pepr 0.42.0 → 0.42.2

package/dist/cli.js

@@ -86,26 +86,10 @@ var banner = `\x1B[107;40m\x1B[38;5;m \x1B[38;5;m \x1B[38;5;m \x1B[38;5;m \x1B[3
 `;
 
 // src/cli/build.ts
-var import_child_process2 = require("child_process");
-var import_esbuild = require("esbuild");
-var import_fs8 = require("fs");
-var import_path2 = require("path");
-
-// src/lib/included-files.ts
-var import_fs = require("fs");
-async function createDockerfile(version3, description, includedFiles) {
-  const file = `
-    # Use an official Node.js runtime as the base image
-    FROM ghcr.io/defenseunicorns/pepr/controller:v${version3}
-  
-    LABEL description="${description}"
-    
-    # Add the included files to the image
-    ${includedFiles.map((f) => `ADD ${f} ${f}`).join("\n")}
-  
-    `;
-  await import_fs.promises.writeFile("Dockerfile.controller", file, { encoding: "utf-8" });
-}
+var import_child_process3 = require("child_process");
+var import_esbuild2 = require("esbuild");
+var import_fs9 = require("fs");
+var import_path3 = require("path");
 
 // src/lib/assets/index.ts
 var import_crypto3 = __toESM(require("crypto"));
@@ -170,7 +154,7 @@ function genCert(key, name2, issuer) {
 
 // src/lib/assets/deploy.ts
 var import_crypto = __toESM(require("crypto"));
-var import_fs2 = require("fs");
+var import_fs = require("fs");
 var import_kubernetes_fluent_client3 = require("kubernetes-fluent-client");
 
 // src/lib/telemetry/logger.ts
@@ -283,200 +267,6 @@ function sanitizeResourceName(name2) {
   return name2.toLowerCase().replace(/[^a-z0-9]+/g, "-").slice(0, 250).replace(/^[^a-z]+|[^a-z]+$/g, "");
 }
 
-// src/lib/filter/adjudicators/adjudicators.ts
-var import_ramda = require("ramda");
-var declaredOperation = (0, import_ramda.pipe)(
-  (request) => request?.operation,
-  (0, import_ramda.defaultTo)("")
-);
-var declaredGroup = (0, import_ramda.pipe)(
-  (request) => request?.kind?.group,
-  (0, import_ramda.defaultTo)("")
-);
-var declaredVersion = (0, import_ramda.pipe)(
-  (request) => request?.kind?.version,
-  (0, import_ramda.defaultTo)("")
-);
-var declaredKind = (0, import_ramda.pipe)(
-  (request) => request?.kind?.kind,
-  (0, import_ramda.defaultTo)("")
-);
-var declaredUid = (0, import_ramda.pipe)((request) => request?.uid, (0, import_ramda.defaultTo)(""));
-var carriesDeletionTimestamp = (0, import_ramda.pipe)(
-  (kubernetesObject) => !!kubernetesObject.metadata?.deletionTimestamp,
-  (0, import_ramda.defaultTo)(false)
-);
-var missingDeletionTimestamp = (0, import_ramda.complement)(carriesDeletionTimestamp);
-var carriedKind = (0, import_ramda.pipe)(
-  (kubernetesObject) => kubernetesObject?.kind,
-  (0, import_ramda.defaultTo)("not set")
-);
-var carriedVersion = (0, import_ramda.pipe)(
-  (kubernetesObject) => kubernetesObject?.metadata?.resourceVersion,
-  (0, import_ramda.defaultTo)("not set")
-);
-var carriedName = (0, import_ramda.pipe)(
-  (kubernetesObject) => kubernetesObject?.metadata?.name,
-  (0, import_ramda.defaultTo)("")
-);
-var carriesName = (0, import_ramda.pipe)(carriedName, (0, import_ramda.equals)(""), import_ramda.not);
-var missingName = (0, import_ramda.complement)(carriesName);
-var carriedNamespace = (0, import_ramda.pipe)(
-  (kubernetesObject) => kubernetesObject?.metadata?.namespace,
-  (0, import_ramda.defaultTo)("")
-);
-var carriesNamespace = (0, import_ramda.pipe)(carriedNamespace, (0, import_ramda.equals)(""), import_ramda.not);
-var carriedAnnotations = (0, import_ramda.pipe)(
-  (kubernetesObject) => kubernetesObject?.metadata?.annotations,
-  (0, import_ramda.defaultTo)({})
-);
-var carriesAnnotations = (0, import_ramda.pipe)(carriedAnnotations, (0, import_ramda.equals)({}), import_ramda.not);
-var carriedLabels = (0, import_ramda.pipe)(
-  (kubernetesObject) => kubernetesObject?.metadata?.labels,
-  (0, import_ramda.defaultTo)({})
-);
-var carriesLabels = (0, import_ramda.pipe)(carriedLabels, (0, import_ramda.equals)({}), import_ramda.not);
-var definesDeletionTimestamp = (0, import_ramda.pipe)(
-  (binding) => binding?.filters?.deletionTimestamp ?? false,
-  (0, import_ramda.defaultTo)(false)
-);
-var ignoresDeletionTimestamp = (0, import_ramda.complement)(definesDeletionTimestamp);
-var definedName = (0, import_ramda.pipe)((binding) => {
-  return binding.filters.name;
-}, (0, import_ramda.defaultTo)(""));
-var definesName = (0, import_ramda.pipe)(definedName, (0, import_ramda.equals)(""), import_ramda.not);
-var ignoresName = (0, import_ramda.complement)(definesName);
-var definedNameRegex = (0, import_ramda.pipe)(
-  (binding) => binding.filters?.regexName,
-  (0, import_ramda.defaultTo)("")
-);
-var definesNameRegex = (0, import_ramda.pipe)(definedNameRegex, (0, import_ramda.equals)(""), import_ramda.not);
-var definedNamespaces = (0, import_ramda.pipe)((binding) => binding?.filters?.namespaces, (0, import_ramda.defaultTo)([]));
-var definesNamespaces = (0, import_ramda.pipe)(definedNamespaces, (0, import_ramda.equals)([]), import_ramda.not);
-var definedNamespaceRegexes = (0, import_ramda.pipe)((binding) => binding?.filters?.regexNamespaces, (0, import_ramda.defaultTo)([]));
-var definesNamespaceRegexes = (0, import_ramda.pipe)(definedNamespaceRegexes, (0, import_ramda.equals)([]), import_ramda.not);
-var definedAnnotations = (0, import_ramda.pipe)((binding) => binding?.filters?.annotations, (0, import_ramda.defaultTo)({}));
-var definesAnnotations = (0, import_ramda.pipe)(definedAnnotations, (0, import_ramda.equals)({}), import_ramda.not);
-var definedLabels = (0, import_ramda.pipe)((binding) => binding?.filters?.labels, (0, import_ramda.defaultTo)({}));
-var definesLabels = (0, import_ramda.pipe)(definedLabels, (0, import_ramda.equals)({}), import_ramda.not);
-var definedEvent = (binding) => {
-  return binding.event;
-};
-var definesDelete = (0, import_ramda.pipe)(definedEvent, (0, import_ramda.equals)("DELETE" /* DELETE */));
-var definedGroup = (0, import_ramda.pipe)((binding) => binding?.kind?.group, (0, import_ramda.defaultTo)(""));
-var definesGroup = (0, import_ramda.pipe)(definedGroup, (0, import_ramda.equals)(""), import_ramda.not);
-var definedVersion = (0, import_ramda.pipe)(
-  (binding) => binding?.kind?.version,
-  (0, import_ramda.defaultTo)("")
-);
-var definesVersion = (0, import_ramda.pipe)(definedVersion, (0, import_ramda.equals)(""), import_ramda.not);
-var definedKind = (0, import_ramda.pipe)((binding) => binding?.kind?.kind, (0, import_ramda.defaultTo)(""));
-var definesKind = (0, import_ramda.pipe)(definedKind, (0, import_ramda.equals)(""), import_ramda.not);
-var definedCallback = (binding) => {
-  return binding.isFinalize ? binding.finalizeCallback : binding.isWatch ? binding.watchCallback : binding.isMutate ? binding.mutateCallback : binding.isValidate ? binding.validateCallback : null;
-};
-var definedCallbackName = (0, import_ramda.pipe)(definedCallback, (0, import_ramda.defaultTo)({ name: "" }), (callback) => callback.name);
-var mismatchedDeletionTimestamp = (0, import_ramda.allPass)([
-  (0, import_ramda.pipe)((0, import_ramda.nthArg)(0), definesDeletionTimestamp),
-  (0, import_ramda.pipe)((0, import_ramda.nthArg)(1), missingDeletionTimestamp)
-]);
-var mismatchedName = (0, import_ramda.allPass)([
-  (0, import_ramda.pipe)((0, import_ramda.nthArg)(0), definesName),
-  (0, import_ramda.pipe)((binding, kubernetesObject) => definedName(binding) !== carriedName(kubernetesObject))
-]);
-var mismatchedNameRegex = (0, import_ramda.allPass)([
-  (0, import_ramda.pipe)((0, import_ramda.nthArg)(0), definesNameRegex),
-  (0, import_ramda.pipe)((binding, kubernetesObject) => new RegExp(definedNameRegex(binding)).test(carriedName(kubernetesObject)), import_ramda.not)
-]);
-var bindsToKind = (0, import_ramda.curry)(
-  (0, import_ramda.allPass)([(0, import_ramda.pipe)((0, import_ramda.nthArg)(0), definedKind, (0, import_ramda.equals)(""), import_ramda.not), (0, import_ramda.pipe)((binding, kind8) => definedKind(binding) === kind8)])
-);
-var bindsToNamespace = (0, import_ramda.curry)((0, import_ramda.pipe)(bindsToKind(import_ramda.__, "Namespace")));
-var misboundNamespace = (0, import_ramda.allPass)([bindsToNamespace, definesNamespaces]);
-var mismatchedNamespace = (0, import_ramda.allPass)([
-  (0, import_ramda.pipe)((0, import_ramda.nthArg)(0), definesNamespaces),
-  (0, import_ramda.pipe)((binding, kubernetesObject) => definedNamespaces(binding).includes(carriedNamespace(kubernetesObject)), import_ramda.not)
-]);
-var mismatchedNamespaceRegex = (0, import_ramda.allPass)([
-  (0, import_ramda.pipe)((0, import_ramda.nthArg)(0), definesNamespaceRegexes),
-  (0, import_ramda.pipe)(
-    (binding, kubernetesObject) => (0, import_ramda.pipe)(
-      (0, import_ramda.any)((regEx) => new RegExp(regEx).test(carriedNamespace(kubernetesObject))),
-      import_ramda.not
-    )(definedNamespaceRegexes(binding))
-  )
-]);
-var metasMismatch = (0, import_ramda.pipe)(
-  (defined, carried) => {
-    const result = { defined, carried, unalike: {} };
-    result.unalike = Object.entries(result.defined).map(([key, value]) => {
-      const keyMissing = !Object.hasOwn(result.carried, key);
-      const noValue = !value;
-      const valMissing = !result.carried[key];
-      const valDiffers = result.carried[key] !== result.defined[key];
-      return keyMissing ? { [key]: value } : noValue ? {} : valMissing ? { [key]: value } : valDiffers ? { [key]: value } : {};
-    }).reduce((acc, cur) => ({ ...acc, ...cur }), {});
-    return result.unalike;
-  },
-  (unalike) => Object.keys(unalike).length > 0
-);
-var mismatchedAnnotations = (0, import_ramda.allPass)([
-  (0, import_ramda.pipe)((0, import_ramda.nthArg)(0), definesAnnotations),
-  (0, import_ramda.pipe)((binding, kubernetesObject) => metasMismatch(definedAnnotations(binding), carriedAnnotations(kubernetesObject)))
-]);
-var mismatchedLabels = (0, import_ramda.allPass)([
-  (0, import_ramda.pipe)((0, import_ramda.nthArg)(0), definesLabels),
-  (0, import_ramda.pipe)((binding, kubernetesObject) => metasMismatch(definedLabels(binding), carriedLabels(kubernetesObject)))
-]);
-var uncarryableNamespace = (0, import_ramda.allPass)([
-  (0, import_ramda.pipe)((0, import_ramda.nthArg)(0), import_ramda.length, (0, import_ramda.gt)(import_ramda.__, 0)),
-  (0, import_ramda.pipe)((0, import_ramda.nthArg)(1), carriesNamespace),
-  (0, import_ramda.pipe)((namespaceSelector, kubernetesObject) => namespaceSelector.includes(carriedNamespace(kubernetesObject)), import_ramda.not)
-]);
-var missingCarriableNamespace = (0, import_ramda.allPass)([
-  (0, import_ramda.pipe)((0, import_ramda.nthArg)(0), import_ramda.length, (0, import_ramda.gt)(import_ramda.__, 0)),
-  (0, import_ramda.pipe)(
-    (namespaceSelector, kubernetesObject) => kubernetesObject.kind === "Namespace" ? !namespaceSelector.includes(kubernetesObject.metadata.name) : !carriesNamespace(kubernetesObject)
-  )
-]);
-var carriesIgnoredNamespace = (0, import_ramda.allPass)([
-  (0, import_ramda.pipe)((0, import_ramda.nthArg)(0), import_ramda.length, (0, import_ramda.gt)(import_ramda.__, 0)),
-  (0, import_ramda.pipe)((0, import_ramda.nthArg)(1), carriesNamespace),
-  (0, import_ramda.pipe)((namespaceSelector, kubernetesObject) => namespaceSelector.includes(carriedNamespace(kubernetesObject)))
-]);
-var unbindableNamespaces = (0, import_ramda.allPass)([
-  (0, import_ramda.pipe)((0, import_ramda.nthArg)(0), import_ramda.length, (0, import_ramda.gt)(import_ramda.__, 0)),
-  (0, import_ramda.pipe)((0, import_ramda.nthArg)(1), definesNamespaces),
-  (0, import_ramda.pipe)(
-    (namespaceSelector, binding) => (0, import_ramda.difference)(definedNamespaces(binding), namespaceSelector),
-    import_ramda.length,
-    (0, import_ramda.equals)(0),
-    import_ramda.not
-  )
-]);
-var misboundDeleteWithDeletionTimestamp = (0, import_ramda.allPass)([definesDelete, definesDeletionTimestamp]);
-var operationMatchesEvent = (0, import_ramda.anyPass)([
-  (0, import_ramda.pipe)((0, import_ramda.nthArg)(1), (0, import_ramda.equals)("*" /* ANY */)),
-  (0, import_ramda.pipe)((operation, event) => operation.valueOf() === event.valueOf()),
-  (0, import_ramda.pipe)((operation, event) => operation ? event.includes(operation) : false)
-]);
-var mismatchedEvent = (0, import_ramda.pipe)(
-  (binding, request) => operationMatchesEvent(declaredOperation(request), definedEvent(binding)),
-  import_ramda.not
-);
-var mismatchedGroup = (0, import_ramda.allPass)([
-  (0, import_ramda.pipe)((0, import_ramda.nthArg)(0), definesGroup),
-  (0, import_ramda.pipe)((binding, request) => definedGroup(binding) !== declaredGroup(request))
-]);
-var mismatchedVersion = (0, import_ramda.allPass)([
-  (0, import_ramda.pipe)((0, import_ramda.nthArg)(0), definesVersion),
-  (0, import_ramda.pipe)((binding, request) => definedVersion(binding) !== declaredVersion(request))
-]);
-var mismatchedKind = (0, import_ramda.allPass)([
-  (0, import_ramda.pipe)((0, import_ramda.nthArg)(0), definesKind),
-  (0, import_ramda.pipe)((binding, request) => definedKind(binding) !== declaredKind(request))
-]);
-
 // src/lib/helpers.ts
 function matchesRegex(pattern, testString) {
   return new RegExp(pattern).test(testString);
@@ -571,7 +361,11 @@ function namespaceComplianceValidator(capability, ignoredNamespaces) {
       `Error in ${name2} capability. A binding violates namespace rules. Please check ignoredNamespaces and capability namespaces: ${namespaceError}`
     );
   }
-  if (bindingRegexNamespaces && bindingRegexNamespaces.length > 0 && capabilityNamespaces && capabilityNamespaces.length > 0) {
+  matchRegexToCapababilityNamespace(bindingRegexNamespaces, capabilityNamespaces);
+  checkRegexNamespaces(bindingRegexNamespaces, ignoredNamespaces);
+}
+var matchRegexToCapababilityNamespace = (bindingRegexNamespaces, capabilityNamespaces) => {
+  if (bindingRegexNamespaces.length > 0 && capabilityNamespaces && capabilityNamespaces.length > 0) {
     for (const regexNamespace of bindingRegexNamespaces) {
       let matches = false;
       matches = regexNamespace !== "" && capabilityNamespaces.some((capabilityNamespace) => matchesRegex(regexNamespace, capabilityNamespace));
@@ -582,7 +376,9 @@ function namespaceComplianceValidator(capability, ignoredNamespaces) {
       }
     }
   }
-  if (bindingRegexNamespaces && bindingRegexNamespaces.length > 0 && ignoredNamespaces && ignoredNamespaces.length > 0) {
+};
+var checkRegexNamespaces = (bindingRegexNamespaces, ignoredNamespaces) => {
+  if (bindingRegexNamespaces.length > 0 && ignoredNamespaces && ignoredNamespaces.length > 0) {
     for (const regexNamespace of bindingRegexNamespaces) {
       const matchedNS = ignoredNamespaces.find((ignoredNS) => matchesRegex(regexNamespace, ignoredNS));
       if (matchedNS) {
@@ -592,7 +388,7 @@ function namespaceComplianceValidator(capability, ignoredNamespaces) {
       }
     }
   }
-}
+};
 function secretOverLimit(str) {
   const encoder = new TextEncoder();
   const encoded = encoder.encode(str);
@@ -600,7 +396,7 @@ function secretOverLimit(str) {
   const oneMiBInBytes = 1048576;
   return sizeInBytes > oneMiBInBytes;
 }
-var parseTimeout = (value, previous) => {
+var parseTimeout = (value) => {
   const parsedValue = parseInt(value, 10);
   const floatValue = parseFloat(value);
   if (isNaN(parsedValue)) {
@@ -633,7 +429,7 @@ function replaceString(str, stringA, stringB) {
 }
 
 // src/lib/assets/pods.ts
-function namespace(namespaceLabels) {
+function getNamespace(namespaceLabels) {
   if (namespaceLabels) {
     return {
       apiVersion: "v1",
@@ -653,7 +449,7 @@ function namespace(namespaceLabels) {
     };
   }
 }
-function watcher(assets, hash, buildTimestamp, imagePullSecret) {
+function getWatcher(assets, hash, buildTimestamp, imagePullSecret) {
   const { name: name2, image, capabilities, config } = assets;
   let hasSchedule = false;
   const app = `${name2}-watcher`;
@@ -797,7 +593,7 @@ function watcher(assets, hash, buildTimestamp, imagePullSecret) {
   }
   return deploy2;
 }
-function deployment(assets, hash, buildTimestamp, imagePullSecret) {
+function getDeployment(assets, hash, buildTimestamp, imagePullSecret) {
   const { name: name2, image, config } = assets;
   const app = name2;
   const deploy2 = {
@@ -938,7 +734,7 @@ function deployment(assets, hash, buildTimestamp, imagePullSecret) {
   }
   return deploy2;
 }
-function moduleSecret(name2, data, hash) {
+function getModuleSecret(name2, data, hash) {
   const compressed = (0, import_zlib.gzipSync)(data);
   const path = `module-${hash}.js.gz`;
   const compressedData = compressed.toString("base64");
@@ -1134,51 +930,40 @@ var peprStoreCRD = {
 };
 
 // src/lib/assets/webhooks.ts
-var import_ramda2 = require("ramda");
+var import_ramda = require("ramda");
 var peprIgnoreLabel = {
   key: "pepr.dev",
   operator: "NotIn",
   values: ["ignore"]
 };
 var peprIgnoreNamespaces = ["kube-system", "pepr-system"];
+var validateRule = (binding, isMutateWebhook) => {
+  const { event, kind: kind8, isMutate, isValidate } = binding;
+  if (isMutateWebhook && !isMutate || !isMutateWebhook && !isValidate) {
+    return void 0;
+  }
+  const operations = event === "CREATEORUPDATE" /* CREATE_OR_UPDATE */ ? ["CREATE" /* CREATE */, "UPDATE" /* UPDATE */] : [event];
+  const resource = kind8.plural || `${kind8.kind.toLowerCase()}s`;
+  const ruleObject = {
+    apiGroups: [kind8.group],
+    apiVersions: [kind8.version || "*"],
+    operations,
+    resources: [resource, ...resource === "pods" ? ["pods/ephemeralcontainers"] : []]
+  };
+  return ruleObject;
+};
 async function generateWebhookRules(assets, isMutateWebhook) {
   const { config, capabilities } = assets;
-  const rules = [];
-  for (const capability of capabilities) {
+  const rules = capabilities.flatMap((capability) => {
     console.info(`Module ${config.uuid} has capability: ${capability.name}`);
-    for (const binding of capability.bindings) {
-      const { event, kind: kind8, isMutate, isValidate } = binding;
-      if (isMutateWebhook && !isMutate) {
-        continue;
-      }
-      if (!isMutateWebhook && !isValidate) {
-        continue;
-      }
-      const operations = [];
-      if (event === "CREATEORUPDATE" /* CREATE_OR_UPDATE */) {
-        operations.push("CREATE" /* CREATE */, "UPDATE" /* UPDATE */);
-      } else {
-        operations.push(event);
-      }
-      const resource = kind8.plural || `${kind8.kind.toLowerCase()}s`;
-      const ruleObject = {
-        apiGroups: [kind8.group],
-        apiVersions: [kind8.version || "*"],
-        operations,
-        resources: [resource]
-      };
-      if (resource === "pods") {
-        ruleObject.resources.push("pods/ephemeralcontainers");
-      }
-      rules.push(ruleObject);
-    }
-  }
-  return (0, import_ramda2.uniqWith)(import_ramda2.equals, rules);
+    return capability.bindings.map((binding) => validateRule(binding, isMutateWebhook)).filter((rule) => !!rule);
+  });
+  return (0, import_ramda.uniqWith)(import_ramda.equals, rules);
 }
 async function webhookConfig(assets, mutateOrValidate, timeoutSeconds = 10) {
   const ignore = [peprIgnoreLabel];
   const { name: name2, tls, config, apiToken, host } = assets;
-  const ignoreNS = (0, import_ramda2.concat)(peprIgnoreNamespaces, config?.alwaysIgnore?.namespaces || []);
+  const ignoreNS = (0, import_ramda.concat)(peprIgnoreNamespaces, config?.alwaysIgnore?.namespaces || []);
   if (ignoreNS) {
     ignore.push({
       key: "kubernetes.io/metadata.name",
@@ -1235,7 +1020,7 @@ async function deployImagePullSecret(imagePullSecret, name2) {
   try {
     await (0, import_kubernetes_fluent_client3.K8s)(import_kubernetes_fluent_client3.kind.Namespace).Get("pepr-system");
   } catch {
-    await (0, import_kubernetes_fluent_client3.K8s)(import_kubernetes_fluent_client3.kind.Namespace).Apply(namespace());
+    await (0, import_kubernetes_fluent_client3.K8s)(import_kubernetes_fluent_client3.kind.Namespace).Apply(getNamespace());
   }
   try {
     await (0, import_kubernetes_fluent_client3.K8s)(import_kubernetes_fluent_client3.kind.Secret).Apply(
@@ -1261,7 +1046,7 @@ async function deploy(assets, force, webhookTimeout) {
   logger_default.info("Establishing connection to Kubernetes");
   const { name: name2, host, path } = assets;
   logger_default.info("Applying pepr-system namespace");
-  await (0, import_kubernetes_fluent_client3.K8s)(import_kubernetes_fluent_client3.kind.Namespace).Apply(namespace(assets.config.customLabels?.namespace));
+  await (0, import_kubernetes_fluent_client3.K8s)(import_kubernetes_fluent_client3.kind.Namespace).Apply(getNamespace(assets.config.customLabels?.namespace));
   const mutateWebhook = await webhookConfig(assets, "mutate", webhookTimeout);
   if (mutateWebhook) {
     logger_default.info("Applying mutating webhook");
@@ -1283,7 +1068,7 @@ async function deploy(assets, force, webhookTimeout) {
   if (host) {
     return;
   }
-  const code = await import_fs2.promises.readFile(path);
+  const code = await import_fs.promises.readFile(path);
   const hash = import_crypto.default.createHash("sha256").update(code).digest("hex");
   if (code.length < 1) {
     throw new Error("No code provided");
@@ -1313,7 +1098,7 @@ async function setupRBAC(name2, capabilities, force, config) {
 async function setupController(assets, code, hash, force) {
   const { name: name2 } = assets;
   logger_default.info("Applying module secret");
-  const mod = moduleSecret(name2, code, hash);
+  const mod = getModuleSecret(name2, code, hash);
   await (0, import_kubernetes_fluent_client3.K8s)(import_kubernetes_fluent_client3.kind.Secret).Apply(mod, { force });
   logger_default.info("Applying controller service");
   const svc = service(name2);
@@ -1325,11 +1110,11 @@ async function setupController(assets, code, hash, force) {
   const apiToken = apiTokenSecret(name2, assets.apiToken);
   await (0, import_kubernetes_fluent_client3.K8s)(import_kubernetes_fluent_client3.kind.Secret).Apply(apiToken, { force });
   logger_default.info("Applying deployment");
-  const dep = deployment(assets, hash, assets.buildTimestamp);
+  const dep = getDeployment(assets, hash, assets.buildTimestamp);
   await (0, import_kubernetes_fluent_client3.K8s)(import_kubernetes_fluent_client3.kind.Deployment).Apply(dep, { force });
 }
 async function setupWatcher(assets, hash, force) {
-  const watchDeployment = watcher(assets, hash, assets.buildTimestamp);
+  const watchDeployment = getWatcher(assets, hash, assets.buildTimestamp);
   if (watchDeployment) {
     logger_default.info("Applying watcher deployment");
     await (0, import_kubernetes_fluent_client3.K8s)(import_kubernetes_fluent_client3.kind.Deployment).Apply(watchDeployment, { force });
@@ -1342,7 +1127,7 @@ async function setupWatcher(assets, hash, force) {
 // src/lib/assets/loader.ts
 var import_child_process = require("child_process");
 function loadCapabilities(path) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     const program2 = (0, import_child_process.fork)(path, {
       env: {
         ...process.env,
@@ -1356,7 +1141,7 @@ function loadCapabilities(path) {
       for (const capability of capabilities) {
         console.info(`Registered Pepr Capability "${capability.name}"`);
       }
-      resolve5(capabilities);
+      resolve6(capabilities);
     });
     program2.on("error", (error) => {
       reject(error);
@@ -1367,7 +1152,7 @@ function loadCapabilities(path) {
 // src/lib/assets/yaml.ts
 var import_client_node = require("@kubernetes/client-node");
 var import_crypto2 = __toESM(require("crypto"));
-var import_fs3 = require("fs");
+var import_fs2 = require("fs");
 async function overridesFile({ hash, name: name2, image, config, apiToken, capabilities }, path) {
   const rbacOverrides = clusterRole(name2, capabilities, config.rbacMode, config.rbac).rules;
   const overrides = {
@@ -1518,7 +1303,7 @@ async function overridesFile({ hash, name: name2, image, config, apiToken, capab
       }
     }
   };
-  await import_fs3.promises.writeFile(path, (0, import_client_node.dumpYaml)(overrides, { noRefs: true, forceQuotes: true }));
+  await import_fs2.promises.writeFile(path, (0, import_client_node.dumpYaml)(overrides, { noRefs: true, forceQuotes: true }));
 }
 function zarfYaml({ name: name2, image, config }, path) {
   const zarfCfg = {
@@ -1575,22 +1360,22 @@ function zarfYamlChart({ name: name2, image, config }, path) {
 }
 async function allYaml(assets, imagePullSecret) {
   const { name: name2, tls, apiToken, path, config } = assets;
-  const code = await import_fs3.promises.readFile(path);
+  const code = await import_fs2.promises.readFile(path);
   assets.hash = import_crypto2.default.createHash("sha256").update(code).digest("hex");
   const mutateWebhook = await webhookConfig(assets, "mutate", assets.config.webhookTimeout);
   const validateWebhook = await webhookConfig(assets, "validate", assets.config.webhookTimeout);
-  const watchDeployment = watcher(assets, assets.hash, assets.buildTimestamp, imagePullSecret);
+  const watchDeployment = getWatcher(assets, assets.hash, assets.buildTimestamp, imagePullSecret);
   const resources = [
-    namespace(assets.config.customLabels?.namespace),
+    getNamespace(assets.config.customLabels?.namespace),
     clusterRole(name2, assets.capabilities, config.rbacMode, config.rbac),
     clusterRoleBinding(name2),
     serviceAccount(name2),
     apiTokenSecret(name2, apiToken),
     tlsSecret(name2, tls),
-    deployment(assets, assets.hash, assets.buildTimestamp, imagePullSecret),
+    getDeployment(assets, assets.hash, assets.buildTimestamp, imagePullSecret),
     service(name2),
     watcherService(name2),
-    moduleSecret(name2, code, assets.hash),
+    getModuleSecret(name2, code, assets.hash),
     storeRole(name2),
     storeRoleBinding(name2)
   ];
@@ -1623,7 +1408,7 @@ function clusterRoleTemplate() {
       {{- end }}
   `;
 }
-function nsTemplate() {
+function namespaceTemplate() {
   return `
     apiVersion: v1
     kind: Namespace
@@ -1860,16 +1645,16 @@ function serviceMonitorTemplate(name2) {
 }
 
 // src/lib/assets/index.ts
-var import_fs5 = require("fs");
+var import_fs4 = require("fs");
 
 // src/lib/filesystemService.ts
-var import_fs4 = require("fs");
+var import_fs3 = require("fs");
 async function createDirectoryIfNotExists(path) {
   try {
-    await import_fs4.promises.access(path);
+    await import_fs3.promises.access(path);
   } catch (error) {
     if (error.code === "ENOENT") {
-      await import_fs4.promises.mkdir(path, { recursive: true });
+      await import_fs3.promises.mkdir(path, { recursive: true });
     } else {
       throw error;
     }
@@ -1972,10 +1757,10 @@ var Assets = class {
       await Promise.all(
         Object.values(helm.dirs).sort((l, r) => l.split("/").length - r.split("/").length).map(async (dir) => await createDirectoryIfNotExists(dir))
       );
-      const code = await import_fs5.promises.readFile(this.path);
+      const code = await import_fs4.promises.readFile(this.path);
       const pairs = [
         [helm.files.chartYaml, () => dedent(chartYaml(this.config.uuid, this.config.description || ""))],
-        [helm.files.namespaceYaml, () => dedent(nsTemplate())],
+        [helm.files.namespaceYaml, () => dedent(namespaceTemplate())],
         [helm.files.watcherServiceYaml, () => toYaml(watcherService(this.name))],
         [helm.files.admissionServiceYaml, () => toYaml(service(this.name))],
         [helm.files.tlsSecretYaml, () => toYaml(tlsSecret(this.name, this.tls))],
@@ -1985,28 +1770,28 @@ var Assets = class {
         [helm.files.clusterRoleYaml, () => dedent(clusterRoleTemplate())],
         [helm.files.clusterRoleBindingYaml, () => toYaml(clusterRoleBinding(this.name))],
         [helm.files.serviceAccountYaml, () => toYaml(serviceAccount(this.name))],
-        [helm.files.moduleSecretYaml, () => toYaml(moduleSecret(this.name, code, this.hash))]
+        [helm.files.moduleSecretYaml, () => toYaml(getModuleSecret(this.name, code, this.hash))]
       ];
-      await Promise.all(pairs.map(async ([file, content]) => await import_fs5.promises.writeFile(file, content())));
+      await Promise.all(pairs.map(async ([file, content]) => await import_fs4.promises.writeFile(file, content())));
       await overridesFile(this, helm.files.valuesYaml);
       const [mutateWebhook, validateWebhook] = await Promise.all([
         webhookConfig(this, "mutate", this.config.webhookTimeout),
         webhookConfig(this, "validate", this.config.webhookTimeout)
       ]);
       if (validateWebhook || mutateWebhook) {
-        await import_fs5.promises.writeFile(helm.files.admissionDeploymentYaml, dedent(admissionDeployTemplate(this.buildTimestamp)));
-        await import_fs5.promises.writeFile(helm.files.admissionServiceMonitorYaml, dedent(serviceMonitorTemplate("admission")));
+        await import_fs4.promises.writeFile(helm.files.admissionDeploymentYaml, dedent(admissionDeployTemplate(this.buildTimestamp)));
+        await import_fs4.promises.writeFile(helm.files.admissionServiceMonitorYaml, dedent(serviceMonitorTemplate("admission")));
       }
       if (mutateWebhook) {
-        await import_fs5.promises.writeFile(helm.files.mutationWebhookYaml, createWebhookYaml(this, mutateWebhook));
+        await import_fs4.promises.writeFile(helm.files.mutationWebhookYaml, createWebhookYaml(this, mutateWebhook));
       }
       if (validateWebhook) {
-        await import_fs5.promises.writeFile(helm.files.validationWebhookYaml, createWebhookYaml(this, validateWebhook));
+        await import_fs4.promises.writeFile(helm.files.validationWebhookYaml, createWebhookYaml(this, validateWebhook));
       }
-      const watchDeployment = watcher(this, this.hash, this.buildTimestamp);
+      const watchDeployment = getWatcher(this, this.hash, this.buildTimestamp);
       if (watchDeployment) {
-        await import_fs5.promises.writeFile(helm.files.watcherDeploymentYaml, dedent(watcherDeployTemplate(this.buildTimestamp)));
-        await import_fs5.promises.writeFile(helm.files.watcherServiceMonitorYaml, dedent(serviceMonitorTemplate("watcher")));
+        await import_fs4.promises.writeFile(helm.files.watcherDeploymentYaml, dedent(watcherDeployTemplate(this.buildTimestamp)));
+        await import_fs4.promises.writeFile(helm.files.watcherServiceMonitorYaml, dedent(serviceMonitorTemplate("watcher")));
       }
     } catch (err) {
       console.error(`Error generating helm chart: ${err.message}`);
@@ -2222,7 +2007,7 @@ var gitIgnore = "# Ignore node_modules and Pepr build artifacts\nnode_modules\nd
 var readmeMd = '# Pepr Module\n\nThis is a Pepr Module. [Pepr](https://github.com/defenseunicorns/pepr) is a type-safe Kubernetes middleware system.\n\nThe `capabilities` directory contains all the capabilities for this module. By default,\na capability is a single typescript file in the format of `capability-name.ts` that is\nimported in the root `pepr.ts` file as `import { HelloPepr } from "./capabilities/hello-pepr";`.\nBecause this is typescript, you can organize this however you choose, e.g. creating a sub-folder\nper-capability or common logic in shared files or folders.\n\nExample Structure:\n\n```\nModule Root\n\u251C\u2500\u2500 package.json\n\u251C\u2500\u2500 pepr.ts\n\u2514\u2500\u2500 capabilities\n    \u251C\u2500\u2500 example-one.ts\n    \u251C\u2500\u2500 example-three.ts\n    \u2514\u2500\u2500 example-two.ts\n```\n';
 var peprTS = 'import { PeprModule } from "pepr";\n// cfg loads your pepr configuration from package.json\nimport cfg from "./package.json";\n\n// HelloPepr is a demo capability that is included with Pepr. Comment or delete the line below to remove it.\nimport { HelloPepr } from "./capabilities/hello-pepr";\n\n/**\n * This is the main entrypoint for this Pepr module. It is run when the module is started.\n * This is where you register your Pepr configurations and capabilities.\n */\nnew PeprModule(cfg, [\n  // "HelloPepr" is a demo capability that is included with Pepr. Comment or delete the line below to remove it.\n  HelloPepr,\n\n  // Your additional capabilities go here\n]);\n';
 var helloPeprTS = 'import {\n  Capability,\n  K8s,\n  Log,\n  PeprMutateRequest,\n  RegisterKind,\n  a,\n  fetch,\n  fetchStatus,\n  kind,\n} from "pepr";\nimport { MockAgent, setGlobalDispatcher } from "undici";\n\n/**\n *  The HelloPepr Capability is an example capability to demonstrate some general concepts of Pepr.\n *  To test this capability you run `pepr dev`and then run the following command:\n *  `kubectl apply -f capabilities/hello-pepr.samples.yaml`\n */\nexport const HelloPepr = new Capability({\n  name: "hello-pepr",\n  description: "A simple example capability to show how things work.",\n  namespaces: ["pepr-demo", "pepr-demo-2"],\n});\n\n// Use the \'When\' function to create a new action, use \'Store\' to persist data\nconst { When, Store } = HelloPepr;\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Namespace)                                   *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action removes the label `remove-me` when a Namespace is created.\n * Note we don\'t need to specify the namespace here, because we\'ve already specified\n * it in the Capability definition above.\n */\nWhen(a.Namespace)\n  .IsCreated()\n  .Mutate(ns => ns.RemoveLabel("remove-me"));\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Watch Action with K8s SSA (Namespace)                           *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action watches for the `pepr-demo-2` namespace to be created, then creates a ConfigMap with\n * the name `pepr-ssa-demo` and adds the namespace UID to the ConfigMap data. Because Pepr uses\n * server-side apply for this operation, the ConfigMap will be created or updated if it already exists.\n */\nWhen(a.Namespace)\n  .IsCreated()\n  .WithName("pepr-demo-2")\n  .Watch(async ns => {\n    Log.info("Namespace pepr-demo-2 was created.");\n\n    try {\n      // Apply the ConfigMap using K8s server-side apply\n      await K8s(kind.ConfigMap).Apply({\n        metadata: {\n          name: "pepr-ssa-demo",\n          namespace: "pepr-demo-2",\n        },\n        data: {\n          "ns-uid": ns.metadata.uid,\n        },\n      });\n    } catch (error) {\n      // You can use the Log object to log messages to the Pepr controller pod\n      Log.error(error, "Failed to apply ConfigMap using server-side apply.");\n    }\n\n    // You can share data between actions using the Store, including between different types of actions\n    Store.setItem("watch-data", "This data was stored by a Watch Action.");\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 1)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This is a single action. They can be in the same file or put imported from other files.\n * In this example, when a ConfigMap is created with the name `example-1`, then add a label and annotation.\n *\n * Equivalent to manually running:\n * `kubectl label configmap example-1 pepr=was-here`\n * `kubectl annotate configmap example-1 pepr.dev=annotations-work-too`\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-1")\n  .Mutate(request => {\n    request\n      .SetLabel("pepr", "was-here")\n      .SetAnnotation("pepr.dev", "annotations-work-too");\n\n    // Use the Store to persist data between requests and Pepr controller pods\n    Store.setItem("example-1", "was-here");\n\n    // This data is written asynchronously and can be read back via `Store.getItem()` or `Store.subscribe()`\n    Store.setItem("example-1-data", JSON.stringify(request.Raw.data));\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate & Validate Actions (CM Example 2)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This combines 3 different types of actions: \'Mutate\', \'Validate\', and \'Watch\'. The order\n * of the actions is required, but each action is optional. In this example, when a ConfigMap is created\n * with the name `example-2`, then add a label and annotation, validate that the ConfigMap has the label\n * `pepr`, and log the request.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-2")\n  .Mutate(request => {\n    // This Mutate Action will mutate the request before it is persisted to the cluster\n\n    // Use `request.Merge()` to merge the new data with the existing data\n    request.Merge({\n      metadata: {\n        labels: {\n          pepr: "was-here",\n        },\n        annotations: {\n          "pepr.dev": "annotations-work-too",\n        },\n      },\n    });\n  })\n  .Validate(request => {\n    // This Validate Action will validate the request before it is persisted to the cluster\n\n    // Approve the request if the ConfigMap has the label \'pepr\'\n    if (request.HasLabel("pepr")) {\n      return request.Approve();\n    }\n\n    // Otherwise, deny the request with an error message (optional)\n    return request.Deny("ConfigMap must have label \'pepr\'");\n  })\n  .Watch((cm, phase) => {\n    // This Watch Action will watch the ConfigMap after it has been persisted to the cluster\n    Log.info(cm, `ConfigMap was ${phase} with the name example-2`);\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 2a)                               *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action shows a simple validation that will deny any ConfigMap that has the\n * annotation `evil`. Note that the `Deny()` function takes an optional second parameter that is a\n * user-defined status code to return.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .Validate(request => {\n    if (request.HasAnnotation("evil")) {\n      return request.Deny("No evil CM annotations allowed.", 400);\n    }\n\n    return request.Approve();\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 3)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action combines different styles. Unlike the previous actions, this one will look\n * for any ConfigMap in the `pepr-demo` namespace that has the label `change=by-label` during either\n * CREATE or UPDATE. Note that all conditions added such as `WithName()`, `WithLabel()`, `InNamespace()`,\n * are ANDs so all conditions must be true for the request to be processed.\n */\nWhen(a.ConfigMap)\n  .IsCreatedOrUpdated()\n  .WithLabel("change", "by-label")\n  .Mutate(request => {\n    // The K8s object e are going to mutate\n    const cm = request.Raw;\n\n    // Get the username and uid of the K8s request\n    const { username, uid } = request.Request.userInfo;\n\n    // Store some data about the request in the configmap\n    cm.data["username"] = username;\n    cm.data["uid"] = uid;\n\n    // You can still mix other ways of making changes too\n    request.SetAnnotation("pepr.dev", "making-waves");\n  });\n\n// This action validates the label `change=by-label` is deleted\nWhen(a.ConfigMap)\n  .IsDeleted()\n  .WithLabel("change", "by-label")\n  .Validate(request => {\n    // Log and then always approve the request\n    Log.info("CM with label \'change=by-label\' was deleted.");\n    return request.Approve();\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 4)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action show how you can use the `Mutate()` function without an inline function.\n * This is useful if you want to keep your actions small and focused on a single task,\n * or if you want to reuse the same function in multiple actions.\n */\nWhen(a.ConfigMap).IsCreated().WithName("example-4").Mutate(example4Cb);\n\n// This function uses the complete type definition, but is not required.\nfunction example4Cb(cm: PeprMutateRequest<a.ConfigMap>) {\n  cm.SetLabel("pepr.dev/first", "true");\n  cm.SetLabel("pepr.dev/second", "true");\n  cm.SetLabel("pepr.dev/third", "true");\n}\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 4a)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This is the same as Example 4, except this only operates on a CM in the `pepr-demo-2` namespace.\n * Note because the Capability defines namespaces, the namespace specified here must be one of those.\n * Alternatively, you can remove the namespace from the Capability definition and specify it here.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .InNamespace("pepr-demo-2")\n  .WithName("example-4a")\n  .Mutate(example4Cb);\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 5)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action is a bit more complex. It will look for any ConfigMap in the `pepr-demo`\n * namespace that has the label `chuck-norris` during CREATE. When it finds one, it will fetch a\n * random Chuck Norris joke from the API and add it to the ConfigMap. This is a great example of how\n * you can use Pepr to make changes to your K8s objects based on external data.\n *\n * Note the use of the `async` keyword. This is required for any action that uses `await` or `fetch()`.\n *\n * Also note we are passing a type to the `fetch()` function. This is optional, but it will help you\n * avoid mistakes when working with the data returned from the API. You can also use the `as` keyword to\n * cast the data returned from the API.\n *\n * These are equivalent:\n * ```ts\n * const joke = await fetch<TheChuckNorrisJoke>("https://icanhazdadjoke.com/");\n * const joke = await fetch("https://icanhazdadjoke.com/") as TheChuckNorrisJoke;\n * ```\n *\n * Alternatively, you can drop the type completely:\n *\n * ```ts\n * fetch("https://icanhazdadjoke.com")\n * ```\n */\ninterface TheChuckNorrisJoke {\n  id: string;\n  joke: string;\n  status: number;\n}\n\nWhen(a.ConfigMap)\n  .IsCreatedOrUpdated()\n  .WithLabel("chuck-norris")\n  .Mutate(cm => cm.SetLabel("got-jokes", "true"))\n  .Watch(async cm => {\n    const jokeURL = "https://icanhazdadjoke.com";\n\n    const mockAgent: MockAgent = new MockAgent();\n    setGlobalDispatcher(mockAgent);\n    const mockClient = mockAgent.get(jokeURL);\n    mockClient.intercept({ path: "/", method: "GET" }).reply(\n      200,\n      {\n        id: "R7UfaahVfFd",\n        joke: "Funny joke goes here.",\n        status: 200,\n      },\n      {\n        headers: {\n          "Content-Type": "application/json; charset=utf-8",\n        },\n      },\n    );\n\n    // Try/catch is not needed as a response object will always be returned\n    const response = await fetch<TheChuckNorrisJoke>(jokeURL, {\n      headers: {\n        Accept: "application/json",\n      },\n    });\n\n    // Instead, check the `response.ok` field\n    if (response.ok) {\n      const { joke } = response.data;\n      // Add Joke to the Store\n      await Store.setItemAndWait(jokeURL, joke);\n      // Add the Chuck Norris joke to the configmap\n      try {\n        await K8s(kind.ConfigMap).Apply({\n          metadata: {\n            name: cm.metadata.name,\n            namespace: cm.metadata.namespace,\n          },\n          data: {\n            "chuck-says": Store.getItem(jokeURL),\n          },\n        });\n      } catch (error) {\n        Log.error(error, "Failed to apply ConfigMap using server-side apply.", {\n          cm,\n        });\n      }\n    }\n\n    // You can also assert on different HTTP response codes\n    if (response.status === fetchStatus.NOT_FOUND) {\n      // Do something else\n      return;\n    }\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Secret Base64 Handling)                      *\n * ---------------------------------------------------------------------------------------------------\n *\n * The K8s JS client provides incomplete support for base64 encoding/decoding handling for secrets,\n * unlike the GO client. To make this less painful, Pepr automatically handles base64 encoding/decoding\n * secret data before and after the action is executed.\n */\nWhen(a.Secret)\n  .IsCreated()\n  .WithName("secret-1")\n  .Mutate(request => {\n    const secret = request.Raw;\n\n    // This will be encoded at the end of all processing back to base64: "Y2hhbmdlLXdpdGhvdXQtZW5jb2Rpbmc="\n    secret.data.magic = "change-without-encoding";\n\n    // You can modify the data directly, and it will be encoded at the end of all processing\n    secret.data.example += " - modified by Pepr";\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Untyped Custom Resource)                     *\n * ---------------------------------------------------------------------------------------------------\n *\n * Out of the box, Pepr supports all the standard Kubernetes objects. However, you can also create\n * your own types. This is useful if you are working with an Operator that creates custom resources.\n * There are two ways to do this, the first is to use the `When()` function with a `GenericKind`,\n * the second is to create a new class that extends `GenericKind` and use the `RegisterKind()` function.\n *\n * This example shows how to use the `When()` function with a `GenericKind`. Note that you\n * must specify the `group`, `version`, and `kind` of the object (if applicable). This is how Pepr knows\n * if the action should be triggered or not. Since we are using a `GenericKind`,\n * Pepr will not be able to provide any intellisense for the object, so you will need to refer to the\n * Kubernetes API documentation for the object you are working with.\n *\n * You will need to wait for the CRD in `hello-pepr.samples.yaml` to be created, then you can apply\n *\n * ```yaml\n * apiVersion: pepr.dev/v1\n * kind: Unicorn\n * metadata:\n *   name: example-1\n *   namespace: pepr-demo\n * spec:\n *   message: replace-me\n *   counter: 0\n * ```\n */\nWhen(a.GenericKind, {\n  group: "pepr.dev",\n  version: "v1",\n  kind: "Unicorn",\n})\n  .IsCreated()\n  .WithName("example-1")\n  .Mutate(request => {\n    request.Merge({\n      spec: {\n        message: "Hello Pepr without type data!",\n        counter: Math.random(),\n      },\n    });\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Typed Custom Resource)                       *\n * ---------------------------------------------------------------------------------------------------\n *\n * This example shows how to use the `RegisterKind()` function to create a new type. This is useful\n * if you are working with an Operator that creates custom resources and you want to have intellisense\n * for the object. Note that you must specify the `group`, `version`, and `kind` of the object (if applicable)\n * as this is how Pepr knows if the action should be triggered or not.\n *\n * Once you register a new Kind with Pepr, you can use the `When()` function with the new Kind. Ideally,\n * you should register custom Kinds at the top of your Capability file or Pepr Module so they are available\n * to all actions, but we are putting it here for demonstration purposes.\n *\n * You will need to wait for the CRD in `hello-pepr.samples.yaml` to be created, then you can apply\n *\n * ```yaml\n * apiVersion: pepr.dev/v1\n * kind: Unicorn\n * metadata:\n *   name: example-2\n *   namespace: pepr-demo\n * spec:\n *   message: replace-me\n *   counter: 0\n * ```*\n */\nclass UnicornKind extends a.GenericKind {\n  spec: {\n    /**\n     * JSDoc comments can be added to explain more details about the field.\n     *\n     * @example\n     * ```ts\n     * request.Raw.spec.message = "Hello Pepr!";\n     * ```\n     * */\n    message: string;\n    counter: number;\n  };\n}\n\nRegisterKind(UnicornKind, {\n  group: "pepr.dev",\n  version: "v1",\n  kind: "Unicorn",\n});\n\nWhen(UnicornKind)\n  .IsCreated()\n  .WithName("example-2")\n  .Mutate(request => {\n    request.Merge({\n      spec: {\n        message: "Hello Pepr with type data!",\n        counter: Math.random(),\n      },\n    });\n  });\n\n/**\n * A callback function that is called once the Pepr Store is fully loaded.\n */\nStore.onReady(data => {\n  Log.info(data, "Pepr Store Ready");\n});\n';
-var packageJSON = { name: "pepr", description: "Kubernetes application engine", author: "Defense Unicorns", homepage: "https://github.com/defenseunicorns/pepr", license: "Apache-2.0", bin: "dist/cli.js", repository: "defenseunicorns/pepr", engines: { node: ">=18.0.0" }, files: ["/dist", "/src", "!src/**/*.test.ts", "!dist/**/*.test.d.ts*"], version: "0.42.0", main: "dist/lib.js", types: "dist/lib.d.ts", scripts: { ci: "npm ci", "gen-data-json": "node hack/build-template-data.js", prebuild: "rm -fr dist/* && npm run gen-data-json", version: "node scripts/set-version.js", build: "tsc && node build.mjs && npm pack", "build:image": "npm run build && docker buildx build --output type=docker --tag pepr:dev .", test: "npm run test:unit && npm run test:journey", "test:unit": "npm run gen-data-json && jest src --coverage --detectOpenHandles --coverageDirectory=./coverage --testPathIgnorePatterns='cosign.e2e.test.ts'", "test:journey": "npm run test:journey:k3d && npm run build && npm run test:journey:image && npm run test:journey:run", "test:journey:prep": "if [ ! -d ./pepr-upgrade-test ]; then git clone https://github.com/defenseunicorns/pepr-upgrade-test.git ; fi", "test:journey-wasm": "npm run test:journey:k3d && npm run build && npm run test:journey:image && npm run test:journey:run-wasm", "test:journey:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0' --wait && kubectl rollout status deployment -n kube-system", "test:journey:image": "docker buildx build --output type=docker --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev", "test:journey:run": "jest --detectOpenHandles journey/entrypoint.test.ts && npm run test:journey:prep && npm run test:journey:upgrade", "test:journey:run-wasm": "jest --detectOpenHandles journey/entrypoint-wasm.test.ts", "test:journey:upgrade": "npm run test:journey:k3d && npm run test:journey:image && jest --detectOpenHandles journey/pepr-upgrade.test.ts", "format:check": "eslint src && prettier src --check", "format:fix": "eslint src --fix && prettier src --write", prepare: `if [ "$NODE_ENV" != 'production' ]; then husky; fi` }, dependencies: { "@types/ramda": "0.30.2", express: "4.21.2", "fast-json-patch": "3.1.1", "follow-redirects": "1.15.9", "http-status-codes": "^2.3.0", "json-pointer": "^0.6.2", "kubernetes-fluent-client": "3.3.7", pino: "9.5.0", "pino-pretty": "13.0.0", "prom-client": "15.1.3", ramda: "0.30.1", sigstore: "3.0.0" }, devDependencies: { "@commitlint/cli": "19.6.0", "@commitlint/config-conventional": "19.6.0", "@fast-check/jest": "^2.0.1", "@jest/globals": "29.7.0", "@types/eslint": "9.6.1", "@types/express": "5.0.0", "@types/follow-redirects": "1.14.4", "@types/json-pointer": "^1.0.34", "@types/node": "22.x.x", "@types/node-forge": "1.3.11", "@types/uuid": "10.0.0", "fast-check": "^3.19.0", husky: "^9.1.6", jest: "29.7.0", "js-yaml": "^4.1.0", "ts-jest": "29.2.5", undici: "^7.0.1" }, peerDependencies: { "@types/prompts": "2.4.9", "@typescript-eslint/eslint-plugin": "7.18.0", "@typescript-eslint/parser": "7.18.0", commander: "12.1.0", esbuild: "0.23.0", eslint: "8.57.0", "node-forge": "1.3.1", prettier: "3.3.3", prompts: "2.4.2", typescript: "5.3.3", uuid: "10.0.0" } };
+var packageJSON = { name: "pepr", description: "Kubernetes application engine", author: "Defense Unicorns", homepage: "https://github.com/defenseunicorns/pepr", license: "Apache-2.0", bin: "dist/cli.js", repository: "defenseunicorns/pepr", engines: { node: ">=18.0.0" }, files: ["/dist", "/src", "!src/**/*.test.ts", "!dist/**/*.test.d.ts*"], version: "0.42.2", main: "dist/lib.js", types: "dist/lib.d.ts", scripts: { ci: "npm ci", "gen-data-json": "node hack/build-template-data.js", prebuild: "rm -fr dist/* && npm run gen-data-json", version: "node scripts/set-version.js", build: "tsc && node build.mjs && npm pack", "build:image": "npm run build && docker buildx build --output type=docker --tag pepr:dev .", test: "npm run test:unit && npm run test:journey", "test:unit": "npm run gen-data-json && jest src --coverage --detectOpenHandles --coverageDirectory=./coverage --testPathIgnorePatterns='cosign.e2e.test.ts'", "test:journey": "npm run test:journey:k3d && npm run build && npm run test:journey:image && npm run test:journey:run", "test:journey:prep": "if [ ! -d ./pepr-upgrade-test ]; then git clone https://github.com/defenseunicorns/pepr-upgrade-test.git ; fi", "test:journey-wasm": "npm run test:journey:k3d && npm run build && npm run test:journey:image && npm run test:journey:run-wasm", "test:journey:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0' --wait && kubectl rollout status deployment -n kube-system", "test:journey:image": "docker buildx build --output type=docker --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev", "test:journey:run": "jest --detectOpenHandles journey/entrypoint.test.ts && npm run test:journey:prep && npm run test:journey:upgrade", "test:journey:run-wasm": "jest --detectOpenHandles journey/entrypoint-wasm.test.ts", "test:journey:upgrade": "npm run test:journey:k3d && npm run test:journey:image && jest --detectOpenHandles journey/pepr-upgrade.test.ts", "format:check": "eslint src && prettier src --check", "format:fix": "eslint src --fix && prettier src --write", prepare: `if [ "$NODE_ENV" != 'production' ]; then husky; fi` }, dependencies: { "@types/ramda": "0.30.2", express: "4.21.2", "fast-json-patch": "3.1.1", "follow-redirects": "1.15.9", "http-status-codes": "^2.3.0", "json-pointer": "^0.6.2", "kubernetes-fluent-client": "3.3.7", pino: "9.6.0", "pino-pretty": "13.0.0", "prom-client": "15.1.3", ramda: "0.30.1", sigstore: "3.0.0" }, devDependencies: { "@commitlint/cli": "19.6.1", "@commitlint/config-conventional": "19.6.0", "@fast-check/jest": "^2.0.1", "@jest/globals": "29.7.0", "@types/eslint": "9.6.1", "@types/express": "5.0.0", "@types/follow-redirects": "1.14.4", "@types/json-pointer": "^1.0.34", "@types/node": "22.x.x", "@types/node-forge": "1.3.11", "@types/uuid": "10.0.0", "fast-check": "^3.19.0", husky: "^9.1.6", jest: "29.7.0", "js-yaml": "^4.1.0", "ts-jest": "29.2.5", undici: "^7.0.1" }, peerDependencies: { "@typescript-eslint/eslint-plugin": "7.18.0", "@typescript-eslint/parser": "7.18.0", "@types/prompts": "2.4.9", eslint: "8.57.0", commander: "12.1.0", esbuild: "0.24.0", "node-forge": "1.3.1", prettier: "3.4.2", prompts: "2.4.2", typescript: "^5.3.3", uuid: "11.0.3" } };
 
 // src/templates/pepr.code-snippets.json
 var pepr_code_snippets_default = {
@@ -2281,7 +2066,7 @@ var tsconfig_module_default = {
 };
 
 // src/cli/init/utils.ts
-var import_fs6 = require("fs");
+var import_fs5 = require("fs");
 function sanitizeName(name2) {
   if (typeof name2 !== "string") {
     throw TypeError(
@@ -2295,7 +2080,7 @@ function sanitizeName(name2) {
 }
 async function createDir(dir) {
   try {
-    await import_fs6.promises.mkdir(dir);
+    await import_fs5.promises.mkdir(dir);
   } catch (err) {
     if (err && err.code === "EEXIST") {
       throw new Error(`Directory ${dir} already exists`);
@@ -2308,7 +2093,7 @@ function write(path, data) {
   if (typeof data !== "string") {
     data = JSON.stringify(data, null, 2);
   }
-  return import_fs6.promises.writeFile(path, data);
+  return import_fs5.promises.writeFile(path, data);
 }
 
 // src/cli/init/templates.ts
@@ -2404,10 +2189,32 @@ var eslint = {
   data: eslintrc_template_default
 };
 
+// src/cli/build.ts
+var import_commander = require("commander");
+
 // src/cli/format.ts
 var import_eslint = require("eslint");
-var import_fs7 = require("fs");
+
+// src/cli/format.helpers.ts
+var import_fs6 = require("fs");
 var import_prettier = require("prettier");
+async function formatWithPrettier(results, validateOnly) {
+  let hasFailure = false;
+  for (const { filePath } of results) {
+    const content = await import_fs6.promises.readFile(filePath, "utf8");
+    const cfg = await (0, import_prettier.resolveConfig)(filePath);
+    const formatted = await (0, import_prettier.format)(content, { filepath: filePath, ...cfg });
+    if (validateOnly && formatted !== content) {
+      hasFailure = true;
+      console.error(`File ${filePath} is not formatted correctly`);
+    } else {
+      await import_fs6.promises.writeFile(filePath, formatted);
+    }
+  }
+  return hasFailure;
+}
+
+// src/cli/format.ts
 function format_default(program2) {
   program2.command("format").description("Lint and format this Pepr module").option("-v, --validate-only", "Do not modify files, only validate formatting").action(async (opts) => {
     const success = await peprFormat(opts.validateOnly);
@@ -2438,17 +2245,7 @@ async function peprFormat(validateOnly) {
       if (!validateOnly) {
         await import_eslint.ESLint.outputFixes(results);
       }
-      for (const { filePath } of results) {
-        const content = await import_fs7.promises.readFile(filePath, "utf8");
-        const cfg = await (0, import_prettier.resolveConfig)(filePath);
-        const formatted = await (0, import_prettier.format)(content, { filepath: filePath, ...cfg });
-        if (validateOnly && formatted !== content) {
-          hasFailure = true;
-          console.error(`File ${filePath} is not formatted correctly`);
-        } else {
-          await import_fs7.promises.writeFile(filePath, formatted);
-        }
-      }
+      hasFailure = await formatWithPrettier(results, validateOnly);
       return !hasFailure;
     } catch (e) {
       console.error(`Error formatting module:`, e);
@@ -2457,10 +2254,27 @@ async function peprFormat(validateOnly) {
   }
 }
 
-// src/cli/build.ts
-var import_commander = require("commander");
+// src/lib/included-files.ts
+var import_fs7 = require("fs");
+async function createDockerfile(version3, description, includedFiles) {
+  const file = `
+    # Use an official Node.js runtime as the base image
+    FROM ghcr.io/defenseunicorns/pepr/controller:v${version3}
+  
+    LABEL description="${description}"
+    
+    # Add the included files to the image
+    ${includedFiles.map((f) => `ADD ${f} ${f}`).join("\n")}
+  
+    `;
+  await import_fs7.promises.writeFile("Dockerfile.controller", file, { encoding: "utf-8" });
+}
 
 // src/cli/build.helpers.ts
+var import_child_process2 = require("child_process");
+var import_esbuild = require("esbuild");
+var import_path2 = require("path");
+var import_fs8 = require("fs");
 function determineRbacMode(opts, cfg) {
   if (opts.rbacMode) {
     return opts.rbacMode;
@@ -2470,6 +2284,93 @@ function determineRbacMode(opts, cfg) {
   }
   return cfg.pepr.rbacMode || "admin";
 }
+async function handleCustomOutputDir(outputDir2) {
+  const defaultOutputDir = "dist";
+  if (outputDir2) {
+    try {
+      await createDirectoryIfNotExists(outputDir2);
+      return outputDir2;
+    } catch (error) {
+      console.error(`Error creating output directory: ${error.message}`);
+      process.exit(1);
+    }
+  }
+  return defaultOutputDir;
+}
+function checkIronBankImage(registry, image, peprVersion) {
+  return registry === "Iron Bank" ? `registry1.dso.mil/ironbank/opensource/defenseunicorns/pepr/controller:v${peprVersion}` : image;
+}
+function validImagePullSecret(imagePullSecretName) {
+  if (imagePullSecretName) {
+    const error = "Invalid imagePullSecret. Please provide a valid name as defined in RFC 1123.";
+    if (sanitizeResourceName(imagePullSecretName) !== imagePullSecretName) {
+      console.error(error);
+      process.exit(1);
+    }
+  }
+}
+function handleCustomImage(customImage, registry) {
+  let defaultImage = "";
+  if (customImage) {
+    if (registry) {
+      console.error(`Custom Image and registry cannot be used together.`);
+      process.exit(1);
+    }
+    defaultImage = customImage;
+  }
+  return defaultImage;
+}
+async function handleCustomImageBuild(includedFiles, peprVersion, description, image) {
+  if (includedFiles.length > 0) {
+    await createDockerfile(peprVersion, description, includedFiles);
+    (0, import_child_process2.execSync)(`docker build --tag ${image} -f Dockerfile.controller .`, {
+      stdio: "inherit"
+    });
+    (0, import_child_process2.execSync)(`docker push ${image}`, { stdio: "inherit" });
+  }
+}
+function handleEmbedding(embed, path) {
+  if (!embed) {
+    console.info(`\u2705 Module built successfully at ${path}`);
+    return;
+  }
+}
+function handleValidCapabilityNames(capabilities) {
+  try {
+    validateCapabilityNames(capabilities);
+  } catch (e) {
+    console.error(`Error loading capability:`, e);
+    process.exit(1);
+  }
+}
+async function watchForChanges(ctxCfg, reloader) {
+  const ctx = await (0, import_esbuild.context)(ctxCfg);
+  if (reloader) {
+    await ctx.watch();
+  } else {
+    await ctx.rebuild();
+    await ctx.dispose();
+  }
+  return ctx;
+}
+async function generateYamlAndWriteToDisk(obj) {
+  const { uuid, imagePullSecret, outputDir: outputDir2, assets, zarf } = obj;
+  const yamlFile = `pepr-module-${uuid}.yaml`;
+  const chartPath = `${uuid}-chart`;
+  const yamlPath = (0, import_path2.resolve)(outputDir2, yamlFile);
+  const yaml = await assets.allYaml(imagePullSecret);
+  const zarfPath = (0, import_path2.resolve)(outputDir2, "zarf.yaml");
+  let localZarf = "";
+  if (zarf === "chart") {
+    localZarf = assets.zarfYamlChart(chartPath);
+  } else {
+    localZarf = assets.zarfYaml(yamlFile);
+  }
+  await import_fs8.promises.writeFile(yamlPath, yaml);
+  await import_fs8.promises.writeFile(zarfPath, localZarf);
+  await assets.generateHelmChart(outputDir2);
+  console.info(`\u2705 K8s resource for the module saved to ${yamlPath}`);
+}
 
 // src/cli/build.ts
 var peprTS2 = "pepr.ts";
@@ -2509,46 +2410,22 @@ function build_default(program2) {
       ["admin", "scoped"]
     )
   ).action(async (opts) => {
-    if (opts.outputDir) {
-      outputDir = opts.outputDir;
-      createDirectoryIfNotExists(outputDir).catch((error) => {
-        console.error(`Error creating output directory: ${error.message}`);
-        process.exit(1);
-      });
-    }
+    outputDir = await handleCustomOutputDir(opts.outputDir);
     const buildModuleResult = await buildModule(void 0, opts.entryPoint, opts.embed);
     if (buildModuleResult?.cfg && buildModuleResult.path && buildModuleResult.uuid) {
       const { cfg, path, uuid } = buildModuleResult;
       const { includedFiles } = cfg.pepr;
-      let image = "";
-      if (opts.customImage) {
-        if (opts.registry) {
-          console.error(`Custom Image and registry cannot be used together.`);
-          process.exit(1);
-        }
-        image = opts.customImage;
-      }
+      let image = handleCustomImage(opts.customImage, opts.registry);
       if (opts.timeout !== void 0) {
         cfg.pepr.webhookTimeout = opts.timeout;
       }
       if (opts.registryInfo !== void 0) {
         console.info(`Including ${includedFiles.length} files in controller image.`);
         image = `${opts.registryInfo}/custom-pepr-controller:${cfg.pepr.peprVersion}`;
-        if (includedFiles.length > 0) {
-          await createDockerfile(cfg.pepr.peprVersion, cfg.description, includedFiles);
-          (0, import_child_process2.execSync)(`docker build --tag ${image} -f Dockerfile.controller .`, {
-            stdio: "inherit"
-          });
-          (0, import_child_process2.execSync)(`docker push ${image}`, { stdio: "inherit" });
-        }
-      }
-      if (!opts.embed) {
-        console.info(`\u2705 Module built successfully at ${path}`);
-        return;
-      }
-      if (opts.version) {
-        cfg.pepr.peprVersion = opts.version;
+        await handleCustomImageBuild(includedFiles, cfg.pepr.peprVersion, cfg.description, image);
       }
+      handleEmbedding(opts.embed, path);
+      opts.version ? cfg.pepr.peprVersion = opts.version : null;
       const assets = new Assets(
         {
           ...cfg.pepr,
@@ -2559,46 +2436,17 @@ function build_default(program2) {
         },
         path
       );
-      if (opts?.registry === "Iron Bank") {
-        console.info(
-          `
-	This command assumes the latest release. Pepr's Iron Bank image release cycle is dictated by renovate and is typically released a few days after the GitHub release.
-	As an alternative you may consider custom --custom-image to target a specific image and version.`
-        );
-        image = `registry1.dso.mil/ironbank/opensource/defenseunicorns/pepr/controller:v${cfg.pepr.peprVersion}`;
-      }
-      if (image !== "") {
-        assets.image = image;
-      }
-      if (opts.withPullSecret) {
-        if (sanitizeResourceName(opts.withPullSecret) !== opts.withPullSecret) {
-          console.error(
-            "Invalid imagePullSecret. Please provide a valid name as defined in RFC 1123."
-          );
-          process.exit(1);
-        }
-      }
-      const yamlFile = `pepr-module-${uuid}.yaml`;
-      const chartPath = `${uuid}-chart`;
-      const yamlPath = (0, import_path2.resolve)(outputDir, yamlFile);
-      const yaml = await assets.allYaml(opts.withPullSecret);
-      try {
-        validateCapabilityNames(assets.capabilities);
-      } catch (e) {
-        console.error(`Error loading capability:`, e);
-        process.exit(1);
-      }
-      const zarfPath = (0, import_path2.resolve)(outputDir, "zarf.yaml");
-      let zarf = "";
-      if (opts.zarf === "chart") {
-        zarf = assets.zarfYamlChart(chartPath);
-      } else {
-        zarf = assets.zarfYaml(yamlFile);
-      }
-      await import_fs8.promises.writeFile(yamlPath, yaml);
-      await import_fs8.promises.writeFile(zarfPath, zarf);
-      await assets.generateHelmChart(outputDir);
-      console.info(`\u2705 K8s resource for the module saved to ${yamlPath}`);
+      image = checkIronBankImage(opts.registry, image, cfg.pepr.peprVersion);
+      image !== "" ? assets.image = image : null;
+      validImagePullSecret(opts.withPullSecret);
+      handleValidCapabilityNames(assets.capabilities);
+      await generateYamlAndWriteToDisk({
+        uuid,
+        outputDir,
+        imagePullSecret: opts.withPullSecret,
+        zarf: opts.zarf,
+        assets
+      });
     }
   });
 }
@@ -2606,19 +2454,19 @@ var externalLibs = Object.keys(dependencies);
 externalLibs.push("pepr");
 externalLibs.push("@kubernetes/client-node");
 async function loadModule(entryPoint = peprTS2) {
-  const entryPointPath = (0, import_path2.resolve)(".", entryPoint);
-  const modulePath = (0, import_path2.dirname)(entryPointPath);
-  const cfgPath = (0, import_path2.resolve)(modulePath, "package.json");
+  const entryPointPath = (0, import_path3.resolve)(".", entryPoint);
+  const modulePath = (0, import_path3.dirname)(entryPointPath);
+  const cfgPath = (0, import_path3.resolve)(modulePath, "package.json");
   try {
-    await import_fs8.promises.access(cfgPath);
-    await import_fs8.promises.access(entryPointPath);
+    await import_fs9.promises.access(cfgPath);
+    await import_fs9.promises.access(entryPointPath);
   } catch (e) {
     console.error(
       `Could not find ${cfgPath} or ${entryPointPath} in the current directory. Please run this command from the root of your module's directory.`
     );
     process.exit(1);
   }
-  const moduleText = await import_fs8.promises.readFile(cfgPath, { encoding: "utf-8" });
+  const moduleText = await import_fs9.promises.readFile(cfgPath, { encoding: "utf-8" });
   const cfg = JSON.parse(moduleText);
   const { uuid } = cfg.pepr;
   const name2 = `pepr-${uuid}.js`;
@@ -2631,23 +2479,17 @@ async function loadModule(entryPoint = peprTS2) {
     entryPointPath,
     modulePath,
     name: name2,
-    path: (0, import_path2.resolve)(outputDir, name2),
+    path: (0, import_path3.resolve)(outputDir, name2),
     uuid
   };
 }
 async function buildModule(reloader, entryPoint = peprTS2, embed = true) {
   try {
     const { cfg, modulePath, path, uuid } = await loadModule(entryPoint);
-    const validFormat = await peprFormat(true);
-    if (!validFormat) {
-      console.log(
-        "\x1B[33m%s\x1B[0m",
-        "Formatting errors were found. The build will continue, but you may want to run `npx pepr format` to address any issues."
-      );
-    }
-    const npmRoot = (0, import_child_process2.execFileSync)("npm", ["root"]).toString().trim();
+    await checkFormat();
+    const npmRoot = (0, import_child_process3.execFileSync)("npm", ["root"]).toString().trim();
     const args = ["--project", `${modulePath}/tsconfig.json`, "--outdir", outputDir];
-    (0, import_child_process2.execFileSync)(`${npmRoot}/.bin/tsc`, args);
+    (0, import_child_process3.execFileSync)(`${npmRoot}/.bin/tsc`, args);
     const ctxCfg = {
       bundle: true,
       entryPoints: [entryPoint],
@@ -2664,7 +2506,7 @@ async function buildModule(reloader, entryPoint = peprTS2, embed = true) {
           setup(build) {
             build.onEnd(async (r) => {
               if (r?.metafile) {
-                console.log(await (0, import_esbuild.analyzeMetafile)(r.metafile));
+                console.log(await (0, import_esbuild2.analyzeMetafile)(r.metafile));
               }
               if (reloader) {
                 await reloader(r);
@@ -2682,46 +2524,52 @@ async function buildModule(reloader, entryPoint = peprTS2, embed = true) {
     }
     if (!embed) {
       ctxCfg.minify = false;
-      ctxCfg.outfile = (0, import_path2.resolve)(outputDir, (0, import_path2.basename)(entryPoint, (0, import_path2.extname)(entryPoint))) + ".js";
+      ctxCfg.outfile = (0, import_path3.resolve)(outputDir, (0, import_path3.basename)(entryPoint, (0, import_path3.extname)(entryPoint))) + ".js";
       ctxCfg.packages = "external";
       ctxCfg.treeShaking = false;
     }
-    const ctx = await (0, import_esbuild.context)(ctxCfg);
-    if (reloader) {
-      await ctx.watch();
-    } else {
-      await ctx.rebuild();
-      await ctx.dispose();
-    }
+    const ctx = await watchForChanges(ctxCfg, reloader);
     return { ctx, path, cfg, uuid };
   } catch (e) {
-    console.error(`Error building module:`, e);
-    if (!e.stdout) process.exit(1);
-    const out = e.stdout.toString();
-    const err = e.stderr.toString();
-    console.log(out);
-    console.error(err);
-    if (out.includes("Types have separate declarations of a private property '_name'.")) {
-      const pgkErrMatch = /error TS2322: .*? 'import\("\/.*?\/node_modules\/(.*?)\/node_modules/g;
-      out.matchAll(pgkErrMatch);
-      const conflicts = [...out.matchAll(pgkErrMatch)];
-      if (conflicts.length < 1) {
-        console.info(
-          `
+    handleModuleBuildError(e);
+  }
+}
+function handleModuleBuildError(e) {
+  console.error(`Error building module:`, e);
+  if (!e.stdout) process.exit(1);
+  const out = e.stdout.toString();
+  const err = e.stderr.toString();
+  console.log(out);
+  console.error(err);
+  if (out.includes("Types have separate declarations of a private property '_name'.")) {
+    const pgkErrMatch = /error TS2322: .*? 'import\("\/.*?\/node_modules\/(.*?)\/node_modules/g;
+    out.matchAll(pgkErrMatch);
+    const conflicts = [...out.matchAll(pgkErrMatch)];
+    if (conflicts.length < 1) {
+      console.info(
+        `
 	One or more imported Pepr Capabilities seem to be using an incompatible version of Pepr.
 	Try updating your Pepr Capabilities to their latest versions.`,
-          "Version Conflict"
-        );
-      }
-      conflicts.forEach((match) => {
-        console.info(
-          `
+        "Version Conflict"
+      );
+    }
+    conflicts.forEach((match) => {
+      console.info(
+        `
 	Package '${match[1]}' seems to be incompatible with your current version of Pepr.
 	Try updating to the latest version.`,
-          "Version Conflict"
-        );
-      });
-    }
+        "Version Conflict"
+      );
+    });
+  }
+}
+async function checkFormat() {
+  const validFormat = await peprFormat(true);
+  if (!validFormat) {
+    console.log(
+      "\x1B[33m%s\x1B[0m",
+      "Formatting errors were found. The build will continue, but you may want to run `npx pepr format` to address any issues."
+    );
   }
 }
 
@@ -2730,19 +2578,19 @@ var import_prompts = __toESM(require("prompts"));
 
 // src/lib/deploymentChecks.ts
 var import_kubernetes_fluent_client4 = require("kubernetes-fluent-client");
-async function checkDeploymentStatus(namespace2) {
-  const deployments = await (0, import_kubernetes_fluent_client4.K8s)(import_kubernetes_fluent_client4.kind.Deployment).InNamespace(namespace2).Get();
+async function checkDeploymentStatus(namespace) {
+  const deployments = await (0, import_kubernetes_fluent_client4.K8s)(import_kubernetes_fluent_client4.kind.Deployment).InNamespace(namespace).Get();
   let status = false;
   let readyCount = 0;
-  for (const deployment2 of deployments.items) {
-    const readyReplicas = deployment2.status?.readyReplicas ? deployment2.status?.readyReplicas : 0;
-    if (deployment2.status?.readyReplicas !== deployment2.spec?.replicas) {
+  for (const deployment of deployments.items) {
+    const readyReplicas = deployment.status?.readyReplicas ? deployment.status?.readyReplicas : 0;
+    if (deployment.status?.readyReplicas !== deployment.spec?.replicas) {
       logger_default.info(
-        `Waiting for deployment ${deployment2.metadata?.name} rollout to finish: ${readyReplicas} of ${deployment2.spec?.replicas} replicas are available`
+        `Waiting for deployment ${deployment.metadata?.name} rollout to finish: ${readyReplicas} of ${deployment.spec?.replicas} replicas are available`
       );
     } else {
       logger_default.info(
-        `Deployment ${deployment2.metadata?.name} rolled out: ${readyReplicas} of ${deployment2.spec?.replicas} replicas are available`
+        `Deployment ${deployment.metadata?.name} rolled out: ${readyReplicas} of ${deployment.spec?.replicas} replicas are available`
       );
       readyCount++;
     }
@@ -2752,87 +2600,113 @@ async function checkDeploymentStatus(namespace2) {
   }
   return status;
 }
-async function namespaceDeploymentsReady(namespace2 = "pepr-system") {
-  logger_default.info(`Checking ${namespace2} deployments status...`);
+async function namespaceDeploymentsReady(namespace = "pepr-system") {
+  logger_default.info(`Checking ${namespace} deployments status...`);
   let ready = false;
   while (!ready) {
-    ready = await checkDeploymentStatus(namespace2);
+    ready = await checkDeploymentStatus(namespace);
     if (ready) {
       return ready;
     }
-    await new Promise((resolve5) => setTimeout(resolve5, 1e3));
+    await new Promise((resolve6) => setTimeout(resolve6, 1e3));
   }
-  logger_default.info(`All ${namespace2} deployments are ready`);
+  logger_default.info(`All ${namespace} deployments are ready`);
 }
 
 // src/cli/deploy.ts
+function validateImagePullSecretDetails(details) {
+  if (!details.pullSecret) {
+    return { valid: true };
+  }
+  if (details.pullSecret !== sanitizeName(details.pullSecret)) {
+    return {
+      valid: false,
+      error: `Invalid --pullSecret. Must be valid name as defined in RFC 1123.`
+    };
+  }
+  const missing = [];
+  if (!details.dockerEmail) {
+    missing.push("--docker-email");
+  }
+  if (!details.dockerServer) {
+    missing.push("--docker-server");
+  }
+  if (!details.dockerUsername) {
+    missing.push("--docker-username");
+  }
+  if (!details.dockerPassword) {
+    missing.push("--docker-password");
+  }
+  if (missing.length > 0) {
+    return {
+      valid: false,
+      error: `Error: Must provide ${missing.join(", ")} when providing --pullSecret`
+    };
+  }
+  return { valid: true };
+}
+function generateImagePullSecret(details) {
+  const auth = Buffer.from(`${details.dockerUsername}:${details.dockerPassword}`).toString(
+    "base64"
+  );
+  return {
+    auths: {
+      [details.dockerServer]: {
+        username: details.dockerUsername,
+        password: details.dockerPassword,
+        email: details.dockerEmail,
+        auth
+      }
+    }
+  };
+}
+async function getUserConfirmation(opts) {
+  if (opts.confirm) {
+    return true;
+  }
+  const confirm2 = await (0, import_prompts.default)({
+    type: "confirm",
+    name: "confirm",
+    message: "This will remove and redeploy the module. Continue?"
+  });
+  return confirm2.confirm ? true : false;
+}
 function deploy_default(program2) {
   program2.command("deploy").description("Deploy a Pepr Module").option("-i, --image [image]", "Override the image tag").option("--confirm", "Skip confirmation prompt").option("--pullSecret <name>", "Deploy imagePullSecret for Controller private registry").option("--docker-server <server>", "Docker server address").option("--docker-username <username>", "Docker registry username").option("--docker-email <email>", "Email for Docker registry").option("--docker-password <password>", "Password for Docker registry").option("--force", "Force deploy the module, override manager field").action(async (opts) => {
-    let imagePullSecret;
-    if (opts.pullSecret && opts.pullSecret.length > 0 && (!opts.dockerServer || !opts.dockerUsername || !opts.dockerEmail || !opts.dockerPassword)) {
-      console.error(
-        "Error: Must provide docker server, username, email, and password when providing pull secret"
-      );
-      process.exit(1);
-    } else if (opts.pullSecret && opts.pullSecret !== sanitizeName(opts.pullSecret)) {
-      console.error(
-        "Invalid imagePullSecret name. Please provide a valid name as defined in RFC 1123."
-      );
+    const valResp = validateImagePullSecretDetails(opts);
+    if (!valResp.valid) {
+      console.error(valResp.error);
       process.exit(1);
-    } else if (opts.pullSecret) {
-      imagePullSecret = {
-        auths: {
-          [opts.dockerServer]: {
-            username: opts.dockerUsername,
-            password: opts.dockerPassword,
-            email: opts.dockerEmail,
-            auth: Buffer.from(`${opts.dockerUsername}:${opts.dockerPassword}`).toString("base64")
-          }
-        }
-      };
-      await deployImagePullSecret(imagePullSecret, opts.pullSecret);
+    }
+    if (opts.pullSecret) {
+      await deployImagePullSecret(generateImagePullSecret(opts), opts.pullSecret);
       return;
     }
-    if (!opts.confirm) {
-      const confirm2 = await (0, import_prompts.default)({
-        type: "confirm",
-        name: "confirm",
-        message: "This will remove and redeploy the module. Continue?"
-      });
-      if (!confirm2.confirm) {
-        process.exit(0);
-      }
+    await getUserConfirmation(opts) || process.exit(0);
+    const builtModule = await buildModule();
+    if (!builtModule) {
+      return;
     }
-    const buildModuleResult = await buildModule();
-    if (buildModuleResult?.cfg && buildModuleResult?.path) {
-      const { cfg, path } = buildModuleResult;
-      const webhook = new Assets(
-        {
-          ...cfg.pepr,
-          description: cfg.description
-        },
-        path
-      );
-      if (opts.image) {
-        webhook.image = opts.image;
-      }
-      const timeout = cfg.pepr.webhookTimeout ? cfg.pepr.webhookTimeout : 10;
-      try {
-        await webhook.deploy(opts.force, timeout);
-        validateCapabilityNames(webhook.capabilities);
-        await namespaceDeploymentsReady();
-        console.info(`\u2705 Module deployed successfully`);
-      } catch (e) {
-        console.error(`Error deploying module:`, e);
-        process.exit(1);
-      }
+    const webhook = new Assets(
+      { ...builtModule.cfg.pepr, description: builtModule.cfg.description },
+      builtModule.path
+    );
+    webhook.image = opts.image ?? webhook.image;
+    try {
+      await webhook.deploy(opts.force, builtModule.cfg.pepr.webhookTimeout ?? 10);
+      validateCapabilityNames(webhook.capabilities);
+      await namespaceDeploymentsReady();
+      console.info(`\u2705 Module deployed successfully`);
+    } catch (e) {
+      console.error(`Error deploying module:`, e);
+      process.exit(1);
     }
   });
 }
 
 // src/cli/dev.ts
-var import_child_process3 = require("child_process");
-var import_fs9 = require("fs");
+var import_child_process4 = require("child_process");
+var import_fs10 = require("fs");
 var import_prompts2 = __toESM(require("prompts"));
 var import_kubernetes_fluent_client5 = require("kubernetes-fluent-client");
 function dev_default(program2) {
@@ -2856,8 +2730,8 @@ function dev_default(program2) {
       path,
       opts.host
     );
-    await import_fs9.promises.writeFile("insecure-tls.crt", webhook.tls.pem.crt);
-    await import_fs9.promises.writeFile("insecure-tls.key", webhook.tls.pem.key);
+    await import_fs10.promises.writeFile("insecure-tls.crt", webhook.tls.pem.crt);
+    await import_fs10.promises.writeFile("insecure-tls.key", webhook.tls.pem.key);
     try {
       let program3;
       const name2 = `pepr-${cfg.pepr.uuid}`;
@@ -2872,7 +2746,7 @@ function dev_default(program2) {
           console.error(`Error validating capability names:`, e);
           process.exit(1);
         }
-        program3 = (0, import_child_process3.fork)(path, {
+        program3 = (0, import_child_process4.fork)(path, {
           env: {
             ...process.env,
             LOG_LEVEL: "debug",
@@ -2921,59 +2795,15 @@ var import_kubernetes_fluent_client6 = require("kubernetes-fluent-client");
 var import_stream = __toESM(require("stream"));
 function monitor_default(program2) {
   program2.command("monitor [module-uuid]").description("Monitor a Pepr Module").action(async (uuid) => {
-    let labels;
-    let errorMessage;
-    if (!uuid) {
-      labels = ["pepr.dev/controller", "admission"];
-      errorMessage = `No pods found with admission labels`;
-    } else {
-      labels = ["app", `pepr-${uuid}`];
-      errorMessage = `No pods found for module ${uuid}`;
-    }
+    const { labels, errorMessage } = getLabelsAndErrorMessage(uuid);
     const pods = await (0, import_kubernetes_fluent_client6.K8s)(import_kubernetes_fluent_client6.kind.Pod).InNamespace("pepr-system").WithLabel(labels[0], labels[1]).Get();
-    const podNames = pods.items.flatMap((pod) => pod.metadata.name);
+    const podNames = pods.items.flatMap((pod) => pod.metadata.name || "");
     if (podNames.length < 1) {
       console.error(errorMessage);
       process.exit(1);
     }
-    const kc = new import_client_node4.KubeConfig();
-    kc.loadFromDefault();
-    const log = new import_client_node4.Log(kc);
-    const logStream = new import_stream.default.PassThrough();
-    logStream.on("data", async (chunk) => {
-      const respMsg = `"msg":"Check response"`;
-      const lines = await chunk.toString().split("\n");
-      for (const line of lines) {
-        if (!line.includes(respMsg)) continue;
-        try {
-          const payload = JSON.parse(line.trim());
-          const isMutate = payload.res.patchType || payload.res.warnings;
-          const name2 = `${payload.namespace}${payload.name}`;
-          const uid = payload.res.uid;
-          if (isMutate) {
-            const plainPatch = payload.res?.patch !== void 0 && payload.res?.patch !== null ? atob(payload.res.patch) : "";
-            const patch = plainPatch !== "" && JSON.stringify(JSON.parse(plainPatch), null, 2);
-            const patchType = payload.res.patchType || payload.res.warnings || "";
-            const allowOrDeny = payload.res.allowed ? "\u{1F500}" : "\u{1F6AB}";
-            console.log(`
-${allowOrDeny}  MUTATE     ${name2} (${uid})`);
-            patchType.length > 0 && console.log(`
-\x1B[1;34m${patch}\x1B[0m`);
-          } else {
-            const failures = Array.isArray(payload.res) ? payload.res : [payload.res];
-            const filteredFailures = failures.filter((r) => !r.allowed).map((r) => r.status.message);
-            console.log(
-              `
-${filteredFailures.length > 0 ? "\u274C" : "\u2705"}  VALIDATE   ${name2} (${uid})`
-            );
-            console.log(
-              filteredFailures.length > 0 ? `\x1B[1;31m${filteredFailures}\x1B[0m` : ""
-            );
-          }
-        } catch {
-        }
-      }
-    });
+    const log = getK8sLogFromKubeConfig();
+    const logStream = createLogStream();
     for (const podName of podNames) {
       await log.log("pepr-system", podName, "server", logStream, {
         follow: true,
@@ -2983,23 +2813,90 @@ ${filteredFailures.length > 0 ? "\u274C" : "\u2705"}  VALIDATE   ${name2} (${uid
     }
   });
 }
+function getLabelsAndErrorMessage(uuid) {
+  let labels;
+  let errorMessage;
+  if (!uuid) {
+    labels = ["pepr.dev/controller", "admission"];
+    errorMessage = `No pods found with admission labels`;
+  } else {
+    labels = ["app", `pepr-${uuid}`];
+    errorMessage = `No pods found for module ${uuid}`;
+  }
+  return { labels, errorMessage };
+}
+function getK8sLogFromKubeConfig() {
+  const kc = new import_client_node4.KubeConfig();
+  kc.loadFromDefault();
+  return new import_client_node4.Log(kc);
+}
+function createLogStream() {
+  const logStream = new import_stream.default.PassThrough();
+  logStream.on("data", async (chunk) => {
+    const lines = chunk.toString().split("\n");
+    const respMsg = `"msg":"Check response"`;
+    for (const line of lines) {
+      if (!line.includes(respMsg)) continue;
+      processLogLine(line);
+    }
+  });
+  return logStream;
+}
+function processLogLine(line) {
+  try {
+    const payload = JSON.parse(line.trim());
+    const isMutate = payload.res.patchType || payload.res.warnings;
+    const name2 = `${payload.namespace}${payload.name}`;
+    const uid = payload.res.uid;
+    if (isMutate) {
+      processMutateLog(payload, name2, uid);
+    } else {
+      processValidateLog(payload, name2, uid);
+    }
+  } catch {
+  }
+}
+function processMutateLog(payload, name2, uid) {
+  const plainPatch = payload.res.patch !== void 0 && payload.res.patch !== null ? atob(payload.res.patch) : "";
+  const patch = plainPatch !== "" && JSON.stringify(JSON.parse(plainPatch), null, 2);
+  const patchType = payload.res.patchType || payload.res.warnings || "";
+  const allowOrDeny = payload.res.allowed ? "\u{1F500}" : "\u{1F6AB}";
+  console.log(`
+${allowOrDeny}  MUTATE     ${name2} (${uid})`);
+  if (patchType.length > 0) {
+    console.log(`
+\x1B[1;34m${patch}\x1B[0m`);
+  }
+}
+function processValidateLog(payload, name2, uid) {
+  const failures = Array.isArray(payload.res) ? payload.res : [payload.res];
+  const filteredFailures = failures.filter((r) => !r.allowed).map((r) => r.status?.message || "");
+  console.log(`
+${filteredFailures.length > 0 ? "\u274C" : "\u2705"}  VALIDATE   ${name2} (${uid})`);
+  if (filteredFailures.length > 0) {
+    console.log(`\x1B[1;31m${filteredFailures}\x1B[0m`);
+  }
+}
 
 // src/cli/init/index.ts
-var import_child_process4 = require("child_process");
-var import_path3 = require("path");
+var import_child_process5 = require("child_process");
+var import_path4 = require("path");
 var import_prompts4 = __toESM(require("prompts"));
 
 // src/cli/init/walkthrough.ts
-var import_fs10 = require("fs");
+var import_fs11 = require("fs");
 var import_prompts3 = __toESM(require("prompts"));
 
+// src/cli/init/enums.ts
+var OnError = /* @__PURE__ */ ((OnError2) => {
+  OnError2["AUDIT"] = "audit";
+  OnError2["IGNORE"] = "ignore";
+  OnError2["REJECT"] = "reject";
+  return OnError2;
+})(OnError || {});
+
 // src/lib/errors.ts
-var Errors = {
-  audit: "audit",
-  ignore: "ignore",
-  reject: "reject"
-};
-var ErrorList = Object.values(Errors);
+var ErrorList = Object.values(OnError);
 
 // src/cli/init/walkthrough.ts
 async function walkthrough(opts) {
@@ -3018,7 +2915,7 @@ async function setName(name2) {
     validate: async (val) => {
       try {
         const name3 = sanitizeName(val);
-        await import_fs10.promises.access(name3, import_fs10.promises.constants.F_OK);
+        await import_fs11.promises.access(name3, import_fs11.promises.constants.F_OK);
         return "A directory with this name already exists";
       } catch (e) {
         return val.length > 2 || "The name must be at least 3 characters long";
@@ -3055,18 +2952,18 @@ async function setErrorBehavior(errorBehavior) {
     choices: [
       {
         title: "Reject the operation",
-        value: Errors.reject,
+        value: "reject" /* REJECT */,
         description: "In the event that Pepr is down or other module errors occur, the operation will not be allowed to continue. (Recommended for production.)"
       },
       {
         title: "Ignore",
-        value: Errors.ignore,
+        value: "ignore" /* IGNORE */,
         description: "In the event that Pepr is down or other module errors occur, an entry will be generated in the Pepr Controller Log and the operation will be allowed to continue. (Recommended for development, not for production.)",
         selected: true
       },
       {
         title: "Log an audit event",
-        value: Errors.audit,
+        value: "audit" /* AUDIT */,
         description: "Pepr will continue processing and generate an entry in the Pepr Controller log as well as an audit event in the cluster."
       }
     ]
@@ -3114,7 +3011,7 @@ ${packageJSON2.print.replace(/^/gm, "    \u2502   ")}
 function init_default(program2) {
   let response = {};
   let pkgOverride = "";
-  program2.command("init").description("Initialize a new Pepr Module").option("--confirm", "Skip verification prompt when creating a new module.").option("--description <string>", "Explain the purpose of the new module.").option("--name <string>", "Set the name of the new module.").option("--skip-post-init", "Skip npm install, git init, and VSCode launch.").option(`--errorBehavior <${ErrorList.join("|")}>`, "Set an errorBehavior.", Errors.reject).hook("preAction", async (thisCommand) => {
+  program2.command("init").description("Initialize a new Pepr Module").option("--confirm", "Skip verification prompt when creating a new module.").option("--description <string>", "Explain the purpose of the new module.").option("--name <string>", "Set the name of the new module.").option("--skip-post-init", "Skip npm install, git init, and VSCode launch.").option(`--errorBehavior <${ErrorList.join("|")}>`, "Set an errorBehavior.", "reject" /* REJECT */).hook("preAction", async (thisCommand) => {
     if (process.env.TEST_MODE === "true") {
       import_prompts4.default.inject(["pepr-test-module", "A test module for Pepr", "ignore", "y"]);
       pkgOverride = "file:../pepr-0.0.0-development.tgz";
@@ -3132,19 +3029,19 @@ function init_default(program2) {
       console.log("Creating new Pepr module...");
       try {
         await createDir(dirName);
-        await createDir((0, import_path3.resolve)(dirName, ".vscode"));
-        await createDir((0, import_path3.resolve)(dirName, "capabilities"));
-        await write((0, import_path3.resolve)(dirName, gitignore.path), gitignore.data);
-        await write((0, import_path3.resolve)(dirName, eslint.path), eslint.data);
-        await write((0, import_path3.resolve)(dirName, prettier.path), prettier.data);
-        await write((0, import_path3.resolve)(dirName, packageJSON2.path), packageJSON2.data);
-        await write((0, import_path3.resolve)(dirName, readme.path), readme.data);
-        await write((0, import_path3.resolve)(dirName, tsConfig.path), tsConfig.data);
-        await write((0, import_path3.resolve)(dirName, peprTS3.path), peprTS3.data);
-        await write((0, import_path3.resolve)(dirName, ".vscode", snippet.path), snippet.data);
-        await write((0, import_path3.resolve)(dirName, ".vscode", codeSettings.path), codeSettings.data);
-        await write((0, import_path3.resolve)(dirName, "capabilities", samplesYaml.path), samplesYaml.data);
-        await write((0, import_path3.resolve)(dirName, "capabilities", helloPepr.path), helloPepr.data);
+        await createDir((0, import_path4.resolve)(dirName, ".vscode"));
+        await createDir((0, import_path4.resolve)(dirName, "capabilities"));
+        await write((0, import_path4.resolve)(dirName, gitignore.path), gitignore.data);
+        await write((0, import_path4.resolve)(dirName, eslint.path), eslint.data);
+        await write((0, import_path4.resolve)(dirName, prettier.path), prettier.data);
+        await write((0, import_path4.resolve)(dirName, packageJSON2.path), packageJSON2.data);
+        await write((0, import_path4.resolve)(dirName, readme.path), readme.data);
+        await write((0, import_path4.resolve)(dirName, tsConfig.path), tsConfig.data);
+        await write((0, import_path4.resolve)(dirName, peprTS3.path), peprTS3.data);
+        await write((0, import_path4.resolve)(dirName, ".vscode", snippet.path), snippet.data);
+        await write((0, import_path4.resolve)(dirName, ".vscode", codeSettings.path), codeSettings.data);
+        await write((0, import_path4.resolve)(dirName, "capabilities", samplesYaml.path), samplesYaml.data);
+        await write((0, import_path4.resolve)(dirName, "capabilities", helloPepr.path), helloPepr.data);
         if (!opts.skipPostInit) {
           doPostInitActions(dirName);
         }
@@ -3161,14 +3058,14 @@ function init_default(program2) {
 }
 var doPostInitActions = (dirName) => {
   process.chdir(dirName);
-  (0, import_child_process4.execSync)("npm install", {
+  (0, import_child_process5.execSync)("npm install", {
     stdio: "inherit"
   });
-  (0, import_child_process4.execSync)("git init --initial-branch=main", {
+  (0, import_child_process5.execSync)("git init --initial-branch=main", {
     stdio: "inherit"
   });
   try {
-    (0, import_child_process4.execSync)("code .", {
+    (0, import_child_process5.execSync)("code .", {
       stdio: "inherit"
     });
   } catch (e) {
@@ -3212,9 +3109,9 @@ var RootCmd = class extends import_commander2.Command {
 };
 
 // src/cli/update.ts
-var import_child_process5 = require("child_process");
-var import_fs11 = __toESM(require("fs"));
-var import_path4 = require("path");
+var import_child_process6 = require("child_process");
+var import_fs12 = __toESM(require("fs"));
+var import_path5 = require("path");
 var import_prompts5 = __toESM(require("prompts"));
 function update_default(program2) {
   program2.command("update").description("Update this Pepr module. Not recommended for prod as it may change files.").option("--skip-template-update", "Skip updating the template files").action(async (opts) => {
@@ -3230,11 +3127,11 @@ function update_default(program2) {
     }
     console.log("Updating the Pepr module...");
     try {
-      (0, import_child_process5.execSync)("npm install pepr@latest", {
+      (0, import_child_process6.execSync)("npm install pepr@latest", {
         stdio: "inherit"
       });
       if (!opts.skipTemplateUpdate) {
-        (0, import_child_process5.execSync)("npx pepr update-templates", {
+        (0, import_child_process6.execSync)("npx pepr update-templates", {
           stdio: "inherit"
         });
       }
@@ -3248,17 +3145,17 @@ function update_default(program2) {
     console.log("Updating Pepr config and template tiles...");
     try {
       if (!opts.skipTemplateUpdate) {
-        await write((0, import_path4.resolve)(prettier.path), prettier.data);
-        await write((0, import_path4.resolve)(tsConfig.path), tsConfig.data);
-        await write((0, import_path4.resolve)(".vscode", snippet.path), snippet.data);
-        await write((0, import_path4.resolve)(".vscode", codeSettings.path), codeSettings.data);
-        const samplePath = (0, import_path4.resolve)("capabilities", samplesYaml.path);
-        if (import_fs11.default.existsSync(samplePath)) {
-          import_fs11.default.unlinkSync(samplePath);
+        await write((0, import_path5.resolve)(prettier.path), prettier.data);
+        await write((0, import_path5.resolve)(tsConfig.path), tsConfig.data);
+        await write((0, import_path5.resolve)(".vscode", snippet.path), snippet.data);
+        await write((0, import_path5.resolve)(".vscode", codeSettings.path), codeSettings.data);
+        const samplePath = (0, import_path5.resolve)("capabilities", samplesYaml.path);
+        if (import_fs12.default.existsSync(samplePath)) {
+          import_fs12.default.unlinkSync(samplePath);
           await write(samplePath, samplesYaml.data);
         }
-        const tsPath = (0, import_path4.resolve)("capabilities", helloPepr.path);
-        if (import_fs11.default.existsSync(tsPath)) {
+        const tsPath = (0, import_path5.resolve)("capabilities", helloPepr.path);
+        if (import_fs12.default.existsSync(tsPath)) {
           await write(tsPath, helloPepr.data);
         }
       }
@@ -3270,7 +3167,7 @@ function update_default(program2) {
 }
 
 // src/cli/kfc.ts
-var import_child_process6 = require("child_process");
+var import_child_process7 = require("child_process");
 var import_prompts6 = __toESM(require("prompts"));
 function kfc_default(program2) {
   program2.command("kfc [args...]").description("Execute Kubernetes Fluent Client commands").action(async (args) => {
@@ -3287,7 +3184,7 @@ function kfc_default(program2) {
         args.push("--help");
       }
       const argsString = args.join(" ");
-      (0, import_child_process6.execSync)(`kubernetes-fluent-client ${argsString}`, {
+      (0, import_child_process7.execSync)(`kubernetes-fluent-client ${argsString}`, {
         stdio: "inherit"
       });
     } catch (e) {