@emseepea/create-resources-and-prompts-server 0.0.13 → 0.0.17

package/README.md

@@ -17,6 +17,30 @@ npm init @emseepea/resources-and-prompts-server -- my-server
 
 <!-- generated-project-readme -->
 
+## Choose Open or Protected Access
+
+Start open when the catalogue and operations are public.
+
+To protect this template, pass both options to the app factory:
+
+- `access: { access: "protected", requiredScopes: ["peas:read"] }`
+- an `authentication` adapter
+
+Keep `authentication.discovery` as `"public"` unless capability names or
+schemas are sensitive. Use `"protected"` only when each principal should see a
+permission-filtered catalogue. OAuth metadata remains public in both modes.
+
+## Add Observability
+
+The same factory accepts `observability`.
+
+- Use `structuredLogging` for safe structured events.
+- Use `openTelemetry` for traces and metrics.
+
+Adapters receive only redacted framework events. They never receive request
+bodies, arguments, results, tokens, provider claims, or raw errors. See the
+[server API](https://github.com/emseepea/emseepea/tree/main/packages/framework#authentication-and-observability) for the complete configuration.
+
 ## Resources and Prompts Example
 
 Choose this example when you want to give an assistant reusable reference
@@ -42,6 +66,13 @@ npm start
 The server listens on `http://127.0.0.1:3000/mcp` by default. Set `PORT` to
 choose another port.
 
+## Add Feedback
+
+Install `@emseepea/feedback` when this server needs a detailed one-way
+observation or a durable support conversation. Pass its tools through the
+application factory's `additionalTools` option. Choose PostgreSQL, Firestore,
+GitHub Issues, or Zendesk in the [feedback guide](../../packages/feedback/README.md).
+
 ## Check This Example
 
 [Ordinary tests](test/) live in `test/`.

package/initializer-dist/template/README.md

@@ -1,4 +1,28 @@
-# Resources and Prompts Example
+# Choose Open or Protected Access
+
+Start open when the catalogue and operations are public.
+
+To protect this template, pass both options to the app factory:
+
+- `access: { access: "protected", requiredScopes: ["peas:read"] }`
+- an `authentication` adapter
+
+Keep `authentication.discovery` as `"public"` unless capability names or
+schemas are sensitive. Use `"protected"` only when each principal should see a
+permission-filtered catalogue. OAuth metadata remains public in both modes.
+
+## Add Observability
+
+The same factory accepts `observability`.
+
+- Use `structuredLogging` for safe structured events.
+- Use `openTelemetry` for traces and metrics.
+
+Adapters receive only redacted framework events. They never receive request
+bodies, arguments, results, tokens, provider claims, or raw errors. See the
+[server API](https://github.com/emseepea/emseepea/tree/main/packages/framework#authentication-and-observability) for the complete configuration.
+
+## Resources and Prompts Example
 
 Choose this example when you want to give an assistant reusable reference
 content and guided starting questions, without adding another tool.
@@ -23,6 +47,13 @@ npm start
 The server listens on `http://127.0.0.1:3000/mcp` by default. Set `PORT` to
 choose another port.
 
+## Add Feedback
+
+Install `@emseepea/feedback` when this server needs a detailed one-way
+observation or a durable support conversation. Pass its tools through the
+application factory's `additionalTools` option. Choose PostgreSQL, Firestore,
+GitHub Issues, or Zendesk in the [feedback guide](../../packages/feedback/README.md).
+
 ## Check This Example
 
 [Ordinary tests](test/) live in `test/`.

package/initializer-dist/template/eval/meaning.test.mjs

@@ -1,13 +1,20 @@
 import test from "node:test";
 import {
-  assertNoToolCalls,
+  assertOptionalToolCall,
   assertResponseMeaning,
   createConversation,
 } from "@emseepea/testing/semantic";
 
+const server = new URL(import.meta.resolve("@emseepea/feedback/testing-server"));
+const environment = {
+  EMSEEPEA_EVAL_APP_MODULE: new URL("../dist/app.js", import.meta.url).href,
+  EMSEEPEA_EVAL_APP_FACTORY: "createResourcesAndPromptsServer",
+};
+
 test("does not pretend an unselected resource was supplied", async (t) => {
   const chat = await createConversation(t, {
-    server: new URL("../dist/server.js", import.meta.url),
+    server,
+    environment,
   });
 
   const response = await chat.send(
@@ -15,9 +22,10 @@ test("does not pretend an unselected resource was supplied", async (t) => {
     "and plant spacing does guide://peas/planting/container specify?",
   );
 
-  assertNoToolCalls(response);
   // Resources and prompts are user-selected client features, not autonomous
-  // tools. One semantic assertion checks the honest unselected experience.
+  // tools. Capability-mismatch feedback is valid in this deliberately
+  // unsuccessful journey, so this test checks only the honest response.
+  assertOptionalToolCall(response, "submit-feedback");
   await assertResponseMeaning(response, {
     expected:
       "The response does not claim to know the guide's recommendation. It says " +

package/initializer-dist/template/package.json

@@ -14,7 +14,8 @@
     "lint": "oxlint src test eval"
   },
   "devDependencies": {
-    "@emseepea/testing": "0.5.3",
+    "@emseepea/feedback": "0.2.0",
+    "@emseepea/testing": "0.9.3",
     "@types/node": "24.13.3",
     "typescript": "6.0.3",
     "oxlint": "1.80.0"
@@ -24,7 +25,7 @@
   },
   "private": true,
   "dependencies": {
-    "@emseepea/server": "0.3.3",
+    "@emseepea/server": "0.6.1",
     "zod": "4.4.3"
   }
 }

package/initializer-dist/template/src/app.ts

@@ -0,0 +1,20 @@
+import {
+  createEmseepea,
+  discoverCapabilities,
+  type AccessPolicy,
+  type EmseepeaExtensions,
+} from "@emseepea/server";
+
+export interface ResourcesAndPromptsServerOptions extends EmseepeaExtensions {
+  readonly access?: AccessPolicy;
+}
+
+export async function createResourcesAndPromptsServer(options: ResourcesAndPromptsServerOptions = {}) {
+  const { access = { access: "public" }, ...extensions } = options;
+  return createEmseepea({
+    name: "emseepea-resources-and-prompts-server",
+    version: "0.0.0",
+    ...await discoverCapabilities(new URL("./capabilities/", import.meta.url), access),
+    ...extensions,
+  });
+}

package/initializer-dist/template/src/capabilities/prompt.growing-guide.ts

@@ -1,9 +1,10 @@
-import { definePrompt, type CapabilityModuleFactory } from "@emseepea/server";
+import { definePrompt, type AccessPolicy, type CapabilityModuleFactory } from "@emseepea/server";
 import { z } from "zod";
 
 const topics = ["sowing-depth", "plant-spacing", "trellis-support"];
 
-export default (() => definePrompt({
+export default ((access) => definePrompt({
+  ...access,
   name: "growing-guide",
   title: "Pea growing guide",
   description: "Create a prompt for a sample pea-growing topic.",
@@ -23,4 +24,4 @@ export default (() => definePrompt({
       },
     }],
   }),
-})) satisfies CapabilityModuleFactory;
+})) satisfies CapabilityModuleFactory<AccessPolicy>;

package/initializer-dist/template/src/capabilities/resource.getting-started.ts

@@ -1,8 +1,9 @@
-import { defineResource, type CapabilityModuleFactory } from "@emseepea/server";
+import { defineResource, type AccessPolicy, type CapabilityModuleFactory } from "@emseepea/server";
 
 const guideUri = "guide://peas/getting-started";
 
-export default (() => defineResource({
+export default ((access) => defineResource({
+  ...access,
   name: "getting-started",
   uri: guideUri,
   title: "Pea growing: getting started",
@@ -15,4 +16,4 @@ export default (() => defineResource({
       text: "# Plant peas clearly\n\nSowing depth is how deep a seed goes; plant spacing is the gap between plants. They are separate choices, not interchangeable measurements.\n",
     }],
   }),
-})) satisfies CapabilityModuleFactory;
+})) satisfies CapabilityModuleFactory<AccessPolicy>;

package/initializer-dist/template/src/capabilities/resource.planting-guide.ts

@@ -1,8 +1,9 @@
-import { defineResourceTemplate, type CapabilityModuleFactory } from "@emseepea/server";
+import { defineResourceTemplate, type AccessPolicy, type CapabilityModuleFactory } from "@emseepea/server";
 
 const methods = ["container", "raised-bed", "row"];
 
-export default (() => defineResourceTemplate({
+export default ((access) => defineResourceTemplate({
+  ...access,
   name: "planting-guide",
   uriTemplate: "guide://peas/planting/{method}",
   title: "Pea planting guide",
@@ -18,4 +19,4 @@ export default (() => defineResourceTemplate({
       text: `# ${String(variables.method)}\n`,
     }],
   }),
-})) satisfies CapabilityModuleFactory;
+})) satisfies CapabilityModuleFactory<AccessPolicy>;

package/initializer-dist/template/src/server.ts

@@ -1,14 +1,9 @@
-import {
-  createEmseepea,
-  discoverCapabilities,
-  serveEmseepea,
-} from "@emseepea/server";
+import { serveEmseepea } from "@emseepea/server";
+import { createResourcesAndPromptsServer } from "./app.js";
 
-const running = await serveEmseepea(createEmseepea({
-  name: "emseepea-resources-and-prompts-server",
-  version: "0.0.0",
-  ...await discoverCapabilities(new URL("./capabilities/", import.meta.url)),
-}), { port: Number.parseInt(process.env.PORT ?? "3000", 10) });
+const running = await serveEmseepea(await createResourcesAndPromptsServer(), {
+  port: Number.parseInt(process.env.PORT ?? "3000", 10),
+});
 
 console.log(`Em See Pea resources and prompts example listening at ${running.url}`);
 

package/initializer-dist/template/test/server.test.mjs

@@ -1,7 +1,12 @@
 import assert from "node:assert/strict";
 import test from "node:test";
 
-import { startMcpServer } from "@emseepea/testing";
+import {
+  insecureTestAuthentication,
+  startEmseepea,
+  startMcpServer,
+} from "@emseepea/testing";
+import { createResourcesAndPromptsServer } from "../dist/app.js";
 
 test("lists and reads the advertised resource and prompt", async (t) => {
   const running = await startMcpServer(t, new URL("../dist/server.js", import.meta.url));
@@ -27,3 +32,17 @@ test("lists and reads the advertised resource and prompt", async (t) => {
   });
   assert.match(prompt.messages[0].content.text, /Explain sowing-depth/);
 });
+
+test("the same template composes protected access and observability", async (t) => {
+  const events = [];
+  const permissions = ["guides:read"];
+  const running = await startEmseepea(t, await createResourcesAndPromptsServer({
+    access: { access: "protected", requiredScopes: permissions },
+    authentication: insecureTestAuthentication(permissions),
+    observability: [{ id: "test-log", emit: (event) => events.push(event) }],
+  }));
+  const client = await running.connect("test-token");
+  assert.deepEqual((await client.listResources()).resources.map(({ name }) => name), ["getting-started"]);
+  assert.deepEqual((await client.listPrompts()).prompts.map(({ name }) => name), ["growing-guide"]);
+  assert.ok(events.some(({ method }) => method === "resources/list"));
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@emseepea/create-resources-and-prompts-server",
-  "version": "0.0.13",
+  "version": "0.0.17",
   "description": "Create an Em See Pea server with resources and prompts.",
   "license": "MIT",
   "type": "module",
@@ -18,9 +18,10 @@
     "prepack": "npm run build:initializer"
   },
   "devDependencies": {
-    "@emseepea/server": "0.3.3",
+    "@emseepea/feedback": "0.2.0",
+    "@emseepea/server": "0.6.1",
     "zod": "4.4.3",
-    "@emseepea/testing": "0.5.3",
+    "@emseepea/testing": "0.9.3",
     "@types/node": "24.13.3",
     "typescript": "6.0.3",
     "oxlint": "1.80.0"