@emseepea/create-mongodb-backed-server 0.0.1 → 0.0.5

package/README.md

@@ -27,6 +27,30 @@ tests.
 
 <!-- generated-project-readme -->
 
+## Choose Open or Protected Access
+
+Start open when the catalogue and operations are public.
+
+To protect this template, pass both options to the app factory:
+
+- `access: { access: "protected", requiredScopes: ["peas:read"] }`
+- an `authentication` adapter
+
+Keep `authentication.discovery` as `"public"` unless capability names or
+schemas are sensitive. Use `"protected"` only when each principal should see a
+permission-filtered catalogue. OAuth metadata remains public in both modes.
+
+## Add Observability
+
+The same factory accepts `observability`.
+
+- Use `structuredLogging` for safe structured events.
+- Use `openTelemetry` for traces and metrics.
+
+Adapters receive only redacted framework events. They never receive request
+bodies, arguments, results, tokens, provider claims, or raw errors. See the
+[server API](https://github.com/emseepea/emseepea/tree/main/packages/framework#authentication-and-observability) for the complete configuration.
+
 ## MongoDB-Backed Server
 
 `pea_varieties` is schema-enforced. `src/pea-document.ts` contains its only
@@ -90,6 +114,13 @@ The tools never accept database operators, collection names, sort documents,
 or destinations. The pool and database operations are bounded, and provider
 failures return a generic error.
 
+## Add Feedback
+
+Install `@emseepea/feedback` when this server needs a detailed one-way
+observation or a durable support conversation. Pass its tools through the
+application factory's `additionalTools` option. Choose PostgreSQL, Firestore,
+GitHub Issues, or Zendesk in the [feedback guide](../../packages/feedback/README.md).
+
 ## Check This Project
 
 Run lint, build, and ordinary database integration tests without spending model

package/initializer-dist/template/README.md

@@ -1,4 +1,28 @@
-# MongoDB-Backed Server
+# Choose Open or Protected Access
+
+Start open when the catalogue and operations are public.
+
+To protect this template, pass both options to the app factory:
+
+- `access: { access: "protected", requiredScopes: ["peas:read"] }`
+- an `authentication` adapter
+
+Keep `authentication.discovery` as `"public"` unless capability names or
+schemas are sensitive. Use `"protected"` only when each principal should see a
+permission-filtered catalogue. OAuth metadata remains public in both modes.
+
+## Add Observability
+
+The same factory accepts `observability`.
+
+- Use `structuredLogging` for safe structured events.
+- Use `openTelemetry` for traces and metrics.
+
+Adapters receive only redacted framework events. They never receive request
+bodies, arguments, results, tokens, provider claims, or raw errors. See the
+[server API](https://github.com/emseepea/emseepea/tree/main/packages/framework#authentication-and-observability) for the complete configuration.
+
+## MongoDB-Backed Server
 
 `pea_varieties` is schema-enforced. `src/pea-document.ts` contains its only
 stored-document schema. MongoDB applies that exact object as its collection
@@ -61,6 +85,13 @@ The tools never accept database operators, collection names, sort documents,
 or destinations. The pool and database operations are bounded, and provider
 failures return a generic error.
 
+## Add Feedback
+
+Install `@emseepea/feedback` when this server needs a detailed one-way
+observation or a durable support conversation. Pass its tools through the
+application factory's `additionalTools` option. Choose PostgreSQL, Firestore,
+GitHub Issues, or Zendesk in the [feedback guide](../../packages/feedback/README.md).
+
 ## Check This Project
 
 Run lint, build, and ordinary database integration tests without spending model

package/initializer-dist/template/eval/meaning.test.mjs

@@ -1,11 +1,15 @@
 import test from "node:test";
 import {
+  assertNoNegativeFeedback,
   assertResponseContains,
   assertResponseMeaning,
-  assertToolCalls,
+  assertToolCallsWithOptionalFeedback,
   createConversation,
 } from "@emseepea/testing/semantic";
 
+const server = new URL(import.meta.resolve("@emseepea/feedback/testing-server"));
+const appModule = new URL("../dist/app.js", import.meta.url).href;
+
 const trialUris = [1, 2, 3].map((trial) => {
   const value = process.env[`MONGODB_URL_TRIAL_${trial}`];
   if (!value) throw new Error(`MONGODB_URL_TRIAL_${trial} is required`);
@@ -14,14 +18,19 @@ const trialUris = [1, 2, 3].map((trial) => {
 
 test("finds and adds MongoDB-backed pea varieties through natural requests", async (t) => {
   const chat = await createConversation(t, {
-    server: new URL("../dist/server.js", import.meta.url),
-    environment: (trial) => ({ MONGODB_URL: trialUris[trial - 1] }),
+    server,
+    environment: (trial) => ({
+      MONGODB_URL: trialUris[trial - 1],
+      EMSEEPEA_EVAL_APP_MODULE: appModule,
+      EMSEEPEA_EVAL_APP_FACTORY: "createMongoExample",
+      EMSEEPEA_EVAL_APP_KIND: "mongodb",
+    }),
   });
 
   // The read and write turns cover both public decisions. Storage validation
   // remains in deterministic tests because asking a model cannot prove it.
   const fastest = await chat.send("Among the saved snap pea varieties, which matures fastest?");
-  assertToolCalls(fastest, [{
+  await assertToolCallsWithOptionalFeedback(fastest, [{
     name: "list-pea-varieties",
     arguments: { pea_type: "snap" },
   }]);
@@ -33,7 +42,7 @@ test("finds and adds MongoDB-backed pea varieties through natural requests", asy
     "Add Golden Sweet as a climbing mangetout pea that matures in 70 days. " +
     "Use exactly mangetout as its pea type. Its notes are: Purple flowers and flat edible pods.",
   );
-  assertToolCalls(added, [{
+  await assertToolCallsWithOptionalFeedback(added, [{
     name: "add-pea-variety",
     arguments: {
       name: "Golden Sweet",
@@ -51,7 +60,7 @@ test("finds and adds MongoDB-backed pea varieties through natural requests", asy
     "Record that Golden Sweet was flowering in the west trellis on 2026-09-08. " +
     "The notes are: First flower opened.",
   );
-  assertToolCalls(recorded, [{
+  await assertToolCallsWithOptionalFeedback(recorded, [{
     name: "record-pea-observation",
     arguments: {
       variety_name: "Golden Sweet",
@@ -63,7 +72,7 @@ test("finds and adds MongoDB-backed pea varieties through natural requests", asy
   }]);
 
   const observations = await chat.send("What have I observed about Golden Sweet?");
-  assertToolCalls(observations, [{
+  await assertToolCallsWithOptionalFeedback(observations, [{
     name: "list-pea-observations",
     arguments: { variety_name: "Golden Sweet" },
   }]);
@@ -72,4 +81,5 @@ test("finds and adds MongoDB-backed pea varieties through natural requests", asy
       "Golden Sweet was flowering in the west trellis on 8 September 2026, " +
       "and the first flower had opened.",
   });
+  assertNoNegativeFeedback(fastest, added, recorded, observations);
 });

package/initializer-dist/template/package.json

@@ -16,7 +16,8 @@
     "lint": "oxlint src test eval"
   },
   "devDependencies": {
-    "@emseepea/testing": "0.5.3",
+    "@emseepea/feedback": "0.2.0",
+    "@emseepea/testing": "0.9.3",
     "@types/node": "24.13.3",
     "typescript": "6.0.3",
     "oxlint": "1.80.0"
@@ -26,7 +27,7 @@
   },
   "private": true,
   "dependencies": {
-    "@emseepea/server": "0.3.3",
+    "@emseepea/server": "0.6.1",
     "ajv": "8.20.0",
     "json-schema-to-ts": "3.1.1",
     "mongodb": "7.6.0",

package/initializer-dist/template/src/app.ts

@@ -1,13 +1,25 @@
-import { createEmseepea, discoverCapabilities } from "@emseepea/server";
+import {
+  createEmseepea,
+  discoverCapabilities,
+  type AccessPolicy,
+  type EmseepeaExtensions,
+} from "@emseepea/server";
 import type { Collection, Db } from "mongodb";
 import { z } from "zod";
 import { createDatabase } from "./database.js";
 import type { PeaObservationDocument } from "./pea-observation-document.js";
 import type { PeaDocument } from "./pea-document.js";
 
-export interface MongoExampleOptions { readonly uri: string }
+export interface MongoExampleOptions extends EmseepeaExtensions {
+  readonly uri: string;
+  readonly access?: AccessPolicy;
+}
 
-export async function createMongoExample({ uri }: MongoExampleOptions) {
+export async function createMongoExample({
+  uri,
+  access = { access: "public" },
+  ...extensions
+}: MongoExampleOptions) {
   const parsedUri = z.string().url().refine(
     (value) => ["mongodb:", "mongodb+srv:"].includes(new URL(value).protocol),
     "uri must use MongoDB",
@@ -33,10 +45,12 @@ export async function createMongoExample({ uri }: MongoExampleOptions) {
     },
     readinessTimeoutMs: 2_500,
     ...await discoverCapabilities(new URL("./capabilities/", import.meta.url), {
+      access,
       database: () => database,
       observations: () => observations,
       varieties: () => varieties,
     }),
+    ...extensions,
   });
   const closeProvider = async () => {
     observations = undefined;

package/initializer-dist/template/src/capabilities/tool.add-pea-variety.ts

@@ -1,5 +1,5 @@
 import { randomUUID } from "node:crypto";
-import { defineTool, type CapabilityModuleFactory } from "@emseepea/server";
+import { defineTool, type CapabilityModuleFactory, type ToolContext } from "@emseepea/server";
 import { parsePeaDocument } from "../pea-document.js";
 import { varietySchema } from "../pea-variety.js";
 import type { MongoContext } from "../database.js";
@@ -9,11 +9,11 @@ const outputSchema = varietySchema;
 
 export default ((context) => defineTool({
   name: "add-pea-variety",
-  access: "public",
+  ...context.access,
   description: "Add one pea variety to the catalogue.",
   inputSchema,
   outputSchema,
-  async handler(variety, { signal }) {
+  async handler(variety, { signal }: ToolContext) {
     const collection = context.varieties();
     if (!collection) throw new Error("Variety provider unavailable");
     signal.throwIfAborted();

package/initializer-dist/template/src/capabilities/tool.list-pea-observations.ts

@@ -1,4 +1,4 @@
-import { defineTool, type CapabilityModuleFactory } from "@emseepea/server";
+import { defineTool, type CapabilityModuleFactory, type ToolContext } from "@emseepea/server";
 import { z } from "zod";
 import type { MongoContext } from "../database.js";
 import { parsePeaObservationDocument } from "../pea-observation-document.js";
@@ -15,11 +15,11 @@ const outputSchema = z.object({
 
 export default ((context) => defineTool({
   name: "list-pea-observations",
-  access: "public",
+  ...context.access,
   description: "List up to 20 recent observations of pea plants.",
   inputSchema,
   outputSchema,
-  async handler({ variety_name }, { signal }) {
+  async handler({ variety_name }, { signal }: ToolContext) {
     const collection = context.observations();
     if (!collection) throw new Error("Observation provider unavailable");
     signal.throwIfAborted();

package/initializer-dist/template/src/capabilities/tool.list-pea-varieties.ts

@@ -1,4 +1,4 @@
-import { defineTool, type CapabilityModuleFactory } from "@emseepea/server";
+import { defineTool, type CapabilityModuleFactory, type ToolContext } from "@emseepea/server";
 import { z } from "zod";
 import { parsePeaDocument } from "../pea-document.js";
 import { varietySchema } from "../pea-variety.js";
@@ -14,11 +14,11 @@ const outputSchema = z.object({
 
 export default ((context) => defineTool({
   name: "list-pea-varieties",
-  access: "public",
+  ...context.access,
   description: "List up to 20 pea varieties, optionally filtered by pea type.",
   inputSchema,
   outputSchema,
-  async handler({ pea_type }, { signal }) {
+  async handler({ pea_type }, { signal }: ToolContext) {
     const collection = context.varieties();
     if (!collection) throw new Error("Variety provider unavailable");
     signal.throwIfAborted();

package/initializer-dist/template/src/capabilities/tool.record-pea-observation.ts

@@ -1,5 +1,5 @@
 import { randomUUID } from "node:crypto";
-import { defineTool, type CapabilityModuleFactory } from "@emseepea/server";
+import { defineTool, type CapabilityModuleFactory, type ToolContext } from "@emseepea/server";
 import type { MongoContext } from "../database.js";
 import { parsePeaObservationDocument } from "../pea-observation-document.js";
 import { observationSchema } from "../pea-observation.js";
@@ -9,11 +9,11 @@ const outputSchema = observationSchema;
 
 export default ((context) => defineTool({
   name: "record-pea-observation",
-  access: "public",
+  ...context.access,
   description: "Record one dated observation of a pea plant.",
   inputSchema,
   outputSchema,
-  async handler(observation, { signal }) {
+  async handler(observation, { signal }: ToolContext) {
     const collection = context.observations();
     if (!collection) throw new Error("Observation provider unavailable");
     signal.throwIfAborted();

package/initializer-dist/template/src/database.ts

@@ -1,4 +1,5 @@
 import { MongoClient, type Collection, type Db } from "mongodb";
+import type { AccessPolicy } from "@emseepea/server";
 import type { PeaObservationDocument } from "./pea-observation-document.js";
 import type { PeaDocument } from "./pea-document.js";
 
@@ -23,6 +24,7 @@ export function createDatabase(uri: string) {
 }
 
 export interface MongoContext {
+  readonly access: AccessPolicy;
   readonly varieties: () => Collection<PeaDocument> | undefined;
   readonly observations: () => Collection<PeaObservationDocument> | undefined;
   readonly database: () => Db | undefined;

package/initializer-dist/template/test/server.test.mjs

@@ -2,7 +2,11 @@ import assert from "node:assert/strict";
 import { spawnSync } from "node:child_process";
 import test, { after } from "node:test";
 
-import { startMcpServer } from "@emseepea/testing";
+import {
+  insecureTestAuthentication,
+  startEmseepea,
+  startMcpServer,
+} from "@emseepea/testing";
 import { MongoClient } from "mongodb";
 import { createMongoExample } from "../dist/app.js";
 import {
@@ -57,6 +61,22 @@ test("each collection has one application schema and only varieties enforce it i
   ]);
 });
 
+test("the same template composes protected access and observability", async (t) => {
+  const events = [];
+  const permissions = ["catalogue:write"];
+  const { app } = await createMongoExample({
+    uri,
+    access: { access: "protected", requiredScopes: permissions },
+    authentication: insecureTestAuthentication(permissions),
+    observability: [{ id: "test-log", emit: (event) => events.push(event) }],
+  });
+  const running = await startEmseepea(t, app);
+  const client = await running.connect("test-token");
+  const result = await client.callTool({ name: "list-pea-varieties", arguments: {} });
+  assert.equal(result.isError, false);
+  assert.ok(events.some(({ capability }) => capability === "list-pea-varieties"));
+});
+
 test("setup fails closed when the schemaless collection already has a validator", async () => {
   await database.command({
     collMod: observationCollectionName,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@emseepea/create-mongodb-backed-server",
-  "version": "0.0.1",
+  "version": "0.0.5",
   "description": "Create an Em See Pea server with schema-enforced and schemaless MongoDB collections.",
   "license": "MIT",
   "type": "module",
@@ -20,12 +20,13 @@
     "prepack": "npm run build:initializer"
   },
   "devDependencies": {
-    "@emseepea/server": "0.3.3",
+    "@emseepea/feedback": "0.2.0",
+    "@emseepea/server": "0.6.1",
     "ajv": "8.20.0",
     "json-schema-to-ts": "3.1.1",
     "mongodb": "7.6.0",
     "zod": "4.4.3",
-    "@emseepea/testing": "0.5.3",
+    "@emseepea/testing": "0.9.3",
     "@types/node": "24.13.3",
     "typescript": "6.0.3",
     "oxlint": "1.80.0"