pepr 0.47.0-nightly.0 → 0.47.0-nightly.10

package/dist/cli.js

@@ -1500,7 +1500,7 @@ var gitIgnore = "# Ignore node_modules and Pepr build artifacts\nnode_modules\nd
 var readmeMd = '# Pepr Module\n\nThis is a Pepr Module. [Pepr](https://github.com/defenseunicorns/pepr) is a type-safe Kubernetes middleware system.\n\nThe `capabilities` directory contains all the capabilities for this module. By default,\na capability is a single typescript file in the format of `capability-name.ts` that is\nimported in the root `pepr.ts` file as `import { HelloPepr } from "./capabilities/hello-pepr";`.\nBecause this is typescript, you can organize this however you choose, e.g. creating a sub-folder\nper-capability or common logic in shared files or folders.\n\nExample Structure:\n\n```\nModule Root\n\u251C\u2500\u2500 package.json\n\u251C\u2500\u2500 pepr.ts\n\u2514\u2500\u2500 capabilities\n    \u251C\u2500\u2500 example-one.ts\n    \u251C\u2500\u2500 example-three.ts\n    \u2514\u2500\u2500 example-two.ts\n```\n';
 var peprTS = 'import { PeprModule } from "pepr";\n// cfg loads your pepr configuration from package.json\nimport cfg from "./package.json";\n\n// HelloPepr is a demo capability that is included with Pepr. Comment or delete the line below to remove it.\nimport { HelloPepr } from "./capabilities/hello-pepr";\n\n/**\n * This is the main entrypoint for this Pepr module. It is run when the module is started.\n * This is where you register your Pepr configurations and capabilities.\n */\nnew PeprModule(cfg, [\n  // "HelloPepr" is a demo capability that is included with Pepr. Comment or delete the line below to remove it.\n  HelloPepr,\n\n  // Your additional capabilities go here\n]);\n';
 var helloPeprTS = 'import {\n  Capability,\n  K8s,\n  Log,\n  PeprMutateRequest,\n  RegisterKind,\n  a,\n  fetch,\n  fetchStatus,\n  kind,\n} from "pepr";\nimport { MockAgent, setGlobalDispatcher } from "undici";\n\n/**\n *  The HelloPepr Capability is an example capability to demonstrate some general concepts of Pepr.\n *  To test this capability you run `pepr dev`and then run the following command:\n *  `kubectl apply -f capabilities/hello-pepr.samples.yaml`\n */\nexport const HelloPepr = new Capability({\n  name: "hello-pepr",\n  description: "A simple example capability to show how things work.",\n  namespaces: ["pepr-demo", "pepr-demo-2"],\n});\n\n// Use the \'When\' function to create a new action, use \'Store\' to persist data\nconst { When, Store } = HelloPepr;\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Namespace)                                   *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action removes the label `remove-me` when a Namespace is created.\n * Note we don\'t need to specify the namespace here, because we\'ve already specified\n * it in the Capability definition above.\n */\nWhen(a.Namespace)\n  .IsCreated()\n  .Mutate(ns => ns.RemoveLabel("remove-me"));\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Watch Action with K8s SSA (Namespace)                           *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action watches for the `pepr-demo-2` namespace to be created, then creates a ConfigMap with\n * the name `pepr-ssa-demo` and adds the namespace UID to the ConfigMap data. Because Pepr uses\n * server-side apply for this operation, the ConfigMap will be created or updated if it already exists.\n */\nWhen(a.Namespace)\n  .IsCreated()\n  .WithName("pepr-demo-2")\n  .Watch(async ns => {\n    Log.info("Namespace pepr-demo-2 was created.");\n\n    try {\n      // Apply the ConfigMap using K8s server-side apply\n      await K8s(kind.ConfigMap).Apply({\n        metadata: {\n          name: "pepr-ssa-demo",\n          namespace: "pepr-demo-2",\n        },\n        data: {\n          "ns-uid": ns.metadata.uid,\n        },\n      });\n    } catch (error) {\n      // You can use the Log object to log messages to the Pepr controller pod\n      Log.error(error, "Failed to apply ConfigMap using server-side apply.");\n    }\n\n    // You can share data between actions using the Store, including between different types of actions\n    Store.setItem("watch-data", "This data was stored by a Watch Action.");\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 1)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This is a single action. They can be in the same file or put imported from other files.\n * In this example, when a ConfigMap is created with the name `example-1`, then add a label and annotation.\n *\n * Equivalent to manually running:\n * `kubectl label configmap example-1 pepr=was-here`\n * `kubectl annotate configmap example-1 pepr.dev=annotations-work-too`\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-1")\n  .Mutate(request => {\n    request.SetLabel("pepr", "was-here").SetAnnotation("pepr.dev", "annotations-work-too");\n\n    // Use the Store to persist data between requests and Pepr controller pods\n    Store.setItem("example-1", "was-here");\n\n    // This data is written asynchronously and can be read back via `Store.getItem()` or `Store.subscribe()`\n    Store.setItem("example-1-data", JSON.stringify(request.Raw.data));\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate & Validate Actions (CM Example 2)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This combines 3 different types of actions: \'Mutate\', \'Validate\', and \'Watch\'. The order\n * of the actions is required, but each action is optional. In this example, when a ConfigMap is created\n * with the name `example-2`, then add a label and annotation, validate that the ConfigMap has the label\n * `pepr`, and log the request.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-2")\n  .Mutate(request => {\n    // This Mutate Action will mutate the request before it is persisted to the cluster\n\n    // Use `request.Merge()` to merge the new data with the existing data\n    request.Merge({\n      metadata: {\n        labels: {\n          pepr: "was-here",\n        },\n        annotations: {\n          "pepr.dev": "annotations-work-too",\n        },\n      },\n    });\n  })\n  .Validate(request => {\n    // This Validate Action will validate the request before it is persisted to the cluster\n\n    // Approve the request if the ConfigMap has the label \'pepr\'\n    if (request.HasLabel("pepr")) {\n      return request.Approve();\n    }\n\n    // Otherwise, deny the request with an error message (optional)\n    return request.Deny("ConfigMap must have label \'pepr\'");\n  })\n  .Watch((cm, phase) => {\n    // This Watch Action will watch the ConfigMap after it has been persisted to the cluster\n    Log.info(cm, `ConfigMap was ${phase} with the name example-2`);\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 2a)                               *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action shows a simple validation that will deny any ConfigMap that has the\n * annotation `evil`. Note that the `Deny()` function takes an optional second parameter that is a\n * user-defined status code to return.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .Validate(request => {\n    if (request.HasAnnotation("evil")) {\n      return request.Deny("No evil CM annotations allowed.", 400);\n    }\n\n    return request.Approve();\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 3)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action combines different styles. Unlike the previous actions, this one will look\n * for any ConfigMap in the `pepr-demo` namespace that has the label `change=by-label` during either\n * CREATE or UPDATE. Note that all conditions added such as `WithName()`, `WithLabel()`, `InNamespace()`,\n * are ANDs so all conditions must be true for the request to be processed.\n */\nWhen(a.ConfigMap)\n  .IsCreatedOrUpdated()\n  .WithLabel("change", "by-label")\n  .Mutate(request => {\n    // The K8s object e are going to mutate\n    const cm = request.Raw;\n\n    // Get the username and uid of the K8s request\n    const { username, uid } = request.Request.userInfo;\n\n    // Store some data about the request in the configmap\n    cm.data["username"] = username;\n    cm.data["uid"] = uid;\n\n    // You can still mix other ways of making changes too\n    request.SetAnnotation("pepr.dev", "making-waves");\n  });\n\n// This action validates the label `change=by-label` is deleted\nWhen(a.ConfigMap)\n  .IsDeleted()\n  .WithLabel("change", "by-label")\n  .Validate(request => {\n    // Log and then always approve the request\n    Log.info("CM with label \'change=by-label\' was deleted.");\n    return request.Approve();\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 4)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action show how you can use the `Mutate()` function without an inline function.\n * This is useful if you want to keep your actions small and focused on a single task,\n * or if you want to reuse the same function in multiple actions.\n */\nWhen(a.ConfigMap).IsCreated().WithName("example-4").Mutate(example4Cb);\n\n// This function uses the complete type definition, but is not required.\nfunction example4Cb(cm: PeprMutateRequest<a.ConfigMap>) {\n  cm.SetLabel("pepr.dev/first", "true");\n  cm.SetLabel("pepr.dev/second", "true");\n  cm.SetLabel("pepr.dev/third", "true");\n}\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 4a)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This is the same as Example 4, except this only operates on a CM in the `pepr-demo-2` namespace.\n * Note because the Capability defines namespaces, the namespace specified here must be one of those.\n * Alternatively, you can remove the namespace from the Capability definition and specify it here.\n */\nWhen(a.ConfigMap).IsCreated().InNamespace("pepr-demo-2").WithName("example-4a").Mutate(example4Cb);\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 5)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action is a bit more complex. It will look for any ConfigMap in the `pepr-demo`\n * namespace that has the label `chuck-norris` during CREATE. When it finds one, it will fetch a\n * random Chuck Norris joke from the API and add it to the ConfigMap. This is a great example of how\n * you can use Pepr to make changes to your K8s objects based on external data.\n *\n * Note the use of the `async` keyword. This is required for any action that uses `await` or `fetch()`.\n *\n * Also note we are passing a type to the `fetch()` function. This is optional, but it will help you\n * avoid mistakes when working with the data returned from the API. You can also use the `as` keyword to\n * cast the data returned from the API.\n *\n * These are equivalent:\n * ```ts\n * const joke = await fetch<TheChuckNorrisJoke>("https://icanhazdadjoke.com/");\n * const joke = await fetch("https://icanhazdadjoke.com/") as TheChuckNorrisJoke;\n * ```\n *\n * Alternatively, you can drop the type completely:\n *\n * ```ts\n * fetch("https://icanhazdadjoke.com")\n * ```\n */\ninterface TheChuckNorrisJoke {\n  id: string;\n  joke: string;\n  status: number;\n}\n\nWhen(a.ConfigMap)\n  .IsCreatedOrUpdated()\n  .WithLabel("chuck-norris")\n  .Mutate(cm => cm.SetLabel("got-jokes", "true"))\n  .Watch(async cm => {\n    const jokeURL = "https://icanhazdadjoke.com";\n\n    const mockAgent: MockAgent = new MockAgent();\n    setGlobalDispatcher(mockAgent);\n    const mockClient = mockAgent.get(jokeURL);\n    mockClient.intercept({ path: "/", method: "GET" }).reply(\n      200,\n      {\n        id: "R7UfaahVfFd",\n        joke: "Funny joke goes here.",\n        status: 200,\n      },\n      {\n        headers: {\n          "Content-Type": "application/json; charset=utf-8",\n        },\n      },\n    );\n\n    // Try/catch is not needed as a response object will always be returned\n    const response = await fetch<TheChuckNorrisJoke>(jokeURL, {\n      headers: {\n        Accept: "application/json",\n      },\n    });\n\n    // Instead, check the `response.ok` field\n    if (response.ok) {\n      const { joke } = response.data;\n      // Add Joke to the Store\n      await Store.setItemAndWait(jokeURL, joke);\n      // Add the Chuck Norris joke to the configmap\n      try {\n        await K8s(kind.ConfigMap).Apply({\n          metadata: {\n            name: cm.metadata.name,\n            namespace: cm.metadata.namespace,\n          },\n          data: {\n            "chuck-says": Store.getItem(jokeURL),\n          },\n        });\n      } catch (error) {\n        Log.error(error, "Failed to apply ConfigMap using server-side apply.", {\n          cm,\n        });\n      }\n    }\n\n    // You can also assert on different HTTP response codes\n    if (response.status === fetchStatus.NOT_FOUND) {\n      // Do something else\n      return;\n    }\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Secret Base64 Handling)                      *\n * ---------------------------------------------------------------------------------------------------\n *\n * The K8s JS client provides incomplete support for base64 encoding/decoding handling for secrets,\n * unlike the GO client. To make this less painful, Pepr automatically handles base64 encoding/decoding\n * secret data before and after the action is executed.\n */\nWhen(a.Secret)\n  .IsCreated()\n  .WithName("secret-1")\n  .Mutate(request => {\n    const secret = request.Raw;\n\n    // This will be encoded at the end of all processing back to base64: "Y2hhbmdlLXdpdGhvdXQtZW5jb2Rpbmc="\n    secret.data.magic = "change-without-encoding";\n\n    // You can modify the data directly, and it will be encoded at the end of all processing\n    secret.data.example += " - modified by Pepr";\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Untyped Custom Resource)                     *\n * ---------------------------------------------------------------------------------------------------\n *\n * Out of the box, Pepr supports all the standard Kubernetes objects. However, you can also create\n * your own types. This is useful if you are working with an Operator that creates custom resources.\n * There are two ways to do this, the first is to use the `When()` function with a `GenericKind`,\n * the second is to create a new class that extends `GenericKind` and use the `RegisterKind()` function.\n *\n * This example shows how to use the `When()` function with a `GenericKind`. Note that you\n * must specify the `group`, `version`, and `kind` of the object (if applicable). This is how Pepr knows\n * if the action should be triggered or not. Since we are using a `GenericKind`,\n * Pepr will not be able to provide any intellisense for the object, so you will need to refer to the\n * Kubernetes API documentation for the object you are working with.\n *\n * You will need to wait for the CRD in `hello-pepr.samples.yaml` to be created, then you can apply\n *\n * ```yaml\n * apiVersion: pepr.dev/v1\n * kind: Unicorn\n * metadata:\n *   name: example-1\n *   namespace: pepr-demo\n * spec:\n *   message: replace-me\n *   counter: 0\n * ```\n */\nWhen(a.GenericKind, {\n  group: "pepr.dev",\n  version: "v1",\n  kind: "Unicorn",\n})\n  .IsCreated()\n  .WithName("example-1")\n  .Mutate(request => {\n    request.Merge({\n      spec: {\n        message: "Hello Pepr without type data!",\n        counter: Math.random(),\n      },\n    });\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Typed Custom Resource)                       *\n * ---------------------------------------------------------------------------------------------------\n *\n * This example shows how to use the `RegisterKind()` function to create a new type. This is useful\n * if you are working with an Operator that creates custom resources and you want to have intellisense\n * for the object. Note that you must specify the `group`, `version`, and `kind` of the object (if applicable)\n * as this is how Pepr knows if the action should be triggered or not.\n *\n * Once you register a new Kind with Pepr, you can use the `When()` function with the new Kind. Ideally,\n * you should register custom Kinds at the top of your Capability file or Pepr Module so they are available\n * to all actions, but we are putting it here for demonstration purposes.\n *\n * You will need to wait for the CRD in `hello-pepr.samples.yaml` to be created, then you can apply\n *\n * ```yaml\n * apiVersion: pepr.dev/v1\n * kind: Unicorn\n * metadata:\n *   name: example-2\n *   namespace: pepr-demo\n * spec:\n *   message: replace-me\n *   counter: 0\n * ```*\n */\nclass UnicornKind extends a.GenericKind {\n  spec: {\n    /**\n     * JSDoc comments can be added to explain more details about the field.\n     *\n     * @example\n     * ```ts\n     * request.Raw.spec.message = "Hello Pepr!";\n     * ```\n     * */\n    message: string;\n    counter: number;\n  };\n}\n\nRegisterKind(UnicornKind, {\n  group: "pepr.dev",\n  version: "v1",\n  kind: "Unicorn",\n});\n\nWhen(UnicornKind)\n  .IsCreated()\n  .WithName("example-2")\n  .Mutate(request => {\n    request.Merge({\n      spec: {\n        message: "Hello Pepr with type data!",\n        counter: Math.random(),\n      },\n    });\n  });\n\n/**\n * A callback function that is called once the Pepr Store is fully loaded.\n */\nStore.onReady(data => {\n  Log.info(data, "Pepr Store Ready");\n});\n';
-var packageJSON = { name: "pepr", description: "Kubernetes application engine", author: "Defense Unicorns", homepage: "https://github.com/defenseunicorns/pepr", license: "Apache-2.0", bin: "dist/cli.js", repository: "defenseunicorns/pepr", engines: { node: ">=18.0.0" }, files: ["/dist", "/src", "!src/**/*.test.ts", "!src/fixtures/**", "!dist/**/*.test.d.ts*"], version: "0.47.0-nightly.0", main: "dist/lib.js", types: "dist/lib.d.ts", scripts: { ci: "npm ci", "gen-data-json": "node hack/build-template-data.js", prebuild: "rm -fr dist/* && npm run gen-data-json", build: "tsc && node build.mjs && npm pack", "build:image": "npm run build && docker buildx build --output type=docker --tag pepr:dev .", "build:image:unicorn": "npm run build && docker buildx build --output type=docker --tag pepr:dev $(node scripts/read-unicorn-build-args.mjs) .", "set:version": "node scripts/set-version.js", test: "npm run test:unit && npm run test:journey && npm run test:journey-wasm", "test:artifacts": "npm run build && jest src/build-artifact.test.ts", "test:integration": "npm run test:integration:prep && npm run test:integration:run", "test:integration:prep": "./integration/prep.sh", "test:integration:run": "jest --maxWorkers=4 integration", "test:journey": "npm run test:journey:k3d && npm run build && npm run test:journey:image && npm run test:journey:run", "test:journey-wasm": "npm run test:journey:k3d && npm run build && npm run test:journey:image && npm run test:journey:run-wasm", "test:journey-wasm:unicorn": "npm run test:journey:k3d && npm run build && npm run test:journey:image:unicorn && npm run test:journey:run-wasm", "test:journey:image": "docker buildx build --output type=docker --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev", "test:journey:image:unicorn": "docker buildx build --output type=docker --tag pepr:dev $(node scripts/read-unicorn-build-args.mjs) . && k3d image import pepr:dev -c pepr-dev", "test:journey:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0' --wait && kubectl rollout status deployment -n kube-system", "test:journey:run": "jest --detectOpenHandles journey/entrypoint.test.ts && npm run test:journey:upgrade", "test:journey:run-wasm": "jest --detectOpenHandles journey/entrypoint-wasm.test.ts", "test:journey:unicorn": "npm run test:journey:k3d && npm run build && npm run test:journey:image:unicorn && npm run test:journey:run", "test:journey:upgrade": "npm run test:journey:k3d && npm run test:journey:image && jest --detectOpenHandles journey/pepr-upgrade.test.ts", "test:unit": "npm run gen-data-json && jest src --coverage --detectOpenHandles --coverageDirectory=./coverage --testPathIgnorePatterns='build-artifact.test.ts'", "format:check": "eslint src && prettier --config .prettierrc src --check", "format:fix": "eslint src --fix && prettier --config .prettierrc src --write", prepare: `if [ "$NODE_ENV" != 'production' ]; then husky; fi` }, dependencies: { "@types/ramda": "0.30.2", express: "5.1.0", "fast-json-patch": "3.1.1", heredoc: "^1.3.1", "http-status-codes": "^2.3.0", "json-pointer": "^0.6.2", "kubernetes-fluent-client": "3.4.6", pino: "9.6.0", "pino-pretty": "13.0.0", "prom-client": "15.1.3", ramda: "0.30.1", sigstore: "3.1.0" }, devDependencies: { "@commitlint/cli": "19.8.0", "@commitlint/config-conventional": "19.8.0", "@fast-check/jest": "^2.0.1", "@jest/globals": "29.7.0", "@types/eslint": "9.6.1", "@types/express": "5.0.1", "@types/json-pointer": "^1.0.34", "@types/node": "22.x.x", "@types/node-forge": "1.3.11", "@types/uuid": "10.0.0", "fast-check": "^4.0.0", globals: "^16.0.0", husky: "^9.1.6", jest: "29.7.0", "js-yaml": "^4.1.0", shellcheck: "^3.0.0", "ts-jest": "29.3.1", undici: "^7.0.1" }, overrides: { glob: "^9.0.0" }, peerDependencies: { "@types/prompts": "2.4.9", "@typescript-eslint/eslint-plugin": "8.23.0", "@typescript-eslint/parser": "8.23.0", commander: "13.1.0", esbuild: "0.25.0", eslint: "8.57.0", "node-forge": "1.3.1", prettier: "3.4.2", prompts: "2.4.2", typescript: "5.7.3", uuid: "11.0.5" } };
+var packageJSON = { name: "pepr", description: "Kubernetes application engine", author: "Defense Unicorns", homepage: "https://github.com/defenseunicorns/pepr", license: "Apache-2.0", bin: "dist/cli.js", repository: "defenseunicorns/pepr", engines: { node: ">=18.0.0" }, files: ["/dist", "/src", "!src/**/*.test.ts", "!src/fixtures/**", "!dist/**/*.test.d.ts*"], version: "0.47.0-nightly.10", main: "dist/lib.js", types: "dist/lib.d.ts", scripts: { ci: "npm ci", "gen-data-json": "node hack/build-template-data.js", prebuild: "rm -fr dist/* && npm run gen-data-json", build: "tsc && node build.mjs && npm pack", "build:image": "npm run build && docker buildx build --output type=docker --tag pepr:dev .", "build:image:unicorn": "npm run build && docker buildx build --output type=docker --tag pepr:dev $(node scripts/read-unicorn-build-args.mjs) .", "set:version": "node scripts/set-version.js", test: "npm run test:unit && npm run test:journey && npm run test:journey-wasm", "test:artifacts": "npm run build && jest src/build-artifact.test.ts", "test:integration": "npm run test:integration:prep && npm run test:integration:run", "test:integration:prep": "./integration/prep.sh", "test:integration:run": "jest --maxWorkers=4 integration", "test:journey": "npm run test:journey:k3d && npm run build && npm run test:journey:image && npm run test:journey:run", "test:journey-wasm": "npm run test:journey:k3d && npm run build && npm run test:journey:image && npm run test:journey:run-wasm", "test:journey-wasm:unicorn": "npm run test:journey:k3d && npm run build && npm run test:journey:image:unicorn && npm run test:journey:run-wasm", "test:journey:image": "docker buildx build --output type=docker --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev", "test:journey:image:unicorn": "npm run build && docker buildx build --output type=docker --tag pepr:dev $(node scripts/read-unicorn-build-args.mjs) . && k3d image import pepr:dev -c pepr-dev", "test:journey:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0' --wait && kubectl rollout status deployment -n kube-system", "test:journey:run": "jest --detectOpenHandles journey/entrypoint.test.ts && npm run test:journey:upgrade", "test:journey:run-wasm": "jest --detectOpenHandles journey/entrypoint-wasm.test.ts", "test:journey:unicorn": "npm run test:journey:k3d && npm run test:journey:image:unicorn && npm run test:journey:run", "test:journey:upgrade": "npm run test:journey:k3d && npm run test:journey:image && jest --detectOpenHandles journey/pepr-upgrade.test.ts", "test:unit": "npm run gen-data-json && jest src --coverage --detectOpenHandles --coverageDirectory=./coverage --testPathIgnorePatterns='build-artifact.test.ts'", "format:check": "eslint src && prettier --config .prettierrc src --check", "format:fix": "eslint src --fix && prettier --config .prettierrc src --write", prepare: `if [ "$NODE_ENV" != 'production' ]; then husky; fi` }, dependencies: { "@types/ramda": "0.30.2", express: "5.1.0", "fast-json-patch": "3.1.1", heredoc: "^1.3.1", "http-status-codes": "^2.3.0", "json-pointer": "^0.6.2", "kubernetes-fluent-client": "3.4.10", pino: "9.6.0", "pino-pretty": "13.0.0", "prom-client": "15.1.3", ramda: "0.30.1", sigstore: "3.1.0" }, devDependencies: { "@commitlint/cli": "19.8.0", "@commitlint/config-conventional": "19.8.0", "@fast-check/jest": "^2.0.1", "@jest/globals": "29.7.0", "@types/eslint": "9.6.1", "@types/express": "5.0.1", "@types/json-pointer": "^1.0.34", "@types/node": "22.x.x", "@types/node-forge": "1.3.11", "@types/uuid": "10.0.0", "fast-check": "^4.0.0", globals: "^16.0.0", husky: "^9.1.6", jest: "29.7.0", "js-yaml": "^4.1.0", shellcheck: "^3.0.0", "ts-jest": "29.3.1", undici: "^7.0.1" }, overrides: { glob: "^9.0.0" }, peerDependencies: { "@types/prompts": "2.4.9", "@typescript-eslint/eslint-plugin": "8.23.0", "@typescript-eslint/parser": "8.23.0", commander: "13.1.0", esbuild: "0.25.0", eslint: "8.57.0", "node-forge": "1.3.1", prettier: "3.4.2", prompts: "2.4.2", typescript: "5.7.3", uuid: "11.0.5" } };
 
 // src/cli/init/utils.ts
 var import_fs4 = require("fs");

package/dist/controller.js

@@ -51,7 +51,7 @@ if (process.env.LOG_LEVEL) {
 var logger_default = Log;
 
 // src/templates/data.json
-var packageJSON = { name: "pepr", description: "Kubernetes application engine", author: "Defense Unicorns", homepage: "https://github.com/defenseunicorns/pepr", license: "Apache-2.0", bin: "dist/cli.js", repository: "defenseunicorns/pepr", engines: { node: ">=18.0.0" }, files: ["/dist", "/src", "!src/**/*.test.ts", "!src/fixtures/**", "!dist/**/*.test.d.ts*"], version: "0.47.0-nightly.0", main: "dist/lib.js", types: "dist/lib.d.ts", scripts: { ci: "npm ci", "gen-data-json": "node hack/build-template-data.js", prebuild: "rm -fr dist/* && npm run gen-data-json", build: "tsc && node build.mjs && npm pack", "build:image": "npm run build && docker buildx build --output type=docker --tag pepr:dev .", "build:image:unicorn": "npm run build && docker buildx build --output type=docker --tag pepr:dev $(node scripts/read-unicorn-build-args.mjs) .", "set:version": "node scripts/set-version.js", test: "npm run test:unit && npm run test:journey && npm run test:journey-wasm", "test:artifacts": "npm run build && jest src/build-artifact.test.ts", "test:integration": "npm run test:integration:prep && npm run test:integration:run", "test:integration:prep": "./integration/prep.sh", "test:integration:run": "jest --maxWorkers=4 integration", "test:journey": "npm run test:journey:k3d && npm run build && npm run test:journey:image && npm run test:journey:run", "test:journey-wasm": "npm run test:journey:k3d && npm run build && npm run test:journey:image && npm run test:journey:run-wasm", "test:journey-wasm:unicorn": "npm run test:journey:k3d && npm run build && npm run test:journey:image:unicorn && npm run test:journey:run-wasm", "test:journey:image": "docker buildx build --output type=docker --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev", "test:journey:image:unicorn": "docker buildx build --output type=docker --tag pepr:dev $(node scripts/read-unicorn-build-args.mjs) . && k3d image import pepr:dev -c pepr-dev", "test:journey:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0' --wait && kubectl rollout status deployment -n kube-system", "test:journey:run": "jest --detectOpenHandles journey/entrypoint.test.ts && npm run test:journey:upgrade", "test:journey:run-wasm": "jest --detectOpenHandles journey/entrypoint-wasm.test.ts", "test:journey:unicorn": "npm run test:journey:k3d && npm run build && npm run test:journey:image:unicorn && npm run test:journey:run", "test:journey:upgrade": "npm run test:journey:k3d && npm run test:journey:image && jest --detectOpenHandles journey/pepr-upgrade.test.ts", "test:unit": "npm run gen-data-json && jest src --coverage --detectOpenHandles --coverageDirectory=./coverage --testPathIgnorePatterns='build-artifact.test.ts'", "format:check": "eslint src && prettier --config .prettierrc src --check", "format:fix": "eslint src --fix && prettier --config .prettierrc src --write", prepare: `if [ "$NODE_ENV" != 'production' ]; then husky; fi` }, dependencies: { "@types/ramda": "0.30.2", express: "5.1.0", "fast-json-patch": "3.1.1", heredoc: "^1.3.1", "http-status-codes": "^2.3.0", "json-pointer": "^0.6.2", "kubernetes-fluent-client": "3.4.6", pino: "9.6.0", "pino-pretty": "13.0.0", "prom-client": "15.1.3", ramda: "0.30.1", sigstore: "3.1.0" }, devDependencies: { "@commitlint/cli": "19.8.0", "@commitlint/config-conventional": "19.8.0", "@fast-check/jest": "^2.0.1", "@jest/globals": "29.7.0", "@types/eslint": "9.6.1", "@types/express": "5.0.1", "@types/json-pointer": "^1.0.34", "@types/node": "22.x.x", "@types/node-forge": "1.3.11", "@types/uuid": "10.0.0", "fast-check": "^4.0.0", globals: "^16.0.0", husky: "^9.1.6", jest: "29.7.0", "js-yaml": "^4.1.0", shellcheck: "^3.0.0", "ts-jest": "29.3.1", undici: "^7.0.1" }, overrides: { glob: "^9.0.0" }, peerDependencies: { "@types/prompts": "2.4.9", "@typescript-eslint/eslint-plugin": "8.23.0", "@typescript-eslint/parser": "8.23.0", commander: "13.1.0", esbuild: "0.25.0", eslint: "8.57.0", "node-forge": "1.3.1", prettier: "3.4.2", prompts: "2.4.2", typescript: "5.7.3", uuid: "11.0.5" } };
+var packageJSON = { name: "pepr", description: "Kubernetes application engine", author: "Defense Unicorns", homepage: "https://github.com/defenseunicorns/pepr", license: "Apache-2.0", bin: "dist/cli.js", repository: "defenseunicorns/pepr", engines: { node: ">=18.0.0" }, files: ["/dist", "/src", "!src/**/*.test.ts", "!src/fixtures/**", "!dist/**/*.test.d.ts*"], version: "0.47.0-nightly.10", main: "dist/lib.js", types: "dist/lib.d.ts", scripts: { ci: "npm ci", "gen-data-json": "node hack/build-template-data.js", prebuild: "rm -fr dist/* && npm run gen-data-json", build: "tsc && node build.mjs && npm pack", "build:image": "npm run build && docker buildx build --output type=docker --tag pepr:dev .", "build:image:unicorn": "npm run build && docker buildx build --output type=docker --tag pepr:dev $(node scripts/read-unicorn-build-args.mjs) .", "set:version": "node scripts/set-version.js", test: "npm run test:unit && npm run test:journey && npm run test:journey-wasm", "test:artifacts": "npm run build && jest src/build-artifact.test.ts", "test:integration": "npm run test:integration:prep && npm run test:integration:run", "test:integration:prep": "./integration/prep.sh", "test:integration:run": "jest --maxWorkers=4 integration", "test:journey": "npm run test:journey:k3d && npm run build && npm run test:journey:image && npm run test:journey:run", "test:journey-wasm": "npm run test:journey:k3d && npm run build && npm run test:journey:image && npm run test:journey:run-wasm", "test:journey-wasm:unicorn": "npm run test:journey:k3d && npm run build && npm run test:journey:image:unicorn && npm run test:journey:run-wasm", "test:journey:image": "docker buildx build --output type=docker --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev", "test:journey:image:unicorn": "npm run build && docker buildx build --output type=docker --tag pepr:dev $(node scripts/read-unicorn-build-args.mjs) . && k3d image import pepr:dev -c pepr-dev", "test:journey:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0' --wait && kubectl rollout status deployment -n kube-system", "test:journey:run": "jest --detectOpenHandles journey/entrypoint.test.ts && npm run test:journey:upgrade", "test:journey:run-wasm": "jest --detectOpenHandles journey/entrypoint-wasm.test.ts", "test:journey:unicorn": "npm run test:journey:k3d && npm run test:journey:image:unicorn && npm run test:journey:run", "test:journey:upgrade": "npm run test:journey:k3d && npm run test:journey:image && jest --detectOpenHandles journey/pepr-upgrade.test.ts", "test:unit": "npm run gen-data-json && jest src --coverage --detectOpenHandles --coverageDirectory=./coverage --testPathIgnorePatterns='build-artifact.test.ts'", "format:check": "eslint src && prettier --config .prettierrc src --check", "format:fix": "eslint src --fix && prettier --config .prettierrc src --write", prepare: `if [ "$NODE_ENV" != 'production' ]; then husky; fi` }, dependencies: { "@types/ramda": "0.30.2", express: "5.1.0", "fast-json-patch": "3.1.1", heredoc: "^1.3.1", "http-status-codes": "^2.3.0", "json-pointer": "^0.6.2", "kubernetes-fluent-client": "3.4.10", pino: "9.6.0", "pino-pretty": "13.0.0", "prom-client": "15.1.3", ramda: "0.30.1", sigstore: "3.1.0" }, devDependencies: { "@commitlint/cli": "19.8.0", "@commitlint/config-conventional": "19.8.0", "@fast-check/jest": "^2.0.1", "@jest/globals": "29.7.0", "@types/eslint": "9.6.1", "@types/express": "5.0.1", "@types/json-pointer": "^1.0.34", "@types/node": "22.x.x", "@types/node-forge": "1.3.11", "@types/uuid": "10.0.0", "fast-check": "^4.0.0", globals: "^16.0.0", husky: "^9.1.6", jest: "29.7.0", "js-yaml": "^4.1.0", shellcheck: "^3.0.0", "ts-jest": "29.3.1", undici: "^7.0.1" }, overrides: { glob: "^9.0.0" }, peerDependencies: { "@types/prompts": "2.4.9", "@typescript-eslint/eslint-plugin": "8.23.0", "@typescript-eslint/parser": "8.23.0", commander: "13.1.0", esbuild: "0.25.0", eslint: "8.57.0", "node-forge": "1.3.1", prettier: "3.4.2", prompts: "2.4.2", typescript: "5.7.3", uuid: "11.0.5" } };
 
 // src/lib/k8s.ts
 var import_kubernetes_fluent_client = require("kubernetes-fluent-client");

package/dist/lib/controller/migrateStore.d.ts

@@ -0,0 +1,11 @@
+import { Storage } from "../core/storage";
+import { Store } from "../k8s";
+export interface StoreMigration {
+    name: string;
+    namespace: string;
+    store: Store;
+    stores: Record<string, Storage>;
+    setupWatch: () => void;
+}
+export declare function migrateAndSetupWatch(storeData: StoreMigration): Promise<void>;
+//# sourceMappingURL=migrateStore.d.ts.map

package/dist/lib/controller/migrateStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrateStore.d.ts","sourceRoot":"","sources":["../../../src/lib/controller/migrateStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAIrD,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAI/B,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,KAAK,CAAC;IACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,UAAU,EAAE,MAAM,IAAI,CAAC;CACxB;AAED,wBAAsB,oBAAoB,CAAC,SAAS,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAuCnF"}

package/dist/lib/controller/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/lib/controller/store.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAUhD,qBAAa,eAAe;;gBAMd,YAAY,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,IAAI;CA0K3E"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/lib/controller/store.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAWhD,qBAAa,eAAe;;gBAMd,YAAY,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,IAAI;CA4I3E"}

package/dist/lib/processors/watch-processor.d.ts

@@ -1,3 +1,4 @@
+import { Binding } from "../types";
 import { Capability } from "../core/capability";
 import { KubernetesObject, WatchEvent, GenericClass } from "kubernetes-fluent-client";
 import { Queue } from "../core/queue";
@@ -18,6 +19,13 @@ export declare function getOrCreateQueue(obj: KubernetesObject): Queue<Kubernete
  * @param capabilities The capabilities to load watches for
  */
 export declare function setupWatch(capabilities: Capability[], ignoredNamespaces?: string[]): void;
+/**
+ * Setup a watch for a binding
+ *
+ * @param binding the binding to watch
+ * @param capabilityNamespaces list of namespaces to filter on
+ */
+export declare function runBinding(binding: Binding, capabilityNamespaces: string[], ignoredNamespaces?: string[]): Promise<void>;
 export declare function logEvent(event: WatchEvent, message?: string, obj?: KubernetesObject): void;
 export type WatchEventArgs<K extends WatchEvent, T extends GenericClass> = {
     [WatchEvent.LIST]: KubernetesListObject<InstanceType<T>>;

package/dist/lib/processors/watch-processor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"watch-processor.d.ts","sourceRoot":"","sources":["../../../src/lib/processors/watch-processor.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAEL,gBAAgB,EAEhB,UAAU,EACV,YAAY,EACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAc,WAAW,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAE3E,OAAO,EAAoB,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAMlF;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,CAkBtD;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAC,CAM/E;AA2BD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,YAAY,EAAE,UAAU,EAAE,EAAE,iBAAiB,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAQzF;AAuGD,wBAAgB,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,GAAE,MAAW,EAAE,GAAG,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAO9F;AAED,MAAM,MAAM,cAAc,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,YAAY,IAAI;IACzE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC/B,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAChC,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IACrC,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC;IAC5B,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IAC1B,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC1C,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC;IAClC,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC;IAC/B,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC;IAC/B,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC7B,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,SAAS,CAAC;IAC1C,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAC7B,CAAC,UAAU,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;CAC/C,CAAC,CAAC,CAAC,CAAC;AAEL,MAAM,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;AAC7E,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,WAAW,CAAC,YAAY,CAAC,EAClC,QAAQ,EAAE,gBAAgB,EAC1B,gBAAgB,EAAE,wBAAwB,GACzC,IAAI,CAgCN"}
+{"version":3,"file":"watch-processor.d.ts","sourceRoot":"","sources":["../../../src/lib/processors/watch-processor.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,OAAO,EAEL,gBAAgB,EAEhB,UAAU,EACV,YAAY,EACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAc,WAAW,EAAE,MAAM,4CAA4C,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAE3E,OAAO,EAAoB,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAMlF;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,gBAAgB,GAAG,MAAM,CAkBtD;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAC,CAM/E;AA2BD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,YAAY,EAAE,UAAU,EAAE,EAAE,iBAAiB,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAMzF;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,OAAO,EAChB,oBAAoB,EAAE,MAAM,EAAE,EAC9B,iBAAiB,CAAC,EAAE,MAAM,EAAE,GAC3B,OAAO,CAAC,IAAI,CAAC,CA+Ff;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,GAAE,MAAW,EAAE,GAAG,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAO9F;AAED,MAAM,MAAM,cAAc,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,YAAY,IAAI;IACzE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,oBAAoB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC/B,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAChC,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IACrC,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC;IAC5B,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IAC1B,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC1C,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC;IAClC,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC;IAC/B,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC;IAC/B,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC7B,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,SAAS,CAAC;IAC1C,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAC7B,CAAC,UAAU,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;CAC/C,CAAC,CAAC,CAAC,CAAC;AAEL,MAAM,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;AAC7E,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,WAAW,CAAC,YAAY,CAAC,EAClC,QAAQ,EAAE,gBAAgB,EAC1B,gBAAgB,EAAE,wBAAwB,GACzC,IAAI,CAmCN"}

package/dist/lib.js

@@ -31,22 +31,22 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var lib_exports = {};
 __export(lib_exports, {
   Capability: () => Capability,
-  K8s: () => import_kubernetes_fluent_client8.K8s,
+  K8s: () => import_kubernetes_fluent_client9.K8s,
   Log: () => logger_default,
   PeprModule: () => PeprModule,
   PeprMutateRequest: () => PeprMutateRequest,
   PeprUtils: () => utils_exports,
   PeprValidateRequest: () => PeprValidateRequest,
   R: () => R,
-  RegisterKind: () => import_kubernetes_fluent_client8.RegisterKind,
-  a: () => import_kubernetes_fluent_client8.kind,
-  fetch: () => import_kubernetes_fluent_client8.fetch,
-  fetchStatus: () => import_kubernetes_fluent_client8.fetchStatus,
-  kind: () => import_kubernetes_fluent_client8.kind,
+  RegisterKind: () => import_kubernetes_fluent_client9.RegisterKind,
+  a: () => import_kubernetes_fluent_client9.kind,
+  fetch: () => import_kubernetes_fluent_client9.fetch,
+  fetchStatus: () => import_kubernetes_fluent_client9.fetchStatus,
+  kind: () => import_kubernetes_fluent_client9.kind,
   sdk: () => sdk_exports
 });
 module.exports = __toCommonJS(lib_exports);
-var import_kubernetes_fluent_client8 = require("kubernetes-fluent-client");
+var import_kubernetes_fluent_client9 = require("kubernetes-fluent-client");
 var R = __toESM(require("ramda"));
 
 // src/lib/core/capability.ts
@@ -735,7 +735,7 @@ var Capability = class {
 };
 
 // src/lib/core/module.ts
-var import_ramda13 = require("ramda");
+var import_ramda14 = require("ramda");
 
 // src/lib/controller/index.ts
 var import_express = __toESM(require("express"));
@@ -1714,8 +1714,8 @@ async function validateProcessor(config, capabilities, req, reqMetadata) {
 }
 
 // src/lib/controller/store.ts
-var import_kubernetes_fluent_client5 = require("kubernetes-fluent-client");
-var import_ramda12 = require("ramda");
+var import_kubernetes_fluent_client6 = require("kubernetes-fluent-client");
+var import_ramda13 = require("ramda");
 
 // src/lib/k8s.ts
 var import_kubernetes_fluent_client3 = require("kubernetes-fluent-client");
@@ -1777,6 +1777,41 @@ function updateCacheID(payload) {
   return payload;
 }
 
+// src/lib/controller/migrateStore.ts
+var import_ramda12 = require("ramda");
+var import_kubernetes_fluent_client5 = require("kubernetes-fluent-client");
+async function migrateAndSetupWatch(storeData) {
+  const { store, namespace: namespace2, name: name2, stores, setupWatch: setupWatch2 } = storeData;
+  logger_default.debug(redactedStore(store), "Pepr Store migration");
+  await (0, import_kubernetes_fluent_client5.K8s)(Store, { namespace: namespace2, name: name2 }).Patch([
+    {
+      op: "add",
+      path: "/metadata/labels/pepr.dev-cacheID",
+      value: `${Date.now()}`
+    }
+  ]);
+  const data = store.data;
+  let storeCache = {};
+  for (const name3 of Object.keys(stores)) {
+    const offset = `${name3}-`.length;
+    for (const key of Object.keys(data)) {
+      if ((0, import_ramda12.startsWith)(name3, key) && !(0, import_ramda12.startsWith)(`${name3}-v2`, key)) {
+        storeCache = fillStoreCache(storeCache, name3, "remove", {
+          key: [key.slice(offset)],
+          value: data[key]
+        });
+        storeCache = fillStoreCache(storeCache, name3, "add", {
+          key: [key.slice(offset)],
+          value: data[key],
+          version: "v2"
+        });
+      }
+    }
+  }
+  storeCache = await sendUpdatesAndFlushCache(storeCache, namespace2, name2);
+  setupWatch2();
+}
+
 // src/lib/controller/store.ts
 var namespace = "pepr-system";
 var debounceBackoffReceive = 1e3;
@@ -1806,45 +1841,23 @@ var StoreController = class {
       }
     }
     setTimeout(
-      () => (0, import_kubernetes_fluent_client5.K8s)(Store).InNamespace(namespace).Get(this.#name).then(async (store) => await this.#migrateAndSetupWatch(store)).catch(this.#createStoreResource),
+      () => (0, import_kubernetes_fluent_client6.K8s)(Store).InNamespace(namespace).Get(this.#name).then(
+        async (store) => await migrateAndSetupWatch({
+          name: name2,
+          namespace,
+          store,
+          stores: this.#stores,
+          setupWatch: this.#setupWatch
+        })
+      ).catch(this.#createStoreResource),
       Math.random() * 3e3
       // Add a jitter to the Store creation to avoid collisions
     );
   }
   #setupWatch = () => {
-    const watcher = (0, import_kubernetes_fluent_client5.K8s)(Store, { name: this.#name, namespace }).Watch(this.#receive);
+    const watcher = (0, import_kubernetes_fluent_client6.K8s)(Store, { name: this.#name, namespace }).Watch(this.#receive);
     watcher.start().catch((e) => logger_default.error(e, "Error starting Pepr store watch"));
   };
-  #migrateAndSetupWatch = async (store) => {
-    logger_default.debug(redactedStore(store), "Pepr Store migration");
-    await (0, import_kubernetes_fluent_client5.K8s)(Store, { namespace, name: this.#name }).Patch([
-      {
-        op: "add",
-        path: "/metadata/labels/pepr.dev-cacheID",
-        value: `${Date.now()}`
-      }
-    ]);
-    const data = store.data || {};
-    let storeCache = {};
-    for (const name2 of Object.keys(this.#stores)) {
-      const offset = `${name2}-`.length;
-      for (const key of Object.keys(data)) {
-        if ((0, import_ramda12.startsWith)(name2, key) && !(0, import_ramda12.startsWith)(`${name2}-v2`, key)) {
-          storeCache = fillStoreCache(storeCache, name2, "remove", {
-            key: [key.slice(offset)],
-            value: data[key]
-          });
-          storeCache = fillStoreCache(storeCache, name2, "add", {
-            key: [key.slice(offset)],
-            value: data[key],
-            version: "v2"
-          });
-        }
-      }
-    }
-    storeCache = await sendUpdatesAndFlushCache(storeCache, namespace, this.#name);
-    this.#setupWatch();
-  };
   #receive = (store) => {
     logger_default.debug(redactedStore(store), "Pepr Store update");
     const debounced = () => {
@@ -1853,7 +1866,7 @@ var StoreController = class {
         const offset = `${name2}-`.length;
         const filtered = {};
         for (const key of Object.keys(data)) {
-          if ((0, import_ramda12.startsWith)(name2, key)) {
+          if ((0, import_ramda13.startsWith)(name2, key)) {
             filtered[key.slice(offset)] = data[key];
           }
         }
@@ -1884,7 +1897,7 @@ var StoreController = class {
     logger_default.info(`Pepr store not found, creating...`);
     logger_default.debug(e);
     try {
-      await (0, import_kubernetes_fluent_client5.K8s)(Store).Apply({
+      await (0, import_kubernetes_fluent_client6.K8s)(Store).Apply({
         metadata: {
           name: this.#name,
           namespace,
@@ -2164,7 +2177,7 @@ function ValidateError(error = "") {
 }
 
 // src/lib/processors/watch-processor.ts
-var import_kubernetes_fluent_client6 = require("kubernetes-fluent-client");
+var import_kubernetes_fluent_client7 = require("kubernetes-fluent-client");
 
 // src/lib/core/queue.ts
 var import_node_crypto = require("node:crypto");
@@ -2294,11 +2307,11 @@ var eventToPhaseMap = {
   ["*" /* ANY */]: [import_types.WatchPhase.Added, import_types.WatchPhase.Modified, import_types.WatchPhase.Deleted]
 };
 function setupWatch(capabilities, ignoredNamespaces) {
-  capabilities.map(
-    (capability) => capability.bindings.filter((binding) => binding.isWatch).forEach(
-      (bindingElement) => runBinding(bindingElement, capability.namespaces, ignoredNamespaces)
-    )
-  );
+  for (const capability of capabilities) {
+    for (const binding of capability.bindings.filter((b) => b.isWatch)) {
+      runBinding(binding, capability.namespaces, ignoredNamespaces);
+    }
+  }
 }
 async function runBinding(binding, capabilityNamespaces, ignoredNamespaces) {
   const phaseMatch = eventToPhaseMap[binding.event] || eventToPhaseMap["*" /* ANY */];
@@ -2347,7 +2360,7 @@ async function runBinding(binding, capabilityNamespaces, ignoredNamespaces) {
       }
     }
   };
-  const watcher = (0, import_kubernetes_fluent_client6.K8s)(binding.model, { ...binding.filters, kindOverride: binding.kind }).Watch(
+  const watcher = (0, import_kubernetes_fluent_client7.K8s)(binding.model, { ...binding.filters, kindOverride: binding.kind }).Watch(
     async (obj, phase) => {
       logger_default.debug(obj, `Watch event ${phase} received`);
       if (binding.isQueue) {
@@ -2359,12 +2372,18 @@ async function runBinding(binding, capabilityNamespaces, ignoredNamespaces) {
     },
     watchCfg
   );
-  registerWatchEventHandlers(watcher, logEvent, metricsCollector);
+  try {
+    registerWatchEventHandlers(watcher, logEvent, metricsCollector);
+  } catch (err) {
+    throw new Error(
+      "WatchEventHandler Registration Error: Unable to register event watch handler.",
+      { cause: err }
+    );
+  }
   try {
     await watcher.start();
   } catch (err) {
-    logger_default.error(err, "Error starting watch");
-    process.exit(1);
+    throw new Error("WatchStart Error: Unable to start watch.", { cause: err });
   }
 }
 function logEvent(event, message = "", obj) {
@@ -2377,26 +2396,29 @@ function logEvent(event, message = "", obj) {
 }
 function registerWatchEventHandlers(watcher, logEvent2, metricsCollector2) {
   const eventHandlers = {
-    [import_kubernetes_fluent_client6.WatchEvent.DATA]: () => null,
-    [import_kubernetes_fluent_client6.WatchEvent.GIVE_UP]: (err) => {
-      logEvent2(import_kubernetes_fluent_client6.WatchEvent.GIVE_UP, err.message);
-      process.exit(1);
+    [import_kubernetes_fluent_client7.WatchEvent.DATA]: () => null,
+    [import_kubernetes_fluent_client7.WatchEvent.GIVE_UP]: (err) => {
+      logEvent2(import_kubernetes_fluent_client7.WatchEvent.GIVE_UP, err.message);
+      throw new Error(
+        "WatchEvent GiveUp Error: The watch has failed to start after several attempts.",
+        { cause: err }
+      );
     },
-    [import_kubernetes_fluent_client6.WatchEvent.CONNECT]: (url) => logEvent2(import_kubernetes_fluent_client6.WatchEvent.CONNECT, url),
-    [import_kubernetes_fluent_client6.WatchEvent.DATA_ERROR]: (err) => logEvent2(import_kubernetes_fluent_client6.WatchEvent.DATA_ERROR, err.message),
-    [import_kubernetes_fluent_client6.WatchEvent.RECONNECT]: (retryCount) => logEvent2(
-      import_kubernetes_fluent_client6.WatchEvent.RECONNECT,
+    [import_kubernetes_fluent_client7.WatchEvent.CONNECT]: (url) => logEvent2(import_kubernetes_fluent_client7.WatchEvent.CONNECT, url),
+    [import_kubernetes_fluent_client7.WatchEvent.DATA_ERROR]: (err) => logEvent2(import_kubernetes_fluent_client7.WatchEvent.DATA_ERROR, err.message),
+    [import_kubernetes_fluent_client7.WatchEvent.RECONNECT]: (retryCount) => logEvent2(
+      import_kubernetes_fluent_client7.WatchEvent.RECONNECT,
       `Reconnecting after ${retryCount} attempt${retryCount === 1 ? "" : "s"}`
     ),
-    [import_kubernetes_fluent_client6.WatchEvent.RECONNECT_PENDING]: () => logEvent2(import_kubernetes_fluent_client6.WatchEvent.RECONNECT_PENDING),
-    [import_kubernetes_fluent_client6.WatchEvent.ABORT]: (err) => logEvent2(import_kubernetes_fluent_client6.WatchEvent.ABORT, err.message),
-    [import_kubernetes_fluent_client6.WatchEvent.OLD_RESOURCE_VERSION]: (errMessage) => logEvent2(import_kubernetes_fluent_client6.WatchEvent.OLD_RESOURCE_VERSION, errMessage),
-    [import_kubernetes_fluent_client6.WatchEvent.NETWORK_ERROR]: (err) => logEvent2(import_kubernetes_fluent_client6.WatchEvent.NETWORK_ERROR, err.message),
-    [import_kubernetes_fluent_client6.WatchEvent.LIST_ERROR]: (err) => logEvent2(import_kubernetes_fluent_client6.WatchEvent.LIST_ERROR, err.message),
-    [import_kubernetes_fluent_client6.WatchEvent.LIST]: (list) => logEvent2(import_kubernetes_fluent_client6.WatchEvent.LIST, JSON.stringify(list, void 0, 2)),
-    [import_kubernetes_fluent_client6.WatchEvent.CACHE_MISS]: (windowName) => metricsCollector2.incCacheMiss(windowName),
-    [import_kubernetes_fluent_client6.WatchEvent.INIT_CACHE_MISS]: (windowName) => metricsCollector2.initCacheMissWindow(windowName),
-    [import_kubernetes_fluent_client6.WatchEvent.INC_RESYNC_FAILURE_COUNT]: (retryCount) => metricsCollector2.incRetryCount(retryCount)
+    [import_kubernetes_fluent_client7.WatchEvent.RECONNECT_PENDING]: () => logEvent2(import_kubernetes_fluent_client7.WatchEvent.RECONNECT_PENDING),
+    [import_kubernetes_fluent_client7.WatchEvent.ABORT]: (err) => logEvent2(import_kubernetes_fluent_client7.WatchEvent.ABORT, err.message),
+    [import_kubernetes_fluent_client7.WatchEvent.OLD_RESOURCE_VERSION]: (errMessage) => logEvent2(import_kubernetes_fluent_client7.WatchEvent.OLD_RESOURCE_VERSION, errMessage),
+    [import_kubernetes_fluent_client7.WatchEvent.NETWORK_ERROR]: (err) => logEvent2(import_kubernetes_fluent_client7.WatchEvent.NETWORK_ERROR, err.message),
+    [import_kubernetes_fluent_client7.WatchEvent.LIST_ERROR]: (err) => logEvent2(import_kubernetes_fluent_client7.WatchEvent.LIST_ERROR, err.message),
+    [import_kubernetes_fluent_client7.WatchEvent.LIST]: (list) => logEvent2(import_kubernetes_fluent_client7.WatchEvent.LIST, JSON.stringify(list, void 0, 2)),
+    [import_kubernetes_fluent_client7.WatchEvent.CACHE_MISS]: (windowName) => metricsCollector2.incCacheMiss(windowName),
+    [import_kubernetes_fluent_client7.WatchEvent.INIT_CACHE_MISS]: (windowName) => metricsCollector2.initCacheMissWindow(windowName),
+    [import_kubernetes_fluent_client7.WatchEvent.INC_RESYNC_FAILURE_COUNT]: (retryCount) => metricsCollector2.incRetryCount(retryCount)
   };
   Object.entries(eventHandlers).forEach(([event, handler]) => {
     watcher.events.on(event, handler);
@@ -2414,7 +2436,7 @@ var PeprModule = class {
    * @param opts Options for the Pepr runtime
    */
   constructor({ description, pepr }, capabilities = [], opts = {}) {
-    const config = (0, import_ramda13.clone)(pepr);
+    const config = (0, import_ramda14.clone)(pepr);
     config.description = description;
     ValidateError(config.onError);
     if (isBuildMode()) {
@@ -2437,7 +2459,7 @@ var PeprModule = class {
     const controllerHooks = {
       beforeHook: opts.beforeHook,
       afterHook: opts.afterHook,
-      onReady: () => {
+      onReady: async () => {
         if (isWatchMode() || isDevMode()) {
           try {
             setupWatch(capabilities, resolveIgnoreNamespaces(pepr?.alwaysIgnore?.namespaces));
@@ -2473,7 +2495,7 @@ __export(sdk_exports, {
   sanitizeResourceName: () => sanitizeResourceName,
   writeEvent: () => writeEvent
 });
-var import_kubernetes_fluent_client7 = require("kubernetes-fluent-client");
+var import_kubernetes_fluent_client8 = require("kubernetes-fluent-client");
 function containers(request, containerType) {
   const containers2 = request.Raw.spec?.containers || [];
   const initContainers = request.Raw.spec?.initContainers || [];
@@ -2491,7 +2513,7 @@ function containers(request, containerType) {
 }
 async function writeEvent(cr, event, options) {
   const { eventType, eventReason, reportingComponent, reportingInstance } = options;
-  await (0, import_kubernetes_fluent_client7.K8s)(import_kubernetes_fluent_client7.kind.CoreEvent).Create({
+  await (0, import_kubernetes_fluent_client8.K8s)(import_kubernetes_fluent_client8.kind.CoreEvent).Create({
     type: eventType,
     reason: eventReason,
     ...event,