@emseepea/create-soap-backed-server 0.0.1 → 0.0.5

package/README.md

@@ -26,6 +26,30 @@ lint checks, ordinary tests, and a semantic test.
 
 <!-- generated-project-readme -->
 
+## Choose Open or Protected Access
+
+Start open when the catalogue and operations are public.
+
+To protect this template, pass both options to the app factory:
+
+- `access: { access: "protected", requiredScopes: ["peas:read"] }`
+- an `authentication` adapter
+
+Keep `authentication.discovery` as `"public"` unless capability names or
+schemas are sensitive. Use `"protected"` only when each principal should see a
+permission-filtered catalogue. OAuth metadata remains public in both modes.
+
+## Add Observability
+
+The same factory accepts `observability`.
+
+- Use `structuredLogging` for safe structured events.
+- Use `openTelemetry` for traces and metrics.
+
+Adapters receive only redacted framework events. They never receive request
+bodies, arguments, results, tokens, provider claims, or raw errors. See the
+[server API](https://github.com/emseepea/emseepea/tree/main/packages/framework#authentication-and-observability) for the complete configuration.
+
 ## SOAP-Backed Server
 
 The committed WSDL defines the operation and imports the committed service XSD.
@@ -77,6 +101,13 @@ service XSD. Public failures contain no provider details.
 `get-pea-variety` retrieves one variety and returns described JSON. The MCP
 caller never sees SOAP XML or chooses transport details.
 
+## Add Feedback
+
+Install `@emseepea/feedback` when this server needs a detailed one-way
+observation or a durable support conversation. Pass its tools through the
+application factory's `additionalTools` option. Choose PostgreSQL, Firestore,
+GitHub Issues, or Zendesk in the [feedback guide](../../packages/feedback/README.md).
+
 ## Check This Project
 
 Run generation, lint, build, and ordinary tests without spending model tokens:

package/initializer-dist/template/README.md

@@ -1,4 +1,28 @@
-# SOAP-Backed Server
+# Choose Open or Protected Access
+
+Start open when the catalogue and operations are public.
+
+To protect this template, pass both options to the app factory:
+
+- `access: { access: "protected", requiredScopes: ["peas:read"] }`
+- an `authentication` adapter
+
+Keep `authentication.discovery` as `"public"` unless capability names or
+schemas are sensitive. Use `"protected"` only when each principal should see a
+permission-filtered catalogue. OAuth metadata remains public in both modes.
+
+## Add Observability
+
+The same factory accepts `observability`.
+
+- Use `structuredLogging` for safe structured events.
+- Use `openTelemetry` for traces and metrics.
+
+Adapters receive only redacted framework events. They never receive request
+bodies, arguments, results, tokens, provider claims, or raw errors. See the
+[server API](https://github.com/emseepea/emseepea/tree/main/packages/framework#authentication-and-observability) for the complete configuration.
+
+## SOAP-Backed Server
 
 The committed WSDL defines the operation and imports the committed service XSD.
 That XSD generates `src/generated/pea-service.ts`. The same XSD is imported by
@@ -49,6 +73,13 @@ service XSD. Public failures contain no provider details.
 `get-pea-variety` retrieves one variety and returns described JSON. The MCP
 caller never sees SOAP XML or chooses transport details.
 
+## Add Feedback
+
+Install `@emseepea/feedback` when this server needs a detailed one-way
+observation or a durable support conversation. Pass its tools through the
+application factory's `additionalTools` option. Choose PostgreSQL, Firestore,
+GitHub Issues, or Zendesk in the [feedback guide](../../packages/feedback/README.md).
+
 ## Check This Project
 
 Run generation, lint, build, and ordinary tests without spending model tokens:

package/initializer-dist/template/eval/meaning.test.mjs

@@ -1,25 +1,37 @@
 import test from "node:test";
 import {
+  assertNoNegativeFeedback,
   assertResponseMeaning,
-  assertToolCalls,
+  assertToolCallsWithOptionalFeedback,
   createConversation,
 } from "@emseepea/testing/semantic";
 import { startSoapFixture } from "../test-support/soap-fixture.mjs";
 
+const server = new URL(import.meta.resolve("@emseepea/feedback/testing-server"));
+
 test("retrieves a pea variety from SOAP through a natural request", async (t) => {
   const fixture = await startSoapFixture(t);
   const chat = await createConversation(t, {
-    server: new URL("../dist/server.js", import.meta.url),
-    environment: { PEA_SOAP_URL: fixture.url.href },
+    server,
+    environment: {
+      PEA_SOAP_URL: fixture.url.href,
+      EMSEEPEA_EVAL_APP_MODULE: new URL("../dist/app.js", import.meta.url).href,
+      EMSEEPEA_EVAL_APP_FACTORY: "createSoapExample",
+      EMSEEPEA_EVAL_APP_KIND: "soap",
+    },
   });
 
   // One turn covers the example's only model-visible decision. XML validation
   // belongs in deterministic tests and would only waste model calls here.
   const result = await chat.send("Tell me about the Sugar Ann pea variety.");
-  assertToolCalls(result, [{ name: "get-pea-variety", arguments: { name: "Sugar Ann" } }]);
+  await assertToolCallsWithOptionalFeedback(result, [{
+    name: "get-pea-variety",
+    arguments: { name: "Sugar Ann" },
+  }]);
   await assertResponseMeaning(result, {
     expected:
       "Sugar Ann is a snap pea that typically matures in 56 days. " +
       "It is an early bush variety with compact plants and edible pods.",
   });
+  assertNoNegativeFeedback(result);
 });

package/initializer-dist/template/package.json

@@ -16,7 +16,8 @@
     "lint": "oxlint src test test-types eval scripts test-support"
   },
   "devDependencies": {
-    "@emseepea/testing": "0.5.3",
+    "@emseepea/feedback": "0.2.0",
+    "@emseepea/testing": "0.9.3",
     "@types/node": "24.13.3",
     "typescript": "6.0.3",
     "oxlint": "1.80.0"
@@ -26,7 +27,7 @@
   },
   "private": true,
   "dependencies": {
-    "@emseepea/server": "0.3.3",
+    "@emseepea/server": "0.6.1",
     "@types/sax": "1.2.7",
     "soap": "1.11.0",
     "xml-xsd-engine": "1.7.3",

package/initializer-dist/template/src/app.ts

@@ -1,11 +1,21 @@
 import { fileURLToPath } from "node:url";
-import { createEmseepea, discoverCapabilities } from "@emseepea/server";
+import {
+  createEmseepea,
+  discoverCapabilities,
+  type AccessPolicy,
+  type EmseepeaExtensions,
+} from "@emseepea/server";
 import { createClientAsync } from "soap";
 import { z } from "zod";
 import { loadSoapEnvelopeSchema } from "./soap-schema.js";
 import { ValidatingHttpClient } from "./validating-http-client.js";
 
-export async function createSoapExample(endpointValue: string) {
+export interface SoapExampleOptions extends EmseepeaExtensions {
+  readonly access?: AccessPolicy;
+}
+
+export async function createSoapExample(endpointValue: string, options: SoapExampleOptions = {}) {
+  const { access = { access: "public" }, ...extensions } = options;
   const endpoint = new URL(z.string().url().parse(endpointValue));
   if (!["http:", "https:"].includes(endpoint.protocol) || endpoint.username || endpoint.password || endpoint.hash) {
     throw new Error("SOAP endpoint must be an HTTP address without credentials or a fragment");
@@ -20,7 +30,8 @@ export async function createSoapExample(endpointValue: string) {
     name: "emseepea-soap-backed-server",
     version: "0.0.0",
     instructions: "Retrieve pea variety details from a legacy SOAP service.",
-    ...await discoverCapabilities(new URL("./capabilities/", import.meta.url), { client }),
+    ...await discoverCapabilities(new URL("./capabilities/", import.meta.url), { client, access }),
+    ...extensions,
   });
   return { app };
 }

package/initializer-dist/template/src/capabilities/context.ts

@@ -1,5 +1,7 @@
 import type { Client } from "soap";
+import type { AccessPolicy } from "@emseepea/server";
 
 export interface SoapExampleContext {
   readonly client: Client;
+  readonly access: AccessPolicy;
 }

package/initializer-dist/template/src/capabilities/tool.get-pea-variety.ts

@@ -1,4 +1,4 @@
-import { defineTool, type CapabilityModuleFactory } from "@emseepea/server";
+import { defineTool, type CapabilityModuleFactory, type ToolContext } from "@emseepea/server";
 import { z } from "zod";
 import type { GetPeaRequest, GetPeaResponse } from "../generated/pea-service.js";
 import type { SoapExampleContext } from "./context.js";
@@ -14,13 +14,13 @@ const outputSchema = z.object({
   traits: z.array(z.string().max(100)).max(5).describe("Growing or eating traits."),
 });
 
-export default (({ client }) => defineTool({
+export default (({ client, access }) => defineTool({
   name: "get-pea-variety",
-  access: "public",
+  ...access,
   description: "Get details about one pea variety.",
   inputSchema,
   outputSchema,
-  async handler({ name }, { signal }) {
+  async handler({ name }, { signal }: ToolContext) {
     signal.throwIfAborted();
     const request: GetPeaRequest = { name };
     const [response] = await client.GetPeaAsync(request, { signal });

package/initializer-dist/template/test/server.test.mjs

@@ -2,7 +2,11 @@ import assert from "node:assert/strict";
 import { readFile } from "node:fs/promises";
 import test from "node:test";
 
-import { startMcpServer } from "@emseepea/testing";
+import {
+  insecureTestAuthentication,
+  startEmseepea,
+  startMcpServer,
+} from "@emseepea/testing";
 import { createSoapExample } from "../dist/app.js";
 import { artifactsFromSources } from "../scripts/generate-types.mjs";
 import { parseSoapEnvelopeSchema } from "../dist/soap-schema.js";
@@ -90,6 +94,22 @@ test("retrieves XSD-validated SOAP data through a described MCP schema", async (
   });
 });
 
+test("the same template composes protected access and observability", async (t) => {
+  const fixture = await startSoapFixture(t);
+  const events = [];
+  const permissions = ["varieties:read"];
+  const { app } = await createSoapExample(fixture.url.href, {
+    access: { access: "protected", requiredScopes: permissions },
+    authentication: insecureTestAuthentication(permissions),
+    observability: [{ id: "test-log", emit: (event) => events.push(event) }],
+  });
+  const running = await startEmseepea(t, app);
+  const client = await running.connect("test-token");
+  const result = await client.callTool({ name: "get-pea-variety", arguments: { name: "Sugar Ann" } });
+  assert.equal(result.isError, false);
+  assert.ok(events.some(({ capability }) => capability === "get-pea-variety"));
+});
+
 test("rejects unsafe and invalid SOAP responses with generic public failures", async (t) => {
   const fixture = await startSoapFixture(t);
   const running = await startMcpServer(t, new URL("../dist/server.js", import.meta.url), {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@emseepea/create-soap-backed-server",
-  "version": "0.0.1",
+  "version": "0.0.5",
   "description": "Create an Em See Pea server that validates a SOAP service from its XSD contract.",
   "license": "MIT",
   "type": "module",
@@ -20,11 +20,12 @@
     "prepack": "npm run build:initializer"
   },
   "devDependencies": {
-    "@emseepea/server": "0.3.3",
+    "@emseepea/feedback": "0.2.0",
+    "@emseepea/server": "0.6.1",
     "soap": "1.11.0",
     "xml-xsd-engine": "1.7.3",
     "zod": "4.4.3",
-    "@emseepea/testing": "0.5.3",
+    "@emseepea/testing": "0.9.3",
     "@types/node": "24.13.3",
     "@types/sax": "1.2.7",
     "typescript": "6.0.3",