yarkr-cli 0.1.0 → 0.1.5

package/dist/yarkr.js

@@ -1206,7 +1206,7 @@ var require_command = __commonJS({
     "use strict";
     var EventEmitter = __require("events").EventEmitter;
     var childProcess = __require("child_process");
-    var path16 = __require("path");
+    var path17 = __require("path");
     var fs = __require("fs");
     var process2 = __require("process");
     var { Argument: Argument2, humanReadableArgName } = require_argument();
@@ -2219,9 +2219,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
         let launchWithNode = false;
         const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
         function findFile(baseDir, baseName) {
-          const localBin = path16.resolve(baseDir, baseName);
+          const localBin = path17.resolve(baseDir, baseName);
           if (fs.existsSync(localBin)) return localBin;
-          if (sourceExt.includes(path16.extname(baseName))) return void 0;
+          if (sourceExt.includes(path17.extname(baseName))) return void 0;
           const foundExt = sourceExt.find(
             (ext) => fs.existsSync(`${localBin}${ext}`)
           );
@@ -2239,17 +2239,17 @@ Expecting one of '${allowedValues.join("', '")}'`);
           } catch {
             resolvedScriptPath = this._scriptPath;
           }
-          executableDir = path16.resolve(
-            path16.dirname(resolvedScriptPath),
+          executableDir = path17.resolve(
+            path17.dirname(resolvedScriptPath),
             executableDir
           );
         }
         if (executableDir) {
           let localFile = findFile(executableDir, executableFile);
           if (!localFile && !subcommand._executableFile && this._scriptPath) {
-            const legacyName = path16.basename(
+            const legacyName = path17.basename(
               this._scriptPath,
-              path16.extname(this._scriptPath)
+              path17.extname(this._scriptPath)
             );
             if (legacyName !== this._name) {
               localFile = findFile(
@@ -2260,7 +2260,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
           }
           executableFile = localFile || executableFile;
         }
-        launchWithNode = sourceExt.includes(path16.extname(executableFile));
+        launchWithNode = sourceExt.includes(path17.extname(executableFile));
         let proc;
         if (process2.platform !== "win32") {
           if (launchWithNode) {
@@ -3175,7 +3175,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @return {Command}
        */
       nameFromFilename(filename) {
-        this._name = path16.basename(filename, path16.extname(filename));
+        this._name = path17.basename(filename, path17.extname(filename));
         return this;
       }
       /**
@@ -3189,9 +3189,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
        * @param {string} [path]
        * @return {(string|null|Command)}
        */
-      executableDir(path17) {
-        if (path17 === void 0) return this._executableDir;
-        this._executableDir = path17;
+      executableDir(path18) {
+        if (path18 === void 0) return this._executableDir;
+        this._executableDir = path18;
         return this;
       }
       /**
@@ -3547,17 +3547,17 @@ var require_visit = __commonJS({
     visit2.BREAK = BREAK;
     visit2.SKIP = SKIP2;
     visit2.REMOVE = REMOVE;
-    function visit_(key, node2, visitor, path16) {
-      const ctrl = callVisitor(key, node2, visitor, path16);
+    function visit_(key, node2, visitor, path17) {
+      const ctrl = callVisitor(key, node2, visitor, path17);
       if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-        replaceNode(key, path16, ctrl);
-        return visit_(key, ctrl, visitor, path16);
+        replaceNode(key, path17, ctrl);
+        return visit_(key, ctrl, visitor, path17);
       }
       if (typeof ctrl !== "symbol") {
         if (identity.isCollection(node2)) {
-          path16 = Object.freeze(path16.concat(node2));
+          path17 = Object.freeze(path17.concat(node2));
           for (let i = 0; i < node2.items.length; ++i) {
-            const ci = visit_(i, node2.items[i], visitor, path16);
+            const ci = visit_(i, node2.items[i], visitor, path17);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -3568,13 +3568,13 @@ var require_visit = __commonJS({
             }
           }
         } else if (identity.isPair(node2)) {
-          path16 = Object.freeze(path16.concat(node2));
-          const ck = visit_("key", node2.key, visitor, path16);
+          path17 = Object.freeze(path17.concat(node2));
+          const ck = visit_("key", node2.key, visitor, path17);
           if (ck === BREAK)
             return BREAK;
           else if (ck === REMOVE)
             node2.key = null;
-          const cv = visit_("value", node2.value, visitor, path16);
+          const cv = visit_("value", node2.value, visitor, path17);
           if (cv === BREAK)
             return BREAK;
           else if (cv === REMOVE)
@@ -3595,17 +3595,17 @@ var require_visit = __commonJS({
     visitAsync.BREAK = BREAK;
     visitAsync.SKIP = SKIP2;
     visitAsync.REMOVE = REMOVE;
-    async function visitAsync_(key, node2, visitor, path16) {
-      const ctrl = await callVisitor(key, node2, visitor, path16);
+    async function visitAsync_(key, node2, visitor, path17) {
+      const ctrl = await callVisitor(key, node2, visitor, path17);
       if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-        replaceNode(key, path16, ctrl);
-        return visitAsync_(key, ctrl, visitor, path16);
+        replaceNode(key, path17, ctrl);
+        return visitAsync_(key, ctrl, visitor, path17);
       }
       if (typeof ctrl !== "symbol") {
         if (identity.isCollection(node2)) {
-          path16 = Object.freeze(path16.concat(node2));
+          path17 = Object.freeze(path17.concat(node2));
           for (let i = 0; i < node2.items.length; ++i) {
-            const ci = await visitAsync_(i, node2.items[i], visitor, path16);
+            const ci = await visitAsync_(i, node2.items[i], visitor, path17);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -3616,13 +3616,13 @@ var require_visit = __commonJS({
             }
           }
         } else if (identity.isPair(node2)) {
-          path16 = Object.freeze(path16.concat(node2));
-          const ck = await visitAsync_("key", node2.key, visitor, path16);
+          path17 = Object.freeze(path17.concat(node2));
+          const ck = await visitAsync_("key", node2.key, visitor, path17);
           if (ck === BREAK)
             return BREAK;
           else if (ck === REMOVE)
             node2.key = null;
-          const cv = await visitAsync_("value", node2.value, visitor, path16);
+          const cv = await visitAsync_("value", node2.value, visitor, path17);
           if (cv === BREAK)
             return BREAK;
           else if (cv === REMOVE)
@@ -3649,23 +3649,23 @@ var require_visit = __commonJS({
       }
       return visitor;
     }
-    function callVisitor(key, node2, visitor, path16) {
+    function callVisitor(key, node2, visitor, path17) {
       if (typeof visitor === "function")
-        return visitor(key, node2, path16);
+        return visitor(key, node2, path17);
       if (identity.isMap(node2))
-        return visitor.Map?.(key, node2, path16);
+        return visitor.Map?.(key, node2, path17);
       if (identity.isSeq(node2))
-        return visitor.Seq?.(key, node2, path16);
+        return visitor.Seq?.(key, node2, path17);
       if (identity.isPair(node2))
-        return visitor.Pair?.(key, node2, path16);
+        return visitor.Pair?.(key, node2, path17);
       if (identity.isScalar(node2))
-        return visitor.Scalar?.(key, node2, path16);
+        return visitor.Scalar?.(key, node2, path17);
       if (identity.isAlias(node2))
-        return visitor.Alias?.(key, node2, path16);
+        return visitor.Alias?.(key, node2, path17);
       return void 0;
     }
-    function replaceNode(key, path16, node2) {
-      const parent = path16[path16.length - 1];
+    function replaceNode(key, path17, node2) {
+      const parent = path17[path17.length - 1];
       if (identity.isCollection(parent)) {
         parent.items[key] = node2;
       } else if (identity.isPair(parent)) {
@@ -4277,10 +4277,10 @@ var require_Collection = __commonJS({
     var createNode = require_createNode();
     var identity = require_identity();
     var Node = require_Node();
-    function collectionFromPath(schema, path16, value) {
+    function collectionFromPath(schema, path17, value) {
       let v = value;
-      for (let i = path16.length - 1; i >= 0; --i) {
-        const k = path16[i];
+      for (let i = path17.length - 1; i >= 0; --i) {
+        const k = path17[i];
         if (typeof k === "number" && Number.isInteger(k) && k >= 0) {
           const a = [];
           a[k] = v;
@@ -4299,7 +4299,7 @@ var require_Collection = __commonJS({
         sourceObjects: /* @__PURE__ */ new Map()
       });
     }
-    var isEmptyPath = (path16) => path16 == null || typeof path16 === "object" && !!path16[Symbol.iterator]().next().done;
+    var isEmptyPath = (path17) => path17 == null || typeof path17 === "object" && !!path17[Symbol.iterator]().next().done;
     var Collection = class extends Node.NodeBase {
       constructor(type, schema) {
         super(type);
@@ -4329,11 +4329,11 @@ var require_Collection = __commonJS({
        * be a Pair instance or a `{ key, value }` object, which may not have a key
        * that already exists in the map.
        */
-      addIn(path16, value) {
-        if (isEmptyPath(path16))
+      addIn(path17, value) {
+        if (isEmptyPath(path17))
           this.add(value);
         else {
-          const [key, ...rest] = path16;
+          const [key, ...rest] = path17;
           const node2 = this.get(key, true);
           if (identity.isCollection(node2))
             node2.addIn(rest, value);
@@ -4347,8 +4347,8 @@ var require_Collection = __commonJS({
        * Removes a value from the collection.
        * @returns `true` if the item was found and removed.
        */
-      deleteIn(path16) {
-        const [key, ...rest] = path16;
+      deleteIn(path17) {
+        const [key, ...rest] = path17;
         if (rest.length === 0)
           return this.delete(key);
         const node2 = this.get(key, true);
@@ -4362,8 +4362,8 @@ var require_Collection = __commonJS({
        * scalar values from their surrounding node; to disable set `keepScalar` to
        * `true` (collections are always returned intact).
        */
-      getIn(path16, keepScalar) {
-        const [key, ...rest] = path16;
+      getIn(path17, keepScalar) {
+        const [key, ...rest] = path17;
         const node2 = this.get(key, true);
         if (rest.length === 0)
           return !keepScalar && identity.isScalar(node2) ? node2.value : node2;
@@ -4381,8 +4381,8 @@ var require_Collection = __commonJS({
       /**
        * Checks if the collection includes a value with the key `key`.
        */
-      hasIn(path16) {
-        const [key, ...rest] = path16;
+      hasIn(path17) {
+        const [key, ...rest] = path17;
         if (rest.length === 0)
           return this.has(key);
         const node2 = this.get(key, true);
@@ -4392,8 +4392,8 @@ var require_Collection = __commonJS({
        * Sets a value in this collection. For `!!set`, `value` needs to be a
        * boolean to add/remove the item from the set.
        */
-      setIn(path16, value) {
-        const [key, ...rest] = path16;
+      setIn(path17, value) {
+        const [key, ...rest] = path17;
         if (rest.length === 0) {
           this.set(key, value);
         } else {
@@ -6908,9 +6908,9 @@ var require_Document = __commonJS({
           this.contents.add(value);
       }
       /** Adds a value to the document. */
-      addIn(path16, value) {
+      addIn(path17, value) {
         if (assertCollection(this.contents))
-          this.contents.addIn(path16, value);
+          this.contents.addIn(path17, value);
       }
       /**
        * Create a new `Alias` node, ensuring that the target `node` has the required anchor.
@@ -6985,14 +6985,14 @@ var require_Document = __commonJS({
        * Removes a value from the document.
        * @returns `true` if the item was found and removed.
        */
-      deleteIn(path16) {
-        if (Collection.isEmptyPath(path16)) {
+      deleteIn(path17) {
+        if (Collection.isEmptyPath(path17)) {
           if (this.contents == null)
             return false;
           this.contents = null;
           return true;
         }
-        return assertCollection(this.contents) ? this.contents.deleteIn(path16) : false;
+        return assertCollection(this.contents) ? this.contents.deleteIn(path17) : false;
       }
       /**
        * Returns item at `key`, or `undefined` if not found. By default unwraps
@@ -7007,10 +7007,10 @@ var require_Document = __commonJS({
        * scalar values from their surrounding node; to disable set `keepScalar` to
        * `true` (collections are always returned intact).
        */
-      getIn(path16, keepScalar) {
-        if (Collection.isEmptyPath(path16))
+      getIn(path17, keepScalar) {
+        if (Collection.isEmptyPath(path17))
           return !keepScalar && identity.isScalar(this.contents) ? this.contents.value : this.contents;
-        return identity.isCollection(this.contents) ? this.contents.getIn(path16, keepScalar) : void 0;
+        return identity.isCollection(this.contents) ? this.contents.getIn(path17, keepScalar) : void 0;
       }
       /**
        * Checks if the document includes a value with the key `key`.
@@ -7021,10 +7021,10 @@ var require_Document = __commonJS({
       /**
        * Checks if the document includes a value at `path`.
        */
-      hasIn(path16) {
-        if (Collection.isEmptyPath(path16))
+      hasIn(path17) {
+        if (Collection.isEmptyPath(path17))
           return this.contents !== void 0;
-        return identity.isCollection(this.contents) ? this.contents.hasIn(path16) : false;
+        return identity.isCollection(this.contents) ? this.contents.hasIn(path17) : false;
       }
       /**
        * Sets a value in this document. For `!!set`, `value` needs to be a
@@ -7041,13 +7041,13 @@ var require_Document = __commonJS({
        * Sets a value in this document. For `!!set`, `value` needs to be a
        * boolean to add/remove the item from the set.
        */
-      setIn(path16, value) {
-        if (Collection.isEmptyPath(path16)) {
+      setIn(path17, value) {
+        if (Collection.isEmptyPath(path17)) {
           this.contents = value;
         } else if (this.contents == null) {
-          this.contents = Collection.collectionFromPath(this.schema, Array.from(path16), value);
+          this.contents = Collection.collectionFromPath(this.schema, Array.from(path17), value);
         } else if (assertCollection(this.contents)) {
-          this.contents.setIn(path16, value);
+          this.contents.setIn(path17, value);
         }
       }
       /**
@@ -9008,9 +9008,9 @@ var require_cst_visit = __commonJS({
     visit2.BREAK = BREAK;
     visit2.SKIP = SKIP2;
     visit2.REMOVE = REMOVE;
-    visit2.itemAtPath = (cst, path16) => {
+    visit2.itemAtPath = (cst, path17) => {
       let item = cst;
-      for (const [field, index2] of path16) {
+      for (const [field, index2] of path17) {
         const tok = item?.[field];
         if (tok && "items" in tok) {
           item = tok.items[index2];
@@ -9019,23 +9019,23 @@ var require_cst_visit = __commonJS({
       }
       return item;
     };
-    visit2.parentCollection = (cst, path16) => {
-      const parent = visit2.itemAtPath(cst, path16.slice(0, -1));
-      const field = path16[path16.length - 1][0];
+    visit2.parentCollection = (cst, path17) => {
+      const parent = visit2.itemAtPath(cst, path17.slice(0, -1));
+      const field = path17[path17.length - 1][0];
       const coll = parent?.[field];
       if (coll && "items" in coll)
         return coll;
       throw new Error("Parent collection not found");
     };
-    function _visit(path16, item, visitor) {
-      let ctrl = visitor(item, path16);
+    function _visit(path17, item, visitor) {
+      let ctrl = visitor(item, path17);
       if (typeof ctrl === "symbol")
         return ctrl;
       for (const field of ["key", "value"]) {
         const token = item[field];
         if (token && "items" in token) {
           for (let i = 0; i < token.items.length; ++i) {
-            const ci = _visit(Object.freeze(path16.concat([[field, i]])), token.items[i], visitor);
+            const ci = _visit(Object.freeze(path17.concat([[field, i]])), token.items[i], visitor);
             if (typeof ci === "number")
               i = ci - 1;
             else if (ci === BREAK)
@@ -9046,10 +9046,10 @@ var require_cst_visit = __commonJS({
             }
           }
           if (typeof ctrl === "function" && field === "key")
-            ctrl = ctrl(item, path16);
+            ctrl = ctrl(item, path17);
         }
       }
-      return typeof ctrl === "function" ? ctrl(item, path16) : ctrl;
+      return typeof ctrl === "function" ? ctrl(item, path17) : ctrl;
     }
     exports.visit = visit2;
   }
@@ -16023,8 +16023,8 @@ var require_utils = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path16) {
-      let input2 = path16;
+    function removeDotSegments(path17) {
+      let input2 = path17;
       const output3 = [];
       let nextSlash = -1;
       let len = 0;
@@ -16433,8 +16433,8 @@ var require_schemes = __commonJS({
       }
       if (wsComponent.resourceName) {
         const queryIndex = wsComponent.resourceName.indexOf("?");
-        const path16 = queryIndex === -1 ? wsComponent.resourceName : wsComponent.resourceName.slice(0, queryIndex);
-        wsComponent.path = path16 && path16 !== "/" ? path16 : void 0;
+        const path17 = queryIndex === -1 ? wsComponent.resourceName : wsComponent.resourceName.slice(0, queryIndex);
+        wsComponent.path = path17 && path17 !== "/" ? path17 : void 0;
         wsComponent.query = queryIndex === -1 ? void 0 : wsComponent.resourceName.slice(queryIndex + 1);
         wsComponent.resourceName = void 0;
       }
@@ -20476,10 +20476,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path16) {
-  if (!path16)
+function getElementAtPath(obj, path17) {
+  if (!path17)
     return obj;
-  return path16.reduce((acc, key) => acc?.[key], obj);
+  return path17.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -20819,11 +20819,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path16, issues) {
+function prefixIssues(path17, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path16);
+    iss.path.unshift(path17);
     return iss;
   });
 }
@@ -21273,16 +21273,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path16 = []) => {
+  const processError = (error63, path17 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path16, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path17, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path16, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path17, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path16, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path17, ...issue2.path]);
       } else {
-        const fullpath = [...path16, ...issue2.path];
+        const fullpath = [...path17, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -21321,17 +21321,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error63, path16 = []) => {
+  const processError = (error63, path17 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path16, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path17, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path16, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path17, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path16, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path17, ...issue2.path]);
       } else {
-        const fullpath = [...path16, ...issue2.path];
+        const fullpath = [...path17, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -21370,8 +21370,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path16 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path16) {
+  const path17 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path17) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -38473,13 +38473,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path16 = ref.slice(1).split("/").filter(Boolean);
-  if (path16.length === 0) {
+  const path17 = ref.slice(1).split("/").filter(Boolean);
+  if (path17.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path16[0] === defsKey) {
-    const key = path16[1] === void 0 ? void 0 : decodeJSONPointerSegment(path16[1]);
+  if (path17[0] === defsKey) {
+    const key = path17[1] === void 0 ? void 0 : decodeJSONPointerSegment(path17[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -39329,47 +39329,14 @@ function date4(params) {
 }
 
 // ../../packages/schema/dist/harness.js
-var HARNESS_IDS = [
-  "claude-code",
-  "claude-cowork",
-  "codex",
-  "opencode",
-  "cursor",
-  "openai-agents-sdk",
-  "linear",
-  "notion",
-  "custom-http",
-  "generic"
-];
+var HARNESS_IDS = ["claude-code", "codex", "opencode", "cursor", "generic"];
 var HarnessId = external_exports.enum(HARNESS_IDS);
+var isHarnessId = (id) => HARNESS_IDS.includes(id);
 var HARNESSES = {
   "claude-code": { id: "claude-code", label: "Claude Code", delivery: ["native-folder", "mcp"], evalAdapter: "native" },
-  "claude-cowork": {
-    id: "claude-cowork",
-    label: "Claude Cowork",
-    delivery: ["native-folder", "mcp"],
-    evalAdapter: "equivalent",
-    notes: "Evaluated through the Claude Agent SDK; results are labelled harness-equivalent."
-  },
   codex: { id: "codex", label: "Codex", delivery: ["native-folder", "mcp"], evalAdapter: "native" },
   opencode: { id: "opencode", label: "opencode", delivery: ["native-folder", "mcp"], evalAdapter: "native" },
   cursor: { id: "cursor", label: "Cursor", delivery: ["native-folder", "mcp"], evalAdapter: "none" },
-  "openai-agents-sdk": { id: "openai-agents-sdk", label: "OpenAI Agents SDK", delivery: ["native-folder"], evalAdapter: "none" },
-  linear: {
-    id: "linear",
-    label: "Linear agents",
-    delivery: ["export-bundle", "mcp"],
-    evalAdapter: "none",
-    notes: "Rendered as an instruction bundle for Linear agent guidance."
-  },
-  notion: {
-    id: "notion",
-    label: "Notion agents",
-    delivery: ["export-bundle", "mcp"],
-    evalAdapter: "none",
-    notes: "Rendered as an instruction page for Notion agent instructions."
-  },
-  "custom-http": { id: "custom-http", label: "Custom HTTP", delivery: ["http", "mcp"], evalAdapter: "native" },
   generic: { id: "generic", label: "Generic folder", delivery: ["native-folder"], evalAdapter: "none" }
 };
 
@@ -39388,8 +39355,8 @@ var AgentSpec = external_exports.object({
   tools: external_exports.array(external_exports.string()).default([]),
   subagents: external_exports.array(PackageName).default([]),
   parameters: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
-  /** Per-harness overrides merged into the rendered output. */
-  render: external_exports.partialRecord(HarnessId, external_exports.record(external_exports.string(), external_exports.unknown())).optional()
+  /** Per-harness overrides merged into the rendered output, keyed by harness id; unknown harnesses are ignored. */
+  render: external_exports.record(external_exports.string(), external_exports.record(external_exports.string(), external_exports.unknown())).optional()
 });
 var McpServerConfig = external_exports.object({
   name: external_exports.string(),
@@ -39419,7 +39386,8 @@ var Manifest = external_exports.object({
   version: SemVer,
   description: external_exports.string().min(1).max(500),
   owners: external_exports.array(Principal).min(1),
-  targets: external_exports.array(HarnessId).min(1),
+  /** Harnesses this package is for. Ids this build doesn't know (another harness, or one Yarkr dropped) are ignored. */
+  targets: external_exports.preprocess((v) => Array.isArray(v) ? v.filter((t) => typeof t !== "string" || isHarnessId(t)) : v, external_exports.array(HarnessId).min(1, "List at least one supported harness in targets")),
   tags: external_exports.array(external_exports.string()).default([]),
   depends: external_exports.object({
     skills: DependencyMap.optional(),
@@ -39485,7 +39453,7 @@ var EvalSuite = external_exports.object({
   cases: external_exports.array(EvalCase).min(1),
   thresholds: Thresholds.default({ pass_rate: ">= baseline - 0.02", no_new_failures_on: ["critical"] })
 });
-var EvalRunStatus = external_exports.enum(["queued", "running", "passed", "failed", "error", "cancelled"]);
+var EvalRunStatus = external_exports.enum(["passed", "failed", "error"]);
 var EvalMode = external_exports.enum(["smoke", "full"]);
 
 // ../../packages/schema/dist/api.js
@@ -39513,7 +39481,7 @@ var PackageQuery = external_exports.object({
   limit: external_exports.coerce.number().int().min(1).max(200).default(50),
   offset: external_exports.coerce.number().int().min(0).default(0)
 });
-var StartEvalBody = external_exports.object({ mode: EvalMode.default("smoke") });
+var YankBody = external_exports.object({ reason: external_exports.string().min(1).max(500) });
 var ImportedTrial = external_exports.object({
   suite: external_exports.string(),
   case_id: external_exports.string(),
@@ -39546,14 +39514,16 @@ var EvalImportBody = external_exports.object({
 });
 var ConnectRepoBody = external_exports.object({
   connected: external_exports.boolean().default(true),
-  /** Defaults to the org slug. Created in the org when it doesn't exist yet. */
-  namespace: external_exports.string().regex(/^[a-z0-9][a-z0-9-]*$/).optional(),
   /** Defaults: `public` for public repos, `restricted` for private ones. Public repos are always `public`. */
   classification: Classification.optional(),
   root_path: external_exports.string().max(200).optional()
 });
 var AuditQuery = external_exports.object({
   package: external_exports.string().optional(),
+  /** `me`: only what you did yourself. Anyone may read their own events. */
+  actor: external_exports.literal("me").optional(),
+  /** An org slug: its members, arks, repos and packages. For that org's admins. */
+  org: external_exports.string().optional(),
   action: external_exports.string().optional(),
   from: external_exports.string().datetime().optional(),
   to: external_exports.string().datetime().optional(),
@@ -39569,18 +39539,11 @@ var CreateUserBody = external_exports.object({
 });
 var OrgRole = external_exports.enum(["member", "admin"]);
 var Slug = external_exports.string().regex(/^[a-z0-9][a-z0-9-]*$/, "Use lowercase letters, digits and dashes");
-var CreateOrgNamespaceBody = external_exports.object({
-  name: external_exports.string().regex(/^[a-z0-9][a-z0-9-]*$/).max(64),
-  description: external_exports.string().max(500).default("")
-});
 var CreateOrgBody = external_exports.object({
-  slug: Slug.refine((s) => s !== "global", '"global" is reserved for global arks'),
+  slug: Slug,
   name: external_exports.string().min(1).max(120)
 });
-var UpdateOrgBody = external_exports.object({
-  name: external_exports.string().min(1).max(120).optional(),
-  allow_personal_additions: external_exports.boolean().optional()
-});
+var UpdateOrgBody = external_exports.object({ name: external_exports.string().min(1).max(120).optional() });
 var OrgMemberBody = external_exports.object({ email: external_exports.string().email(), role: OrgRole.default("member") });
 var ArkServerOverride = external_exports.object({
   env: external_exports.record(external_exports.string(), external_exports.string()).optional(),
@@ -39591,13 +39554,11 @@ var ArkServerOverride = external_exports.object({
 var ArkItemConfig = external_exports.object({ servers: external_exports.record(external_exports.string(), ArkServerOverride).optional() });
 var CreateArkBody = external_exports.object({
   name: Slug,
-  description: external_exports.string().max(500).default(""),
-  idp_group: external_exports.string().nullable().optional()
+  description: external_exports.string().max(500).default("")
 });
 var UpdateArkBody = external_exports.object({
   description: external_exports.string().max(500).optional(),
-  idp_group: external_exports.string().nullable().optional(),
-  /** Public arks are visible to everyone and can go into anyone's collection. They may only hold public packages. */
+  /** Anyone can see and use a public ark, signed in or not. It may only hold public packages. */
   public: external_exports.boolean().optional()
 });
 var ArkItemBody = external_exports.object({
@@ -39612,30 +39573,14 @@ var EffectiveArkQuery = external_exports.object({
   /** Comma-separated ark refs to narrow to; omit for all. */
   arks: external_exports.string().optional()
 });
-var CollectionVisibility = external_exports.enum(["private", "org", "public"]);
-var COLLECTION_REF = /^@([a-z0-9][a-z0-9-]*)\/([a-z0-9][a-z0-9-]*)(?:@([1-9][0-9]*))?$/;
-function parseCollectionRef(ref) {
-  const m = COLLECTION_REF.exec(ref);
-  return m ? { handle: m[1], name: m[2], version: m[3] ? Number(m[3]) : null } : null;
-}
-var CreateCollectionBody = external_exports.object({
-  name: Slug,
-  description: external_exports.string().max(500).default(""),
-  visibility: CollectionVisibility.default("private"),
-  /** Required for `org` visibility: the org whose members may use it. */
-  org: external_exports.string().optional()
-});
-var UpdateCollectionBody = external_exports.object({
-  description: external_exports.string().max(500).optional(),
-  visibility: CollectionVisibility.optional(),
-  org: external_exports.string().optional()
-});
-var CollectionArkBody = external_exports.object({ ark: external_exports.string().min(1) });
-var PublishCollectionBody = external_exports.object({ note: external_exports.string().max(500).default("") });
 var PersonalItemBody = external_exports.object({ package: PackageName, range: external_exports.string().nullable().optional() });
 var ExclusionBody = external_exports.object({ ark: external_exports.string(), package: PackageName });
 
 // src/commands/auth.ts
+import { spawn } from "child_process";
+import { randomBytes } from "crypto";
+import { createServer } from "http";
+import os3 from "os";
 import { createInterface } from "readline/promises";
 import path3 from "path";
 import { Writable } from "stream";
@@ -39797,8 +39742,8 @@ var Api = class {
     this.conn = conn;
   }
   conn;
-  async request(method, path16, body, { allow404 = false } = {}) {
-    const url2 = `${this.conn.server}/api/v1${path16}`;
+  async request(method, path17, body, { allow404 = false } = {}) {
+    const url2 = `${this.conn.server}/api/v1${path17}`;
     let res;
     try {
       res = await fetch(url2, {
@@ -39820,7 +39765,7 @@ var Api = class {
         payload = await res.json();
       } catch {
       }
-      const msg = payload.message ?? `${method} ${path16} failed with HTTP ${res.status}.`;
+      const msg = payload.message ?? `${method} ${path17} failed with HTTP ${res.status}.`;
       if (res.status === 401) {
         throw new CliError(
           msg,
@@ -39835,6 +39780,8 @@ ${JSON.stringify(payload.details, null, 2)}` : "";
   }
   info = () => this.request("GET", "/info");
   me = () => this.request("GET", "/me");
+  /** Revokes the token this client is using (`yarkr logout`). */
+  revokeCurrentToken = () => this.request("DELETE", "/tokens/current");
   search = (q) => {
     const qs = new URLSearchParams(Object.entries(q).filter((e) => !!e[1])).toString();
     return this.request("GET", `/packages${qs ? `?${qs}` : ""}`);
@@ -39845,23 +39792,22 @@ ${JSON.stringify(payload.details, null, 2)}` : "";
     const qs = new URLSearchParams({ channel: opts.channel, ...opts.range ? { range: opts.range } : {} });
     return this.request("GET", `/packages/${split(name)}/resolve?${qs}`);
   };
-  bundle = (name, version2) => this.request("GET", `/packages/${split(name)}/releases/${encodeURIComponent(version2)}/bundle`);
+  /** A whole release. `sync` marks a fetch that installs it, which the hub counts as a download. */
+  bundle = (name, version2, { sync: sync2 = false } = {}) => this.request("GET", `/packages/${split(name)}/releases/${encodeURIComponent(version2)}/bundle${sync2 ? "?use=sync" : ""}`);
   signingKey = () => this.request("GET", "/signing-key", void 0, { allow404: true });
-  /** The caller's effective set: global ∪ org arks ∪ personal ark. `only` narrows to some ark refs. */
+  /** The caller's effective set: org arks ∪ personal ark. `only` narrows to some ark refs. */
   myArk = (only) => this.request("GET", `/me/ark${only?.length ? `?arks=${encodeURIComponent(only.join(","))}` : ""}`);
-  collections = () => this.request("GET", "/me/collections");
-  collection = (name) => this.request("GET", `/me/collections/${encodeURIComponent(name)}`);
-  createCollection = (body) => this.request("POST", "/me/collections", body);
-  updateCollection = (name, body) => this.request("PATCH", `/me/collections/${encodeURIComponent(name)}`, body);
-  deleteCollection = (name) => this.request("DELETE", `/me/collections/${encodeURIComponent(name)}`);
-  addCollectionArk = (name, ark) => this.request("POST", `/me/collections/${encodeURIComponent(name)}/arks`, { ark });
-  removeCollectionArk = (name, ark) => this.request("DELETE", `/me/collections/${encodeURIComponent(name)}/arks`, { ark });
-  publishCollection = (name, note = "") => this.request("POST", `/me/collections/${encodeURIComponent(name)}/versions`, { note });
-  /** A published collection version by ref: `@ana/pdf` (latest) or `@ana/pdf@3`. Works without a token for public ones. */
-  readCollection = (ref) => {
-    const [handle, rest] = [ref.slice(0, ref.indexOf("/")), ref.slice(ref.indexOf("/") + 1)];
-    return this.request("GET", `/collections/${encodeURIComponent(handle)}/${encodeURIComponent(rest)}`);
+  /**
+   * One ark by ref (`<org>/<ark>`): yours, or a public one, which works without a token. `sync` marks a fetch that
+   * installs it, which the hub counts to rank public arks.
+   */
+  ark = (ref, { sync: sync2 = false } = {}) => {
+    const [org, name, extra] = ref.split("/");
+    if (!org || !name || extra !== void 0 || ref.startsWith("@")) throw new CliError(`"${ref}" isn't an ark.`, "Arks look like <org>/<ark>, e.g. acme/finance; @me is your personal ark.");
+    return this.request("GET", `/arks/${encodeURIComponent(org)}/${encodeURIComponent(name)}${sync2 ? "?use=sync" : ""}`);
   };
+  /** Yank a release (org admins), or undo it with `reason: null`. */
+  yank = (name, version2, reason) => this.request(reason === null ? "DELETE" : "POST", `/packages/${split(name)}/releases/${encodeURIComponent(version2)}/yank`, reason === null ? void 0 : { reason });
   publicArks = () => this.request("GET", "/arks/public");
   addPersonal = (name, range) => this.request("POST", "/me/ark/items", { package: name, range: range ?? null });
   removePersonal = (name) => this.request("DELETE", `/me/ark/items/${split(name)}`);
@@ -39910,17 +39856,17 @@ function parseManifest(text) {
   }
   return manifest;
 }
-function parseEvalSuite(text, path16 = "suite") {
+function parseEvalSuite(text, path17 = "suite") {
   let raw;
   try {
     raw = import_yaml.default.parse(text);
   } catch (err) {
-    throw new ManifestError(`${path16} is not valid YAML: ${err.message}`);
+    throw new ManifestError(`${path17} is not valid YAML: ${err.message}`);
   }
   const res = EvalSuite.safeParse(raw);
   if (!res.success) {
     const issues = res.error.issues.map((i) => ({ path: i.path.join("."), message: i.message }));
-    throw new ManifestError(`${path16} is invalid: ${issues.map((i) => `${i.path}: ${i.message}`).join("; ")}`, issues);
+    throw new ManifestError(`${path17} is invalid: ${issues.map((i) => `${i.path}: ${i.message}`).join("; ")}`, issues);
   }
   return res.data;
 }
@@ -39977,8 +39923,8 @@ function asText(content) {
     return null;
   return typeof content === "string" ? content : new TextDecoder().decode(content);
 }
-function isYarkrOnly(path16) {
-  return path16 === MANIFEST_FILE || path16.startsWith("evals/") || path16.startsWith("fixtures/");
+function isYarkrOnly(path17) {
+  return path17 === MANIFEST_FILE || path17.startsWith("evals/") || path17.startsWith("fixtures/");
 }
 function skillEntryPath(m) {
   return m.entry ?? "SKILL.md";
@@ -40006,10 +39952,10 @@ ${body.replace(/^\n+/, "")}`);
 function skillFolderFiles(pkg, dir, folderName) {
   const entry = skillEntryPath(pkg.manifest);
   const files = [{ package: pkg.manifest.name, path: join(dir, folderName, "SKILL.md"), content: renderSkillMd(pkg, folderName) }];
-  for (const [path16, content] of Object.entries(pkg.files)) {
-    if (path16 === entry || path16 === "SKILL.md" || isYarkrOnly(path16))
+  for (const [path17, content] of Object.entries(pkg.files)) {
+    if (path17 === entry || path17 === "SKILL.md" || isYarkrOnly(path17))
       continue;
-    files.push({ package: pkg.manifest.name, path: join(dir, folderName, path16), content });
+    files.push({ package: pkg.manifest.name, path: join(dir, folderName, path17), content });
   }
   return files;
 }
@@ -40078,20 +40024,6 @@ function standardMcpEntry(pkg, s, style, notes, withType) {
 function clean(o) {
   return Object.fromEntries(Object.entries(o).filter(([, v]) => v !== void 0));
 }
-function inlineMarkdown(pkg, skip) {
-  const parts = [];
-  for (const [path16, content] of Object.entries(pkg.files).sort(([a], [b]) => a < b ? -1 : 1)) {
-    if (skip.has(path16) || isYarkrOnly(path16) || !/\.(md|markdown|txt)$/i.test(path16))
-      continue;
-    const text = asText(content);
-    if (text === null)
-      continue;
-    parts.push(`### Reference: ${path16}
-
-${splitFrontmatter(text).body.trim()}`);
-  }
-  return parts.join("\n\n");
-}
 
 // ../../packages/core/dist/harnesses/types.js
 function defineHarness(def) {
@@ -40117,13 +40049,13 @@ function nativeFolderHarness(o) {
     ...o.mcp ? {
       toolsets(servers, ctx) {
         const mcp = o.mcp;
-        const path16 = ctx.layout[slot];
-        if (!path16) {
+        const path17 = ctx.layout[slot];
+        if (!path17) {
           if (mcp.unavailable)
             ctx.out.notes.push(mcp.unavailable(servers));
           return;
         }
-        ctx.out.mcp.push({ path: path16, key: mcp.key, servers: Object.fromEntries(servers.map(({ pkg, server }) => [server.name, mcp.entry(pkg, server, ctx.out.notes)])) });
+        ctx.out.mcp.push({ path: path17, key: mcp.key, servers: Object.fromEntries(servers.map(({ pkg, server }) => [server.name, mcp.entry(pkg, server, ctx.out.notes)])) });
       }
     } : {}
   });
@@ -40165,68 +40097,6 @@ function claudeMcpJson(mcpUrl, tokenEnv) {
   return JSON.stringify({ mcpServers: { yarkr: { type: "http", url: mcpUrl, headers: { Authorization: `Bearer \${${tokenEnv}}` } } } }, null, 2);
 }
 
-// ../../packages/core/dist/harnesses/claude-cowork.js
-var claudeCowork = defineHarness({
-  id: "claude-cowork",
-  layout: {
-    project: { plugin: "yarkr/exports/claude-cowork/yarkr", name: "yarkr" },
-    user: { plugin: ".yarkr/exports/claude-cowork/yarkr", name: "yarkr" }
-  },
-  skill(pkg, ctx) {
-    ctx.out.files.push(...skillFolderFiles(pkg, join(ctx.layout.plugin, "skills"), ctx.names.get(pkg.manifest.name)));
-  },
-  agent(pkg, ctx) {
-    const parts = agentParts(pkg, ctx.harness, ctx.names, ctx.out);
-    const fm = { ...claudeAgentFrontmatter(pkg, parts, ctx), ...parts.overrides };
-    ctx.out.files.push({ package: pkg.manifest.name, path: join(ctx.layout.plugin, "agents", `${ctx.names.get(pkg.manifest.name)}.md`), content: agentMarkdown(pkg, fm, parts) });
-  },
-  toolsets(servers, ctx) {
-    ctx.out.files.push({
-      path: join(ctx.layout.plugin, ".mcp.json"),
-      content: JSON.stringify({ mcpServers: Object.fromEntries(servers.map(({ pkg, server }) => [server.name, standardMcpEntry(pkg, server, "dollar-brace", ctx.out.notes, true)])) }, null, 2) + "\n"
-    });
-  },
-  finalize({ out, layout: l, input: input2 }) {
-    if (!out.files.length)
-      return;
-    const root = l.plugin;
-    out.files.push({
-      path: join(root, ".claude-plugin", "plugin.json"),
-      content: JSON.stringify({
-        name: l.name,
-        version: pluginVersion(input2),
-        description: "Skills and agents from your Yarkr registry (managed by yarkr).",
-        author: { name: "Yarkr" }
-      }, null, 2) + "\n"
-    });
-    out.files.push({
-      path: join(root, "README.md"),
-      content: withFrontmatter({ "managed-by": "yarkr" }, `# Yarkr plugin for Claude Cowork
-
-This folder is a Cowork plugin generated by \`yarkr sync\`.
-
-1. Zip this folder (\`${l.name}\`).
-2. In Claude Cowork, open Customize \u2192 Plugins and upload the zip, or publish it to your organisation's plugin marketplace.
-3. Re-run \`yarkr sync\` and re-upload after updates.
-`)
-    });
-    out.notes.push(`Cowork plugin written to ${root}/. Zip and upload it in Cowork (Customize \u2192 Plugins).`);
-  },
-  mcpSnippet: (mcpUrl, tokenEnv, notes) => ({
-    file: "Cowork: Customize \u2192 Connectors \u2192 Add custom connector",
-    format: "json",
-    content: claudeMcpJson(mcpUrl, tokenEnv),
-    notes: [...notes, "Cowork custom connectors take the URL and an Authorization header; paste the token value there."]
-  })
-});
-function pluginVersion(input2) {
-  const key = input2.packages.map((p) => `${p.manifest.name}@${p.manifest.version}`).sort().join(",");
-  let h = 0;
-  for (let i = 0; i < key.length; i++)
-    h = h * 31 + key.charCodeAt(i) >>> 0;
-  return `0.0.${h % 1e5}`;
-}
-
 // ../../packages/core/dist/harnesses/codex.js
 var index = /* @__PURE__ */ new WeakMap();
 var indexOf = (ctx) => index.get(ctx) ?? index.set(ctx, []).get(ctx);
@@ -40370,10 +40240,10 @@ var cursor = defineHarness({
     const entry = skillEntryPath(pkg.manifest);
     const { data, body } = splitFrontmatter(asText(pkg.files[entry]) ?? "");
     const extra = [];
-    for (const [path16, content] of Object.entries(pkg.files)) {
-      if (path16 === entry || isYarkrOnly(path16))
+    for (const [path17, content] of Object.entries(pkg.files)) {
+      if (path17 === entry || isYarkrOnly(path17))
         continue;
-      const p = join(l.assets, name, path16);
+      const p = join(l.assets, name, path17);
       ctx.out.files.push({ package: pkg.manifest.name, path: p, content });
       extra.push(`- \`${p}\``);
     }
@@ -40444,9 +40314,9 @@ function folderExportHarness(id, rootDefault, opts = {}) {
       for (const pkg of byKind(input2, "agent")) {
         const name = names.get(pkg.manifest.name);
         const parts = agentParts(pkg, id, names, out);
-        for (const [path16, content] of Object.entries(pkg.files))
-          if (!isYarkrOnly(path16))
-            out.files.push({ package: pkg.manifest.name, path: join(root, "agents", name, path16), content });
+        for (const [path17, content] of Object.entries(pkg.files))
+          if (!isYarkrOnly(path17))
+            out.files.push({ package: pkg.manifest.name, path: join(root, "agents", name, path17), content });
         index2.push({ kind: "agent", name, package: pkg.manifest.name, version: pkg.manifest.version, description: pkg.manifest.description, model: parts.model, tools: parts.tools, skills: parts.skills, subagents: parts.subagents, system_prompt: join("agents", name, pkg.manifest.agent?.system_prompt ?? "") });
       }
       for (const pkg of byKind(input2, "toolset")) {
@@ -40466,170 +40336,6 @@ function folderExportHarness(id, rootDefault, opts = {}) {
 }
 var generic = folderExportHarness("generic", "yarkr/generic", { acceptsAllTargets: true });
 
-// ../../packages/core/dist/harnesses/custom-http.js
-var customHttp = folderExportHarness("custom-http", "yarkr/custom-http");
-
-// ../../packages/core/dist/harnesses/workspace.js
-function workspaceHarness(t) {
-  return defineHarness({
-    id: t.id,
-    layout: {
-      project: { root: `yarkr/exports/${t.id}` },
-      user: { root: `.yarkr/exports/${t.id}` }
-    },
-    render({ input: input2, layout, names, out }) {
-      const root = layout.root;
-      const byName = new Map(input2.packages.map((p) => [p.manifest.name, p]));
-      const rows = [];
-      const header = (p) => `<!-- managed by yarkr: ${p.manifest.name}@${p.manifest.version}. Regenerate with \`yarkr sync\`; change it with a pull request in its repo. -->`;
-      for (const pkg of byKind(input2, "skill")) {
-        const name = names.get(pkg.manifest.name);
-        const entry = skillEntryPath(pkg.manifest);
-        const body = splitFrontmatter(asText(pkg.files[entry]) ?? "").body.trim();
-        const refs = inlineMarkdown(pkg, /* @__PURE__ */ new Set([entry]));
-        out.files.push({
-          package: pkg.manifest.name,
-          path: join(root, `${name}.md`),
-          content: `${header(pkg)}
-
-# ${name}
-
-Use when: ${pkg.manifest.description}
-
-${body}${refs ? `
-
-${refs}` : ""}
-`
-        });
-        rows.push(`| \`${name}.md\` | skill | ${pkg.manifest.name}@${pkg.manifest.version} | ${pkg.manifest.description} |`);
-      }
-      for (const pkg of byKind(input2, "agent")) {
-        const name = names.get(pkg.manifest.name);
-        const parts = agentParts(pkg, t.id, names, out);
-        const skillBlocks = Object.keys(pkg.manifest.depends?.skills ?? {}).map((d) => byName.get(d)).filter((p) => !!p).map((p) => `## Skill: ${names.get(p.manifest.name)}
-
-${splitFrontmatter(asText(p.files[skillEntryPath(p.manifest)]) ?? "").body.trim()}`);
-        out.files.push({
-          package: pkg.manifest.name,
-          path: join(root, `agent-${name}.md`),
-          content: `${header(pkg)}
-
-# ${name}
-
-${pkg.manifest.description}
-
-${parts.prompt}${skillBlocks.length ? `
-
-${skillBlocks.join("\n\n")}` : ""}
-`
-        });
-        rows.push(`| \`agent-${name}.md\` | agent | ${pkg.manifest.name}@${pkg.manifest.version} | ${pkg.manifest.description} |`);
-      }
-      const servers = toolsetServers(input2);
-      if (servers.length) {
-        out.notes.push(`${t.product} can't load MCP config from files. Connect these servers in ${t.product}'s settings: ${servers.map((s) => `${s.server.name} (${s.server.url ?? s.server.command})`).join(", ")}.`);
-      }
-      if (rows.length) {
-        out.files.push({
-          path: join(root, "README.md"),
-          content: `<!-- managed by yarkr -->
-
-# Yarkr instructions for ${t.product}
-
-${t.product} doesn't read instruction files from disk, so \`yarkr sync\` writes them here for you to paste.
-
-**Where to paste:** ${t.where}
-
-${t.limits}
-
-| File | Kind | Release | Use when |
-| --- | --- | --- | --- |
-${rows.join("\n")}
-
-After \`yarkr update\`, re-paste any file whose release changed.
-`
-        });
-        out.notes.push(`${t.product} bundle written to ${root}/. Paste each file as described in ${root}/README.md.`);
-      }
-    },
-    mcpSnippet: (mcpUrl) => ({
-      file: t.mcpWhere,
-      format: "text",
-      content: `URL: ${mcpUrl}
-Header: Authorization: Bearer <your Yarkr API token>`,
-      notes: [`${t.product} stores the token in its own connection settings. Use a token from a service account with read access only.`]
-    })
-  });
-}
-
-// ../../packages/core/dist/harnesses/linear.js
-var linear = workspaceHarness({
-  id: "linear",
-  product: "Linear",
-  where: "Workspace guidance: Settings \u2192 Agents \u2192 Additional guidance. Team guidance: Team settings \u2192 Agents \u2192 Additional guidance (team guidance takes priority). Paste the contents of the matching file.",
-  limits: "Linear passes this guidance to every agent working on issues in the workspace or team, so keep each file focused.",
-  mcpWhere: "Linear agents that support MCP: add a custom MCP server"
-});
-
-// ../../packages/core/dist/harnesses/notion.js
-var notion = workspaceHarness({
-  id: "notion",
-  product: "Notion",
-  where: "Create or open a Custom Agent \u2192 Instructions, and paste the contents of the matching file. For Notion AI personal instructions, use Settings \u2192 Notion AI \u2192 Instructions. MCP toolsets are added under the agent's Connections.",
-  limits: "Notion instructions are plain text; reference files are inlined below the main instructions.",
-  mcpWhere: "Notion Custom Agent \u2192 Connections \u2192 Add MCP server"
-});
-
-// ../../packages/core/dist/harnesses/openai-agents-sdk.js
-var openaiAgentsSdk = defineHarness({
-  id: "openai-agents-sdk",
-  layout: {
-    project: { root: "yarkr/agents-sdk" },
-    user: { root: ".yarkr/agents-sdk" }
-  },
-  render({ input: input2, layout, names, out }) {
-    const root = layout.root;
-    for (const pkg of byKind(input2, "skill"))
-      out.files.push(...skillFolderFiles(pkg, join(root, "skills"), names.get(pkg.manifest.name)));
-    const servers = toolsetServers(input2).map(({ pkg, server: s }) => {
-      const conv = (what) => (k, v) => convertSecretRefs(v, "keep", { pkg: pkg.manifest.name, server: s.name, key: `${what} ${k}` }, out.notes);
-      return {
-        toolset: pkg.manifest.name,
-        def: clean({ name: s.name, transport: s.transport === "http" ? "streamable_http" : "stdio", command: s.command, args: s.args, url: s.url, env: mapValues(s.env, conv("env")), headers: mapValues(s.headers, conv("header")) })
-      };
-    });
-    if (servers.length)
-      out.files.push({ path: join(root, "mcp.json"), content: JSON.stringify({ managed_by: "yarkr", servers: servers.map((s) => s.def) }, null, 2) + "\n" });
-    for (const pkg of byKind(input2, "agent")) {
-      const name = names.get(pkg.manifest.name);
-      const parts = agentParts(pkg, "openai-agents-sdk", names, out);
-      const toolsetDeps = new Set(Object.keys(pkg.manifest.depends?.toolsets ?? {}));
-      const def = clean({
-        managed_by: "yarkr",
-        package: pkg.manifest.name,
-        version: pkg.manifest.version,
-        name,
-        handoff_description: pkg.manifest.description,
-        instructions: parts.prompt,
-        model: parts.model,
-        model_settings: Object.keys(parts.parameters).length ? parts.parameters : void 0,
-        tools: parts.tools,
-        handoffs: parts.subagents,
-        skills: parts.skills.map((s) => join("skills", s)),
-        mcp_servers: servers.filter((s) => toolsetDeps.has(s.toolset)).map((s) => s.def.name),
-        ...parts.overrides
-      });
-      out.files.push({ package: pkg.manifest.name, path: join(root, "agents", `${name}.json`), content: JSON.stringify(def, null, 2) + "\n" });
-    }
-  },
-  mcpSnippet: (mcpUrl, tokenEnv, notes) => ({
-    file: "your agent code",
-    format: "text",
-    content: `MCPServerStreamableHttp(params={"url": "${mcpUrl}", "headers": {"Authorization": f"Bearer {os.environ['${tokenEnv}']}"}})`,
-    notes
-  })
-});
-
 // ../../packages/core/dist/harnesses/opencode.js
 function opencodeModel(model) {
   if (!model || model.includes("/"))
@@ -40673,14 +40379,9 @@ var opencode = nativeFolderHarness({
 // ../../packages/core/dist/harnesses/index.js
 var HARNESS_REGISTRY = {
   "claude-code": claudeCode,
-  "claude-cowork": claudeCowork,
   codex,
   opencode,
   cursor,
-  "openai-agents-sdk": openaiAgentsSdk,
-  linear,
-  notion,
-  "custom-http": customHttp,
   generic
 };
 function detectHarnesses(exists) {
@@ -40753,24 +40454,18 @@ function yarkrMcpSnippet(harness, mcpUrl, tokenEnv = "YARKR_TOKEN") {
     notes
   };
 }
-var SCOPE = /^(all|public|@me|@[a-z0-9][a-z0-9-]*\/[a-z0-9][a-z0-9-]*(@[1-9][0-9]*)?|global\/[a-z0-9][a-z0-9-]*|[a-z0-9][a-z0-9-]*(\/[a-z0-9][a-z0-9-]*)?)$/;
+var SCOPE = /^(all|public|[a-z0-9][a-z0-9-]*(\/[a-z0-9][a-z0-9-]*)?)$/;
 function isConnectionScope(scope) {
   return SCOPE.test(scope);
 }
 function yarkrConnection(server, scope, tokenEnv = "YARKR_TOKEN") {
   if (!isConnectionScope(scope))
-    throw new Error(`"${scope}" isn't an MCP scope. Use all, public, @me, @<handle>/<collection>, <org>, <org>/<ark> or global/<ark>.`);
+    throw new Error(`"${scope}" isn't an MCP scope. Use all, public, <org> or <org>/<ark>.`);
   const base = server.replace(/\/+$/, "");
   if (scope === "all")
     return { scope, name: "yarkr", url: `${base}/mcp`, tokenEnv };
   if (scope === "public")
     return { scope, name: "yarkr-public", url: `${base}/mcp/public`, tokenEnv: null };
-  if (scope === "@me")
-    return { scope, name: "yarkr-me", url: `${base}/mcp/a/@me`, tokenEnv };
-  if (scope.startsWith("@"))
-    return { scope, name: `yarkr-${scope.slice(1).replace(/@\d+$/, "").replace("/", "-")}`, url: `${base}/mcp/${scope}`, tokenEnv };
-  if (scope.startsWith("global/"))
-    return { scope, name: `yarkr-${scope.replace("/", "-")}`, url: `${base}/mcp/a/${scope}`, tokenEnv };
   return { scope, name: `yarkr-${scope.replace("/", "-")}`, url: `${base}/mcp/o/${scope}`, tokenEnv };
 }
 function connectionPackage(c) {
@@ -40832,7 +40527,48 @@ import { readFileSync } from "fs";
 import { chmod, mkdir, readFile, writeFile } from "fs/promises";
 import os from "os";
 import path from "path";
+
+// src/keychain.ts
+import { execFileSync, spawnSync } from "child_process";
+var SERVICE = "yarkr";
+var detected;
+function store() {
+  if (process.env.YARKR_CREDENTIAL_STORE === "file") return null;
+  if (detected !== void 0) return detected;
+  const has = (cmd) => spawnSync("which", [cmd], { stdio: "ignore" }).status === 0;
+  detected = process.platform === "darwin" && has("security") ? "macos" : process.platform === "linux" && has("secret-tool") ? "secret-service" : null;
+  return detected;
+}
+function keychainName() {
+  const s = store();
+  return s === "macos" ? "the macOS Keychain" : s === "secret-service" ? "your keyring (Secret Service)" : null;
+}
+function keychainSet(account, token) {
+  const s = store();
+  if (!s || /["\n]/.test(account + token)) return false;
+  const r = s === "macos" ? spawnSync("security", ["-i"], { input: `add-generic-password -U -s ${SERVICE} -a "${account}" -l "Yarkr (${account})" -w "${token}"
+`, stdio: ["pipe", "ignore", "ignore"] }) : spawnSync("secret-tool", ["store", `--label=Yarkr (${account})`, "service", SERVICE, "registry", account], { input: token, stdio: ["pipe", "ignore", "ignore"] });
+  return r.status === 0 && keychainGet(account) === token;
+}
+function keychainGet(account) {
+  const s = store();
+  if (!s) return null;
+  try {
+    const out = s === "macos" ? execFileSync("security", ["find-generic-password", "-s", SERVICE, "-a", account, "-w"], { stdio: ["ignore", "pipe", "ignore"] }) : execFileSync("secret-tool", ["lookup", "service", SERVICE, "registry", account], { stdio: ["ignore", "pipe", "ignore"] });
+    return out.toString("utf8").trim() || null;
+  } catch {
+    return null;
+  }
+}
+function keychainDelete(account) {
+  const s = store();
+  if (s === "macos") spawnSync("security", ["delete-generic-password", "-s", SERVICE, "-a", account], { stdio: "ignore" });
+  else if (s === "secret-service") spawnSync("secret-tool", ["clear", "service", SERVICE, "registry", account], { stdio: "ignore" });
+}
+
+// src/rc.ts
 var RC_FILE = ".yarkrrc";
+var KEYCHAIN_TOKEN = "@keychain";
 var userRcPath = () => process.env.YARKR_USERCONFIG ?? path.join(os.homedir(), RC_FILE);
 function parseRc(text, file2) {
   const rc = { path: file2, tokens: /* @__PURE__ */ new Map() };
@@ -40869,6 +40605,11 @@ function tokenFor(rc, server) {
   for (const k of rc.tokens.keys()) if (key.startsWith(k) && (!best || k.length > best.length)) best = k;
   if (!best) return void 0;
   const raw = rc.tokens.get(best);
+  if (raw === KEYCHAIN_TOKEN) {
+    const token = keychainGet(best);
+    if (!token) throw new CliError(`${rc.path} says the token for ${best} is in your keychain, but it isn't there.`, "Run `yarkr login` again.");
+    return token;
+  }
   const value = raw.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(\?)?\}/g, (_, name, optional2) => {
     const v = process.env[name];
     if (v === void 0 && !optional2) {
@@ -40880,7 +40621,7 @@ function tokenFor(rc, server) {
 }
 function warnOnLiteralTokens(rc) {
   for (const [k, v] of rc.tokens) {
-    if (!v.includes("${")) ui.warn(`${rc.path} has a literal token for ${k}. Use \${ENV_VAR} instead if you commit this file.`);
+    if (!v.includes("${") && v !== KEYCHAIN_TOKEN) ui.warn(`${rc.path} has a literal token for ${k}. Use \${ENV_VAR} instead if you commit this file.`);
   }
 }
 var authTokenKey = (server) => `${registryKey(server)}:_authToken`;
@@ -40911,7 +40652,7 @@ async function setRcValue(file2, key, value, { secret = false } = {}) {
 var CONFIG_FILE = "yarkr.json";
 var LOCK_FILE = "yarkr.lock";
 var normalizeServer = (url2) => url2.replace(/\/+$/, "");
-var DEFAULT_REGISTRY = "https://yarkr.com";
+var DEFAULT_REGISTRY = "https://api.yarkr.com/functions/v1/api";
 var connectionFor = (server, m) => yarkrConnection(server, m.scope, m.public ? null : m.token_env);
 var userStateDir = () => process.env.YARKR_STATE_DIR ?? path2.join(process.env.XDG_CONFIG_HOME ?? path2.join(os2.homedir(), ".config"), "yarkr");
 async function loadProjectConfig(dir, { required: required2 = true } = {}) {
@@ -40933,10 +40674,7 @@ async function loadProjectConfig(dir, { required: required2 = true } = {}) {
   const unknown2 = harnesses.filter((h) => !HARNESS_IDS.includes(h));
   if (unknown2.length) throw new CliError(`${CONFIG_FILE} lists unknown harnesses: ${unknown2.join(", ")}.`, `Known harnesses: ${HARNESS_IDS.join(", ")}.`);
   if (raw.arks !== void 0 && raw.arks !== "auto" && !(Array.isArray(raw.arks) && raw.arks.every((a) => typeof a === "string"))) {
-    throw new CliError(`${CONFIG_FILE}: "arks" must be "auto" or a list of ark refs.`, `For example "arks": ["acme/finance", "global/essentials"].`);
-  }
-  if (raw.collections !== void 0 && !(Array.isArray(raw.collections) && raw.collections.every((c) => typeof c === "string" && parseCollectionRef(c)))) {
-    throw new CliError(`${CONFIG_FILE}: "collections" must be a list of collection refs.`, `For example "collections": ["@ana/pdf", "@acme-bot/review@3"].`);
+    throw new CliError(`${CONFIG_FILE}: "arks" must be "auto" or a list of ark refs.`, `For example "arks": ["acme/finance", "@me"].`);
   }
   const mcp = (raw.mcp ?? []).map((m) => typeof m === "string" ? { scope: m } : m);
   for (const m of mcp) {
@@ -40952,7 +40690,6 @@ async function loadProjectConfig(dir, { required: required2 = true } = {}) {
     layout: raw.layout,
     ...raw.arks !== void 0 ? { arks: raw.arks } : {},
     ...raw.exclude?.length ? { exclude: raw.exclude } : {},
-    ...raw.collections?.length ? { collections: raw.collections } : {},
     ...mcp.length ? { mcp } : {}
   };
 }
@@ -40965,7 +40702,6 @@ async function saveProjectConfig(dir, cfg) {
   };
   if (cfg.arks !== void 0) out.arks = cfg.arks;
   if (cfg.exclude?.length) out.exclude = [...cfg.exclude].sort();
-  if (cfg.collections?.length) out.collections = [...cfg.collections].sort();
   if (cfg.mcp?.length) out.mcp = cfg.mcp.map((m) => m.token_env || m.public ? m : m.scope);
   if (cfg.layout && Object.keys(cfg.layout).length) out.layout = cfg.layout;
   await writeFile2(path2.join(dir, CONFIG_FILE), JSON.stringify(out, null, 2) + "\n");
@@ -41020,12 +40756,13 @@ async function resolveConnection(opts) {
 }
 
 // src/commands/auth.ts
+async function readStdin() {
+  const chunks = [];
+  for await (const c of process.stdin) chunks.push(c);
+  return Buffer.concat(chunks).toString("utf8").trim();
+}
 async function promptHidden(question) {
-  if (!process.stdin.isTTY) {
-    const chunks = [];
-    for await (const c of process.stdin) chunks.push(c);
-    return Buffer.concat(chunks).toString("utf8").trim();
-  }
+  if (!process.stdin.isTTY) return readStdin();
   let muted = false;
   const output3 = new Writable({
     write(chunk, _enc, cb) {
@@ -41041,30 +40778,99 @@ async function promptHidden(question) {
   process.stdout.write("\n");
   return answer.trim();
 }
+function registryFor(flag, userRc) {
+  return normalizeServer(flag ?? process.env.YARKR_REGISTRY ?? loadRc(path3.join(process.cwd(), RC_FILE))?.registry ?? userRc?.registry ?? DEFAULT_REGISTRY);
+}
 async function login(opts) {
   const userRc = loadRc(userRcPath());
-  const registry2 = normalizeServer(opts.registry ?? process.env.YARKR_REGISTRY ?? loadRc(path3.join(process.cwd(), RC_FILE))?.registry ?? userRc?.registry ?? DEFAULT_REGISTRY);
+  const registry2 = registryFor(opts.registry, userRc);
   let token = opts.token ?? process.env.YARKR_TOKEN;
-  if (!token) {
-    if (process.stdin.isTTY) ui.info(`Create an API token at ${ui.code(registry2)} under Settings \u2192 API tokens.`);
-    token = await promptHidden("Paste the token: ");
-  }
+  if (!token && !process.stdin.isTTY) token = await readStdin();
+  if (!token) token = await browserLogin(registry2, opts.browser !== false && !headless());
   if (!token) throw new CliError("No token entered.");
   const me = await new Api({ server: registry2, token }).me();
-  await setRcValue(userRcPath(), authTokenKey(registry2), token, { secret: true });
+  const store2 = keychainSet(registryKey(registry2), token) ? keychainName() : null;
+  await setRcValue(userRcPath(), authTokenKey(registry2), store2 ? KEYCHAIN_TOKEN : token, { secret: true });
   if (!userRc?.registry) await setRcValue(userRcPath(), "registry", registry2, { secret: true });
   ui.ok(`Signed in to ${registry2} as ${ui.bold(me.email)}.`);
-  ui.step(`Token saved to ${userRcPath()} (readable only by you).`);
+  ui.step(store2 ? `Token saved to ${store2}.` : `Token saved to ${userRcPath()} (readable only by you).`);
+}
+var LOGIN_TIMEOUT_MS = 5 * 6e4;
+var headless = () => !!process.env.SSH_CONNECTION || process.platform === "linux" && !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY;
+async function browserLogin(registry2, open2, openUrl = openBrowser) {
+  const info2 = await new Api({ server: registry2, token: null }).info();
+  const web = (info2.web_url ?? registry2).replace(/\/+$/, "");
+  const host = os3.hostname().replace(/\.local$/, "");
+  if (!open2) {
+    ui.info("Open this link on any device, sign in and approve:");
+    console.log(`
+  ${ui.code(`${web}/cli/login?${new URLSearchParams({ host })}`)}
+`);
+    return promptHidden("Paste the token it shows: ");
+  }
+  const state = randomBytes(16).toString("base64url");
+  return new Promise((resolve, reject) => {
+    const done = (err, token) => {
+      clearTimeout(timer);
+      server.close();
+      if (err) reject(err);
+      else resolve(token);
+    };
+    const server = createServer((req, res) => {
+      if (req.method !== "POST" || req.url !== "/callback") return void res.writeHead(404).end();
+      let body = "";
+      req.setEncoding("utf8");
+      req.on("data", (c) => {
+        body += c;
+        if (body.length > 8192) req.destroy();
+      });
+      req.on("end", () => {
+        const form = new URLSearchParams(body);
+        if (form.get("state") !== state) return void res.writeHead(400, { "content-type": "text/plain" }).end("This sign-in link is stale. Run `yarkr login` again.");
+        const token = form.get("token");
+        res.writeHead(303, { location: `${web}/cli/login?${new URLSearchParams({ done: token ? "ok" : "denied" })}`, connection: "close" });
+        res.end(() => done(token ? null : new CliError("Sign-in was cancelled in the browser."), token ?? void 0));
+      });
+    });
+    const timer = setTimeout(() => done(new CliError("Timed out waiting for the browser.", "Run `yarkr login` again, or `yarkr login --no-browser` to paste a token.")), LOGIN_TIMEOUT_MS);
+    server.on("error", (err) => done(err));
+    server.listen(0, "127.0.0.1", () => {
+      const { port } = server.address();
+      const url2 = `${web}/cli/login?${new URLSearchParams({ port: String(port), state, host })}`;
+      ui.info(`Opening your browser to sign in to ${ui.bold(web)}\u2026`);
+      ui.step(`If it doesn't open, visit ${ui.code(url2)}`);
+      openUrl(url2);
+    });
+  });
+}
+function openBrowser(url2) {
+  const [cmd, args] = process.platform === "darwin" ? ["open", [url2]] : process.platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", url2]] : ["xdg-open", [url2]];
+  try {
+    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
 }
 async function logout(opts) {
   const userRc = loadRc(userRcPath());
-  const registry2 = normalizeServer(opts.registry ?? process.env.YARKR_REGISTRY ?? loadRc(path3.join(process.cwd(), RC_FILE))?.registry ?? userRc?.registry ?? DEFAULT_REGISTRY);
-  if (!userRc || tokenFor(userRc, registry2) === void 0) {
+  const registry2 = registryFor(opts.registry, userRc);
+  let token;
+  try {
+    token = userRc ? tokenFor(userRc, registry2) : void 0;
+  } catch {
+    token = null;
+  }
+  if (token === void 0) {
     ui.info("You aren't signed in.");
     return;
   }
+  const revoked = token ? await new Api({ server: registry2, token }).revokeCurrentToken().then(() => true, () => false) : false;
+  keychainDelete(registryKey(registry2));
   await setRcValue(userRcPath(), authTokenKey(registry2), null, { secret: true });
-  ui.ok(`Signed out of ${registry2}. The token still exists on the server; revoke it in Settings \u2192 API tokens if you no longer need it.`);
+  ui.ok(`Signed out of ${registry2}.`);
+  if (!revoked) ui.step("The token may still exist on the server; revoke it in Settings \u2192 API tokens if you no longer need it.");
 }
 async function whoami(opts) {
   const conn = await resolveConnection({ registry: opts.registry, dir: process.cwd() });
@@ -41072,28 +40878,28 @@ async function whoami(opts) {
   ui.ok(`${ui.bold(me.name)} <${me.email}> on ${conn.server}`);
   if (conn.tokenSource) ui.step(`token from ${conn.tokenSource}`);
   if (me.is_admin) ui.step("admin");
-  if (me.groups.length) ui.step(`groups: ${me.groups.join(", ")}`);
+  if (me.orgs.length) ui.step(`orgs: ${me.orgs.map((o) => `${o.slug}${o.role === "admin" ? " (admin)" : ""}`).join(", ")}`);
 }
 
 // src/commands/registry.ts
 var pct = (v) => v === null ? ui.dim("\u2014") : `${Math.round(v * 100)}%`;
 async function search(query, opts) {
-  const api2 = new Api(await resolveConnection({ dir: process.cwd() }));
-  const page = await api2.search({ q: query, kind: opts.kind, target: opts.target });
+  const api = new Api(await resolveConnection({ dir: process.cwd() }));
+  const page = await api.search({ q: query, kind: opts.kind, target: opts.target });
   if (opts.json) return console.log(JSON.stringify(page, null, 2));
   if (!page.items.length) {
-    ui.info(query ? `Nothing matches "${query}".` : "Nothing here yet. An org admin connects GitHub repos under Settings \u2192 Organisations.");
+    ui.info(query ? `Nothing matches "${query}".` : "Nothing here yet. Publish by installing the Yarkr GitHub App on your repos (Settings \u2192 GitHub).");
     return;
   }
   ui.table(
-    page.items.map((p) => [ui.bold(p.name), p.kind, p.channels.find((c) => c.name === "stable")?.version ?? ui.dim("unreleased"), pct(p.verified_eval?.pass_rate ?? null), p.description.slice(0, 60)]),
+    page.items.map((p) => [ui.bold(p.name), p.kind, p.channels.find((c) => c.name === "stable")?.version ?? ui.dim("unreleased"), pct(p.reported_eval?.pass_rate ?? null), p.description.slice(0, 60)]),
     ["package", "kind", "stable", "evals", "description"]
   );
   if (page.total > page.items.length) ui.step(`${page.total - page.items.length} more \u2014 narrow the search.`);
 }
 async function info(name, opts) {
-  const api2 = new Api(await resolveConnection({ dir: process.cwd() }));
-  const p = await api2.pkg(name);
+  const api = new Api(await resolveConnection({ dir: process.cwd() }));
+  const p = await api.pkg(name);
   if (opts.json) return console.log(JSON.stringify(p, null, 2));
   ui.heading(`${p.name}  ${ui.dim(p.kind)}`);
   console.log(`  ${p.description}`);
@@ -41106,20 +40912,28 @@ async function info(name, opts) {
       ["tags", p.tags.join(", ") || ui.dim("\u2014")],
       ["classification", p.classification],
       ["source", p.source ? `${p.source.repo}/${p.source.path}` : ui.dim("\u2014")],
-      ["verified evals", pct(p.verified_eval?.pass_rate ?? null)],
-      ["reported evals", p.reported_eval ? `${pct(p.reported_eval.pass_rate)} ${ui.dim(p.reported_eval.trust)}` : ui.dim("\u2014")]
+      ["evals", p.reported_eval ? `${pct(p.reported_eval.pass_rate)} ${ui.dim(p.reported_eval.trust)}` : ui.dim("\u2014")]
     ].map(([k, v]) => [ui.dim(k), v])
   );
   if (p.releases.length) {
     console.log();
     ui.table(
-      p.releases.slice(0, 10).map((r) => [r.version, r.channels.join(", "), pct(r.eval_score), r.commit_sha?.slice(0, 7) ?? "", r.created_at.slice(0, 10)]),
+      p.releases.slice(0, 10).map((r) => [r.version, r.yanked ? ui.del(`yanked: ${r.yanked.reason}`) : r.channels.join(", "), pct(r.eval_score), r.commit_sha?.slice(0, 7) ?? "", r.created_at.slice(0, 10)]),
       ["release", "channels", "evals", "commit", "date"]
     );
   }
   console.log();
   ui.step(`Install: ${ui.code(`yarkr add ${p.name}`)}`);
 }
+async function yank(spec, opts) {
+  const at = spec.lastIndexOf("@");
+  if (at < 1) throw new CliError(`Name the release: <namespace/name>@<version>, e.g. acme/pdf@1.4.0.`);
+  const [name, version2] = [spec.slice(0, at), spec.slice(at + 1)];
+  if (!opts.undo && !opts.reason) throw new CliError("Say why with --reason: people who installed it see it.", `yarkr yank ${spec} --reason "leaks a token"`);
+  const api = new Api(await resolveConnection({ dir: process.cwd() }));
+  await api.yank(name, version2, opts.undo ? null : opts.reason);
+  ui.ok(opts.undo ? `${name}@${version2} is no longer yanked.` : `Yanked ${name}@${version2}. Ranges and stable skip it now; lockfiles that pin it still install it, with a warning.`);
+}
 async function mcpConfig(harness, opts) {
   if (!HARNESS_IDS.includes(harness)) throw new CliError(`Unknown harness "${harness}".`, `Choose one of: ${HARNESS_IDS.join(", ")}.`);
   const conn = await resolveConnection({ registry: opts.registry, dir: process.cwd() });
@@ -41140,13 +40954,13 @@ async function mcpConfig(harness, opts) {
 // src/commands/project.ts
 import { existsSync as existsSync3 } from "fs";
 import { mkdir as mkdir3 } from "fs/promises";
-import os4 from "os";
+import os5 from "os";
 import path5 from "path";
 
 // src/sync.ts
 import { mkdir as mkdir2, readFile as readFile3, rm, writeFile as writeFile3, readdir, rmdir } from "fs/promises";
 import { existsSync as existsSync2 } from "fs";
-import os3 from "os";
+import os4 from "os";
 import path4 from "path";
 
 // ../../packages/core/dist/hash.js
@@ -41311,14 +41125,14 @@ var dirname = (p) => p.includes("/") ? p.slice(0, p.lastIndexOf("/")) : "";
 var basename = (p) => p.slice(p.lastIndexOf("/") + 1);
 var under = (dir, p) => dir ? p.startsWith(`${dir}/`) : true;
 var rel = (dir, p) => dir ? p.slice(dir.length + 1) : p;
-function parseOverrides(text, path16, problems) {
+function parseOverrides(text, path17, problems) {
   if (text === null)
     return null;
   try {
     const raw = import_yaml3.default.parse(text);
     return raw && typeof raw === "object" ? raw : null;
   } catch (err) {
-    problems.push({ path: path16, message: `${MANIFEST_FILE} isn't valid YAML: ${err.message}` });
+    problems.push({ path: path17, message: `${MANIFEST_FILE} isn't valid YAML: ${err.message}` });
     return null;
   }
 }
@@ -41332,7 +41146,7 @@ async function detectAssets(input2) {
   const claimed = [];
   const isClaimed = (p) => claimed.some((d) => d ? p === d || p.startsWith(`${d}/`) : true);
   const filesBelow = (dir) => new Map(paths.filter((p) => under(dir, p)).map((p) => [rel(dir, p), p]));
-  const make = (name, kind, path16, files, o, extra) => {
+  const make = (name, kind, path17, files, o, extra) => {
     const suites = [...files.keys()].filter((p) => SUITE.test(p));
     const raw = {
       name: `${input2.namespace}/${slugify2(name)}`,
@@ -41351,10 +41165,10 @@ async function detectAssets(input2) {
     };
     const res = Manifest.safeParse(raw);
     if (!res.success) {
-      problems.push({ path: path16, message: res.error.issues.map((i) => `${i.path.join(".") || "manifest"}: ${i.message}`).join("; ") });
+      problems.push({ path: path17, message: res.error.issues.map((i) => `${i.path.join(".") || "manifest"}: ${i.message}`).join("; ") });
       return null;
     }
-    return { name: slugify2(name), kind, path: path16, manifest: res.data, files };
+    return { name: slugify2(name), kind, path: path17, manifest: res.data, files };
   };
   const manifestNear = async (dir, from) => {
     const mp = dir ? `${dir}/${MANIFEST_FILE}` : MANIFEST_FILE;
@@ -41446,12 +41260,12 @@ async function detectAssets(input2) {
   }
   return { assets: [...byName.values()], problems };
 }
-function toolsetServers2(text, path16, problems) {
+function toolsetServers2(text, path17, problems) {
   let doc;
   try {
     doc = JSON.parse(text ?? "");
   } catch (err) {
-    problems.push({ path: path16, message: `isn't valid JSON: ${err.message}` });
+    problems.push({ path: path17, message: `isn't valid JSON: ${err.message}` });
     return null;
   }
   const out = [];
@@ -41464,7 +41278,7 @@ function toolsetServers2(text, path16, problems) {
         const ref = String(v).replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(?::-[^}]*)?\}/g, "${env:$1}");
         const plain = ref.replace(/^Bearer /, "");
         if (!SECRET_REF.test(plain)) {
-          problems.push({ path: path16, message: `${name}.${field}.${k} is a literal value. Use \${${k.toUpperCase().replace(/[^A-Z0-9]+/g, "_")}} or \${vault:path#key} so no secret lives in the repo.` });
+          problems.push({ path: path17, message: `${name}.${field}.${k} is a literal value. Use \${${k.toUpperCase().replace(/[^A-Z0-9]+/g, "_")}} or \${vault:path#key} so no secret lives in the repo.` });
           return null;
         }
         res[k] = ref;
@@ -41484,7 +41298,7 @@ function toolsetServers2(text, path16, problems) {
     });
   }
   if (!out.length) {
-    problems.push({ path: path16, message: "has no mcpServers." });
+    problems.push({ path: path17, message: "has no mcpServers." });
     return null;
   }
   return out;
@@ -41498,7 +41312,7 @@ function firstParagraph(md2) {
 
 // src/resolve.ts
 var import_semver2 = __toESM(require_semver2(), 1);
-async function resolveAll(api2, opts) {
+async function resolveAll(api, opts) {
   const ranges = /* @__PURE__ */ new Map();
   const queue = [];
   const want = (name, range, from) => {
@@ -41509,14 +41323,12 @@ async function resolveAll(api2, opts) {
   };
   for (const [name, range] of Object.entries(opts.roots)) want(name, range, null);
   const channels = /* @__PURE__ */ new Map();
-  const pins = /* @__PURE__ */ new Map();
   for (const r of opts.arkRoots ?? []) {
-    for (const src of r.sources) want(r.name, r.range ?? "*", `${r.via ?? "ark"}:${src}`);
+    for (const src of r.sources) want(r.name, r.range ?? "*", `ark:${src}`);
     if (r.channel) channels.set(r.name, r.channel);
-    if (r.digest && r.range) pins.set(r.name, { version: r.range, digest: r.digest, sources: r.sources });
   }
   const out = /* @__PURE__ */ new Map();
-  const key = await signingKey(api2);
+  const key = await signingKey(api);
   while (queue.length) {
     const name = queue.shift();
     const reqs = ranges.get(name);
@@ -41525,22 +41337,10 @@ async function resolveAll(api2, opts) {
       prev.lock.required_by = requiredBy(reqs);
       continue;
     }
-    const pin = pins.get(name);
-    if (pin) {
-      const clash = reqs.find((r) => !satisfies(pin.version, r.range));
-      if (clash) {
-        throw new CliError(`${name}: ${pin.sources.join(", ")} pins ${pin.version}, but ${clash.from ?? "yarkr.json"} wants ${clash.range}.`, "A collection pins exact releases. Relax the other range, or use another version of the collection.");
-      }
-    }
-    const version2 = pin?.version ?? await pickVersion(api2, name, reqs, { ...opts, channel: channels.get(name) ?? opts.channel });
-    const bundle = await api2.bundle(name, version2);
+    const version2 = await pickVersion(api, name, reqs, { ...opts, channel: channels.get(name) ?? opts.channel });
+    const bundle = await api.bundle(name, version2, { sync: true });
     const pkg = verifyBundle(bundle, key, opts.requireSignatures ?? false);
-    if (pin && bundle.content_hash !== pin.digest) {
-      throw new CliError(
-        `${name}@${version2} doesn't match the content hash ${pin.sources.join(", ")} pinned (${pin.digest.slice(0, 12)}\u2026, got ${bundle.content_hash.slice(0, 12)}\u2026).`,
-        "Nothing was written. Report this to your Yarkr admin."
-      );
-    }
+    if (bundle.yanked) ui.warn(`${name}@${version2} was yanked: ${bundle.yanked.reason}. Run \`yarkr update ${name}\` to move off it.`);
     out.set(name, {
       pkg,
       lock: {
@@ -41562,14 +41362,14 @@ async function resolveAll(api2, opts) {
 }
 var satisfies = (v, range) => range === "*" || range === "latest" || import_semver2.default.satisfies(v, range, { includePrerelease: true });
 var requiredBy = (reqs) => [...new Set(reqs.map((r) => r.from).filter((f) => !!f))].sort();
-async function pickVersion(api2, name, reqs, opts) {
+async function pickVersion(api, name, reqs, opts) {
   const locked = opts.lock?.packages[name];
   const updating = opts.update === true || opts.update?.has(name);
   if (locked && !updating && reqs.every((r) => satisfies(locked.version, r.range))) return locked.version;
   const ranges = reqs.map((r) => r.range).filter((r) => r !== "*" && r !== "latest");
   const combined = ranges.length ? ranges.join(" ") : void 0;
   try {
-    const rel2 = await api2.resolve(name, { channel: opts.channel, range: combined });
+    const rel2 = await api.resolve(name, { channel: opts.channel, range: combined });
     if (!reqs.every((r) => satisfies(rel2.version, r.range))) throw new Error("unsatisfied");
     return rel2.version;
   } catch (err) {
@@ -41583,9 +41383,9 @@ async function pickVersion(api2, name, reqs, opts) {
     throw err;
   }
 }
-async function signingKey(api2) {
+async function signingKey(api) {
   try {
-    return await api2.signingKey();
+    return await api.signingKey();
   } catch {
     return null;
   }
@@ -41622,8 +41422,8 @@ function verifyBundle(b, key, requireSignature) {
   return { manifest: b.manifest, files, content_hash: b.content_hash };
 }
 var TEXT_EXT = /\.(md|mdc|mdx|markdown|txt|ya?ml|json|toml|py|sh|bash|js|mjs|cjs|ts|tsx|csv|html|css|xml|sql|rb|go|rs|java|ini|cfg|env)$/i;
-function looksText(path16, bytes) {
-  if (TEXT_EXT.test(path16)) return true;
+function looksText(path17, bytes) {
+  if (TEXT_EXT.test(path17)) return true;
   const n = Math.min(bytes.length, 4096);
   for (let i = 0; i < n; i++) if (bytes[i] === 0) return false;
   try {
@@ -41635,6 +41435,16 @@ function looksText(path16, bytes) {
 }
 
 // src/sync.ts
+async function loadArks(api, arks, signedIn) {
+  if (!arks) return { ark: null, publicArks: [] };
+  if (arks === "auto") return { ark: signedIn ? await api.myArk() : null, publicArks: [] };
+  const all = signedIn ? await api.myArk() : null;
+  const mine = arks.filter((r) => r === "@me" || all?.arks.some((a) => a.ref === r));
+  if (!signedIn && arks.includes("@me")) throw new CliError("@me is your personal ark: sign in to sync it.", 'Run `yarkr login`, or drop @me from "arks".');
+  const publicArks2 = [];
+  for (const ref of arks.filter((r) => !mine.includes(r))) publicArks2.push(await api.ark(ref, { sync: true }));
+  return { ark: mine.length ? await api.myArk(mine) : null, publicArks: publicArks2 };
+}
 var hashOf = (c) => sha256(c);
 async function readMaybe(p) {
   try {
@@ -41643,35 +41453,25 @@ async function readMaybe(p) {
     return null;
   }
 }
-async function planSync(api2, opts) {
+async function planSync(api, opts) {
   const { config: config2 } = opts;
   const harnesses = opts.harnesses ?? config2.harnesses;
   if (!harnesses.length) throw new CliError("No harnesses configured.", "Add some to yarkr.json, e.g. `yarkr init --harness claude-code codex`.");
   const unknown2 = harnesses.filter((h) => !config2.harnesses.includes(h));
   if (unknown2.length) throw new CliError(`${unknown2.join(", ")} isn't in yarkr.json's harnesses.`, "Add it there first so the lockfile can track its files.");
   const warnings = [];
-  const ark = config2.arks ? await api2.myArk(config2.arks === "auto" ? void 0 : config2.arks) : null;
+  const { ark, publicArks: publicArks2 } = await loadArks(api, config2.arks, opts.signedIn ?? true);
+  const items = [...ark?.items ?? [], ...publicArks2.flatMap((a) => a.items.map((i) => ({ ...i, sources: [a.ref] })))];
   const arkRoots = [];
   const excluded = new Set(config2.exclude ?? []);
-  for (const it of ark?.items ?? []) {
+  for (const it of items) {
     if (excluded.has(it.package)) {
       if (!it.required) continue;
       warnings.push(`${it.package} is required by ${it.sources.join(", ")}; "exclude" can't drop it.`);
     }
     arkRoots.push({ name: it.package, range: it.range, channel: it.channel, sources: it.sources });
   }
-  const collections = [];
-  for (const ref of config2.collections ?? []) {
-    const c = await api2.readCollection(ref);
-    collections.push(c);
-    for (const it of c.items) {
-      const same = arkRoots.find((r) => r.name === it.package && r.digest);
-      if (same && same.range !== it.version) throw new CliError(`${it.package}: ${same.sources.join(", ")} pins ${same.range}, but ${c.ref} pins ${it.version}.`, "Use versions of these collections that agree, or drop one.");
-      if (same) same.sources.push(c.ref);
-      else arkRoots.push({ name: it.package, range: it.version, channel: null, sources: [c.ref], digest: it.digest, via: "collection" });
-    }
-  }
-  const resolved = await resolveAll(api2, {
+  const resolved = await resolveAll(api, {
     channel: config2.channel,
     roots: config2.packages,
     arkRoots,
@@ -41679,13 +41479,13 @@ async function planSync(api2, opts) {
     update: opts.update,
     requireSignatures: opts.requireSignatures
   });
-  for (const it of [...ark?.items ?? [], ...collections.flatMap((c) => c.items)]) {
+  for (const it of items) {
     const r = resolved.get(it.package);
     if (r && it.config.servers) r.pkg = withServerOverrides(r.pkg, it.config.servers);
   }
   const packages = [...resolved.values()].map((r) => r.pkg);
   for (const m of config2.mcp ?? []) packages.push(connectionPackage(connectionFor(opts.server, m)));
-  const base = config2.scope === "user" ? opts.home ?? os3.homedir() : opts.dir;
+  const base = config2.scope === "user" ? opts.home ?? os4.homedir() : opts.dir;
   const prevOutputs = opts.lock?.outputs ?? {};
   const outputs = {};
   for (const [h, o] of Object.entries(prevOutputs)) if (!harnesses.includes(h) && config2.harnesses.includes(h)) outputs[h] = o;
@@ -41763,11 +41563,10 @@ async function planSync(api2, opts) {
     scope: config2.scope,
     packages: Object.fromEntries([...resolved.entries()].map(([n, r]) => [n, r.lock])),
     outputs,
-    ...ark ? { arks: ark.arks.map((a) => a.ref) } : {},
-    ...collections.length ? { collections: collections.map((c) => c.ref) } : {}
+    ...ark || publicArks2.length ? { arks: [...ark?.arks.map((a) => a.ref) ?? [], ...publicArks2.map((a) => a.ref)] } : {}
   };
   const lockChanged = !opts.lock || stringifyLock(lock) !== stringifyLock(opts.lock);
-  return { resolved, packages, changes, conflicts, kept, notes, warnings, ark, collections, lock, lockChanged, base };
+  return { resolved, packages, changes, conflicts, kept, notes, warnings, ark, publicArks: publicArks2, lock, lockChanged, base };
 }
 function withServerOverrides(pkg, overrides) {
   const ts = pkg.manifest.toolset;
@@ -41915,46 +41714,45 @@ async function init2(opts) {
 async function context(flags = {}) {
   const cwd = process.cwd();
   const conn = await resolveConnection({ dir: cwd, registry: flags.registry });
-  const api2 = new Api(conn);
+  const api = new Api(conn);
   const project = flags.user ? null : await loadProjectConfig(cwd, { required: false });
-  if (project) return { dir: cwd, config: project, conn, api: api2, lock: await loadLock(cwd), userMode: false };
+  if (project) return { dir: cwd, config: project, conn, api, lock: await loadLock(cwd), userMode: false };
   const dir = userStateDir();
   let config2 = await loadProjectConfig(dir, { required: false });
   if (!config2) {
-    const detected = detectHarnesses2(os4.homedir());
-    config2 = { channel: "stable", scope: "user", harnesses: detected.length ? detected : ["claude-code"], packages: {}, arks: "auto" };
+    const detected2 = detectHarnesses2(os5.homedir());
+    config2 = { channel: "stable", scope: "user", harnesses: detected2.length ? detected2 : ["claude-code"], packages: {}, arks: "auto" };
     await mkdir3(dir, { recursive: true });
     await saveProjectConfig(dir, config2);
     ui.info(`No ${CONFIG_FILE} here, so yarkr installs your arks into your home directory (${config2.harnesses.join(", ")}). Settings: ${path5.join(dir, CONFIG_FILE)}.`);
   }
-  return { dir, config: config2, conn, api: api2, lock: await loadLock(dir), userMode: true };
+  return { dir, config: config2, conn, api, lock: await loadLock(dir), userMode: true };
 }
-async function sync(flags, update2, collectionRefs = []) {
-  const { dir, config: config2, conn, api: api2, lock, userMode } = await context(flags);
+async function sync(flags, update2, arkRefs = []) {
+  const { dir, config: config2, conn, api, lock, userMode } = await context(flags);
   const harnesses = parseHarnesses(flags.harness);
-  if (collectionRefs.length) {
-    for (const ref of collectionRefs) {
-      const parsed = parseCollectionRef(ref);
-      if (!parsed) throw new CliError(`"${ref}" isn't a collection.`, "Collections look like @<handle>/<name>, or @<handle>/<name>@<version> for one version.");
-      const base = `@${parsed.handle}/${parsed.name}`;
-      config2.collections = [...(config2.collections ?? []).filter((c) => c !== base && !c.startsWith(`${base}@`)), ref];
+  if (arkRefs.length) {
+    for (const ref of arkRefs) {
+      if (ref !== "@me" && !/^[a-z0-9][a-z0-9-]*\/[a-z0-9][a-z0-9-]*$/.test(ref)) throw new CliError(`"${ref}" isn't an ark.`, "Arks look like <org>/<ark>, e.g. acme/starter; @me is your personal ark.");
+      const listed = Array.isArray(config2.arks) ? config2.arks : config2.arks === "auto" && conn.token ? (await api.myArk()).arks.map((a) => a.ref) : [];
+      config2.arks = [...listed.filter((a) => a !== ref), ref];
     }
     for (const h of harnesses ?? []) if (!config2.harnesses.includes(h)) config2.harnesses.push(h);
   }
   const runConfig = !conn.token && config2.arks === "auto" ? { ...config2, arks: void 0 } : config2;
-  if (runConfig !== config2 && userMode) ui.info("Not signed in, so only collections are synced. `yarkr login` adds your arks.");
-  const opts = { dir, config: runConfig, lock, server: conn.server, harnesses, update: update2, requireSignatures: flags.requireSignatures };
-  const plan = await planSync(api2, opts);
-  if (collectionRefs.length && !flags.dryRun && !flags.check) await saveProjectConfig(dir, config2);
+  if (runConfig !== config2 && userMode) ui.info("Not signed in, so only packages and public arks are synced. `yarkr login` adds your arks.");
+  const opts = { dir, config: runConfig, lock, server: conn.server, harnesses, update: update2, requireSignatures: flags.requireSignatures, signedIn: !!conn.token };
+  const plan = await planSync(api, opts);
+  if (arkRefs.length && !flags.dryRun && !flags.check) await saveProjectConfig(dir, config2);
   if (plan.ark) ui.info(plan.ark.arks.length ? `Arks: ${plan.ark.arks.map((a) => a.ref).join(", ")}` : "No arks give you anything yet.");
-  for (const c of plan.collections) ui.info(`Collection ${c.ref}${c.version < c.latest ? ui.dim(` (latest is ${c.latest})`) : ""}${c.description ? ui.dim(` \xB7 ${c.description}`) : ""}`);
+  for (const a of plan.publicArks) ui.info(`Public ark ${a.ref}${a.description ? ui.dim(` \xB7 ${a.description}`) : ""}`);
   for (const [name, r] of [...plan.resolved.entries()].sort(([a], [b]) => a < b ? -1 : 1)) {
     const prev = lock?.packages[name]?.version;
-    const via = r.lock.required_by.length ? ui.dim(` (via ${r.lock.required_by.map((v) => v.replace(/^(ark|collection):/, "$1 ")).join(", ")})`) : "";
+    const via = r.lock.required_by.length ? ui.dim(` (via ${r.lock.required_by.map((v) => v.replace(/^ark:/, "ark ")).join(", ")})`) : "";
     const move = prev && prev !== r.lock.version ? `${ui.dim(prev)} \u2192 ${ui.bold(r.lock.version)}` : ui.bold(r.lock.version);
     ui.step(`${name} ${move}${via}`);
   }
-  if (!plan.resolved.size && !plan.ark && !plan.collections.length) ui.info(`No packages in ${CONFIG_FILE}. Add one with \`yarkr add <namespace/name>\`.`);
+  if (!plan.resolved.size && !plan.ark && !plan.publicArks.length) ui.info(`No packages in ${CONFIG_FILE}. Add one with \`yarkr add <namespace/name>\`.`);
   for (const w of plan.warnings) ui.warn(w);
   printChanges(plan.changes);
   for (const k of plan.kept) ui.warn(flags.force ? `${k.path}: discarding your local edits (--force).` : `${k.path}: kept your local edits. \`yarkr diff\` shows them; open a pull request in the package's repo to send them upstream.`);
@@ -41997,16 +41795,16 @@ var splitSpec = (spec) => {
   return at > 0 ? { name: spec.slice(0, at), range: spec.slice(at + 1) } : { name: spec, range: "" };
 };
 async function add(specs, flags) {
-  const { dir, config: config2, conn, api: api2, userMode } = await context(flags);
+  const { dir, config: config2, conn, api, userMode } = await context(flags);
   const added = [];
   for (const spec of specs) {
     let { name, range } = splitSpec(spec);
     if (!PackageName.safeParse(name).success) throw new CliError(`"${name}" isn't a package name.`, "Use namespace/name, e.g. finance/invoice-extraction.");
     if (!range) {
-      const rel2 = await api2.resolve(name, { channel: config2.channel });
+      const rel2 = await api.resolve(name, { channel: config2.channel });
       range = `^${rel2.version}`;
     }
-    if (userMode && conn.token) await api2.addPersonal(name, range);
+    if (userMode && conn.token) await api.addPersonal(name, range);
     else config2.packages[name] = range;
     added.push(`${name}@${range}`);
   }
@@ -42017,38 +41815,38 @@ async function add(specs, flags) {
   if (!flags.noSync) await sync(flags, new Set(specs.map((s) => splitSpec(s).name)));
 }
 async function remove(names, flags) {
-  const { dir, config: config2, conn, api: api2, lock, userMode } = await context(flags);
-  const syncedCollection = (n) => {
-    const col = parseCollectionRef(n);
-    const base = col && `@${col.handle}/${col.name}`;
-    return base ? (config2.collections ?? []).filter((c) => c === base || c.startsWith(`${base}@`)) : [];
-  };
-  const needsArk = names.some((n) => !(n in config2.packages) && !syncedCollection(n).length);
-  const ark = needsArk && config2.arks && (conn.token || config2.arks !== "auto") ? await api2.myArk(config2.arks === "auto" ? void 0 : config2.arks) : null;
+  const { dir, config: config2, conn, api, lock, userMode } = await context(flags);
+  const listedArk = (n) => Array.isArray(config2.arks) && config2.arks.includes(n);
+  const needsArk = names.some((n) => !(n in config2.packages) && !listedArk(n));
+  const ark = needsArk && config2.arks && conn.token ? await api.myArk(config2.arks === "auto" ? void 0 : await ownArks(api, config2.arks)) : null;
   const personalRef = ark?.arks.find((a) => a.kind === "personal")?.ref;
   for (const n of names) {
     if (n in config2.packages) {
       delete config2.packages[n];
       continue;
     }
-    const cols = syncedCollection(n);
-    if (cols.length) {
-      config2.collections = config2.collections.filter((c) => !cols.includes(c));
-      if (!config2.collections.length) delete config2.collections;
+    if (listedArk(n)) {
+      config2.arks = config2.arks.filter((a) => a !== n);
       continue;
     }
     const item = ark?.items.find((i) => i.package === n);
     if (!item) {
       const via = lock?.packages[n]?.required_by ?? [];
-      throw new CliError(`${n} isn't a direct dependency, an ark item or a collection here.`, via.length ? `It's installed because ${via.join(", ")} needs it.` : void 0);
+      const fromPublicArk = via.some((v) => v.startsWith("ark:") && !ark?.arks.some((a) => `ark:${a.ref}` === v));
+      if (fromPublicArk) {
+        if (userMode) throw new CliError(`${n} comes from a public ark (${via.join(", ")}).`, `Remove the ark itself, or list the package under "exclude" if it's optional.`);
+        config2.exclude = [.../* @__PURE__ */ new Set([...config2.exclude ?? [], n])];
+        continue;
+      }
+      throw new CliError(`${n} isn't a direct dependency, an ark or an ark item here.`, via.length ? `It's installed because ${via.join(", ")} needs it.` : void 0);
     }
     const orgSources = item.sources.filter((src) => src !== personalRef);
     if (orgSources.length && item.required) {
       throw new CliError(`${n} is required by ${orgSources.join(", ")}.`, "Only optional ark items can be removed. Ask the ark's admin.");
     }
-    if (personalRef && item.sources.includes(personalRef)) await api2.removePersonal(n);
+    if (personalRef && item.sources.includes(personalRef)) await api.removePersonal(n);
     for (const src of orgSources) {
-      if (userMode) await api2.exclude(src, n, true);
+      if (userMode) await api.exclude(src, n, true);
       else config2.exclude = [.../* @__PURE__ */ new Set([...config2.exclude ?? [], n])];
     }
   }
@@ -42057,8 +41855,8 @@ async function remove(names, flags) {
   if (!flags.noSync) await sync(flags);
 }
 async function showArk(refs, opts) {
-  const api2 = new Api(await resolveConnection({ dir: process.cwd() }));
-  const eff = await api2.myArk(refs.length ? refs : void 0);
+  const api = new Api(await resolveConnection({ dir: process.cwd() }));
+  const eff = await api.myArk(refs.length ? refs : void 0);
   if (opts.json) return console.log(JSON.stringify(eff, null, 2));
   if (!eff.arks.length) return ui.info("No arks give you anything yet. Ask an org admin, or add your own with `yarkr add` outside a project.");
   ui.heading("Your arks");
@@ -42071,7 +41869,18 @@ async function showArk(refs, opts) {
     );
   } else ui.info("Your arks are empty.");
   if (eff.excluded.length) ui.step(`Excluded by you: ${eff.excluded.map((e) => `${e.package} (${e.ark})`).join(", ")}`);
-  if (!eff.personal_allowed) ui.step("Your org doesn't allow personal additions.");
+}
+async function publicArks(opts) {
+  const api = new Api(await resolveConnection({ dir: process.cwd() }));
+  const arks = await api.publicArks();
+  if (opts.json) return console.log(JSON.stringify(arks, null, 2));
+  if (!arks.length) return ui.info("No public arks yet. An org admin makes one public on the ark's page.");
+  ui.table(arks.map((a) => [ui.bold(a.ref), String(a.items.length), a.uses_30d === void 0 ? "\u2014" : String(a.uses_30d), a.description]), ["ark", "packages", "uses (30d)", "description"]);
+  ui.step(`Install one with ${ui.code("yarkr sync <org>/<ark>")}, or connect it with ${ui.code("yarkr mcp add <org>/<ark>")}. No sign-in needed.`);
+}
+async function ownArks(api, refs) {
+  const all = await api.myArk();
+  return refs.filter((r) => r === "@me" || all.arks.some((a) => a.ref === r));
 }
 async function update(names, flags) {
   return sync(flags, names.length ? new Set(names) : true);
@@ -42079,7 +41888,7 @@ async function update(names, flags) {
 
 // src/commands/diff.ts
 import { readFile as readFile4 } from "fs/promises";
-import os5 from "os";
+import os6 from "os";
 import path6 from "path";
 
 // ../../node_modules/.pnpm/diff@8.0.4/node_modules/diff/libesm/diff/base.js
@@ -42182,16 +41991,16 @@ var Diff = class {
       }
     }
   }
-  addToPath(path16, added, removed, oldPosInc, options) {
-    const last = path16.lastComponent;
+  addToPath(path17, added, removed, oldPosInc, options) {
+    const last = path17.lastComponent;
     if (last && !options.oneChangePerToken && last.added === added && last.removed === removed) {
       return {
-        oldPos: path16.oldPos + oldPosInc,
+        oldPos: path17.oldPos + oldPosInc,
         lastComponent: { count: last.count + 1, added, removed, previousComponent: last.previousComponent }
       };
     } else {
       return {
-        oldPos: path16.oldPos + oldPosInc,
+        oldPos: path17.oldPos + oldPosInc,
         lastComponent: { count: 1, added, removed, previousComponent: last }
       };
     }
@@ -42519,7 +42328,7 @@ async function diff(name, opts) {
   const lock = await loadLock(dir);
   if (!lock) throw new CliError("Nothing synced yet.", "Run `yarkr sync` first.");
   if (name && !lock.packages[name]) throw new CliError(`${name} isn't in yarkr.lock.`);
-  const base = config2.scope === "user" ? os5.homedir() : dir;
+  const base = config2.scope === "user" ? os6.homedir() : dir;
   const edited = [];
   for (const [harness, out] of Object.entries(lock.outputs)) {
     for (const [p, meta3] of Object.entries(out.files)) {
@@ -42542,9 +42351,9 @@ async function diff(name, opts) {
     for (const e of edited) console.log(e.path);
     return edited;
   }
-  const api2 = new Api(await resolveConnection({ dir }));
-  const key = await api2.signingKey().catch(() => null);
-  const pkgs = await Promise.all(Object.entries(lock.packages).map(async ([n, l]) => verifyBundle(await api2.bundle(n, l.version), key, false)));
+  const api = new Api(await resolveConnection({ dir }));
+  const key = await api.signingKey().catch(() => null);
+  const pkgs = await Promise.all(Object.entries(lock.packages).map(async ([n, l]) => verifyBundle(await api.bundle(n, l.version), key, false)));
   for (const harness of new Set(edited.map((e) => e.harness))) {
     const out = render(harness, { packages: pkgs, scope: config2.scope, layout: config2.layout?.[harness] });
     for (const e of edited.filter((x) => x.harness === harness)) {
@@ -42565,15 +42374,16 @@ async function diff(name, opts) {
 
 // src/commands/mcp.ts
 async function mcpAdd(scopes, flags) {
-  const { dir, config: config2, conn, api: api2, userMode } = await context(flags);
-  const me = conn.token ? await api2.me().catch(() => null) : null;
+  const { dir, config: config2, conn, api, userMode } = await context(flags);
+  const me = conn.token ? await api.me().catch(() => null) : null;
   for (const scope of scopes) {
-    if (!isConnectionScope(scope)) throw new CliError(`"${scope}" isn't an MCP scope.`, "Use an org (acme), a team (acme/finance), global/<ark>, @me, @<handle>/<collection>, all, or public.");
-    const org = !["all", "public"].includes(scope) && !scope.startsWith("global/") && !scope.startsWith("@") ? scope.split("/")[0] : null;
-    if (org && me && !me.orgs.some((o) => o.slug === org)) {
-      throw new CliError(`You aren't a member of ${org} on ${conn.server}.`, `Your orgs: ${me.orgs.map((o) => o.slug).join(", ") || "none"}.`);
+    if (!isConnectionScope(scope)) throw new CliError(`"${scope}" isn't an MCP scope.`, "Use an org (acme), a team or public ark (acme/finance), all, or public.");
+    const org = !["all", "public"].includes(scope) ? scope.split("/")[0] : null;
+    const member = !!org && !!me?.orgs.some((o) => o.slug === org);
+    const isPublic = !!org && !member && scope.includes("/") && await api.ark(scope).then((a) => a.public).catch(() => false);
+    if (org && !member && !isPublic && (me || !scope.includes("/"))) {
+      throw new CliError(`You aren't a member of ${org} on ${conn.server}${scope.includes("/") ? `, and ${scope} isn't a public ark` : ""}.`, `Your orgs: ${me?.orgs.map((o) => o.slug).join(", ") || "none"}.`);
     }
-    const isPublic = parseCollectionRef(scope) ? (await api2.readCollection(scope)).visibility === "public" : false;
     const entry = { scope, ...flags.tokenEnv && !isPublic ? { token_env: flags.tokenEnv } : {}, ...isPublic ? { public: true } : {} };
     config2.mcp = [...(config2.mcp ?? []).filter((m) => m.scope !== scope), entry];
   }
@@ -42597,7 +42407,7 @@ async function mcpList(flags) {
   const rows = (config2.mcp ?? []).map((m) => connectionFor(conn.server, m));
   if (flags.json) return console.log(JSON.stringify(rows, null, 2));
   if (!rows.length) {
-    ui.info("No MCP connections. Add one with `yarkr mcp add <org>` (or `<org>/<team>`, `@<handle>/<collection>`, `all`, `public`).");
+    ui.info("No MCP connections. Add one with `yarkr mcp add <org>` (or `<org>/<ark>`, `all`, `public`).");
     return;
   }
   ui.table(
@@ -42620,94 +42430,6 @@ function printHints(server, added, harnesses, userMode) {
   }
 }
 
-// src/commands/collection.ts
-var api = async () => new Api(await resolveConnection({ dir: process.cwd() }));
-function visibility(v) {
-  if (v === void 0) return void 0;
-  const r = CollectionVisibility.safeParse(v);
-  if (!r.success) throw new CliError(`"${v}" isn't a visibility.`, "Use private (only you), org (members of --org) or public (anyone, no sign-in).");
-  return r.data;
-}
-var audience = (c) => c.visibility === "org" ? `org ${c.org}` : c.visibility;
-function printCollection(c) {
-  ui.heading(`${c.ref} ${ui.dim(`(${audience(c)})`)}${c.description ? ui.dim(` \xB7 ${c.description}`) : ""}`);
-  if (c.arks.length) ui.table(c.arks.map((a) => [ui.bold(a.ref), a.kind, a.public ? "public" : "", a.description]), ["ark", "kind", "", "description"]);
-  else ui.info(`No arks yet. Add some with \`yarkr collection add ${c.name} <ark>\` (@me, <org>/<ark>, global/<ark>, or a public ark).`);
-  console.log();
-  if (c.versions.length) {
-    ui.table(c.versions.map((v) => [ui.bold(`@${v.version}`), String(v.items), v.published_at.slice(0, 10), v.note]), ["version", "packages", "published", "note"]);
-  } else ui.info(`Not published yet: \`yarkr collection publish ${c.name}\`.`);
-}
-function printRelease(r) {
-  ui.heading(`${r.ref} ${ui.dim(`(${r.visibility}${r.version < r.latest ? `, latest is ${r.latest}` : ""})`)}${r.note ? ui.dim(` \xB7 ${r.note}`) : ""}`);
-  if (!r.items.length) return ui.info("Empty.");
-  ui.table(
-    r.items.map((i) => [ui.bold(i.package), i.kind ?? "?", i.version, ui.dim(`${i.digest.slice(0, 12)}\u2026`), i.sources.join(", ")]),
-    ["package", "kind", "version", "digest", "from"]
-  );
-}
-async function collectionList(opts) {
-  const list = await (await api()).collections();
-  if (opts.json) return console.log(JSON.stringify(list, null, 2));
-  if (!list.length) return ui.info("No collections yet. Create one with `yarkr collection create <name>`.");
-  ui.table(
-    list.map((c) => [ui.bold(c.ref), audience(c), c.versions[0] ? `@${c.versions[0].version}` : ui.dim("unpublished"), String(c.arks.length), c.description]),
-    ["collection", "visibility", "latest", "arks", "description"]
-  );
-}
-async function collectionShow(ref, opts) {
-  const client = await api();
-  if (ref.startsWith("@")) {
-    const r = await client.readCollection(ref);
-    return opts.json ? console.log(JSON.stringify(r, null, 2)) : printRelease(r);
-  }
-  const c = await client.collection(ref);
-  if (opts.json) return console.log(JSON.stringify(c, null, 2));
-  printCollection(c);
-}
-async function collectionCreate(name, opts) {
-  const v = opts.public ? "public" : visibility(opts.visibility) ?? (opts.org ? "org" : "private");
-  const c = await (await api()).createCollection({ name, description: opts.description ?? "", visibility: v, ...opts.org ? { org: opts.org } : {} });
-  ui.ok(`Created ${c.ref} (${audience(c)}).`);
-  ui.step(`Add arks: ${ui.code(`yarkr collection add ${name} @me <org>/<ark> \u2026`)}, then ${ui.code(`yarkr collection publish ${name}`)}.`);
-}
-async function collectionEdit(name, opts) {
-  const v = opts.public ? "public" : visibility(opts.visibility) ?? (opts.org ? "org" : void 0);
-  if (v === void 0 && opts.description === void 0) throw new CliError("Nothing to change.", "Pass --visibility, --org, --public or --description.");
-  const c = await (await api()).updateCollection(name, { ...opts.description !== void 0 ? { description: opts.description } : {}, ...v ? { visibility: v } : {}, ...opts.org ? { org: opts.org } : {} });
-  ui.ok(`Updated ${c.ref} (${audience(c)}).`);
-}
-async function collectionDelete(name) {
-  await (await api()).deleteCollection(name);
-  ui.ok(`Deleted collection ${name}. Its published versions are gone too.`);
-}
-async function collectionAdd(name, refs) {
-  const client = await api();
-  let c;
-  for (const ref of refs) c = await client.addCollectionArk(name, ref);
-  ui.ok(`Added ${refs.join(", ")} to ${c.ref}. Publish to make it part of a version.`);
-}
-async function collectionRemove(name, refs) {
-  const client = await api();
-  let c;
-  for (const ref of refs) c = await client.removeCollectionArk(name, ref);
-  ui.ok(`Removed ${refs.join(", ")} from ${c.ref}. Publish to make it part of a version.`);
-}
-async function collectionPublish(name, opts) {
-  const r = await (await api()).publishCollection(name, opts.message ?? "");
-  if (opts.json) return console.log(JSON.stringify(r, null, 2));
-  if (r.unchanged) ui.info(`Nothing changed since ${r.ref}.`);
-  else ui.ok(`Published ${r.ref}.`);
-  printRelease(r);
-  ui.step(`Use it: ${ui.code(`yarkr sync ${r.collection}`)} (latest) or ${ui.code(`yarkr sync ${r.ref}`)}, or ${ui.code(`yarkr mcp add ${r.collection}`)}.`);
-}
-async function collectionArks(opts) {
-  const list = await (await api()).publicArks();
-  if (opts.json) return console.log(JSON.stringify(list, null, 2));
-  if (!list.length) return ui.info("No public arks yet.");
-  ui.table(list.map((a) => [ui.bold(a.ref), String(a.items.length), a.description]), ["ark", "packages", "description"]);
-}
-
 // src/commands/eval.ts
 var import_ajv2 = __toESM(require_ajv(), 1);
 import { existsSync as existsSync7 } from "fs";
@@ -42735,9 +42457,6 @@ function evalEnvFromProcess(env = process.env) {
     anthropicApiKey: nonEmpty(env.ANTHROPIC_API_KEY),
     openaiApiKey: nonEmpty(env.OPENAI_API_KEY),
     judgeModel: nonEmpty(env.JUDGE_MODEL) ?? "claude-sonnet-5",
-    customHttpUrl: nonEmpty(env.EVAL_CUSTOM_HTTP_URL),
-    customHttpToken: nonEmpty(env.EVAL_CUSTOM_HTTP_TOKEN),
-    customHttpVersion: nonEmpty(env.EVAL_CUSTOM_HTTP_VERSION),
     opencodeProvider: nonEmpty(env.EVAL_OPENCODE_PROVIDER),
     claudeAllowedTools: nonEmpty(env.EVAL_CLAUDE_ALLOWED_TOOLS),
     extraSecrets: { YARKR_TOKEN: nonEmpty(env.YARKR_TOKEN) },
@@ -42806,7 +42525,6 @@ function harnessAccessEnv(harness, env) {
   };
   switch (harness) {
     case "claude-code":
-    case "claude-cowork":
       if (gw) {
         out.ANTHROPIC_BASE_URL = gw.url;
         out.ANTHROPIC_AUTH_TOKEN = gw.token;
@@ -42849,7 +42567,6 @@ function secretsOf(env) {
     [env.inferenceTokenName ?? "INFERENCE_API_TOKEN"]: env.inferenceToken,
     ANTHROPIC_API_KEY: env.anthropicApiKey,
     OPENAI_API_KEY: env.openaiApiKey,
-    EVAL_CUSTOM_HTTP_TOKEN: env.customHttpToken,
     ...env.extraSecrets
   };
   return Object.fromEntries(Object.entries(all).filter((e) => typeof e[1] === "string" && e[1].length >= 8));
@@ -42858,11 +42575,10 @@ async function nativeRequirements(harness, env, onPath2) {
   const missing = [];
   const gw = gatewayOf(env);
   const access2 = "INFERENCE_API_URL + INFERENCE_API_TOKEN";
-  if (gw && !gw.token && harness !== "custom-http")
+  if (gw && !gw.token)
     missing.push("INFERENCE_API_TOKEN (or API_TOKEN), since INFERENCE_API_URL is set");
   switch (harness) {
     case "claude-code":
-    case "claude-cowork":
       if (!await onPath2("claude"))
         missing.push("the `claude` CLI (npm i -g @anthropic-ai/claude-code)");
       if (!gw && !env.anthropicApiKey)
@@ -42880,10 +42596,6 @@ async function nativeRequirements(harness, env, onPath2) {
       if (!gw && !env.openaiApiKey && !env.anthropicApiKey)
         missing.push(`${access2}, ANTHROPIC_API_KEY or OPENAI_API_KEY`);
       break;
-    case "custom-http":
-      if (!env.customHttpUrl)
-        missing.push("EVAL_CUSTOM_HTTP_URL");
-      break;
     default:
       missing.push(`a native runner (there is none for ${harness} yet; use --simulated)`);
   }
@@ -42930,10 +42642,10 @@ async function loadSuites(candidate, candFiles, shared) {
   }
   return out;
 }
-function parseSuite(bytes, ref, path16, source) {
+function parseSuite(bytes, ref, path17, source) {
   const text = bytes.toString("utf8");
   try {
-    return { suite: parseEvalSuite(text, path16), ref, path: path16, source, hash: sha256(text) };
+    return { suite: parseEvalSuite(text, path17), ref, path: path17, source, hash: sha256(text) };
   } catch (err) {
     throw new SuiteError(err.message);
   }
@@ -42950,7 +42662,7 @@ function narrowSuites(suites, f) {
 }
 
 // ../../packages/evals/dist/runners/shared.js
-import { spawn } from "child_process";
+import { spawn as spawn2 } from "child_process";
 import { access, readFile as readFile6 } from "fs/promises";
 import { constants } from "fs";
 import path8 from "path";
@@ -43068,7 +42780,7 @@ async function onPath(bin, pathVar = process.env.PATH ?? "") {
 function runProcess(cmd, args, opts) {
   return new Promise((resolve, reject) => {
     const started = Date.now();
-    const child = spawn(cmd, args, { cwd: opts.cwd, env: opts.env, stdio: ["pipe", "pipe", "pipe"] });
+    const child = spawn2(cmd, args, { cwd: opts.cwd, env: opts.env, stdio: ["pipe", "pipe", "pipe"] });
     let stdout = "";
     let stderr = "";
     let timedOut = false;
@@ -43291,10 +43003,10 @@ function redact(value, secrets) {
 
 // ../../packages/evals/dist/cache.js
 import { mkdir as mkdir5, readFile as readFile7, rename, writeFile as writeFile5 } from "fs/promises";
-import os6 from "os";
+import os7 from "os";
 import path9 from "path";
 function defaultCacheDir(env = process.env) {
-  return env.YARKR_CACHE_DIR || path9.join(env.XDG_CACHE_HOME || path9.join(os6.homedir(), ".cache"), "yarkr");
+  return env.YARKR_CACHE_DIR || path9.join(env.XDG_CACHE_HOME || path9.join(os7.homedir(), ".cache"), "yarkr");
 }
 function fileTrialCache(dir) {
   const root = path9.join(dir, "evals");
@@ -43324,7 +43036,7 @@ function fileTrialCache(dir) {
 // ../../packages/evals/dist/execute.js
 import { randomUUID } from "crypto";
 import { mkdir as mkdir6, rm as rm2, stat as stat2 } from "fs/promises";
-import os7 from "os";
+import os8 from "os";
 import path11 from "path";
 
 // ../../packages/evals/dist/graders/index.js
@@ -43561,11 +43273,12 @@ async function gradeReal(ctx) {
 }
 
 // ../../packages/evals/dist/runners/claude-code.js
-function claudeCodeAdapter(env, fidelity = "native") {
+function claudeCodeAdapter(env) {
+  const fidelity = "native";
   const pathVar = baseProcessEnv(env).PATH;
   let cachedVersion = null;
   return {
-    id: fidelity === "native" ? "claude-code" : "claude-code(equivalent)",
+    id: "claude-code",
     fidelity,
     async available() {
       return await onPath("claude", pathVar) !== null;
@@ -43769,67 +43482,6 @@ function codexAdapter(env) {
   };
 }
 
-// ../../packages/evals/dist/runners/custom-http.js
-function customHttpAdapter(env) {
-  const url2 = env.customHttpUrl;
-  let files = {};
-  return {
-    id: "custom-http",
-    fidelity: "native",
-    async available() {
-      return !!url2;
-    },
-    async version() {
-      return env.customHttpVersion ?? "custom";
-    },
-    async install(_pkg, f) {
-      files = Object.fromEntries([...f].map(([k, v]) => [k, v.toString("base64")]));
-    },
-    async run(input2) {
-      if (!url2)
-        throw new Error("EVAL_CUSTOM_HTTP_URL is not set.");
-      const started = Date.now();
-      const res = await fetch(url2, {
-        method: "POST",
-        signal: AbortSignal.timeout(input2.limits.timeoutMs),
-        headers: {
-          "content-type": "application/json",
-          ...env.customHttpToken ? { authorization: `Bearer ${env.customHttpToken}` } : {}
-        },
-        body: JSON.stringify({
-          case: { id: input2.evalCase.id, prompt: input2.evalCase.prompt },
-          model: input2.model,
-          limits: input2.limits,
-          package: { name: input2.pkg.name, version: input2.pkg.label, files, encoding: "base64" }
-        })
-      });
-      if (!res.ok)
-        throw new Error(`custom-http runner returned ${res.status}: ${(await res.text()).slice(0, 300)}`);
-      const t = await res.json();
-      if (typeof t.output !== "string")
-        throw new Error("custom-http runner response is missing `output`.");
-      return {
-        transcript: {
-          harness: input2.harness,
-          harness_version: t.harness_version ?? await this.version(),
-          model: input2.model,
-          events: t.events ?? [{ role: "assistant", content: t.output, at_ms: 0 }],
-          output: t.output,
-          files: t.files ?? {},
-          tool_calls: t.tool_calls ?? [],
-          skills_loaded: t.skills_loaded ?? [],
-          turns: t.turns ?? 1,
-          tokens_in: t.tokens_in ?? 0,
-          tokens_out: t.tokens_out ?? 0,
-          cost_usd: t.cost_usd ?? 0,
-          latency_ms: t.latency_ms ?? Date.now() - started,
-          fidelity: "native"
-        }
-      };
-    }
-  };
-}
-
 // ../../packages/evals/dist/runners/opencode.js
 function opencodeAdapter(env) {
   const pathVar = baseProcessEnv(env).PATH;
@@ -44027,11 +43679,9 @@ function synthesize(input2, c, plan) {
 
 // ../../packages/evals/dist/runners/index.js
 var NATIVE = {
-  "claude-code": (env) => claudeCodeAdapter(env, "native"),
-  "claude-cowork": (env) => claudeCodeAdapter(env, "equivalent"),
+  "claude-code": claudeCodeAdapter,
   codex: codexAdapter,
-  opencode: opencodeAdapter,
-  "custom-http": customHttpAdapter
+  opencode: opencodeAdapter
 };
 var NativeUnavailableError = class extends Error {
 };
@@ -44080,7 +43730,7 @@ async function executeRun(input2) {
   const { candidate, baseline, env } = input2;
   const suites = input2.harnesses?.length || input2.models?.length ? narrowSuites(input2.suites, { harnesses: input2.harnesses, models: input2.models }) : input2.suites;
   const shards = planShards(suites, input2.mode, !!baseline);
-  const tmpRoot = input2.tmpRoot ?? path11.join(os7.tmpdir(), "yarkr-eval", runId);
+  const tmpRoot = input2.tmpRoot ?? path11.join(os8.tmpdir(), "yarkr-eval", runId);
   const timeoutMs = input2.shardTimeoutMs ?? DEFAULT_SHARD_TIMEOUT_MS;
   const secrets = secretsOf(env);
   const adapterFor = adapterPicker(env, { native: input2.native, strict: input2.strict });
@@ -44227,7 +43877,8 @@ async function executeRun(input2) {
   const draft = buildReport({
     runId,
     mode: input2.mode,
-    status: "running",
+    // Placeholder: the status depends on the report, and is set just below.
+    status: "failed",
     baselineVersion: baseline?.label ?? null,
     candidateVersion: input2.candidateVersion ?? null,
     suites,
@@ -44406,7 +44057,7 @@ ${suites.join("\n")}
 import { execFile } from "child_process";
 import { existsSync as existsSync5, readFileSync as readFileSync2 } from "fs";
 import { mkdtemp, rm as rm3 } from "fs/promises";
-import os8 from "os";
+import os9 from "os";
 import path12 from "path";
 import { promisify } from "util";
 var exec = promisify(execFile);
@@ -44465,7 +44116,7 @@ async function checkoutRef(dir, ref) {
   if (!commit) {
     throw new CliError(`git ref "${ref}" doesn't exist here.`, "In CI, check out with `fetch-depth: 0` or fetch the base branch first, e.g. `git fetch origin main`.", 2);
   }
-  const tmp = await mkdtemp(path12.join(os8.tmpdir(), "yarkr-baseline-"));
+  const tmp = await mkdtemp(path12.join(os9.tmpdir(), "yarkr-baseline-"));
   const wt = path12.join(tmp, "tree");
   try {
     await exec("git", ["worktree", "add", "--detach", "--force", wt, commit], { cwd: top });
@@ -44489,21 +44140,21 @@ async function checkoutRef(dir, ref) {
 }
 
 // src/eval/registry.ts
-async function registrySnapshot(api2, name, opts = {}) {
-  const pkg = await api2.pkgOrNull(name);
+async function registrySnapshot(api, name, opts = {}) {
+  const pkg = await api.pkgOrNull(name);
   if (!pkg) return null;
-  const rel2 = await api2.resolve(name, { channel: opts.channel ?? "stable", range: opts.range });
-  const bundle = await api2.bundle(name, rel2.version);
+  const rel2 = await api.resolve(name, { channel: opts.channel ?? "stable", range: opts.range });
+  const bundle = await api.bundle(name, rel2.version);
   const files = new Map(bundle.files.map((f) => [f.path, Buffer.from(f.content, "base64")]));
-  const tree = buildTree([...files].map(([path16, bytes]) => ({ path: path16, bytes })));
+  const tree = buildTree([...files].map(([path17, bytes]) => ({ path: path17, bytes })));
   return { snapshot: { name, label: bundle.version, contentHash: bundle.content_hash, manifest: bundle.manifest, tree }, files };
 }
 function registrySuiteResolver(getApi) {
   return {
     async resolve(name, range) {
-      const api2 = await getApi();
-      if (!api2) throw new SuiteError(`Shared suite ${name}@${range} needs a registry. Set YARKR_REGISTRY (and YARKR_TOKEN), or run \`yarkr login\`.`);
-      return registrySnapshot(api2, name, { range: range === "*" ? void 0 : range });
+      const api = await getApi();
+      if (!api) throw new SuiteError(`Shared suite ${name}@${range} needs a registry. Set YARKR_REGISTRY (and YARKR_TOKEN), or run \`yarkr login\`.`);
+      return registrySnapshot(api, name, { range: range === "*" ? void 0 : range });
     }
   };
 }
@@ -44574,7 +44225,7 @@ function matchPackage(scan, pkg) {
 }
 
 // src/eval/upload.ts
-import os9 from "os";
+import os10 from "os";
 function toImportedTrial(t, transcripts) {
   const { events: _events, tool_calls: _calls, files: _files, output: _output, ...summary } = t.transcript;
   return {
@@ -44596,7 +44247,7 @@ function runnerLabel(env = process.env) {
     const url2 = env.GITHUB_SERVER_URL && env.GITHUB_REPOSITORY && env.GITHUB_RUN_ID ? ` ${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}/actions/runs/${env.GITHUB_RUN_ID}` : "";
     return `github-actions${url2}`.slice(0, 200);
   }
-  return `yarkr-cli on ${env.CI ? "ci" : os9.platform()}`;
+  return `yarkr-cli on ${env.CI ? "ci" : os10.platform()}`;
 }
 async function githubOidcToken(env = process.env, fetchImpl = fetch) {
   const url2 = env.ACTIONS_ID_TOKEN_REQUEST_URL;
@@ -44830,15 +44481,15 @@ async function resolveBaseline(dir, pkg, opts, getApi, say) {
     }
   }
   if (spec === "registry" || spec === "auto") {
-    const api2 = await getApi();
-    if (!api2 || spec === "auto" && !pkg.named) {
+    const api = await getApi();
+    if (!api || spec === "auto" && !pkg.named) {
       if (spec === "registry") throw fail("--baseline registry needs a registry.", "Set YARKR_REGISTRY and YARKR_TOKEN, or run `yarkr login`.");
       if (say) ui.step("No baseline: no registry configured or no package name. Use --baseline git:<ref> or <dir> to compare.");
       return noBaseline();
     }
     let rel2;
     try {
-      rel2 = await registrySnapshot(api2, pkg.snapshot.name);
+      rel2 = await registrySnapshot(api, pkg.snapshot.name);
     } catch (err) {
       if (spec === "registry") throw fail(`Couldn't fetch the registry baseline for ${pkg.snapshot.name}: ${err.message}`);
       if (say) ui.step(`No baseline: ${err.message}`);
@@ -44859,8 +44510,8 @@ async function resolveBaseline(dir, pkg, opts, getApi, say) {
   } };
 }
 async function upload(dir, pkg, run3, mode, getApi, env, say) {
-  const api2 = await getApi();
-  if (!api2) throw fail("--report needs a registry and a token.", "Set YARKR_REGISTRY and YARKR_TOKEN, or run `yarkr login`.");
+  const api = await getApi();
+  if (!api) throw fail("--report needs a registry and a token.", "Set YARKR_REGISTRY and YARKR_TOKEN, or run `yarkr login`.");
   if (run3.trials.length > 5e3) throw fail(`${run3.package}: ${run3.trials.length} trials are more than one upload takes (5000). Narrow the run with --suite, --harness or --model.`);
   const git2 = pkg.named ? null : await gitInfo(dir);
   if (!pkg.named && !git2) throw fail(`--report can't tell which package ${pkg.asset.name} is.`, "Pass --package <namespace/name>, or run inside a git checkout with an origin remote.");
@@ -44877,7 +44528,7 @@ async function upload(dir, pkg, run3, mode, getApi, env, say) {
     }),
     secretsOf(env)
   );
-  const res = await api2.importEvalRun(body).catch((err) => {
+  const res = await api.importEvalRun(body).catch((err) => {
     throw fail(`Upload failed: ${err.message}`, err instanceof CliError ? err.hint : void 0);
   });
   if (say) ui.ok(`Uploaded (${res.trust}): ${res.url}`);
@@ -45059,8 +44710,165 @@ async function gradeCase(c, caseDir, pkgRoot, runScripts) {
   }
 }
 
+// src/commands/guide.ts
+import { mkdir as mkdir8, stat as stat3, writeFile as writeFile7 } from "fs/promises";
+import path16 from "path";
+
+// ../../packages/core/dist/guides/content.generated.js
+var GUIDE_CONTENT = {
+  "create-ark": '---\nname: create-ark\ndescription: Build a Yarkr ark (a set of skills, agents or MCP configs handed to a team) for a given topic and type. Use when asked to create, assemble or curate an ark, or to collect a topic\'s skills, agents or MCP servers for a team in Yarkr.\n---\n\n# Creating an ark from a topic and a type\n\nYou get two inputs and build one [ark](https://github.com/posterus-ltd/yarkr-public/blob/main/docs/arks.md) that hands out packages on that topic.\n\n| Input | Example | Meaning |\n| --- | --- | --- |\n| **topic** | `invoice processing`, `frontend testing` | what the ark is about |\n| **type** | `skill`, `agent` or `mcp` | the kind of package it holds. `mcp` is a **toolset** in Yarkr (`--kind toolset`, `kind: toolset`) |\n\nPlus, from the user or their config: the **org** (its slug is its GitHub login, lowercased), and whether the ark should\nbe **public**. Ask for the org if you can\'t tell; default to private.\n\nAn ark only points at packages. Packages come from GitHub ([github.md](https://github.com/posterus-ltd/yarkr-public/blob/main/docs/github.md)): there is no way to upload content to\nYarkr directly. So the work is: find what exists, write what\'s missing in a repo, then assemble the ark.\n\n```\n1. plan \u2500\u2500\u25B6 2. find existing \u2500\u2500\u25B6 3. author missing (PR) \u2500\u2500\u25B6 4. wait for index \u2500\u2500\u25B6 5. create ark + items \u2500\u2500\u25B6 6. verify\n```\n\n---\n\n## 1. Plan\n\n- **Ark name:** a slug, `^[a-z0-9][a-z0-9-]*$`, short and named after the topic: `invoice-processing`, not\n  `ark-for-invoices`. It must be unique in the org.\n- **Description:** one sentence, at most 500 characters, saying who it\'s for and what they get.\n- **Scope:** aim for 3 to 8 packages. Every skill in an ark goes into every member\'s context; too many makes agents\n  worse. Split a broad topic into several arks rather than one big one.\n- List the packages you expect to need, each with a one-line purpose, before searching.\n\n## 2. Find what already exists\n\nReuse beats writing. Search the registry for each planned package:\n\n```bash\nyarkr search "<topic words>" --kind <skill|agent|toolset> --json\nyarkr info <namespace>/<name>        # source repo, targets, releases, eval results\n```\n\nOver MCP, `search_packages` with `scope: "all"`, then `get_skill` / `get_agent` / `get_toolset` to read one.\n\nKeep a package when:\n\n- its description and body actually cover the planned purpose (read it, don\'t trust the name);\n- the org can put it in an ark: **the org\'s own namespace, or any public package**;\n- for a public ark: **it is public**. A public ark can hold nothing else;\n- it isn\'t yanked or archived, and has evals that pass if any are shown.\n\n## 3. Author what\'s missing\n\nWrite each missing package in one of the org\'s **connected** repos (check **Settings \u2192 GitHub** / `/orgs/<org>/github`;\na repo that isn\'t connected is never indexed). For a public ark the repo must be public. Open **one pull request** with\nall new packages, and describe the ark they\'re for. Merging is publishing; don\'t push to the default branch yourself\nunless the user tells you to.\n\nPackage names come from the folder or `name:` frontmatter, slugified, and publish as `<org>/<name>`. Check that the name\ndoesn\'t already exist in the org.\n\n### Type `skill`\n\nA folder with `SKILL.md`. Everything in the folder ships with it. This guide is itself one.\n\n```\nskills/<name>/\n  SKILL.md\n  references/\u2026      # optional: long docs the skill loads on demand\n  scripts/\u2026         # optional\n  evals/core.yaml   # optional but recommended, see https://github.com/posterus-ltd/yarkr-public/blob/main/docs/evals.md\n```\n\n```markdown\n---\nname: <name>\ndescription: <what it does and when to use it. Harnesses decide whether to load the skill from this line alone, so name the trigger situations.>\n---\n\n# <Title>\n\n<Steps the agent follows. Concrete and imperative. Point to references/ for anything long.>\n```\n\n`description` is required; without it the skill isn\'t indexed.\n\n### Type `agent`\n\nOne markdown file under `agents/` (or `.claude/agents/`).\n\n```markdown\n---\nname: <name>\ndescription: <when to hand work to this agent>\nmodel: <optional>\ntools: Read, Grep, Bash          # optional\nskills: <skill-name>, other-org/skill   # optional: dependencies, installed with the agent\n---\n\n<System prompt: role, what it does, how it decides, what it returns.>\n```\n\n- `description` is required; a file without it is treated as a plain doc.\n- A bare name in `skills:` means a skill in the same org. Use `ns/name` for another namespace. A skill the agent needs\n  that doesn\'t exist yet is part of this same PR.\n- Add the agent\'s skills to the ark too, or leave them to the dependency: `yarkr sync` installs dependencies either way.\n\n### Type `mcp` (toolset)\n\nOne toolset per folder, in Claude Code\'s `.mcp.json` format:\n\n```\ntoolsets/<name>/\n  .mcp.json\n  README.md         # first paragraph becomes the description\n```\n\n```json\n{\n  "mcpServers": {\n    "<server>": {\n      "type": "http",\n      "url": "https://mcp.example.com/mcp",\n      "headers": { "Authorization": "Bearer ${EXAMPLE_TOKEN}" }\n    }\n  }\n}\n```\n\n- **No literal secrets.** Values in `env` and `headers` must be `${VAR}` (becomes `${env:VAR}`), `${VAR:-default}`\n  or `${vault:path#key}`. A literal value is refused.\n- Prefer servers you can verify exist: the vendor\'s official server, or a well-known package for `stdio` (`npx -y \u2026`).\n  Never invent a URL or package name. If you can\'t confirm one, stop and ask.\n- Document in the README which variables each user must set.\n\n### Optional `yarkr.yaml`\n\nNext to any asset, for what can\'t be inferred:\n\n```yaml\ntargets: [claude-code, codex]   # default: every harness\ntags: [<topic>, \u2026]              # helps search; use the topic\nevals: [evals/core.yaml]\n```\n\n## 4. Wait for the index\n\nAfter the PR merges, the push is indexed in the background, usually within a minute. Each package\'s first release is a\nsnapshot of the default branch (`0.0.0-main.\u2026`) unless a tag says otherwise.\n\n```bash\nyarkr info <org>/<name>     # repeat until it shows a stable version\n```\n\nIf it never appears, check the repo\'s row on the org\'s GitHub page: detection problems (missing description, literal\nsecret, name clash) are listed there. Fix them in a new PR.\n\n## 5. Create the ark and add items\n\nArk changes need an **org admin** and a **read and write** token. There\'s no CLI command for this; use the web app\n(**Arks \u2192 your org**) or the API. The base URL is the registry (`yarkr whoami` prints it; the hub is\n`https://api.yarkr.com/functions/v1/api`).\n\n```bash\nAPI=https://api.yarkr.com/functions/v1/api/api/v1\nAUTH="Authorization: Bearer $YARKR_TOKEN"\n\n# Create\ncurl -sf -X POST "$API/arks/<org>" -H "$AUTH" -H \'content-type: application/json\' \\\n  -d \'{"name":"<ark>","description":"<one sentence>"}\'\n\n# One call per package\ncurl -sf -X PUT "$API/arks/<org>/<ark>/items/<ns>/<name>" -H "$AUTH" -H \'content-type: application/json\' \\\n  -d \'{"range":"^1","required":true}\'\n```\n\nItem body:\n\n| Field | Use |\n| --- | --- |\n| `range` | Semver range. Use `^<major>` for tagged packages. Omit it (and `channel`) to follow `stable`, which suits new snapshot-only packages |\n| `channel` | Instead of a range, e.g. `stable` |\n| `required` | `true` for the core of the topic; `false` for extras members may exclude |\n| `config` | Toolsets only: per-ark overrides, `{"servers": {"<server>": {"env": {\u2026}, "headers": {\u2026}, "args": [\u2026], "url": "\u2026"}}}`. Secret values must be `${env:\u2026}` or `${vault:\u2026}` |\n\nThe server rejects an item that the org can\'t use, a private package in a public ark, a bad range, a literal secret,\nor a range that conflicts with another ark sharing a member. Read the error and fix the cause; don\'t retry blindly.\n\nThen, only if asked:\n\n```bash\n# Make it public (public packages only)\ncurl -sf -X PATCH "$API/arks/<org>/<ark>" -H "$AUTH" -H \'content-type: application/json\' -d \'{"public":true}\'\n\n# Add members (they must already belong to the org)\ncurl -sf -X POST "$API/arks/<org>/<ark>/members" -H "$AUTH" -H \'content-type: application/json\' -d \'{"email":"\u2026"}\'\n```\n\n## 6. Verify\n\n```bash\ncurl -sf "$API/arks/<org>/<ark>" -H "$AUTH"           # items, ranges, description\nyarkr ark lint <org>/<ark> --strict                     # fix every error and warning it reports\nyarkr sync <org>/<ark> --dry-run --harness claude-code  # resolves every item without writing files\n```\n\nFor a public ark, also check `yarkr arks` lists it.\n\n## Report back\n\nTell the user:\n\n- the ark (`<org>/<ark>`), its description and whether it\'s public;\n- each item: reused or new, range, required or optional, one line on why it\'s there;\n- the PR link for new packages, and whether it\'s merged;\n- what\'s left for them: merging the PR, adding members, setting the toolset variables listed in the READMEs, and how\n  people get it (`yarkr sync <org>/<ark>`, or `yarkr mcp add <org>/<ark>`).\n\n## Don\'ts\n\n- Don\'t put literal secrets anywhere: repo, ark config or PR description.\n- Don\'t add packages you haven\'t read.\n- Don\'t make an ark public, add members, or merge a PR unless the user asked.\n- Don\'t pad the ark to reach a number. Three good packages beat eight vague ones.\n'
+};
+
+// ../../packages/core/dist/guides/index.js
+var GUIDE_NAMES = Object.keys(GUIDE_CONTENT);
+var descriptionOf = (md2) => /^---\n[\s\S]*?^description:\s*(.+)$/m.exec(md2)?.[1]?.trim() ?? "";
+var isGuideName = (n) => Object.hasOwn(GUIDE_CONTENT, n);
+function getGuide(name) {
+  const content = GUIDE_CONTENT[name];
+  return { name, description: descriptionOf(content), content };
+}
+var ARK_TYPES = { skill: "skill", agent: "agent", mcp: "toolset" };
+function createArkPrompt(inputs = {}) {
+  const body = GUIDE_CONTENT["create-ark"].replace(/^---\n[\s\S]*?\n---\n+/, "");
+  const given = [
+    inputs.topic && `- topic: ${inputs.topic}`,
+    inputs.type && `- type: ${inputs.type} (package kind \`${ARK_TYPES[inputs.type]}\`)`,
+    inputs.org && `- org: ${inputs.org}`
+  ].filter(Boolean);
+  return given.length ? `${body.trimEnd()}
+
+---
+
+Your inputs:
+
+${given.join("\n")}
+` : body;
+}
+
+// src/commands/guide.ts
+async function guide(name, opts) {
+  if (!name) {
+    ui.table(GUIDE_NAMES.map((n) => [ui.bold(n), getGuide(n).description]), ["guide", "description"]);
+    ui.step(`${ui.code("yarkr guide <name>")} prints one; ${ui.code("--out <dir>")} saves it as <dir>/SKILL.md.`);
+    return;
+  }
+  if (!isGuideName(name)) throw new CliError(`No guide named ${name}.`, `Guides: ${GUIDE_NAMES.join(", ")}.`);
+  const text = name === "create-ark" && (opts.topic || opts.type) ? createArkPrompt({ topic: opts.topic, type: opts.type }) : getGuide(name).content;
+  if (!opts.out) return void process.stdout.write(text);
+  const isDir = opts.out.endsWith("/") || opts.out.endsWith(path16.sep) || (await stat3(opts.out).catch(() => null))?.isDirectory();
+  const file2 = path16.resolve(isDir ? path16.join(opts.out, "SKILL.md") : opts.out);
+  await mkdir8(path16.dirname(file2), { recursive: true });
+  await writeFile7(file2, text);
+  ui.ok(`Wrote ${name} to ${file2}`);
+}
+
+// src/commands/lint.ts
+var import_semver3 = __toESM(require_semver2(), 1);
+var MAX_ITEMS = 8;
+var EVAL_PASS = 0.8;
+var SECRETISH = /(token|secret|password|passwd|api[_-]?key|private[_-]?key|credential|auth)/i;
+var isTagged = (v) => !import_semver3.default.prerelease(v);
+async function lintArk(api, ref) {
+  const ark = await api.ark(ref);
+  const findings = [];
+  const add2 = (severity, rule, message, pkg) => findings.push({ severity, rule, message, ...pkg ? { package: pkg } : {} });
+  if (!ark.description.trim()) add2("warning", "description", "The ark has no description. Say in one sentence who it's for and what they get.");
+  if (!ark.items.length) add2("error", "empty", "The ark has no items, so it gives its members nothing.");
+  if (ark.items.length > MAX_ITEMS) add2("warning", "size", `The ark has ${ark.items.length} items. Past ${MAX_ITEMS}, agents get worse; split it into narrower arks.`);
+  const details = /* @__PURE__ */ new Map();
+  const detail = async (name) => {
+    if (!details.has(name)) details.set(name, await api.pkgOrNull(name));
+    return details.get(name);
+  };
+  const releases = await Promise.all(ark.items.map((item) => lintItem(api, ark, item, detail, add2)));
+  if (ark.public) {
+    for (const rel2 of releases) {
+      if (!rel2) continue;
+      const deps = Object.keys({ ...rel2.manifest.depends.skills, ...rel2.manifest.depends.toolsets, ...rel2.manifest.depends.agents });
+      for (const dep of deps) {
+        const d = await detail(dep);
+        if (!d) add2("error", "dependency", `Depends on ${dep}, which doesn't exist or you can't read.`, rel2.package);
+        else if (d.classification !== "public") add2("error", "public-dependency", `Depends on ${dep}, which isn't public, so people outside the org can't install it.`, rel2.package);
+      }
+    }
+  }
+  const order = { error: 0, warning: 1 };
+  findings.sort((a, b) => order[a.severity] - order[b.severity] || (a.package ?? "").localeCompare(b.package ?? ""));
+  return { ark, findings };
+}
+async function lintItem(api, ark, item, detail, add2) {
+  const name = item.package;
+  const p = await detail(name);
+  if (!p) {
+    add2("error", "missing", "The package doesn't exist, or you can't read it.", name);
+    return null;
+  }
+  if (p.taken_down) {
+    add2("error", "taken-down", `The package was taken down: ${p.taken_down.reason}`, name);
+    return null;
+  }
+  if (ark.public && p.classification !== "public") add2("error", "public-item", `It's ${p.classification}, but a public ark may only hold public packages.`, name);
+  if (!p.description.trim()) add2("warning", "item-description", "The package has no description, so members can't tell what it's for.", name);
+  if (item.range && !import_semver3.default.validRange(item.range)) {
+    add2("error", "range", `"${item.range}" isn't a semver range.`, name);
+    return null;
+  }
+  let rel2 = null;
+  try {
+    rel2 = await api.resolve(name, { channel: item.channel ?? "stable", range: item.range ?? void 0 });
+  } catch (err) {
+    const what = item.range ? `range ${item.range}` : `channel ${item.channel ?? "stable"}`;
+    add2("error", "unresolvable", `Nothing matches ${what}, so \`yarkr sync\` fails for every member (${err.message})`, name);
+  }
+  const live = p.releases.filter((r) => !r.yanked).map((r) => r.version);
+  const newest = import_semver3.default.maxSatisfying(live.filter(isTagged), "*");
+  if (!item.range && !item.channel && newest) add2("warning", "unpinned", `Follows stable although it has tagged releases. Pin a range like ^${import_semver3.default.major(newest)} so a new major doesn't reach members unreviewed.`, name);
+  if (item.range && rel2 && newest && import_semver3.default.gt(newest, rel2.version) && !import_semver3.default.satisfies(newest, item.range)) {
+    add2("warning", "outdated", `${newest} is out, but the range ${item.range} holds members at ${rel2.version}.`, name);
+  }
+  const ev = p.reported_eval;
+  if (ev && (ev.status === "failed" || ev.pass_rate !== null && ev.pass_rate < EVAL_PASS)) {
+    const rate = ev.pass_rate === null ? "" : ` (${Math.round(ev.pass_rate * 100)}% passed)`;
+    add2("warning", "evals", `Its latest eval run on ${ev.version} failed${rate}.`, name);
+  }
+  const servers = item.config.servers ?? {};
+  if (Object.keys(servers).length && item.kind !== "toolset") add2("error", "config", "Has server config, but only toolsets use it.", name);
+  for (const [server, o] of Object.entries(servers)) {
+    if (rel2?.manifest.toolset && !rel2.manifest.toolset.servers.some((s) => s.name === server)) {
+      add2("warning", "config", `Configures server "${server}", which ${rel2.version} doesn't have (it has ${rel2.manifest.toolset.servers.map((s) => s.name).join(", ") || "none"}).`, name);
+    }
+    for (const field of ["env", "headers"]) {
+      for (const [k, v] of Object.entries(o[field] ?? {})) {
+        if (SECRETISH.test(k) && !SECRET_REF.test(v)) add2("error", "secret", `${server}.${field}.${k} holds a literal value. Use \${env:\u2026} or \${vault:path#key}.`, name);
+      }
+    }
+  }
+  return rel2;
+}
+async function arkLint(ref, opts) {
+  const api = new Api(await resolveConnection({ dir: process.cwd() }));
+  const { ark, findings } = await lintArk(api, ref);
+  const errors = findings.filter((f) => f.severity === "error").length;
+  const warnings = findings.length - errors;
+  if (opts.json) console.log(JSON.stringify({ ark: ark.ref, errors, warnings, findings }, null, 2));
+  else {
+    ui.heading(`${ark.ref}  ${ui.dim(`${ark.items.length} item(s)${ark.public ? ", public" : ""}`)}`);
+    for (const f of findings) {
+      const line = `${f.package ? `${ui.bold(f.package)} ` : ""}${f.message} ${ui.dim(`[${f.rule}]`)}`;
+      if (f.severity === "error") ui.error(line);
+      else ui.warn(line);
+    }
+    if (!findings.length) ui.ok("No problems found.");
+  }
+  if (errors || opts.strict && warnings) {
+    throw new CliError(`${errors} error(s), ${warnings} warning(s) in ${ark.ref}.`, errors ? void 0 : "Warnings fail the lint because of --strict.");
+  }
+  if (warnings && !opts.json) ui.info(`${warnings} warning(s). Pass --strict to fail on them.`);
+  return findings;
+}
+
 // src/index.ts
-var VERSION = true ? "0.1.0" : "0.0.0-dev";
+var VERSION = true ? "0.1.5" : "0.0.0-dev";
 var act = (fn) => async (...a) => {
   await fn(...a);
 };
@@ -45069,30 +44877,23 @@ function buildProgram() {
   const program2 = new Command().name("yarkr").description("Yarkr: install your org's skills, agents and MCP configs into every harness.").version(VERSION).option("-q, --quiet", "only print warnings and errors").hook("preAction", (cmd) => {
     ui.quiet = !!cmd.opts().quiet;
   });
-  program2.command("login").description("store an API token for a registry in ~/.yarkrrc").option("--registry <url>").option("--token <token>", "token (or pipe it on stdin)").action(act(login));
-  program2.command("logout").description("forget the stored token").option("--registry <url>").action(act(logout));
+  program2.command("login").description("sign in in the browser and keep a token in your keychain (or ~/.yarkrrc)").option("--registry <url>").option("--token <token>", "use this token instead of the browser (or pipe it on stdin)").option("--no-browser", "print a link to open on any device, then paste the token it shows").action(act(login));
+  program2.command("logout").description("forget the stored token and revoke it on the server").option("--registry <url>").action(act(logout));
   program2.command("whoami").description("show who you're signed in as").option("--registry <url>").action(act(whoami));
-  program2.command("init").description("create yarkr.json (and .yarkrrc), detecting the harnesses used here").option("--harness <ids...>", "harnesses to target").option("--registry <url>", "registry to pin in .yarkrrc").option("--user", "install into your home directory instead of this project").option("--ark <refs...>", "install from these arks too, e.g. acme/finance global/essentials @me").option("--force", "overwrite an existing yarkr.json").action(act(init2));
+  program2.command("init").description("create yarkr.json (and .yarkrrc), detecting the harnesses used here").option("--harness <ids...>", "harnesses to target").option("--registry <url>", "registry to pin in .yarkrrc").option("--user", "install into your home directory instead of this project").option("--ark <refs...>", "install from these arks too, e.g. acme/finance @me, or another org's public ark").option("--force", "overwrite an existing yarkr.json").action(act(init2));
   program2.command("search").argument("[query]").description("find packages").addOption(new Option("--kind <kind>").choices(["skill", "agent", "toolset"])).option("--target <harness>").option("--json").action(act(search));
   program2.command("info").argument("<package>").description("show a package's channels, releases and owners").option("--json").action(act(info));
-  program2.command("ark").argument("[arks...]", "limit to these arks, e.g. acme/finance or @me").description("show what your arks give you").option("--json").action(act((refs, o) => showArk(refs, o)));
-  const col = program2.command("collection").alias("col").description("your named sets of arks, published as pinned versions others use as @<handle>/<name>");
-  const visibilityFlags = (c) => c.option("-d, --description <text>").addOption(new Option("--visibility <v>", "who can use it").choices(["private", "org", "public"])).option("--public", "same as --visibility public: anyone, without signing in").option("--org <slug>", "org whose members can use it (implies --visibility org)");
-  col.command("list").description("list your collections").option("--json").action(act(collectionList));
-  col.command("show").argument("<name>", "yours by name, or a published version: @<handle>/<name>[@<version>]").description("show a collection").option("--json").action(act(collectionShow));
-  visibilityFlags(col.command("create").argument("<name>").description("create an empty collection (private unless you say otherwise)")).action(act(collectionCreate));
-  visibilityFlags(col.command("edit").argument("<name>").description("change a collection's description or visibility")).action(act(collectionEdit));
-  col.command("delete").argument("<name>").description("delete a collection and all its versions").action(act(collectionDelete));
-  col.command("add").argument("<name>").argument("<arks...>", "@me, <org>/<ark>, global/<ark>, or a public ark").description("put arks in a collection (takes effect when you publish)").action(act(collectionAdd));
-  col.command("remove").argument("<name>").argument("<arks...>").description("take arks out of a collection (takes effect when you publish)").action(act(collectionRemove));
-  col.command("publish").argument("<name>").description("freeze the collection's arks into the next version, every package pinned").option("-m, --message <note>").option("--json").action(act(collectionPublish));
-  col.command("arks").description("list public arks you can put in a collection").option("--json").action(act(collectionArks));
+  const arkCmd = program2.command("ark").argument("[arks...]", "limit to these arks, e.g. acme/finance or @me").description("show what your arks give you").option("--json").action(act((refs, o) => showArk(refs, o)));
+  arkCmd.command("lint").argument("<ark>", "an ark you can read, e.g. acme/finance").description("check an ark's items: missing or private packages, ranges that resolve to nothing, literal secrets, failing evals").option("--strict", "exit 1 on warnings too").option("--json").action(act((ref, o) => arkLint(ref, { ...o, json: o.json || !!arkCmd.opts().json })));
+  program2.command("arks").description("list public arks: curated sets anyone can sync or connect over MCP").option("--json").action(act(publicArks));
+  program2.command("guide").argument("[name]", "a guide, e.g. create-ark; omit to list them").description("print instructions for your agent, e.g. how to build an ark for a topic").option("-o, --out <path>", "write to a file, or <dir>/SKILL.md for a directory (e.g. ~/.claude/skills/create-ark/)").option("--topic <topic>", "create-ark: what the ark is about").addOption(new Option("--type <type>", "create-ark: the kind of package it holds").choices(["skill", "agent", "mcp"])).action(act(guide));
   syncFlags(program2.command("add").argument("<packages...>", "namespace/name[@range]").description("add packages to yarkr.json (outside a project: to your personal ark, or your user config when signed out) and sync").option("--no-sync", "only edit yarkr.json")).action(act((pkgs, o) => add(pkgs, { ...o, noSync: o.sync === false })));
-  syncFlags(program2.command("remove").argument("<packages...>").description("remove packages (or opt out of optional ark items) and delete their files").option("--no-sync", "only edit yarkr.json")).action(act((pkgs, o) => remove(pkgs, { ...o, noSync: o.sync === false })));
+  syncFlags(program2.command("remove").argument("<packages...>", "packages, or arks listed in yarkr.json").description("remove packages or arks (or opt out of optional ark items) and delete their files").option("--no-sync", "only edit yarkr.json")).action(act((pkgs, o) => remove(pkgs, { ...o, noSync: o.sync === false })));
   syncFlags(program2.command("update").argument("[packages...]").description("move packages to the newest release their range allows")).action(act((pkgs, o) => update(pkgs, o)));
   syncFlags(
-    program2.command("sync").argument("[collections...]", "collections to add first: @<handle>/<name> (latest) or @<handle>/<name>@<version>; public ones need no sign-in").description("install locked releases into each harness's native layout (outside a project: your arks, into your home directory)")
+    program2.command("sync").argument("[arks...]", "arks to add first: <org>/<ark>, yours or another org's public ark (which needs no sign-in)").description("install locked releases into each harness's native layout (outside a project: your arks, into your home directory)")
   ).action(act((refs, o) => sync(o, void 0, refs)));
+  program2.command("yank").argument("<release>", "namespace/name@version").description("yank a release (org admins): ranges and stable skip it, exact pins still install it").option("--reason <text>", "why, shown to everyone who installed it").option("--undo", "un-yank it").action(act(yank));
   program2.command("diff").argument("[package]").description("show local edits to synced files").option("--name-only").action(act(diff));
   const evalCmd = program2.command("eval").argument("[dir]", "package folder", ".").description("check a package's eval suites (--local), or run them against a baseline (eval run)").option("--local", "validate the package and suites, and grade recorded outputs; no model calls").option("--outputs <dir>", "recorded outputs: <dir>/<suite>/<case>/{output.txt,transcript.json,files/}").option("--run-scripts", "run script graders (executes commands from the suite)").option("--json [file]", "print JSON (with run: write it to <file>)").action(
     act(async (dir, o) => {
@@ -45109,7 +44910,7 @@ function buildProgram() {
   );
   const mcp = program2.command("mcp").description("connect harnesses to Yarkr's MCP server: one connection per org or team");
   const mcpFlags = (c) => syncFlags(c).option("--token-env <name>", "environment variable holding the token for this connection (default YARKR_TOKEN)").option("--no-sync", "only edit the config");
-  mcpFlags(mcp.command("add").argument("<scopes...>", "acme (an org), acme/finance (a team), global/<ark>, @me, @<handle>/<collection>[@<version>], all or public").description("add MCP connections and write them into each harness's MCP config")).action(
+  mcpFlags(mcp.command("add").argument("<scopes...>", "acme (an org), acme/finance (a team, or a public ark), all or public").description("add MCP connections and write them into each harness's MCP config")).action(
     act((scopes, o) => mcpAdd(scopes, { ...o, noSync: o.sync === false }))
   );
   mcpFlags(mcp.command("remove").argument("<scopes...>").description("remove MCP connections from every harness")).action(act((scopes, o) => mcpRemove(scopes, { ...o, noSync: o.sync === false })));