@emseepea/create-database-schema-server 0.0.0 → 0.0.2

package/README.md

@@ -28,6 +28,30 @@ Compose setup, lint checks, ordinary tests, and semantic tests.
 
 <!-- generated-project-readme -->
 
+## Choose Open or Protected Access
+
+Start open when the catalogue and operations are public.
+
+To protect this template, pass both options to the app factory:
+
+- `access: { access: "protected", requiredScopes: ["peas:read"] }`
+- an `authentication` adapter
+
+Keep `authentication.discovery` as `"public"` unless capability names or
+schemas are sensitive. Use `"protected"` only when each principal should see a
+permission-filtered catalogue. OAuth metadata remains public in both modes.
+
+## Add Observability
+
+The same factory accepts `observability`.
+
+- Use `structuredLogging` for safe structured events.
+- Use `openTelemetry` for traces and metrics.
+
+Adapters receive only redacted framework events. They never receive request
+bodies, arguments, results, tokens, provider claims, or raw errors. See the
+[server API](https://github.com/emseepea/emseepea/tree/main/packages/framework#authentication-and-observability) for the complete configuration.
+
 ## Database Schema Server
 
 PostgreSQL is authoritative for the internal contract. Kanel and Kanel Zod

package/initializer-dist/template/README.md

@@ -1,4 +1,28 @@
-# Database Schema Server
+# Choose Open or Protected Access
+
+Start open when the catalogue and operations are public.
+
+To protect this template, pass both options to the app factory:
+
+- `access: { access: "protected", requiredScopes: ["peas:read"] }`
+- an `authentication` adapter
+
+Keep `authentication.discovery` as `"public"` unless capability names or
+schemas are sensitive. Use `"protected"` only when each principal should see a
+permission-filtered catalogue. OAuth metadata remains public in both modes.
+
+## Add Observability
+
+The same factory accepts `observability`.
+
+- Use `structuredLogging` for safe structured events.
+- Use `openTelemetry` for traces and metrics.
+
+Adapters receive only redacted framework events. They never receive request
+bodies, arguments, results, tokens, provider claims, or raw errors. See the
+[server API](https://github.com/emseepea/emseepea/tree/main/packages/framework#authentication-and-observability) for the complete configuration.
+
+## Database Schema Server
 
 PostgreSQL is authoritative for the internal contract. Kanel and Kanel Zod
 generate TypeScript and runtime validators from the committed schema. Normal

package/initializer-dist/template/compose.yaml

@@ -6,7 +6,7 @@ services:
       POSTGRES_PASSWORD: emseepea
       POSTGRES_USER: emseepea
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U emseepea -d emseepea"]
+      test: ["CMD-SHELL", "pg_isready -h 127.0.0.1 -U emseepea -d emseepea"]
       interval: 1s
       timeout: 3s
       retries: 20

package/initializer-dist/template/package.json

@@ -19,7 +19,7 @@
   "devDependencies": {
     "kanel": "4.0.4",
     "kanel-zod": "4.0.1",
-    "@emseepea/testing": "0.5.2",
+    "@emseepea/testing": "0.6.1",
     "@modelcontextprotocol/client": "2.0.0",
     "@types/node": "24.13.3",
     "@types/pg": "8.23.1",
@@ -31,7 +31,7 @@
   },
   "private": true,
   "dependencies": {
-    "@emseepea/server": "0.3.3",
+    "@emseepea/server": "0.4.0",
     "pg": "8.23.0",
     "zod": "4.4.3"
   }

package/initializer-dist/template/src/app.ts

@@ -1,12 +1,19 @@
-import { createEmseepea, discoverCapabilities } from "@emseepea/server";
+import {
+  createEmseepea,
+  discoverCapabilities,
+  type AccessPolicy,
+  type EmseepeaExtensions,
+} from "@emseepea/server";
 import { Pool } from "pg";
 import { z } from "zod";
 
-export interface DatabaseSchemaExampleOptions {
+export interface DatabaseSchemaExampleOptions extends EmseepeaExtensions {
   readonly databaseUrl: string;
+  readonly access?: AccessPolicy;
 }
 
 export async function createDatabaseSchemaExample(options: DatabaseSchemaExampleOptions) {
+  const { access = { access: "public" }, authentication, observability } = options;
   const databaseUrl = z.string().url().refine(
     (value) => ["postgres:", "postgresql:"].includes(new URL(value).protocol),
     "databaseUrl must use PostgreSQL",
@@ -41,7 +48,10 @@ export async function createDatabaseSchemaExample(options: DatabaseSchemaExample
     readinessTimeoutMs: 2_500,
     ...await discoverCapabilities(new URL("./capabilities/", import.meta.url), {
       database: () => database,
+      access,
     }),
+    authentication,
+    observability,
   });
   const closeProvider = async () => {
     const activeDatabase = database;

package/initializer-dist/template/src/capabilities/context.ts

@@ -1,5 +1,7 @@
 import type { Pool } from "pg";
+import type { AccessPolicy } from "@emseepea/server";
 
 export interface DatabaseSchemaContext {
   readonly database: () => Pool | undefined;
+  readonly access: AccessPolicy;
 }

package/initializer-dist/template/src/capabilities/tool.add-pea-variety.ts

@@ -1,4 +1,4 @@
-import { defineTool, type CapabilityModuleFactory } from "@emseepea/server";
+import { defineTool, type CapabilityModuleFactory, type ToolContext } from "@emseepea/server";
 import { peaVarietyCatalog } from "../generated/public/PeaVarietyCatalog.mjs";
 import { varietySchema } from "../pea-variety.js";
 import type { DatabaseSchemaContext } from "./context.js";
@@ -8,11 +8,11 @@ const outputSchema = varietySchema;
 
 export default ((context) => defineTool({
   name: "add-pea-variety",
-  access: "public",
+  ...context.access,
   description: "Add one pea variety to the catalogue.",
   inputSchema,
   outputSchema,
-  async handler(variety, { signal }) {
+  async handler(variety, { signal }: ToolContext) {
     const database = context.database();
     if (!database) throw new Error("Variety provider unavailable");
     signal.throwIfAborted();

package/initializer-dist/template/src/capabilities/tool.list-pea-varieties.ts

@@ -1,4 +1,4 @@
-import { defineTool, type CapabilityModuleFactory } from "@emseepea/server";
+import { defineTool, type CapabilityModuleFactory, type ToolContext } from "@emseepea/server";
 import { z } from "zod";
 import { peaVarietyCatalog } from "../generated/public/PeaVarietyCatalog.mjs";
 import { varietySchema } from "../pea-variety.js";
@@ -14,11 +14,11 @@ const outputSchema = z.object({
 
 export default ((context) => defineTool({
   name: "list-pea-varieties",
-  access: "public",
+  ...context.access,
   description: "List pea varieties, optionally filtered by pea type.",
   inputSchema,
   outputSchema,
-  async handler({ pea_type }, { signal }) {
+  async handler({ pea_type }, { signal }: ToolContext) {
     const database = context.database();
     if (!database) throw new Error("Variety provider unavailable");
     signal.throwIfAborted();

package/initializer-dist/template/src/capabilities/tool.summarize-pea-catalog.ts

@@ -1,4 +1,4 @@
-import { defineTool, type CapabilityModuleFactory } from "@emseepea/server";
+import { defineTool, type CapabilityModuleFactory, type ToolContext } from "@emseepea/server";
 import { z } from "zod";
 import { peaCatalogSummary } from "../generated/public/PeaCatalogSummary.mjs";
 import type { DatabaseSchemaContext } from "./context.js";
@@ -16,11 +16,11 @@ const outputSchema = z.object({
 
 export default ((context) => defineTool({
   name: "summarize-pea-catalog",
-  access: "public",
+  ...context.access,
   description: "Summarize the pea catalogue.",
   inputSchema,
   outputSchema,
-  async handler({ pea_type }, { signal }) {
+  async handler({ pea_type }, { signal }: ToolContext) {
     const database = context.database();
     if (!database) throw new Error("Variety provider unavailable");
     signal.throwIfAborted();

package/initializer-dist/template/test/server.test.mjs

@@ -1,8 +1,13 @@
 import assert from "node:assert/strict";
 import test, { after } from "node:test";
 
-import { startMcpServer } from "@emseepea/testing";
+import {
+  insecureTestAuthentication,
+  startEmseepea,
+  startMcpServer,
+} from "@emseepea/testing";
 import { Pool } from "pg";
+import { createDatabaseSchemaExample } from "../dist/app.js";
 
 const databaseUrl = process.env.DATABASE_URL;
 assert.ok(databaseUrl, "DATABASE_URL is required");
@@ -74,6 +79,22 @@ test("reads and writes through the view and summarizes through the procedure", a
   );
 });
 
+test("the same template composes protected access and observability", async (t) => {
+  const events = [];
+  const permissions = ["catalogue:write"];
+  const { app } = await createDatabaseSchemaExample({
+    databaseUrl,
+    access: { access: "protected", requiredScopes: permissions },
+    authentication: insecureTestAuthentication(permissions),
+    observability: [{ id: "test-log", emit: (event) => events.push(event) }],
+  });
+  const running = await startEmseepea(t, app);
+  const client = await running.connect("test-token");
+  const result = await client.callTool({ name: "list-pea-varieties", arguments: {} });
+  assert.equal(result.isError, false);
+  assert.ok(events.some(({ capability }) => capability === "list-pea-varieties"));
+});
+
 test("the catalogue read has a fixed 20-row boundary", async (t) => {
   await database.query(`
     INSERT INTO pea_variety_catalog

package/package.json

@@ -1,14 +1,10 @@
 {
   "name": "@emseepea/create-database-schema-server",
-  "version": "0.0.0",
+  "version": "0.0.2",
   "description": "Create an Em See Pea server with internal validation generated from a PostgreSQL schema.",
   "license": "MIT",
   "type": "module",
-  "starterDependencies": [
-    "@emseepea/server",
-    "pg",
-    "zod"
-  ],
+  "starterDependencies": ["@emseepea/server", "pg", "zod"],
   "scripts": {
     "build": "npm run build:example && npm run build:initializer",
     "build:example": "tsc -p tsconfig.json",
@@ -25,12 +21,12 @@
     "prepack": "npm run build:initializer"
   },
   "devDependencies": {
-    "@emseepea/server": "0.3.3",
+    "@emseepea/server": "0.4.0",
     "pg": "8.23.0",
     "zod": "4.4.3",
     "kanel": "4.0.4",
     "kanel-zod": "4.0.1",
-    "@emseepea/testing": "0.5.3",
+    "@emseepea/testing": "0.6.1",
     "@modelcontextprotocol/client": "2.0.0",
     "@types/node": "24.13.3",
     "@types/pg": "8.23.1",
@@ -40,21 +36,10 @@
   "engines": {
     "node": ">=22.13.0"
   },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/emseepea/emseepea.git",
-    "directory": "examples/database-schema-server"
-  },
+  "repository": { "type": "git", "url": "git+https://github.com/emseepea/emseepea.git", "directory": "examples/database-schema-server" },
   "homepage": "https://emseepea.github.io/emseepea/examples/",
   "bugs": "https://github.com/emseepea/emseepea/issues",
-  "publishConfig": {
-    "access": "public",
-    "provenance": true
-  },
-  "bin": {
-    "create-database-schema-server": "./initializer-dist/create.mjs"
-  },
-  "files": [
-    "initializer-dist"
-  ]
+  "publishConfig": { "access": "public", "provenance": true },
+  "bin": { "create-database-schema-server": "./initializer-dist/create.mjs" },
+  "files": ["initializer-dist"]
 }