@jokerized/decksmith 0.1.0 → 0.1.2

package/README.md

@@ -336,7 +336,7 @@ turn a document into a deck with the same settings the CLI takes.
 }
 ```
 
-Build it first with `npm run build && npm run build:mcp`. `DECKSMITH_MCP_ROOT` is the fence
+Build it first with `npm run build`. `DECKSMITH_MCP_ROOT` is the fence
 — documents outside it are not readable, and it defaults to your home directory rather than
 the working directory, because not every client launches a stdio server anywhere useful.
 
@@ -408,9 +408,17 @@ consequences worth knowing before you touch anything:
   npmjs.com names `release.yml` exactly, and npm does not check that configuration when
   you save it. Rename the file and publishing fails as an authentication error that says
   nothing about a rename.
+- **So is the environment name.** The job runs in the `release` environment and the
+  trusted publisher requires that claim, which is what stops some *other* workflow in
+  this repository from publishing. Both ends have to say `release`.
 - **`repository.url` in `package.json` must match this repo exactly**, for the same
   reason.
 
+The `release` environment is also where deployment protection lives. It is restricted to
+`v*` **tags**, so a push to a branch cannot reach it. Required reviewers would go here
+too — GitHub gates that rule behind a paid plan for private repositories, so there is no
+human approval step today; anyone who can push a `v*` tag can publish.
+
 ```sh
 npm version minor      # bumps package.json and tags
 git push --follow-tags