@ainova-systems/intelligence 0.11.0-rc.7 → 0.11.0-rc.8

package/cli/{commands/remove.sh → internal/package-remove.sh}

@@ -1,10 +1,10 @@
 #!/bin/bash
-# intelligence remove <@scope/name> [--no-sync]
+# Internal package remove operation.
 set -euo pipefail
 source "$CLI_DIR/lib/cli-common.sh"
 
 name="${1:-}"
-[ -n "$name" ] || die "usage: intelligence remove <@scope/name>"
+[ -n "$name" ] || die "usage: intelligence package remove <@scope/name>"
 shift || true
 no_sync=0 force=0
 for a in "$@"; do
@@ -24,7 +24,7 @@ if [ "$name" = "$SYNC_PKG_NAME" ] && [ "$force" -eq 0 ]; then
     echo "ERROR: $SYNC_PKG_NAME is the engine's own content — removing it drops every" >&2
     echo "  intelligence-* meta-skill, the authoring rule and the engine agents from" >&2
     echo "  the outputs. The sync engine itself keeps working (it ships with the CLI)." >&2
-    echo "  If that is what you want: intelligence remove $SYNC_PKG_NAME --force" >&2
+    echo "  If that is what you want: intelligence package remove $SYNC_PKG_NAME --force" >&2
     exit 1
 fi
 assert_valid_pkg_name "$name"

package/cli/{commands/search.sh → internal/package-search.sh}

@@ -1,5 +1,5 @@
 #!/bin/bash
-# intelligence search [term] — what the registries offer, and what this project
+# Internal package search operation: what the registries offer and what this project
 # already has. The catalogue view `list` deliberately is not: `list` answers
 # "what does this project depend on", `search` answers "what could it".
 #
@@ -27,7 +27,7 @@ pkg_state() {
     elif [ -d "$IP_ROOT/.intelligence/packages/$name" ]; then
         printf 'installed %s' "$(qmap_field "$IP_ROOT/intelligence.lock" "packages" "$name" "resolved")"
     else
-        printf 'declared (run install)'
+        printf 'declared (run sync)'
     fi
 }
 
@@ -75,9 +75,9 @@ if [ "$rows" -eq 0 ]; then
     else
         echo "No trusted registries (or they offer nothing) — intelligence registry add <repo-url>."
     fi
-    echo "Explicit installs need no registry: intelligence add github:org/repo"
+    echo "Explicit installs need no registry: intelligence package add github:org/repo"
     exit 0
 fi
 
 echo ""
-echo "add one: intelligence add <name>   |   private registry: intelligence registry add <repo-url>"
+echo "add one: intelligence package add <name>   |   private registry: intelligence registry add <repo-url>"

package/cli/internal/package-update.sh

@@ -0,0 +1,97 @@
+#!/bin/bash
+# Internal package range update operation.
+#
+# Re-resolve version ranges against the remotes and rewrite the lock. Pinned
+# packages (`ref:`) never move here — repin by editing the manifest or
+# re-adding. `update <name>` limits the pass to one package.
+set -euo pipefail
+source "$CLI_DIR/lib/cli-common.sh"
+
+only="" no_sync=0 preview=0
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --no-sync) no_sync=1 ;;
+        --preview) preview=1 ;;
+        @*) only="$1" ;;
+        *) die "unknown argument '$1'" ;;
+    esac
+    shift || true
+done
+
+require_v2
+manifest="$IP_ROOT/intelligence.yaml"
+lock="$IP_ROOT/intelligence.lock"
+
+moved=0 found=0
+while IFS= read -r name; do
+    [ -n "$name" ] || continue
+    # Manifest keys are untrusted input on their way into store paths.
+    assert_valid_pkg_name "$name"
+    [ -n "$only" ] && [ "$name" != "$only" ] && continue
+    # A named package that exists is "found" whatever happens next — a skip
+    # message followed by "not in the manifest" would contradict itself.
+    found=1
+    if [ "$name" = "$SYNC_PKG_NAME" ]; then
+        echo "  $name: engine content follows the installed CLI — skipped"
+        continue
+    fi
+    ref="$(qmap_field "$manifest" "packages" "$name" "ref")"
+    [ -n "$ref" ] && { echo "  $name: pinned to ref '$ref' — skipped"; continue; }
+    range="$(qmap_field "$manifest" "packages" "$name" "version")"
+    # An exact version is a pin, same as ref: — update never moves pins.
+    if [ -n "$range" ] && semver_is_stable "$range"; then
+        echo "  $name: pinned to $range — edit the manifest to move it"
+        continue
+    fi
+    url="$(qmap_field "$manifest" "packages" "$name" "url")"
+    path="$(qmap_field "$manifest" "packages" "$name" "path")"
+    if [ -z "$url" ]; then
+        resolve_package_source "$manifest" "$name"
+        url="$RES_URL"; path="$RES_PATH"
+    fi
+    picked="$(list_remote_versions "$url" | semver_pick_highest "$range")"
+    [ -n "$picked" ] || { echo "  $name: nothing satisfies '${range:-*}' at $url" >&2; continue; }
+    read -r tag _ <<< "$(remote_tag_for_version "$url" "$picked")"
+    current="$(qmap_field "$lock" "packages" "$name" "resolved")"
+    cur_url="$(qmap_field "$lock" "packages" "$name" "url")"
+    cur_path="$(qmap_field "$lock" "packages" "$name" "path")"
+    # Same tag is not enough: a registry may re-point a name's source while
+    # keeping the version — the move doctor warns about must be actionable
+    # here, so url/path changes refetch too.
+    if [ "$tag" = "$current" ] && [ "$url" = "$cur_url" ] && [ "$path" = "$cur_path" ]; then
+        echo "  $name: ${current:-<none>} (up to date)"
+        continue
+    fi
+    if [ "$preview" -eq 1 ]; then
+        echo "  $name: ${current:-<none>} -> $tag"
+        moved=$((moved + 1))
+        continue
+    fi
+    rel=".intelligence/packages/$name"
+    # Fetch into staging FIRST: a failed clone must leave the current install
+    # fully wired and intact. Only after success is the old shape unwired
+    # (the new version may have dropped a section dir), the store swapped,
+    # and the new shape wired.
+    staging="$IP_ROOT/.intelligence/.staging-$$"
+    rm -rf "$staging"
+    sha="$(fetch_package "$url" "$tag" "$path" "$staging")"
+    unwire_package_sources "$manifest" "$rel"
+    rm -rf "${IP_ROOT:?}/$rel"
+    mkdir -p "$(dirname "$IP_ROOT/$rel")"
+    mv "$staging" "$IP_ROOT/$rel"
+    wire_package_sources "$manifest" "$name" "$rel" "$IP_ROOT"
+    lock_upsert "$lock" "$name" "$range" "$url" "$path" "$tag" "$sha"
+    echo "  $name: ${current:-<none>} -> $tag"
+    moved=$((moved + 1))
+done < <(qmap_keys "$manifest" "packages")
+
+[ -n "$only" ] && [ "$found" -eq 0 ] && die "package '$only' is not in the manifest"
+if [ "$preview" -eq 1 ]; then
+    echo "updates available: $moved package(s)"
+else
+    echo "updated: $moved package(s)"
+fi
+
+if [ "$preview" -eq 0 ] && [ "$moved" -gt 0 ] && [ "$no_sync" -eq 0 ]; then
+    exec bash "$CLI_DIR/commands/sync.sh"
+fi

package/cli/{commands/install.sh → internal/restore.sh}

@@ -1,5 +1,5 @@
 #!/bin/bash
-# intelligence install [--frozen] [--force] [--no-sync]
+# Internal locked-store restore operation.
 #
 # Restore .intelligence/ from intelligence.lock — the fresh-clone command.
 # --frozen additionally refuses any manifest/lock divergence (CI mode) and
@@ -30,7 +30,7 @@ if [ "$frozen" -eq 1 ]; then
     while IFS= read -r name; do
         [ -n "$name" ] || continue
         [ -n "$(qmap_field "$lock" "packages" "$name" "url")" ] \
-            || die "--frozen: $name is in the manifest but not in intelligence.lock"
+            || die "locked restore: $name is in the manifest but not in intelligence.lock"
         m_ver="$(qmap_field "$manifest" "packages" "$name" "version")"
         m_ref="$(qmap_field "$manifest" "packages" "$name" "ref")"
         m_url="$(qmap_field "$manifest" "packages" "$name" "url")"
@@ -40,7 +40,7 @@ if [ "$frozen" -eq 1 ]; then
         l_url="$(qmap_field "$lock" "packages" "$name" "url")"
         l_path="$(qmap_field "$lock" "packages" "$name" "path")"
         [ -z "$m_ver" ] || [ "$m_ver" = "$l_req" ] \
-            || die "--frozen: $name requests '$m_ver' but the lock recorded '$l_req' — run 'intelligence install' without --frozen"
+            || die "locked restore: $name requests '$m_ver' but the lock recorded '$l_req' — reconcile the manifest and lock"
         [ -z "$m_ref" ] || [ "$m_ref" = "$l_res" ] \
             || die "--frozen: $name pins ref '$m_ref' but the lock resolved '$l_res'"
         [ -z "$m_url" ] || [ "$m_url" = "$l_url" ] \

package/cli/internal/target-state.sh

@@ -0,0 +1,57 @@
+#!/bin/bash
+# Internal adapter target-state operation.
+#
+# Change only the manifest. Syncing and deleting generated output are separate
+# explicit actions: a generic target command cannot infer a custom adapter's
+# ownership safely.
+set -euo pipefail
+source "$CLI_DIR/lib/cli-common.sh"
+
+action="${1:-}"
+name="${2:-}"
+[ $# -le 2 ] || die "internal target state: expected <enable|disable> <name>"
+case "$action" in enable|disable) ;; *) die "internal target state: expected <enable|disable> <name>" ;; esac
+[ -n "$name" ] || die "internal target state: missing adapter name"
+assert_valid_target_name "$name"
+
+require_v2
+manifest="$IP_ROOT/intelligence.yaml"
+content_dir="$(manifest_intelligence_dir "$manifest")"
+
+if [ "$action" = "enable" ]; then
+    project_adapter="$IP_ROOT/$content_dir/adapters/$name.sh"
+    bundled_adapter="$IS_ENGINE_DIR/adapters/$name.sh"
+    if [ ! -f "$project_adapter" ] && [ ! -f "$bundled_adapter" ]; then
+        die "adapter '$name' not found — create it first: intelligence adapter create $name"
+    fi
+
+    # These adapters intentionally omit always-on rules because their tools
+    # read AGENTS.md. Do not create a manifest that full sync must refuse.
+    case "$name" in
+        cursor|copilot|codex|pi|opencode)
+            if [ "$(is_target_enabled "$manifest" "agents")" != "1" ]; then
+                die "target '$name' requires target 'agents' — enable it first"
+            fi
+            ;;
+    esac
+
+    output="$(get_target_output "$manifest" "$name")"
+    [ -n "$output" ] || output="$(default_target_output "$name")"
+    target_set_enabled "$manifest" "$name" true "$output"
+    echo "enabled: $name (output: $output)"
+    exit 0
+fi
+
+target_exists "$manifest" "$name" || die "target '$name' is not in the manifest"
+if [ "$name" = "agents" ]; then
+    for dependent in cursor copilot codex pi opencode; do
+        if [ "$(is_target_enabled "$manifest" "$dependent")" = "1" ]; then
+            die "target 'agents' is required by enabled target '$dependent' — disable '$dependent' first"
+        fi
+    done
+fi
+output="$(get_target_output "$manifest" "$name")"
+[ -n "$output" ] || output="$(default_target_output "$name")"
+target_set_enabled "$manifest" "$name" false "$output"
+echo "disabled: $name"
+echo "  generated output was kept; remove only paths owned by this adapter"

package/cli/{commands/upgrade.sh → internal/upgrade-v2.sh}

@@ -1,17 +1,34 @@
 #!/bin/bash
-# intelligence upgrade — bring the project to this CLI's engine: apply v2
+# Internal: bring the project to this CLI's engine: apply v2
 # schema migrations, align the engine-content package to the bundled version,
-# restamp sync_version, sync.
+# restamp schema_version, sync.
 set -euo pipefail
 source "$CLI_DIR/lib/cli-common.sh"
 
+no_sync=0
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --no-sync) no_sync=1 ;;
+        *) die "internal upgrade: unknown option '$1'" ;;
+    esac
+    shift
+done
+
 require_v2
 manifest="$IP_ROOT/intelligence.yaml"
 
-stamp="$(read_engine_stamp "$manifest")"
+stamp="$(read_schema_version "$manifest")"
+legacy_stamp="$(top_scalar "$manifest" "sync_version")"
+schema_key_count="$(awk '/^schema_version:[[:space:]]*/ { n++ } END { print n + 0 }' "$manifest")"
+legacy_key_count="$(awk '/^sync_version:[[:space:]]*/ { n++ } END { print n + 0 }' "$manifest")"
 eng="$(bundled_engine_version)"
+[ "$schema_key_count" -le 1 ] || die "manifest has duplicate schema_version keys"
+[ "$legacy_key_count" -le 1 ] || die "manifest has duplicate sync_version keys"
 if [ -n "$stamp" ] && _ver_gt "$stamp" "$eng"; then
-    die "manifest schema $stamp is newer than this CLI's engine $eng — update the CLI first: npm i -g @ainova-systems/intelligence@latest"
+    die "manifest schema $stamp is newer than this CLI's engine $eng — update the global CLI first"
+fi
+if [ -n "$legacy_stamp" ] && _ver_gt "$legacy_stamp" "$eng"; then
+    die "manifest schema $legacy_stamp is newer than this CLI's engine $eng — update the global CLI first"
 fi
 
 # --- v2 schema migrations -------------------------------------------------
@@ -19,6 +36,19 @@ fi
 # Same discipline: ascending, append-only, each migration self-detects and
 # no-ops when already applied.
 
+# v2 migration 0: the original RC manifest called the permanent schema key
+# `sync_version`. Rename it without changing its value; the final stamp below
+# then aligns it with this engine. The archived v1 reader remains separate.
+if [ -n "$legacy_stamp" ]; then
+    if [ -n "$stamp" ]; then
+        [ "$stamp" = "$legacy_stamp" ] || die "manifest has conflicting schema_version '$stamp' and sync_version '$legacy_stamp'"
+        _qmap_stage "$manifest" '$0 !~ /^sync_version:[[:space:]]*/'
+    else
+        _qmap_stage "$manifest" '{ sub(/^sync_version:/, "schema_version:"); print }'
+    fi
+    echo "  migrating: sync_version -> schema_version"
+fi
+
 # v2 migration 1: staged engine content -> the @ainova-systems/sync package.
 # Pre-package manifests listed `.intelligence/engine/{rules,agents,skills}`
 # as sources fed by a CLI-staged copy; that copy is now an ordinary package
@@ -59,10 +89,20 @@ if [ "$have_pkg" -eq 1 ] && [ "$migrated" -eq 0 ]; then
     sync_pkg_install "$IP_ROOT"
 fi
 if [ "$have_pkg" -eq 0 ] && [ "$migrated" -eq 0 ]; then
-    echo "  NOTE: $SYNC_PKG_NAME is not in this manifest (bare setup) — engine meta-skills stay uninstalled; 'intelligence add $SYNC_PKG_NAME' opts back in." >&2
+    echo "  NOTE: $SYNC_PKG_NAME is not in this manifest (bare setup) — engine meta-skills stay uninstalled; 'intelligence package add $SYNC_PKG_NAME' opts back in." >&2
 fi
 
-stamp_version "$manifest" "$eng"
-echo "  sync_version -> $eng"
+# A previous RC could leave this managed directory even after its source
+# entries were already removed. Its presence is itself an upgrade predicate,
+# so always close that post-condition.
+if [ -d "$IP_ROOT/.intelligence/engine" ]; then
+    rm -rf "$IP_ROOT/.intelligence/engine"
+    echo "  removed stale .intelligence/engine"
+fi
 
-exec bash "$CLI_DIR/commands/sync.sh"
+stamp_schema_version "$manifest" "$eng"
+echo "  schema_version -> $eng"
+
+if [ "$no_sync" -eq 0 ]; then
+    exec bash "$CLI_DIR/commands/sync.sh"
+fi

package/cli/lib/cli-common.sh

@@ -54,8 +54,8 @@ source "$CLI_DIR/lib/lockfile.sh"
 # The engine-content package: OPTIONAL but auto-selected at init. Package by
 # UX (manifest entry, lockfile row, list/search/remove), bundle by mechanics —
 # at the version the CLI ships, it materializes from the npm bundle without
-# network; only a cross-version install reaches git. The pin is held exactly
-# at the bundled engine version and moved only by `upgrade`.
+# network; only a cross-version acquisition reaches git. The pin is held
+# exactly at the bundled engine version and moved by lifecycle alignment.
 #
 # Its identity is DATA shipped with the distribution (cli/engine-package.yaml),
 # never a name compiled into cli code — a fork edits the file.
@@ -113,7 +113,7 @@ require_v2() {
     detect_project
     case "$IP_MODE" in
         v2) ;;
-        legacy) die "this is a vendored (v1) setup — run 'intelligence migrate' first, or keep using its own flow" ;;
+        legacy) die "this is a vendored (v1) setup — run 'intelligence init' to migrate it, or keep using its own flow" ;;
         *) die "no intelligence project found here — run 'intelligence init'" ;;
     esac
 }
@@ -126,6 +126,14 @@ manifest_intelligence_dir() {
     printf '%s' "${v:-intelligence}"
 }
 
+default_target_output() {
+    case "$1" in
+        agents) printf '%s' "AGENTS.md" ;;
+        copilot) printf '%s' ".github" ;;
+        *) printf '.%s' "$1" ;;
+    esac
+}
+
 bundled_engine_version() {
     tr -d ' \t\r\n' < "$IS_ENGINE_DIR/VERSION"
 }
@@ -156,14 +164,132 @@ sync_pkg_install() {
 # Everything the IS_CLI mode of sync.sh needs, derived from the manifest.
 export_engine_env() {
     local root="$1"
-    local umbrella
-    umbrella="$(manifest_intelligence_dir "$root/intelligence.yaml")"
+    local content_rel
+    content_rel="$(manifest_intelligence_dir "$root/intelligence.yaml")"
     export IS_CLI=1
     export CONFIG_FILE="$root/intelligence.yaml"
     export REPO_ROOT="$root"
-    export IS_UMBRELLA_REL="$umbrella"
+    export IS_CONTENT_REL="$content_rel"
     export IS_MODULE_REL="$SYNC_PKG_STORE"
     export IS_SYNC_CMD="intelligence sync"
     export IS_MANIFEST_NAME="intelligence.yaml"
-    export IS_PROTECTED_DIRS="$umbrella:.intelligence"
+    export IS_PROTECTED_DIRS="$content_rel:.intelligence"
+}
+
+# --- Project lifecycle preflight -----------------------------------------
+# Public commands are intentionally few. They share this state gate so a CLI
+# installed at a newer engine version brings the current v2 project forward
+# before a mutating operation. The npm install itself cannot do that: it runs
+# outside any project and does not know which repositories the user owns.
+
+is_ci_environment() {
+    case "${CI:-}" in
+        1|true|TRUE|True|yes|YES|Yes|on|ON|On) return 0 ;;
+        *) return 1 ;;
+    esac
+}
+
+# Validate a repository-relative project content directory, including every
+# existing symlinked path component. Call before writing a new manifest.
+assert_safe_content_dir() {
+    local root="$1" content_dir="$2" repo_phys probe old_ifs part probe_phys
+    local -a parts
+    case "$content_dir" in
+        ""|/*|.|..|../*|*/../*|*/..|.git|.git/*|.intelligence|.intelligence/*|*\\*|[A-Za-z]:*)
+            die "unsafe content directory '$content_dir'"
+            ;;
+    esac
+    repo_phys="$(cd "$root" && pwd -P)"
+    probe="$root"
+    old_ifs="$IFS"; IFS='/'; read -r -a parts <<< "$content_dir"; IFS="$old_ifs"
+    for part in "${parts[@]}"; do
+        [ -n "$part" ] || continue
+        probe="$probe/$part"
+        if [ -e "$probe" ] || [ -L "$probe" ]; then
+            probe_phys="$(cd "$probe" 2>/dev/null && pwd -P)" \
+                || die "cannot resolve project content path '$content_dir'"
+            case "$probe_phys" in
+                "$repo_phys"|"$repo_phys"/*) ;;
+                *) die "project content directory resolves outside the repository: '$content_dir'" ;;
+            esac
+        fi
+    done
+}
+
+project_needs_upgrade() {
+    local root="$1" manifest="$1/intelligence.yaml" stamp eng pinned locked name
+    [ -f "$manifest" ] || return 1
+    stamp="$(read_schema_version "$manifest")"
+    eng="$(bundled_engine_version)"
+    [ -z "$stamp" ] && return 0
+    [ -n "$(top_scalar "$manifest" "sync_version")" ] && return 0
+    _ver_gt "$eng" "$stamp" && return 0
+    [ -d "$root/.intelligence/engine" ] && return 0
+
+    while IFS= read -r name; do
+        [ "$name" = "$SYNC_PKG_NAME" ] || continue
+        pinned="$(qmap_field "$manifest" "packages" "$name" "version")"
+        locked="$(qmap_field "$root/intelligence.lock" "packages" "$name" "resolved")"
+        [ "$pinned" = "$eng" ] || return 0
+        if [ -f "$root/intelligence.lock" ]; then
+            [ -n "$locked" ] || return 0
+            [ "${locked#v}" = "$eng" ] || return 0
+        fi
+    done < <(qmap_keys "$manifest" "packages")
+    return 1
+}
+
+# A manifest with packages but no lock has no trustworthy resolved state from
+# which lifecycle alignment can proceed. Never manufacture a partial lock.
+project_has_packages() {
+    local root="$1" name found=1
+    while IFS= read -r name; do
+        [ -n "$name" ] || continue
+        assert_valid_pkg_name "$name"
+        found=0
+    done < <(qmap_keys "$root/intelligence.yaml" "packages")
+    return "$found"
+}
+
+ensure_project_current() {
+    local root="$1" explicit="${2:-}" manifest="$1/intelligence.yaml" stamp eng
+    check_version_compat "$manifest" || return $?
+    if project_has_packages "$root" && [ ! -f "$root/intelligence.lock" ]; then
+        die "manifest declares packages but intelligence.lock is absent — restore the committed lock before running project lifecycle commands"
+    fi
+    project_needs_upgrade "$root" || return 0
+    stamp="$(read_schema_version "$manifest")"
+    eng="$(bundled_engine_version)"
+    if is_ci_environment && [ "$explicit" != "--explicit" ]; then
+        die "project lifecycle requires alignment (stamp ${stamp:-unstamped}, engine $eng) — run 'intelligence init --apply' locally, review and commit the diff"
+    fi
+    echo "  project alignment: stamp ${stamp:-unstamped}, engine $eng"
+    bash "$CLI_DIR/internal/upgrade-v2.sh" --no-sync
+}
+
+project_store_missing() {
+    local root="$1" manifest="$1/intelligence.yaml" name src
+    while IFS= read -r name; do
+        [ -n "$name" ] || continue
+        assert_valid_pkg_name "$name"
+        [ -d "$root/.intelligence/packages/$name" ] || return 0
+    done < <(qmap_keys "$manifest" "packages")
+    for section in rules agents skills; do
+        while IFS= read -r src; do
+            case "$src" in
+                .intelligence/packages/*)
+                    [ -d "$root/$src" ] || return 0
+                    ;;
+            esac
+        done < <(read_yaml_list "$manifest" "$section")
+    done
+    return 1
+}
+
+restore_project_store_if_missing() {
+    local root="$1"
+    project_store_missing "$root" || return 0
+    [ -f "$root/intelligence.lock" ] || die "package store is missing and intelligence.lock is absent — run 'intelligence init'"
+    echo "  restoring package store from intelligence.lock"
+    bash "$CLI_DIR/internal/restore.sh" --frozen --no-sync
 }

package/cli/lib/lockfile.sh

@@ -12,7 +12,7 @@ LOCK_SEP=$'\x1f'
 
 # top_scalar <file> <key> — one top-level scalar (`key: "value"`), quotes and
 # trailing comment stripped. The declared exception to "no new parsing": the
-# engine's read_engine_stamp is hardwired to its own key.
+# engine's read_schema_version is hardwired to its own key.
 top_scalar() {
     [ -f "$1" ] || return 0
     awk -v key="$2" '

package/cli/lib/manifest.sh

@@ -36,6 +36,92 @@ assert_valid_pkg_name() {
     esac
 }
 
+# Target names become adapter filenames and shell function suffixes, so keep
+# them inside the portable shell-identifier subset used by built-in adapters.
+assert_valid_target_name() {
+    case "$1" in
+        ""|[!abcdefghijklmnopqrstuvwxyz]*|*[!abcdefghijklmnopqrstuvwxyz0123456789_]*)
+            die "invalid target name '$1' — expected [a-z][a-z0-9_]*"
+            ;;
+    esac
+}
+
+# target_exists <manifest> <name> — distinguish a disabled target from one
+# that is not declared at all. Both inline and block target shapes count.
+target_exists() {
+    local file="$1" target="$2"
+    [ -f "$file" ] || return 1
+    awk -v target="$target" '
+        { sub(/\r$/, "") }
+        /^targets:[[:space:]]*$/ { in_targets = 1; next }
+        /^[A-Za-z]/ { in_targets = 0 }
+        in_targets && $0 ~ "^  " target ":[[:space:]]*" { found = 1; exit }
+        END { exit(found ? 0 : 1) }
+    ' "$file"
+}
+
+# target_set_enabled <manifest> <name> <true|false> <default-output>
+# Transactionally update only `enabled`, preserving every other target field
+# and comment. A missing target is added in the compact form used by init.
+target_set_enabled() {
+    local file="$1" target="$2" enabled="$3" output="$4"
+    [ -f "$file" ] || die "no such file: $file"
+    case "$enabled" in true|false) ;; *) die "internal: invalid target state '$enabled'" ;; esac
+    output="$(_yq_esc "$output")"
+    _qmap_stage "$file" -v target="$target" -v enabled="$enabled" -v output="$output" '
+        function entry() { return "  " target ": { enabled: " enabled ", output: \"" output "\" }" }
+        function add_enabled_to_inline(line,    p) {
+            p = index(line, "{")
+            if (p > 0) return substr(line, 1, p) " enabled: " enabled "," substr(line, p + 1)
+            return line
+        }
+        function flush_target() {
+            if (in_target && !enabled_seen) print "    enabled: " enabled
+            in_target = 0
+        }
+        function flush_targets() {
+            flush_target()
+            if (in_targets && !target_seen) { print entry(); target_seen = 1 }
+            in_targets = 0
+        }
+        { sub(/\r$/, "") }
+        /^targets:[[:space:]]*$/ { targets_seen = 1; in_targets = 1; print; next }
+        in_targets && /^[A-Za-z]/ { flush_targets() }
+        in_targets && /^  [A-Za-z]/ {
+            flush_target()
+            if ($0 ~ "^  " target ":[[:space:]]*") {
+                target_seen = 1
+                if (match($0, /enabled:[[:space:]]*(true|false)/)) {
+                    print substr($0, 1, RSTART - 1) "enabled: " enabled substr($0, RSTART + RLENGTH)
+                    enabled_seen = 1
+                } else if ($0 ~ /\{/) {
+                    print add_enabled_to_inline($0)
+                    enabled_seen = 1
+                } else {
+                    print
+                    in_target = 1
+                    enabled_seen = 0
+                }
+                next
+            }
+        }
+        in_target && /^    enabled:[[:space:]]*/ {
+            print "    enabled: " enabled
+            enabled_seen = 1
+            next
+        }
+        { last = $0; print }
+        END {
+            flush_targets()
+            if (!targets_seen) {
+                if (last != "") print ""
+                print "targets:"
+                print entry()
+            }
+        }
+    '
+}
+
 # qmap_keys <file> <block> — quoted keys, one per line.
 qmap_keys() {
     [ -f "$1" ] || return 0

package/cli/lib/registry.sh

@@ -11,7 +11,7 @@
 # visible, reviewable, deletable.
 #
 # The NAME is the trust anchor a developer reasons with; source integrity is
-# a separate mechanism: the lock pins url+sha, and doctor flags
+# a separate mechanism: the lock pins url+sha, and `status --check` flags
 # resolution/lock url drift.
 #
 # An index is itself fetched with git (never curl): auth, proxies and private
@@ -93,7 +93,7 @@ suggest_similar() {
             cshort="${cand#*/}"; cshort="${cshort%s}"
             if [ "$cshort" = "$want" ] && [ "$cand" != "$name" ]; then
                 seen="$seen$cand "
-                echo "  Did you mean: intelligence add $cand" >&2
+                echo "  Did you mean: intelligence package add $cand" >&2
             fi
         done < <(qmap_keys "$idx" "packages")
     }
@@ -116,8 +116,8 @@ fetch_package() {
     assert_safe_source_url "$url"
     assert_safe_ref "$ref"
     # Bundle seed: the engine-content package at the CLI's own version copies
-    # from the npm bundle — no network, which keeps init / fresh-clone install
-    # / migrate offline exactly like the staging they replace. Keyed on the
+    # from the npm bundle — no network, which keeps init, sync restoration and
+    # archived-project conversion offline. Keyed on the
     # full (url, path, ref) triple; any other version or source falls through
     # to the normal clone.
     if [ "$url" = "$SYNC_PKG_URL" ] && [ "$subpath" = "$SYNC_PKG_PATH" ] \

package/engine/ENGINE_SHA

@@ -1 +1 @@
-557cde6997dce612e0e8a5a11adc2472173dcec0
+f2bfc5e3722bf6fb2f7309db2d248368d5b0cc5e