Point the quickstart at the published package

README.md

@@ -6,6 +6,7 @@
   <a href="https://github.com/BlockSiFr/ttp-protocol/actions/workflows/ci.yml"><img alt="CI" src="https://github.com/BlockSiFr/ttp-protocol/actions/workflows/ci.yml/badge.svg"></a>
   <img alt="tests" src="https://img.shields.io/badge/tests-123%20passing-00E676?style=flat-square&labelColor=0A0A0F">
   <a href="LICENSE"><img alt="license" src="https://img.shields.io/badge/license-Apache--2.0-0066CC?style=flat-square&labelColor=0A0A0F"></a>
+  <a href="https://www.npmjs.com/package/@blocksifr/pctr"><img alt="npm" src="https://img.shields.io/npm/v/@blocksifr/pctr?style=flat-square&labelColor=0A0A0F&color=00D4FF"></a>
   <img alt="dependencies" src="https://img.shields.io/badge/dependencies-none-00B8A9?style=flat-square&labelColor=0A0A0F">
 </p>
 
@@ -41,9 +42,8 @@ Objective  ->  Trust Route  ->  Consequence Preview  ->  Execution Authority  ->
 | **3. Authority** | Is this exact execution allowed right now? | `pctr protect <action>` |
 
 ```bash
-npm link ./packages/pctr   # not on npm yet; link it from a clone
-pctr init                  # discover agents and tools, write pctr.json
-pctr scan                  # what consequences can they reach?
+npx @blocksifr/pctr init   # discover agents and tools, write pctr.json
+npx @blocksifr/pctr scan   # what consequences can they reach?
 ```
 
 <p align="center">

packages/pctr/README.md

@@ -12,14 +12,13 @@ Objective  ->  Trust Route  ->  Consequence Preview  ->  Execution Authority  ->
 
 <img src="../../assets/pctr-scan.svg" alt="pctr scan finds five agents, three tools and four potential actions, and reports one critical protected consequence: customers.delete can be reached through support-agent and admin-agent without independent execution authority" width="100%">
 
-Not on npm yet — from a clone of this repo:
-
 ```bash
-npm link ./packages/pctr    # then the bare `pctr` command works anywhere
-pctr init                   # discover agents and tools, write pctr.json
-pctr scan                   # what consequences can they reach?
+npx @blocksifr/pctr init    # discover agents and tools, write pctr.json
+npx @blocksifr/pctr scan    # what consequences can they reach?
 ```
 
+Or install it: `npm i -g @blocksifr/pctr`, then just `pctr init` and `pctr scan`.
+
 No account. No network. Everything stays in `./pctr.json` and `./.pctr`.
 
 ## Share what you find

packages/pctr/action.yml

@@ -21,7 +21,7 @@ inputs:
   version:
     description: 'Version of @blocksifr/pctr to run.'
     required: false
-    default: 'latest'
+    default: 'latest'   # published on npm: https://www.npmjs.com/package/@blocksifr/pctr
 
 outputs:
   critical:

packages/pctr/scripts/render-terminal-svg.mjs

@@ -97,7 +97,7 @@ const svg = `<svg xmlns="http://www.w3.org/2000/svg" width="${width}" height="${
   <rect width="${width}" height="${TOP - 10}" rx="10" fill="${THEME.chrome}"/>
   <rect y="${TOP - 20}" width="${width}" height="10" fill="${THEME.chrome}"/>
   <circle cx="24" cy="18" r="5" fill="#FF5F57"/><circle cx="43" cy="18" r="5" fill="#FEBC2E"/><circle cx="62" cy="18" r="5" fill="#28C840"/>
-  <text x="84" y="22" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" font-size="12" fill="${THEME.dim}">pctr scan</text>
+  <text x="84" y="22" font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" font-size="12" fill="${THEME.dim}">npx @blocksifr/pctr scan</text>
   <g font-family="ui-monospace, SFMono-Regular, Menlo, Consolas, monospace" font-size="13.5" fill="${THEME.text}">
 ${body}
   </g>

packages/pctr/src/report.mjs

@@ -85,4 +85,4 @@ export function renderReport(graph, { title = 'PCTR consequence scan', includeBa
 }
 
 const footer = () =>
-  `---\n<sub>Scanned with [PCTR](${HOMEPAGE}) — \`pctr scan\`. Nothing left this machine.</sub>\n`;
+  `---\n<sub>Scanned with [PCTR](${HOMEPAGE}) — \`npx @blocksifr/pctr scan\`. Nothing left this machine.</sub>\n`;