try {
-            (0, import_child_process4.execSync)("code .", {
-              stdio: "inherit"
-            });
-          } catch (e) {
-          }
+          doPostInitActions(dirName);
         }
         console.log(`New Pepr module created at ${dirName}`);
         console.log(`Open VSCode or your editor of choice in ${dirName} to get started!`);
@@ -3054,6 +3092,21 @@ function init_default(program2) {
     }
   });
 }
+var doPostInitActions = (dirName) => {
+  process.chdir(dirName);
+  (0, import_child_process4.execSync)("npm install", {
+    stdio: "inherit"
+  });
+  (0, import_child_process4.execSync)("git init --initial-branch=main", {
+    stdio: "inherit"
+  });
+  try {
+    (0, import_child_process4.execSync)("code .", {
+      stdio: "inherit"
+    });
+  } catch (e) {
+  }
+};
 
 // src/cli/uuid.ts
 var import_kubernetes_fluent_client7 = require("kubernetes-fluent-client");