@emseepea/create-multi-instance-postgres-server 0.0.4 → 0.0.8

package/README.md

@@ -25,6 +25,30 @@ ordinary tests, and semantic tests.
 
 <!-- generated-project-readme -->
 
+## Choose Open or Protected Access
+
+Start open when the catalogue and operations are public.
+
+To protect this template, pass both options to the app factory:
+
+- `access: { access: "protected", requiredScopes: ["peas:read"] }`
+- an `authentication` adapter
+
+Keep `authentication.discovery` as `"public"` unless capability names or
+schemas are sensitive. Use `"protected"` only when each principal should see a
+permission-filtered catalogue. OAuth metadata remains public in both modes.
+
+## Add Observability
+
+The same factory accepts `observability`.
+
+- Use `structuredLogging` for safe structured events.
+- Use `openTelemetry` for traces and metrics.
+
+Adapters receive only redacted framework events. They never receive request
+bodies, arguments, results, tokens, provider claims, or raw errors. See the
+[server API](https://github.com/emseepea/emseepea/tree/main/packages/framework#authentication-and-observability) for the complete configuration.
+
 ## Multi-Instance PostgreSQL Server
 
 Each server process owns its own Em See Pea app and bounded PostgreSQL
@@ -93,6 +117,13 @@ to the shared database continues to serve the same state.
 - No claim of exactly-once external effects, latency, throughput, or unlimited
   scale.
 
+## Add Feedback
+
+Install `@emseepea/feedback` when this server needs a detailed one-way
+observation or a durable support conversation. Pass its tools through the
+application factory's `additionalTools` option. Choose PostgreSQL, Firestore,
+GitHub Issues, or Zendesk in the [feedback guide](../../packages/feedback/README.md).
+
 ## Check This Project
 
 [Ordinary tests](test/) prove cross-process state, complete-state replacement,

package/initializer-dist/template/README.md

@@ -1,4 +1,28 @@
-# Multi-Instance PostgreSQL Server
+# Choose Open or Protected Access
+
+Start open when the catalogue and operations are public.
+
+To protect this template, pass both options to the app factory:
+
+- `access: { access: "protected", requiredScopes: ["peas:read"] }`
+- an `authentication` adapter
+
+Keep `authentication.discovery` as `"public"` unless capability names or
+schemas are sensitive. Use `"protected"` only when each principal should see a
+permission-filtered catalogue. OAuth metadata remains public in both modes.
+
+## Add Observability
+
+The same factory accepts `observability`.
+
+- Use `structuredLogging` for safe structured events.
+- Use `openTelemetry` for traces and metrics.
+
+Adapters receive only redacted framework events. They never receive request
+bodies, arguments, results, tokens, provider claims, or raw errors. See the
+[server API](https://github.com/emseepea/emseepea/tree/main/packages/framework#authentication-and-observability) for the complete configuration.
+
+## Multi-Instance PostgreSQL Server
 
 Each server process owns its own Em See Pea app and bounded PostgreSQL
 connection pool. Every process reads and writes the same application state, so
@@ -66,6 +90,13 @@ to the shared database continues to serve the same state.
 - No claim of exactly-once external effects, latency, throughput, or unlimited
   scale.
 
+## Add Feedback
+
+Install `@emseepea/feedback` when this server needs a detailed one-way
+observation or a durable support conversation. Pass its tools through the
+application factory's `additionalTools` option. Choose PostgreSQL, Firestore,
+GitHub Issues, or Zendesk in the [feedback guide](../../packages/feedback/README.md).
+
 ## Check This Project
 
 [Ordinary tests](test/) prove cross-process state, complete-state replacement,

package/initializer-dist/template/compose.yaml

@@ -6,7 +6,7 @@ services:
       POSTGRES_PASSWORD: emseepea
       POSTGRES_USER: emseepea
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U emseepea -d emseepea"]
+      test: ["CMD-SHELL", "pg_isready -h 127.0.0.1 -U emseepea -d emseepea"]
       interval: 1s
       timeout: 3s
       retries: 20

package/initializer-dist/template/eval/meaning.test.mjs

@@ -1,18 +1,26 @@
 import test from "node:test";
 import {
+  assertNoNegativeFeedback,
   assertResponseContains,
   assertResponseMeaning,
-  assertToolCalls,
+  assertToolCallsWithOptionalFeedback,
   createConversation,
 } from "@emseepea/testing/semantic";
 
+const server = new URL(import.meta.resolve("@emseepea/feedback/testing-server"));
+
 const databaseUrl = process.env.DATABASE_URL;
 if (!databaseUrl) throw new Error("DATABASE_URL is required for the PostgreSQL semantic test");
 
 test("saves and retrieves a harvest report without exposing server instances", async (t) => {
   const chat = await createConversation(t, {
-    server: new URL("../dist/server.js", import.meta.url),
-    environment: { DATABASE_URL: databaseUrl },
+    server,
+    environment: {
+      DATABASE_URL: databaseUrl,
+      EMSEEPEA_EVAL_APP_MODULE: new URL("../dist/app.js", import.meta.url).href,
+      EMSEEPEA_EVAL_APP_FACTORY: "createMultiInstanceExample",
+      EMSEEPEA_EVAL_APP_KIND: "postgres",
+    },
   });
 
   // Two natural turns cover write and read tool selection at low model cost.
@@ -22,7 +30,7 @@ test("saves and retrieves a harvest report without exposing server instances", a
     "Save a harvest report for North Bed on 2026-09-08 with 12 shelling pea " +
     "plants and 8 snap pea plants.",
   );
-  assertToolCalls(saved, [
+  await assertToolCallsWithOptionalFeedback(saved, [
     {
       name: "save-harvest-report",
       arguments: {
@@ -38,7 +46,7 @@ test("saves and retrieves a harvest report without exposing server instances", a
   const retrieved = await chat.send(
     "What harvest report do we have for that garden bed and date?",
   );
-  assertToolCalls(retrieved, [
+  await assertToolCallsWithOptionalFeedback(retrieved, [
     {
       name: "get-harvest-report",
       arguments: { gardenBed: "North Bed", harvestDate: "2026-09-08" },
@@ -49,4 +57,5 @@ test("saves and retrieves a harvest report without exposing server instances", a
       "The saved report for North Bed on 2026-09-08 has 12 shelling pea plants, " +
       "8 snap pea plants, and 20 plants in total.",
   });
+  assertNoNegativeFeedback(saved, retrieved);
 });

package/initializer-dist/template/package.json

@@ -17,7 +17,8 @@
     "lint": "oxlint src test eval"
   },
   "devDependencies": {
-    "@emseepea/testing": "0.5.3",
+    "@emseepea/feedback": "0.2.0",
+    "@emseepea/testing": "0.9.3",
     "@modelcontextprotocol/client": "2.0.0",
     "@types/node": "24.13.3",
     "@types/pg": "8.23.1",
@@ -29,7 +30,7 @@
   },
   "private": true,
   "dependencies": {
-    "@emseepea/server": "0.3.3",
+    "@emseepea/server": "0.6.1",
     "pg": "8.23.0",
     "zod": "4.4.3"
   }

package/initializer-dist/template/src/app.ts

@@ -1,16 +1,23 @@
-import { createEmseepea, discoverCapabilities } from "@emseepea/server";
+import {
+  createEmseepea,
+  discoverCapabilities,
+  type AccessPolicy,
+  type EmseepeaExtensions,
+} from "@emseepea/server";
 import { Pool } from "pg";
 import { z } from "zod";
 
-export interface MultiInstanceExampleOptions {
+export interface MultiInstanceExampleOptions extends EmseepeaExtensions {
   readonly databaseUrl: string;
+  readonly access?: AccessPolicy;
 }
 
 export async function createMultiInstanceExample(options: MultiInstanceExampleOptions) {
+  const { databaseUrl: databaseUrlOption, access = { access: "public" }, ...extensions } = options;
   const databaseUrl = z.string().url().refine(
     (value) => ["postgres:", "postgresql:"].includes(new URL(value).protocol),
     "databaseUrl must use PostgreSQL",
-  ).parse(options.databaseUrl);
+  ).parse(databaseUrlOption);
   let database: Pool | undefined = new Pool({
     connectionString: databaseUrl,
     connectionTimeoutMillis: 2_000,
@@ -41,7 +48,9 @@ export async function createMultiInstanceExample(options: MultiInstanceExampleOp
     readinessTimeoutMs: 2_500,
     ...await discoverCapabilities(new URL("./capabilities/", import.meta.url), {
       database: () => database,
+      access,
     }),
+    ...extensions,
   });
   const closeProvider = async () => {
     const activeDatabase = database;

package/initializer-dist/template/src/capabilities/context.ts

@@ -1,5 +1,7 @@
 import type { Pool } from "pg";
+import type { AccessPolicy } from "@emseepea/server";
 
 export interface MultiInstanceContext {
   readonly database: () => Pool | undefined;
+  readonly access: AccessPolicy;
 }

package/initializer-dist/template/src/capabilities/tool.get-harvest-report.ts

@@ -1,4 +1,4 @@
-import { defineTool, type CapabilityModuleFactory } from "@emseepea/server";
+import { defineTool, type CapabilityModuleFactory, type ToolContext } from "@emseepea/server";
 import { z } from "zod";
 import { reportKeySchema, reportSchema } from "../harvest-report.js";
 import type { MultiInstanceContext } from "./context.js";
@@ -12,11 +12,11 @@ const outputSchema = z.object({
 
 export default ((context) => defineTool({
   name: "get-harvest-report",
-  access: "public",
+  ...context.access,
   description: "Get the pea harvest report for a garden bed and date.",
   inputSchema,
   outputSchema,
-  async handler({ gardenBed, harvestDate }, { signal }) {
+  async handler({ gardenBed, harvestDate }, { signal }: ToolContext) {
     const database = context.database();
     if (!database) throw new Error("Report provider unavailable");
     signal.throwIfAborted();

package/initializer-dist/template/src/capabilities/tool.save-harvest-report.ts

@@ -1,4 +1,4 @@
-import { defineTool, type CapabilityModuleFactory } from "@emseepea/server";
+import { defineTool, type CapabilityModuleFactory, type ToolContext } from "@emseepea/server";
 import { z } from "zod";
 import { editableReportSchema, reportSchema } from "../harvest-report.js";
 import type { MultiInstanceContext } from "./context.js";
@@ -8,11 +8,11 @@ const outputSchema = reportSchema;
 
 export default ((context) => defineTool({
   name: "save-harvest-report",
-  access: "public",
+  ...context.access,
   description: "Save the complete pea harvest report for a garden bed and date.",
   inputSchema,
   outputSchema,
-  async handler({ gardenBed, harvestDate, shellingCount, snapCount }, { signal }) {
+  async handler({ gardenBed, harvestDate, shellingCount, snapCount }, { signal }: ToolContext) {
     const database = context.database();
     if (!database) throw new Error("Report provider unavailable");
     signal.throwIfAborted();

package/initializer-dist/template/test/server.test.mjs

@@ -4,6 +4,8 @@ import { fileURLToPath } from "node:url";
 import test, { after } from "node:test";
 import { Client, StreamableHTTPClientTransport } from "@modelcontextprotocol/client";
 import { Pool } from "pg";
+import { insecureTestAuthentication, startEmseepea } from "@emseepea/testing";
+import { createMultiInstanceExample } from "../dist/app.js";
 
 const serverPath = fileURLToPath(new URL("../dist/server.js", import.meta.url));
 const databaseUrl = process.env.DATABASE_URL;
@@ -67,6 +69,25 @@ test("two interchangeable server processes share one coherent report store", asy
   assert.equal(await readiness.text(), "not ready\n");
 });
 
+test("the same template composes protected access and observability", async (t) => {
+  const events = [];
+  const permissions = ["reports:write"];
+  const { app } = await createMultiInstanceExample({
+    databaseUrl,
+    access: { access: "protected", requiredScopes: permissions },
+    authentication: insecureTestAuthentication(permissions),
+    observability: [{ id: "test-log", emit: (event) => events.push(event) }],
+  });
+  const running = await startEmseepea(t, app);
+  const client = await running.connect("test-token");
+  const result = await client.callTool({
+    name: "get-harvest-report",
+    arguments: { gardenBed: "Missing", harvestDate: "2026-09-08" },
+  });
+  assert.equal(result.isError, false);
+  assert.ok(events.some(({ capability }) => capability === "get-harvest-report"));
+});
+
 test("describes every public harvest report property", async (t) => {
   const instance = await startInstance("schema-instance", databaseUrl);
   const client = await connect(instance.url);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@emseepea/create-multi-instance-postgres-server",
-  "version": "0.0.4",
+  "version": "0.0.8",
   "description": "Create interchangeable Em See Pea server instances sharing PostgreSQL state.",
   "license": "MIT",
   "type": "module",
@@ -21,10 +21,11 @@
     "prepack": "npm run build:initializer"
   },
   "devDependencies": {
-    "@emseepea/server": "0.3.3",
+    "@emseepea/feedback": "0.2.0",
+    "@emseepea/server": "0.6.1",
     "pg": "8.23.0",
     "zod": "4.4.3",
-    "@emseepea/testing": "0.5.3",
+    "@emseepea/testing": "0.9.3",
     "@modelcontextprotocol/client": "2.0.0",
     "@types/node": "24.13.3",
     "@types/pg": "8.23.1",