pepr 0.49.0 → 0.50.0-nightly.1

package/dist/cli.js

@@ -103,17 +103,17 @@ var require_visit = __commonJS({
     visit.BREAK = BREAK;
     visit.SKIP = SKIP;
     visit.REMOVE = REMOVE;
-    function visit_(key, node, visitor, path3) {
-      const ctrl = callVisitor(key, node, visitor, path3);
+    function visit_(key, node, visitor, path4) {
+      const ctrl = callVisitor(key, node, visitor, path4);
       if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-        replaceNode(key, path3, ctrl);
-        return visit_(key, ctrl, visitor, path3);
+        replaceNode(key, path4, ctrl);
+        return visit_(key, ctrl, visitor, path4);
       }
       if (typeof ctrl !== "symbol") {
         if (identity.isCollection(node)) {
-          path3 = Object.freeze(path3.concat(node));
+          path4 = Object.freeze(path4.concat(node));
           for (let i = 0; i < node.items.length; ++i) {
-            const ci = visit_(i, node.items[i], visitor, path3);
+            const ci = visit_(i, node.items[i], visitor, path4);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -124,13 +124,13 @@ var require_visit = __commonJS({
             }
           }
         } else if (identity.isPair(node)) {
-          path3 = Object.freeze(path3.concat(node));
-          const ck = visit_("key", node.key, visitor, path3);
+          path4 = Object.freeze(path4.concat(node));
+          const ck = visit_("key", node.key, visitor, path4);
           if (ck === BREAK)
             return BREAK;
           else if (ck === REMOVE)
             node.key = null;
-          const cv = visit_("value", node.value, visitor, path3);
+          const cv = visit_("value", node.value, visitor, path4);
           if (cv === BREAK)
             return BREAK;
           else if (cv === REMOVE)
@@ -151,17 +151,17 @@ var require_visit = __commonJS({
     visitAsync.BREAK = BREAK;
     visitAsync.SKIP = SKIP;
     visitAsync.REMOVE = REMOVE;
-    async function visitAsync_(key, node, visitor, path3) {
-      const ctrl = await callVisitor(key, node, visitor, path3);
+    async function visitAsync_(key, node, visitor, path4) {
+      const ctrl = await callVisitor(key, node, visitor, path4);
       if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-        replaceNode(key, path3, ctrl);
-        return visitAsync_(key, ctrl, visitor, path3);
+        replaceNode(key, path4, ctrl);
+        return visitAsync_(key, ctrl, visitor, path4);
       }
       if (typeof ctrl !== "symbol") {
         if (identity.isCollection(node)) {
-          path3 = Object.freeze(path3.concat(node));
+          path4 = Object.freeze(path4.concat(node));
           for (let i = 0; i < node.items.length; ++i) {
-            const ci = await visitAsync_(i, node.items[i], visitor, path3);
+            const ci = await visitAsync_(i, node.items[i], visitor, path4);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -172,13 +172,13 @@ var require_visit = __commonJS({
             }
           }
         } else if (identity.isPair(node)) {
-          path3 = Object.freeze(path3.concat(node));
-          const ck = await visitAsync_("key", node.key, visitor, path3);
+          path4 = Object.freeze(path4.concat(node));
+          const ck = await visitAsync_("key", node.key, visitor, path4);
           if (ck === BREAK)
             return BREAK;
           else if (ck === REMOVE)
             node.key = null;
-          const cv = await visitAsync_("value", node.value, visitor, path3);
+          const cv = await visitAsync_("value", node.value, visitor, path4);
           if (cv === BREAK)
             return BREAK;
           else if (cv === REMOVE)
@@ -205,23 +205,23 @@ var require_visit = __commonJS({
       }
       return visitor;
     }
-    function callVisitor(key, node, visitor, path3) {
+    function callVisitor(key, node, visitor, path4) {
       if (typeof visitor === "function")
-        return visitor(key, node, path3);
+        return visitor(key, node, path4);
       if (identity.isMap(node))
-        return visitor.Map?.(key, node, path3);
+        return visitor.Map?.(key, node, path4);
       if (identity.isSeq(node))
-        return visitor.Seq?.(key, node, path3);
+        return visitor.Seq?.(key, node, path4);
       if (identity.isPair(node))
-        return visitor.Pair?.(key, node, path3);
+        return visitor.Pair?.(key, node, path4);
       if (identity.isScalar(node))
-        return visitor.Scalar?.(key, node, path3);
+        return visitor.Scalar?.(key, node, path4);
       if (identity.isAlias(node))
-        return visitor.Alias?.(key, node, path3);
+        return visitor.Alias?.(key, node, path4);
       return void 0;
     }
-    function replaceNode(key, path3, node) {
-      const parent = path3[path3.length - 1];
+    function replaceNode(key, path4, node) {
+      const parent = path4[path4.length - 1];
       if (identity.isCollection(parent)) {
         parent.items[key] = node;
       } else if (identity.isPair(parent)) {
@@ -819,10 +819,10 @@ var require_Collection = __commonJS({
     var createNode = require_createNode();
     var identity = require_identity();
     var Node2 = require_Node();
-    function collectionFromPath(schema, path3, value) {
+    function collectionFromPath(schema, path4, value) {
       let v = value;
-      for (let i = path3.length - 1; i >= 0; --i) {
-        const k = path3[i];
+      for (let i = path4.length - 1; i >= 0; --i) {
+        const k = path4[i];
         if (typeof k === "number" && Number.isInteger(k) && k >= 0) {
           const a = [];
           a[k] = v;
@@ -841,7 +841,7 @@ var require_Collection = __commonJS({
         sourceObjects: /* @__PURE__ */ new Map()
       });
     }
-    var isEmptyPath = (path3) => path3 == null || typeof path3 === "object" && !!path3[Symbol.iterator]().next().done;
+    var isEmptyPath = (path4) => path4 == null || typeof path4 === "object" && !!path4[Symbol.iterator]().next().done;
     var Collection = class extends Node2.NodeBase {
       constructor(type, schema) {
         super(type);
@@ -871,11 +871,11 @@ var require_Collection = __commonJS({
        * be a Pair instance or a `{ key, value }` object, which may not have a key
        * that already exists in the map.
        */
-      addIn(path3, value) {
-        if (isEmptyPath(path3))
+      addIn(path4, value) {
+        if (isEmptyPath(path4))
           this.add(value);
         else {
-          const [key, ...rest] = path3;
+          const [key, ...rest] = path4;
           const node = this.get(key, true);
           if (identity.isCollection(node))
             node.addIn(rest, value);
@@ -889,8 +889,8 @@ var require_Collection = __commonJS({
        * Removes a value from the collection.
        * @returns `true` if the item was found and removed.
        */
-      deleteIn(path3) {
-        const [key, ...rest] = path3;
+      deleteIn(path4) {
+        const [key, ...rest] = path4;
         if (rest.length === 0)
           return this.delete(key);
         const node = this.get(key, true);
@@ -904,8 +904,8 @@ var require_Collection = __commonJS({
        * scalar values from their surrounding node; to disable set `keepScalar` to
        * `true` (collections are always returned intact).
        */
-      getIn(path3, keepScalar) {
-        const [key, ...rest] = path3;
+      getIn(path4, keepScalar) {
+        const [key, ...rest] = path4;
         const node = this.get(key, true);
         if (rest.length === 0)
           return !keepScalar && identity.isScalar(node) ? node.value : node;
@@ -923,8 +923,8 @@ var require_Collection = __commonJS({
       /**
        * Checks if the collection includes a value with the key `key`.
        */
-      hasIn(path3) {
-        const [key, ...rest] = path3;
+      hasIn(path4) {
+        const [key, ...rest] = path4;
         if (rest.length === 0)
           return this.has(key);
         const node = this.get(key, true);
@@ -934,8 +934,8 @@ var require_Collection = __commonJS({
        * Sets a value in this collection. For `!!set`, `value` needs to be a
        * boolean to add/remove the item from the set.
        */
-      setIn(path3, value) {
-        const [key, ...rest] = path3;
+      setIn(path4, value) {
+        const [key, ...rest] = path4;
         if (rest.length === 0) {
           this.set(key, value);
         } else {
@@ -1481,7 +1481,7 @@ var require_stringify = __commonJS({
         props.push(doc.directives.tagString(tag));
       return props.join(" ");
     }
-    function stringify(item, ctx, onComment, onChompKeep) {
+    function stringify2(item, ctx, onComment, onChompKeep) {
       if (identity.isPair(item))
         return item.toString(ctx, onComment, onChompKeep);
       if (identity.isAlias(item)) {
@@ -1511,7 +1511,7 @@ var require_stringify = __commonJS({
 ${ctx.indent}${str}`;
     }
     exports2.createStringifyContext = createStringifyContext;
-    exports2.stringify = stringify;
+    exports2.stringify = stringify2;
   }
 });
 
@@ -1521,7 +1521,7 @@ var require_stringifyPair = __commonJS({
     "use strict";
     var identity = require_identity();
     var Scalar = require_Scalar();
-    var stringify = require_stringify();
+    var stringify2 = require_stringify();
     var stringifyComment = require_stringifyComment();
     function stringifyPair({ key, value }, ctx, onComment, onChompKeep) {
       const { allNullValues, doc, indent, indentStep, options: { commentString, indentSeq, simpleKeys } } = ctx;
@@ -1543,7 +1543,7 @@ var require_stringifyPair = __commonJS({
       });
       let keyCommentDone = false;
       let chompKeep = false;
-      let str = stringify.stringify(key, ctx, () => keyCommentDone = true, () => chompKeep = true);
+      let str = stringify2.stringify(key, ctx, () => keyCommentDone = true, () => chompKeep = true);
       if (!explicitKey && !ctx.inFlow && str.length > 1024) {
         if (simpleKeys)
           throw new Error("With simple keys, single line scalar must not span more than 1024 characters");
@@ -1595,7 +1595,7 @@ ${indent}:`;
         ctx.indent = ctx.indent.substring(2);
       }
       let valueCommentDone = false;
-      const valueStr = stringify.stringify(value, ctx, () => valueCommentDone = true, () => chompKeep = true);
+      const valueStr = stringify2.stringify(value, ctx, () => valueCommentDone = true, () => chompKeep = true);
       let ws = " ";
       if (keyComment || vsb || vcb) {
         ws = vsb ? "\n" : "";
@@ -1733,7 +1733,7 @@ var require_addPairToJSMap = __commonJS({
     "use strict";
     var log = require_log();
     var merge = require_merge();
-    var stringify = require_stringify();
+    var stringify2 = require_stringify();
     var identity = require_identity();
     var toJS = require_toJS();
     function addPairToJSMap(ctx, map, { key, value }) {
@@ -1769,7 +1769,7 @@ var require_addPairToJSMap = __commonJS({
       if (typeof jsKey !== "object")
         return String(jsKey);
       if (identity.isNode(key) && ctx?.doc) {
-        const strCtx = stringify.createStringifyContext(ctx.doc, {});
+        const strCtx = stringify2.createStringifyContext(ctx.doc, {});
         strCtx.anchors = /* @__PURE__ */ new Set();
         for (const node of ctx.anchors.keys())
           strCtx.anchors.add(node.anchor);
@@ -1836,12 +1836,12 @@ var require_stringifyCollection = __commonJS({
   "node_modules/yaml/dist/stringify/stringifyCollection.js"(exports2) {
     "use strict";
     var identity = require_identity();
-    var stringify = require_stringify();
+    var stringify2 = require_stringify();
     var stringifyComment = require_stringifyComment();
     function stringifyCollection(collection, ctx, options) {
       const flow = ctx.inFlow ?? collection.flow;
-      const stringify2 = flow ? stringifyFlowCollection : stringifyBlockCollection;
-      return stringify2(collection, ctx, options);
+      const stringify3 = flow ? stringifyFlowCollection : stringifyBlockCollection;
+      return stringify3(collection, ctx, options);
     }
     function stringifyBlockCollection({ comment, items }, ctx, { blockItemPrefix, flowChars, itemIndent, onChompKeep, onComment }) {
       const { indent, options: { commentString } } = ctx;
@@ -1866,7 +1866,7 @@ var require_stringifyCollection = __commonJS({
           }
         }
         chompKeep = false;
-        let str2 = stringify.stringify(item, itemCtx, () => comment2 = null, () => chompKeep = true);
+        let str2 = stringify2.stringify(item, itemCtx, () => comment2 = null, () => chompKeep = true);
         if (comment2)
           str2 += stringifyComment.lineComment(str2, itemIndent, commentString(comment2));
         if (chompKeep && comment2)
@@ -1933,7 +1933,7 @@ ${indent}${line}` : "\n";
         }
         if (comment)
           reqNewline = true;
-        let str = stringify.stringify(item, itemCtx, () => comment = null);
+        let str = stringify2.stringify(item, itemCtx, () => comment = null);
         if (i < items.length - 1)
           str += ",";
         if (comment)
@@ -3288,7 +3288,7 @@ var require_stringifyDocument = __commonJS({
   "node_modules/yaml/dist/stringify/stringifyDocument.js"(exports2) {
     "use strict";
     var identity = require_identity();
-    var stringify = require_stringify();
+    var stringify2 = require_stringify();
     var stringifyComment = require_stringifyComment();
     function stringifyDocument(doc, options) {
       const lines = [];
@@ -3303,7 +3303,7 @@ var require_stringifyDocument = __commonJS({
       }
       if (hasDirectives)
         lines.push("---");
-      const ctx = stringify.createStringifyContext(doc, options);
+      const ctx = stringify2.createStringifyContext(doc, options);
       const { commentString } = ctx.options;
       if (doc.commentBefore) {
         if (lines.length !== 1)
@@ -3325,7 +3325,7 @@ var require_stringifyDocument = __commonJS({
           contentComment = doc.contents.comment;
         }
         const onChompKeep = contentComment ? void 0 : () => chompKeep = true;
-        let body = stringify.stringify(doc.contents, ctx, () => contentComment = null, onChompKeep);
+        let body = stringify2.stringify(doc.contents, ctx, () => contentComment = null, onChompKeep);
         if (contentComment)
           body += stringifyComment.lineComment(body, "", commentString(contentComment));
         if ((body[0] === "|" || body[0] === ">") && lines[lines.length - 1] === "---") {
@@ -3333,7 +3333,7 @@ var require_stringifyDocument = __commonJS({
         } else
           lines.push(body);
       } else {
-        lines.push(stringify.stringify(doc.contents, ctx));
+        lines.push(stringify2.stringify(doc.contents, ctx));
       }
       if (doc.directives?.docEnd) {
         if (doc.comment) {
@@ -3441,9 +3441,9 @@ var require_Document = __commonJS({
           this.contents.add(value);
       }
       /** Adds a value to the document. */
-      addIn(path3, value) {
+      addIn(path4, value) {
         if (assertCollection(this.contents))
-          this.contents.addIn(path3, value);
+          this.contents.addIn(path4, value);
       }
       /**
        * Create a new `Alias` node, ensuring that the target `node` has the required anchor.
@@ -3518,14 +3518,14 @@ var require_Document = __commonJS({
        * Removes a value from the document.
        * @returns `true` if the item was found and removed.
        */
-      deleteIn(path3) {
-        if (Collection.isEmptyPath(path3)) {
+      deleteIn(path4) {
+        if (Collection.isEmptyPath(path4)) {
           if (this.contents == null)
             return false;
           this.contents = null;
           return true;
         }
-        return assertCollection(this.contents) ? this.contents.deleteIn(path3) : false;
+        return assertCollection(this.contents) ? this.contents.deleteIn(path4) : false;
       }
       /**
        * Returns item at `key`, or `undefined` if not found. By default unwraps
@@ -3540,10 +3540,10 @@ var require_Document = __commonJS({
        * scalar values from their surrounding node; to disable set `keepScalar` to
        * `true` (collections are always returned intact).
        */
-      getIn(path3, keepScalar) {
-        if (Collection.isEmptyPath(path3))
+      getIn(path4, keepScalar) {
+        if (Collection.isEmptyPath(path4))
           return !keepScalar && identity.isScalar(this.contents) ? this.contents.value : this.contents;
-        return identity.isCollection(this.contents) ? this.contents.getIn(path3, keepScalar) : void 0;
+        return identity.isCollection(this.contents) ? this.contents.getIn(path4, keepScalar) : void 0;
       }
       /**
        * Checks if the document includes a value with the key `key`.
@@ -3554,10 +3554,10 @@ var require_Document = __commonJS({
       /**
        * Checks if the document includes a value at `path`.
        */
-      hasIn(path3) {
-        if (Collection.isEmptyPath(path3))
+      hasIn(path4) {
+        if (Collection.isEmptyPath(path4))
           return this.contents !== void 0;
-        return identity.isCollection(this.contents) ? this.contents.hasIn(path3) : false;
+        return identity.isCollection(this.contents) ? this.contents.hasIn(path4) : false;
       }
       /**
        * Sets a value in this document. For `!!set`, `value` needs to be a
@@ -3574,13 +3574,13 @@ var require_Document = __commonJS({
        * Sets a value in this document. For `!!set`, `value` needs to be a
        * boolean to add/remove the item from the set.
        */
-      setIn(path3, value) {
-        if (Collection.isEmptyPath(path3)) {
+      setIn(path4, value) {
+        if (Collection.isEmptyPath(path4)) {
           this.contents = value;
         } else if (this.contents == null) {
-          this.contents = Collection.collectionFromPath(this.schema, Array.from(path3), value);
+          this.contents = Collection.collectionFromPath(this.schema, Array.from(path4), value);
         } else if (assertCollection(this.contents)) {
-          this.contents.setIn(path3, value);
+          this.contents.setIn(path4, value);
         }
       }
       /**
@@ -5463,7 +5463,7 @@ var require_cst_scalar = __commonJS({
 var require_cst_stringify = __commonJS({
   "node_modules/yaml/dist/parse/cst-stringify.js"(exports2) {
     "use strict";
-    var stringify = (cst) => "type" in cst ? stringifyToken(cst) : stringifyItem(cst);
+    var stringify2 = (cst) => "type" in cst ? stringifyToken(cst) : stringifyItem(cst);
     function stringifyToken(token) {
       switch (token.type) {
         case "block-scalar": {
@@ -5516,7 +5516,7 @@ var require_cst_stringify = __commonJS({
         res += stringifyToken(value);
       return res;
     }
-    exports2.stringify = stringify;
+    exports2.stringify = stringify2;
   }
 });
 
@@ -5535,9 +5535,9 @@ var require_cst_visit = __commonJS({
     visit.BREAK = BREAK;
     visit.SKIP = SKIP;
     visit.REMOVE = REMOVE;
-    visit.itemAtPath = (cst, path3) => {
+    visit.itemAtPath = (cst, path4) => {
       let item = cst;
-      for (const [field, index] of path3) {
+      for (const [field, index] of path4) {
         const tok = item?.[field];
         if (tok && "items" in tok) {
           item = tok.items[index];
@@ -5546,23 +5546,23 @@ var require_cst_visit = __commonJS({
       }
       return item;
     };
-    visit.parentCollection = (cst, path3) => {
-      const parent = visit.itemAtPath(cst, path3.slice(0, -1));
-      const field = path3[path3.length - 1][0];
+    visit.parentCollection = (cst, path4) => {
+      const parent = visit.itemAtPath(cst, path4.slice(0, -1));
+      const field = path4[path4.length - 1][0];
       const coll = parent?.[field];
       if (coll && "items" in coll)
         return coll;
       throw new Error("Parent collection not found");
     };
-    function _visit(path3, item, visitor) {
-      let ctrl = visitor(item, path3);
+    function _visit(path4, item, visitor) {
+      let ctrl = visitor(item, path4);
       if (typeof ctrl === "symbol")
         return ctrl;
       for (const field of ["key", "value"]) {
         const token = item[field];
         if (token && "items" in token) {
           for (let i = 0; i < token.items.length; ++i) {
-            const ci = _visit(Object.freeze(path3.concat([[field, i]])), token.items[i], visitor);
+            const ci = _visit(Object.freeze(path4.concat([[field, i]])), token.items[i], visitor);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -5573,10 +5573,10 @@ var require_cst_visit = __commonJS({
             }
           }
           if (typeof ctrl === "function" && field === "key")
-            ctrl = ctrl(item, path3);
+            ctrl = ctrl(item, path4);
         }
       }
-      return typeof ctrl === "function" ? ctrl(item, path3) : ctrl;
+      return typeof ctrl === "function" ? ctrl(item, path4) : ctrl;
     }
     exports2.visit = visit;
   }
@@ -7229,7 +7229,7 @@ var require_public_api = __commonJS({
       }
       return doc.toJS(Object.assign({ reviver: _reviver }, options));
     }
-    function stringify(value, replacer, options) {
+    function stringify2(value, replacer, options) {
       let _replacer = null;
       if (typeof replacer === "function" || Array.isArray(replacer)) {
         _replacer = replacer;
@@ -7254,7 +7254,7 @@ var require_public_api = __commonJS({
     exports2.parse = parse;
     exports2.parseAllDocuments = parseAllDocuments;
     exports2.parseDocument = parseDocument;
-    exports2.stringify = stringify;
+    exports2.stringify = stringify2;
   }
 });
 
@@ -7375,8 +7375,8 @@ var banner = `\x1B[107;40m\x1B[38;5;m \x1B[38;5;m \x1B[38;5;m \x1B[38;5;m \x1B[3
 // src/cli/build.ts
 var import_child_process3 = require("child_process");
 var import_esbuild2 = require("esbuild");
-var import_fs9 = require("fs");
-var import_path3 = require("path");
+var import_fs10 = require("fs");
+var import_path4 = require("path");
 
 // src/lib/assets/assets.ts
 var import_crypto = __toESM(require("crypto"));
@@ -7529,7 +7529,13 @@ function watcherDeployTemplate(buildTimestamp) {
             terminationGracePeriodSeconds: {{ .Values.watcher.terminationGracePeriodSeconds }}
             serviceAccountName: {{ .Values.uuid }}
             securityContext:
-              {{- toYaml .Values.admission.securityContext | nindent 8 }}
+              {{- toYaml .Values.watcher.securityContext | nindent 8 }}
+            nodeSelector:
+              {{- toYaml .Values.watcher.nodeSelector | nindent 8 }}
+            tolerations:
+              {{- toYaml .Values.watcher.tolerations | nindent 8 }}
+            affinity:
+              {{- toYaml .Values.watcher.affinity | nindent 8 }}
             containers:
               - name: watcher
                 image: {{ .Values.watcher.image }}
@@ -7613,6 +7619,27 @@ function admissionDeployTemplate(buildTimestamp) {
               app: {{ .Values.uuid }}
               pepr.dev/controller: admission
           spec:
+            {{- if or .Values.admission.antiAffinity .Values.admission.affinity }}
+            affinity:
+            {{- if .Values.admission.antiAffinity }}
+              podAntiAffinity:
+                requiredDuringSchedulingIgnoredDuringExecution:
+                  - labelSelector:
+                      matchExpressions:
+                        - key: pepr.dev/controller
+                          operator: In
+                          values:
+                            - admission
+                    topologyKey: "kubernetes.io/hostname"
+            {{- end }}
+            {{- if .Values.admission.affinity }}
+              {{- toYaml .Values.admission.affinity | nindent 8 }}
+            {{- end }}
+            {{- end }}
+            nodeSelector:
+              {{- toYaml .Values.admission.nodeSelector | nindent 8 }}
+            tolerations:
+              {{- toYaml .Values.admission.tolerations | nindent 8 }}
             terminationGracePeriodSeconds: {{ .Values.admission.terminationGracePeriodSeconds }}
             priorityClassName: system-node-critical
             serviceAccountName: {{ .Values.uuid }}
@@ -7709,12 +7736,12 @@ function serviceMonitorTemplate(name2, type) {
 
 // src/lib/filesystemService.ts
 var import_fs = require("fs");
-async function createDirectoryIfNotExists(path3) {
+async function createDirectoryIfNotExists(path4) {
   try {
-    await import_fs.promises.access(path3);
+    await import_fs.promises.access(path4);
   } catch (error) {
     if (error.code === "ENOENT") {
-      await import_fs.promises.mkdir(path3, { recursive: true });
+      await import_fs.promises.mkdir(path4, { recursive: true });
     } else {
       throw error;
     }
@@ -7764,7 +7791,7 @@ var logger_default = Log;
 // src/sdk/sdk.ts
 var import_kubernetes_fluent_client = require("kubernetes-fluent-client");
 function sanitizeResourceName(name2) {
-  return name2.toLowerCase().replace(/[^a-z0-9]+/g, "-").slice(0, 250).replace(/^[^a-z]+|[^a-z]+$/g, "");
+  return name2.toLowerCase().replace(/[^a-z0-9-]+/g, "-").slice(0, 63).replace(/^[^a-z0-9]+/, "").replace(/[^a-z0-9]+$/, "");
 }
 
 // src/lib/helpers.ts
@@ -7847,18 +7874,23 @@ function generateWatchNamespaceError(ignoredNamespaces, bindingNamespaces, capab
   }
   return err.replace(/\.([^ ])/g, ". $1");
 }
-function namespaceComplianceValidator(capability, ignoredNamespaces) {
+function namespaceComplianceValidator(capability, ignoredNamespaces, watch) {
   const { namespaces: capabilityNamespaces, bindings, name: name2 } = capability;
+  const shouldInclude = (binding) => {
+    if (watch === true) return !!binding.isWatch;
+    if (watch === false) return !!binding.isMutate;
+    return true;
+  };
   const bindingNamespaces = bindings.flatMap(
-    (binding) => binding.filters.namespaces
+    (binding) => shouldInclude(binding) ? binding.filters.namespaces || [] : []
   );
   const bindingRegexNamespaces = bindings.flatMap(
-    (binding) => binding.filters.regexNamespaces || []
+    (binding) => shouldInclude(binding) ? binding.filters.regexNamespaces || [] : []
   );
   const namespaceError = generateWatchNamespaceError(
-    ignoredNamespaces ? ignoredNamespaces : [],
+    ignoredNamespaces ?? [],
     bindingNamespaces,
-    capabilityNamespaces ? capabilityNamespaces : []
+    capabilityNamespaces ?? []
   );
   if (namespaceError !== "") {
     throw new Error(
@@ -8039,11 +8071,28 @@ function storeRoleBinding(name2) {
 
 // src/lib/assets/yaml/overridesFile.ts
 var import_fs2 = require("fs");
-async function overridesFile({ hash, name: name2, image, config, apiPath, capabilities }, path3, imagePullSecrets) {
+
+// src/lib/assets/ignoredNamespaces.ts
+function resolveIgnoreNamespaces(ignoredNSConfig = []) {
+  const ignoredNSEnv = process.env.PEPR_ADDITIONAL_IGNORED_NAMESPACES;
+  if (!ignoredNSEnv) {
+    return ignoredNSConfig;
+  }
+  const namespaces = ignoredNSEnv.split(",").map((ns) => ns.trim());
+  if (ignoredNSConfig) {
+    namespaces.push(...ignoredNSConfig);
+  }
+  return namespaces.filter((ns) => ns.length > 0);
+}
+
+// src/lib/assets/yaml/overridesFile.ts
+async function overridesFile({ hash, name: name2, image, config, apiPath, capabilities }, path4, imagePullSecrets) {
   const rbacOverrides = clusterRole(name2, capabilities, config.rbacMode, config.rbac).rules;
   const overrides = {
     imagePullSecrets,
-    additionalIgnoredNamespaces: [],
+    additionalIgnoredNamespaces: resolveIgnoreNamespaces(
+      config?.alwaysIgnore?.namespaces?.length ? config?.alwaysIgnore?.namespaces : config?.admission?.alwaysIgnore?.namespaces
+    ),
     rbac: rbacOverrides,
     secrets: {
       apiPath: Buffer.from(apiPath).toString("base64")
@@ -8057,6 +8106,7 @@ async function overridesFile({ hash, name: name2, image, config, apiPath, capabi
     },
     uuid: name2,
     admission: {
+      antiAffinity: false,
       terminationGracePeriodSeconds: 5,
       failurePolicy: config.onError === "reject" ? "Fail" : "Ignore",
       webhookTimeout: config.webhookTimeout,
@@ -8191,7 +8241,7 @@ async function overridesFile({ hash, name: name2, image, config, apiPath, capabi
       }
     }
   };
-  await import_fs2.promises.writeFile(path3, (0, import_client_node.dumpYaml)(overrides, { noRefs: true, forceQuotes: true }));
+  await import_fs2.promises.writeFile(path4, (0, import_client_node.dumpYaml)(overrides, { noRefs: true, forceQuotes: true }));
 }
 
 // src/lib/assets/index.ts
@@ -8276,9 +8326,9 @@ function helmLayout(basePath, unique) {
 
 // src/lib/assets/loader.ts
 var import_child_process = require("child_process");
-function loadCapabilities(path3) {
+function loadCapabilities(path4) {
   return new Promise((resolve6, reject) => {
-    const program2 = (0, import_child_process.fork)(path3, {
+    const program2 = (0, import_child_process.fork)(path4, {
       env: {
         ...process.env,
         LOG_LEVEL: "warn",
@@ -8396,12 +8446,12 @@ var Assets = class {
   image;
   buildTimestamp;
   host;
-  constructor(config, path3, imagePullSecrets, host) {
+  constructor(config, path4, imagePullSecrets, host) {
     this.name = `pepr-${config.uuid}`;
     this.imagePullSecrets = imagePullSecrets;
     this.buildTimestamp = `${Date.now()}`;
     this.config = config;
-    this.path = path3;
+    this.path = path4;
     this.host = host;
     this.alwaysIgnore = config.alwaysIgnore;
     this.image = `ghcr.io/defenseunicorns/pepr/controller:v${config.peprVersion}`;
@@ -8413,12 +8463,18 @@ var Assets = class {
     const timeout = typeof webhookTimeout === "number" ? webhookTimeout : 10;
     await deployFunction(this, force, timeout);
   }
-  zarfYaml = (zarfYamlGenerator, path3) => zarfYamlGenerator(this, path3, "manifests");
-  zarfYamlChart = (zarfYamlGenerator, path3) => zarfYamlGenerator(this, path3, "charts");
+  zarfYaml = (zarfYamlGenerator, path4) => zarfYamlGenerator(this, path4, "manifests");
+  zarfYamlChart = (zarfYamlGenerator, path4) => zarfYamlGenerator(this, path4, "charts");
   allYaml = async (yamlGenerationFunction, getDeploymentFunction, getWatcherFunction, imagePullSecret) => {
     this.capabilities = await loadCapabilities(this.path);
     for (const capability of this.capabilities) {
       namespaceComplianceValidator(capability, this.alwaysIgnore?.namespaces);
+      namespaceComplianceValidator(
+        capability,
+        this.config.admission?.alwaysIgnore?.namespaces,
+        false
+      );
+      namespaceComplianceValidator(capability, this.config.watch?.alwaysIgnore?.namespaces, true);
     }
     const code = await import_fs3.promises.readFile(this.path);
     const moduleHash = import_crypto.default.createHash("sha256").update(code).digest("hex");
@@ -8538,26 +8594,8 @@ var Assets = class {
 var import_client_node3 = require("@kubernetes/client-node");
 var import_util = require("util");
 var import_uuid = require("uuid");
-
-// src/templates/.eslintrc.template.json
-var eslintrc_template_default = {
-  env: {
-    browser: false,
-    es2021: true
-  },
-  extends: ["eslint:recommended", "plugin:@typescript-eslint/recommended"],
-  parser: "@typescript-eslint/parser",
-  parserOptions: {
-    project: ["./tsconfig.json"],
-    ecmaVersion: 2022
-  },
-  plugins: ["@typescript-eslint"],
-  ignorePatterns: ["node_modules", "dist"],
-  root: true,
-  rules: {
-    "@typescript-eslint/no-floating-promises": ["error"]
-  }
-};
+var import_fs5 = require("fs");
+var import_path2 = __toESM(require("path"));
 
 // src/templates/pepr.code-snippets.json
 var pepr_code_snippets_default = {
@@ -8797,8 +8835,8 @@ var tsconfig_module_default = {
 var gitIgnore = "# Ignore node_modules and Pepr build artifacts\nnode_modules\ndist\ninsecure*\n";
 var readmeMd = '# Pepr Module\n\nThis is a Pepr Module. [Pepr](https://github.com/defenseunicorns/pepr) is a type-safe Kubernetes middleware system.\n\nThe `capabilities` directory contains all the capabilities for this module. By default,\na capability is a single typescript file in the format of `capability-name.ts` that is\nimported in the root `pepr.ts` file as `import { HelloPepr } from "./capabilities/hello-pepr";`.\nBecause this is typescript, you can organize this however you choose, e.g. creating a sub-folder\nper-capability or common logic in shared files or folders.\n\nExample Structure:\n\n```\nModule Root\n\u251C\u2500\u2500 package.json\n\u251C\u2500\u2500 pepr.ts\n\u2514\u2500\u2500 capabilities\n    \u251C\u2500\u2500 example-one.ts\n    \u251C\u2500\u2500 example-three.ts\n    \u2514\u2500\u2500 example-two.ts\n```\n';
 var peprTS = 'import { PeprModule } from "pepr";\n// cfg loads your pepr configuration from package.json\nimport cfg from "./package.json";\n\n// HelloPepr is a demo capability that is included with Pepr. Comment or delete the line below to remove it.\nimport { HelloPepr } from "./capabilities/hello-pepr";\n\n/**\n * This is the main entrypoint for this Pepr module. It is run when the module is started.\n * This is where you register your Pepr configurations and capabilities.\n */\nnew PeprModule(cfg, [\n  // "HelloPepr" is a demo capability that is included with Pepr. Comment or delete the line below to remove it.\n  HelloPepr,\n\n  // Your additional capabilities go here\n]);\n';
-var helloPeprTS = 'import {\n  Capability,\n  K8s,\n  Log,\n  PeprMutateRequest,\n  RegisterKind,\n  a,\n  fetch,\n  fetchStatus,\n  kind,\n} from "pepr";\nimport { MockAgent, setGlobalDispatcher } from "undici";\n\n/**\n *  The HelloPepr Capability is an example capability to demonstrate some general concepts of Pepr.\n *  To test this capability you run `pepr dev`and then run the following command:\n *  `kubectl apply -f capabilities/hello-pepr.samples.yaml`\n */\nexport const HelloPepr = new Capability({\n  name: "hello-pepr",\n  description: "A simple example capability to show how things work.",\n  namespaces: ["pepr-demo", "pepr-demo-2"],\n});\n\n// Use the \'When\' function to create a new action, use \'Store\' to persist data\nconst { When, Store } = HelloPepr;\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Namespace)                                   *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action removes the label `remove-me` when a Namespace is created.\n * Note we don\'t need to specify the namespace here, because we\'ve already specified\n * it in the Capability definition above.\n */\nWhen(a.Namespace)\n  .IsCreated()\n  .Mutate(ns => ns.RemoveLabel("remove-me"));\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Watch Action with K8s SSA (Namespace)                           *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action watches for the `pepr-demo-2` namespace to be created, then creates a ConfigMap with\n * the name `pepr-ssa-demo` and adds the namespace UID to the ConfigMap data. Because Pepr uses\n * server-side apply for this operation, the ConfigMap will be created or updated if it already exists.\n */\nWhen(a.Namespace)\n  .IsCreated()\n  .WithName("pepr-demo-2")\n  .Watch(async ns => {\n    Log.info("Namespace pepr-demo-2 was created.");\n\n    try {\n      // Apply the ConfigMap using K8s server-side apply\n      await K8s(kind.ConfigMap).Apply({\n        metadata: {\n          name: "pepr-ssa-demo",\n          namespace: "pepr-demo-2",\n        },\n        data: {\n          "ns-uid": ns.metadata.uid,\n        },\n      });\n    } catch (error) {\n      // You can use the Log object to log messages to the Pepr controller pod\n      Log.error(error, "Failed to apply ConfigMap using server-side apply.");\n    }\n\n    // You can share data between actions using the Store, including between different types of actions\n    Store.setItem("watch-data", "This data was stored by a Watch Action.");\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 1)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This is a single action. They can be in the same file or put imported from other files.\n * In this example, when a ConfigMap is created with the name `example-1`, then add a label and annotation.\n *\n * Equivalent to manually running:\n * `kubectl label configmap example-1 pepr=was-here`\n * `kubectl annotate configmap example-1 pepr.dev=annotations-work-too`\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-1")\n  .Mutate(request => {\n    request.SetLabel("pepr", "was-here").SetAnnotation("pepr.dev", "annotations-work-too");\n\n    // Use the Store to persist data between requests and Pepr controller pods\n    Store.setItem("example-1", "was-here");\n\n    // This data is written asynchronously and can be read back via `Store.getItem()` or `Store.subscribe()`\n    Store.setItem("example-1-data", JSON.stringify(request.Raw.data));\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate & Validate Actions (CM Example 2)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This combines 3 different types of actions: \'Mutate\', \'Validate\', and \'Watch\'. The order\n * of the actions is required, but each action is optional. In this example, when a ConfigMap is created\n * with the name `example-2`, then add a label and annotation, validate that the ConfigMap has the label\n * `pepr`, and log the request.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-2")\n  .Mutate(request => {\n    // This Mutate Action will mutate the request before it is persisted to the cluster\n\n    // Use `request.Merge()` to merge the new data with the existing data\n    request.Merge({\n      metadata: {\n        labels: {\n          pepr: "was-here",\n        },\n        annotations: {\n          "pepr.dev": "annotations-work-too",\n        },\n      },\n    });\n  })\n  .Validate(request => {\n    // This Validate Action will validate the request before it is persisted to the cluster\n\n    // Approve the request if the ConfigMap has the label \'pepr\'\n    if (request.HasLabel("pepr")) {\n      return request.Approve();\n    }\n\n    // Otherwise, deny the request with an error message (optional)\n    return request.Deny("ConfigMap must have label \'pepr\'");\n  })\n  .Watch((cm, phase) => {\n    // This Watch Action will watch the ConfigMap after it has been persisted to the cluster\n    Log.info(cm, `ConfigMap was ${phase} with the name example-2`);\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 2a)                               *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action shows a simple validation that will deny any ConfigMap that has the\n * annotation `evil`. Note that the `Deny()` function takes an optional second parameter that is a\n * user-defined status code to return.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .Validate(request => {\n    if (request.HasAnnotation("evil")) {\n      return request.Deny("No evil CM annotations allowed.", 400);\n    }\n\n    return request.Approve();\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 3)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action combines different styles. Unlike the previous actions, this one will look\n * for any ConfigMap in the `pepr-demo` namespace that has the label `change=by-label` during either\n * CREATE or UPDATE. Note that all conditions added such as `WithName()`, `WithLabel()`, `InNamespace()`,\n * are ANDs so all conditions must be true for the request to be processed.\n */\nWhen(a.ConfigMap)\n  .IsCreatedOrUpdated()\n  .WithLabel("change", "by-label")\n  .Mutate(request => {\n    // The K8s object e are going to mutate\n    const cm = request.Raw;\n\n    // Get the username and uid of the K8s request\n    const { username, uid } = request.Request.userInfo;\n\n    // Store some data about the request in the configmap\n    cm.data["username"] = username;\n    cm.data["uid"] = uid;\n\n    // You can still mix other ways of making changes too\n    request.SetAnnotation("pepr.dev", "making-waves");\n  });\n\n// This action validates the label `change=by-label` is deleted\nWhen(a.ConfigMap)\n  .IsDeleted()\n  .WithLabel("change", "by-label")\n  .Validate(request => {\n    // Log and then always approve the request\n    Log.info("CM with label \'change=by-label\' was deleted.");\n    return request.Approve();\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 4)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action show how you can use the `Mutate()` function without an inline function.\n * This is useful if you want to keep your actions small and focused on a single task,\n * or if you want to reuse the same function in multiple actions.\n */\nWhen(a.ConfigMap).IsCreated().WithName("example-4").Mutate(example4Cb);\n\n// This function uses the complete type definition, but is not required.\nfunction example4Cb(cm: PeprMutateRequest<a.ConfigMap>) {\n  cm.SetLabel("pepr.dev/first", "true");\n  cm.SetLabel("pepr.dev/second", "true");\n  cm.SetLabel("pepr.dev/third", "true");\n}\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 4a)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This is the same as Example 4, except this only operates on a CM in the `pepr-demo-2` namespace.\n * Note because the Capability defines namespaces, the namespace specified here must be one of those.\n * Alternatively, you can remove the namespace from the Capability definition and specify it here.\n */\nWhen(a.ConfigMap).IsCreated().InNamespace("pepr-demo-2").WithName("example-4a").Mutate(example4Cb);\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 5)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action is a bit more complex. It will look for any ConfigMap in the `pepr-demo`\n * namespace that has the label `chuck-norris` during CREATE. When it finds one, it will fetch a\n * random Chuck Norris joke from the API and add it to the ConfigMap. This is a great example of how\n * you can use Pepr to make changes to your K8s objects based on external data.\n *\n * Note the use of the `async` keyword. This is required for any action that uses `await` or `fetch()`.\n *\n * Also note we are passing a type to the `fetch()` function. This is optional, but it will help you\n * avoid mistakes when working with the data returned from the API. You can also use the `as` keyword to\n * cast the data returned from the API.\n *\n * These are equivalent:\n * ```ts\n * const joke = await fetch<TheChuckNorrisJoke>("https://icanhazdadjoke.com/");\n * const joke = await fetch("https://icanhazdadjoke.com/") as TheChuckNorrisJoke;\n * ```\n *\n * Alternatively, you can drop the type completely:\n *\n * ```ts\n * fetch("https://icanhazdadjoke.com")\n * ```\n */\ninterface TheChuckNorrisJoke {\n  id: string;\n  joke: string;\n  status: number;\n}\n\nWhen(a.ConfigMap)\n  .IsCreatedOrUpdated()\n  .WithLabel("chuck-norris")\n  .Mutate(cm => cm.SetLabel("got-jokes", "true"))\n  .Watch(async cm => {\n    const jokeURL = "https://icanhazdadjoke.com";\n\n    const mockAgent: MockAgent = new MockAgent();\n    setGlobalDispatcher(mockAgent);\n    const mockClient = mockAgent.get(jokeURL);\n    mockClient.intercept({ path: "/", method: "GET" }).reply(\n      200,\n      {\n        id: "R7UfaahVfFd",\n        joke: "Funny joke goes here.",\n        status: 200,\n      },\n      {\n        headers: {\n          "Content-Type": "application/json; charset=utf-8",\n        },\n      },\n    );\n\n    // Try/catch is not needed as a response object will always be returned\n    const response = await fetch<TheChuckNorrisJoke>(jokeURL, {\n      headers: {\n        Accept: "application/json",\n      },\n    });\n\n    // Instead, check the `response.ok` field\n    if (response.ok) {\n      const { joke } = response.data;\n      // Add Joke to the Store\n      await Store.setItemAndWait(jokeURL, joke);\n      // Add the Chuck Norris joke to the configmap\n      try {\n        await K8s(kind.ConfigMap).Apply({\n          metadata: {\n            name: cm.metadata.name,\n            namespace: cm.metadata.namespace,\n          },\n          data: {\n            "chuck-says": Store.getItem(jokeURL),\n          },\n        });\n      } catch (error) {\n        Log.error(error, "Failed to apply ConfigMap using server-side apply.", {\n          cm,\n        });\n      }\n    }\n\n    // You can also assert on different HTTP response codes\n    if (response.status === fetchStatus.NOT_FOUND) {\n      // Do something else\n      return;\n    }\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Secret Base64 Handling)                      *\n * ---------------------------------------------------------------------------------------------------\n *\n * The K8s JS client provides incomplete support for base64 encoding/decoding handling for secrets,\n * unlike the GO client. To make this less painful, Pepr automatically handles base64 encoding/decoding\n * secret data before and after the action is executed.\n */\nWhen(a.Secret)\n  .IsCreated()\n  .WithName("secret-1")\n  .Mutate(request => {\n    const secret = request.Raw;\n\n    // This will be encoded at the end of all processing back to base64: "Y2hhbmdlLXdpdGhvdXQtZW5jb2Rpbmc="\n    secret.data.magic = "change-without-encoding";\n\n    // You can modify the data directly, and it will be encoded at the end of all processing\n    secret.data.example += " - modified by Pepr";\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Untyped Custom Resource)                     *\n * ---------------------------------------------------------------------------------------------------\n *\n * Out of the box, Pepr supports all the standard Kubernetes objects. However, you can also create\n * your own types. This is useful if you are working with an Operator that creates custom resources.\n * There are two ways to do this, the first is to use the `When()` function with a `GenericKind`,\n * the second is to create a new class that extends `GenericKind` and use the `RegisterKind()` function.\n *\n * This example shows how to use the `When()` function with a `GenericKind`. Note that you\n * must specify the `group`, `version`, and `kind` of the object (if applicable). This is how Pepr knows\n * if the action should be triggered or not. Since we are using a `GenericKind`,\n * Pepr will not be able to provide any intellisense for the object, so you will need to refer to the\n * Kubernetes API documentation for the object you are working with.\n *\n * You will need to wait for the CRD in `hello-pepr.samples.yaml` to be created, then you can apply\n *\n * ```yaml\n * apiVersion: pepr.dev/v1\n * kind: Unicorn\n * metadata:\n *   name: example-1\n *   namespace: pepr-demo\n * spec:\n *   message: replace-me\n *   counter: 0\n * ```\n */\nWhen(a.GenericKind, {\n  group: "pepr.dev",\n  version: "v1",\n  kind: "Unicorn",\n})\n  .IsCreated()\n  .WithName("example-1")\n  .Mutate(request => {\n    request.Merge({\n      spec: {\n        message: "Hello Pepr without type data!",\n        counter: Math.random(),\n      },\n    });\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Typed Custom Resource)                       *\n * ---------------------------------------------------------------------------------------------------\n *\n * This example shows how to use the `RegisterKind()` function to create a new type. This is useful\n * if you are working with an Operator that creates custom resources and you want to have intellisense\n * for the object. Note that you must specify the `group`, `version`, and `kind` of the object (if applicable)\n * as this is how Pepr knows if the action should be triggered or not.\n *\n * Once you register a new Kind with Pepr, you can use the `When()` function with the new Kind. Ideally,\n * you should register custom Kinds at the top of your Capability file or Pepr Module so they are available\n * to all actions, but we are putting it here for demonstration purposes.\n *\n * You will need to wait for the CRD in `hello-pepr.samples.yaml` to be created, then you can apply\n *\n * ```yaml\n * apiVersion: pepr.dev/v1\n * kind: Unicorn\n * metadata:\n *   name: example-2\n *   namespace: pepr-demo\n * spec:\n *   message: replace-me\n *   counter: 0\n * ```*\n */\nclass UnicornKind extends a.GenericKind {\n  spec: {\n    /**\n     * JSDoc comments can be added to explain more details about the field.\n     *\n     * @example\n     * ```ts\n     * request.Raw.spec.message = "Hello Pepr!";\n     * ```\n     * */\n    message: string;\n    counter: number;\n  };\n}\n\nRegisterKind(UnicornKind, {\n  group: "pepr.dev",\n  version: "v1",\n  kind: "Unicorn",\n});\n\nWhen(UnicornKind)\n  .IsCreated()\n  .WithName("example-2")\n  .Mutate(request => {\n    request.Merge({\n      spec: {\n        message: "Hello Pepr with type data!",\n        counter: Math.random(),\n      },\n    });\n  });\n\n/**\n * A callback function that is called once the Pepr Store is fully loaded.\n */\nStore.onReady(data => {\n  Log.info(data, "Pepr Store Ready");\n});\n';
-var packageJSON = { name: "pepr", description: "Kubernetes application engine", author: "Defense Unicorns", homepage: "https://github.com/defenseunicorns/pepr", license: "Apache-2.0", bin: "dist/cli.js", repository: "defenseunicorns/pepr", engines: { node: ">=18.0.0" }, files: ["/dist", "/src", "!src/**/*.test.ts", "!src/fixtures/**", "!dist/**/*.test.d.ts*"], version: "0.49.0", main: "dist/lib.js", types: "dist/lib.d.ts", scripts: { ci: "npm ci", "gen-data-json": "node hack/build-template-data.js", prebuild: "rm -fr dist/* && npm run gen-data-json", build: "tsc && node build.mjs && npm pack", "build:image": "npm run build && docker buildx build --output type=docker --tag pepr:dev .", "build:image:unicorn": "npm run build && docker buildx build --output type=docker --tag pepr:dev $(node scripts/read-unicorn-build-args.mjs) .", "set:version": "node scripts/set-version.js", test: "npm run test:unit && npm run test:journey && npm run test:journey-wasm", "test:artifacts": "npm run build && jest src/build-artifact.test.ts", "test:integration": "npm run test:integration:prep && npm run test:integration:run", "test:integration:prep": "./integration/prep.sh", "test:integration:run": "jest --maxWorkers=4 integration", "test:journey": "npm run test:journey:k3d && npm run build && npm run test:journey:image && npm run test:journey:run", "test:journey-wasm": "npm run test:journey:k3d && npm run build && npm run test:journey:image && npm run test:journey:run-wasm", "test:journey-wasm:unicorn": "npm run test:journey:k3d && npm run build && npm run test:journey:image:unicorn && npm run test:journey:run-wasm", "test:journey:image": "docker buildx build --output type=docker --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev", "test:journey:image:unicorn": "npm run build && docker buildx build --output type=docker --tag pepr:dev $(node scripts/read-unicorn-build-args.mjs) . && k3d image import pepr:dev -c pepr-dev", "test:journey:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0' --wait && kubectl rollout status deployment -n kube-system", "test:journey:run": "jest --detectOpenHandles journey/entrypoint.test.ts && npm run test:journey:upgrade", "test:journey:run-wasm": "jest --detectOpenHandles journey/entrypoint-wasm.test.ts", "test:journey:unicorn": "npm run test:journey:k3d && npm run test:journey:image:unicorn && npm run test:journey:run", "test:journey:upgrade": "npm run test:journey:k3d && npm run test:journey:image && jest --detectOpenHandles journey/pepr-upgrade.test.ts", "test:unit": "npm run gen-data-json && jest src --coverage --detectOpenHandles --coverageDirectory=./coverage --testPathIgnorePatterns='build-artifact.test.ts'", "format:check": "eslint src && prettier --config .prettierrc src --check", "format:fix": "eslint src --fix && prettier --config .prettierrc src --write", prepare: `if [ "$NODE_ENV" != 'production' ]; then husky; fi` }, dependencies: { "@types/ramda": "0.30.2", express: "5.1.0", "fast-json-patch": "3.1.1", heredoc: "^1.3.1", "http-status-codes": "^2.3.0", "json-pointer": "^0.6.2", "kubernetes-fluent-client": "3.5.1", pino: "9.6.0", "pino-pretty": "13.0.0", "prom-client": "15.1.3", ramda: "0.30.1", sigstore: "3.1.0", "ts-morph": "^25.0.1" }, devDependencies: { "@commitlint/cli": "19.8.0", "@commitlint/config-conventional": "19.8.0", "@fast-check/jest": "^2.0.1", "@jest/globals": "29.7.0", "@types/eslint": "9.6.1", "@types/express": "5.0.1", "@types/json-pointer": "^1.0.34", "@types/node": "22.x.x", "@types/node-forge": "1.3.11", "@types/uuid": "10.0.0", "fast-check": "^4.0.0", globals: "^16.0.0", husky: "^9.1.6", jest: "29.7.0", "js-yaml": "^4.1.0", shellcheck: "^3.0.0", "ts-jest": "29.3.2", undici: "^7.0.1" }, overrides: { glob: "^9.0.0" }, peerDependencies: { "@types/prompts": "2.4.9", "@typescript-eslint/eslint-plugin": "8.23.0", "@typescript-eslint/parser": "8.23.0", commander: "13.1.0", esbuild: "0.25.0", eslint: "8.57.0", "node-forge": "1.3.1", prettier: "3.4.2", prompts: "2.4.2", typescript: "5.7.3", uuid: "11.0.5" } };
+var helloPeprTS = 'import {\n  Capability,\n  K8s,\n  Log,\n  PeprMutateRequest,\n  RegisterKind,\n  a,\n  fetch,\n  fetchStatus,\n  kind,\n} from "pepr";\nimport { MockAgent, setGlobalDispatcher } from "undici";\n\n/**\n *  The HelloPepr Capability is an example capability to demonstrate some general concepts of Pepr.\n *  To test this capability you run `pepr dev`and then run the following command:\n *  `kubectl apply -f capabilities/hello-pepr.samples.yaml`\n */\nexport const HelloPepr = new Capability({\n  name: "hello-pepr",\n  description: "A simple example capability to show how things work.",\n  namespaces: ["pepr-demo", "pepr-demo-2"],\n});\n\n// Use the \'When\' function to create a new action, use \'Store\' to persist data\nconst { When, Store } = HelloPepr;\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Namespace)                                   *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action removes the label `remove-me` when a Namespace is created.\n * Note we don\'t need to specify the namespace here, because we\'ve already specified\n * it in the Capability definition above.\n */\nWhen(a.Namespace)\n  .IsCreated()\n  .Mutate(ns => ns.RemoveLabel("remove-me"));\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Watch Action with K8s SSA (Namespace)                           *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action watches for the `pepr-demo-2` namespace to be created, then creates a ConfigMap with\n * the name `pepr-ssa-demo` and adds the namespace UID to the ConfigMap data. Because Pepr uses\n * server-side apply for this operation, the ConfigMap will be created or updated if it already exists.\n */\nWhen(a.Namespace)\n  .IsCreated()\n  .WithName("pepr-demo-2")\n  .Watch(async ns => {\n    Log.info("Namespace pepr-demo-2 was created.");\n\n    try {\n      // Apply the ConfigMap using K8s server-side apply\n      await K8s(kind.ConfigMap).Apply({\n        metadata: {\n          name: "pepr-ssa-demo",\n          namespace: "pepr-demo-2",\n        },\n        data: {\n          "ns-uid": ns.metadata.uid,\n        },\n      });\n    } catch (error) {\n      // You can use the Log object to log messages to the Pepr controller pod\n      Log.error(error, "Failed to apply ConfigMap using server-side apply.");\n    }\n\n    // You can share data between actions using the Store, including between different types of actions\n    Store.setItem("watch-data", "This data was stored by a Watch Action.");\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 1)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This is a single action. They can be in the same file or put imported from other files.\n * In this example, when a ConfigMap is created with the name `example-1`, then add a label and annotation.\n *\n * Equivalent to manually running:\n * `kubectl label configmap example-1 pepr=was-here`\n * `kubectl annotate configmap example-1 pepr.dev=annotations-work-too`\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-1")\n  .Mutate(request => {\n    request.SetLabel("pepr", "was-here").SetAnnotation("pepr.dev", "annotations-work-too");\n\n    // Use the Store to persist data between requests and Pepr controller pods\n    Store.setItem("example-1", "was-here");\n\n    // This data is written asynchronously and can be read back via `Store.getItem()` or `Store.subscribe()`\n    Store.setItem("example-1-data", JSON.stringify(request.Raw.data));\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate & Validate Actions (CM Example 2)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This combines 3 different types of actions: \'Mutate\', \'Validate\', and \'Watch\'. The order\n * of the actions is required, but each action is optional. In this example, when a ConfigMap is created\n * with the name `example-2`, then add a label and annotation, validate that the ConfigMap has the label\n * `pepr`, and log the request.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-2")\n  .Mutate(request => {\n    // This Mutate Action will mutate the request before it is persisted to the cluster\n\n    // Use `request.Merge()` to merge the new data with the existing data\n    request.Merge({\n      metadata: {\n        labels: {\n          pepr: "was-here",\n        },\n        annotations: {\n          "pepr.dev": "annotations-work-too",\n        },\n      },\n    });\n  })\n  .Validate(request => {\n    // This Validate Action will validate the request before it is persisted to the cluster\n\n    // Approve the request if the ConfigMap has the label \'pepr\'\n    if (request.HasLabel("pepr")) {\n      return request.Approve();\n    }\n\n    // Otherwise, deny the request with an error message (optional)\n    return request.Deny("ConfigMap must have label \'pepr\'");\n  })\n  .Watch((cm, phase) => {\n    // This Watch Action will watch the ConfigMap after it has been persisted to the cluster\n    Log.info(cm, `ConfigMap was ${phase} with the name example-2`);\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 2a)                               *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action shows a simple validation that will deny any ConfigMap that has the\n * annotation `evil`. Note that the `Deny()` function takes an optional second parameter that is a\n * user-defined status code to return.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .Validate(request => {\n    if (request.HasAnnotation("evil")) {\n      return request.Deny("No evil CM annotations allowed.", 400);\n    }\n\n    return request.Approve();\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 3)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action combines different styles. Unlike the previous actions, this one will look\n * for any ConfigMap in the `pepr-demo` namespace that has the label `change=by-label` during either\n * CREATE or UPDATE. Note that all conditions added such as `WithName()`, `WithLabel()`, `InNamespace()`,\n * are ANDs so all conditions must be true for the request to be processed.\n */\nWhen(a.ConfigMap)\n  .IsCreatedOrUpdated()\n  .WithLabel("change", "by-label")\n  .Mutate(request => {\n    // The K8s object e are going to mutate\n    const cm = request.Raw;\n\n    // Get the username and uid of the K8s request\n    const { username, uid } = request.Request.userInfo;\n\n    // Store some data about the request in the configmap\n    cm.data["username"] = username;\n    cm.data["uid"] = uid;\n\n    // You can still mix other ways of making changes too\n    request.SetAnnotation("pepr.dev", "making-waves");\n  });\n\n// This action validates the label `change=by-label` is deleted\nWhen(a.ConfigMap)\n  .IsDeleted()\n  .WithLabel("change", "by-label")\n  .Validate(request => {\n    // Log and then always approve the request\n    Log.info("CM with label \'change=by-label\' was deleted.");\n    return request.Approve();\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 4)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action show how you can use the `Mutate()` function without an inline function.\n * This is useful if you want to keep your actions small and focused on a single task,\n * or if you want to reuse the same function in multiple actions.\n */\nWhen(a.ConfigMap).IsCreated().WithName("example-4").Mutate(example4Cb);\n\n// This function uses the complete type definition, but is not required.\nfunction example4Cb(cm: PeprMutateRequest<a.ConfigMap>): void {\n  cm.SetLabel("pepr.dev/first", "true");\n  cm.SetLabel("pepr.dev/second", "true");\n  cm.SetLabel("pepr.dev/third", "true");\n}\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 4a)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This is the same as Example 4, except this only operates on a CM in the `pepr-demo-2` namespace.\n * Note because the Capability defines namespaces, the namespace specified here must be one of those.\n * Alternatively, you can remove the namespace from the Capability definition and specify it here.\n */\nWhen(a.ConfigMap).IsCreated().InNamespace("pepr-demo-2").WithName("example-4a").Mutate(example4Cb);\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 5)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action is a bit more complex. It will look for any ConfigMap in the `pepr-demo`\n * namespace that has the label `chuck-norris` during CREATE. When it finds one, it will fetch a\n * random Chuck Norris joke from the API and add it to the ConfigMap. This is a great example of how\n * you can use Pepr to make changes to your K8s objects based on external data.\n *\n * Note the use of the `async` keyword. This is required for any action that uses `await` or `fetch()`.\n *\n * Also note we are passing a type to the `fetch()` function. This is optional, but it will help you\n * avoid mistakes when working with the data returned from the API. You can also use the `as` keyword to\n * cast the data returned from the API.\n *\n * These are equivalent:\n * ```ts\n * const joke = await fetch<TheChuckNorrisJoke>("https://icanhazdadjoke.com/");\n * const joke = await fetch("https://icanhazdadjoke.com/") as TheChuckNorrisJoke;\n * ```\n *\n * Alternatively, you can drop the type completely:\n *\n * ```ts\n * fetch("https://icanhazdadjoke.com")\n * ```\n */\ninterface TheChuckNorrisJoke {\n  id: string;\n  joke: string;\n  status: number;\n}\n\nWhen(a.ConfigMap)\n  .IsCreatedOrUpdated()\n  .WithLabel("chuck-norris")\n  .Mutate(cm => cm.SetLabel("got-jokes", "true"))\n  .Watch(async cm => {\n    const jokeURL = "https://icanhazdadjoke.com";\n\n    const mockAgent: MockAgent = new MockAgent();\n    setGlobalDispatcher(mockAgent);\n    const mockClient = mockAgent.get(jokeURL);\n    mockClient.intercept({ path: "/", method: "GET" }).reply(\n      200,\n      {\n        id: "R7UfaahVfFd",\n        joke: "Funny joke goes here.",\n        status: 200,\n      },\n      {\n        headers: {\n          "Content-Type": "application/json; charset=utf-8",\n        },\n      },\n    );\n\n    // Try/catch is not needed as a response object will always be returned\n    const response = await fetch<TheChuckNorrisJoke>(jokeURL, {\n      headers: {\n        Accept: "application/json",\n      },\n    });\n\n    // Instead, check the `response.ok` field\n    if (response.ok) {\n      const { joke } = response.data;\n      // Add Joke to the Store\n      await Store.setItemAndWait(jokeURL, joke);\n      // Add the Chuck Norris joke to the configmap\n      try {\n        await K8s(kind.ConfigMap).Apply({\n          metadata: {\n            name: cm.metadata.name,\n            namespace: cm.metadata.namespace,\n          },\n          data: {\n            "chuck-says": Store.getItem(jokeURL),\n          },\n        });\n      } catch (error) {\n        Log.error(error, "Failed to apply ConfigMap using server-side apply.", {\n          cm,\n        });\n      }\n    }\n\n    // You can also assert on different HTTP response codes\n    if (response.status === fetchStatus.NOT_FOUND) {\n      // Do something else\n      return;\n    }\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Secret Base64 Handling)                      *\n * ---------------------------------------------------------------------------------------------------\n *\n * The K8s JS client provides incomplete support for base64 encoding/decoding handling for secrets,\n * unlike the GO client. To make this less painful, Pepr automatically handles base64 encoding/decoding\n * secret data before and after the action is executed.\n */\nWhen(a.Secret)\n  .IsCreated()\n  .WithName("secret-1")\n  .Mutate(request => {\n    const secret = request.Raw;\n\n    // This will be encoded at the end of all processing back to base64: "Y2hhbmdlLXdpdGhvdXQtZW5jb2Rpbmc="\n    secret.data.magic = "change-without-encoding";\n\n    // You can modify the data directly, and it will be encoded at the end of all processing\n    secret.data.example += " - modified by Pepr";\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Untyped Custom Resource)                     *\n * ---------------------------------------------------------------------------------------------------\n *\n * Out of the box, Pepr supports all the standard Kubernetes objects. However, you can also create\n * your own types. This is useful if you are working with an Operator that creates custom resources.\n * There are two ways to do this, the first is to use the `When()` function with a `GenericKind`,\n * the second is to create a new class that extends `GenericKind` and use the `RegisterKind()` function.\n *\n * This example shows how to use the `When()` function with a `GenericKind`. Note that you\n * must specify the `group`, `version`, and `kind` of the object (if applicable). This is how Pepr knows\n * if the action should be triggered or not. Since we are using a `GenericKind`,\n * Pepr will not be able to provide any intellisense for the object, so you will need to refer to the\n * Kubernetes API documentation for the object you are working with.\n *\n * You will need to wait for the CRD in `hello-pepr.samples.yaml` to be created, then you can apply\n *\n * ```yaml\n * apiVersion: pepr.dev/v1\n * kind: Unicorn\n * metadata:\n *   name: example-1\n *   namespace: pepr-demo\n * spec:\n *   message: replace-me\n *   counter: 0\n * ```\n */\nWhen(a.GenericKind, {\n  group: "pepr.dev",\n  version: "v1",\n  kind: "Unicorn",\n})\n  .IsCreated()\n  .WithName("example-1")\n  .Mutate(request => {\n    request.Merge({\n      spec: {\n        message: "Hello Pepr without type data!",\n        counter: Math.random(),\n      },\n    });\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Typed Custom Resource)                       *\n * ---------------------------------------------------------------------------------------------------\n *\n * This example shows how to use the `RegisterKind()` function to create a new type. This is useful\n * if you are working with an Operator that creates custom resources and you want to have intellisense\n * for the object. Note that you must specify the `group`, `version`, and `kind` of the object (if applicable)\n * as this is how Pepr knows if the action should be triggered or not.\n *\n * Once you register a new Kind with Pepr, you can use the `When()` function with the new Kind. Ideally,\n * you should register custom Kinds at the top of your Capability file or Pepr Module so they are available\n * to all actions, but we are putting it here for demonstration purposes.\n *\n * You will need to wait for the CRD in `hello-pepr.samples.yaml` to be created, then you can apply\n *\n * ```yaml\n * apiVersion: pepr.dev/v1\n * kind: Unicorn\n * metadata:\n *   name: example-2\n *   namespace: pepr-demo\n * spec:\n *   message: replace-me\n *   counter: 0\n * ```*\n */\nclass UnicornKind extends a.GenericKind {\n  spec: {\n    /**\n     * JSDoc comments can be added to explain more details about the field.\n     *\n     * @example\n     * ```ts\n     * request.Raw.spec.message = "Hello Pepr!";\n     * ```\n     * */\n    message: string;\n    counter: number;\n  };\n}\n\nRegisterKind(UnicornKind, {\n  group: "pepr.dev",\n  version: "v1",\n  kind: "Unicorn",\n});\n\nWhen(UnicornKind)\n  .IsCreated()\n  .WithName("example-2")\n  .Mutate(request => {\n    request.Merge({\n      spec: {\n        message: "Hello Pepr with type data!",\n        counter: Math.random(),\n      },\n    });\n  });\n\n/**\n * A callback function that is called once the Pepr Store is fully loaded.\n */\nStore.onReady(data => {\n  Log.info(data, "Pepr Store Ready");\n});\n';
+var packageJSON = { name: "pepr", description: "Kubernetes application engine", author: "Defense Unicorns", homepage: "https://github.com/defenseunicorns/pepr", license: "Apache-2.0", bin: "dist/cli.js", repository: "defenseunicorns/pepr", engines: { node: ">=18.0.0" }, files: ["/dist", "/src", "!src/**/*.test.ts", "!src/fixtures/**", "!dist/**/*.test.d.ts*", "!src/cli/docs/**"], version: "0.50.0-nightly.1", main: "dist/lib.js", types: "dist/lib.d.ts", scripts: { ci: "npm ci", "gen-data-json": "node hack/build-template-data.js", prebuild: "rm -fr dist/* && npm run gen-data-json", build: "tsc && node build.mjs && npm pack", "build:image": "npm run build && docker buildx build --output type=docker --tag pepr:dev .", "build:image:unicorn": "npm run build && docker buildx build --output type=docker --tag pepr:dev $(node scripts/read-unicorn-build-args.mjs) .", "set:version": "node scripts/set-version.js", test: "npm run test:unit && npm run test:journey && npm run test:journey-wasm", "test:artifacts": "npm run build && jest src/build-artifact.test.ts", "test:docs": "jest --verbose src/cli/docs/*.test.ts", "test:integration": "npm run test:integration:prep && npm run test:integration:run", "test:integration:prep": "./integration/prep.sh", "test:integration:run": "jest --maxWorkers=4 integration", "test:journey": "npm run test:journey:k3d && npm run build && npm run test:journey:image && npm run test:journey:run", "test:journey-wasm": "npm run test:journey:k3d && npm run build && npm run test:journey:image && npm run test:journey:run-wasm", "test:journey-wasm:unicorn": "npm run test:journey:k3d && npm run build && npm run test:journey:image:unicorn && npm run test:journey:run-wasm", "test:journey:image": "docker buildx build --output type=docker --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev", "test:journey:image:unicorn": "npm run build && docker buildx build --output type=docker --tag pepr:dev $(node scripts/read-unicorn-build-args.mjs) . && k3d image import pepr:dev -c pepr-dev", "test:journey:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0' --wait && kubectl rollout status deployment -n kube-system", "test:journey:run": "jest --detectOpenHandles journey/entrypoint.test.ts && npm run test:journey:upgrade", "test:journey:run-wasm": "jest --detectOpenHandles journey/entrypoint-wasm.test.ts", "test:journey:unicorn": "npm run test:journey:k3d && npm run test:journey:image:unicorn && npm run test:journey:run", "test:journey:upgrade": "npm run test:journey:k3d && npm run test:journey:image && jest --detectOpenHandles journey/pepr-upgrade.test.ts", "test:unit": 'npm run gen-data-json && jest src --coverage --detectOpenHandles --coverageDirectory=./coverage --testPathIgnorePatterns="build-artifact.test.ts|src/cli/docs/.*\\.test\\.ts"', "format:check": "eslint --ignore-pattern src/templates/eslint.config.mjs  src && prettier --config .prettierrc src --check", "format:fix": "eslint --fix --ignore-pattern src/templates/eslint.config.mjs  src && prettier --config .prettierrc src --write", prepare: `if [ "$NODE_ENV" != 'production' ]; then husky; fi` }, dependencies: { "@types/ramda": "0.30.2", express: "5.1.0", "fast-json-patch": "3.1.1", heredoc: "^1.3.1", "http-status-codes": "^2.3.0", "json-pointer": "^0.6.2", "kubernetes-fluent-client": "3.5.3", pino: "9.6.0", "pino-pretty": "13.0.0", "prom-client": "15.1.3", ramda: "0.30.1", sigstore: "3.1.0", "ts-morph": "^25.0.1" }, devDependencies: { "@commitlint/cli": "19.8.1", "@commitlint/config-conventional": "19.8.1", "@fast-check/jest": "^2.0.1", "@jest/globals": "29.7.0", "@types/eslint": "9.6.1", "@types/express": "5.0.1", "@types/json-pointer": "^1.0.34", "@types/node": "22.x.x", "@types/node-forge": "1.3.11", "@types/uuid": "10.0.0", "fast-check": "^4.0.0", globals: "^16.0.0", husky: "^9.1.6", jest: "29.7.0", "js-yaml": "^4.1.0", shellcheck: "^3.0.0", "ts-jest": "29.3.2", undici: "^7.0.1" }, overrides: { glob: "^9.0.0" }, peerDependencies: { "@types/prompts": "2.4.9", "@typescript-eslint/eslint-plugin": "8.32.1", "@typescript-eslint/parser": "8.32.1", commander: "13.1.0", esbuild: "0.25.0", eslint: "^9.26.0", "node-forge": "1.3.1", prettier: "3.5.3", prompts: "2.4.2", typescript: "5.8.3", uuid: "11.1.0" } };
 
 // src/cli/init/utils.ts
 var import_fs4 = require("fs");
@@ -8824,11 +8862,11 @@ async function createDir(dir) {
     }
   }
 }
-function write(path3, data) {
+function write(path4, data) {
   if (typeof data !== "string") {
     data = JSON.stringify(data, null, 2);
   }
-  return import_fs4.promises.writeFile(path3, data);
+  return import_fs4.promises.writeFile(path4, data);
 }
 
 // src/cli/init/templates.ts
@@ -8861,6 +8899,16 @@ function genPkgJSON(opts, pgkVerOverride) {
       alwaysIgnore: {
         namespaces: []
       },
+      admission: {
+        alwaysIgnore: {
+          namespaces: []
+        }
+      },
+      watch: {
+        alwaysIgnore: {
+          namespaces: []
+        }
+      },
       includedFiles: [],
       env: pgkVerOverride ? testEnv : {}
     },
@@ -8918,38 +8966,49 @@ var prettier = {
   data: prettierrc_default
 };
 var eslint = {
-  path: ".eslintrc.json",
-  data: eslintrc_template_default
+  path: "eslint.config.mjs",
+  data: (0, import_fs5.readFileSync)(
+    import_path2.default.resolve(
+      (() => {
+        const fullPath = __dirname;
+        const lengthOfSuffix = "pepr/".length;
+        const lastPeprIndex = fullPath.lastIndexOf("pepr/");
+        return fullPath.substring(0, lastPeprIndex + lengthOfSuffix);
+      })(),
+      "src/templates/eslint.config.mjs"
+    ),
+    "utf-8"
+  )
 };
 
 // src/cli/build.ts
 var import_commander = require("commander");
 
-// src/cli/format.ts
+// src/cli/format/index.ts
 var import_eslint = require("eslint");
 
-// src/cli/format.helpers.ts
-var import_fs5 = require("fs");
+// src/cli/format/format.helpers.ts
+var import_fs6 = require("fs");
 var import_prettier = require("prettier");
 async function formatWithPrettier(results, validateOnly) {
   let hasFailure = false;
   for (const { filePath } of results) {
-    const content = await import_fs5.promises.readFile(filePath, "utf8");
+    const content = await import_fs6.promises.readFile(filePath, "utf8");
     const cfg = await (0, import_prettier.resolveConfig)(filePath);
     const formatted = await (0, import_prettier.format)(content, { filepath: filePath, ...cfg });
     if (validateOnly && formatted !== content) {
       hasFailure = true;
       console.error(`File ${filePath} is not formatted correctly`);
     } else {
-      await import_fs5.promises.writeFile(filePath, formatted);
+      await import_fs6.promises.writeFile(filePath, formatted);
     }
   }
   return hasFailure;
 }
 
-// src/cli/format.ts
+// src/cli/format/index.ts
 function format_default(program2) {
-  program2.command("format").description("Lint and format this Pepr module").option("-v, --validate-only", "Do not modify files, only validate formatting").action(async (opts) => {
+  program2.command("format").description("Lint and format this Pepr module").option("-v, --validate-only", "Do not modify files, only validate formatting.").action(async (opts) => {
     const success = await peprFormat(opts.validateOnly);
     if (success) {
       console.info("\u2705 Module formatted");
@@ -8988,7 +9047,7 @@ async function peprFormat(validateOnly) {
 }
 
 // src/lib/included-files.ts
-var import_fs6 = require("fs");
+var import_fs7 = require("fs");
 async function createDockerfile(version3, description, includedFiles) {
   const file = `
     # Use an official Node.js runtime as the base image
@@ -9000,14 +9059,14 @@ async function createDockerfile(version3, description, includedFiles) {
     ${includedFiles.map((f) => `ADD ${f} ${f}`).join("\n")}
   
     `;
-  await import_fs6.promises.writeFile("Dockerfile.controller", file, { encoding: "utf-8" });
+  await import_fs7.promises.writeFile("Dockerfile.controller", file, { encoding: "utf-8" });
 }
 
 // src/cli/build.helpers.ts
 var import_child_process2 = require("child_process");
 var import_esbuild = require("esbuild");
-var import_path2 = require("path");
-var import_fs8 = require("fs");
+var import_path3 = require("path");
+var import_fs9 = require("fs");
 
 // src/lib/assets/yaml/generateAllYaml.ts
 var import_crypto2 = __toESM(require("crypto"));
@@ -9322,7 +9381,7 @@ function getDeployment(assets, hash, buildTimestamp, imagePullSecret) {
 }
 function getModuleSecret(name2, data, hash) {
   const compressed = (0, import_zlib.gzipSync)(data);
-  const path3 = `module-${hash}.js.gz`;
+  const path4 = `module-${hash}.js.gz`;
   const compressedData = compressed.toString("base64");
   if (secretOverLimit(compressedData)) {
     const error = new Error(`Module secret for ${name2} is over the 1MB limit`);
@@ -9337,14 +9396,14 @@ function getModuleSecret(name2, data, hash) {
       },
       type: "Opaque",
       data: {
-        [path3]: compressed.toString("base64")
+        [path4]: compressed.toString("base64")
       }
     };
   }
 }
 
 // src/lib/assets/yaml/generateAllYaml.ts
-var import_fs7 = require("fs");
+var import_fs8 = require("fs");
 
 // src/lib/assets/webhooks.ts
 var import_ramda = require("ramda");
@@ -9364,17 +9423,6 @@ var validateRule = (binding, isMutateWebhook) => {
   };
   return ruleObject;
 };
-function resolveIgnoreNamespaces(ignoredNSConfig = []) {
-  const ignoredNSEnv = process.env.PEPR_ADDITIONAL_IGNORED_NAMESPACES;
-  if (!ignoredNSEnv) {
-    return ignoredNSConfig;
-  }
-  const namespaces = ignoredNSEnv.split(",").map((ns) => ns.trim());
-  if (ignoredNSConfig) {
-    namespaces.push(...ignoredNSConfig);
-  }
-  return namespaces.filter((ns) => ns.length > 0);
-}
 async function generateWebhookRules(assets, isMutateWebhook) {
   const { config, capabilities } = assets;
   const rules = capabilities.flatMap((capability) => {
@@ -9388,7 +9436,9 @@ async function webhookConfigGenerator(assets, mutateOrValidate, timeoutSeconds =
   const { name: name2, tls, config, apiPath, host } = assets;
   const ignoreNS = (0, import_ramda.concat)(
     peprIgnoreNamespaces,
-    resolveIgnoreNamespaces(config?.alwaysIgnore?.namespaces)
+    resolveIgnoreNamespaces(
+      config?.alwaysIgnore?.namespaces?.length ? config?.alwaysIgnore?.namespaces : config?.admission?.alwaysIgnore?.namespaces
+    )
   );
   if (ignoreNS) {
     ignore.push({
@@ -9440,8 +9490,8 @@ async function webhookConfigGenerator(assets, mutateOrValidate, timeoutSeconds =
 
 // src/lib/assets/yaml/generateAllYaml.ts
 async function generateAllYaml(assets, deployments) {
-  const { name: name2, tls, apiPath, path: path3, config } = assets;
-  const code = await import_fs7.promises.readFile(path3);
+  const { name: name2, tls, apiPath, path: path4, config } = assets;
+  const code = await import_fs8.promises.readFile(path4);
   const hash = import_crypto2.default.createHash("sha256").update(code).digest("hex");
   const resources = [
     getNamespace(assets.config.customLabels?.namespace),
@@ -9474,18 +9524,18 @@ async function generateAllYaml(assets, deployments) {
 
 // src/lib/assets/yaml/generateZarfYaml.ts
 var import_client_node5 = require("@kubernetes/client-node");
-function generateZarfYamlGeneric(assets, path3, type) {
+function generateZarfYamlGeneric(assets, path4, type) {
   const zarfComponentName = process.env.PEPR_CUSTOM_BUILD_NAME ?? "module";
   const manifestSettings = {
     name: zarfComponentName,
     namespace: "pepr-system",
-    files: [path3]
+    files: [path4]
   };
   const chartSettings = {
     name: zarfComponentName,
     namespace: "pepr-system",
     version: `${assets.config.appVersion || "0.0.1"}`,
-    localPath: path3
+    localPath: path4
   };
   const component = {
     name: zarfComponentName,
@@ -9585,18 +9635,18 @@ async function generateYamlAndWriteToDisk(obj) {
   const { uuid, imagePullSecret, outputDir: outputDir2, assets, zarf } = obj;
   const yamlFile = `pepr-module-${uuid}.yaml`;
   const chartPath = `${uuid}-chart`;
-  const yamlPath = (0, import_path2.resolve)(outputDir2, yamlFile);
+  const yamlPath = (0, import_path3.resolve)(outputDir2, yamlFile);
   try {
     const yaml = await assets.allYaml(generateAllYaml, getDeployment, getWatcher, imagePullSecret);
-    const zarfPath = (0, import_path2.resolve)(outputDir2, "zarf.yaml");
+    const zarfPath = (0, import_path3.resolve)(outputDir2, "zarf.yaml");
     let localZarf = "";
     if (zarf === "chart") {
       localZarf = assets.zarfYamlChart(generateZarfYamlGeneric, chartPath);
     } else {
       localZarf = assets.zarfYaml(generateZarfYamlGeneric, yamlFile);
     }
-    await import_fs8.promises.writeFile(yamlPath, yaml);
-    await import_fs8.promises.writeFile(zarfPath, localZarf);
+    await import_fs9.promises.writeFile(yamlPath, yaml);
+    await import_fs9.promises.writeFile(zarfPath, localZarf);
     await assets.generateHelmChart(webhookConfigGenerator, getWatcher, getModuleSecret, outputDir2);
     console.info(`\u2705 K8s resource for the module saved to ${yamlPath}`);
   } catch (error) {
@@ -9611,7 +9661,7 @@ var outputDir = "dist";
 function build_default(program2) {
   program2.command("build").description("Build a Pepr Module for deployment").option("-e, --entry-point [file]", "Specify the entry point file to build with.", peprTS2).option(
     "-n, --no-embed",
-    "Disables embedding of deployment files into output module.  Useful when creating library modules intended solely for reuse/distribution via NPM."
+    "Disables embedding of deployment files into output module. Useful when creating library modules intended solely for reuse/distribution via NPM."
   ).addOption(
     new import_commander.Option(
       "-i, --custom-image <custom-image>",
@@ -9652,7 +9702,7 @@ function build_default(program2) {
   ).action(async (opts) => {
     outputDir = await handleCustomOutputDir(opts.outputDir);
     const buildModuleResult = await buildModule(void 0, opts.entryPoint, opts.embed);
-    const { cfg, path: path3 } = buildModuleResult;
+    const { cfg, path: path4 } = buildModuleResult;
     if (opts.customName) {
       process.env.PEPR_CUSTOM_BUILD_NAME = opts.customName;
     }
@@ -9675,7 +9725,7 @@ function build_default(program2) {
       );
     }
     if (!opts.embed) {
-      console.info(`\u2705 Module built successfully at ${path3}`);
+      console.info(`\u2705 Module built successfully at ${path4}`);
       return;
     }
     const assets = new Assets(
@@ -9689,7 +9739,7 @@ function build_default(program2) {
         // Can override the rbacMode with the CLI option
         rbacMode: determineRbacMode(opts, cfg)
       },
-      path3,
+      path4,
       opts.withPullSecret === "" ? [] : [opts.withPullSecret]
     );
     if (image !== "") assets.image = image;
@@ -9708,19 +9758,19 @@ var externalLibs = Object.keys(dependencies);
 externalLibs.push("pepr");
 externalLibs.push("@kubernetes/client-node");
 async function loadModule(entryPoint = peprTS2) {
-  const entryPointPath = (0, import_path3.resolve)(".", entryPoint);
-  const modulePath = (0, import_path3.dirname)(entryPointPath);
-  const cfgPath = (0, import_path3.resolve)(modulePath, "package.json");
+  const entryPointPath = (0, import_path4.resolve)(".", entryPoint);
+  const modulePath = (0, import_path4.dirname)(entryPointPath);
+  const cfgPath = (0, import_path4.resolve)(modulePath, "package.json");
   try {
-    await import_fs9.promises.access(cfgPath);
-    await import_fs9.promises.access(entryPointPath);
+    await import_fs10.promises.access(cfgPath);
+    await import_fs10.promises.access(entryPointPath);
   } catch {
     console.error(
       `Could not find ${cfgPath} or ${entryPointPath} in the current directory. Please run this command from the root of your module's directory.`
     );
     process.exit(1);
   }
-  const moduleText = await import_fs9.promises.readFile(cfgPath, { encoding: "utf-8" });
+  const moduleText = await import_fs10.promises.readFile(cfgPath, { encoding: "utf-8" });
   const cfg = JSON.parse(moduleText);
   const { uuid } = cfg.pepr;
   const name2 = `pepr-${uuid}.js`;
@@ -9733,13 +9783,13 @@ async function loadModule(entryPoint = peprTS2) {
     entryPointPath,
     modulePath,
     name: name2,
-    path: (0, import_path3.resolve)(outputDir, name2),
+    path: (0, import_path4.resolve)(outputDir, name2),
     uuid
   };
 }
 async function buildModule(reloader, entryPoint = peprTS2, embed = true) {
   try {
-    const { cfg, modulePath, path: path3, uuid } = await loadModule(entryPoint);
+    const { cfg, modulePath, path: path4, uuid } = await loadModule(entryPoint);
     await checkFormat();
     const npmRoot = (0, import_child_process3.execFileSync)("npm", ["root"]).toString().trim();
     const args = ["--project", `${modulePath}/tsconfig.json`, "--outdir", outputDir];
@@ -9753,7 +9803,7 @@ async function buildModule(reloader, entryPoint = peprTS2, embed = true) {
       legalComments: "external",
       metafile: true,
       minify: true,
-      outfile: path3,
+      outfile: path4,
       plugins: [
         {
           name: "reload-server",
@@ -9778,12 +9828,12 @@ async function buildModule(reloader, entryPoint = peprTS2, embed = true) {
     }
     if (!embed) {
       ctxCfg.minify = false;
-      ctxCfg.outfile = (0, import_path3.resolve)(outputDir, (0, import_path3.basename)(entryPoint, (0, import_path3.extname)(entryPoint))) + ".js";
+      ctxCfg.outfile = (0, import_path4.resolve)(outputDir, (0, import_path4.basename)(entryPoint, (0, import_path4.extname)(entryPoint))) + ".js";
       ctxCfg.packages = "external";
       ctxCfg.treeShaking = false;
     }
     const ctx = await watchForChanges(ctxCfg, reloader);
-    return { ctx, path: path3, cfg, uuid };
+    return { ctx, path: path4, cfg, uuid };
   } catch (e) {
     handleModuleBuildError(e);
   }
@@ -9832,7 +9882,7 @@ var import_prompts = __toESM(require("prompts"));
 
 // src/lib/assets/deploy.ts
 var import_crypto3 = __toESM(require("crypto"));
-var import_fs10 = require("fs");
+var import_fs11 = require("fs");
 var import_kubernetes_fluent_client3 = require("kubernetes-fluent-client");
 
 // src/lib/k8s.ts
@@ -9941,7 +9991,7 @@ async function deployWebhook(assets, force, webhookTimeout) {
   logger_default.info("Applying the Pepr Store CRD if it doesn't exist");
   await (0, import_kubernetes_fluent_client3.K8s)(import_kubernetes_fluent_client3.kind.CustomResourceDefinition).Apply(peprStoreCRD, { force });
   if (assets.host) return;
-  const code = await import_fs10.promises.readFile(assets.path);
+  const code = await import_fs11.promises.readFile(assets.path);
   if (!code.length) throw new Error("No code provided");
   const hash = import_crypto3.default.createHash("sha256").update(code).digest("hex");
   await setupRBAC(assets.name, assets.capabilities, force, assets.config);
@@ -10101,6 +10151,16 @@ async function buildAndDeployModule(image, force) {
     []
   );
   webhook.image = image ?? webhook.image;
+  const capabilities = await loadCapabilities(webhook.path);
+  for (const capability of capabilities) {
+    namespaceComplianceValidator(capability, webhook.alwaysIgnore?.namespaces);
+    namespaceComplianceValidator(
+      capability,
+      webhook.config.admission?.alwaysIgnore?.namespaces,
+      false
+    );
+    namespaceComplianceValidator(capability, webhook.config.watch?.alwaysIgnore?.namespaces, true);
+  }
   try {
     await webhook.deploy(deployWebhook, force, builtModule.cfg.pepr.webhookTimeout ?? 10);
     validateCapabilityNames(webhook.capabilities);
@@ -10133,7 +10193,7 @@ function deploy_default(program2) {
 var import_prompts2 = __toESM(require("prompts"));
 var import_child_process4 = require("child_process");
 var import_kubernetes_fluent_client5 = require("kubernetes-fluent-client");
-var import_fs11 = require("fs");
+var import_fs12 = require("fs");
 function dev_default(program2) {
   program2.command("dev").description("Setup a local webhook development environment").option("-h, --host [host]", "Host to listen on", "host.k3d.internal").option("--confirm", "Skip confirmation prompt").action(async (opts) => {
     if (!opts.confirm) {
@@ -10146,25 +10206,25 @@ function dev_default(program2) {
         process.exit(0);
       }
     }
-    const { cfg, path: path3 } = await loadModule();
+    const { cfg, path: path4 } = await loadModule();
     const webhook = new Assets(
       {
         ...cfg.pepr,
         description: cfg.description
       },
-      path3,
+      path4,
       [],
       opts.host
     );
-    await import_fs11.promises.writeFile("insecure-tls.crt", webhook.tls.pem.crt);
-    await import_fs11.promises.writeFile("insecure-tls.key", webhook.tls.pem.key);
+    await import_fs12.promises.writeFile("insecure-tls.crt", webhook.tls.pem.crt);
+    await import_fs12.promises.writeFile("insecure-tls.key", webhook.tls.pem.key);
     try {
       let program3;
       const name2 = `pepr-${cfg.pepr.uuid}`;
       const scheduleStore = `pepr-${cfg.pepr.uuid}-schedule`;
       const store = `pepr-${cfg.pepr.uuid}-store`;
       const runFork = async () => {
-        console.info(`Running module ${path3}`);
+        console.info(`Running module ${path4}`);
         await webhook.deploy(deployWebhook, false, 30);
         try {
           validateCapabilityNames(webhook.capabilities);
@@ -10172,7 +10232,7 @@ function dev_default(program2) {
           console.error(`Error validating capability names:`, e);
           process.exit(1);
         }
-        program3 = (0, import_child_process4.fork)(path3, {
+        program3 = (0, import_child_process4.fork)(path4, {
           env: {
             ...process.env,
             LOG_LEVEL: process.env.LOG_LEVEL ?? "debug",
@@ -10306,11 +10366,11 @@ ${filteredFailures.length > 0 ? "\u274C" : "\u2705"}  VALIDATE   ${name2} (${uid
 
 // src/cli/init/index.ts
 var import_child_process5 = require("child_process");
-var import_path4 = require("path");
+var import_path5 = require("path");
 var import_prompts4 = __toESM(require("prompts"));
 
 // src/cli/init/walkthrough.ts
-var import_fs12 = require("fs");
+var import_fs13 = require("fs");
 var import_prompts3 = __toESM(require("prompts"));
 
 // src/cli/init/enums.ts
@@ -10357,7 +10417,7 @@ async function setName(name2) {
     validate: async (val) => {
       try {
         const name3 = sanitizeName(val);
-        await import_fs12.promises.access(name3, import_fs12.promises.constants.F_OK);
+        await import_fs13.promises.access(name3, import_fs13.promises.constants.F_OK);
         return "A directory with this name already exists";
       } catch {
         return val.length > 2 || "The name must be at least 3 characters long";
@@ -10502,8 +10562,8 @@ function init_default(program2) {
 }
 async function setupProjectStructure(dirName) {
   await createDir(dirName);
-  await createDir((0, import_path4.resolve)(dirName, ".vscode"));
-  await createDir((0, import_path4.resolve)(dirName, "capabilities"));
+  await createDir((0, import_path5.resolve)(dirName, ".vscode"));
+  await createDir((0, import_path5.resolve)(dirName, "capabilities"));
 }
 async function createProjectFiles(dirName, packageJSON2) {
   const files = [
@@ -10522,10 +10582,10 @@ async function createProjectFiles(dirName, packageJSON2) {
     { dir: "capabilities", path: helloPepr.path, data: helloPepr.data }
   ];
   for (const file of files) {
-    await write((0, import_path4.resolve)(dirName, file.path), file.data);
+    await write((0, import_path5.resolve)(dirName, file.path), file.data);
   }
   for (const file of nestedFiles) {
-    await write((0, import_path4.resolve)(dirName, file.dir, file.path), file.data);
+    await write((0, import_path5.resolve)(dirName, file.dir, file.path), file.data);
   }
 }
 var doPostInitActions = (dirName) => {
@@ -10581,10 +10641,10 @@ var RootCmd = class extends import_commander2.Command {
   }
 };
 
-// src/cli/update.ts
+// src/cli/update/index.ts
 var import_child_process6 = require("child_process");
-var import_fs13 = __toESM(require("fs"));
-var import_path5 = require("path");
+var import_fs14 = __toESM(require("fs"));
+var import_path6 = require("path");
 var import_prompts5 = __toESM(require("prompts"));
 function update_default(program2) {
   program2.command("update").description("Update this Pepr module. Not recommended for prod as it may change files.").option("--skip-template-update", "Skip updating the template files").action(async (opts) => {
@@ -10600,6 +10660,22 @@ function update_default(program2) {
     }
     console.log("Updating the Pepr module...");
     try {
+      let packageLockContent = "";
+      let foundPackageLock = false;
+      try {
+        if (import_fs14.default.existsSync("./package-lock.json")) {
+          packageLockContent = import_fs14.default.readFileSync("./package-lock.json", "utf-8");
+          foundPackageLock = true;
+        }
+      } catch {
+      }
+      if (foundPackageLock && packageLockContent) {
+        if (packageLockContent.indexOf('"eslint":') >= 0 && packageLockContent.match(/"eslint":\s*"[~^]?8\.[0-9]+\.[0-9]+"/)) {
+          console.warn(
+            "\nWarning: This Pepr module uses ESLint v8. Pepr will be upgraded to use v9 in a future release.\nSee eslint@9.0.0 release notes for more details: https://eslint.org/blog/2024/04/eslint-v9.0.0-released/"
+          );
+        }
+      }
       (0, import_child_process6.execSync)("npm install pepr@latest", {
         stdio: "inherit"
       });
@@ -10618,17 +10694,17 @@ function update_default(program2) {
     console.log("Updating Pepr config and template tiles...");
     try {
       if (!opts.skipTemplateUpdate) {
-        await write((0, import_path5.resolve)(prettier.path), prettier.data);
-        await write((0, import_path5.resolve)(tsConfig.path), tsConfig.data);
-        await write((0, import_path5.resolve)(".vscode", snippet.path), snippet.data);
-        await write((0, import_path5.resolve)(".vscode", codeSettings.path), codeSettings.data);
-        const samplePath = (0, import_path5.resolve)("capabilities", samplesYaml.path);
-        if (import_fs13.default.existsSync(samplePath)) {
-          import_fs13.default.unlinkSync(samplePath);
+        await write((0, import_path6.resolve)(prettier.path), prettier.data);
+        await write((0, import_path6.resolve)(tsConfig.path), tsConfig.data);
+        await write((0, import_path6.resolve)(".vscode", snippet.path), snippet.data);
+        await write((0, import_path6.resolve)(".vscode", codeSettings.path), codeSettings.data);
+        const samplePath = (0, import_path6.resolve)("capabilities", samplesYaml.path);
+        if (import_fs14.default.existsSync(samplePath)) {
+          import_fs14.default.unlinkSync(samplePath);
           await write(samplePath, samplesYaml.data);
         }
-        const tsPath = (0, import_path5.resolve)("capabilities", helloPepr.path);
-        if (import_fs13.default.existsSync(tsPath)) {
+        const tsPath = (0, import_path6.resolve)("capabilities", helloPepr.path);
+        if (import_fs14.default.existsSync(tsPath)) {
           await write(tsPath, helloPepr.data);
         }
       }
@@ -10669,8 +10745,8 @@ function kfc_default(program2) {
 
 // src/cli/crd/create.ts
 var import_commander3 = require("commander");
-var import_fs14 = require("fs");
-var import_path6 = __toESM(require("path"));
+var import_fs15 = require("fs");
+var import_path7 = __toESM(require("path"));
 var create = new import_commander3.Command("create").description("Create a new CRD TypeScript definition").requiredOption("--group <group>", "API group (e.g. cache)").requiredOption("--version <version>", "API version (e.g. v1alpha1)").requiredOption("--kind <kind>", "Kind name (e.g. Memcached)").option("--domain <domain>", "Optional domain (e.g. pepr.dev)", "pepr.dev").option(
   "--scope <Namespaced | Cluster>",
   "Whether the resulting custom resource is cluster- or namespace-scoped",
@@ -10678,9 +10754,9 @@ var create = new import_commander3.Command("create").description("Create a new C
   "Namespaced"
 ).option("--plural <plural>", "Plural name (e.g. memcacheds)", "").option("--shortName <shortName>", "Short name (e.g. mc)", "").action(async ({ group: group2, version: version3, kind: kind8, domain, scope, plural: plural2, shortName }) => {
   console.log("This feature is currently in alpha.\n");
-  const outputDir2 = import_path6.default.resolve(`./api/${version3}`);
+  const outputDir2 = import_path7.default.resolve(`./api/${version3}`);
   await createDirectoryIfNotExists(outputDir2);
-  await import_fs14.promises.writeFile(
+  await import_fs15.promises.writeFile(
     `./api/${version3}/${kind8.toLowerCase()}_types.ts`,
     generateCRDScaffold(group2, version3, kind8, { domain, scope, plural: plural2, shortName })
   );
@@ -10775,10 +10851,24 @@ function validateScope(value) {
 
 // src/cli/crd/generate.ts
 var import_commander4 = require("commander");
-var import_fs15 = __toESM(require("fs"));
-var import_path7 = __toESM(require("path"));
+var import_fs16 = __toESM(require("fs"));
+var import_path8 = __toESM(require("path"));
 var import_yaml = __toESM(require_dist());
 var import_ts_morph = require("ts-morph");
+
+// src/cli/crd/messages.ts
+var ErrorMessages = {
+  MISSING_DETAILS: "Missing 'details' variable declaration.",
+  INVALID_SCOPE: (scope) => `'scope' must be either "Cluster" or "Namespaced", got "${scope}"`,
+  MISSING_OR_INVALID_KEY: (key) => `Missing or invalid value for required key: '${key}'`
+};
+var WarningMessages = {
+  MISSING_DETAILS: "Missing 'details' variable declaration.",
+  MISSING_KIND_COMMENT: (fileName) => `Skipping ${fileName}: missing '// Kind: <KindName>' comment`,
+  MISSING_INTERFACE: (fileName, kind8) => `Skipping ${fileName}: missing interface ${kind8}Spec`
+};
+
+// src/cli/crd/generate.ts
 var generate_default = new import_commander4.Command("generate").description("Generate CRD manifests from TypeScript definitions").option("--output <output>", "Output directory for generated CRDs", "./crds").action(generateCRDs);
 function extractCRDDetails(content, sourceFile) {
   const kind8 = extractSingleLineComment(content, "Kind");
@@ -10792,36 +10882,36 @@ function extractCRDDetails(content, sourceFile) {
 }
 async function generateCRDs(options) {
   console.log("This feature is currently in alpha.\n");
-  const outputDir2 = import_path7.default.resolve(options.output);
+  const outputDir2 = import_path8.default.resolve(options.output);
   await createDirectoryIfNotExists(outputDir2);
   const project = new import_ts_morph.Project();
-  const apiRoot = import_path7.default.resolve("api");
+  const apiRoot = import_path8.default.resolve("api");
   const versions = getAPIVersions(apiRoot);
   for (const version3 of versions) {
-    const sourceFiles = loadVersionFiles(project, import_path7.default.join(apiRoot, version3));
+    const sourceFiles = loadVersionFiles(project, import_path8.default.join(apiRoot, version3));
     for (const sourceFile of sourceFiles) {
       processSourceFile(sourceFile, version3, outputDir2);
     }
   }
 }
 function getAPIVersions(apiRoot) {
-  return import_fs15.default.readdirSync(apiRoot).filter((v) => import_fs15.default.statSync(import_path7.default.join(apiRoot, v)).isDirectory());
+  return import_fs16.default.readdirSync(apiRoot).filter((v) => import_fs16.default.statSync(import_path8.default.join(apiRoot, v)).isDirectory());
 }
 function loadVersionFiles(project, versionDir) {
-  const files = import_fs15.default.readdirSync(versionDir).filter((f) => f.endsWith(".ts"));
-  const filePaths = files.map((f) => import_path7.default.join(versionDir, f));
+  const files = import_fs16.default.readdirSync(versionDir).filter((f) => f.endsWith(".ts"));
+  const filePaths = files.map((f) => import_path8.default.join(versionDir, f));
   return project.addSourceFilesAtPaths(filePaths);
 }
 function processSourceFile(sourceFile, version3, outputDir2) {
   const content = sourceFile.getFullText();
   const { kind: kind8, fqdn, scope, plural: plural2, shortNames } = extractCRDDetails(content, sourceFile);
   if (!kind8) {
-    console.warn(`Skipping ${sourceFile.getBaseName()}: missing '// Kind: <KindName>' comment`);
+    console.warn(WarningMessages.MISSING_KIND_COMMENT(sourceFile.getBaseName()));
     return;
   }
   const spec = sourceFile.getInterface(`${kind8}Spec`);
   if (!spec) {
-    console.warn(`Skipping ${sourceFile.getBaseName()}: missing interface ${kind8}Spec`);
+    console.warn(WarningMessages.MISSING_INTERFACE(sourceFile.getBaseName(), kind8));
     return;
   }
   const condition = sourceFile.getTypeAlias(`${kind8}StatusCondition`);
@@ -10837,8 +10927,8 @@ function processSourceFile(sourceFile, version3, outputDir2) {
     specSchema,
     conditionSchema
   });
-  const outPath = import_path7.default.join(outputDir2, `${kind8.toLowerCase()}.yaml`);
-  import_fs15.default.writeFileSync(outPath, (0, import_yaml.stringify)(crd), "utf8");
+  const outPath = import_path8.default.join(outputDir2, `${kind8.toLowerCase()}.yaml`);
+  import_fs16.default.writeFileSync(outPath, (0, import_yaml.stringify)(crd), "utf8");
   console.log(`\u2714 Created ${outPath}`);
 }
 function extractSingleLineComment(content, label) {
@@ -10848,14 +10938,14 @@ function extractSingleLineComment(content, label) {
 function extractDetails(sourceFile) {
   const decl = sourceFile.getVariableDeclaration("details");
   if (!decl) {
-    throw new Error(`Missing 'details' variable declaration.`);
+    throw new Error(ErrorMessages.MISSING_DETAILS);
   }
   const init = decl.getInitializerIfKindOrThrow(import_ts_morph.SyntaxKind.ObjectLiteralExpression);
   const getStr = (key) => {
     const prop = init.getProperty(key);
     const value = prop?.getFirstChildByKind(import_ts_morph.SyntaxKind.StringLiteral)?.getLiteralText();
     if (!value) {
-      throw new Error(`Missing or invalid value for required key: '${key}'`);
+      throw new Error(ErrorMessages.MISSING_OR_INVALID_KEY(key));
     }
     return value;
   };
@@ -10867,7 +10957,7 @@ function extractDetails(sourceFile) {
       shortName: getStr("shortName")
     };
   }
-  throw new Error(`'scope' must be either "Cluster" or "Namespaced", got "${scope}"`);
+  throw new Error(ErrorMessages.INVALID_SCOPE(scope));
 }
 function getJsDocDescription(node) {
   if (!import_ts_morph.Node.isPropertySignature(node) && !import_ts_morph.Node.isPropertyDeclaration(node)) return "";