@happyvertical/smrt-template-sveltekit 0.43.2 → 0.43.4

package/README.md

@@ -122,8 +122,10 @@ pnpm smrt generate-mcp --no-config --no-readme
 
 WebMCP registration is documented as an opt-in, per-page integration using
 `collectionDefinitions` from `@happyvertical/smrt-virt-web` and
-`registerWebMcpTools()` from `@happyvertical/smrt-web`. CRUD is wired in
-0.38.25; custom action execution is not yet wired and is documented as such.
+`registerWebMcpTools()` from `@happyvertical/smrt-web`. Generated model tools
+default to read-effect exposure, including custom actions declared as reads.
+Write and destructive effects require explicit opt-in, and all custom actions
+execute through their generated REST routes.
 The CLI's manifest-only `objects` and `schema` commands work in this
 source-first template. Local-object CRUD execution through the generic CLI
 additionally requires a compiled JavaScript project entry point.
@@ -134,9 +136,12 @@ additionally requires a compiled JavaScript project entry point.
 consumer adds it only when a page imports the live collection or WebMCP runtime:
 
 ```bash
-pnpm add @happyvertical/smrt-web@0.38.25
+pnpm add "@happyvertical/smrt-web@$(node -p "require('./package.json').dependencies['@happyvertical/smrt-core']")"
 ```
 
+Run this inside the generated project. It keeps `smrt-web` on the same release
+line as the template's synchronized `smrt-core` dependency.
+
 The generated-project README shows the current hydration pattern:
 `createSmrtCollection(getCollectionDefinition('items'), { initialData,
 basePath: '/api' })` followed by `liveCollection()`. The root layout does not

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@happyvertical/smrt-template-sveltekit",
-  "version": "0.43.2",
+  "version": "0.43.4",
   "description": "Minimal SvelteKit project template with s-m-r-t framework integration",
   "type": "module",
   "main": "index.js",
@@ -29,12 +29,12 @@
     "directory": "packages/template-sveltekit"
   },
   "peerDependencies": {
-    "@happyvertical/smrt-core": "0.43.2"
+    "@happyvertical/smrt-core": "0.43.4"
   },
   "devDependencies": {
     "vitest": "4.1.10",
-    "@happyvertical/smrt-tenancy": "0.43.2",
-    "@happyvertical/smrt-users": "0.43.2"
+    "@happyvertical/smrt-tenancy": "0.43.4",
+    "@happyvertical/smrt-users": "0.43.4"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",

package/template/README.md

@@ -253,9 +253,12 @@ WebMCP is opt-in per browser surface. First add the browser runtime, then put
 registration in a dedicated page that actually exposes tools:
 
 ```bash
-pnpm add @happyvertical/smrt-web@0.38.25
+pnpm add "@happyvertical/smrt-web@$(node -p "require('./package.json').dependencies['@happyvertical/smrt-core']")"
 ```
 
+This derives the version from the generated project's synchronized s-m-r-t release
+pin, so the optional browser runtime stays on the same release line.
+
 ```svelte
 <script lang="ts">
   import { collectionDefinitions } from '@happyvertical/smrt-virt-web';
@@ -274,10 +277,13 @@ pnpm add @happyvertical/smrt-web@0.38.25
 ```
 
 `registerWebMcpTools()` feature-detects browser support and uses the current
-authenticated page session. In 0.38.25, list/get/create/update/delete are wired.
-Generated descriptors for custom actions exist, but custom action execution is
-not yet wired; WebMCP returns a clear result for those actions. Filter to read-only on
-surfaces that should not offer browser mutations.
+authenticated page session. Omitted policy exposes all `read`-effect tools:
+intrinsic `list`/`get` plus custom actions explicitly declared as reads. To
+advertise mutations on a trusted surface, pass an explicit effect allowlist, for
+example `effects: ['read', 'write']`; include `destructive` only where delete and
+destructive custom actions are intended. Generated custom actions execute
+through their authenticated REST routes, and undeclared custom effects fail
+closed as destructive.
 
 ## 9. Add optional live browser data
 

package/template/package.json

@@ -25,16 +25,16 @@
     "svelte-check": "^4.7.2",
     "typescript": "^6.0.3",
     "vite": "^8.1.4",
-    "@happyvertical/smrt-cli": "^0.43.2"
+    "@happyvertical/smrt-cli": "^0.43.4"
   },
   "dependencies": {
-    "@happyvertical/smrt-config": "^0.43.2",
-    "@happyvertical/smrt-core": "^0.43.2",
-    "@happyvertical/smrt-profiles": "^0.43.2",
-    "@happyvertical/smrt-svelte": "^0.43.2",
-    "@happyvertical/smrt-tenancy": "^0.43.2",
-    "@happyvertical/smrt-ui": "^0.43.2",
-    "@happyvertical/smrt-users": "^0.43.2",
+    "@happyvertical/smrt-config": "^0.43.4",
+    "@happyvertical/smrt-core": "^0.43.4",
+    "@happyvertical/smrt-profiles": "^0.43.4",
+    "@happyvertical/smrt-svelte": "^0.43.4",
+    "@happyvertical/smrt-tenancy": "^0.43.4",
+    "@happyvertical/smrt-ui": "^0.43.4",
+    "@happyvertical/smrt-users": "^0.43.4",
     "@modelcontextprotocol/server": "^2.0.0"
   }
 }