v0.4.0

What's Changed

• Serve .well-known discovery documents when the path has a trailing slash by @tomjn in #7
• Consolidate open Dependabot bumps and group future updates by @roborourke in #9
• Cap rest-api/call responses and pass _fields through by @roborourke in #19
• Add a media/upload ability for file uploads by @roborourke in #20
• Pin the Playground site name and add an application password by @roborourke in #21
• Expose both abilities as first-class MCP tools by @roborourke in #23
• Add an MCP client and protocol tests by @roborourke in #24
• Add CRUD, media and permission tests over MCP by @roborourke in #25
• Bump actions/checkout from 4 to 7 in the github-actions group by @dependabot[bot] in #10
• Bump @playwright/test from 1.62.1 to 1.63.0 in the npm-dependencies group by @dependabot[bot] in #11
• Deny permission for unmatched routes by @roborourke in #34
• Filterable policy layer, permissive by default by @roborourke in #35
• Split rest-api/call into read, write, and delete tools by @roborourke in #36
• Route risk classification and confirmation guidance by @roborourke in #37
• Fix stale rest-api-call references left after the tool split by @roborourke in #40
• Add guidance for a route's publishable status field by @roborourke in #41

New Contributors

• @tomjn made their first contribution in #7
• @roborourke made their first contribution in #9
• @dependabot[bot] made their first contribution in #10

Full Changelog: https://github.com/humanmade/hm-rest-ability/commits/v0.4.0