pepr 0.52.2 → 0.52.3

package/dist/cli.js

@@ -7376,12 +7376,6 @@ var banner = `\x1B[107;40m\x1B[38;5;m \x1B[38;5;m \x1B[38;5;m \x1B[38;5;m \x1B[3
   \x1B[0m
 `;
 
-// src/cli/build.ts
-var import_child_process3 = require("child_process");
-var import_esbuild2 = require("esbuild");
-var import_fs10 = require("fs");
-var import_path4 = require("path");
-
 // src/lib/assets/assets.ts
 var import_crypto = __toESM(require("crypto"));
 
@@ -7784,10 +7778,17 @@ async function createDirectoryIfNotExists(path4) {
 }
 
 // src/lib/assets/environment.ts
+function getLogLevel(config) {
+  const fromEnv = process.env.LOG_LEVEL;
+  if (fromEnv) {
+    return fromEnv;
+  }
+  return config.logLevel || "info";
+}
 function genEnv(config, watchMode = false, ignoreWatchMode = false) {
   const noWatchDef = {
     PEPR_PRETTY_LOG: "false",
-    LOG_LEVEL: config.logLevel || "info"
+    LOG_LEVEL: getLogLevel(config)
   };
   const def = {
     PEPR_WATCH_MODE: watchMode ? "true" : "false",
@@ -8366,7 +8367,7 @@ function helmLayout(basePath, unique) {
 // src/lib/assets/loader.ts
 var import_child_process = require("child_process");
 function loadCapabilities(path4) {
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve7, reject) => {
     const program2 = (0, import_child_process.fork)(path4, {
       env: {
         ...process.env,
@@ -8378,9 +8379,9 @@ function loadCapabilities(path4) {
     program2.on("message", (message) => {
       const capabilities = message.valueOf();
       for (const capability of capabilities) {
-        console.info(`Registered Pepr Capability "${capability.name}"`);
+        console.debug(`Registered Pepr Capability "${capability.name}"`);
       }
-      resolve6(capabilities);
+      resolve7(capabilities);
     });
     program2.on("error", (error) => {
       reject(error);
@@ -8629,528 +8630,76 @@ var Assets = class {
   };
 };
 
-// src/cli/init/templates.ts
-var import_client_node3 = require("@kubernetes/client-node");
-var import_util = require("util");
-var import_uuid = require("uuid");
-var import_fs5 = require("fs");
-var import_path2 = __toESM(require("path"));
+// src/cli/build/index.ts
+var import_commander = require("commander");
 
-// src/templates/pepr.code-snippets.json
-var pepr_code_snippets_default = {
-  "Create a new Pepr capability": {
-    prefix: "create pepr capability",
-    body: [
-      "import { Capability, a } from 'pepr';",
-      "",
-      "export const ${TM_FILENAME_BASE/(.*)/${1:/pascalcase}/} = new Capability({",
-      "	name: '${TM_FILENAME_BASE}',",
-      "	description: '${1:A brief description of this capability.}',",
-      "	namespaces: [${2:}],",
-      "});",
-      "",
-      "// Use the 'When' function to create a new action",
-      "const { When } = ${TM_FILENAME_BASE/(.*)/${1:/pascalcase}/};",
-      "",
-      "// When(a.<Kind>).Is<Event>().Then(change => change.<changes>",
-      "When(${3:})"
-    ],
-    description: "Creates a new Pepr capability with a specified description, optional namespaces, and adds a When statement for the specified value."
-  }
-};
+// src/lib/included-files.ts
+var import_fs4 = require("fs");
+async function createDockerfile(version3, description, includedFiles) {
+  const file = `
+    # Use an official Node.js runtime as the base image
+    FROM ghcr.io/defenseunicorns/pepr/controller:v${version3}
+  
+    LABEL description="${description}"
+    
+    # Add the included files to the image
+    ${includedFiles.map((f) => `ADD ${f} ${f}`).join("\n")}
+  
+    `;
+  await import_fs4.promises.writeFile("Dockerfile.controller", file, { encoding: "utf-8" });
+}
 
-// src/templates/.prettierrc.json
-var prettierrc_default = {
-  arrowParens: "avoid",
-  bracketSameLine: false,
-  bracketSpacing: true,
-  embeddedLanguageFormatting: "auto",
-  insertPragma: false,
-  printWidth: 100,
-  quoteProps: "as-needed",
-  requirePragma: false,
-  semi: true,
-  tabWidth: 2,
-  useTabs: false,
-  vueIndentScriptAndStyle: false
-};
+// src/cli/build/build.helpers.ts
+var import_child_process2 = require("child_process");
+var import_esbuild = require("esbuild");
+var import_path2 = require("path");
+var import_fs6 = require("fs");
 
-// src/templates/capabilities/hello-pepr.samples.json
-var hello_pepr_samples_default = [
-  {
-    apiVersion: "v1",
-    kind: "Namespace",
-    metadata: {
-      name: "pepr-demo",
-      labels: {
-        "keep-me": "please",
-        "remove-me": "please"
-      }
-    }
-  },
-  {
-    apiVersion: "v1",
-    kind: "Namespace",
-    metadata: {
-      name: "pepr-demo-2"
-    }
-  },
-  {
-    apiVersion: "v1",
-    kind: "Secret",
-    metadata: {
-      name: "secret-1",
-      namespace: "pepr-demo"
-    },
-    data: {
-      example: "dW5pY29ybiBtYWdpYw==",
-      "binary-data": "iCZQUg8xYucNUqD+8lyl2YcKjYYygvTtiDSEV9b9WKUkxSSLFJTgIWMJ9GcFFYs4T9JCdda51u74jfq8yHzRuEASl60EdTS/NfWgIIFTGqcNRfqMw+vgpyTMmCyJVaJEDFq6AA==",
-      "ascii-with-white-space": "VGhpcyBpcyBzb21lIHJhbmRvbSB0ZXh0OgoKICAgIC0gd2l0aCBsaW5lIGJyZWFrcwogICAgLSBhbmQgdGFicw=="
-    }
-  },
-  {
-    apiVersion: "v1",
-    kind: "ConfigMap",
-    metadata: {
-      name: "example-1",
-      namespace: "pepr-demo"
-    },
-    data: {
-      key: "ex-1-val"
-    }
-  },
-  {
-    apiVersion: "v1",
-    kind: "ConfigMap",
-    metadata: {
-      name: "example-2",
-      namespace: "pepr-demo"
-    },
-    data: {
-      key: "ex-2-val"
-    }
-  },
-  {
-    apiVersion: "v1",
-    kind: "ConfigMap",
-    metadata: {
-      name: "example-evil-cm",
-      namespace: "pepr-demo",
-      annotations: {
-        evil: "true"
+// src/lib/assets/yaml/generateAllYaml.ts
+var import_crypto2 = __toESM(require("crypto"));
+var import_client_node3 = require("@kubernetes/client-node");
+
+// src/lib/assets/k8sObjects.ts
+var import_zlib = require("zlib");
+function getNamespace(namespaceLabels) {
+  if (namespaceLabels) {
+    return {
+      apiVersion: "v1",
+      kind: "Namespace",
+      metadata: {
+        name: "pepr-system",
+        labels: namespaceLabels ?? {}
       }
-    },
-    data: {
-      key: "ex-evil-cm-val"
-    }
-  },
-  {
-    apiVersion: "v1",
-    kind: "ConfigMap",
-    metadata: {
-      name: "example-3",
-      namespace: "pepr-demo",
-      labels: {
-        change: "by-label"
+    };
+  } else {
+    return {
+      apiVersion: "v1",
+      kind: "Namespace",
+      metadata: {
+        name: "pepr-system"
       }
-    },
-    data: {
-      key: "ex-3-val"
-    }
-  },
-  {
-    apiVersion: "v1",
-    kind: "ConfigMap",
-    metadata: {
-      name: "example-4",
-      namespace: "pepr-demo"
-    },
-    data: {
-      key: "ex-4-val"
-    }
-  },
-  {
-    apiVersion: "v1",
-    kind: "ConfigMap",
-    metadata: {
-      name: "example-4a",
-      namespace: "pepr-demo-2"
-    },
-    data: {
-      key: "ex-4-val"
-    }
-  },
-  {
-    apiVersion: "v1",
-    kind: "ConfigMap",
+    };
+  }
+}
+function getWatcher(assets, hash, buildTimestamp, imagePullSecret) {
+  const { name: name2, image, config } = assets;
+  if (!isWatcher(assets.capabilities)) {
+    return null;
+  }
+  const app = `${name2}-watcher`;
+  const deploy = {
+    apiVersion: "apps/v1",
+    kind: "Deployment",
     metadata: {
-      name: "example-5",
-      namespace: "pepr-demo",
+      name: app,
+      namespace: "pepr-system",
+      annotations: {
+        "pepr.dev/description": config.description || ""
+      },
       labels: {
-        "chuck-norris": "test"
-      }
-    },
-    data: {
-      key: "ex-5-val"
-    }
-  },
-  {
-    apiVersion: "apiextensions.k8s.io/v1",
-    kind: "CustomResourceDefinition",
-    metadata: {
-      name: "unicorns.pepr.dev"
-    },
-    spec: {
-      group: "pepr.dev",
-      versions: [
-        {
-          name: "v1",
-          served: true,
-          storage: true,
-          schema: {
-            openAPIV3Schema: {
-              type: "object",
-              properties: {
-                spec: {
-                  type: "object",
-                  properties: {
-                    message: {
-                      type: "string"
-                    },
-                    counter: {
-                      type: "number"
-                    }
-                  }
-                }
-              }
-            }
-          }
-        }
-      ],
-      scope: "Namespaced",
-      names: {
-        plural: "unicorns",
-        singular: "unicorn",
-        kind: "Unicorn"
-      }
-    }
-  }
-];
-
-// src/templates/settings.json
-var settings_default = {
-  "debug.javascript.terminalOptions": {
-    enableTurboSourcemaps: true,
-    resolveSourceMapLocations: [
-      "${workspaceFolder}/**",
-      "node_modules/kubernetes-fluent-client/**",
-      "node_modules/pepr/**"
-    ]
-  }
-};
-
-// src/templates/tsconfig.module.json
-var tsconfig_module_default = {
-  compilerOptions: {
-    allowSyntheticDefaultImports: true,
-    declaration: true,
-    declarationMap: true,
-    emitDeclarationOnly: true,
-    esModuleInterop: true,
-    lib: ["ES2022"],
-    module: "NodeNext",
-    moduleResolution: "NodeNext",
-    outDir: "dist",
-    resolveJsonModule: true,
-    rootDir: ".",
-    strict: false,
-    target: "ES2022",
-    useUnknownInCatchVariables: false
-  },
-  include: ["**/*.ts"]
-};
-
-// src/templates/data.json
-var gitIgnore = "# Ignore node_modules and Pepr build artifacts\nnode_modules\ndist\ninsecure*\n";
-var readmeMd = '# Pepr Module\n\nThis is a Pepr Module. [Pepr](https://github.com/defenseunicorns/pepr) is a type-safe Kubernetes middleware system.\n\nThe `capabilities` directory contains all the capabilities for this module. By default,\na capability is a single typescript file in the format of `capability-name.ts` that is\nimported in the root `pepr.ts` file as `import { HelloPepr } from "./capabilities/hello-pepr";`.\nBecause this is typescript, you can organize this however you choose, e.g. creating a sub-folder\nper-capability or common logic in shared files or folders.\n\nExample Structure:\n\n```text\nModule Root\n\u251C\u2500\u2500 package.json\n\u251C\u2500\u2500 pepr.ts\n\u2514\u2500\u2500 capabilities\n    \u251C\u2500\u2500 example-one.ts\n    \u251C\u2500\u2500 example-three.ts\n    \u2514\u2500\u2500 example-two.ts\n```\n';
-var peprTS = 'import { PeprModule } from "pepr";\n// cfg loads your pepr configuration from package.json\nimport cfg from "./package.json";\n\n// HelloPepr is a demo capability that is included with Pepr. Comment or delete the line below to remove it.\nimport { HelloPepr } from "./capabilities/hello-pepr";\n\n/**\n * This is the main entrypoint for this Pepr module. It is run when the module is started.\n * This is where you register your Pepr configurations and capabilities.\n */\nnew PeprModule(cfg, [\n  // "HelloPepr" is a demo capability that is included with Pepr. Comment or delete the line below to remove it.\n  HelloPepr,\n\n  // Your additional capabilities go here\n]);\n';
-var helloPeprTS = 'import {\n  Capability,\n  K8s,\n  Log,\n  PeprMutateRequest,\n  RegisterKind,\n  a,\n  fetch,\n  fetchStatus,\n  kind,\n} from "pepr";\nimport { MockAgent, setGlobalDispatcher } from "undici";\n\n/**\n *  The HelloPepr Capability is an example capability to demonstrate some general concepts of Pepr.\n *  To test this capability you run `pepr dev`and then run the following command:\n *  `kubectl apply -f capabilities/hello-pepr.samples.yaml`\n */\nexport const HelloPepr = new Capability({\n  name: "hello-pepr",\n  description: "A simple example capability to show how things work.",\n  namespaces: ["pepr-demo", "pepr-demo-2"],\n});\n\n// Use the \'When\' function to create a new action, use \'Store\' to persist data\nconst { When, Store } = HelloPepr;\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Namespace)                                   *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action removes the label `remove-me` when a Namespace is created.\n * Note we don\'t need to specify the namespace here, because we\'ve already specified\n * it in the Capability definition above.\n */\nWhen(a.Namespace)\n  .IsCreated()\n  .Mutate(ns => ns.RemoveLabel("remove-me"));\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Watch Action with K8s SSA (Namespace)                           *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action watches for the `pepr-demo-2` namespace to be created, then creates a ConfigMap with\n * the name `pepr-ssa-demo` and adds the namespace UID to the ConfigMap data. Because Pepr uses\n * server-side apply for this operation, the ConfigMap will be created or updated if it already exists.\n */\nWhen(a.Namespace)\n  .IsCreated()\n  .WithName("pepr-demo-2")\n  .Watch(async ns => {\n    Log.info("Namespace pepr-demo-2 was created.");\n\n    try {\n      // Apply the ConfigMap using K8s server-side apply\n      await K8s(kind.ConfigMap).Apply({\n        metadata: {\n          name: "pepr-ssa-demo",\n          namespace: "pepr-demo-2",\n        },\n        data: {\n          "ns-uid": ns.metadata.uid,\n        },\n      });\n    } catch (error) {\n      // You can use the Log object to log messages to the Pepr controller pod\n      Log.error(error, "Failed to apply ConfigMap using server-side apply.");\n    }\n\n    // You can share data between actions using the Store, including between different types of actions\n    Store.setItem("watch-data", "This data was stored by a Watch Action.");\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 1)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This is a single action. They can be in the same file or put imported from other files.\n * In this example, when a ConfigMap is created with the name `example-1`, then add a label and annotation.\n *\n * Equivalent to manually running:\n * `kubectl label configmap example-1 pepr=was-here`\n * `kubectl annotate configmap example-1 pepr.dev=annotations-work-too`\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-1")\n  .Mutate(request => {\n    request.SetLabel("pepr", "was-here").SetAnnotation("pepr.dev", "annotations-work-too");\n\n    // Use the Store to persist data between requests and Pepr controller pods\n    Store.setItem("example-1", "was-here");\n\n    // This data is written asynchronously and can be read back via `Store.getItem()` or `Store.subscribe()`\n    Store.setItem("example-1-data", JSON.stringify(request.Raw.data));\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate & Validate Actions (CM Example 2)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This combines 3 different types of actions: \'Mutate\', \'Validate\', and \'Watch\'. The order\n * of the actions is required, but each action is optional. In this example, when a ConfigMap is created\n * with the name `example-2`, then add a label and annotation, validate that the ConfigMap has the label\n * `pepr`, and log the request.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-2")\n  .Mutate(request => {\n    // This Mutate Action will mutate the request before it is persisted to the cluster\n\n    // Use `request.Merge()` to merge the new data with the existing data\n    request.Merge({\n      metadata: {\n        labels: {\n          pepr: "was-here",\n        },\n        annotations: {\n          "pepr.dev": "annotations-work-too",\n        },\n      },\n    });\n  })\n  .Validate(request => {\n    // This Validate Action will validate the request before it is persisted to the cluster\n\n    // Approve the request if the ConfigMap has the label \'pepr\'\n    if (request.HasLabel("pepr")) {\n      return request.Approve();\n    }\n\n    // Otherwise, deny the request with an error message (optional)\n    return request.Deny("ConfigMap must have label \'pepr\'");\n  })\n  .Watch((cm, phase) => {\n    // This Watch Action will watch the ConfigMap after it has been persisted to the cluster\n    Log.info(cm, `ConfigMap was ${phase} with the name example-2`);\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 2a)                               *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action shows a simple validation that will deny any ConfigMap that has the\n * annotation `evil`. Note that the `Deny()` function takes an optional second parameter that is a\n * user-defined status code to return.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .Validate(request => {\n    if (request.HasAnnotation("evil")) {\n      return request.Deny("No evil CM annotations allowed.", 400);\n    }\n\n    return request.Approve();\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 3)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action combines different styles. Unlike the previous actions, this one will look\n * for any ConfigMap in the `pepr-demo` namespace that has the label `change=by-label` during either\n * CREATE or UPDATE. Note that all conditions added such as `WithName()`, `WithLabel()`, `InNamespace()`,\n * are ANDs so all conditions must be true for the request to be processed.\n */\nWhen(a.ConfigMap)\n  .IsCreatedOrUpdated()\n  .WithLabel("change", "by-label")\n  .Mutate(request => {\n    // The K8s object e are going to mutate\n    const cm = request.Raw;\n\n    // Get the username and uid of the K8s request\n    const { username, uid } = request.Request.userInfo;\n\n    // Store some data about the request in the configmap\n    cm.data["username"] = username;\n    cm.data["uid"] = uid;\n\n    // You can still mix other ways of making changes too\n    request.SetAnnotation("pepr.dev", "making-waves");\n  });\n\n// This action validates the label `change=by-label` is deleted\nWhen(a.ConfigMap)\n  .IsDeleted()\n  .WithLabel("change", "by-label")\n  .Validate(request => {\n    // Log and then always approve the request\n    Log.info("CM with label \'change=by-label\' was deleted.");\n    return request.Approve();\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 4)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action show how you can use the `Mutate()` function without an inline function.\n * This is useful if you want to keep your actions small and focused on a single task,\n * or if you want to reuse the same function in multiple actions.\n */\nWhen(a.ConfigMap).IsCreated().WithName("example-4").Mutate(example4Cb);\n\n// This function uses the complete type definition, but is not required.\nfunction example4Cb(cm: PeprMutateRequest<a.ConfigMap>): void {\n  cm.SetLabel("pepr.dev/first", "true");\n  cm.SetLabel("pepr.dev/second", "true");\n  cm.SetLabel("pepr.dev/third", "true");\n}\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 4a)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This is the same as Example 4, except this only operates on a CM in the `pepr-demo-2` namespace.\n * Note because the Capability defines namespaces, the namespace specified here must be one of those.\n * Alternatively, you can remove the namespace from the Capability definition and specify it here.\n */\nWhen(a.ConfigMap).IsCreated().InNamespace("pepr-demo-2").WithName("example-4a").Mutate(example4Cb);\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 5)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action is a bit more complex. It will look for any ConfigMap in the `pepr-demo`\n * namespace that has the label `chuck-norris` during CREATE. When it finds one, it will fetch a\n * random Chuck Norris joke from the API and add it to the ConfigMap. This is a great example of how\n * you can use Pepr to make changes to your K8s objects based on external data.\n *\n * Note the use of the `async` keyword. This is required for any action that uses `await` or `fetch()`.\n *\n * Also note we are passing a type to the `fetch()` function. This is optional, but it will help you\n * avoid mistakes when working with the data returned from the API. You can also use the `as` keyword to\n * cast the data returned from the API.\n *\n * These are equivalent:\n * ```ts\n * const joke = await fetch<TheChuckNorrisJoke>("https://icanhazdadjoke.com/");\n * const joke = await fetch("https://icanhazdadjoke.com/") as TheChuckNorrisJoke;\n * ```\n *\n * Alternatively, you can drop the type completely:\n *\n * ```ts\n * fetch("https://icanhazdadjoke.com")\n * ```\n */\ninterface TheChuckNorrisJoke {\n  id: string;\n  joke: string;\n  status: number;\n}\n\nWhen(a.ConfigMap)\n  .IsCreatedOrUpdated()\n  .WithLabel("chuck-norris")\n  .Mutate(cm => cm.SetLabel("got-jokes", "true"))\n  .Watch(async cm => {\n    const jokeURL = "https://icanhazdadjoke.com";\n\n    const mockAgent: MockAgent = new MockAgent();\n    setGlobalDispatcher(mockAgent);\n    const mockClient = mockAgent.get(jokeURL);\n    mockClient.intercept({ path: "/", method: "GET" }).reply(\n      200,\n      {\n        id: "R7UfaahVfFd",\n        joke: "Funny joke goes here.",\n        status: 200,\n      },\n      {\n        headers: {\n          "Content-Type": "application/json; charset=utf-8",\n        },\n      },\n    );\n\n    // Try/catch is not needed as a response object will always be returned\n    const response = await fetch<TheChuckNorrisJoke>(jokeURL, {\n      headers: {\n        Accept: "application/json",\n      },\n    });\n\n    // Instead, check the `response.ok` field\n    if (response.ok) {\n      const { joke } = response.data;\n      // Add Joke to the Store\n      await Store.setItemAndWait(jokeURL, joke);\n      // Add the Chuck Norris joke to the configmap\n      try {\n        await K8s(kind.ConfigMap).Apply({\n          metadata: {\n            name: cm.metadata.name,\n            namespace: cm.metadata.namespace,\n          },\n          data: {\n            "chuck-says": Store.getItem(jokeURL),\n          },\n        });\n      } catch (error) {\n        Log.error(error, "Failed to apply ConfigMap using server-side apply.", {\n          cm,\n        });\n      }\n    }\n\n    // You can also assert on different HTTP response codes\n    if (response.status === fetchStatus.NOT_FOUND) {\n      // Do something else\n      return;\n    }\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Secret Base64 Handling)                      *\n * ---------------------------------------------------------------------------------------------------\n *\n * The K8s JS client provides incomplete support for base64 encoding/decoding handling for secrets,\n * unlike the GO client. To make this less painful, Pepr automatically handles base64 encoding/decoding\n * secret data before and after the action is executed.\n */\nWhen(a.Secret)\n  .IsCreated()\n  .WithName("secret-1")\n  .Mutate(request => {\n    const secret = request.Raw;\n\n    // This will be encoded at the end of all processing back to base64: "Y2hhbmdlLXdpdGhvdXQtZW5jb2Rpbmc="\n    secret.data.magic = "change-without-encoding";\n\n    // You can modify the data directly, and it will be encoded at the end of all processing\n    secret.data.example += " - modified by Pepr";\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Untyped Custom Resource)                     *\n * ---------------------------------------------------------------------------------------------------\n *\n * Out of the box, Pepr supports all the standard Kubernetes objects. However, you can also create\n * your own types. This is useful if you are working with an Operator that creates custom resources.\n * There are two ways to do this, the first is to use the `When()` function with a `GenericKind`,\n * the second is to create a new class that extends `GenericKind` and use the `RegisterKind()` function.\n *\n * This example shows how to use the `When()` function with a `GenericKind`. Note that you\n * must specify the `group`, `version`, and `kind` of the object (if applicable). This is how Pepr knows\n * if the action should be triggered or not. Since we are using a `GenericKind`,\n * Pepr will not be able to provide any intellisense for the object, so you will need to refer to the\n * Kubernetes API documentation for the object you are working with.\n *\n * You will need to wait for the CRD in `hello-pepr.samples.yaml` to be created, then you can apply\n *\n * ```yaml\n * apiVersion: pepr.dev/v1\n * kind: Unicorn\n * metadata:\n *   name: example-1\n *   namespace: pepr-demo\n * spec:\n *   message: replace-me\n *   counter: 0\n * ```\n */\nWhen(a.GenericKind, {\n  group: "pepr.dev",\n  version: "v1",\n  kind: "Unicorn",\n})\n  .IsCreated()\n  .WithName("example-1")\n  .Mutate(request => {\n    request.Merge({\n      spec: {\n        message: "Hello Pepr without type data!",\n        counter: Math.random(),\n      },\n    });\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Typed Custom Resource)                       *\n * ---------------------------------------------------------------------------------------------------\n *\n * This example shows how to use the `RegisterKind()` function to create a new type. This is useful\n * if you are working with an Operator that creates custom resources and you want to have intellisense\n * for the object. Note that you must specify the `group`, `version`, and `kind` of the object (if applicable)\n * as this is how Pepr knows if the action should be triggered or not.\n *\n * Once you register a new Kind with Pepr, you can use the `When()` function with the new Kind. Ideally,\n * you should register custom Kinds at the top of your Capability file or Pepr Module so they are available\n * to all actions, but we are putting it here for demonstration purposes.\n *\n * You will need to wait for the CRD in `hello-pepr.samples.yaml` to be created, then you can apply\n *\n * ```yaml\n * apiVersion: pepr.dev/v1\n * kind: Unicorn\n * metadata:\n *   name: example-2\n *   namespace: pepr-demo\n * spec:\n *   message: replace-me\n *   counter: 0\n * ```*\n */\nclass UnicornKind extends a.GenericKind {\n  spec: {\n    /**\n     * JSDoc comments can be added to explain more details about the field.\n     *\n     * @example\n     * ```ts\n     * request.Raw.spec.message = "Hello Pepr!";\n     * ```\n     * */\n    message: string;\n    counter: number;\n  };\n}\n\nRegisterKind(UnicornKind, {\n  group: "pepr.dev",\n  version: "v1",\n  kind: "Unicorn",\n});\n\nWhen(UnicornKind)\n  .IsCreated()\n  .WithName("example-2")\n  .Mutate(request => {\n    request.Merge({\n      spec: {\n        message: "Hello Pepr with type data!",\n        counter: Math.random(),\n      },\n    });\n  });\n\n/**\n * A callback function that is called once the Pepr Store is fully loaded.\n */\nStore.onReady(data => {\n  Log.info(data, "Pepr Store Ready");\n});\n';
-var packageJSON = { name: "pepr", description: "Kubernetes application engine", author: "Defense Unicorns", homepage: "https://github.com/defenseunicorns/pepr", license: "Apache-2.0", bin: "dist/cli.js", repository: "defenseunicorns/pepr", engines: { node: ">=18.0.0" }, files: ["/dist", "/src", "!src/**/*.test.ts", "!src/fixtures/**", "!dist/**/*.test.d.ts*"], version: "0.52.2", main: "dist/lib.js", types: "dist/lib.d.ts", scripts: { build: "tsc -p config/tsconfig.root.json && node build.mjs && npm pack", "build:image": "npm run build && docker buildx build --output type=docker --tag pepr:dev .", "build:image:unicorn": "npm run build && docker buildx build --output type=docker --tag pepr/private:dev $(node scripts/read-unicorn-build-args.mjs) .", ci: "npm ci", "format:check": "npm run format:src && npm run format:tests && npm run format:markdown && npm run format:integration && npm run format:prettier -- --check", "format:fix": "npm run format:src -- --fix && npm run format:markdown -- --fix && npm run format:integration -- --fix && npm run format:prettier -- --write", "format:integration": "eslint --config config/eslint.integration.config.mjs integration/cli integration/helpers", "format:markdown": 'npx -y markdownlint-cli --config config/.markdownlint.json --ignore adr --ignore integration/testroot --ignore pepr-test-module --ignore node_modules "**/*.md"', "format:prettier": "prettier --config config/.prettierrc src integration/cli/**/*.ts integration/helpers/**/*.ts", "format:src": "eslint --config config/eslint.root.config.mjs 'src/**/*.ts' --ignore-pattern '**/*.test.ts' --ignore-pattern 'src/templates/**'", "format:tests": "eslint --config config/eslint.test.config.mjs 'src/**/*.test.ts'", "gen-data-json": "node hack/build-template-data.js", prebuild: "rm -fr dist/* && npm run gen-data-json", prepare: `if [ "$NODE_ENV" != 'production' ]; then husky; fi`, "set:version": "node scripts/set-version.js", test: "npm run test:unit && npm run test:journey && npm run test:journey-wasm", "test:artifacts": "npm run build && vitest run src/build-artifact.test.ts", "test:docs": "vitest run --config=config/vitest.integration.config.ts integration/cli/docs/*.test.ts", "test:integration": "npm run test:integration:prep && npm run test:integration:run", "test:integration:prep": "./integration/prep.sh", "test:integration:run": "vitest run --config=config/vitest.integration.config.ts integration", "test:journey": "npm run test:journey:k3d && npm run build && npm run test:journey:image && npm run test:journey:run", "test:journey-wasm": "npm run test:journey:k3d && npm run build && npm run test:journey:image && npm run test:journey:run-wasm", "test:journey-wasm:unicorn": "npm run test:journey:k3d && npm run build && npm run test:journey:image:unicorn && npm run test:journey:run-wasm", "test:journey:image": "npm run build && docker buildx build --output type=docker --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev", "test:journey:image:unicorn": "npm run build && docker buildx build --output type=docker --tag pepr/private:dev $(node scripts/read-unicorn-build-args.mjs) . && k3d image import pepr/private:dev -c pepr-dev", "test:journey:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0' --wait && kubectl rollout status deployment -n kube-system", "test:journey:run": "vitest run --config=config/vitest.journey.config.ts journey/entrypoint.test.ts", "test:journey:run-wasm": "vitest run --config=config/vitest.journey.config.ts journey/entrypoint-wasm.test.ts", "test:journey:unicorn": "npm run test:journey:k3d && npm run test:journey:image:unicorn && npm run test:journey:run", "test:unit": "npm run gen-data-json && NODE_OPTIONS=--no-deprecation vitest --config config/vitest.root.config.ts run --coverage", "test:upgrade:unicorn": "npm run test:journey:k3d && npm run test:journey:image:unicorn && vitest run integration/cluster/upgrade.test.ts", "test:upgrade:upstream": "npm run test:journey:k3d && npm run test:journey:image && vitest run integration/cluster/upgrade.test.ts" }, dependencies: { "@types/ramda": "0.30.2", commander: "14.0.0", express: "5.1.0", "fast-json-patch": "3.1.1", heredoc: "^1.3.1", "http-status-codes": "^2.3.0", "json-pointer": "^0.6.2", "kubernetes-fluent-client": "3.9.0", pino: "9.7.0", "pino-pretty": "13.0.0", "prom-client": "15.1.3", ramda: "0.31.3", sigstore: "3.1.0", "ts-morph": "^26.0.0" }, devDependencies: { "@commitlint/cli": "19.8.1", "@commitlint/config-conventional": "19.8.1", "@fast-check/vitest": "^0.2.1", "@types/eslint": "9.6.1", "@types/express": "5.0.3", "@types/json-pointer": "^1.0.34", "@types/node": "24.x.x", "@types/node-forge": "1.3.13", "@types/uuid": "10.0.0", "@types/ws": "^8.18.1", "@vitest/coverage-v8": "^3.2.3", "fast-check": "^4.0.0", globals: "^16.0.0", husky: "^9.1.6", "js-yaml": "^4.1.0", shellcheck: "^3.0.0", tsx: "^4.20.3", undici: "^7.0.1", vitest: "^3.2.3" }, overrides: { glob: "^9.0.0" }, peerDependencies: { "@types/prompts": "2.4.9", "@typescript-eslint/eslint-plugin": "8.33.0", "@typescript-eslint/parser": "8.33.0", esbuild: "0.25.5", eslint: "^9.26.0", "node-forge": "1.3.1", prettier: "3.5.3", prompts: "2.4.2", typescript: "5.8.3", uuid: "11.1.0" } };
-
-// src/cli/init/utils.ts
-var import_fs4 = require("fs");
-function sanitizeName(name2) {
-  if (typeof name2 !== "string") {
-    throw TypeError(
-      `sanitizeName() was called with a non-string value. The value is: ${name2} of type ${typeof name2}`
-    );
-  }
-  let sanitized = name2.toLowerCase().replace(/[^a-z0-9-]+/gi, "-");
-  sanitized = sanitized.replace(/^-+|-+$/g, "");
-  sanitized = sanitized.replace(/--+/g, "-");
-  return sanitized;
-}
-async function createDir(dir) {
-  try {
-    await import_fs4.promises.mkdir(dir);
-  } catch (err) {
-    if (err && err.code === "EEXIST") {
-      throw new Error(`Directory ${dir} already exists`);
-    } else {
-      throw err;
-    }
-  }
-}
-function write(path4, data) {
-  if (typeof data !== "string") {
-    data = JSON.stringify(data, null, 2);
-  }
-  return import_fs4.promises.writeFile(path4, data);
-}
-
-// src/cli/init/templates.ts
-var { dependencies, devDependencies, peerDependencies, scripts, version } = packageJSON;
-function genPkgJSON(opts) {
-  const uuid = !opts.uuid ? (0, import_uuid.v4)() : opts.uuid;
-  const name2 = sanitizeName(opts.name);
-  const { typescript } = peerDependencies;
-  const data = {
-    name: name2,
-    version: "0.0.1",
-    description: opts.description,
-    keywords: ["pepr", "k8s", "policy-engine", "pepr-module", "security"],
-    engines: {
-      node: ">=20.0.0"
-    },
-    pepr: {
-      uuid,
-      onError: opts.errorBehavior,
-      webhookTimeout: 10,
-      customLabels: {
-        namespace: {
-          "pepr.dev": ""
-        }
-      },
-      alwaysIgnore: {
-        namespaces: []
-      },
-      admission: {
-        alwaysIgnore: {
-          namespaces: []
-        }
-      },
-      watch: {
-        alwaysIgnore: {
-          namespaces: []
-        }
-      },
-      includedFiles: [],
-      env: {}
-    },
-    scripts: {
-      "k3d-setup": scripts["test:journey:k3d"]
-    },
-    dependencies: {
-      pepr: version,
-      undici: "^7.0.1"
-    },
-    devDependencies: {
-      typescript
-    },
-    overrides: {
-      "brace-expansion": "1.1.11"
-    }
-  };
-  return {
-    data,
-    path: "package.json",
-    print: (0, import_util.inspect)(data, false, 5, true)
-  };
-}
-var peprTSTemplate = {
-  path: "pepr.ts",
-  data: peprTS
-};
-var readme = {
-  path: "README.md",
-  data: readmeMd
-};
-var helloPepr = {
-  path: "hello-pepr.ts",
-  data: helloPeprTS
-};
-var gitignore = {
-  path: ".gitignore",
-  data: gitIgnore
-};
-var samplesYaml = {
-  path: "hello-pepr.samples.yaml",
-  data: hello_pepr_samples_default.map((r) => (0, import_client_node3.dumpYaml)(r, { noRefs: true })).join("---\n")
-};
-var snippet = {
-  path: "pepr.code-snippets",
-  data: pepr_code_snippets_default
-};
-var codeSettings = {
-  path: "settings.json",
-  data: settings_default
-};
-var tsConfig = {
-  path: "tsconfig.json",
-  data: tsconfig_module_default
-};
-var prettier = {
-  path: ".prettierrc",
-  data: prettierrc_default
-};
-var eslint = {
-  path: "eslint.config.mjs",
-  data: (0, import_fs5.readFileSync)(
-    import_path2.default.resolve(
-      (() => {
-        const fullPath = __dirname;
-        const lengthOfSuffix = "pepr/".length;
-        const lastPeprIndex = fullPath.lastIndexOf("pepr/");
-        return fullPath.substring(0, lastPeprIndex + lengthOfSuffix);
-      })(),
-      "src/templates/eslint.config.mjs"
-    ),
-    "utf-8"
-  )
-};
-
-// src/cli/build.ts
-var import_commander = require("commander");
-
-// src/cli/format/index.ts
-var import_eslint = require("eslint");
-
-// src/cli/format/format.helpers.ts
-var import_fs6 = require("fs");
-var import_prettier = require("prettier");
-async function formatWithPrettier(results, validateOnly) {
-  let hasFailure = false;
-  for (const { filePath } of results) {
-    const content = await import_fs6.promises.readFile(filePath, "utf8");
-    const cfg = await (0, import_prettier.resolveConfig)(filePath);
-    const formatted = await (0, import_prettier.format)(content, { filepath: filePath, ...cfg });
-    if (validateOnly && formatted !== content) {
-      hasFailure = true;
-      console.error(`File ${filePath} is not formatted correctly`);
-    } else {
-      await import_fs6.promises.writeFile(filePath, formatted);
-    }
-  }
-  return hasFailure;
-}
-
-// src/cli/format/index.ts
-function format_default(program2) {
-  program2.command("format").description("Lint and format this Pepr module").option("-v, --validate-only", "Do not modify files, only validate formatting.").action(async (opts) => {
-    const success = await peprFormat(opts.validateOnly);
-    if (success) {
-      logger_default.info("Module formatted");
-    } else {
-      process.exit(1);
-    }
-  });
-}
-async function peprFormat(validateOnly) {
-  {
-    try {
-      const eslint2 = new import_eslint.ESLint();
-      const results = await eslint2.lintFiles(["./**/*.ts"]);
-      let hasFailure = false;
-      results.forEach(async (result) => {
-        const errorCount = result.fatalErrorCount + result.errorCount;
-        if (errorCount > 0) {
-          hasFailure = true;
-        }
-      });
-      const formatter = await eslint2.loadFormatter("stylish");
-      const resultText = await formatter.format(results, {});
-      if (resultText) {
-        logger_default.info(resultText);
-      }
-      if (!validateOnly) {
-        await import_eslint.ESLint.outputFixes(results);
-      }
-      hasFailure = hasFailure || await formatWithPrettier(results, validateOnly);
-      return !hasFailure;
-    } catch (error) {
-      logger_default.error(error, `Error formatting module:`);
-      return false;
-    }
-  }
-}
-
-// src/lib/included-files.ts
-var import_fs7 = require("fs");
-async function createDockerfile(version3, description, includedFiles) {
-  const file = `
-    # Use an official Node.js runtime as the base image
-    FROM ghcr.io/defenseunicorns/pepr/controller:v${version3}
-  
-    LABEL description="${description}"
-    
-    # Add the included files to the image
-    ${includedFiles.map((f) => `ADD ${f} ${f}`).join("\n")}
-  
-    `;
-  await import_fs7.promises.writeFile("Dockerfile.controller", file, { encoding: "utf-8" });
-}
-
-// src/cli/build.helpers.ts
-var import_child_process2 = require("child_process");
-var import_esbuild = require("esbuild");
-var import_path3 = require("path");
-var import_fs9 = require("fs");
-
-// src/lib/assets/yaml/generateAllYaml.ts
-var import_crypto2 = __toESM(require("crypto"));
-var import_client_node4 = require("@kubernetes/client-node");
-
-// src/lib/assets/k8sObjects.ts
-var import_zlib = require("zlib");
-function getNamespace(namespaceLabels) {
-  if (namespaceLabels) {
-    return {
-      apiVersion: "v1",
-      kind: "Namespace",
-      metadata: {
-        name: "pepr-system",
-        labels: namespaceLabels ?? {}
-      }
-    };
-  } else {
-    return {
-      apiVersion: "v1",
-      kind: "Namespace",
-      metadata: {
-        name: "pepr-system"
-      }
-    };
-  }
-}
-function getWatcher(assets, hash, buildTimestamp, imagePullSecret) {
-  const { name: name2, image, config } = assets;
-  if (!isWatcher(assets.capabilities)) {
-    return null;
-  }
-  const app = `${name2}-watcher`;
-  const deploy = {
-    apiVersion: "apps/v1",
-    kind: "Deployment",
-    metadata: {
-      name: app,
-      namespace: "pepr-system",
-      annotations: {
-        "pepr.dev/description": config.description || ""
-      },
-      labels: {
-        app,
-        "pepr.dev/controller": "watcher",
-        "pepr.dev/uuid": config.uuid
+        app,
+        "pepr.dev/controller": "watcher",
+        "pepr.dev/uuid": config.uuid
       }
     },
     spec: {
@@ -9406,472 +8955,836 @@ function getDeployment(assets, hash, buildTimestamp, imagePullSecret) {
       }
     }
   };
-  if (imagePullSecret) {
-    deploy.spec.template.spec.imagePullSecrets = [{ name: imagePullSecret }];
+  if (imagePullSecret) {
+    deploy.spec.template.spec.imagePullSecrets = [{ name: imagePullSecret }];
+  }
+  return deploy;
+}
+function getModuleSecret(name2, data, hash) {
+  const compressed = (0, import_zlib.gzipSync)(data);
+  const path4 = `module-${hash}.js.gz`;
+  const compressedData = compressed.toString("base64");
+  if (secretOverLimit(compressedData)) {
+    const error = new Error(`Module secret for ${name2} is over the 1MB limit`);
+    throw error;
+  } else {
+    return {
+      apiVersion: "v1",
+      kind: "Secret",
+      metadata: {
+        name: `${name2}-module`,
+        namespace: "pepr-system"
+      },
+      type: "Opaque",
+      data: {
+        [path4]: compressed.toString("base64")
+      }
+    };
+  }
+}
+function service(name2, assets) {
+  if (!isAdmission(assets.capabilities) && !norWatchOrAdmission(assets.capabilities)) {
+    return null;
+  }
+  return {
+    apiVersion: "v1",
+    kind: "Service",
+    metadata: {
+      name: name2,
+      namespace: "pepr-system",
+      labels: {
+        "pepr.dev/controller": "admission"
+      }
+    },
+    spec: {
+      selector: {
+        app: name2,
+        "pepr.dev/controller": "admission"
+      },
+      ports: [
+        {
+          port: 443,
+          targetPort: 3e3
+        }
+      ]
+    }
+  };
+}
+function watcherService(name2, assets) {
+  if (!isWatcher(assets.capabilities)) {
+    return null;
+  }
+  return {
+    apiVersion: "v1",
+    kind: "Service",
+    metadata: {
+      name: `${name2}-watcher`,
+      namespace: "pepr-system",
+      labels: {
+        "pepr.dev/controller": "watcher"
+      }
+    },
+    spec: {
+      selector: {
+        app: `${name2}-watcher`,
+        "pepr.dev/controller": "watcher"
+      },
+      ports: [
+        {
+          port: 443,
+          targetPort: 3e3
+        }
+      ]
+    }
+  };
+}
+
+// src/lib/assets/yaml/generateAllYaml.ts
+var import_fs5 = require("fs");
+
+// src/lib/assets/webhooks.ts
+var import_ramda = require("ramda");
+var peprIgnoreNamespaces = ["kube-system", "pepr-system"];
+var validateRule = (binding, isMutateWebhook) => {
+  const { event, kind: kind8, isMutate, isValidate } = binding;
+  if (isMutateWebhook && !isMutate || !isMutateWebhook && !isValidate) {
+    return void 0;
+  }
+  const operations = event === "CREATEORUPDATE" /* CREATE_OR_UPDATE */ ? ["CREATE" /* CREATE */, "UPDATE" /* UPDATE */] : [event];
+  const resource = kind8.plural || `${kind8.kind.toLowerCase()}s`;
+  const ruleObject = {
+    apiGroups: [kind8.group],
+    apiVersions: [kind8.version || "*"],
+    operations,
+    resources: [resource, ...resource === "pods" ? ["pods/ephemeralcontainers"] : []]
+  };
+  return ruleObject;
+};
+async function generateWebhookRules(assets, isMutateWebhook) {
+  const { config, capabilities } = assets;
+  const rules = capabilities.flatMap((capability) => {
+    logger_default.info(`Module ${config.uuid} has capability: ${capability.name}`);
+    return capability.bindings.map((binding) => validateRule(binding, isMutateWebhook)).filter((rule) => !!rule);
+  });
+  return (0, import_ramda.uniqWith)(import_ramda.equals, rules);
+}
+async function webhookConfigGenerator(assets, mutateOrValidate, timeoutSeconds = 10) {
+  const ignore = [];
+  const { name: name2, tls, config, apiPath, host } = assets;
+  const ignoreNS = (0, import_ramda.concat)(
+    peprIgnoreNamespaces,
+    resolveIgnoreNamespaces(
+      config?.alwaysIgnore?.namespaces?.length ? config?.alwaysIgnore?.namespaces : config?.admission?.alwaysIgnore?.namespaces
+    )
+  );
+  if (ignoreNS) {
+    ignore.push({
+      key: "kubernetes.io/metadata.name",
+      operator: "NotIn",
+      values: ignoreNS
+    });
+  }
+  const clientConfig = {
+    caBundle: tls.ca
+  };
+  const fullApiPath = `/${mutateOrValidate}/${apiPath}`;
+  if (host) {
+    clientConfig.url = `https://${host}:3000${fullApiPath}`;
+  } else {
+    clientConfig.service = {
+      name: name2,
+      namespace: "pepr-system",
+      path: fullApiPath
+    };
+  }
+  const isMutate = mutateOrValidate === "mutate" /* MUTATE */;
+  const rules = await generateWebhookRules(assets, isMutate);
+  if (rules.length < 1) {
+    return null;
+  }
+  return {
+    apiVersion: "admissionregistration.k8s.io/v1",
+    kind: isMutate ? "MutatingWebhookConfiguration" : "ValidatingWebhookConfiguration",
+    metadata: { name: name2 },
+    webhooks: [
+      {
+        name: `${name2}.pepr.dev`,
+        admissionReviewVersions: ["v1", "v1beta1"],
+        clientConfig,
+        failurePolicy: config.onError === "reject" ? "Fail" : "Ignore",
+        matchPolicy: "Equivalent",
+        timeoutSeconds,
+        namespaceSelector: {
+          matchExpressions: ignore
+        },
+        rules,
+        // @todo: track side effects state
+        sideEffects: "None"
+      }
+    ]
+  };
+}
+
+// src/lib/assets/yaml/generateAllYaml.ts
+function pushControllerManifests(resources, deployments, services) {
+  if (deployments.watch) {
+    resources.push(deployments.watch);
+  }
+  if (deployments.admission) {
+    resources.push(deployments.admission);
+  }
+  if (services.admission) {
+    resources.push(services.admission);
+  }
+  if (services.watch) {
+    resources.push(services.watch);
+  }
+  return resources;
+}
+async function generateAllYaml(assets, deployments, services) {
+  const { name: name2, tls, apiPath, path: path4, config } = assets;
+  const code = await import_fs5.promises.readFile(path4);
+  const hash = import_crypto2.default.createHash("sha256").update(code).digest("hex");
+  let resources = [
+    getNamespace(assets.config.customLabels?.namespace),
+    clusterRole(name2, assets.capabilities, config.rbacMode, config.rbac),
+    clusterRoleBinding(name2),
+    serviceAccount(name2),
+    apiPathSecret(name2, apiPath),
+    tlsSecret(name2, tls),
+    getModuleSecret(name2, code, hash),
+    storeRole(name2),
+    storeRoleBinding(name2)
+  ];
+  resources = pushControllerManifests(resources, deployments, services);
+  const webhooks = {
+    mutate: await webhookConfigGenerator(assets, "mutate" /* MUTATE */, assets.config.webhookTimeout),
+    validate: await webhookConfigGenerator(
+      assets,
+      "validate" /* VALIDATE */,
+      assets.config.webhookTimeout
+    )
+  };
+  const additionalResources = [webhooks.mutate, webhooks.validate].filter(
+    (resource) => resource !== null && resource !== void 0
+  );
+  resources.push(...additionalResources);
+  return resources.map((resource) => (0, import_client_node3.dumpYaml)(resource, { noRefs: true })).join("---\n");
+}
+
+// src/lib/assets/yaml/generateZarfYaml.ts
+var import_client_node4 = require("@kubernetes/client-node");
+function generateZarfYamlGeneric(assets, path4, type) {
+  const zarfComponentName = process.env.PEPR_CUSTOM_BUILD_NAME ?? "module";
+  const manifestSettings = {
+    name: zarfComponentName,
+    namespace: "pepr-system",
+    files: [path4]
+  };
+  const chartSettings = {
+    name: zarfComponentName,
+    namespace: "pepr-system",
+    version: `${assets.config.appVersion || "0.0.1"}`,
+    localPath: path4
+  };
+  const component = {
+    name: zarfComponentName,
+    required: true,
+    images: [assets.image],
+    [type]: [type === "manifests" ? manifestSettings : chartSettings]
+  };
+  const zarfCfg = {
+    kind: "ZarfPackageConfig",
+    metadata: {
+      name: assets.name,
+      description: `Pepr Module: ${assets.config.description}`,
+      url: "https://github.com/defenseunicorns/pepr",
+      version: `${assets.config.appVersion || "0.0.1"}`
+    },
+    components: [component]
+  };
+  return (0, import_client_node4.dumpYaml)(zarfCfg, { noRefs: true });
+}
+
+// src/cli/build/build.helpers.ts
+function assignImage(imageOptions) {
+  const { customImage, registryInfo, peprVersion, registry } = imageOptions;
+  if (customImage) {
+    return customImage;
   }
-  return deploy;
+  if (registryInfo) {
+    return `${registryInfo}/custom-pepr-controller:${peprVersion}`;
+  }
+  if (registry) {
+    return checkIronBankImage(registry, "", peprVersion);
+  }
+  return "";
 }
-function getModuleSecret(name2, data, hash) {
-  const compressed = (0, import_zlib.gzipSync)(data);
-  const path4 = `module-${hash}.js.gz`;
-  const compressedData = compressed.toString("base64");
-  if (secretOverLimit(compressedData)) {
-    const error = new Error(`Module secret for ${name2} is over the 1MB limit`);
-    throw error;
+function determineRbacMode(opts, cfg) {
+  if (opts.rbacMode) {
+    return opts.rbacMode;
+  }
+  if (cfg.pepr.rbacMode && cfg.pepr.rbacMode !== "scoped") {
+    return "admin";
+  }
+  return cfg.pepr.rbacMode || "admin";
+}
+async function createOutputDirectory(outputDir) {
+  try {
+    const dir = outputDir === "" ? "dist" : outputDir;
+    await createDirectoryIfNotExists(dir);
+    return dir;
+  } catch (error) {
+    console.error(`Error creating output directory: ${error.message}`);
+    process.exit(1);
+  }
+}
+function checkIronBankImage(registry, image, peprVersion) {
+  return registry === "Iron Bank" ? `registry1.dso.mil/ironbank/opensource/defenseunicorns/pepr/controller:v${peprVersion}` : image;
+}
+function validImagePullSecret(imagePullSecretName) {
+  if (imagePullSecretName) {
+    const error = "Invalid imagePullSecret. Please provide a valid name as defined in RFC 1123.";
+    if (sanitizeResourceName(imagePullSecretName) !== imagePullSecretName) {
+      console.error(error);
+      process.exit(1);
+    }
+  }
+}
+async function handleCustomImageBuild(includedFiles, peprVersion, description, image) {
+  if (includedFiles.length > 0) {
+    await createDockerfile(peprVersion, description, includedFiles);
+    (0, import_child_process2.execSync)(`docker build --tag ${image} -f Dockerfile.controller .`, {
+      stdio: "inherit"
+    });
+    (0, import_child_process2.execSync)(`docker push ${image}`, { stdio: "inherit" });
+  }
+}
+function handleValidCapabilityNames(capabilities) {
+  try {
+    validateCapabilityNames(capabilities);
+  } catch (e) {
+    console.error(`Error loading capability:`, e);
+    process.exit(1);
+  }
+}
+async function watchForChanges(ctxCfg, reloader) {
+  const ctx = await (0, import_esbuild.context)(ctxCfg);
+  if (reloader) {
+    await ctx.watch();
   } else {
-    return {
-      apiVersion: "v1",
-      kind: "Secret",
-      metadata: {
-        name: `${name2}-module`,
-        namespace: "pepr-system"
+    await ctx.rebuild();
+    await ctx.dispose();
+  }
+  return ctx;
+}
+async function generateYamlAndWriteToDisk(obj) {
+  const { uuid, imagePullSecret, outputDir, assets, zarf } = obj;
+  const yamlFile = `pepr-module-${uuid}.yaml`;
+  const chartPath = `${uuid}-chart`;
+  const yamlPath = (0, import_path2.resolve)(outputDir, yamlFile);
+  try {
+    const yaml = await assets.allYaml(
+      generateAllYaml,
+      {
+        getDeploymentFunction: getDeployment,
+        getWatcherFunction: getWatcher,
+        getServiceFunction: service,
+        getWatcherServiceFunction: watcherService
       },
-      type: "Opaque",
-      data: {
-        [path4]: compressed.toString("base64")
-      }
-    };
+      imagePullSecret
+    );
+    const zarfPath = (0, import_path2.resolve)(outputDir, "zarf.yaml");
+    let localZarf = "";
+    if (zarf === "chart") {
+      localZarf = assets.zarfYamlChart(generateZarfYamlGeneric, chartPath);
+    } else {
+      localZarf = assets.zarfYaml(generateZarfYamlGeneric, yamlFile);
+    }
+    await import_fs6.promises.writeFile(yamlPath, yaml);
+    await import_fs6.promises.writeFile(zarfPath, localZarf);
+    await assets.generateHelmChart(webhookConfigGenerator, getWatcher, getModuleSecret, outputDir);
+    console.info(`K8s resource for the module saved to ${yamlPath}`);
+  } catch (error) {
+    console.error(`Error generating YAML: ${error}`);
+    process.exit(1);
   }
 }
-function service(name2, assets) {
-  if (!isAdmission(assets.capabilities) && !norWatchOrAdmission(assets.capabilities)) {
-    return null;
+
+// src/cli/build/buildModule.ts
+var import_child_process3 = require("child_process");
+var import_esbuild2 = require("esbuild");
+var import_path4 = require("path");
+
+// src/cli/init/templates.ts
+var import_client_node5 = require("@kubernetes/client-node");
+var import_util = require("util");
+var import_uuid = require("uuid");
+var import_fs8 = require("fs");
+var import_path3 = __toESM(require("path"));
+
+// src/templates/pepr.code-snippets.json
+var pepr_code_snippets_default = {
+  "Create a new Pepr capability": {
+    prefix: "create pepr capability",
+    body: [
+      "import { Capability, a } from 'pepr';",
+      "",
+      "export const ${TM_FILENAME_BASE/(.*)/${1:/pascalcase}/} = new Capability({",
+      "	name: '${TM_FILENAME_BASE}',",
+      "	description: '${1:A brief description of this capability.}',",
+      "	namespaces: [${2:}],",
+      "});",
+      "",
+      "// Use the 'When' function to create a new action",
+      "const { When } = ${TM_FILENAME_BASE/(.*)/${1:/pascalcase}/};",
+      "",
+      "// When(a.<Kind>).Is<Event>().Then(change => change.<changes>",
+      "When(${3:})"
+    ],
+    description: "Creates a new Pepr capability with a specified description, optional namespaces, and adds a When statement for the specified value."
   }
-  return {
+};
+
+// src/templates/.prettierrc.json
+var prettierrc_default = {
+  arrowParens: "avoid",
+  bracketSameLine: false,
+  bracketSpacing: true,
+  embeddedLanguageFormatting: "auto",
+  insertPragma: false,
+  printWidth: 100,
+  quoteProps: "as-needed",
+  requirePragma: false,
+  semi: true,
+  tabWidth: 2,
+  useTabs: false,
+  vueIndentScriptAndStyle: false
+};
+
+// src/templates/capabilities/hello-pepr.samples.json
+var hello_pepr_samples_default = [
+  {
+    apiVersion: "v1",
+    kind: "Namespace",
+    metadata: {
+      name: "pepr-demo",
+      labels: {
+        "keep-me": "please",
+        "remove-me": "please"
+      }
+    }
+  },
+  {
+    apiVersion: "v1",
+    kind: "Namespace",
+    metadata: {
+      name: "pepr-demo-2"
+    }
+  },
+  {
+    apiVersion: "v1",
+    kind: "Secret",
+    metadata: {
+      name: "secret-1",
+      namespace: "pepr-demo"
+    },
+    data: {
+      example: "dW5pY29ybiBtYWdpYw==",
+      "binary-data": "iCZQUg8xYucNUqD+8lyl2YcKjYYygvTtiDSEV9b9WKUkxSSLFJTgIWMJ9GcFFYs4T9JCdda51u74jfq8yHzRuEASl60EdTS/NfWgIIFTGqcNRfqMw+vgpyTMmCyJVaJEDFq6AA==",
+      "ascii-with-white-space": "VGhpcyBpcyBzb21lIHJhbmRvbSB0ZXh0OgoKICAgIC0gd2l0aCBsaW5lIGJyZWFrcwogICAgLSBhbmQgdGFicw=="
+    }
+  },
+  {
+    apiVersion: "v1",
+    kind: "ConfigMap",
+    metadata: {
+      name: "example-1",
+      namespace: "pepr-demo"
+    },
+    data: {
+      key: "ex-1-val"
+    }
+  },
+  {
+    apiVersion: "v1",
+    kind: "ConfigMap",
+    metadata: {
+      name: "example-2",
+      namespace: "pepr-demo"
+    },
+    data: {
+      key: "ex-2-val"
+    }
+  },
+  {
+    apiVersion: "v1",
+    kind: "ConfigMap",
+    metadata: {
+      name: "example-evil-cm",
+      namespace: "pepr-demo",
+      annotations: {
+        evil: "true"
+      }
+    },
+    data: {
+      key: "ex-evil-cm-val"
+    }
+  },
+  {
     apiVersion: "v1",
-    kind: "Service",
+    kind: "ConfigMap",
     metadata: {
-      name: name2,
-      namespace: "pepr-system",
+      name: "example-3",
+      namespace: "pepr-demo",
       labels: {
-        "pepr.dev/controller": "admission"
+        change: "by-label"
       }
     },
-    spec: {
-      selector: {
-        app: name2,
-        "pepr.dev/controller": "admission"
-      },
-      ports: [
-        {
-          port: 443,
-          targetPort: 3e3
-        }
-      ]
+    data: {
+      key: "ex-3-val"
     }
-  };
-}
-function watcherService(name2, assets) {
-  if (!isWatcher(assets.capabilities)) {
-    return null;
-  }
-  return {
+  },
+  {
     apiVersion: "v1",
-    kind: "Service",
+    kind: "ConfigMap",
     metadata: {
-      name: `${name2}-watcher`,
-      namespace: "pepr-system",
+      name: "example-4",
+      namespace: "pepr-demo"
+    },
+    data: {
+      key: "ex-4-val"
+    }
+  },
+  {
+    apiVersion: "v1",
+    kind: "ConfigMap",
+    metadata: {
+      name: "example-4a",
+      namespace: "pepr-demo-2"
+    },
+    data: {
+      key: "ex-4-val"
+    }
+  },
+  {
+    apiVersion: "v1",
+    kind: "ConfigMap",
+    metadata: {
+      name: "example-5",
+      namespace: "pepr-demo",
       labels: {
-        "pepr.dev/controller": "watcher"
+        "chuck-norris": "test"
       }
     },
-    spec: {
-      selector: {
-        app: `${name2}-watcher`,
-        "pepr.dev/controller": "watcher"
-      },
-      ports: [
-        {
-          port: 443,
-          targetPort: 3e3
-        }
-      ]
+    data: {
+      key: "ex-5-val"
     }
-  };
-}
-
-// src/lib/assets/yaml/generateAllYaml.ts
-var import_fs8 = require("fs");
-
-// src/lib/assets/webhooks.ts
-var import_ramda = require("ramda");
-var peprIgnoreNamespaces = ["kube-system", "pepr-system"];
-var validateRule = (binding, isMutateWebhook) => {
-  const { event, kind: kind8, isMutate, isValidate } = binding;
-  if (isMutateWebhook && !isMutate || !isMutateWebhook && !isValidate) {
-    return void 0;
-  }
-  const operations = event === "CREATEORUPDATE" /* CREATE_OR_UPDATE */ ? ["CREATE" /* CREATE */, "UPDATE" /* UPDATE */] : [event];
-  const resource = kind8.plural || `${kind8.kind.toLowerCase()}s`;
-  const ruleObject = {
-    apiGroups: [kind8.group],
-    apiVersions: [kind8.version || "*"],
-    operations,
-    resources: [resource, ...resource === "pods" ? ["pods/ephemeralcontainers"] : []]
-  };
-  return ruleObject;
-};
-async function generateWebhookRules(assets, isMutateWebhook) {
-  const { config, capabilities } = assets;
-  const rules = capabilities.flatMap((capability) => {
-    logger_default.info(`Module ${config.uuid} has capability: ${capability.name}`);
-    return capability.bindings.map((binding) => validateRule(binding, isMutateWebhook)).filter((rule) => !!rule);
-  });
-  return (0, import_ramda.uniqWith)(import_ramda.equals, rules);
-}
-async function webhookConfigGenerator(assets, mutateOrValidate, timeoutSeconds = 10) {
-  const ignore = [];
-  const { name: name2, tls, config, apiPath, host } = assets;
-  const ignoreNS = (0, import_ramda.concat)(
-    peprIgnoreNamespaces,
-    resolveIgnoreNamespaces(
-      config?.alwaysIgnore?.namespaces?.length ? config?.alwaysIgnore?.namespaces : config?.admission?.alwaysIgnore?.namespaces
-    )
-  );
-  if (ignoreNS) {
-    ignore.push({
-      key: "kubernetes.io/metadata.name",
-      operator: "NotIn",
-      values: ignoreNS
-    });
-  }
-  const clientConfig = {
-    caBundle: tls.ca
-  };
-  const fullApiPath = `/${mutateOrValidate}/${apiPath}`;
-  if (host) {
-    clientConfig.url = `https://${host}:3000${fullApiPath}`;
-  } else {
-    clientConfig.service = {
-      name: name2,
-      namespace: "pepr-system",
-      path: fullApiPath
-    };
-  }
-  const isMutate = mutateOrValidate === "mutate" /* MUTATE */;
-  const rules = await generateWebhookRules(assets, isMutate);
-  if (rules.length < 1) {
-    return null;
-  }
-  return {
-    apiVersion: "admissionregistration.k8s.io/v1",
-    kind: isMutate ? "MutatingWebhookConfiguration" : "ValidatingWebhookConfiguration",
-    metadata: { name: name2 },
-    webhooks: [
-      {
-        name: `${name2}.pepr.dev`,
-        admissionReviewVersions: ["v1", "v1beta1"],
-        clientConfig,
-        failurePolicy: config.onError === "reject" ? "Fail" : "Ignore",
-        matchPolicy: "Equivalent",
-        timeoutSeconds,
-        namespaceSelector: {
-          matchExpressions: ignore
-        },
-        rules,
-        // @todo: track side effects state
-        sideEffects: "None"
-      }
-    ]
-  };
-}
-
-// src/lib/assets/yaml/generateAllYaml.ts
-function pushControllerManifests(resources, deployments, services) {
-  if (deployments.watch) {
-    resources.push(deployments.watch);
-  }
-  if (deployments.admission) {
-    resources.push(deployments.admission);
-  }
-  if (services.admission) {
-    resources.push(services.admission);
-  }
-  if (services.watch) {
-    resources.push(services.watch);
-  }
-  return resources;
-}
-async function generateAllYaml(assets, deployments, services) {
-  const { name: name2, tls, apiPath, path: path4, config } = assets;
-  const code = await import_fs8.promises.readFile(path4);
-  const hash = import_crypto2.default.createHash("sha256").update(code).digest("hex");
-  let resources = [
-    getNamespace(assets.config.customLabels?.namespace),
-    clusterRole(name2, assets.capabilities, config.rbacMode, config.rbac),
-    clusterRoleBinding(name2),
-    serviceAccount(name2),
-    apiPathSecret(name2, apiPath),
-    tlsSecret(name2, tls),
-    getModuleSecret(name2, code, hash),
-    storeRole(name2),
-    storeRoleBinding(name2)
-  ];
-  resources = pushControllerManifests(resources, deployments, services);
-  const webhooks = {
-    mutate: await webhookConfigGenerator(assets, "mutate" /* MUTATE */, assets.config.webhookTimeout),
-    validate: await webhookConfigGenerator(
-      assets,
-      "validate" /* VALIDATE */,
-      assets.config.webhookTimeout
-    )
-  };
-  const additionalResources = [webhooks.mutate, webhooks.validate].filter(
-    (resource) => resource !== null && resource !== void 0
-  );
-  resources.push(...additionalResources);
-  return resources.map((resource) => (0, import_client_node4.dumpYaml)(resource, { noRefs: true })).join("---\n");
-}
-
-// src/lib/assets/yaml/generateZarfYaml.ts
-var import_client_node5 = require("@kubernetes/client-node");
-function generateZarfYamlGeneric(assets, path4, type) {
-  const zarfComponentName = process.env.PEPR_CUSTOM_BUILD_NAME ?? "module";
-  const manifestSettings = {
-    name: zarfComponentName,
-    namespace: "pepr-system",
-    files: [path4]
-  };
-  const chartSettings = {
-    name: zarfComponentName,
-    namespace: "pepr-system",
-    version: `${assets.config.appVersion || "0.0.1"}`,
-    localPath: path4
-  };
-  const component = {
-    name: zarfComponentName,
-    required: true,
-    images: [assets.image],
-    [type]: [type === "manifests" ? manifestSettings : chartSettings]
-  };
-  const zarfCfg = {
-    kind: "ZarfPackageConfig",
+  },
+  {
+    apiVersion: "apiextensions.k8s.io/v1",
+    kind: "CustomResourceDefinition",
     metadata: {
-      name: assets.name,
-      description: `Pepr Module: ${assets.config.description}`,
-      url: "https://github.com/defenseunicorns/pepr",
-      version: `${assets.config.appVersion || "0.0.1"}`
+      name: "unicorns.pepr.dev"
     },
-    components: [component]
-  };
-  return (0, import_client_node5.dumpYaml)(zarfCfg, { noRefs: true });
-}
-
-// src/cli/build.helpers.ts
-function assignImage(imageOptions) {
-  const { customImage, registryInfo, peprVersion, registry } = imageOptions;
-  if (customImage) {
-    return customImage;
-  }
-  if (registryInfo) {
-    return `${registryInfo}/custom-pepr-controller:${peprVersion}`;
-  }
-  if (registry) {
-    return checkIronBankImage(registry, "", peprVersion);
+    spec: {
+      group: "pepr.dev",
+      versions: [
+        {
+          name: "v1",
+          served: true,
+          storage: true,
+          schema: {
+            openAPIV3Schema: {
+              type: "object",
+              properties: {
+                spec: {
+                  type: "object",
+                  properties: {
+                    message: {
+                      type: "string"
+                    },
+                    counter: {
+                      type: "number"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      ],
+      scope: "Namespaced",
+      names: {
+        plural: "unicorns",
+        singular: "unicorn",
+        kind: "Unicorn"
+      }
+    }
   }
-  return "";
-}
-function determineRbacMode(opts, cfg) {
-  if (opts.rbacMode) {
-    return opts.rbacMode;
+];
+
+// src/templates/settings.json
+var settings_default = {
+  "debug.javascript.terminalOptions": {
+    enableTurboSourcemaps: true,
+    resolveSourceMapLocations: [
+      "${workspaceFolder}/**",
+      "node_modules/kubernetes-fluent-client/**",
+      "node_modules/pepr/**"
+    ]
   }
-  if (cfg.pepr.rbacMode && cfg.pepr.rbacMode !== "scoped") {
-    return "admin";
+};
+
+// src/templates/tsconfig.module.json
+var tsconfig_module_default = {
+  compilerOptions: {
+    allowSyntheticDefaultImports: true,
+    declaration: true,
+    declarationMap: true,
+    emitDeclarationOnly: true,
+    esModuleInterop: true,
+    lib: ["ES2022"],
+    module: "NodeNext",
+    moduleResolution: "NodeNext",
+    outDir: "dist",
+    resolveJsonModule: true,
+    rootDir: ".",
+    strict: false,
+    target: "ES2022",
+    useUnknownInCatchVariables: false
+  },
+  include: ["**/*.ts"]
+};
+
+// src/templates/data.json
+var gitIgnore = "# Ignore node_modules and Pepr build artifacts\nnode_modules\ndist\ninsecure*\n";
+var readmeMd = '# Pepr Module\n\nThis is a Pepr Module. [Pepr](https://github.com/defenseunicorns/pepr) is a type-safe Kubernetes middleware system.\n\nThe `capabilities` directory contains all the capabilities for this module. By default,\na capability is a single typescript file in the format of `capability-name.ts` that is\nimported in the root `pepr.ts` file as `import { HelloPepr } from "./capabilities/hello-pepr";`.\nBecause this is typescript, you can organize this however you choose, e.g. creating a sub-folder\nper-capability or common logic in shared files or folders.\n\nExample Structure:\n\n```text\nModule Root\n\u251C\u2500\u2500 package.json\n\u251C\u2500\u2500 pepr.ts\n\u2514\u2500\u2500 capabilities\n    \u251C\u2500\u2500 example-one.ts\n    \u251C\u2500\u2500 example-three.ts\n    \u2514\u2500\u2500 example-two.ts\n```\n';
+var peprTS = 'import { PeprModule } from "pepr";\n// cfg loads your pepr configuration from package.json\nimport cfg from "./package.json";\n\n// HelloPepr is a demo capability that is included with Pepr. Comment or delete the line below to remove it.\nimport { HelloPepr } from "./capabilities/hello-pepr";\n\n/**\n * This is the main entrypoint for this Pepr module. It is run when the module is started.\n * This is where you register your Pepr configurations and capabilities.\n */\nnew PeprModule(cfg, [\n  // "HelloPepr" is a demo capability that is included with Pepr. Comment or delete the line below to remove it.\n  HelloPepr,\n\n  // Your additional capabilities go here\n]);\n';
+var helloPeprTS = 'import {\n  Capability,\n  K8s,\n  Log,\n  PeprMutateRequest,\n  RegisterKind,\n  a,\n  fetch,\n  fetchStatus,\n  kind,\n} from "pepr";\nimport { MockAgent, setGlobalDispatcher } from "undici";\n\n/**\n *  The HelloPepr Capability is an example capability to demonstrate some general concepts of Pepr.\n *  To test this capability you run `pepr dev`and then run the following command:\n *  `kubectl apply -f capabilities/hello-pepr.samples.yaml`\n */\nexport const HelloPepr = new Capability({\n  name: "hello-pepr",\n  description: "A simple example capability to show how things work.",\n  namespaces: ["pepr-demo", "pepr-demo-2"],\n});\n\n// Use the \'When\' function to create a new action, use \'Store\' to persist data\nconst { When, Store } = HelloPepr;\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Namespace)                                   *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action removes the label `remove-me` when a Namespace is created.\n * Note we don\'t need to specify the namespace here, because we\'ve already specified\n * it in the Capability definition above.\n */\nWhen(a.Namespace)\n  .IsCreated()\n  .Mutate(ns => ns.RemoveLabel("remove-me"));\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Watch Action with K8s SSA (Namespace)                           *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action watches for the `pepr-demo-2` namespace to be created, then creates a ConfigMap with\n * the name `pepr-ssa-demo` and adds the namespace UID to the ConfigMap data. Because Pepr uses\n * server-side apply for this operation, the ConfigMap will be created or updated if it already exists.\n */\nWhen(a.Namespace)\n  .IsCreated()\n  .WithName("pepr-demo-2")\n  .Watch(async ns => {\n    Log.info("Namespace pepr-demo-2 was created.");\n\n    try {\n      // Apply the ConfigMap using K8s server-side apply\n      await K8s(kind.ConfigMap).Apply({\n        metadata: {\n          name: "pepr-ssa-demo",\n          namespace: "pepr-demo-2",\n        },\n        data: {\n          "ns-uid": ns.metadata.uid,\n        },\n      });\n    } catch (error) {\n      // You can use the Log object to log messages to the Pepr controller pod\n      Log.error(error, "Failed to apply ConfigMap using server-side apply.");\n    }\n\n    // You can share data between actions using the Store, including between different types of actions\n    Store.setItem("watch-data", "This data was stored by a Watch Action.");\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 1)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This is a single action. They can be in the same file or put imported from other files.\n * In this example, when a ConfigMap is created with the name `example-1`, then add a label and annotation.\n *\n * Equivalent to manually running:\n * `kubectl label configmap example-1 pepr=was-here`\n * `kubectl annotate configmap example-1 pepr.dev=annotations-work-too`\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-1")\n  .Mutate(request => {\n    request.SetLabel("pepr", "was-here").SetAnnotation("pepr.dev", "annotations-work-too");\n\n    // Use the Store to persist data between requests and Pepr controller pods\n    Store.setItem("example-1", "was-here");\n\n    // This data is written asynchronously and can be read back via `Store.getItem()` or `Store.subscribe()`\n    Store.setItem("example-1-data", JSON.stringify(request.Raw.data));\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate & Validate Actions (CM Example 2)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This combines 3 different types of actions: \'Mutate\', \'Validate\', and \'Watch\'. The order\n * of the actions is required, but each action is optional. In this example, when a ConfigMap is created\n * with the name `example-2`, then add a label and annotation, validate that the ConfigMap has the label\n * `pepr`, and log the request.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-2")\n  .Mutate(request => {\n    // This Mutate Action will mutate the request before it is persisted to the cluster\n\n    // Use `request.Merge()` to merge the new data with the existing data\n    request.Merge({\n      metadata: {\n        labels: {\n          pepr: "was-here",\n        },\n        annotations: {\n          "pepr.dev": "annotations-work-too",\n        },\n      },\n    });\n  })\n  .Validate(request => {\n    // This Validate Action will validate the request before it is persisted to the cluster\n\n    // Approve the request if the ConfigMap has the label \'pepr\'\n    if (request.HasLabel("pepr")) {\n      return request.Approve();\n    }\n\n    // Otherwise, deny the request with an error message (optional)\n    return request.Deny("ConfigMap must have label \'pepr\'");\n  })\n  .Watch((cm, phase) => {\n    // This Watch Action will watch the ConfigMap after it has been persisted to the cluster\n    Log.info(cm, `ConfigMap was ${phase} with the name example-2`);\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 2a)                               *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action shows a simple validation that will deny any ConfigMap that has the\n * annotation `evil`. Note that the `Deny()` function takes an optional second parameter that is a\n * user-defined status code to return.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .Validate(request => {\n    if (request.HasAnnotation("evil")) {\n      return request.Deny("No evil CM annotations allowed.", 400);\n    }\n\n    return request.Approve();\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 3)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action combines different styles. Unlike the previous actions, this one will look\n * for any ConfigMap in the `pepr-demo` namespace that has the label `change=by-label` during either\n * CREATE or UPDATE. Note that all conditions added such as `WithName()`, `WithLabel()`, `InNamespace()`,\n * are ANDs so all conditions must be true for the request to be processed.\n */\nWhen(a.ConfigMap)\n  .IsCreatedOrUpdated()\n  .WithLabel("change", "by-label")\n  .Mutate(request => {\n    // The K8s object e are going to mutate\n    const cm = request.Raw;\n\n    // Get the username and uid of the K8s request\n    const { username, uid } = request.Request.userInfo;\n\n    // Store some data about the request in the configmap\n    cm.data["username"] = username;\n    cm.data["uid"] = uid;\n\n    // You can still mix other ways of making changes too\n    request.SetAnnotation("pepr.dev", "making-waves");\n  });\n\n// This action validates the label `change=by-label` is deleted\nWhen(a.ConfigMap)\n  .IsDeleted()\n  .WithLabel("change", "by-label")\n  .Validate(request => {\n    // Log and then always approve the request\n    Log.info("CM with label \'change=by-label\' was deleted.");\n    return request.Approve();\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 4)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action show how you can use the `Mutate()` function without an inline function.\n * This is useful if you want to keep your actions small and focused on a single task,\n * or if you want to reuse the same function in multiple actions.\n */\nWhen(a.ConfigMap).IsCreated().WithName("example-4").Mutate(example4Cb);\n\n// This function uses the complete type definition, but is not required.\nfunction example4Cb(cm: PeprMutateRequest<a.ConfigMap>): void {\n  cm.SetLabel("pepr.dev/first", "true");\n  cm.SetLabel("pepr.dev/second", "true");\n  cm.SetLabel("pepr.dev/third", "true");\n}\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 4a)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This is the same as Example 4, except this only operates on a CM in the `pepr-demo-2` namespace.\n * Note because the Capability defines namespaces, the namespace specified here must be one of those.\n * Alternatively, you can remove the namespace from the Capability definition and specify it here.\n */\nWhen(a.ConfigMap).IsCreated().InNamespace("pepr-demo-2").WithName("example-4a").Mutate(example4Cb);\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 5)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action is a bit more complex. It will look for any ConfigMap in the `pepr-demo`\n * namespace that has the label `chuck-norris` during CREATE. When it finds one, it will fetch a\n * random Chuck Norris joke from the API and add it to the ConfigMap. This is a great example of how\n * you can use Pepr to make changes to your K8s objects based on external data.\n *\n * Note the use of the `async` keyword. This is required for any action that uses `await` or `fetch()`.\n *\n * Also note we are passing a type to the `fetch()` function. This is optional, but it will help you\n * avoid mistakes when working with the data returned from the API. You can also use the `as` keyword to\n * cast the data returned from the API.\n *\n * These are equivalent:\n * ```ts\n * const joke = await fetch<TheChuckNorrisJoke>("https://icanhazdadjoke.com/");\n * const joke = await fetch("https://icanhazdadjoke.com/") as TheChuckNorrisJoke;\n * ```\n *\n * Alternatively, you can drop the type completely:\n *\n * ```ts\n * fetch("https://icanhazdadjoke.com")\n * ```\n */\ninterface TheChuckNorrisJoke {\n  id: string;\n  joke: string;\n  status: number;\n}\n\nWhen(a.ConfigMap)\n  .IsCreatedOrUpdated()\n  .WithLabel("chuck-norris")\n  .Mutate(cm => cm.SetLabel("got-jokes", "true"))\n  .Watch(async cm => {\n    const jokeURL = "https://icanhazdadjoke.com";\n\n    const mockAgent: MockAgent = new MockAgent();\n    setGlobalDispatcher(mockAgent);\n    const mockClient = mockAgent.get(jokeURL);\n    mockClient.intercept({ path: "/", method: "GET" }).reply(\n      200,\n      {\n        id: "R7UfaahVfFd",\n        joke: "Funny joke goes here.",\n        status: 200,\n      },\n      {\n        headers: {\n          "Content-Type": "application/json; charset=utf-8",\n        },\n      },\n    );\n\n    // Try/catch is not needed as a response object will always be returned\n    const response = await fetch<TheChuckNorrisJoke>(jokeURL, {\n      headers: {\n        Accept: "application/json",\n      },\n    });\n\n    // Instead, check the `response.ok` field\n    if (response.ok) {\n      const { joke } = response.data;\n      // Add Joke to the Store\n      await Store.setItemAndWait(jokeURL, joke);\n      // Add the Chuck Norris joke to the configmap\n      try {\n        await K8s(kind.ConfigMap).Apply({\n          metadata: {\n            name: cm.metadata.name,\n            namespace: cm.metadata.namespace,\n          },\n          data: {\n            "chuck-says": Store.getItem(jokeURL),\n          },\n        });\n      } catch (error) {\n        Log.error(error, "Failed to apply ConfigMap using server-side apply.", {\n          cm,\n        });\n      }\n    }\n\n    // You can also assert on different HTTP response codes\n    if (response.status === fetchStatus.NOT_FOUND) {\n      // Do something else\n      return;\n    }\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Secret Base64 Handling)                      *\n * ---------------------------------------------------------------------------------------------------\n *\n * The K8s JS client provides incomplete support for base64 encoding/decoding handling for secrets,\n * unlike the GO client. To make this less painful, Pepr automatically handles base64 encoding/decoding\n * secret data before and after the action is executed.\n */\nWhen(a.Secret)\n  .IsCreated()\n  .WithName("secret-1")\n  .Mutate(request => {\n    const secret = request.Raw;\n\n    // This will be encoded at the end of all processing back to base64: "Y2hhbmdlLXdpdGhvdXQtZW5jb2Rpbmc="\n    secret.data.magic = "change-without-encoding";\n\n    // You can modify the data directly, and it will be encoded at the end of all processing\n    secret.data.example += " - modified by Pepr";\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Untyped Custom Resource)                     *\n * ---------------------------------------------------------------------------------------------------\n *\n * Out of the box, Pepr supports all the standard Kubernetes objects. However, you can also create\n * your own types. This is useful if you are working with an Operator that creates custom resources.\n * There are two ways to do this, the first is to use the `When()` function with a `GenericKind`,\n * the second is to create a new class that extends `GenericKind` and use the `RegisterKind()` function.\n *\n * This example shows how to use the `When()` function with a `GenericKind`. Note that you\n * must specify the `group`, `version`, and `kind` of the object (if applicable). This is how Pepr knows\n * if the action should be triggered or not. Since we are using a `GenericKind`,\n * Pepr will not be able to provide any intellisense for the object, so you will need to refer to the\n * Kubernetes API documentation for the object you are working with.\n *\n * You will need to wait for the CRD in `hello-pepr.samples.yaml` to be created, then you can apply\n *\n * ```yaml\n * apiVersion: pepr.dev/v1\n * kind: Unicorn\n * metadata:\n *   name: example-1\n *   namespace: pepr-demo\n * spec:\n *   message: replace-me\n *   counter: 0\n * ```\n */\nWhen(a.GenericKind, {\n  group: "pepr.dev",\n  version: "v1",\n  kind: "Unicorn",\n})\n  .IsCreated()\n  .WithName("example-1")\n  .Mutate(request => {\n    request.Merge({\n      spec: {\n        message: "Hello Pepr without type data!",\n        counter: Math.random(),\n      },\n    });\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Typed Custom Resource)                       *\n * ---------------------------------------------------------------------------------------------------\n *\n * This example shows how to use the `RegisterKind()` function to create a new type. This is useful\n * if you are working with an Operator that creates custom resources and you want to have intellisense\n * for the object. Note that you must specify the `group`, `version`, and `kind` of the object (if applicable)\n * as this is how Pepr knows if the action should be triggered or not.\n *\n * Once you register a new Kind with Pepr, you can use the `When()` function with the new Kind. Ideally,\n * you should register custom Kinds at the top of your Capability file or Pepr Module so they are available\n * to all actions, but we are putting it here for demonstration purposes.\n *\n * You will need to wait for the CRD in `hello-pepr.samples.yaml` to be created, then you can apply\n *\n * ```yaml\n * apiVersion: pepr.dev/v1\n * kind: Unicorn\n * metadata:\n *   name: example-2\n *   namespace: pepr-demo\n * spec:\n *   message: replace-me\n *   counter: 0\n * ```*\n */\nclass UnicornKind extends a.GenericKind {\n  spec: {\n    /**\n     * JSDoc comments can be added to explain more details about the field.\n     *\n     * @example\n     * ```ts\n     * request.Raw.spec.message = "Hello Pepr!";\n     * ```\n     * */\n    message: string;\n    counter: number;\n  };\n}\n\nRegisterKind(UnicornKind, {\n  group: "pepr.dev",\n  version: "v1",\n  kind: "Unicorn",\n});\n\nWhen(UnicornKind)\n  .IsCreated()\n  .WithName("example-2")\n  .Mutate(request => {\n    request.Merge({\n      spec: {\n        message: "Hello Pepr with type data!",\n        counter: Math.random(),\n      },\n    });\n  });\n\n/**\n * A callback function that is called once the Pepr Store is fully loaded.\n */\nStore.onReady(data => {\n  Log.info(data, "Pepr Store Ready");\n});\n';
+var packageJSON = { name: "pepr", description: "Kubernetes application engine", author: "Defense Unicorns", homepage: "https://github.com/defenseunicorns/pepr", license: "Apache-2.0", bin: "dist/cli.js", repository: "defenseunicorns/pepr", engines: { node: ">=18.0.0" }, files: ["/dist", "/src", "!src/**/*.test.ts", "!src/fixtures/**", "!dist/**/*.test.d.ts*"], version: "0.52.3", main: "dist/lib.js", types: "dist/lib.d.ts", scripts: { build: "tsc -p config/tsconfig.root.json && node build.mjs && npm pack", "build:image": "npm run build && docker buildx build --output type=docker --tag pepr:dev .", "build:image:unicorn": "npm run build && docker buildx build --output type=docker --tag pepr/private:dev $(node scripts/read-unicorn-build-args.mjs) .", ci: "npm ci", "format:check": "npm run format:src && npm run format:tests && npm run format:markdown && npm run format:integration && npm run format:prettier -- --check", "format:fix": "npm run format:src -- --fix && npm run format:markdown -- --fix && npm run format:integration -- --fix && npm run format:prettier -- --write", "format:integration": "eslint --config config/eslint.integration.config.mjs integration/cli integration/helpers", "format:markdown": 'npx -y markdownlint-cli --config config/.markdownlint.json --ignore adr --ignore integration/testroot --ignore pepr-test-module --ignore node_modules "**/*.md"', "format:prettier": "prettier --config config/.prettierrc src integration/cli/**/*.ts integration/helpers/**/*.ts", "format:src": "eslint --config config/eslint.root.config.mjs 'src/**/*.ts' --ignore-pattern '**/*.test.ts' --ignore-pattern 'src/templates/**'", "format:tests": "eslint --config config/eslint.test.config.mjs 'src/**/*.test.ts'", "gen-data-json": "node hack/build-template-data.js", prebuild: "rm -fr dist/* && npm run gen-data-json", prepare: `if [ "$NODE_ENV" != 'production' ]; then husky; fi`, "set:version": "node scripts/set-version.js", test: "npm run test:unit && npm run test:journey && npm run test:journey-wasm", "test:artifacts": "npm run build && vitest run src/build-artifact.test.ts", "test:docs": "vitest run --config=config/vitest.integration.config.ts integration/cli/docs/*.test.ts", "test:integration": "npm run test:integration:prep && npm run test:integration:run", "test:integration:prep": "./integration/prep.sh", "test:integration:run": "vitest run --config=config/vitest.integration.config.ts integration", "test:journey": "npm run test:journey:k3d && npm run build && npm run test:journey:image && npm run test:journey:run", "test:journey-wasm": "npm run test:journey:k3d && npm run build && npm run test:journey:image && npm run test:journey:run-wasm", "test:journey-wasm:unicorn": "npm run test:journey:k3d && npm run build && npm run test:journey:image:unicorn && npm run test:journey:run-wasm", "test:journey:image": "npm run build && docker buildx build --output type=docker --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev", "test:journey:image:unicorn": "npm run build && docker buildx build --output type=docker --tag pepr/private:dev $(node scripts/read-unicorn-build-args.mjs) . && k3d image import pepr/private:dev -c pepr-dev", "test:journey:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0' --wait && kubectl rollout status deployment -n kube-system", "test:journey:run": "vitest run --config=config/vitest.journey.config.ts journey/entrypoint.test.ts", "test:journey:run-wasm": "vitest run --config=config/vitest.journey.config.ts journey/entrypoint-wasm.test.ts", "test:journey:unicorn": "npm run test:journey:k3d && npm run test:journey:image:unicorn && npm run test:journey:run", "test:unit": "npm run gen-data-json && NODE_OPTIONS=--no-deprecation vitest --config config/vitest.root.config.ts run --coverage", "test:upgrade:unicorn": "npm run test:journey:k3d && npm run test:journey:image:unicorn && vitest run integration/cluster/upgrade.test.ts", "test:upgrade:upstream": "npm run test:journey:k3d && npm run test:journey:image && vitest run integration/cluster/upgrade.test.ts" }, dependencies: { "@types/ramda": "0.31.0", commander: "14.0.0", express: "5.1.0", "fast-json-patch": "3.1.1", heredoc: "^1.3.1", "http-status-codes": "^2.3.0", "json-pointer": "^0.6.2", "kubernetes-fluent-client": "3.10.0", pino: "9.7.0", "pino-pretty": "13.1.1", "prom-client": "15.1.3", ramda: "0.31.3", "ts-morph": "^26.0.0" }, devDependencies: { "@commitlint/cli": "19.8.1", "@commitlint/config-conventional": "19.8.1", "@fast-check/vitest": "^0.2.1", "@types/eslint": "9.6.1", "@types/express": "5.0.3", "@types/json-pointer": "^1.0.34", "@types/node": "24.x.x", "@types/node-forge": "1.3.13", "@types/uuid": "10.0.0", "@types/ws": "^8.18.1", "@vitest/coverage-v8": "^3.2.3", "fast-check": "^4.0.0", globals: "^16.0.0", husky: "^9.1.6", "js-yaml": "^4.1.0", shellcheck: "^3.0.0", tsx: "^4.20.3", undici: "^7.0.1", vitest: "^3.2.3" }, overrides: { glob: "^9.0.0" }, peerDependencies: { "@types/prompts": "2.4.9", "@typescript-eslint/eslint-plugin": "8.38.0", "@typescript-eslint/parser": "8.38.0", esbuild: "0.25.8", eslint: "9.32.0", "node-forge": "1.3.1", prettier: "3.6.2", prompts: "2.4.2", typescript: "5.8.3", uuid: "11.1.0" } };
+
+// src/cli/init/utils.ts
+var import_fs7 = require("fs");
+function sanitizeName(name2) {
+  if (typeof name2 !== "string") {
+    throw TypeError(
+      `sanitizeName() was called with a non-string value. The value is: ${name2} of type ${typeof name2}`
+    );
   }
-  return cfg.pepr.rbacMode || "admin";
+  let sanitized = name2.toLowerCase().replace(/[^a-z0-9-]+/gi, "-");
+  sanitized = sanitized.replace(/^-+|-+$/g, "");
+  sanitized = sanitized.replace(/--+/g, "-");
+  return sanitized;
 }
-async function createOutputDirectory(outputDir2) {
+async function createDir(dir) {
   try {
-    const dir = outputDir2 === "" ? "dist" : outputDir2;
-    await createDirectoryIfNotExists(dir);
-    return dir;
-  } catch (error) {
-    console.error(`Error creating output directory: ${error.message}`);
-    process.exit(1);
-  }
-}
-function checkIronBankImage(registry, image, peprVersion) {
-  return registry === "Iron Bank" ? `registry1.dso.mil/ironbank/opensource/defenseunicorns/pepr/controller:v${peprVersion}` : image;
-}
-function validImagePullSecret(imagePullSecretName) {
-  if (imagePullSecretName) {
-    const error = "Invalid imagePullSecret. Please provide a valid name as defined in RFC 1123.";
-    if (sanitizeResourceName(imagePullSecretName) !== imagePullSecretName) {
-      console.error(error);
-      process.exit(1);
+    await import_fs7.promises.mkdir(dir);
+  } catch (err) {
+    if (err && err.code === "EEXIST") {
+      throw new Error(`Directory ${dir} already exists`);
+    } else {
+      throw err;
     }
   }
 }
-async function handleCustomImageBuild(includedFiles, peprVersion, description, image) {
-  if (includedFiles.length > 0) {
-    await createDockerfile(peprVersion, description, includedFiles);
-    (0, import_child_process2.execSync)(`docker build --tag ${image} -f Dockerfile.controller .`, {
-      stdio: "inherit"
-    });
-    (0, import_child_process2.execSync)(`docker push ${image}`, { stdio: "inherit" });
-  }
-}
-function handleValidCapabilityNames(capabilities) {
-  try {
-    validateCapabilityNames(capabilities);
-  } catch (e) {
-    console.error(`Error loading capability:`, e);
-    process.exit(1);
-  }
-}
-async function watchForChanges(ctxCfg, reloader) {
-  const ctx = await (0, import_esbuild.context)(ctxCfg);
-  if (reloader) {
-    await ctx.watch();
-  } else {
-    await ctx.rebuild();
-    await ctx.dispose();
+function write(path4, data) {
+  if (typeof data !== "string") {
+    data = JSON.stringify(data, null, 2);
   }
-  return ctx;
+  return import_fs7.promises.writeFile(path4, data);
 }
-async function generateYamlAndWriteToDisk(obj) {
-  const { uuid, imagePullSecret, outputDir: outputDir2, assets, zarf } = obj;
-  const yamlFile = `pepr-module-${uuid}.yaml`;
-  const chartPath = `${uuid}-chart`;
-  const yamlPath = (0, import_path3.resolve)(outputDir2, yamlFile);
-  try {
-    const yaml = await assets.allYaml(
-      generateAllYaml,
-      {
-        getDeploymentFunction: getDeployment,
-        getWatcherFunction: getWatcher,
-        getServiceFunction: service,
-        getWatcherServiceFunction: watcherService
+
+// src/cli/init/templates.ts
+var { dependencies, devDependencies, peerDependencies, scripts, version } = packageJSON;
+function genPkgJSON(opts) {
+  const uuid = !opts.uuid ? (0, import_uuid.v4)() : opts.uuid;
+  const name2 = sanitizeName(opts.name);
+  const { typescript } = peerDependencies;
+  const data = {
+    name: name2,
+    version: "0.0.1",
+    description: opts.description,
+    keywords: ["pepr", "k8s", "policy-engine", "pepr-module", "security"],
+    engines: {
+      node: ">=20.0.0"
+    },
+    pepr: {
+      uuid,
+      onError: opts.errorBehavior,
+      webhookTimeout: 10,
+      customLabels: {
+        namespace: {
+          "pepr.dev": ""
+        }
       },
-      imagePullSecret
-    );
-    const zarfPath = (0, import_path3.resolve)(outputDir2, "zarf.yaml");
-    let localZarf = "";
-    if (zarf === "chart") {
-      localZarf = assets.zarfYamlChart(generateZarfYamlGeneric, chartPath);
+      alwaysIgnore: {
+        namespaces: []
+      },
+      admission: {
+        alwaysIgnore: {
+          namespaces: []
+        }
+      },
+      watch: {
+        alwaysIgnore: {
+          namespaces: []
+        }
+      },
+      includedFiles: [],
+      env: {}
+    },
+    scripts: {
+      "k3d-setup": scripts["test:journey:k3d"]
+    },
+    dependencies: {
+      pepr: version,
+      undici: "^7.0.1"
+    },
+    devDependencies: {
+      typescript
+    },
+    overrides: {
+      "brace-expansion": "1.1.11"
+    }
+  };
+  return {
+    data,
+    path: "package.json",
+    print: (0, import_util.inspect)(data, false, 5, true)
+  };
+}
+var peprTSTemplate = {
+  path: "pepr.ts",
+  data: peprTS
+};
+var readme = {
+  path: "README.md",
+  data: readmeMd
+};
+var helloPepr = {
+  path: "hello-pepr.ts",
+  data: helloPeprTS
+};
+var gitignore = {
+  path: ".gitignore",
+  data: gitIgnore
+};
+var samplesYaml = {
+  path: "hello-pepr.samples.yaml",
+  data: hello_pepr_samples_default.map((r) => (0, import_client_node5.dumpYaml)(r, { noRefs: true })).join("---\n")
+};
+var snippet = {
+  path: "pepr.code-snippets",
+  data: pepr_code_snippets_default
+};
+var codeSettings = {
+  path: "settings.json",
+  data: settings_default
+};
+var tsConfig = {
+  path: "tsconfig.json",
+  data: tsconfig_module_default
+};
+var prettier = {
+  path: ".prettierrc",
+  data: prettierrc_default
+};
+var eslint = {
+  path: "eslint.config.mjs",
+  data: (0, import_fs8.readFileSync)(
+    import_path3.default.resolve(
+      (() => {
+        const fullPath = __dirname;
+        const lengthOfSuffix = "pepr/".length;
+        const lastPeprIndex = fullPath.lastIndexOf("pepr/");
+        return fullPath.substring(0, lastPeprIndex + lengthOfSuffix);
+      })(),
+      "src/templates/eslint.config.mjs"
+    ),
+    "utf-8"
+  )
+};
+
+// src/cli/format/index.ts
+var import_eslint = require("eslint");
+
+// src/cli/format/format.helpers.ts
+var import_fs9 = require("fs");
+var import_prettier = require("prettier");
+async function formatWithPrettier(results, validateOnly) {
+  let hasFailure = false;
+  for (const { filePath } of results) {
+    const content = await import_fs9.promises.readFile(filePath, "utf8");
+    const cfg = await (0, import_prettier.resolveConfig)(filePath);
+    const formatted = await (0, import_prettier.format)(content, { filepath: filePath, ...cfg });
+    if (validateOnly && formatted !== content) {
+      hasFailure = true;
+      console.error(`File ${filePath} is not formatted correctly`);
     } else {
-      localZarf = assets.zarfYaml(generateZarfYamlGeneric, yamlFile);
+      await import_fs9.promises.writeFile(filePath, formatted);
     }
-    await import_fs9.promises.writeFile(yamlPath, yaml);
-    await import_fs9.promises.writeFile(zarfPath, localZarf);
-    await assets.generateHelmChart(webhookConfigGenerator, getWatcher, getModuleSecret, outputDir2);
-    console.info(`K8s resource for the module saved to ${yamlPath}`);
-  } catch (error) {
-    console.error(`Error generating YAML: ${error}`);
-    process.exit(1);
   }
+  return hasFailure;
 }
 
-// src/cli/build.ts
-var peprTS2 = "pepr.ts";
-var outputDir = "dist";
-function build_default(program2) {
-  program2.command("build").description("Build a Pepr Module for deployment").addOption(
-    new import_commander.Option("-M, --rbac-mode <mode>", "Override module config and set RBAC mode.").choices([
-      "admin",
-      "scoped"
-    ])
-  ).addOption(
-    new import_commander.Option(
-      "-I, --registry-info <registry/username>",
-      "Provide the image registry and username for building and pushing a custom WASM container. Requires authentication. Conflicts with --custom-image and --registry. Builds and pushes `'<registry/username>/custom-pepr-controller:<current-version>'`."
-    ).conflicts(["customImage", "registry"])
-  ).option("-P, --with-pull-secret <name>", "Use image pull secret for controller Deployment.", "").addOption(
-    new import_commander.Option(
-      "-c, --custom-name <name>",
-      "Set name for zarf component and service monitors in helm charts."
-    )
-  ).option("-e, --entry-point <file>", "Specify the entry point file to build with.", peprTS2).addOption(
-    new import_commander.Option(
-      "-i, --custom-image <image>",
-      "Specify a custom image with version for deployments. Conflicts with --registry-info and --registry. Example: 'docker.io/username/custom-pepr-controller:v1.0.0'"
-    ).conflicts(["registryInfo", "registry"])
-  ).option(
-    "-n, --no-embed",
-    "Disable embedding of deployment files into output module. Useful when creating library modules intended solely for reuse/distribution via NPM."
-  ).option("-o, --output <directory>", "Set output directory.", "dist").addOption(
-    new import_commander.Option(
-      "-r, --registry <GitHub|Iron Bank>",
-      "Container registry: Choose container registry for deployment manifests. Conflicts with --custom-image and --registry-info."
-    ).conflicts(["customImage", "registryInfo"]).choices(["GitHub", "Iron Bank"])
-  ).option(
-    "-t, --timeout <seconds>",
-    "How long the API server should wait for a webhook to respond before treating the call as a failure.",
-    parseTimeout
-  ).addOption(
-    new import_commander.Option("-z, --zarf <manifest|chart>", "Set Zarf package type").choices(["manifest", "chart"]).default("manifest")
-  ).action(async (opts) => {
-    outputDir = await createOutputDirectory(opts.output);
-    const buildModuleResult = await buildModule(void 0, opts.entryPoint, opts.embed);
-    const { cfg, path: path4 } = buildModuleResult;
-    if (opts.customName) {
-      process.env.PEPR_CUSTOM_BUILD_NAME = opts.customName;
-    }
-    const image = assignImage({
-      customImage: opts.customImage,
-      registryInfo: opts.registryInfo,
-      peprVersion: cfg.pepr.peprVersion,
-      registry: opts.registry
-    });
-    if (opts.timeout !== void 0) {
-      cfg.pepr.webhookTimeout = opts.timeout;
-    }
-    if (opts.registryInfo !== void 0) {
-      console.info(`Including ${cfg.pepr.includedFiles.length} files in controller image.`);
-      await handleCustomImageBuild(
-        cfg.pepr.includedFiles,
-        cfg.pepr.peprVersion,
-        cfg.description,
-        image
-      );
-    }
-    if (!opts.embed) {
-      console.info(`Module built successfully at ${path4}`);
-      return;
+// src/cli/format/index.ts
+function format_default(program2) {
+  program2.command("format").description("Lint and format this Pepr module").option("-v, --validate-only", "Do not modify files, only validate formatting.").action(async (opts) => {
+    const success = await peprFormat(opts.validateOnly);
+    if (success) {
+      logger_default.info("Module formatted");
+    } else {
+      process.exit(1);
     }
-    const assets = new Assets(
-      {
-        ...cfg.pepr,
-        appVersion: cfg.version,
-        description: cfg.description,
-        alwaysIgnore: {
-          namespaces: cfg.pepr.alwaysIgnore?.namespaces
-        },
-        // Can override the rbacMode with the CLI option
-        rbacMode: determineRbacMode(opts, cfg)
-      },
-      path4,
-      opts.withPullSecret === "" ? [] : [opts.withPullSecret]
-    );
-    if (image !== "") assets.image = image;
-    validImagePullSecret(opts.withPullSecret);
-    handleValidCapabilityNames(assets.capabilities);
-    await generateYamlAndWriteToDisk({
-      uuid: cfg.pepr.uuid,
-      outputDir,
-      imagePullSecret: opts.withPullSecret,
-      zarf: opts.zarf,
-      assets
-    });
   });
 }
-var externalLibs = Object.keys(dependencies);
-externalLibs.push("pepr");
-externalLibs.push("@kubernetes/client-node");
-async function loadModule(entryPoint = peprTS2) {
-  const entryPointPath = (0, import_path4.resolve)(".", entryPoint);
-  const modulePath = (0, import_path4.dirname)(entryPointPath);
-  const cfgPath = (0, import_path4.resolve)(modulePath, "package.json");
+async function peprFormat(validateOnly) {
+  {
+    try {
+      const eslint2 = new import_eslint.ESLint();
+      const results = await eslint2.lintFiles(["./**/*.ts"]);
+      let hasFailure = false;
+      results.forEach(async (result) => {
+        const errorCount = result.fatalErrorCount + result.errorCount;
+        if (errorCount > 0) {
+          hasFailure = true;
+        }
+      });
+      const formatter = await eslint2.loadFormatter("stylish");
+      const resultText = await formatter.format(results, {});
+      if (resultText) {
+        logger_default.info(resultText);
+      }
+      if (!validateOnly) {
+        await import_eslint.ESLint.outputFixes(results);
+      }
+      hasFailure = hasFailure || await formatWithPrettier(results, validateOnly);
+      return !hasFailure;
+    } catch (error) {
+      logger_default.error(error, `Error formatting module:`);
+      return false;
+    }
+  }
+}
+
+// src/cli/build/loadModule.ts
+var import_promises = __toESM(require("fs/promises"));
+var import_posix = require("path/posix");
+async function loadModule(outputDir, entryPoint) {
+  const entryPointPath = (0, import_posix.resolve)(".", entryPoint);
+  const modulePath = (0, import_posix.dirname)(entryPointPath);
+  const cfgPath = (0, import_posix.resolve)(modulePath, "package.json");
   try {
-    await import_fs10.promises.access(cfgPath);
-    await import_fs10.promises.access(entryPointPath);
+    await import_promises.default.access(cfgPath);
+    await import_promises.default.access(entryPointPath);
   } catch {
     console.error(
       `Could not find ${cfgPath} or ${entryPointPath} in the current directory. Please run this command from the root of your module's directory.`
     );
     process.exit(1);
   }
-  const moduleText = await import_fs10.promises.readFile(cfgPath, { encoding: "utf-8" });
+  const moduleText = await import_promises.default.readFile(cfgPath, { encoding: "utf-8" });
   const cfg = JSON.parse(moduleText);
   const { uuid } = cfg.pepr;
   const name2 = `pepr-${uuid}.js`;
@@ -9884,13 +9797,18 @@ async function loadModule(entryPoint = peprTS2) {
     entryPointPath,
     modulePath,
     name: name2,
-    path: (0, import_path4.resolve)(outputDir, name2),
+    path: (0, import_posix.resolve)(outputDir, name2),
     uuid
   };
 }
-async function buildModule(reloader, entryPoint = peprTS2, embed = true) {
+
+// src/cli/build/buildModule.ts
+var externalLibs = Object.keys(dependencies);
+externalLibs.push("pepr");
+externalLibs.push("@kubernetes/client-node");
+async function buildModule(outputDir, reloader, entryPoint = "pepr.ts", embed = true) {
   try {
-    const { cfg, modulePath, path: path4, uuid } = await loadModule(entryPoint);
+    const { cfg, modulePath, path: path4, uuid } = await loadModule(outputDir, entryPoint);
     await checkFormat();
     const npmRoot = (0, import_child_process3.execFileSync)("npm", ["root"]).toString().trim();
     const args = ["--project", `${modulePath}/tsconfig.json`, "--outdir", outputDir];
@@ -9978,12 +9896,109 @@ async function checkFormat() {
   }
 }
 
+// src/cli/build/index.ts
+function build_default(program2) {
+  program2.command("build").description("Build a Pepr Module for deployment").addOption(
+    new import_commander.Option("-M, --rbac-mode <mode>", "Override module config and set RBAC mode.").choices([
+      "admin",
+      "scoped"
+    ])
+  ).addOption(
+    new import_commander.Option(
+      "-I, --registry-info <registry/username>",
+      "Provide the image registry and username for building and pushing a custom WASM container. Requires authentication. Conflicts with --custom-image and --registry. Builds and pushes `'<registry/username>/custom-pepr-controller:<current-version>'`."
+    ).conflicts(["customImage", "registry"])
+  ).option("-P, --with-pull-secret <name>", "Use image pull secret for controller Deployment.", "").addOption(
+    new import_commander.Option(
+      "-c, --custom-name <name>",
+      "Set name for zarf component and service monitors in helm charts."
+    )
+  ).option("-e, --entry-point <file>", "Specify the entry point file to build with.", "pepr.ts").addOption(
+    new import_commander.Option(
+      "-i, --custom-image <image>",
+      "Specify a custom image with version for deployments. Conflicts with --registry-info and --registry. Example: 'docker.io/username/custom-pepr-controller:v1.0.0'"
+    ).conflicts(["registryInfo", "registry"])
+  ).option(
+    "-n, --no-embed",
+    "Disable embedding of deployment files into output module. Useful when creating library modules intended solely for reuse/distribution via NPM."
+  ).option("-o, --output <directory>", "Set output directory.", "dist").addOption(
+    new import_commander.Option(
+      "-r, --registry <GitHub|Iron Bank>",
+      "Container registry: Choose container registry for deployment manifests. Conflicts with --custom-image and --registry-info."
+    ).conflicts(["customImage", "registryInfo"]).choices(["GitHub", "Iron Bank"])
+  ).option(
+    "-t, --timeout <seconds>",
+    "How long the API server should wait for a webhook to respond before treating the call as a failure.",
+    parseTimeout
+  ).addOption(
+    new import_commander.Option("-z, --zarf <manifest|chart>", "Set Zarf package type").choices(["manifest", "chart"]).default("manifest")
+  ).action(async (opts) => {
+    const outputDir = await createOutputDirectory(opts.output);
+    const buildModuleResult = await buildModule(
+      outputDir,
+      void 0,
+      opts.entryPoint,
+      opts.embed
+    );
+    const { cfg, path: path4 } = buildModuleResult;
+    if (opts.customName) {
+      process.env.PEPR_CUSTOM_BUILD_NAME = opts.customName;
+    }
+    const image = assignImage({
+      customImage: opts.customImage,
+      registryInfo: opts.registryInfo,
+      peprVersion: cfg.pepr.peprVersion,
+      registry: opts.registry
+    });
+    if (opts.timeout !== void 0) {
+      cfg.pepr.webhookTimeout = opts.timeout;
+    }
+    if (opts.registryInfo !== void 0) {
+      console.info(`Including ${cfg.pepr.includedFiles.length} files in controller image.`);
+      await handleCustomImageBuild(
+        cfg.pepr.includedFiles,
+        cfg.pepr.peprVersion,
+        cfg.description,
+        image
+      );
+    }
+    if (!opts.embed) {
+      console.info(`Module built successfully at ${path4}`);
+      return;
+    }
+    const assets = new Assets(
+      {
+        ...cfg.pepr,
+        appVersion: cfg.version,
+        description: cfg.description,
+        alwaysIgnore: {
+          namespaces: cfg.pepr.alwaysIgnore?.namespaces
+        },
+        // Can override the rbacMode with the CLI option
+        rbacMode: determineRbacMode(opts, cfg)
+      },
+      path4,
+      opts.withPullSecret === "" ? [] : [opts.withPullSecret]
+    );
+    if (image !== "") assets.image = image;
+    validImagePullSecret(opts.withPullSecret);
+    handleValidCapabilityNames(assets.capabilities);
+    await generateYamlAndWriteToDisk({
+      uuid: cfg.pepr.uuid,
+      outputDir,
+      imagePullSecret: opts.withPullSecret,
+      zarf: opts.zarf,
+      assets
+    });
+  });
+}
+
 // src/cli/deploy.ts
 var import_prompts = __toESM(require("prompts"));
 
 // src/lib/assets/deploy.ts
 var import_crypto3 = __toESM(require("crypto"));
-var import_fs11 = require("fs");
+var import_fs10 = require("fs");
 var import_kubernetes_fluent_client3 = require("kubernetes-fluent-client");
 
 // src/lib/k8s.ts
@@ -10089,10 +10104,10 @@ async function deployWebhook(assets, force, webhookTimeout) {
   await (0, import_kubernetes_fluent_client3.K8s)(import_kubernetes_fluent_client3.kind.Namespace).Apply(getNamespace(assets.config.customLabels?.namespace));
   await handleWebhookConfiguration(assets, "mutate" /* MUTATE */, webhookTimeout, force);
   await handleWebhookConfiguration(assets, "validate" /* VALIDATE */, webhookTimeout, force);
-  logger_default.info("Applying the Pepr Store CRD if it doesn't exist");
+  logger_default.debug("Applying the Pepr Store CRD if it doesn't exist");
   await (0, import_kubernetes_fluent_client3.K8s)(import_kubernetes_fluent_client3.kind.CustomResourceDefinition).Apply(peprStoreCRD, { force });
   if (assets.host) return;
-  const code = await import_fs11.promises.readFile(assets.path);
+  const code = await import_fs10.promises.readFile(assets.path);
   if (!code.length) throw new Error("No code provided");
   const hash = import_crypto3.default.createHash("sha256").update(code).digest("hex");
   await setupRBAC(assets.name, assets.capabilities, force, assets.config);
@@ -10184,7 +10199,7 @@ async function namespaceDeploymentsReady(namespace = "pepr-system") {
     if (ready) {
       return ready;
     }
-    await new Promise((resolve6) => setTimeout(resolve6, 1e3));
+    await new Promise((resolve7) => setTimeout(resolve7, 1e3));
   }
   logger_default.info(`All ${namespace} deployments are ready`);
 }
@@ -10248,7 +10263,7 @@ async function getUserConfirmation(opts) {
   return confirmation.yes ? true : false;
 }
 async function buildAndDeployModule(image, force) {
-  const builtModule = await buildModule();
+  const builtModule = await buildModule("dist");
   if (!builtModule) {
     return;
   }
@@ -10303,7 +10318,7 @@ function validateNamespaces(capability, webhook) {
 var import_prompts2 = __toESM(require("prompts"));
 var import_child_process4 = require("child_process");
 var import_kubernetes_fluent_client5 = require("kubernetes-fluent-client");
-var import_fs12 = require("fs");
+var import_fs11 = require("fs");
 function dev_default(program2) {
   program2.command("dev").description("Setup a local webhook development environment").option("-H, --host <host>", "Host to listen on", "host.k3d.internal").option("-y, --yes", "Skip confirmation prompt").action(async (opts) => {
     if (!opts.yes) {
@@ -10317,7 +10332,7 @@ function dev_default(program2) {
         return;
       }
     }
-    const { cfg, path: path4 } = await loadModule();
+    const { cfg, path: path4 } = await loadModule("dist", "pepr.ts");
     const webhook = new Assets(
       {
         ...cfg.pepr,
@@ -10327,8 +10342,8 @@ function dev_default(program2) {
       [],
       opts.host
     );
-    await import_fs12.promises.writeFile("insecure-tls.crt", webhook.tls.pem.crt);
-    await import_fs12.promises.writeFile("insecure-tls.key", webhook.tls.pem.key);
+    await import_fs11.promises.writeFile("insecure-tls.crt", webhook.tls.pem.crt);
+    await import_fs11.promises.writeFile("insecure-tls.key", webhook.tls.pem.key);
     try {
       let program3;
       const name2 = `pepr-${cfg.pepr.uuid}`;
@@ -10370,7 +10385,7 @@ ${error}`
           console.debug(`Received SIGINT, removing webhooks`);
         });
       };
-      await buildModule(async (r) => {
+      await buildModule("dist", async (r) => {
         if (r.errors.length > 0) {
           console.error(`Error compiling module: ${r.errors}`);
           return;
@@ -10483,7 +10498,7 @@ var import_child_process5 = require("child_process");
 var import_path5 = require("path");
 
 // src/cli/init/walkthrough.ts
-var import_fs13 = require("fs");
+var import_fs12 = require("fs");
 var import_prompts3 = __toESM(require("prompts"));
 
 // src/cli/init/enums.ts
@@ -10530,7 +10545,7 @@ async function setName(name2) {
     validate: async (val) => {
       try {
         const name3 = sanitizeName(val);
-        await import_fs13.promises.access(name3, import_fs13.promises.constants.F_OK);
+        await import_fs12.promises.access(name3, import_fs12.promises.constants.F_OK);
         return "A directory with this name already exists";
       } catch {
         return val.length > 2 || "The name must be at least 3 characters long";
@@ -10714,11 +10729,11 @@ function uuid_default(program2) {
   program2.command("uuid [uuid]").description("Module UUID(s) currently deployed in the cluster").action(async (uuid) => {
     const deployments = await getPeprDeploymentsByUUID(uuid);
     const uuidTable = buildUUIDTable(deployments);
-    console.log("UUID		Description");
-    console.log("--------------------------------------------");
-    Object.entries(uuidTable).forEach(([uuid2, description]) => {
-      console.log(`${uuid2}	${description}`);
-    });
+    const uuidTableEntries = Object.entries(uuidTable).map(([uuid2, description]) => ({
+      UUID: uuid2,
+      Description: description
+    }));
+    console.table(uuidTableEntries);
   });
 }
 async function getPeprDeploymentsByUUID(uuid) {
@@ -10751,7 +10766,7 @@ var import_commander6 = require("commander");
 
 // src/cli/update/index.ts
 var import_child_process6 = require("child_process");
-var import_fs14 = __toESM(require("fs"));
+var import_fs13 = __toESM(require("fs"));
 var import_path6 = require("path");
 var import_prompts4 = __toESM(require("prompts"));
 function update_default(program2) {
@@ -10791,12 +10806,12 @@ function update_default(program2) {
         await write((0, import_path6.resolve)(".vscode", snippet.path), snippet.data);
         await write((0, import_path6.resolve)(".vscode", codeSettings.path), codeSettings.data);
         const samplePath = (0, import_path6.resolve)("capabilities", samplesYaml.path);
-        if (import_fs14.default.existsSync(samplePath)) {
-          import_fs14.default.unlinkSync(samplePath);
+        if (import_fs13.default.existsSync(samplePath)) {
+          import_fs13.default.unlinkSync(samplePath);
           await write(samplePath, samplesYaml.data);
         }
         const tsPath = (0, import_path6.resolve)("capabilities", helloPepr.path);
-        if (import_fs14.default.existsSync(tsPath)) {
+        if (import_fs13.default.existsSync(tsPath)) {
           await write(tsPath, helloPepr.data);
         }
       }
@@ -10844,7 +10859,7 @@ var import_commander5 = require("commander");
 var import_commander3 = require("commander");
 
 // src/cli/crd/generate/generators.ts
-var import_fs15 = __toESM(require("fs"));
+var import_fs14 = __toESM(require("fs"));
 var import_path7 = __toESM(require("path"));
 var import_yaml = __toESM(require_dist());
 var import_ts_morph = require("ts-morph");
@@ -10874,27 +10889,27 @@ function extractCRDDetails(content, sourceFile) {
 }
 async function generateCRDs(options) {
   logger_default.warn("This feature is currently in alpha.\n");
-  const outputDir2 = import_path7.default.resolve(options.output);
-  await createDirectoryIfNotExists(outputDir2);
+  const outputDir = import_path7.default.resolve(options.output);
+  await createDirectoryIfNotExists(outputDir);
   const project = new import_ts_morph.Project();
   const apiRoot = import_path7.default.resolve("api");
   const versions = getAPIVersions(apiRoot);
   for (const version3 of versions) {
     const sourceFiles = loadVersionFiles(project, import_path7.default.join(apiRoot, version3));
     for (const sourceFile of sourceFiles) {
-      processSourceFile(sourceFile, version3, outputDir2);
+      processSourceFile(sourceFile, version3, outputDir);
     }
   }
 }
 function getAPIVersions(apiRoot) {
-  return import_fs15.default.readdirSync(apiRoot).filter((v) => import_fs15.default.statSync(import_path7.default.join(apiRoot, v)).isDirectory());
+  return import_fs14.default.readdirSync(apiRoot).filter((v) => import_fs14.default.statSync(import_path7.default.join(apiRoot, v)).isDirectory());
 }
 function loadVersionFiles(project, versionDir) {
-  const files = import_fs15.default.readdirSync(versionDir).filter((f) => f.endsWith(".ts"));
+  const files = import_fs14.default.readdirSync(versionDir).filter((f) => f.endsWith(".ts"));
   const filePaths = files.map((f) => import_path7.default.join(versionDir, f));
   return project.addSourceFilesAtPaths(filePaths);
 }
-function processSourceFile(sourceFile, version3, outputDir2) {
+function processSourceFile(sourceFile, version3, outputDir) {
   const content = sourceFile.getFullText();
   const { kind: kind8, fqdn, scope, plural: plural2, shortNames } = extractCRDDetails(content, sourceFile);
   if (!kind8) {
@@ -10919,8 +10934,8 @@ function processSourceFile(sourceFile, version3, outputDir2) {
     specSchema,
     conditionSchema
   });
-  const outPath = import_path7.default.join(outputDir2, `${kind8.toLowerCase()}.yaml`);
-  import_fs15.default.writeFileSync(outPath, (0, import_yaml.stringify)(crd), "utf8");
+  const outPath = import_path7.default.join(outputDir, `${kind8.toLowerCase()}.yaml`);
+  import_fs14.default.writeFileSync(outPath, (0, import_yaml.stringify)(crd), "utf8");
   logger_default.info(`\u2714 Created ${outPath}`);
 }
 function extractSingleLineComment(content, label) {
@@ -11084,7 +11099,7 @@ function generate_default() {
 
 // src/cli/crd/create/index.ts
 var import_commander4 = require("commander");
-var import_fs16 = require("fs");
+var import_fs15 = require("fs");
 
 // src/cli/crd/create/createCRDscaffold.ts
 var createCRDscaffold = (group2, version3, kind8, data) => {
@@ -11177,13 +11192,13 @@ function create_default() {
     ).choices(["Namespaced", "Cluster"]).default("Namespaced")
   ).option("-d, --domain <domain>", "Optional domain for CRD (e.g. pepr.dev)", "pepr.dev").requiredOption("-g, --group <group>", "API group (e.g. cache)").requiredOption("-k, --kind <kind>", "Kind name (e.g. memcached)").option("-p, --plural <plural>", "Plural name for CRD (e.g. memcacheds)").requiredOption("-s, --short-name <name>", "Short name for CRD (e.g. mc)").requiredOption("-v, --version <version>", "API version (e.g. v1alpha1)").action(async ({ group: group2, version: version3, kind: kind8, domain, scope, plural: plural2, shortName }) => {
     logger_default.warn("This feature is currently in alpha.");
-    const outputDir2 = import_path8.default.resolve(`./api/${version3}`);
-    await createDirectoryIfNotExists(outputDir2);
-    await import_fs16.promises.writeFile(
+    const outputDir = import_path8.default.resolve(`./api/${version3}`);
+    await createDirectoryIfNotExists(outputDir);
+    await import_fs15.promises.writeFile(
       `./api/${version3}/${kind8.toLowerCase()}_types.ts`,
       createCRDscaffold(group2, version3, kind8, { domain, scope, plural: plural2, shortName })
     );
-    logger_default.info(`\u2714 Created ${kind8} TypeScript definition in ${outputDir2}`);
+    logger_default.info(`\u2714 Created ${kind8} TypeScript definition in ${outputDir}`);
   });
 }