pepr 0.51.6 → 0.52.0-nightly.0

package/dist/cli.js

@@ -7500,8 +7500,9 @@ function chartYaml(name2, description) {
     appVersion: "1.16.0"
 `;
 }
-function watcherDeployTemplate(buildTimestamp) {
+function watcherDeployTemplate(buildTimestamp, type) {
   return `
+      {{- if .Values.${type}.enabled }}
       apiVersion: apps/v1
       kind: Deployment
       metadata:
@@ -7529,6 +7530,9 @@ function watcherDeployTemplate(buildTimestamp) {
             labels:
               app: {{ .Values.uuid }}-watcher
               pepr.dev/controller: watcher
+              {{- if .Values.watcher.podLabels }}
+              {{- toYaml .Values.watcher.podLabels | nindent 8 }}
+              {{- end }}
           spec:
             terminationGracePeriodSeconds: {{ .Values.watcher.terminationGracePeriodSeconds }}
             serviceAccountName: {{ .Values.uuid }}
@@ -7593,10 +7597,12 @@ function watcherDeployTemplate(buildTimestamp) {
               {{- if .Values.watcher.extraVolumes }}
               {{- toYaml .Values.watcher.extraVolumes | nindent 8 }}
               {{- end }}
+      {{- end }}
     `;
 }
-function admissionDeployTemplate(buildTimestamp) {
+function admissionDeployTemplate(buildTimestamp, type) {
   return `
+      {{- if .Values.${type}.enabled }}
       apiVersion: apps/v1
       kind: Deployment
       metadata:
@@ -7622,6 +7628,9 @@ function admissionDeployTemplate(buildTimestamp) {
             labels:
               app: {{ .Values.uuid }}
               pepr.dev/controller: admission
+              {{- if .Values.admission.podLabels }}
+              {{- toYaml .Values.admission.podLabels | nindent 8 }}
+              {{- end }}
           spec:
             {{- if or .Values.admission.antiAffinity .Values.admission.affinity }}
             affinity:
@@ -7708,6 +7717,7 @@ function admissionDeployTemplate(buildTimestamp) {
               {{- if .Values.admission.extraVolumes }}
               {{- toYaml .Values.admission.extraVolumes | nindent 8 }}
               {{- end }}
+      {{- end }}
     `;
 }
 function serviceMonitorTemplate(name2, type) {
@@ -7737,6 +7747,27 @@ function serviceMonitorTemplate(name2, type) {
       {{- end }}
     `;
 }
+function serviceTemplate(name2, type) {
+  const svcName = type === "admission" ? name2 : `${name2}-${type}`;
+  return `
+      {{- if .Values.${type}.enabled }}
+      apiVersion: v1
+      kind: Service
+      metadata:
+        name: ${svcName}
+        namespace: pepr-system
+        labels:
+          pepr.dev/controller: ${type}
+      spec:
+        selector:
+          app: ${svcName}
+          pepr.dev/controller: ${type}
+        ports:
+        - port: 443
+          targetPort: 3000
+      {{- end }}
+    `;
+}
 
 // src/lib/filesystemService.ts
 var import_fs = require("fs");
@@ -7752,7 +7783,7 @@ async function createDirectoryIfNotExists(path4) {
   }
 }
 
-// src/lib/assets/envrionment.ts
+// src/lib/assets/environment.ts
 function genEnv(config, watchMode = false, ignoreWatchMode = false) {
   const noWatchDef = {
     PEPR_PRETTY_LOG: "false",
@@ -8090,7 +8121,7 @@ function resolveIgnoreNamespaces(ignoredNSConfig = []) {
 }
 
 // src/lib/assets/yaml/overridesFile.ts
-async function overridesFile({ hash, name: name2, image, config, apiPath, capabilities }, path4, imagePullSecrets) {
+async function overridesFile({ hash, name: name2, image, config, apiPath, capabilities }, path4, imagePullSecrets, controllerType = { admission: true, watcher: true }) {
   const rbacOverrides = clusterRole(name2, capabilities, config.rbacMode, config.rbac).rules;
   const overrides = {
     imagePullSecrets,
@@ -8110,6 +8141,7 @@ async function overridesFile({ hash, name: name2, image, config, apiPath, capabi
     },
     uuid: name2,
     admission: {
+      enabled: controllerType.admission === true ? true : false,
       antiAffinity: false,
       terminationGracePeriodSeconds: 5,
       failurePolicy: config.onError === "reject" ? "Fail" : "Ignore",
@@ -8167,6 +8199,7 @@ async function overridesFile({ hash, name: name2, image, config, apiPath, capabi
         }
       },
       podAnnotations: {},
+      podLabels: {},
       nodeSelector: {},
       tolerations: [],
       extraVolumeMounts: [],
@@ -8179,6 +8212,7 @@ async function overridesFile({ hash, name: name2, image, config, apiPath, capabi
       }
     },
     watcher: {
+      enabled: controllerType.watcher === true ? true : false,
       terminationGracePeriodSeconds: 5,
       env: genEnv(config, true, true),
       envFrom: [],
@@ -8238,6 +8272,7 @@ async function overridesFile({ hash, name: name2, image, config, apiPath, capabi
       extraVolumes: [],
       affinity: {},
       podAnnotations: {},
+      podLabels: {},
       serviceMonitor: {
         enabled: false,
         labels: {},
@@ -8386,58 +8421,36 @@ function tlsSecret(name2, tls) {
     }
   };
 }
-function service(name2) {
-  return {
-    apiVersion: "v1",
-    kind: "Service",
-    metadata: {
-      name: name2,
-      namespace: "pepr-system",
-      labels: {
-        "pepr.dev/controller": "admission"
-      }
-    },
-    spec: {
-      selector: {
-        app: name2,
-        "pepr.dev/controller": "admission"
-      },
-      ports: [
-        {
-          port: 443,
-          targetPort: 3e3
-        }
-      ]
+
+// src/lib/assets/assets.ts
+function norWatchOrAdmission(capabilities) {
+  return !isAdmission(capabilities) && !isWatcher(capabilities);
+}
+function isAdmission(capabilities) {
+  for (const capability of capabilities) {
+    const admissionBindings = capability.bindings.filter(
+      (binding) => binding.isFinalize || binding.isMutate || binding.isValidate
+    );
+    if (admissionBindings.length > 0) {
+      return true;
     }
-  };
+  }
+  return false;
 }
-function watcherService(name2) {
-  return {
-    apiVersion: "v1",
-    kind: "Service",
-    metadata: {
-      name: `${name2}-watcher`,
-      namespace: "pepr-system",
-      labels: {
-        "pepr.dev/controller": "watcher"
-      }
-    },
-    spec: {
-      selector: {
-        app: `${name2}-watcher`,
-        "pepr.dev/controller": "watcher"
-      },
-      ports: [
-        {
-          port: 443,
-          targetPort: 3e3
-        }
-      ]
+function isWatcher(capabilities) {
+  for (const capability of capabilities) {
+    if (capability.hasSchedule) {
+      return true;
     }
-  };
+    const watcherBindings = capability.bindings.filter(
+      (binding) => binding.isFinalize || binding.isWatch || binding.isQueue
+    );
+    if (watcherBindings.length > 0) {
+      return true;
+    }
+  }
+  return false;
 }
-
-// src/lib/assets/assets.ts
 var Assets = class {
   name;
   tls;
@@ -8469,7 +8482,7 @@ var Assets = class {
   }
   zarfYaml = (zarfYamlGenerator, path4) => zarfYamlGenerator(this, path4, "manifests");
   zarfYamlChart = (zarfYamlGenerator, path4) => zarfYamlGenerator(this, path4, "charts");
-  allYaml = async (yamlGenerationFunction, getDeploymentFunction, getWatcherFunction, imagePullSecret) => {
+  allYaml = async (yamlGenerationFunction, getControllerManifests, imagePullSecret) => {
     this.capabilities = await loadCapabilities(this.path);
     for (const capability of this.capabilities) {
       namespaceComplianceValidator(capability, this.alwaysIgnore?.namespaces);
@@ -8483,16 +8496,30 @@ var Assets = class {
     const code = await import_fs3.promises.readFile(this.path);
     const moduleHash = import_crypto.default.createHash("sha256").update(code).digest("hex");
     const deployments = {
-      default: getDeploymentFunction(this, moduleHash, this.buildTimestamp, imagePullSecret),
-      watch: getWatcherFunction(this, moduleHash, this.buildTimestamp, imagePullSecret)
+      admission: getControllerManifests.getDeploymentFunction(
+        this,
+        moduleHash,
+        this.buildTimestamp,
+        imagePullSecret
+      ),
+      watch: getControllerManifests.getWatcherFunction(
+        this,
+        moduleHash,
+        this.buildTimestamp,
+        imagePullSecret
+      )
+    };
+    const services = {
+      admission: getControllerManifests.getServiceFunction(this.name, this),
+      watch: getControllerManifests.getWatcherServiceFunction(this.name, this)
     };
-    return yamlGenerationFunction(this, deployments);
+    return yamlGenerationFunction(this, deployments, services);
   };
   writeWebhookFiles = async (validateWebhook, mutateWebhook, helm) => {
     if (validateWebhook || mutateWebhook) {
       await import_fs3.promises.writeFile(
         helm.files.admissionDeploymentYaml,
-        dedent(admissionDeployTemplate(this.buildTimestamp))
+        dedent(admissionDeployTemplate(this.buildTimestamp, "admission"))
       );
       await import_fs3.promises.writeFile(
         helm.files.admissionServiceMonitorYaml,
@@ -8531,8 +8558,14 @@ var Assets = class {
           () => dedent(chartYaml(this.config.uuid, this.config.description || ""))
         ],
         [helm.files.namespaceYaml, () => dedent(namespaceTemplate())],
-        [helm.files.watcherServiceYaml, () => toYaml(watcherService(this.name))],
-        [helm.files.admissionServiceYaml, () => toYaml(service(this.name))],
+        [
+          helm.files.watcherServiceYaml,
+          () => dedent(serviceTemplate(this.name, "watcher"))
+        ],
+        [
+          helm.files.admissionServiceYaml,
+          () => dedent(serviceTemplate(this.name, "admission"))
+        ],
         [helm.files.tlsSecretYaml, () => toYaml(tlsSecret(this.name, this.tls))],
         [
           helm.files.apiPathSecretYaml,
@@ -8557,7 +8590,10 @@ var Assets = class {
         apiPath: this.apiPath,
         capabilities: this.capabilities
       };
-      await overridesFile(overrideData, helm.files.valuesYaml, this.imagePullSecrets);
+      await overridesFile(overrideData, helm.files.valuesYaml, this.imagePullSecrets, {
+        admission: isAdmission(this.capabilities) || norWatchOrAdmission(this.capabilities),
+        watcher: isWatcher(this.capabilities)
+      });
       const webhooks = {
         mutate: await webhookGeneratorFunction(
           this,
@@ -8575,7 +8611,7 @@ var Assets = class {
       if (watchDeployment) {
         await import_fs3.promises.writeFile(
           helm.files.watcherDeploymentYaml,
-          dedent(watcherDeployTemplate(this.buildTimestamp))
+          dedent(watcherDeployTemplate(this.buildTimestamp, "watcher"))
         );
         await import_fs3.promises.writeFile(
           helm.files.watcherServiceMonitorYaml,
@@ -8822,8 +8858,8 @@ var tsconfig_module_default = {
     emitDeclarationOnly: true,
     esModuleInterop: true,
     lib: ["ES2022"],
-    module: "CommonJS",
-    moduleResolution: "node",
+    module: "NodeNext",
+    moduleResolution: "NodeNext",
     outDir: "dist",
     resolveJsonModule: true,
     rootDir: ".",
@@ -8839,7 +8875,7 @@ var gitIgnore = "# Ignore node_modules and Pepr build artifacts\nnode_modules\nd
 var readmeMd = '# Pepr Module\n\nThis is a Pepr Module. [Pepr](https://github.com/defenseunicorns/pepr) is a type-safe Kubernetes middleware system.\n\nThe `capabilities` directory contains all the capabilities for this module. By default,\na capability is a single typescript file in the format of `capability-name.ts` that is\nimported in the root `pepr.ts` file as `import { HelloPepr } from "./capabilities/hello-pepr";`.\nBecause this is typescript, you can organize this however you choose, e.g. creating a sub-folder\nper-capability or common logic in shared files or folders.\n\nExample Structure:\n\n```text\nModule Root\n\u251C\u2500\u2500 package.json\n\u251C\u2500\u2500 pepr.ts\n\u2514\u2500\u2500 capabilities\n    \u251C\u2500\u2500 example-one.ts\n    \u251C\u2500\u2500 example-three.ts\n    \u2514\u2500\u2500 example-two.ts\n```\n';
 var peprTS = 'import { PeprModule } from "pepr";\n// cfg loads your pepr configuration from package.json\nimport cfg from "./package.json";\n\n// HelloPepr is a demo capability that is included with Pepr. Comment or delete the line below to remove it.\nimport { HelloPepr } from "./capabilities/hello-pepr";\n\n/**\n * This is the main entrypoint for this Pepr module. It is run when the module is started.\n * This is where you register your Pepr configurations and capabilities.\n */\nnew PeprModule(cfg, [\n  // "HelloPepr" is a demo capability that is included with Pepr. Comment or delete the line below to remove it.\n  HelloPepr,\n\n  // Your additional capabilities go here\n]);\n';
 var helloPeprTS = 'import {\n  Capability,\n  K8s,\n  Log,\n  PeprMutateRequest,\n  RegisterKind,\n  a,\n  fetch,\n  fetchStatus,\n  kind,\n} from "pepr";\nimport { MockAgent, setGlobalDispatcher } from "undici";\n\n/**\n *  The HelloPepr Capability is an example capability to demonstrate some general concepts of Pepr.\n *  To test this capability you run `pepr dev`and then run the following command:\n *  `kubectl apply -f capabilities/hello-pepr.samples.yaml`\n */\nexport const HelloPepr = new Capability({\n  name: "hello-pepr",\n  description: "A simple example capability to show how things work.",\n  namespaces: ["pepr-demo", "pepr-demo-2"],\n});\n\n// Use the \'When\' function to create a new action, use \'Store\' to persist data\nconst { When, Store } = HelloPepr;\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Namespace)                                   *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action removes the label `remove-me` when a Namespace is created.\n * Note we don\'t need to specify the namespace here, because we\'ve already specified\n * it in the Capability definition above.\n */\nWhen(a.Namespace)\n  .IsCreated()\n  .Mutate(ns => ns.RemoveLabel("remove-me"));\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Watch Action with K8s SSA (Namespace)                           *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action watches for the `pepr-demo-2` namespace to be created, then creates a ConfigMap with\n * the name `pepr-ssa-demo` and adds the namespace UID to the ConfigMap data. Because Pepr uses\n * server-side apply for this operation, the ConfigMap will be created or updated if it already exists.\n */\nWhen(a.Namespace)\n  .IsCreated()\n  .WithName("pepr-demo-2")\n  .Watch(async ns => {\n    Log.info("Namespace pepr-demo-2 was created.");\n\n    try {\n      // Apply the ConfigMap using K8s server-side apply\n      await K8s(kind.ConfigMap).Apply({\n        metadata: {\n          name: "pepr-ssa-demo",\n          namespace: "pepr-demo-2",\n        },\n        data: {\n          "ns-uid": ns.metadata.uid,\n        },\n      });\n    } catch (error) {\n      // You can use the Log object to log messages to the Pepr controller pod\n      Log.error(error, "Failed to apply ConfigMap using server-side apply.");\n    }\n\n    // You can share data between actions using the Store, including between different types of actions\n    Store.setItem("watch-data", "This data was stored by a Watch Action.");\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 1)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This is a single action. They can be in the same file or put imported from other files.\n * In this example, when a ConfigMap is created with the name `example-1`, then add a label and annotation.\n *\n * Equivalent to manually running:\n * `kubectl label configmap example-1 pepr=was-here`\n * `kubectl annotate configmap example-1 pepr.dev=annotations-work-too`\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-1")\n  .Mutate(request => {\n    request.SetLabel("pepr", "was-here").SetAnnotation("pepr.dev", "annotations-work-too");\n\n    // Use the Store to persist data between requests and Pepr controller pods\n    Store.setItem("example-1", "was-here");\n\n    // This data is written asynchronously and can be read back via `Store.getItem()` or `Store.subscribe()`\n    Store.setItem("example-1-data", JSON.stringify(request.Raw.data));\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate & Validate Actions (CM Example 2)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This combines 3 different types of actions: \'Mutate\', \'Validate\', and \'Watch\'. The order\n * of the actions is required, but each action is optional. In this example, when a ConfigMap is created\n * with the name `example-2`, then add a label and annotation, validate that the ConfigMap has the label\n * `pepr`, and log the request.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-2")\n  .Mutate(request => {\n    // This Mutate Action will mutate the request before it is persisted to the cluster\n\n    // Use `request.Merge()` to merge the new data with the existing data\n    request.Merge({\n      metadata: {\n        labels: {\n          pepr: "was-here",\n        },\n        annotations: {\n          "pepr.dev": "annotations-work-too",\n        },\n      },\n    });\n  })\n  .Validate(request => {\n    // This Validate Action will validate the request before it is persisted to the cluster\n\n    // Approve the request if the ConfigMap has the label \'pepr\'\n    if (request.HasLabel("pepr")) {\n      return request.Approve();\n    }\n\n    // Otherwise, deny the request with an error message (optional)\n    return request.Deny("ConfigMap must have label \'pepr\'");\n  })\n  .Watch((cm, phase) => {\n    // This Watch Action will watch the ConfigMap after it has been persisted to the cluster\n    Log.info(cm, `ConfigMap was ${phase} with the name example-2`);\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 2a)                               *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action shows a simple validation that will deny any ConfigMap that has the\n * annotation `evil`. Note that the `Deny()` function takes an optional second parameter that is a\n * user-defined status code to return.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .Validate(request => {\n    if (request.HasAnnotation("evil")) {\n      return request.Deny("No evil CM annotations allowed.", 400);\n    }\n\n    return request.Approve();\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 3)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action combines different styles. Unlike the previous actions, this one will look\n * for any ConfigMap in the `pepr-demo` namespace that has the label `change=by-label` during either\n * CREATE or UPDATE. Note that all conditions added such as `WithName()`, `WithLabel()`, `InNamespace()`,\n * are ANDs so all conditions must be true for the request to be processed.\n */\nWhen(a.ConfigMap)\n  .IsCreatedOrUpdated()\n  .WithLabel("change", "by-label")\n  .Mutate(request => {\n    // The K8s object e are going to mutate\n    const cm = request.Raw;\n\n    // Get the username and uid of the K8s request\n    const { username, uid } = request.Request.userInfo;\n\n    // Store some data about the request in the configmap\n    cm.data["username"] = username;\n    cm.data["uid"] = uid;\n\n    // You can still mix other ways of making changes too\n    request.SetAnnotation("pepr.dev", "making-waves");\n  });\n\n// This action validates the label `change=by-label` is deleted\nWhen(a.ConfigMap)\n  .IsDeleted()\n  .WithLabel("change", "by-label")\n  .Validate(request => {\n    // Log and then always approve the request\n    Log.info("CM with label \'change=by-label\' was deleted.");\n    return request.Approve();\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 4)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action show how you can use the `Mutate()` function without an inline function.\n * This is useful if you want to keep your actions small and focused on a single task,\n * or if you want to reuse the same function in multiple actions.\n */\nWhen(a.ConfigMap).IsCreated().WithName("example-4").Mutate(example4Cb);\n\n// This function uses the complete type definition, but is not required.\nfunction example4Cb(cm: PeprMutateRequest<a.ConfigMap>): void {\n  cm.SetLabel("pepr.dev/first", "true");\n  cm.SetLabel("pepr.dev/second", "true");\n  cm.SetLabel("pepr.dev/third", "true");\n}\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 4a)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This is the same as Example 4, except this only operates on a CM in the `pepr-demo-2` namespace.\n * Note because the Capability defines namespaces, the namespace specified here must be one of those.\n * Alternatively, you can remove the namespace from the Capability definition and specify it here.\n */\nWhen(a.ConfigMap).IsCreated().InNamespace("pepr-demo-2").WithName("example-4a").Mutate(example4Cb);\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 5)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action is a bit more complex. It will look for any ConfigMap in the `pepr-demo`\n * namespace that has the label `chuck-norris` during CREATE. When it finds one, it will fetch a\n * random Chuck Norris joke from the API and add it to the ConfigMap. This is a great example of how\n * you can use Pepr to make changes to your K8s objects based on external data.\n *\n * Note the use of the `async` keyword. This is required for any action that uses `await` or `fetch()`.\n *\n * Also note we are passing a type to the `fetch()` function. This is optional, but it will help you\n * avoid mistakes when working with the data returned from the API. You can also use the `as` keyword to\n * cast the data returned from the API.\n *\n * These are equivalent:\n * ```ts\n * const joke = await fetch<TheChuckNorrisJoke>("https://icanhazdadjoke.com/");\n * const joke = await fetch("https://icanhazdadjoke.com/") as TheChuckNorrisJoke;\n * ```\n *\n * Alternatively, you can drop the type completely:\n *\n * ```ts\n * fetch("https://icanhazdadjoke.com")\n * ```\n */\ninterface TheChuckNorrisJoke {\n  id: string;\n  joke: string;\n  status: number;\n}\n\nWhen(a.ConfigMap)\n  .IsCreatedOrUpdated()\n  .WithLabel("chuck-norris")\n  .Mutate(cm => cm.SetLabel("got-jokes", "true"))\n  .Watch(async cm => {\n    const jokeURL = "https://icanhazdadjoke.com";\n\n    const mockAgent: MockAgent = new MockAgent();\n    setGlobalDispatcher(mockAgent);\n    const mockClient = mockAgent.get(jokeURL);\n    mockClient.intercept({ path: "/", method: "GET" }).reply(\n      200,\n      {\n        id: "R7UfaahVfFd",\n        joke: "Funny joke goes here.",\n        status: 200,\n      },\n      {\n        headers: {\n          "Content-Type": "application/json; charset=utf-8",\n        },\n      },\n    );\n\n    // Try/catch is not needed as a response object will always be returned\n    const response = await fetch<TheChuckNorrisJoke>(jokeURL, {\n      headers: {\n        Accept: "application/json",\n      },\n    });\n\n    // Instead, check the `response.ok` field\n    if (response.ok) {\n      const { joke } = response.data;\n      // Add Joke to the Store\n      await Store.setItemAndWait(jokeURL, joke);\n      // Add the Chuck Norris joke to the configmap\n      try {\n        await K8s(kind.ConfigMap).Apply({\n          metadata: {\n            name: cm.metadata.name,\n            namespace: cm.metadata.namespace,\n          },\n          data: {\n            "chuck-says": Store.getItem(jokeURL),\n          },\n        });\n      } catch (error) {\n        Log.error(error, "Failed to apply ConfigMap using server-side apply.", {\n          cm,\n        });\n      }\n    }\n\n    // You can also assert on different HTTP response codes\n    if (response.status === fetchStatus.NOT_FOUND) {\n      // Do something else\n      return;\n    }\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Secret Base64 Handling)                      *\n * ---------------------------------------------------------------------------------------------------\n *\n * The K8s JS client provides incomplete support for base64 encoding/decoding handling for secrets,\n * unlike the GO client. To make this less painful, Pepr automatically handles base64 encoding/decoding\n * secret data before and after the action is executed.\n */\nWhen(a.Secret)\n  .IsCreated()\n  .WithName("secret-1")\n  .Mutate(request => {\n    const secret = request.Raw;\n\n    // This will be encoded at the end of all processing back to base64: "Y2hhbmdlLXdpdGhvdXQtZW5jb2Rpbmc="\n    secret.data.magic = "change-without-encoding";\n\n    // You can modify the data directly, and it will be encoded at the end of all processing\n    secret.data.example += " - modified by Pepr";\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Untyped Custom Resource)                     *\n * ---------------------------------------------------------------------------------------------------\n *\n * Out of the box, Pepr supports all the standard Kubernetes objects. However, you can also create\n * your own types. This is useful if you are working with an Operator that creates custom resources.\n * There are two ways to do this, the first is to use the `When()` function with a `GenericKind`,\n * the second is to create a new class that extends `GenericKind` and use the `RegisterKind()` function.\n *\n * This example shows how to use the `When()` function with a `GenericKind`. Note that you\n * must specify the `group`, `version`, and `kind` of the object (if applicable). This is how Pepr knows\n * if the action should be triggered or not. Since we are using a `GenericKind`,\n * Pepr will not be able to provide any intellisense for the object, so you will need to refer to the\n * Kubernetes API documentation for the object you are working with.\n *\n * You will need to wait for the CRD in `hello-pepr.samples.yaml` to be created, then you can apply\n *\n * ```yaml\n * apiVersion: pepr.dev/v1\n * kind: Unicorn\n * metadata:\n *   name: example-1\n *   namespace: pepr-demo\n * spec:\n *   message: replace-me\n *   counter: 0\n * ```\n */\nWhen(a.GenericKind, {\n  group: "pepr.dev",\n  version: "v1",\n  kind: "Unicorn",\n})\n  .IsCreated()\n  .WithName("example-1")\n  .Mutate(request => {\n    request.Merge({\n      spec: {\n        message: "Hello Pepr without type data!",\n        counter: Math.random(),\n      },\n    });\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Typed Custom Resource)                       *\n * ---------------------------------------------------------------------------------------------------\n *\n * This example shows how to use the `RegisterKind()` function to create a new type. This is useful\n * if you are working with an Operator that creates custom resources and you want to have intellisense\n * for the object. Note that you must specify the `group`, `version`, and `kind` of the object (if applicable)\n * as this is how Pepr knows if the action should be triggered or not.\n *\n * Once you register a new Kind with Pepr, you can use the `When()` function with the new Kind. Ideally,\n * you should register custom Kinds at the top of your Capability file or Pepr Module so they are available\n * to all actions, but we are putting it here for demonstration purposes.\n *\n * You will need to wait for the CRD in `hello-pepr.samples.yaml` to be created, then you can apply\n *\n * ```yaml\n * apiVersion: pepr.dev/v1\n * kind: Unicorn\n * metadata:\n *   name: example-2\n *   namespace: pepr-demo\n * spec:\n *   message: replace-me\n *   counter: 0\n * ```*\n */\nclass UnicornKind extends a.GenericKind {\n  spec: {\n    /**\n     * JSDoc comments can be added to explain more details about the field.\n     *\n     * @example\n     * ```ts\n     * request.Raw.spec.message = "Hello Pepr!";\n     * ```\n     * */\n    message: string;\n    counter: number;\n  };\n}\n\nRegisterKind(UnicornKind, {\n  group: "pepr.dev",\n  version: "v1",\n  kind: "Unicorn",\n});\n\nWhen(UnicornKind)\n  .IsCreated()\n  .WithName("example-2")\n  .Mutate(request => {\n    request.Merge({\n      spec: {\n        message: "Hello Pepr with type data!",\n        counter: Math.random(),\n      },\n    });\n  });\n\n/**\n * A callback function that is called once the Pepr Store is fully loaded.\n */\nStore.onReady(data => {\n  Log.info(data, "Pepr Store Ready");\n});\n';
-var packageJSON = { name: "pepr", description: "Kubernetes application engine", author: "Defense Unicorns", homepage: "https://github.com/defenseunicorns/pepr", license: "Apache-2.0", bin: "dist/cli.js", repository: "defenseunicorns/pepr", engines: { node: ">=18.0.0" }, files: ["/dist", "/src", "!src/**/*.test.ts", "!src/fixtures/**", "!dist/**/*.test.d.ts*"], version: "0.51.6", main: "dist/lib.js", types: "dist/lib.d.ts", scripts: { ci: "npm ci", "gen-data-json": "node hack/build-template-data.js", prebuild: "rm -fr dist/* && npm run gen-data-json", build: "tsc -p config/tsconfig.root.json && node build.mjs && npm pack", "build:image": "npm run build && docker buildx build --output type=docker --tag pepr:dev .", "build:image:unicorn": "npm run build && docker buildx build --output type=docker --tag pepr/private:dev $(node scripts/read-unicorn-build-args.mjs) .", "set:version": "node scripts/set-version.js", test: "npm run test:unit && npm run test:journey && npm run test:journey-wasm", "test:artifacts": "npm run build && vitest run src/build-artifact.test.ts", "test:docs": "vitest run --config=config/vitest.integration.config.ts integration/cli/docs/*.test.ts", "test:integration": "npm run test:integration:prep && npm run test:integration:run", "test:integration:prep": "./integration/prep.sh", "test:integration:run": "vitest run --config=config/vitest.integration.config.ts integration", "test:journey": "npm run test:journey:k3d && npm run build && npm run test:journey:image && npm run test:journey:run", "test:journey-wasm": "npm run test:journey:k3d && npm run build && npm run test:journey:image && npm run test:journey:run-wasm", "test:journey-wasm:unicorn": "npm run test:journey:k3d && npm run build && npm run test:journey:image:unicorn && npm run test:journey:run-wasm", "test:journey:image": "docker buildx build --output type=docker --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev", "test:journey:image:unicorn": "npm run build && docker buildx build --output type=docker --tag pepr/private:dev $(node scripts/read-unicorn-build-args.mjs) . && k3d image import pepr/private:dev -c pepr-dev", "test:journey:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0' --wait && kubectl rollout status deployment -n kube-system", "test:journey:run": "vitest run --config=config/vitest.journey.config.ts journey/entrypoint.test.ts && npm run test:journey:upgrade", "test:journey:run-wasm": "vitest run --config=config/vitest.journey.config.ts journey/entrypoint-wasm.test.ts", "test:journey:unicorn": "npm run test:journey:k3d && npm run test:journey:image:unicorn && npm run test:journey:run", "format:check": "npm run format:src && npm run format:tests && npm run format:markdown && npm run format:integration && npm run format:prettier -- --check", "format:fix": "npm run format:src -- --fix && npm run format:markdown -- --fix && npm run format:integration -- --fix && npm run format:prettier -- --write", "format:integration": "eslint --config config/eslint.integration.config.mjs integration/cli integration/helpers", "format:markdown": 'npx -y markdownlint-cli --config config/.markdownlint.json --ignore adr --ignore integration/testroot --ignore pepr-test-module --ignore pepr-upgrade-test --ignore node_modules "**/*.md"', "format:prettier": "prettier --config config/.prettierrc src integration/cli/**/*.ts integration/helpers/**/*.ts", "format:src": "eslint --config config/eslint.root.config.mjs 'src/**/*.ts' --ignore-pattern '**/*.test.ts' --ignore-pattern 'src/templates/**'", "format:tests": "eslint --config config/eslint.test.config.mjs 'src/**/*.test.ts'", "test:journey:upgrade": "npm run test:journey:k3d && npm run test:journey:image && vitest run --config=config/vitest.journey.config.ts journey/pepr-upgrade.test.ts", "test:unit": "npm run gen-data-json && NODE_OPTIONS=--no-deprecation vitest --config config/vitest.root.config.ts run --coverage", prepare: `if [ "$NODE_ENV" != 'production' ]; then husky; fi` }, dependencies: { "@types/ramda": "0.30.2", commander: "14.0.0", express: "5.1.0", "fast-json-patch": "3.1.1", heredoc: "^1.3.1", "http-status-codes": "^2.3.0", "json-pointer": "^0.6.2", "kubernetes-fluent-client": "3.8.0", pino: "9.7.0", "pino-pretty": "13.0.0", "prom-client": "15.1.3", ramda: "0.31.3", sigstore: "3.1.0", "ts-morph": "^26.0.0" }, devDependencies: { "@commitlint/cli": "19.8.1", "@commitlint/config-conventional": "19.8.1", "@fast-check/vitest": "^0.2.1", "@types/eslint": "9.6.1", "@types/express": "5.0.3", "@types/json-pointer": "^1.0.34", "@types/node": "24.x.x", "@types/node-forge": "1.3.12", "@types/uuid": "10.0.0", "@types/ws": "^8.18.1", "@vitest/coverage-v8": "^3.2.3", "fast-check": "^4.0.0", globals: "^16.0.0", husky: "^9.1.6", "js-yaml": "^4.1.0", shellcheck: "^3.0.0", tsx: "^4.20.3", undici: "^7.0.1", vitest: "^3.2.3" }, overrides: { glob: "^9.0.0", "brace-expansion": "1.1.11" }, peerDependencies: { "@types/prompts": "2.4.9", "@typescript-eslint/eslint-plugin": "8.33.0", "@typescript-eslint/parser": "8.33.0", esbuild: "0.25.5", eslint: "^9.26.0", "node-forge": "1.3.1", prettier: "3.5.3", prompts: "2.4.2", typescript: "5.8.3", uuid: "11.1.0" } };
+var packageJSON = { name: "pepr", description: "Kubernetes application engine", author: "Defense Unicorns", homepage: "https://github.com/defenseunicorns/pepr", license: "Apache-2.0", bin: "dist/cli.js", repository: "defenseunicorns/pepr", engines: { node: ">=18.0.0" }, files: ["/dist", "/src", "!src/**/*.test.ts", "!src/fixtures/**", "!dist/**/*.test.d.ts*"], version: "0.52.0-nightly.0", main: "dist/lib.js", types: "dist/lib.d.ts", scripts: { build: "tsc -p config/tsconfig.root.json && node build.mjs && npm pack", "build:image": "npm run build && docker buildx build --output type=docker --tag pepr:dev .", "build:image:unicorn": "npm run build && docker buildx build --output type=docker --tag pepr/private:dev $(node scripts/read-unicorn-build-args.mjs) .", ci: "npm ci", "format:check": "npm run format:src && npm run format:tests && npm run format:markdown && npm run format:integration && npm run format:prettier -- --check", "format:fix": "npm run format:src -- --fix && npm run format:markdown -- --fix && npm run format:integration -- --fix && npm run format:prettier -- --write", "format:integration": "eslint --config config/eslint.integration.config.mjs integration/cli integration/helpers", "format:markdown": 'npx -y markdownlint-cli --config config/.markdownlint.json --ignore adr --ignore integration/testroot --ignore pepr-test-module --ignore node_modules "**/*.md"', "format:prettier": "prettier --config config/.prettierrc src integration/cli/**/*.ts integration/helpers/**/*.ts", "format:src": "eslint --config config/eslint.root.config.mjs 'src/**/*.ts' --ignore-pattern '**/*.test.ts' --ignore-pattern 'src/templates/**'", "format:tests": "eslint --config config/eslint.test.config.mjs 'src/**/*.test.ts'", "gen-data-json": "node hack/build-template-data.js", prebuild: "rm -fr dist/* && npm run gen-data-json", prepare: `if [ "$NODE_ENV" != 'production' ]; then husky; fi`, "set:version": "node scripts/set-version.js", test: "npm run test:unit && npm run test:journey && npm run test:journey-wasm", "test:artifacts": "npm run build && vitest run src/build-artifact.test.ts", "test:docs": "vitest run --config=config/vitest.integration.config.ts integration/cli/docs/*.test.ts", "test:integration": "npm run test:integration:prep && npm run test:integration:run", "test:integration:prep": "./integration/prep.sh", "test:integration:run": "vitest run --config=config/vitest.integration.config.ts integration", "test:journey": "npm run test:journey:k3d && npm run build && npm run test:journey:image && npm run test:journey:run", "test:journey-wasm": "npm run test:journey:k3d && npm run build && npm run test:journey:image && npm run test:journey:run-wasm", "test:journey-wasm:unicorn": "npm run test:journey:k3d && npm run build && npm run test:journey:image:unicorn && npm run test:journey:run-wasm", "test:journey:image": "npm run build && docker buildx build --output type=docker --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev", "test:journey:image:unicorn": "npm run build && docker buildx build --output type=docker --tag pepr/private:dev $(node scripts/read-unicorn-build-args.mjs) . && k3d image import pepr/private:dev -c pepr-dev", "test:journey:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0' --wait && kubectl rollout status deployment -n kube-system", "test:journey:run": "vitest run --config=config/vitest.journey.config.ts journey/entrypoint.test.ts", "test:journey:run-wasm": "vitest run --config=config/vitest.journey.config.ts journey/entrypoint-wasm.test.ts", "test:journey:unicorn": "npm run test:journey:k3d && npm run test:journey:image:unicorn && npm run test:journey:run", "test:unit": "npm run gen-data-json && NODE_OPTIONS=--no-deprecation vitest --config config/vitest.root.config.ts run --coverage", "test:upgrade:unicorn": "npm run test:journey:k3d && npm run test:journey:image:unicorn && vitest run integration/cluster/upgrade.test.ts", "test:upgrade:upstream": "npm run test:journey:k3d && npm run test:journey:image && vitest run integration/cluster/upgrade.test.ts" }, dependencies: { "@types/ramda": "0.30.2", commander: "14.0.0", express: "5.1.0", "fast-json-patch": "3.1.1", heredoc: "^1.3.1", "http-status-codes": "^2.3.0", "json-pointer": "^0.6.2", "kubernetes-fluent-client": "3.8.1", pino: "9.7.0", "pino-pretty": "13.0.0", "prom-client": "15.1.3", ramda: "0.31.3", sigstore: "3.1.0", "ts-morph": "^26.0.0" }, devDependencies: { "@commitlint/cli": "19.8.1", "@commitlint/config-conventional": "19.8.1", "@fast-check/vitest": "^0.2.1", "@types/eslint": "9.6.1", "@types/express": "5.0.3", "@types/json-pointer": "^1.0.34", "@types/node": "24.x.x", "@types/node-forge": "1.3.13", "@types/uuid": "10.0.0", "@types/ws": "^8.18.1", "@vitest/coverage-v8": "^3.2.3", "fast-check": "^4.0.0", globals: "^16.0.0", husky: "^9.1.6", "js-yaml": "^4.1.0", shellcheck: "^3.0.0", tsx: "^4.20.3", undici: "^7.0.1", vitest: "^3.2.3" }, overrides: { glob: "^9.0.0" }, peerDependencies: { "@types/prompts": "2.4.9", "@typescript-eslint/eslint-plugin": "8.33.0", "@typescript-eslint/parser": "8.33.0", esbuild: "0.25.5", eslint: "^9.26.0", "node-forge": "1.3.1", prettier: "3.5.3", prompts: "2.4.2", typescript: "5.8.3", uuid: "11.1.0" } };
 
 // src/cli/init/utils.ts
 var import_fs4 = require("fs");
@@ -9038,12 +9074,12 @@ async function peprFormat(validateOnly) {
       const formatter = await eslint2.loadFormatter("stylish");
       const resultText = await formatter.format(results, {});
       if (resultText) {
-        console.log(resultText);
+        logger_default.info(resultText);
       }
       if (!validateOnly) {
         await import_eslint.ESLint.outputFixes(results);
       }
-      hasFailure = await formatWithPrettier(results, validateOnly);
+      hasFailure = hasFailure || await formatWithPrettier(results, validateOnly);
       return !hasFailure;
     } catch (e) {
       console.error(`Error formatting module:`, e);
@@ -9078,7 +9114,7 @@ var import_fs9 = require("fs");
 var import_crypto2 = __toESM(require("crypto"));
 var import_client_node4 = require("@kubernetes/client-node");
 
-// src/lib/assets/pods.ts
+// src/lib/assets/k8sObjects.ts
 var import_zlib = require("zlib");
 function getNamespace(namespaceLabels) {
   if (namespaceLabels) {
@@ -9101,20 +9137,11 @@ function getNamespace(namespaceLabels) {
   }
 }
 function getWatcher(assets, hash, buildTimestamp, imagePullSecret) {
-  const { name: name2, image, capabilities, config } = assets;
-  let hasSchedule = false;
-  const app = `${name2}-watcher`;
-  const bindings = [];
-  for (const capability of capabilities) {
-    if (capability.hasSchedule) {
-      hasSchedule = true;
-    }
-    const watchers = capability.bindings.filter((binding) => binding.isWatch);
-    bindings.push(...watchers);
-  }
-  if (bindings.length < 1 && !hasSchedule) {
+  const { name: name2, image, config } = assets;
+  if (!isWatcher(assets.capabilities)) {
     return null;
   }
+  const app = `${name2}-watcher`;
   const deploy = {
     apiVersion: "apps/v1",
     kind: "Deployment",
@@ -9247,6 +9274,9 @@ function getWatcher(assets, hash, buildTimestamp, imagePullSecret) {
 function getDeployment(assets, hash, buildTimestamp, imagePullSecret) {
   const { name: name2, image, config } = assets;
   const app = name2;
+  if (!isAdmission(assets.capabilities) && !norWatchOrAdmission(assets.capabilities)) {
+    return null;
+  }
   const deploy = {
     apiVersion: "apps/v1",
     kind: "Deployment",
@@ -9407,6 +9437,62 @@ function getModuleSecret(name2, data, hash) {
     };
   }
 }
+function service(name2, assets) {
+  if (!isAdmission(assets.capabilities) && !norWatchOrAdmission(assets.capabilities)) {
+    return null;
+  }
+  return {
+    apiVersion: "v1",
+    kind: "Service",
+    metadata: {
+      name: name2,
+      namespace: "pepr-system",
+      labels: {
+        "pepr.dev/controller": "admission"
+      }
+    },
+    spec: {
+      selector: {
+        app: name2,
+        "pepr.dev/controller": "admission"
+      },
+      ports: [
+        {
+          port: 443,
+          targetPort: 3e3
+        }
+      ]
+    }
+  };
+}
+function watcherService(name2, assets) {
+  if (!isWatcher(assets.capabilities)) {
+    return null;
+  }
+  return {
+    apiVersion: "v1",
+    kind: "Service",
+    metadata: {
+      name: `${name2}-watcher`,
+      namespace: "pepr-system",
+      labels: {
+        "pepr.dev/controller": "watcher"
+      }
+    },
+    spec: {
+      selector: {
+        app: `${name2}-watcher`,
+        "pepr.dev/controller": "watcher"
+      },
+      ports: [
+        {
+          port: 443,
+          targetPort: 3e3
+        }
+      ]
+    }
+  };
+}
 
 // src/lib/assets/yaml/generateAllYaml.ts
 var import_fs8 = require("fs");
@@ -9495,24 +9581,37 @@ async function webhookConfigGenerator(assets, mutateOrValidate, timeoutSeconds =
 }
 
 // src/lib/assets/yaml/generateAllYaml.ts
-async function generateAllYaml(assets, deployments) {
+function pushControllerManifests(resources, deployments, services) {
+  if (deployments.watch) {
+    resources.push(deployments.watch);
+  }
+  if (deployments.admission) {
+    resources.push(deployments.admission);
+  }
+  if (services.admission) {
+    resources.push(services.admission);
+  }
+  if (services.watch) {
+    resources.push(services.watch);
+  }
+  return resources;
+}
+async function generateAllYaml(assets, deployments, services) {
   const { name: name2, tls, apiPath, path: path4, config } = assets;
   const code = await import_fs8.promises.readFile(path4);
   const hash = import_crypto2.default.createHash("sha256").update(code).digest("hex");
-  const resources = [
+  let resources = [
     getNamespace(assets.config.customLabels?.namespace),
     clusterRole(name2, assets.capabilities, config.rbacMode, config.rbac),
     clusterRoleBinding(name2),
     serviceAccount(name2),
     apiPathSecret(name2, apiPath),
     tlsSecret(name2, tls),
-    deployments.default,
-    service(name2),
-    watcherService(name2),
     getModuleSecret(name2, code, hash),
     storeRole(name2),
     storeRoleBinding(name2)
   ];
+  resources = pushControllerManifests(resources, deployments, services);
   const webhooks = {
     mutate: await webhookConfigGenerator(assets, "mutate" /* MUTATE */, assets.config.webhookTimeout),
     validate: await webhookConfigGenerator(
@@ -9521,7 +9620,7 @@ async function generateAllYaml(assets, deployments) {
       assets.config.webhookTimeout
     )
   };
-  const additionalResources = [webhooks.mutate, webhooks.validate, deployments.watch].filter(
+  const additionalResources = [webhooks.mutate, webhooks.validate].filter(
     (resource) => resource !== null && resource !== void 0
   );
   resources.push(...additionalResources);
@@ -9585,18 +9684,15 @@ function determineRbacMode(opts, cfg) {
   }
   return cfg.pepr.rbacMode || "admin";
 }
-async function handleCustomOutputDir(outputDir2) {
-  const defaultOutputDir = "dist";
-  if (outputDir2) {
-    try {
-      await createDirectoryIfNotExists(outputDir2);
-      return outputDir2;
-    } catch (error) {
-      console.error(`Error creating output directory: ${error.message}`);
-      process.exit(1);
-    }
+async function createOutputDirectory(outputDir2) {
+  try {
+    const dir = outputDir2 === "" ? "dist" : outputDir2;
+    await createDirectoryIfNotExists(dir);
+    return dir;
+  } catch (error) {
+    console.error(`Error creating output directory: ${error.message}`);
+    process.exit(1);
   }
-  return defaultOutputDir;
 }
 function checkIronBankImage(registry, image, peprVersion) {
   return registry === "Iron Bank" ? `registry1.dso.mil/ironbank/opensource/defenseunicorns/pepr/controller:v${peprVersion}` : image;
@@ -9643,7 +9739,16 @@ async function generateYamlAndWriteToDisk(obj) {
   const chartPath = `${uuid}-chart`;
   const yamlPath = (0, import_path3.resolve)(outputDir2, yamlFile);
   try {
-    const yaml = await assets.allYaml(generateAllYaml, getDeployment, getWatcher, imagePullSecret);
+    const yaml = await assets.allYaml(
+      generateAllYaml,
+      {
+        getDeploymentFunction: getDeployment,
+        getWatcherFunction: getWatcher,
+        getServiceFunction: service,
+        getWatcherServiceFunction: watcherService
+      },
+      imagePullSecret
+    );
     const zarfPath = (0, import_path3.resolve)(outputDir2, "zarf.yaml");
     let localZarf = "";
     if (zarf === "chart") {
@@ -9654,7 +9759,7 @@ async function generateYamlAndWriteToDisk(obj) {
     await import_fs9.promises.writeFile(yamlPath, yaml);
     await import_fs9.promises.writeFile(zarfPath, localZarf);
     await assets.generateHelmChart(webhookConfigGenerator, getWatcher, getModuleSecret, outputDir2);
-    console.info(`\u2705 K8s resource for the module saved to ${yamlPath}`);
+    console.info(`K8s resource for the module saved to ${yamlPath}`);
   } catch (error) {
     console.error(`Error generating YAML: ${error}`);
     process.exit(1);
@@ -9665,48 +9770,42 @@ async function generateYamlAndWriteToDisk(obj) {
 var peprTS2 = "pepr.ts";
 var outputDir = "dist";
 function build_default(program2) {
-  program2.command("build").description("Build a Pepr Module for deployment").option("-e, --entry-point [file]", "Specify the entry point file to build with.", peprTS2).option(
-    "-n, --no-embed",
-    "Disables embedding of deployment files into output module. Useful when creating library modules intended solely for reuse/distribution via NPM."
+  program2.command("build").description("Build a Pepr Module for deployment").addOption(
+    new import_commander.Option("-M, --rbac-mode <mode>", "Override module config and set RBAC mode.").choices([
+      "admin",
+      "scoped"
+    ])
   ).addOption(
     new import_commander.Option(
-      "-i, --custom-image <custom-image>",
-      "Specify a custom image (including version) for Admission and Watch Deployments. Example: 'docker.io/username/custom-pepr-controller:v1.0.0'"
-    ).conflicts(["registryInfo", "registry"])
-  ).addOption(
-    new import_commander.Option(
-      "-r, --registry-info [<registry>/<username>]",
-      "Provide the image registry and username for building and pushing a custom WASM container. Requires authentication. Builds and pushes `'registry/username/custom-pepr-controller:<current-version>'`."
+      "-I, --registry-info <registry/username>",
+      "Provide the image registry and username for building and pushing a custom WASM container. Requires authentication. Conflicts with --custom-image and --registry. Builds and pushes `'<registry/username>/custom-pepr-controller:<current-version>'`."
     ).conflicts(["customImage", "registry"])
-  ).option("-o, --output-dir <output directory>", "Define where to place build output").option(
-    "--timeout <timeout>",
-    "How long the API server should wait for a webhook to respond before treating the call as a failure",
-    parseTimeout
+  ).option("-P, --with-pull-secret <name>", "Use image pull secret for controller Deployment.", "").addOption(
+    new import_commander.Option(
+      "-c, --custom-name <name>",
+      "Set name for zarf component and service monitors in helm charts."
+    )
+  ).option("-e, --entry-point <file>", "Specify the entry point file to build with.", peprTS2).addOption(
+    new import_commander.Option(
+      "-i, --custom-image <image>",
+      "Specify a custom image with version for deployments. Conflicts with --registry-info and --registry. Example: 'docker.io/username/custom-pepr-controller:v1.0.0'"
+    ).conflicts(["registryInfo", "registry"])
   ).option(
-    "--withPullSecret <imagePullSecret>",
-    "Image Pull Secret: Use image pull secret for controller Deployment.",
-    ""
-  ).addOption(
+    "-n, --no-embed",
+    "Disable embedding of deployment files into output module. Useful when creating library modules intended solely for reuse/distribution via NPM."
+  ).option("-o, --output <directory>", "Set output directory.", "dist").addOption(
     new import_commander.Option(
-      "--registry <GitHub|Iron Bank>",
-      "Container registry: Choose container registry for deployment manifests. Can't be used with --custom-image."
+      "-r, --registry <GitHub|Iron Bank>",
+      "Container registry: Choose container registry for deployment manifests. Conflicts with --custom-image and --registry-info."
     ).conflicts(["customImage", "registryInfo"]).choices(["GitHub", "Iron Bank"])
+  ).option(
+    "-t, --timeout <seconds>",
+    "How long the API server should wait for a webhook to respond before treating the call as a failure.",
+    parseTimeout
   ).addOption(
-    new import_commander.Option(
-      "-z, --zarf [manifest|chart]",
-      "Zarf package type: manifest, chart (default: manifest)"
-    ).choices(["manifest", "chart"]).default("manifest")
-  ).addOption(
-    new import_commander.Option("--rbac-mode [admin|scoped]", "Rbac Mode: admin, scoped (default: admin)").choices(
-      ["admin", "scoped"]
-    )
-  ).addOption(
-    new import_commander.Option(
-      "--custom-name [name]",
-      "Specify a custom name for zarf component and service monitors in helm charts."
-    )
+    new import_commander.Option("-z, --zarf <manifest|chart>", "Set Zarf package type").choices(["manifest", "chart"]).default("manifest")
   ).action(async (opts) => {
-    outputDir = await handleCustomOutputDir(opts.outputDir);
+    outputDir = await createOutputDirectory(opts.output);
     const buildModuleResult = await buildModule(void 0, opts.entryPoint, opts.embed);
     const { cfg, path: path4 } = buildModuleResult;
     if (opts.customName) {
@@ -9731,7 +9830,7 @@ function build_default(program2) {
       );
     }
     if (!opts.embed) {
-      console.info(`\u2705 Module built successfully at ${path4}`);
+      console.info(`Module built successfully at ${path4}`);
       return;
     }
     const assets = new Assets(
@@ -9816,7 +9915,7 @@ async function buildModule(reloader, entryPoint = peprTS2, embed = true) {
           setup(build) {
             build.onEnd(async (r) => {
               if (r?.metafile) {
-                console.log(await (0, import_esbuild2.analyzeMetafile)(r.metafile));
+                console.info(await (0, import_esbuild2.analyzeMetafile)(r.metafile));
               }
               if (reloader) {
                 await reloader(r);
@@ -9849,7 +9948,7 @@ function handleModuleBuildError(e) {
   if (!e.stdout) process.exit(1);
   const out = e.stdout.toString();
   const err = e.stderr.toString();
-  console.log(out);
+  console.info(out);
   console.error(err);
   if (out.includes("Types have separate declarations of a private property '_name'.")) {
     const pgkErrMatch = /error TS2322: .*? 'import\("\/.*?\/node_modules\/(.*?)\/node_modules/g;
@@ -9876,7 +9975,7 @@ function handleModuleBuildError(e) {
 async function checkFormat() {
   const validFormat = await peprFormat(true);
   if (!validFormat) {
-    console.log(
+    console.info(
       "\x1B[33m%s\x1B[0m",
       "Formatting errors were found. The build will continue, but you may want to run `npx pepr format` to address any issues."
     );
@@ -10027,26 +10126,34 @@ async function setupController(assets, code, hash, force) {
   logger_default.info("Applying module secret");
   const mod = getModuleSecret(name2, code, hash);
   await (0, import_kubernetes_fluent_client3.K8s)(import_kubernetes_fluent_client3.kind.Secret).Apply(mod, { force });
-  logger_default.info("Applying controller service");
-  const svc = service(name2);
-  await (0, import_kubernetes_fluent_client3.K8s)(import_kubernetes_fluent_client3.kind.Service).Apply(svc, { force });
+  if (isAdmission(assets.capabilities) || norWatchOrAdmission(assets.capabilities)) {
+    const svc = service(name2, assets);
+    if (svc) {
+      logger_default.info("Applying controller service");
+      await (0, import_kubernetes_fluent_client3.K8s)(import_kubernetes_fluent_client3.kind.Service).Apply(svc, { force });
+    }
+    const dep = getDeployment(assets, hash, assets.buildTimestamp);
+    if (dep) {
+      logger_default.info("Applying deployment");
+      await (0, import_kubernetes_fluent_client3.K8s)(import_kubernetes_fluent_client3.kind.Deployment).Apply(dep, { force });
+    }
+  }
   logger_default.info("Applying TLS secret");
   const tls = tlsSecret(name2, assets.tls);
   await (0, import_kubernetes_fluent_client3.K8s)(import_kubernetes_fluent_client3.kind.Secret).Apply(tls, { force });
   logger_default.info("Applying API path secret");
   const apiPath = apiPathSecret(name2, assets.apiPath);
   await (0, import_kubernetes_fluent_client3.K8s)(import_kubernetes_fluent_client3.kind.Secret).Apply(apiPath, { force });
-  logger_default.info("Applying deployment");
-  const dep = getDeployment(assets, hash, assets.buildTimestamp);
-  await (0, import_kubernetes_fluent_client3.K8s)(import_kubernetes_fluent_client3.kind.Deployment).Apply(dep, { force });
 }
 async function setupWatcher(assets, hash, force) {
   const watchDeployment = getWatcher(assets, hash, assets.buildTimestamp);
   if (watchDeployment) {
     logger_default.info("Applying watcher deployment");
     await (0, import_kubernetes_fluent_client3.K8s)(import_kubernetes_fluent_client3.kind.Deployment).Apply(watchDeployment, { force });
+  }
+  const watchSvc = watcherService(assets.name, assets);
+  if (watchSvc) {
     logger_default.info("Applying watcher service");
-    const watchSvc = watcherService(assets.name);
     await (0, import_kubernetes_fluent_client3.K8s)(import_kubernetes_fluent_client3.kind.Service).Apply(watchSvc, { force });
   }
 }
@@ -10113,7 +10220,7 @@ function validateImagePullSecretDetails(details) {
   if (missing.length > 0) {
     return {
       valid: false,
-      error: `Error: Must provide ${missing.join(", ")} when providing --pullSecret`
+      error: `Error: Must provide ${missing.join(", ")} when providing --pull-secret`
     };
   }
   return { valid: true };
@@ -10134,15 +10241,15 @@ function generateImagePullSecret(details) {
   };
 }
 async function getUserConfirmation(opts) {
-  if (opts.confirm) {
+  if (opts.yes) {
     return true;
   }
-  const confirm2 = await (0, import_prompts.default)({
+  const confirmation = await (0, import_prompts.default)({
     type: "confirm",
-    name: "confirm",
+    name: "yes",
     message: "This will remove and redeploy the module. Continue?"
   });
-  return confirm2.confirm ? true : false;
+  return confirmation.yes ? true : false;
 }
 async function buildAndDeployModule(image, force) {
   const builtModule = await buildModule();
@@ -10170,7 +10277,7 @@ async function buildAndDeployModule(image, force) {
   }
 }
 function deploy_default(program2) {
-  program2.command("deploy").description("Deploy a Pepr Module").option("-i, --image [image]", "Override the image tag").option("--confirm", "Skip confirmation prompt").option("--pullSecret <name>", "Deploy imagePullSecret for Controller private registry").option("--docker-server <server>", "Docker server address").option("--docker-username <username>", "Docker registry username").option("--docker-email <email>", "Email for Docker registry").option("--docker-password <password>", "Password for Docker registry").option("--force", "Force deploy the module, override manager field").action(async (opts) => {
+  program2.command("deploy").description("Deploy a Pepr Module").option("-E, --docker-email <email>", "Email for Docker registry.").option("-P, --docker-password <password>", "Password for Docker registry.").option("-S, --docker-server <server>", "Docker server address.").option("-U, --docker-username <username>", "Docker registry username.").option("-f, --force", "Force deploy the module, override manager field.").option("-i, --image <image>", "Override the image tag.").option("-p, --pull-secret <name>", "Deploy imagePullSecret for Controller private registry.").option("-y, --yes", "Skip confirmation prompts.").action(async (opts) => {
     const valResp = validateImagePullSecretDetails(opts);
     if (!valResp.valid) {
       console.error(valResp.error);
@@ -10202,14 +10309,14 @@ var import_child_process4 = require("child_process");
 var import_kubernetes_fluent_client5 = require("kubernetes-fluent-client");
 var import_fs12 = require("fs");
 function dev_default(program2) {
-  program2.command("dev").description("Setup a local webhook development environment").option("-h, --host [host]", "Host to listen on", "host.k3d.internal").option("--confirm", "Skip confirmation prompt").action(async (opts) => {
-    if (!opts.confirm) {
+  program2.command("dev").description("Setup a local webhook development environment").option("-H, --host <host>", "Host to listen on", "host.k3d.internal").option("-y, --yes", "Skip confirmation prompt").action(async (opts) => {
+    if (!opts.yes) {
       const confirm2 = await (0, import_prompts2.default)({
         type: "confirm",
-        name: "confirm",
+        name: "yes",
         message: "This will remove and redeploy the module. Continue?"
       });
-      if (!confirm2.confirm) {
+      if (!confirm2.yes) {
         process.exitCode = 0;
         return;
       }
@@ -10492,7 +10599,7 @@ async function setErrorBehavior(errorBehavior) {
 async function confirm(dirName, packageJSON2, peprTSPath, skipPrompt) {
   const confirmationPrompt = {
     type: "confirm",
-    name: "confirm",
+    name: "yes",
     message: "Create the new Pepr module?"
   };
   const confirmationMessage = `To be generated:
@@ -10515,17 +10622,20 @@ ${packageJSON2.print.replace(/^/gm, "    \u2502   ")}
   } else {
     console.log(confirmationMessage);
     const confirm2 = await (0, import_prompts3.default)([confirmationPrompt]);
-    const shouldCreateModule = confirm2.confirm === "y" || confirm2.confirm === "yes" || confirm2.confirm === true ? true : false;
+    const shouldCreateModule = confirm2.yes === "y" || confirm2.yes === "yes" || confirm2.yes === true ? true : false;
     return shouldCreateModule;
   }
 }
 
 // src/cli/init/index.ts
+var import_commander2 = require("commander");
 function init_default(program2) {
   let response = {};
   let pkgOverride = "";
-  program2.command("init").description("Initialize a new Pepr Module").option("--confirm", "Skip verification prompt when creating a new module.").option("--description <string>", "Explain the purpose of the new module.").option("--name <string>", "Set the name of the new module.").option("--skip-post-init", "Skip npm install, git init, and VSCode launch.").option(`--errorBehavior <${ErrorList.join("|")}>`, "Set an errorBehavior.").option(
-    "--uuid [string]",
+  program2.command("init").description("Initialize a new Pepr Module").option("-d, --description <string>", "Explain the purpose of the new module.").addOption(
+    new import_commander2.Option("-e, --error-behavior <behavior>", "Set an error behavior.").choices(ErrorList)
+  ).option("-n, --name <string>", "Set the name of the new module.").option("-s, --skip-post-init", "Skip npm install, git init, and VSCode launch.").option(
+    "-u, --uuid <string>",
     "Unique identifier for your module with a max length of 36 characters.",
     (uuid) => {
       if (uuid.length > UUID_LENGTH_LIMIT) {
@@ -10533,7 +10643,7 @@ function init_default(program2) {
       }
       return uuid.toLocaleLowerCase();
     }
-  ).hook("preAction", async (thisCommand) => {
+  ).option("-y, --yes", "Skip verification prompt when creating a new module.").hook("preAction", async (thisCommand) => {
     if (process.env.TEST_MODE === "true") {
       import_prompts4.default.inject([
         "pepr-test-module",
@@ -10551,7 +10661,7 @@ function init_default(program2) {
   }).action(async (opts) => {
     const dirName = sanitizeName(response.name);
     const packageJSON2 = genPkgJSON(response, pkgOverride);
-    const confirmed = await confirm(dirName, packageJSON2, peprTSTemplate.path, opts.confirm);
+    const confirmed = await confirm(dirName, packageJSON2, peprTSTemplate.path, opts.yes);
     if (confirmed) {
       console.log("Creating new Pepr module...");
       try {
@@ -10642,15 +10752,8 @@ function uuid_default(program2) {
   });
 }
 
-// src/cli/root.ts
-var import_commander2 = require("commander");
-var RootCmd = class extends import_commander2.Command {
-  // eslint-disable-next-line class-methods-use-this
-  createCommand(name2) {
-    const cmd = new import_commander2.Command(name2);
-    return cmd;
-  }
-};
+// src/cli.ts
+var import_commander5 = require("commander");
 
 // src/cli/update/index.ts
 var import_child_process6 = require("child_process");
@@ -10658,7 +10761,7 @@ var import_fs14 = __toESM(require("fs"));
 var import_path6 = require("path");
 var import_prompts5 = __toESM(require("prompts"));
 function update_default(program2) {
-  program2.command("update").description("Update this Pepr module. Not recommended for prod as it may change files.").option("--skip-template-update", "Skip updating the template files").action(async (opts) => {
+  program2.command("update").description("Update this Pepr module. Not recommended for prod as it may change files.").option("-s, --skip-template-update", "Do not update template files").action(async (opts) => {
     if (!opts.skipTemplateUpdate) {
       const { confirm: confirm2 } = await (0, import_prompts5.default)({
         type: "confirm",
@@ -10669,7 +10772,7 @@ function update_default(program2) {
         return;
       }
     }
-    console.log("Updating the Pepr module...");
+    logger_default.info("Updating the Pepr module...");
     try {
       (0, import_child_process6.execSync)("npm install pepr@latest", {
         stdio: "inherit"
@@ -10679,14 +10782,14 @@ function update_default(program2) {
           stdio: "inherit"
         });
       }
-      console.log(`\u2705 Module updated successfully`);
-    } catch (e) {
-      console.error(`Error updating Pepr module:`, e);
+      logger_default.info(`\u2705 Module updated successfully`);
+    } catch (error) {
+      logger_default.error(error, `Error updating Pepr module:`);
       process.exitCode = 1;
     }
   });
   program2.command("update-templates", { hidden: true }).description("Perform template updates").action(async (opts) => {
-    console.log("Updating Pepr config and template tiles...");
+    logger_default.info("Updating Pepr config and template files...");
     try {
       if (!opts.skipTemplateUpdate) {
         await write((0, import_path6.resolve)(prettier.path), prettier.data);
@@ -10703,9 +10806,8 @@ function update_default(program2) {
           await write(tsPath, helloPepr.data);
         }
       }
-      throw new Error("another error, for testing");
-    } catch (e) {
-      console.error(`Error updating template files:`, e);
+    } catch (error) {
+      logger_default.error(error, `Error updating template files:`);
       process.exitCode = 1;
     }
   });
@@ -10715,14 +10817,16 @@ function update_default(program2) {
 var import_child_process7 = require("child_process");
 var import_prompts6 = __toESM(require("prompts"));
 function kfc_default(program2) {
-  program2.command("kfc [args...]").description("Execute Kubernetes Fluent Client commands").action(async (args) => {
-    const { confirm: confirm2 } = await (0, import_prompts6.default)({
-      type: "confirm",
-      name: "confirm",
-      message: "For commands that generate files, this may overwrite any previously generated files.\nAre you sure you want to continue?"
-    });
-    if (!confirm2) {
-      return;
+  program2.command("kfc [args...]").description("Execute Kubernetes Fluent Client commands").option("-y, --yes", "Skip confirmation prompt.").action(async (args, options) => {
+    if (!options.yes) {
+      const { confirm: confirm2 } = await (0, import_prompts6.default)({
+        type: "confirm",
+        name: "confirm",
+        message: "For commands that generate files, this may overwrite any previously generated files.\nAre you sure you want to continue?"
+      });
+      if (!confirm2) {
+        return;
+      }
     }
     try {
       if (args.length === 0) {
@@ -10743,13 +10847,13 @@ function kfc_default(program2) {
 var import_commander3 = require("commander");
 var import_fs15 = require("fs");
 var import_path7 = __toESM(require("path"));
-var create = new import_commander3.Command("create").description("Create a new CRD TypeScript definition").requiredOption("--group <group>", "API group (e.g. cache)").requiredOption("--version <version>", "API version (e.g. v1alpha1)").requiredOption("--kind <kind>", "Kind name (e.g. Memcached)").option("--domain <domain>", "Optional domain (e.g. pepr.dev)", "pepr.dev").option(
-  "--scope <Namespaced | Cluster>",
-  "Whether the resulting custom resource is cluster- or namespace-scoped",
-  validateScope,
-  "Namespaced"
-).option("--plural <plural>", "Plural name (e.g. memcacheds)", "").option("--shortName <shortName>", "Short name (e.g. mc)", "").action(async ({ group: group2, version: version3, kind: kind8, domain, scope, plural: plural2, shortName }) => {
-  console.log("This feature is currently in alpha.\n");
+var create = new import_commander3.Command("create").description("Create a new CRD TypeScript definition").addOption(
+  new import_commander3.Option(
+    "-S, --scope <scope>",
+    "Whether the resulting custom resource is cluster- or namespace-scoped"
+  ).choices(["Namespaced", "Cluster"]).default("Namespaced")
+).option("-d, --domain <domain>", "Optional domain for CRD (e.g. pepr.dev)", "pepr.dev").requiredOption("-g, --group <group>", "API group (e.g. cache)").requiredOption("-k, --kind <kind>", "Kind name (e.g. memcached)").option("-p, --plural <plural>", "Plural name for CRD (e.g. memcacheds)").requiredOption("-s, --short-name <name>", "Short name for CRD (e.g. mc)", "").requiredOption("-v, --version <version>", "API version (e.g. v1alpha1)").action(async ({ group: group2, version: version3, kind: kind8, domain, scope, plural: plural2, shortName }) => {
+  console.log("This feature is currently in alpha.");
   const outputDir2 = import_path7.default.resolve(`./api/${version3}`);
   await createDirectoryIfNotExists(outputDir2);
   await import_fs15.promises.writeFile(
@@ -10838,12 +10942,6 @@ type ${kind8}StatusCondition = {
 
 `;
 };
-function validateScope(value) {
-  if (value !== "Cluster" && value !== "Namespaced") {
-    throw new Error("Scope must be either 'Cluster' or 'Namespaced'");
-  }
-  return value;
-}
 
 // src/cli/crd/generate.ts
 var import_commander4 = require("commander");
@@ -10865,7 +10963,9 @@ var WarningMessages = {
 };
 
 // src/cli/crd/generate.ts
-var generate_default = new import_commander4.Command("generate").description("Generate CRD manifests from TypeScript definitions").option("--output <output>", "Output directory for generated CRDs", "./crds").action(generateCRDs);
+var generate_default = new import_commander4.Command("generate").description(
+  "Generate CRD manifests from TypeScript definitions stored in 'api/' of the current directory."
+).option("-o, --output <directory>", "Output directory for generated CRDs", "./crds").action(generateCRDs);
 function extractCRDDetails(content, sourceFile) {
   const kind8 = extractSingleLineComment(content, "Kind");
   const group2 = extractSingleLineComment(content, "Group") ?? "example";
@@ -10877,7 +10977,7 @@ function extractCRDDetails(content, sourceFile) {
   return { kind: kind8, plural: plural2, scope, shortNames, fqdn };
 }
 async function generateCRDs(options) {
-  console.log("This feature is currently in alpha.\n");
+  logger_default.warn("This feature is currently in alpha.\n");
   const outputDir2 = import_path8.default.resolve(options.output);
   await createDirectoryIfNotExists(outputDir2);
   const project = new import_ts_morph.Project();
@@ -10902,12 +11002,12 @@ function processSourceFile(sourceFile, version3, outputDir2) {
   const content = sourceFile.getFullText();
   const { kind: kind8, fqdn, scope, plural: plural2, shortNames } = extractCRDDetails(content, sourceFile);
   if (!kind8) {
-    console.warn(WarningMessages.MISSING_KIND_COMMENT(sourceFile.getBaseName()));
+    logger_default.warn(WarningMessages.MISSING_KIND_COMMENT(sourceFile.getBaseName()));
     return;
   }
   const spec = sourceFile.getInterface(`${kind8}Spec`);
   if (!spec) {
-    console.warn(WarningMessages.MISSING_INTERFACE(sourceFile.getBaseName(), kind8));
+    logger_default.warn(WarningMessages.MISSING_INTERFACE(sourceFile.getBaseName(), kind8));
     return;
   }
   const condition = sourceFile.getTypeAlias(`${kind8}StatusCondition`);
@@ -10925,7 +11025,7 @@ function processSourceFile(sourceFile, version3, outputDir2) {
   });
   const outPath = import_path8.default.join(outputDir2, `${kind8.toLowerCase()}.yaml`);
   import_fs16.default.writeFileSync(outPath, (0, import_yaml.stringify)(crd), "utf8");
-  console.log(`\u2714 Created ${outPath}`);
+  logger_default.info(`\u2714 Created ${outPath}`);
 }
 function extractSingleLineComment(content, label) {
   const match = content.match(new RegExp(`//\\s+${label}:\\s+(.*)`));
@@ -11090,7 +11190,7 @@ function crd_default(program2) {
 if (process.env.npm_lifecycle_event !== "npx") {
   console.info("Pepr should be run via `npx pepr <command>` instead of `pepr <command>`.");
 }
-var program = new RootCmd();
+var program = new import_commander5.Command();
 if (!process.env.PEPR_NODE_WARNINGS) {
   process.removeAllListeners("warning");
 }