@jokerized/decksmith 0.1.0 → 0.1.1

package/README.md

@@ -408,9 +408,17 @@ consequences worth knowing before you touch anything:
   npmjs.com names `release.yml` exactly, and npm does not check that configuration when
   you save it. Rename the file and publishing fails as an authentication error that says
   nothing about a rename.
+- **So is the environment name.** The job runs in the `release` environment and the
+  trusted publisher requires that claim, which is what stops some *other* workflow in
+  this repository from publishing. Both ends have to say `release`.
 - **`repository.url` in `package.json` must match this repo exactly**, for the same
   reason.
 
+The `release` environment is also where deployment protection lives. It is restricted to
+`v*` **tags**, so a push to a branch cannot reach it. Required reviewers would go here
+too — GitHub gates that rule behind a paid plan for private repositories, so there is no
+human approval step today; anyone who can push a `v*` tag can publish.
+
 ```sh
 npm version minor      # bumps package.json and tags
 git push --follow-tags

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jokerized/decksmith",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Turn a source document into an animated explanation deck.",
   "type": "module",
   "license": "MIT",