pepr 0.46.3-nightly.7 → 0.46.3-nightly.9

package/dist/cli.js

@@ -433,8 +433,25 @@ async function createDirectoryIfNotExists(path) {
   }
 }
 
-// src/lib/assets/pods.ts
-var import_zlib = require("zlib");
+// src/lib/assets/envrionment.ts
+function genEnv(config, watchMode = false, ignoreWatchMode = false) {
+  const noWatchDef = {
+    PEPR_PRETTY_LOG: "false",
+    LOG_LEVEL: config.logLevel || "info"
+  };
+  const def = {
+    PEPR_WATCH_MODE: watchMode ? "true" : "false",
+    ...noWatchDef
+  };
+  if (config.env && config.env["PEPR_WATCH_MODE"]) {
+    delete config.env["PEPR_WATCH_MODE"];
+  }
+  const cfg = config.env || {};
+  return ignoreWatchMode ? Object.entries({ ...noWatchDef, ...cfg }).map(([name2, value]) => ({ name: name2, value })) : Object.entries({ ...def, ...cfg }).map(([name2, value]) => ({ name: name2, value }));
+}
+
+// src/lib/assets/yaml/overridesFile.ts
+var import_client_node = require("@kubernetes/client-node");
 
 // src/lib/telemetry/logger.ts
 var import_pino = require("pino");
@@ -631,500 +648,152 @@ function replaceString(str, stringA, stringB) {
   return str.replace(regExp, stringB);
 }
 
-// src/lib/assets/pods.ts
-function getNamespace(namespaceLabels) {
-  if (namespaceLabels) {
+// src/lib/assets/rbac.ts
+function clusterRole(name2, capabilities, rbacMode = "admin", customRbac) {
+  const rbacMap = createRBACMap(capabilities);
+  const scopedRules = Object.keys(rbacMap).map((key) => {
+    const group2 = key.split("/").length < 3 ? "" : key.split("/")[0];
     return {
-      apiVersion: "v1",
-      kind: "Namespace",
-      metadata: {
-        name: "pepr-system",
-        labels: namespaceLabels ?? {}
-      }
+      apiGroups: [group2],
+      resources: [rbacMap[key].plural],
+      verbs: rbacMap[key].verbs
     };
-  } else {
-    return {
-      apiVersion: "v1",
-      kind: "Namespace",
-      metadata: {
-        name: "pepr-system"
+  });
+  const mergedRBAC = [...Array.isArray(customRbac) ? customRbac : [], ...scopedRules];
+  const deduper = {};
+  mergedRBAC.forEach((rule) => {
+    const key = `${rule.apiGroups}/${rule.resources}`;
+    if (deduper[key]) {
+      deduper[key].verbs = Array.from(/* @__PURE__ */ new Set([...deduper[key].verbs, ...rule.verbs]));
+    } else {
+      deduper[key] = { ...rule, verbs: rule.verbs || [] };
+    }
+  });
+  const deduplicatedRules = Object.values(deduper);
+  return {
+    apiVersion: "rbac.authorization.k8s.io/v1",
+    kind: "ClusterRole",
+    metadata: { name: name2 },
+    rules: rbacMode === "scoped" ? deduplicatedRules : [
+      {
+        apiGroups: ["*"],
+        resources: ["*"],
+        verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
       }
-    };
-  }
+    ]
+  };
 }
-function getWatcher(assets, hash, buildTimestamp, imagePullSecret) {
-  const { name: name2, image, capabilities, config } = assets;
-  let hasSchedule = false;
-  const app = `${name2}-watcher`;
-  const bindings = [];
-  for (const capability of capabilities) {
-    if (capability.hasSchedule) {
-      hasSchedule = true;
-    }
-    const watchers = capability.bindings.filter((binding) => binding.isWatch);
-    bindings.push(...watchers);
-  }
-  if (bindings.length < 1 && !hasSchedule) {
-    return null;
-  }
-  const deploy = {
-    apiVersion: "apps/v1",
-    kind: "Deployment",
+function clusterRoleBinding(name2) {
+  return {
+    apiVersion: "rbac.authorization.k8s.io/v1",
+    kind: "ClusterRoleBinding",
+    metadata: { name: name2 },
+    roleRef: {
+      apiGroup: "rbac.authorization.k8s.io",
+      kind: "ClusterRole",
+      name: name2
+    },
+    subjects: [
+      {
+        kind: "ServiceAccount",
+        name: name2,
+        namespace: "pepr-system"
+      }
+    ]
+  };
+}
+function serviceAccount(name2) {
+  return {
+    apiVersion: "v1",
+    kind: "ServiceAccount",
     metadata: {
-      name: app,
-      namespace: "pepr-system",
+      name: name2,
+      namespace: "pepr-system"
+    }
+  };
+}
+function storeRole(name2) {
+  name2 = `${name2}-store`;
+  return {
+    apiVersion: "rbac.authorization.k8s.io/v1",
+    kind: "Role",
+    metadata: { name: name2, namespace: "pepr-system" },
+    rules: [
+      {
+        apiGroups: ["pepr.dev"],
+        resources: ["peprstores"],
+        resourceNames: [""],
+        verbs: ["create", "get", "patch", "watch"]
+      }
+    ]
+  };
+}
+function storeRoleBinding(name2) {
+  name2 = `${name2}-store`;
+  return {
+    apiVersion: "rbac.authorization.k8s.io/v1",
+    kind: "RoleBinding",
+    metadata: { name: name2, namespace: "pepr-system" },
+    roleRef: {
+      apiGroup: "rbac.authorization.k8s.io",
+      kind: "Role",
+      name: name2
+    },
+    subjects: [
+      {
+        kind: "ServiceAccount",
+        name: name2,
+        namespace: "pepr-system"
+      }
+    ]
+  };
+}
+
+// src/lib/assets/yaml/overridesFile.ts
+var import_fs2 = require("fs");
+async function overridesFile({ hash, name: name2, image, config, apiPath, capabilities }, path, imagePullSecrets) {
+  const rbacOverrides = clusterRole(name2, capabilities, config.rbacMode, config.rbac).rules;
+  const overrides = {
+    imagePullSecrets,
+    additionalIgnoredNamespaces: [],
+    rbac: rbacOverrides,
+    secrets: {
+      apiPath: Buffer.from(apiPath).toString("base64")
+    },
+    hash,
+    namespace: {
+      annotations: {},
+      labels: config.customLabels?.namespace ?? {
+        "pepr.dev": ""
+      }
+    },
+    uuid: name2,
+    admission: {
+      terminationGracePeriodSeconds: 5,
+      failurePolicy: config.onError === "reject" ? "Fail" : "Ignore",
+      webhookTimeout: config.webhookTimeout,
+      env: genEnv(config, false, true),
+      envFrom: [],
+      image,
       annotations: {
-        "pepr.dev/description": config.description || ""
+        "pepr.dev/description": `${config.description}` || ""
       },
       labels: {
-        app,
-        "pepr.dev/controller": "watcher",
+        app: name2,
+        "pepr.dev/controller": "admission",
         "pepr.dev/uuid": config.uuid
-      }
-    },
-    spec: {
-      replicas: 1,
-      strategy: {
-        type: "Recreate"
       },
-      selector: {
-        matchLabels: {
-          app,
-          "pepr.dev/controller": "watcher"
-        }
+      securityContext: {
+        runAsUser: 65532,
+        runAsGroup: 65532,
+        runAsNonRoot: true,
+        fsGroup: 65532
       },
-      template: {
-        metadata: {
-          annotations: {
-            buildTimestamp: `${buildTimestamp}`
-          },
-          labels: {
-            app,
-            "pepr.dev/controller": "watcher"
-          }
-        },
-        spec: {
-          terminationGracePeriodSeconds: 5,
-          serviceAccountName: name2,
-          securityContext: {
-            runAsUser: 65532,
-            runAsGroup: 65532,
-            runAsNonRoot: true,
-            fsGroup: 65532
-          },
-          containers: [
-            {
-              name: "watcher",
-              image,
-              imagePullPolicy: "IfNotPresent",
-              args: ["/app/node_modules/pepr/dist/controller.js", hash],
-              readinessProbe: {
-                httpGet: {
-                  path: "/healthz",
-                  port: 3e3,
-                  scheme: "HTTPS"
-                },
-                initialDelaySeconds: 10
-              },
-              livenessProbe: {
-                httpGet: {
-                  path: "/healthz",
-                  port: 3e3,
-                  scheme: "HTTPS"
-                },
-                initialDelaySeconds: 10
-              },
-              ports: [
-                {
-                  containerPort: 3e3
-                }
-              ],
-              resources: {
-                requests: {
-                  memory: "256Mi",
-                  cpu: "200m"
-                },
-                limits: {
-                  memory: "512Mi",
-                  cpu: "500m"
-                }
-              },
-              securityContext: {
-                runAsUser: 65532,
-                runAsGroup: 65532,
-                runAsNonRoot: true,
-                allowPrivilegeEscalation: false,
-                capabilities: {
-                  drop: ["ALL"]
-                }
-              },
-              volumeMounts: [
-                {
-                  name: "tls-certs",
-                  mountPath: "/etc/certs",
-                  readOnly: true
-                },
-                {
-                  name: "module",
-                  mountPath: `/app/load`,
-                  readOnly: true
-                }
-              ],
-              env: genEnv(config, true)
-            }
-          ],
-          volumes: [
-            {
-              name: "tls-certs",
-              secret: {
-                secretName: `${name2}-tls`
-              }
-            },
-            {
-              name: "module",
-              secret: {
-                secretName: `${name2}-module`
-              }
-            }
-          ]
-        }
-      }
-    }
-  };
-  if (imagePullSecret) {
-    deploy.spec.template.spec.imagePullSecrets = [{ name: imagePullSecret }];
-  }
-  return deploy;
-}
-function getDeployment(assets, hash, buildTimestamp, imagePullSecret) {
-  const { name: name2, image, config } = assets;
-  const app = name2;
-  const deploy = {
-    apiVersion: "apps/v1",
-    kind: "Deployment",
-    metadata: {
-      name: name2,
-      namespace: "pepr-system",
-      annotations: {
-        "pepr.dev/description": config.description || ""
-      },
-      labels: {
-        app,
-        "pepr.dev/controller": "admission",
-        "pepr.dev/uuid": config.uuid
-      }
-    },
-    spec: {
-      replicas: 2,
-      selector: {
-        matchLabels: {
-          app,
-          "pepr.dev/controller": "admission"
-        }
-      },
-      template: {
-        metadata: {
-          annotations: {
-            buildTimestamp: `${buildTimestamp}`
-          },
-          labels: {
-            app,
-            "pepr.dev/controller": "admission"
-          }
-        },
-        spec: {
-          terminationGracePeriodSeconds: 5,
-          priorityClassName: "system-node-critical",
-          serviceAccountName: name2,
-          securityContext: {
-            runAsUser: 65532,
-            runAsGroup: 65532,
-            runAsNonRoot: true,
-            fsGroup: 65532
-          },
-          containers: [
-            {
-              name: "server",
-              image,
-              imagePullPolicy: "IfNotPresent",
-              args: ["/app/node_modules/pepr/dist/controller.js", hash],
-              readinessProbe: {
-                httpGet: {
-                  path: "/healthz",
-                  port: 3e3,
-                  scheme: "HTTPS"
-                },
-                initialDelaySeconds: 10
-              },
-              livenessProbe: {
-                httpGet: {
-                  path: "/healthz",
-                  port: 3e3,
-                  scheme: "HTTPS"
-                },
-                initialDelaySeconds: 10
-              },
-              ports: [
-                {
-                  containerPort: 3e3
-                }
-              ],
-              resources: {
-                requests: {
-                  memory: "256Mi",
-                  cpu: "200m"
-                },
-                limits: {
-                  memory: "512Mi",
-                  cpu: "500m"
-                }
-              },
-              env: genEnv(config),
-              securityContext: {
-                runAsUser: 65532,
-                runAsGroup: 65532,
-                runAsNonRoot: true,
-                allowPrivilegeEscalation: false,
-                capabilities: {
-                  drop: ["ALL"]
-                }
-              },
-              volumeMounts: [
-                {
-                  name: "tls-certs",
-                  mountPath: "/etc/certs",
-                  readOnly: true
-                },
-                {
-                  name: "api-path",
-                  mountPath: "/app/api-path",
-                  readOnly: true
-                },
-                {
-                  name: "module",
-                  mountPath: `/app/load`,
-                  readOnly: true
-                }
-              ]
-            }
-          ],
-          volumes: [
-            {
-              name: "tls-certs",
-              secret: {
-                secretName: `${name2}-tls`
-              }
-            },
-            {
-              name: "api-path",
-              secret: {
-                secretName: `${name2}-api-path`
-              }
-            },
-            {
-              name: "module",
-              secret: {
-                secretName: `${name2}-module`
-              }
-            }
-          ]
-        }
-      }
-    }
-  };
-  if (imagePullSecret) {
-    deploy.spec.template.spec.imagePullSecrets = [{ name: imagePullSecret }];
-  }
-  return deploy;
-}
-function getModuleSecret(name2, data, hash) {
-  const compressed = (0, import_zlib.gzipSync)(data);
-  const path = `module-${hash}.js.gz`;
-  const compressedData = compressed.toString("base64");
-  if (secretOverLimit(compressedData)) {
-    const error = new Error(`Module secret for ${name2} is over the 1MB limit`);
-    console.error("Uncaught Exception:", error);
-    process.exit(1);
-  } else {
-    return {
-      apiVersion: "v1",
-      kind: "Secret",
-      metadata: {
-        name: `${name2}-module`,
-        namespace: "pepr-system"
-      },
-      type: "Opaque",
-      data: {
-        [path]: compressed.toString("base64")
-      }
-    };
-  }
-}
-function genEnv(config, watchMode = false, ignoreWatchMode = false) {
-  const noWatchDef = {
-    PEPR_PRETTY_LOG: "false",
-    LOG_LEVEL: config.logLevel || "info"
-  };
-  const def = {
-    PEPR_WATCH_MODE: watchMode ? "true" : "false",
-    ...noWatchDef
-  };
-  if (config.env && config.env["PEPR_WATCH_MODE"]) {
-    delete config.env["PEPR_WATCH_MODE"];
-  }
-  const cfg = config.env || {};
-  return ignoreWatchMode ? Object.entries({ ...noWatchDef, ...cfg }).map(([name2, value]) => ({ name: name2, value })) : Object.entries({ ...def, ...cfg }).map(([name2, value]) => ({ name: name2, value }));
-}
-
-// src/lib/assets/yaml/overridesFile.ts
-var import_client_node = require("@kubernetes/client-node");
-
-// src/lib/assets/rbac.ts
-function clusterRole(name2, capabilities, rbacMode = "admin", customRbac) {
-  const rbacMap = createRBACMap(capabilities);
-  const scopedRules = Object.keys(rbacMap).map((key) => {
-    const group2 = key.split("/").length < 3 ? "" : key.split("/")[0];
-    return {
-      apiGroups: [group2],
-      resources: [rbacMap[key].plural],
-      verbs: rbacMap[key].verbs
-    };
-  });
-  const mergedRBAC = [...Array.isArray(customRbac) ? customRbac : [], ...scopedRules];
-  const deduper = {};
-  mergedRBAC.forEach((rule) => {
-    const key = `${rule.apiGroups}/${rule.resources}`;
-    if (deduper[key]) {
-      deduper[key].verbs = Array.from(/* @__PURE__ */ new Set([...deduper[key].verbs, ...rule.verbs]));
-    } else {
-      deduper[key] = { ...rule, verbs: rule.verbs || [] };
-    }
-  });
-  const deduplicatedRules = Object.values(deduper);
-  return {
-    apiVersion: "rbac.authorization.k8s.io/v1",
-    kind: "ClusterRole",
-    metadata: { name: name2 },
-    rules: rbacMode === "scoped" ? deduplicatedRules : [
-      {
-        apiGroups: ["*"],
-        resources: ["*"],
-        verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
-      }
-    ]
-  };
-}
-function clusterRoleBinding(name2) {
-  return {
-    apiVersion: "rbac.authorization.k8s.io/v1",
-    kind: "ClusterRoleBinding",
-    metadata: { name: name2 },
-    roleRef: {
-      apiGroup: "rbac.authorization.k8s.io",
-      kind: "ClusterRole",
-      name: name2
-    },
-    subjects: [
-      {
-        kind: "ServiceAccount",
-        name: name2,
-        namespace: "pepr-system"
-      }
-    ]
-  };
-}
-function serviceAccount(name2) {
-  return {
-    apiVersion: "v1",
-    kind: "ServiceAccount",
-    metadata: {
-      name: name2,
-      namespace: "pepr-system"
-    }
-  };
-}
-function storeRole(name2) {
-  name2 = `${name2}-store`;
-  return {
-    apiVersion: "rbac.authorization.k8s.io/v1",
-    kind: "Role",
-    metadata: { name: name2, namespace: "pepr-system" },
-    rules: [
-      {
-        apiGroups: ["pepr.dev"],
-        resources: ["peprstores"],
-        resourceNames: [""],
-        verbs: ["create", "get", "patch", "watch"]
-      }
-    ]
-  };
-}
-function storeRoleBinding(name2) {
-  name2 = `${name2}-store`;
-  return {
-    apiVersion: "rbac.authorization.k8s.io/v1",
-    kind: "RoleBinding",
-    metadata: { name: name2, namespace: "pepr-system" },
-    roleRef: {
-      apiGroup: "rbac.authorization.k8s.io",
-      kind: "Role",
-      name: name2
-    },
-    subjects: [
-      {
-        kind: "ServiceAccount",
-        name: name2,
-        namespace: "pepr-system"
-      }
-    ]
-  };
-}
-
-// src/lib/assets/yaml/overridesFile.ts
-var import_fs2 = require("fs");
-async function overridesFile({ hash, name: name2, image, config, apiPath, capabilities }, path, imagePullSecrets) {
-  const rbacOverrides = clusterRole(name2, capabilities, config.rbacMode, config.rbac).rules;
-  const overrides = {
-    imagePullSecrets,
-    additionalIgnoredNamespaces: [],
-    rbac: rbacOverrides,
-    secrets: {
-      apiPath: Buffer.from(apiPath).toString("base64")
-    },
-    hash,
-    namespace: {
-      annotations: {},
-      labels: config.customLabels?.namespace ?? {
-        "pepr.dev": ""
-      }
-    },
-    uuid: name2,
-    admission: {
-      terminationGracePeriodSeconds: 5,
-      failurePolicy: config.onError === "reject" ? "Fail" : "Ignore",
-      webhookTimeout: config.webhookTimeout,
-      env: genEnv(config, false, true),
-      envFrom: [],
-      image,
-      annotations: {
-        "pepr.dev/description": `${config.description}` || ""
-      },
-      labels: {
-        app: name2,
-        "pepr.dev/controller": "admission",
-        "pepr.dev/uuid": config.uuid
-      },
-      securityContext: {
-        runAsUser: 65532,
-        runAsGroup: 65532,
-        runAsNonRoot: true,
-        fsGroup: 65532
-      },
-      readinessProbe: {
-        httpGet: {
-          path: "/healthz",
-          port: 3e3,
-          scheme: "HTTPS"
+      readinessProbe: {
+        httpGet: {
+          path: "/healthz",
+          port: 3e3,
+          scheme: "HTTPS"
         },
         initialDelaySeconds: 10
       },
@@ -1458,7 +1127,7 @@ var Assets = class {
   }
   zarfYaml = (zarfYamlGenerator, path) => zarfYamlGenerator(this, path, "manifests");
   zarfYamlChart = (zarfYamlGenerator, path) => zarfYamlGenerator(this, path, "charts");
-  allYaml = async (yamlGenerationFunction, imagePullSecret) => {
+  allYaml = async (yamlGenerationFunction, getDeploymentFunction, getWatcherFunction, imagePullSecret) => {
     this.capabilities = await loadCapabilities(this.path);
     for (const capability of this.capabilities) {
       namespaceComplianceValidator(capability, this.alwaysIgnore?.namespaces);
@@ -1466,8 +1135,8 @@ var Assets = class {
     const code = await import_fs3.promises.readFile(this.path);
     const moduleHash = import_crypto.default.createHash("sha256").update(code).digest("hex");
     const deployments = {
-      default: getDeployment(this, moduleHash, this.buildTimestamp, imagePullSecret),
-      watch: getWatcher(this, moduleHash, this.buildTimestamp, imagePullSecret)
+      default: getDeploymentFunction(this, moduleHash, this.buildTimestamp, imagePullSecret),
+      watch: getWatcherFunction(this, moduleHash, this.buildTimestamp, imagePullSecret)
     };
     return yamlGenerationFunction(this, deployments);
   };
@@ -1495,7 +1164,7 @@ var Assets = class {
       );
     }
   };
-  generateHelmChart = async (webhookGeneratorFunction, basePath) => {
+  generateHelmChart = async (webhookGeneratorFunction, getWatcherFunction, getModuleSecretFunction, basePath) => {
     const helm = helmLayout(basePath, this.config.uuid);
     try {
       await Promise.all(
@@ -1523,7 +1192,7 @@ var Assets = class {
         [helm.files.serviceAccountYaml, () => toYaml(serviceAccount(this.name))],
         [
           helm.files.moduleSecretYaml,
-          () => toYaml(getModuleSecret(this.name, code, moduleHash))
+          () => toYaml(getModuleSecretFunction(this.name, code, moduleHash))
         ]
       ];
       await Promise.all(pairs.map(async ([file, content]) => await import_fs3.promises.writeFile(file, content())));
@@ -1549,7 +1218,7 @@ var Assets = class {
         )
       };
       await this.writeWebhookFiles(webhooks.validate, webhooks.mutate, helm);
-      const watchDeployment = getWatcher(this, moduleHash, this.buildTimestamp);
+      const watchDeployment = getWatcherFunction(this, moduleHash, this.buildTimestamp);
       if (watchDeployment) {
         await import_fs3.promises.writeFile(
           helm.files.watcherDeploymentYaml,
@@ -1831,7 +1500,7 @@ var gitIgnore = "# Ignore node_modules and Pepr build artifacts\nnode_modules\nd
 var readmeMd = '# Pepr Module\n\nThis is a Pepr Module. [Pepr](https://github.com/defenseunicorns/pepr) is a type-safe Kubernetes middleware system.\n\nThe `capabilities` directory contains all the capabilities for this module. By default,\na capability is a single typescript file in the format of `capability-name.ts` that is\nimported in the root `pepr.ts` file as `import { HelloPepr } from "./capabilities/hello-pepr";`.\nBecause this is typescript, you can organize this however you choose, e.g. creating a sub-folder\nper-capability or common logic in shared files or folders.\n\nExample Structure:\n\n```\nModule Root\n\u251C\u2500\u2500 package.json\n\u251C\u2500\u2500 pepr.ts\n\u2514\u2500\u2500 capabilities\n    \u251C\u2500\u2500 example-one.ts\n    \u251C\u2500\u2500 example-three.ts\n    \u2514\u2500\u2500 example-two.ts\n```\n';
 var peprTS = 'import { PeprModule } from "pepr";\n// cfg loads your pepr configuration from package.json\nimport cfg from "./package.json";\n\n// HelloPepr is a demo capability that is included with Pepr. Comment or delete the line below to remove it.\nimport { HelloPepr } from "./capabilities/hello-pepr";\n\n/**\n * This is the main entrypoint for this Pepr module. It is run when the module is started.\n * This is where you register your Pepr configurations and capabilities.\n */\nnew PeprModule(cfg, [\n  // "HelloPepr" is a demo capability that is included with Pepr. Comment or delete the line below to remove it.\n  HelloPepr,\n\n  // Your additional capabilities go here\n]);\n';
 var helloPeprTS = 'import {\n  Capability,\n  K8s,\n  Log,\n  PeprMutateRequest,\n  RegisterKind,\n  a,\n  fetch,\n  fetchStatus,\n  kind,\n} from "pepr";\nimport { MockAgent, setGlobalDispatcher } from "undici";\n\n/**\n *  The HelloPepr Capability is an example capability to demonstrate some general concepts of Pepr.\n *  To test this capability you run `pepr dev`and then run the following command:\n *  `kubectl apply -f capabilities/hello-pepr.samples.yaml`\n */\nexport const HelloPepr = new Capability({\n  name: "hello-pepr",\n  description: "A simple example capability to show how things work.",\n  namespaces: ["pepr-demo", "pepr-demo-2"],\n});\n\n// Use the \'When\' function to create a new action, use \'Store\' to persist data\nconst { When, Store } = HelloPepr;\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Namespace)                                   *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action removes the label `remove-me` when a Namespace is created.\n * Note we don\'t need to specify the namespace here, because we\'ve already specified\n * it in the Capability definition above.\n */\nWhen(a.Namespace)\n  .IsCreated()\n  .Mutate(ns => ns.RemoveLabel("remove-me"));\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Watch Action with K8s SSA (Namespace)                           *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action watches for the `pepr-demo-2` namespace to be created, then creates a ConfigMap with\n * the name `pepr-ssa-demo` and adds the namespace UID to the ConfigMap data. Because Pepr uses\n * server-side apply for this operation, the ConfigMap will be created or updated if it already exists.\n */\nWhen(a.Namespace)\n  .IsCreated()\n  .WithName("pepr-demo-2")\n  .Watch(async ns => {\n    Log.info("Namespace pepr-demo-2 was created.");\n\n    try {\n      // Apply the ConfigMap using K8s server-side apply\n      await K8s(kind.ConfigMap).Apply({\n        metadata: {\n          name: "pepr-ssa-demo",\n          namespace: "pepr-demo-2",\n        },\n        data: {\n          "ns-uid": ns.metadata.uid,\n        },\n      });\n    } catch (error) {\n      // You can use the Log object to log messages to the Pepr controller pod\n      Log.error(error, "Failed to apply ConfigMap using server-side apply.");\n    }\n\n    // You can share data between actions using the Store, including between different types of actions\n    Store.setItem("watch-data", "This data was stored by a Watch Action.");\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 1)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This is a single action. They can be in the same file or put imported from other files.\n * In this example, when a ConfigMap is created with the name `example-1`, then add a label and annotation.\n *\n * Equivalent to manually running:\n * `kubectl label configmap example-1 pepr=was-here`\n * `kubectl annotate configmap example-1 pepr.dev=annotations-work-too`\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-1")\n  .Mutate(request => {\n    request.SetLabel("pepr", "was-here").SetAnnotation("pepr.dev", "annotations-work-too");\n\n    // Use the Store to persist data between requests and Pepr controller pods\n    Store.setItem("example-1", "was-here");\n\n    // This data is written asynchronously and can be read back via `Store.getItem()` or `Store.subscribe()`\n    Store.setItem("example-1-data", JSON.stringify(request.Raw.data));\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate & Validate Actions (CM Example 2)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This combines 3 different types of actions: \'Mutate\', \'Validate\', and \'Watch\'. The order\n * of the actions is required, but each action is optional. In this example, when a ConfigMap is created\n * with the name `example-2`, then add a label and annotation, validate that the ConfigMap has the label\n * `pepr`, and log the request.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-2")\n  .Mutate(request => {\n    // This Mutate Action will mutate the request before it is persisted to the cluster\n\n    // Use `request.Merge()` to merge the new data with the existing data\n    request.Merge({\n      metadata: {\n        labels: {\n          pepr: "was-here",\n        },\n        annotations: {\n          "pepr.dev": "annotations-work-too",\n        },\n      },\n    });\n  })\n  .Validate(request => {\n    // This Validate Action will validate the request before it is persisted to the cluster\n\n    // Approve the request if the ConfigMap has the label \'pepr\'\n    if (request.HasLabel("pepr")) {\n      return request.Approve();\n    }\n\n    // Otherwise, deny the request with an error message (optional)\n    return request.Deny("ConfigMap must have label \'pepr\'");\n  })\n  .Watch((cm, phase) => {\n    // This Watch Action will watch the ConfigMap after it has been persisted to the cluster\n    Log.info(cm, `ConfigMap was ${phase} with the name example-2`);\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 2a)                               *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action shows a simple validation that will deny any ConfigMap that has the\n * annotation `evil`. Note that the `Deny()` function takes an optional second parameter that is a\n * user-defined status code to return.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .Validate(request => {\n    if (request.HasAnnotation("evil")) {\n      return request.Deny("No evil CM annotations allowed.", 400);\n    }\n\n    return request.Approve();\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 3)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action combines different styles. Unlike the previous actions, this one will look\n * for any ConfigMap in the `pepr-demo` namespace that has the label `change=by-label` during either\n * CREATE or UPDATE. Note that all conditions added such as `WithName()`, `WithLabel()`, `InNamespace()`,\n * are ANDs so all conditions must be true for the request to be processed.\n */\nWhen(a.ConfigMap)\n  .IsCreatedOrUpdated()\n  .WithLabel("change", "by-label")\n  .Mutate(request => {\n    // The K8s object e are going to mutate\n    const cm = request.Raw;\n\n    // Get the username and uid of the K8s request\n    const { username, uid } = request.Request.userInfo;\n\n    // Store some data about the request in the configmap\n    cm.data["username"] = username;\n    cm.data["uid"] = uid;\n\n    // You can still mix other ways of making changes too\n    request.SetAnnotation("pepr.dev", "making-waves");\n  });\n\n// This action validates the label `change=by-label` is deleted\nWhen(a.ConfigMap)\n  .IsDeleted()\n  .WithLabel("change", "by-label")\n  .Validate(request => {\n    // Log and then always approve the request\n    Log.info("CM with label \'change=by-label\' was deleted.");\n    return request.Approve();\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 4)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action show how you can use the `Mutate()` function without an inline function.\n * This is useful if you want to keep your actions small and focused on a single task,\n * or if you want to reuse the same function in multiple actions.\n */\nWhen(a.ConfigMap).IsCreated().WithName("example-4").Mutate(example4Cb);\n\n// This function uses the complete type definition, but is not required.\nfunction example4Cb(cm: PeprMutateRequest<a.ConfigMap>) {\n  cm.SetLabel("pepr.dev/first", "true");\n  cm.SetLabel("pepr.dev/second", "true");\n  cm.SetLabel("pepr.dev/third", "true");\n}\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 4a)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This is the same as Example 4, except this only operates on a CM in the `pepr-demo-2` namespace.\n * Note because the Capability defines namespaces, the namespace specified here must be one of those.\n * Alternatively, you can remove the namespace from the Capability definition and specify it here.\n */\nWhen(a.ConfigMap).IsCreated().InNamespace("pepr-demo-2").WithName("example-4a").Mutate(example4Cb);\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 5)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action is a bit more complex. It will look for any ConfigMap in the `pepr-demo`\n * namespace that has the label `chuck-norris` during CREATE. When it finds one, it will fetch a\n * random Chuck Norris joke from the API and add it to the ConfigMap. This is a great example of how\n * you can use Pepr to make changes to your K8s objects based on external data.\n *\n * Note the use of the `async` keyword. This is required for any action that uses `await` or `fetch()`.\n *\n * Also note we are passing a type to the `fetch()` function. This is optional, but it will help you\n * avoid mistakes when working with the data returned from the API. You can also use the `as` keyword to\n * cast the data returned from the API.\n *\n * These are equivalent:\n * ```ts\n * const joke = await fetch<TheChuckNorrisJoke>("https://icanhazdadjoke.com/");\n * const joke = await fetch("https://icanhazdadjoke.com/") as TheChuckNorrisJoke;\n * ```\n *\n * Alternatively, you can drop the type completely:\n *\n * ```ts\n * fetch("https://icanhazdadjoke.com")\n * ```\n */\ninterface TheChuckNorrisJoke {\n  id: string;\n  joke: string;\n  status: number;\n}\n\nWhen(a.ConfigMap)\n  .IsCreatedOrUpdated()\n  .WithLabel("chuck-norris")\n  .Mutate(cm => cm.SetLabel("got-jokes", "true"))\n  .Watch(async cm => {\n    const jokeURL = "https://icanhazdadjoke.com";\n\n    const mockAgent: MockAgent = new MockAgent();\n    setGlobalDispatcher(mockAgent);\n    const mockClient = mockAgent.get(jokeURL);\n    mockClient.intercept({ path: "/", method: "GET" }).reply(\n      200,\n      {\n        id: "R7UfaahVfFd",\n        joke: "Funny joke goes here.",\n        status: 200,\n      },\n      {\n        headers: {\n          "Content-Type": "application/json; charset=utf-8",\n        },\n      },\n    );\n\n    // Try/catch is not needed as a response object will always be returned\n    const response = await fetch<TheChuckNorrisJoke>(jokeURL, {\n      headers: {\n        Accept: "application/json",\n      },\n    });\n\n    // Instead, check the `response.ok` field\n    if (response.ok) {\n      const { joke } = response.data;\n      // Add Joke to the Store\n      await Store.setItemAndWait(jokeURL, joke);\n      // Add the Chuck Norris joke to the configmap\n      try {\n        await K8s(kind.ConfigMap).Apply({\n          metadata: {\n            name: cm.metadata.name,\n            namespace: cm.metadata.namespace,\n          },\n          data: {\n            "chuck-says": Store.getItem(jokeURL),\n          },\n        });\n      } catch (error) {\n        Log.error(error, "Failed to apply ConfigMap using server-side apply.", {\n          cm,\n        });\n      }\n    }\n\n    // You can also assert on different HTTP response codes\n    if (response.status === fetchStatus.NOT_FOUND) {\n      // Do something else\n      return;\n    }\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Secret Base64 Handling)                      *\n * ---------------------------------------------------------------------------------------------------\n *\n * The K8s JS client provides incomplete support for base64 encoding/decoding handling for secrets,\n * unlike the GO client. To make this less painful, Pepr automatically handles base64 encoding/decoding\n * secret data before and after the action is executed.\n */\nWhen(a.Secret)\n  .IsCreated()\n  .WithName("secret-1")\n  .Mutate(request => {\n    const secret = request.Raw;\n\n    // This will be encoded at the end of all processing back to base64: "Y2hhbmdlLXdpdGhvdXQtZW5jb2Rpbmc="\n    secret.data.magic = "change-without-encoding";\n\n    // You can modify the data directly, and it will be encoded at the end of all processing\n    secret.data.example += " - modified by Pepr";\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Untyped Custom Resource)                     *\n * ---------------------------------------------------------------------------------------------------\n *\n * Out of the box, Pepr supports all the standard Kubernetes objects. However, you can also create\n * your own types. This is useful if you are working with an Operator that creates custom resources.\n * There are two ways to do this, the first is to use the `When()` function with a `GenericKind`,\n * the second is to create a new class that extends `GenericKind` and use the `RegisterKind()` function.\n *\n * This example shows how to use the `When()` function with a `GenericKind`. Note that you\n * must specify the `group`, `version`, and `kind` of the object (if applicable). This is how Pepr knows\n * if the action should be triggered or not. Since we are using a `GenericKind`,\n * Pepr will not be able to provide any intellisense for the object, so you will need to refer to the\n * Kubernetes API documentation for the object you are working with.\n *\n * You will need to wait for the CRD in `hello-pepr.samples.yaml` to be created, then you can apply\n *\n * ```yaml\n * apiVersion: pepr.dev/v1\n * kind: Unicorn\n * metadata:\n *   name: example-1\n *   namespace: pepr-demo\n * spec:\n *   message: replace-me\n *   counter: 0\n * ```\n */\nWhen(a.GenericKind, {\n  group: "pepr.dev",\n  version: "v1",\n  kind: "Unicorn",\n})\n  .IsCreated()\n  .WithName("example-1")\n  .Mutate(request => {\n    request.Merge({\n      spec: {\n        message: "Hello Pepr without type data!",\n        counter: Math.random(),\n      },\n    });\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Typed Custom Resource)                       *\n * ---------------------------------------------------------------------------------------------------\n *\n * This example shows how to use the `RegisterKind()` function to create a new type. This is useful\n * if you are working with an Operator that creates custom resources and you want to have intellisense\n * for the object. Note that you must specify the `group`, `version`, and `kind` of the object (if applicable)\n * as this is how Pepr knows if the action should be triggered or not.\n *\n * Once you register a new Kind with Pepr, you can use the `When()` function with the new Kind. Ideally,\n * you should register custom Kinds at the top of your Capability file or Pepr Module so they are available\n * to all actions, but we are putting it here for demonstration purposes.\n *\n * You will need to wait for the CRD in `hello-pepr.samples.yaml` to be created, then you can apply\n *\n * ```yaml\n * apiVersion: pepr.dev/v1\n * kind: Unicorn\n * metadata:\n *   name: example-2\n *   namespace: pepr-demo\n * spec:\n *   message: replace-me\n *   counter: 0\n * ```*\n */\nclass UnicornKind extends a.GenericKind {\n  spec: {\n    /**\n     * JSDoc comments can be added to explain more details about the field.\n     *\n     * @example\n     * ```ts\n     * request.Raw.spec.message = "Hello Pepr!";\n     * ```\n     * */\n    message: string;\n    counter: number;\n  };\n}\n\nRegisterKind(UnicornKind, {\n  group: "pepr.dev",\n  version: "v1",\n  kind: "Unicorn",\n});\n\nWhen(UnicornKind)\n  .IsCreated()\n  .WithName("example-2")\n  .Mutate(request => {\n    request.Merge({\n      spec: {\n        message: "Hello Pepr with type data!",\n        counter: Math.random(),\n      },\n    });\n  });\n\n/**\n * A callback function that is called once the Pepr Store is fully loaded.\n */\nStore.onReady(data => {\n  Log.info(data, "Pepr Store Ready");\n});\n';
-var packageJSON = { name: "pepr", description: "Kubernetes application engine", author: "Defense Unicorns", homepage: "https://github.com/defenseunicorns/pepr", license: "Apache-2.0", bin: "dist/cli.js", repository: "defenseunicorns/pepr", engines: { node: ">=18.0.0" }, files: ["/dist", "/src", "!src/**/*.test.ts", "!src/fixtures/**", "!dist/**/*.test.d.ts*"], version: "0.46.3-nightly.7", main: "dist/lib.js", types: "dist/lib.d.ts", scripts: { ci: "npm ci", "gen-data-json": "node hack/build-template-data.js", prebuild: "rm -fr dist/* && npm run gen-data-json", build: "tsc && node build.mjs && npm pack", "build:image": "npm run build && docker buildx build --output type=docker --tag pepr:dev .", "build:image:unicorn": "npm run build && docker buildx build --output type=docker --tag pepr:dev $(node scripts/read-unicorn-build-args.mjs) .", "set:version": "node scripts/set-version.js", test: "npm run test:unit && npm run test:journey && npm run test:journey-wasm", "test:artifacts": "npm run build && jest src/build-artifact.test.ts", "test:integration": "npm run test:integration:prep && npm run test:integration:run", "test:integration:prep": "./integration/prep.sh", "test:integration:run": "jest --maxWorkers=4 integration", "test:journey": "npm run test:journey:k3d && npm run build && npm run test:journey:image && npm run test:journey:run", "test:journey-wasm": "npm run test:journey:k3d && npm run build && npm run test:journey:image && npm run test:journey:run-wasm", "test:journey-wasm:unicorn": "npm run test:journey:k3d && npm run build && npm run test:journey:image:unicorn && npm run test:journey:run-wasm", "test:journey:image": "docker buildx build --output type=docker --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev", "test:journey:image:unicorn": "docker buildx build --output type=docker --tag pepr:dev $(node scripts/read-unicorn-build-args.mjs) . && k3d image import pepr:dev -c pepr-dev", "test:journey:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0' --wait && kubectl rollout status deployment -n kube-system", "test:journey:run": "jest --detectOpenHandles journey/entrypoint.test.ts && npm run test:journey:upgrade", "test:journey:run-wasm": "jest --detectOpenHandles journey/entrypoint-wasm.test.ts", "test:journey:unicorn": "npm run test:journey:k3d && npm run build && npm run test:journey:image:unicorn && npm run test:journey:run", "test:journey:upgrade": "npm run test:journey:k3d && npm run test:journey:image && jest --detectOpenHandles journey/pepr-upgrade.test.ts", "test:unit": "npm run gen-data-json && jest src --coverage --detectOpenHandles --coverageDirectory=./coverage --testPathIgnorePatterns='build-artifact.test.ts'", "format:check": "eslint src && prettier --config .prettierrc src --check", "format:fix": "eslint src --fix && prettier --config .prettierrc src --write", prepare: `if [ "$NODE_ENV" != 'production' ]; then husky; fi` }, dependencies: { "@types/ramda": "0.30.2", express: "4.21.2", "fast-json-patch": "3.1.1", heredoc: "^1.3.1", "http-status-codes": "^2.3.0", "json-pointer": "^0.6.2", "kubernetes-fluent-client": "3.4.5", pino: "9.6.0", "pino-pretty": "13.0.0", "prom-client": "15.1.3", ramda: "0.30.1", sigstore: "3.1.0" }, devDependencies: { "@commitlint/cli": "19.8.0", "@commitlint/config-conventional": "19.8.0", "@fast-check/jest": "^2.0.1", "@jest/globals": "29.7.0", "@types/eslint": "9.6.1", "@types/express": "5.0.1", "@types/json-pointer": "^1.0.34", "@types/node": "22.x.x", "@types/node-forge": "1.3.11", "@types/uuid": "10.0.0", "fast-check": "^4.0.0", globals: "^16.0.0", husky: "^9.1.6", jest: "29.7.0", "js-yaml": "^4.1.0", shellcheck: "^3.0.0", "ts-jest": "29.3.0", undici: "^7.0.1" }, overrides: { glob: "^9.0.0" }, peerDependencies: { "@types/prompts": "2.4.9", "@typescript-eslint/eslint-plugin": "8.23.0", "@typescript-eslint/parser": "8.23.0", commander: "13.1.0", esbuild: "0.25.0", eslint: "8.57.0", "node-forge": "1.3.1", prettier: "3.4.2", prompts: "2.4.2", typescript: "5.7.3", uuid: "11.0.5" } };
+var packageJSON = { name: "pepr", description: "Kubernetes application engine", author: "Defense Unicorns", homepage: "https://github.com/defenseunicorns/pepr", license: "Apache-2.0", bin: "dist/cli.js", repository: "defenseunicorns/pepr", engines: { node: ">=18.0.0" }, files: ["/dist", "/src", "!src/**/*.test.ts", "!src/fixtures/**", "!dist/**/*.test.d.ts*"], version: "0.46.3-nightly.9", main: "dist/lib.js", types: "dist/lib.d.ts", scripts: { ci: "npm ci", "gen-data-json": "node hack/build-template-data.js", prebuild: "rm -fr dist/* && npm run gen-data-json", build: "tsc && node build.mjs && npm pack", "build:image": "npm run build && docker buildx build --output type=docker --tag pepr:dev .", "build:image:unicorn": "npm run build && docker buildx build --output type=docker --tag pepr:dev $(node scripts/read-unicorn-build-args.mjs) .", "set:version": "node scripts/set-version.js", test: "npm run test:unit && npm run test:journey && npm run test:journey-wasm", "test:artifacts": "npm run build && jest src/build-artifact.test.ts", "test:integration": "npm run test:integration:prep && npm run test:integration:run", "test:integration:prep": "./integration/prep.sh", "test:integration:run": "jest --maxWorkers=4 integration", "test:journey": "npm run test:journey:k3d && npm run build && npm run test:journey:image && npm run test:journey:run", "test:journey-wasm": "npm run test:journey:k3d && npm run build && npm run test:journey:image && npm run test:journey:run-wasm", "test:journey-wasm:unicorn": "npm run test:journey:k3d && npm run build && npm run test:journey:image:unicorn && npm run test:journey:run-wasm", "test:journey:image": "docker buildx build --output type=docker --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev", "test:journey:image:unicorn": "docker buildx build --output type=docker --tag pepr:dev $(node scripts/read-unicorn-build-args.mjs) . && k3d image import pepr:dev -c pepr-dev", "test:journey:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0' --wait && kubectl rollout status deployment -n kube-system", "test:journey:run": "jest --detectOpenHandles journey/entrypoint.test.ts && npm run test:journey:upgrade", "test:journey:run-wasm": "jest --detectOpenHandles journey/entrypoint-wasm.test.ts", "test:journey:unicorn": "npm run test:journey:k3d && npm run build && npm run test:journey:image:unicorn && npm run test:journey:run", "test:journey:upgrade": "npm run test:journey:k3d && npm run test:journey:image && jest --detectOpenHandles journey/pepr-upgrade.test.ts", "test:unit": "npm run gen-data-json && jest src --coverage --detectOpenHandles --coverageDirectory=./coverage --testPathIgnorePatterns='build-artifact.test.ts'", "format:check": "eslint src && prettier --config .prettierrc src --check", "format:fix": "eslint src --fix && prettier --config .prettierrc src --write", prepare: `if [ "$NODE_ENV" != 'production' ]; then husky; fi` }, dependencies: { "@types/ramda": "0.30.2", express: "4.21.2", "fast-json-patch": "3.1.1", heredoc: "^1.3.1", "http-status-codes": "^2.3.0", "json-pointer": "^0.6.2", "kubernetes-fluent-client": "3.4.5", pino: "9.6.0", "pino-pretty": "13.0.0", "prom-client": "15.1.3", ramda: "0.30.1", sigstore: "3.1.0" }, devDependencies: { "@commitlint/cli": "19.8.0", "@commitlint/config-conventional": "19.8.0", "@fast-check/jest": "^2.0.1", "@jest/globals": "29.7.0", "@types/eslint": "9.6.1", "@types/express": "5.0.1", "@types/json-pointer": "^1.0.34", "@types/node": "22.x.x", "@types/node-forge": "1.3.11", "@types/uuid": "10.0.0", "fast-check": "^4.0.0", globals: "^16.0.0", husky: "^9.1.6", jest: "29.7.0", "js-yaml": "^4.1.0", shellcheck: "^3.0.0", "ts-jest": "29.3.0", undici: "^7.0.1" }, overrides: { glob: "^9.0.0" }, peerDependencies: { "@types/prompts": "2.4.9", "@typescript-eslint/eslint-plugin": "8.23.0", "@typescript-eslint/parser": "8.23.0", commander: "13.1.0", esbuild: "0.25.0", eslint: "8.57.0", "node-forge": "1.3.1", prettier: "3.4.2", prompts: "2.4.2", typescript: "5.7.3", uuid: "11.0.5" } };
 
 // src/cli/init/utils.ts
 var import_fs4 = require("fs");
@@ -1867,7 +1536,7 @@ function write(path, data) {
 // src/cli/init/templates.ts
 var { dependencies, devDependencies, peerDependencies, scripts, version } = packageJSON;
 function genPkgJSON(opts, pgkVerOverride) {
-  const uuid = !opts.uuid ? (0, import_uuid.v5)(opts.name, (0, import_uuid.v4)()) : opts.uuid;
+  const uuid = !opts.uuid ? (0, import_uuid.v4)() : opts.uuid;
   const name2 = sanitizeName(opts.name);
   const { typescript } = peerDependencies;
   const testEnv = {
@@ -1977,74 +1646,407 @@ async function formatWithPrettier(results, validateOnly) {
       await import_fs5.promises.writeFile(filePath, formatted);
     }
   }
-  return hasFailure;
-}
-
-// src/cli/format.ts
-function format_default(program2) {
-  program2.command("format").description("Lint and format this Pepr module").option("-v, --validate-only", "Do not modify files, only validate formatting").action(async (opts) => {
-    const success = await peprFormat(opts.validateOnly);
-    if (success) {
-      console.info("\u2705 Module formatted");
-    } else {
-      process.exit(1);
-    }
-  });
+  return hasFailure;
+}
+
+// src/cli/format.ts
+function format_default(program2) {
+  program2.command("format").description("Lint and format this Pepr module").option("-v, --validate-only", "Do not modify files, only validate formatting").action(async (opts) => {
+    const success = await peprFormat(opts.validateOnly);
+    if (success) {
+      console.info("\u2705 Module formatted");
+    } else {
+      process.exit(1);
+    }
+  });
+}
+async function peprFormat(validateOnly) {
+  {
+    try {
+      const eslint2 = new import_eslint.ESLint();
+      const results = await eslint2.lintFiles(["./**/*.ts"]);
+      let hasFailure = false;
+      results.forEach(async (result) => {
+        const errorCount = result.fatalErrorCount + result.errorCount;
+        if (errorCount > 0) {
+          hasFailure = true;
+        }
+      });
+      const formatter = await eslint2.loadFormatter("stylish");
+      const resultText = await formatter.format(results, {});
+      if (resultText) {
+        console.log(resultText);
+      }
+      if (!validateOnly) {
+        await import_eslint.ESLint.outputFixes(results);
+      }
+      hasFailure = await formatWithPrettier(results, validateOnly);
+      return !hasFailure;
+    } catch (e) {
+      console.error(`Error formatting module:`, e);
+      return false;
+    }
+  }
+}
+
+// src/lib/included-files.ts
+var import_fs6 = require("fs");
+async function createDockerfile(version3, description, includedFiles) {
+  const file = `
+    # Use an official Node.js runtime as the base image
+    FROM ghcr.io/defenseunicorns/pepr/controller:v${version3}
+  
+    LABEL description="${description}"
+    
+    # Add the included files to the image
+    ${includedFiles.map((f) => `ADD ${f} ${f}`).join("\n")}
+  
+    `;
+  await import_fs6.promises.writeFile("Dockerfile.controller", file, { encoding: "utf-8" });
+}
+
+// src/cli/build.helpers.ts
+var import_child_process2 = require("child_process");
+var import_esbuild = require("esbuild");
+var import_path2 = require("path");
+var import_fs8 = require("fs");
+
+// src/lib/assets/yaml/generateAllYaml.ts
+var import_crypto2 = __toESM(require("crypto"));
+var import_client_node4 = require("@kubernetes/client-node");
+
+// src/lib/assets/pods.ts
+var import_zlib = require("zlib");
+function getNamespace(namespaceLabels) {
+  if (namespaceLabels) {
+    return {
+      apiVersion: "v1",
+      kind: "Namespace",
+      metadata: {
+        name: "pepr-system",
+        labels: namespaceLabels ?? {}
+      }
+    };
+  } else {
+    return {
+      apiVersion: "v1",
+      kind: "Namespace",
+      metadata: {
+        name: "pepr-system"
+      }
+    };
+  }
+}
+function getWatcher(assets, hash, buildTimestamp, imagePullSecret) {
+  const { name: name2, image, capabilities, config } = assets;
+  let hasSchedule = false;
+  const app = `${name2}-watcher`;
+  const bindings = [];
+  for (const capability of capabilities) {
+    if (capability.hasSchedule) {
+      hasSchedule = true;
+    }
+    const watchers = capability.bindings.filter((binding) => binding.isWatch);
+    bindings.push(...watchers);
+  }
+  if (bindings.length < 1 && !hasSchedule) {
+    return null;
+  }
+  const deploy = {
+    apiVersion: "apps/v1",
+    kind: "Deployment",
+    metadata: {
+      name: app,
+      namespace: "pepr-system",
+      annotations: {
+        "pepr.dev/description": config.description || ""
+      },
+      labels: {
+        app,
+        "pepr.dev/controller": "watcher",
+        "pepr.dev/uuid": config.uuid
+      }
+    },
+    spec: {
+      replicas: 1,
+      strategy: {
+        type: "Recreate"
+      },
+      selector: {
+        matchLabels: {
+          app,
+          "pepr.dev/controller": "watcher"
+        }
+      },
+      template: {
+        metadata: {
+          annotations: {
+            buildTimestamp: `${buildTimestamp}`
+          },
+          labels: {
+            app,
+            "pepr.dev/controller": "watcher"
+          }
+        },
+        spec: {
+          terminationGracePeriodSeconds: 5,
+          serviceAccountName: name2,
+          securityContext: {
+            runAsUser: 65532,
+            runAsGroup: 65532,
+            runAsNonRoot: true,
+            fsGroup: 65532
+          },
+          containers: [
+            {
+              name: "watcher",
+              image,
+              imagePullPolicy: "IfNotPresent",
+              args: ["/app/node_modules/pepr/dist/controller.js", hash],
+              readinessProbe: {
+                httpGet: {
+                  path: "/healthz",
+                  port: 3e3,
+                  scheme: "HTTPS"
+                },
+                initialDelaySeconds: 10
+              },
+              livenessProbe: {
+                httpGet: {
+                  path: "/healthz",
+                  port: 3e3,
+                  scheme: "HTTPS"
+                },
+                initialDelaySeconds: 10
+              },
+              ports: [
+                {
+                  containerPort: 3e3
+                }
+              ],
+              resources: {
+                requests: {
+                  memory: "256Mi",
+                  cpu: "200m"
+                },
+                limits: {
+                  memory: "512Mi",
+                  cpu: "500m"
+                }
+              },
+              securityContext: {
+                runAsUser: 65532,
+                runAsGroup: 65532,
+                runAsNonRoot: true,
+                allowPrivilegeEscalation: false,
+                capabilities: {
+                  drop: ["ALL"]
+                }
+              },
+              volumeMounts: [
+                {
+                  name: "tls-certs",
+                  mountPath: "/etc/certs",
+                  readOnly: true
+                },
+                {
+                  name: "module",
+                  mountPath: `/app/load`,
+                  readOnly: true
+                }
+              ],
+              env: genEnv(config, true)
+            }
+          ],
+          volumes: [
+            {
+              name: "tls-certs",
+              secret: {
+                secretName: `${name2}-tls`
+              }
+            },
+            {
+              name: "module",
+              secret: {
+                secretName: `${name2}-module`
+              }
+            }
+          ]
+        }
+      }
+    }
+  };
+  if (imagePullSecret) {
+    deploy.spec.template.spec.imagePullSecrets = [{ name: imagePullSecret }];
+  }
+  return deploy;
 }
-async function peprFormat(validateOnly) {
-  {
-    try {
-      const eslint2 = new import_eslint.ESLint();
-      const results = await eslint2.lintFiles(["./**/*.ts"]);
-      let hasFailure = false;
-      results.forEach(async (result) => {
-        const errorCount = result.fatalErrorCount + result.errorCount;
-        if (errorCount > 0) {
-          hasFailure = true;
-        }
-      });
-      const formatter = await eslint2.loadFormatter("stylish");
-      const resultText = await formatter.format(results, {});
-      if (resultText) {
-        console.log(resultText);
+function getDeployment(assets, hash, buildTimestamp, imagePullSecret) {
+  const { name: name2, image, config } = assets;
+  const app = name2;
+  const deploy = {
+    apiVersion: "apps/v1",
+    kind: "Deployment",
+    metadata: {
+      name: name2,
+      namespace: "pepr-system",
+      annotations: {
+        "pepr.dev/description": config.description || ""
+      },
+      labels: {
+        app,
+        "pepr.dev/controller": "admission",
+        "pepr.dev/uuid": config.uuid
       }
-      if (!validateOnly) {
-        await import_eslint.ESLint.outputFixes(results);
+    },
+    spec: {
+      replicas: 2,
+      selector: {
+        matchLabels: {
+          app,
+          "pepr.dev/controller": "admission"
+        }
+      },
+      template: {
+        metadata: {
+          annotations: {
+            buildTimestamp: `${buildTimestamp}`
+          },
+          labels: {
+            app,
+            "pepr.dev/controller": "admission"
+          }
+        },
+        spec: {
+          terminationGracePeriodSeconds: 5,
+          priorityClassName: "system-node-critical",
+          serviceAccountName: name2,
+          securityContext: {
+            runAsUser: 65532,
+            runAsGroup: 65532,
+            runAsNonRoot: true,
+            fsGroup: 65532
+          },
+          containers: [
+            {
+              name: "server",
+              image,
+              imagePullPolicy: "IfNotPresent",
+              args: ["/app/node_modules/pepr/dist/controller.js", hash],
+              readinessProbe: {
+                httpGet: {
+                  path: "/healthz",
+                  port: 3e3,
+                  scheme: "HTTPS"
+                },
+                initialDelaySeconds: 10
+              },
+              livenessProbe: {
+                httpGet: {
+                  path: "/healthz",
+                  port: 3e3,
+                  scheme: "HTTPS"
+                },
+                initialDelaySeconds: 10
+              },
+              ports: [
+                {
+                  containerPort: 3e3
+                }
+              ],
+              resources: {
+                requests: {
+                  memory: "256Mi",
+                  cpu: "200m"
+                },
+                limits: {
+                  memory: "512Mi",
+                  cpu: "500m"
+                }
+              },
+              env: genEnv(config),
+              securityContext: {
+                runAsUser: 65532,
+                runAsGroup: 65532,
+                runAsNonRoot: true,
+                allowPrivilegeEscalation: false,
+                capabilities: {
+                  drop: ["ALL"]
+                }
+              },
+              volumeMounts: [
+                {
+                  name: "tls-certs",
+                  mountPath: "/etc/certs",
+                  readOnly: true
+                },
+                {
+                  name: "api-path",
+                  mountPath: "/app/api-path",
+                  readOnly: true
+                },
+                {
+                  name: "module",
+                  mountPath: `/app/load`,
+                  readOnly: true
+                }
+              ]
+            }
+          ],
+          volumes: [
+            {
+              name: "tls-certs",
+              secret: {
+                secretName: `${name2}-tls`
+              }
+            },
+            {
+              name: "api-path",
+              secret: {
+                secretName: `${name2}-api-path`
+              }
+            },
+            {
+              name: "module",
+              secret: {
+                secretName: `${name2}-module`
+              }
+            }
+          ]
+        }
       }
-      hasFailure = await formatWithPrettier(results, validateOnly);
-      return !hasFailure;
-    } catch (e) {
-      console.error(`Error formatting module:`, e);
-      return false;
     }
+  };
+  if (imagePullSecret) {
+    deploy.spec.template.spec.imagePullSecrets = [{ name: imagePullSecret }];
   }
+  return deploy;
 }
-
-// src/lib/included-files.ts
-var import_fs6 = require("fs");
-async function createDockerfile(version3, description, includedFiles) {
-  const file = `
-    # Use an official Node.js runtime as the base image
-    FROM ghcr.io/defenseunicorns/pepr/controller:v${version3}
-  
-    LABEL description="${description}"
-    
-    # Add the included files to the image
-    ${includedFiles.map((f) => `ADD ${f} ${f}`).join("\n")}
-  
-    `;
-  await import_fs6.promises.writeFile("Dockerfile.controller", file, { encoding: "utf-8" });
+function getModuleSecret(name2, data, hash) {
+  const compressed = (0, import_zlib.gzipSync)(data);
+  const path = `module-${hash}.js.gz`;
+  const compressedData = compressed.toString("base64");
+  if (secretOverLimit(compressedData)) {
+    const error = new Error(`Module secret for ${name2} is over the 1MB limit`);
+    console.error("Uncaught Exception:", error);
+    process.exit(1);
+  } else {
+    return {
+      apiVersion: "v1",
+      kind: "Secret",
+      metadata: {
+        name: `${name2}-module`,
+        namespace: "pepr-system"
+      },
+      type: "Opaque",
+      data: {
+        [path]: compressed.toString("base64")
+      }
+    };
+  }
 }
 
-// src/cli/build.helpers.ts
-var import_child_process2 = require("child_process");
-var import_esbuild = require("esbuild");
-var import_path2 = require("path");
-var import_fs8 = require("fs");
-
 // src/lib/assets/yaml/generateAllYaml.ts
-var import_crypto2 = __toESM(require("crypto"));
-var import_client_node4 = require("@kubernetes/client-node");
 var import_fs7 = require("fs");
 
 // src/lib/assets/webhooks.ts
@@ -2286,7 +2288,7 @@ async function generateYamlAndWriteToDisk(obj) {
   const yamlFile = `pepr-module-${uuid}.yaml`;
   const chartPath = `${uuid}-chart`;
   const yamlPath = (0, import_path2.resolve)(outputDir2, yamlFile);
-  const yaml = await assets.allYaml(generateAllYaml, imagePullSecret);
+  const yaml = await assets.allYaml(generateAllYaml, getDeployment, getWatcher, imagePullSecret);
   const zarfPath = (0, import_path2.resolve)(outputDir2, "zarf.yaml");
   let localZarf = "";
   if (zarf === "chart") {
@@ -2296,7 +2298,7 @@ async function generateYamlAndWriteToDisk(obj) {
   }
   await import_fs8.promises.writeFile(yamlPath, yaml);
   await import_fs8.promises.writeFile(zarfPath, localZarf);
-  await assets.generateHelmChart(webhookConfigGenerator, outputDir2);
+  await assets.generateHelmChart(webhookConfigGenerator, getWatcher, getModuleSecret, outputDir2);
   console.info(`\u2705 K8s resource for the module saved to ${yamlPath}`);
 }