uniweb 0.85.0 → 0.86.0

package/src/commands/snapshot.js

@@ -33,7 +33,7 @@ import { createRequire } from 'node:module'
 import { isAbsolute, join, relative, resolve, sep } from 'node:path'
 import { pathToFileURL } from 'node:url'
 import yaml from 'js-yaml'
-import { upsertYamlScalar } from '@uniweb/build/uwx'
+import { writeSiteConfig } from '@uniweb/build/uwx'
 
 import { didYouMean } from '../utils/args.js'
 import { humanBytes } from '../utils/bytes.js'
@@ -431,14 +431,23 @@ export async function snapshot(args = []) {
     return
   }
   const current = siteYml.data.preview
+  // Edited in place, its comments kept (`writeSiteConfig`) — and not at all when site.yml
+  // does not parse: that is said, and the file left as the author has it.
+  const setPreview = () => {
+    try {
+      writeSiteConfig(siteDir, { preview: value })
+      return true
+    } catch (err) {
+      console.log(`  ${YELLOW}site.yml not changed:${RESET} ${DIM}${err.message}${RESET}`)
+      return false
+    }
+  }
   switch (previewDecision(current, value)) {
     case 'set':
-      upsertYamlScalar(siteYml.file, 'preview', value)
-      console.log(`  site.yml: ${CYAN}preview: ${value}${RESET}`)
+      if (setPreview()) console.log(`  site.yml: ${CYAN}preview: ${value}${RESET}`)
       break
     case 'replace':
-      upsertYamlScalar(siteYml.file, 'preview', value)
-      console.log(`  site.yml: ${CYAN}preview: ${value}${RESET} ${DIM}(replaces the app-generated preview)${RESET}`)
+      if (setPreview()) console.log(`  site.yml: ${CYAN}preview: ${value}${RESET} ${DIM}(replaces the app-generated preview)${RESET}`)
       break
     case 'unchanged':
       console.log(`  ${DIM}site.yml already has preview: ${value}${RESET}`)

package/src/commands/status.js

@@ -243,7 +243,7 @@ export async function status(args = []) {
     if (siteState?.state === 'gone') {
       say.warn(`The backend has no site ${uuid} — it was deleted there, or the backend was rebuilt.`)
       say.dim(
-        `To push this as a new site: uniweb forget --backend ${probeBackend}, then uniweb push.`
+        `To push this as a new site: uniweb forget --server ${probeBackend}, then uniweb push.`
       )
     } else if (siteState?.state === 'unknown') {
       say.dim(

package/src/framework-index.json

@@ -1,16 +1,16 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-10-07T11:39:54.164Z",
+  "generatedAt": "2026-10-07T18:16:06.785Z",
   "packages": {
     "@uniweb/api": {
-      "version": "0.6.10",
+      "version": "0.7.0",
       "path": "framework/api",
       "deps": [
         "@uniweb/core"
       ]
     },
     "@uniweb/build": {
-      "version": "0.78.0",
+      "version": "0.79.0",
       "path": "framework/build",
       "deps": [
         "@uniweb/content-reader",
@@ -35,7 +35,7 @@
       "deps": []
     },
     "@uniweb/core": {
-      "version": "0.37.2",
+      "version": "0.38.0",
       "path": "framework/core",
       "deps": [
         "@uniweb/semantic-parser",
@@ -48,14 +48,14 @@
       "deps": []
     },
     "@uniweb/icons": {
-      "version": "0.4.28",
+      "version": "0.4.29",
       "path": "framework/icons",
       "deps": [
         "@uniweb/core"
       ]
     },
     "@uniweb/kit": {
-      "version": "0.19.18",
+      "version": "0.20.0",
       "path": "framework/kit",
       "deps": [
         "@uniweb/core",
@@ -76,7 +76,7 @@
       "deps": []
     },
     "@uniweb/projections": {
-      "version": "0.7.14",
+      "version": "0.7.15",
       "path": "framework/projections",
       "deps": [
         "@uniweb/content-writer",
@@ -84,7 +84,7 @@
       ]
     },
     "@uniweb/runtime": {
-      "version": "0.29.2",
+      "version": "0.29.3",
       "path": "framework/runtime",
       "deps": [
         "@uniweb/core",
@@ -97,7 +97,7 @@
       "deps": []
     },
     "@uniweb/schemas": {
-      "version": "0.12.0",
+      "version": "0.13.0",
       "path": "framework/schemas",
       "deps": []
     },
@@ -117,7 +117,7 @@
       "deps": []
     },
     "@uniweb/templates": {
-      "version": "0.18.0",
+      "version": "0.18.1",
       "path": "framework/templates",
       "deps": []
     },
@@ -127,7 +127,7 @@
       "deps": []
     },
     "@uniweb/unipress": {
-      "version": "0.10.22",
+      "version": "0.10.23",
       "path": "framework/unipress",
       "deps": [
         "@uniweb/build",

package/src/index.js

@@ -645,6 +645,15 @@ async function main() {
   const command = args[0]
   const pm = detectPackageManager()
 
+  // ⛔ THE VARIABLE THAT AIMS A PROCESS IS UNIWEB_SERVER — UNIWEB_REGISTER_URL until 2026-10-07.
+  // Set ALONE, the old name is refused rather than ignored: ignored, a script that meant a
+  // local or staging backend would go to the default one, uniweb.app, and say nothing. Set
+  // beside the new one it is ignored, so a script can carry both while CLIs of both ages run it.
+  if (process.env.UNIWEB_REGISTER_URL && !process.env.UNIWEB_SERVER) {
+    error('UNIWEB_REGISTER_URL is now UNIWEB_SERVER — rename it, and the command goes to the same backend.')
+    process.exit(2)
+  }
+
   // Handle --version / -v
   //
   // Output convention: the version goes to stdout (parseable, scriptable —
@@ -915,13 +924,13 @@ async function main() {
   }
 
   // Handle login command — the backend (username/password · paste a token ·
-  // --token <bearer>). ⭐ `--backend <url>` names it; without the flag it is the DEFAULT
-  // backend — UNIWEB_REGISTER_URL, else ~/.uniweb/config.json, else https://uniweb.app —
+  // --token <bearer>). ⭐ `--server <url>` names it; without the flag it is the DEFAULT
+  // backend — UNIWEB_SERVER, else ~/.uniweb/config.json, else https://uniweb.app —
   // and never the project's backend *[Diego, 2026-09-21: "the default backend for login, if
   // not specified, is uniweb.app"]*. ⭐ Except a WORKSPACE SWITCH — `--org` / `--personal`
   // and no way of signing in — which acts on the backend you are logged in to *[Diego,
   // 2026-10-06]* (`resolveLoginOrigin`). The backend logged in to becomes CURRENT, and
-  // every backend command goes there (only UNIWEB_REGISTER_URL outranks it) — which is why
+  // every backend command goes there (only UNIWEB_SERVER outranks it) — which is why
   // this is the one place a backend is chosen.
   //
   // ⛔ Until 2026-09-21 a bare login went to the backend of the project in the cwd, and
@@ -932,12 +941,19 @@ async function main() {
     const { readFlagValue } = await import('./utils/args.js')
     const { runRegistryLogin } = await import('./utils/registry-auth.js')
     const { resolveLoginOrigin } = await import('./utils/config.js')
+    // `--backend` was this flag's name until 2026-10-07 — renamed so it is not read as a
+    // site's `backend` service. Refused with the new name, never treated as unknown and dropped:
+    // dropped, the login would go to the default backend.
+    if (loginArgs.some((a) => a === '--backend' || a.startsWith('--backend='))) {
+      console.error('\x1b[31m✗\x1b[0m `--backend` is now `--server`: uniweb login --server <url>')
+      process.exit(2)
+    }
     let apiBase
     try {
-      apiBase = resolveLoginOrigin(readFlagValue(loginArgs, '--backend'), loginArgs)
+      apiBase = resolveLoginOrigin(readFlagValue(loginArgs, '--server'), loginArgs)
     } catch (err) {
       console.error(
-        `\x1b[31m✗\x1b[0m ${err.message} — e.g. uniweb login --backend http://localhost:8080`
+        `\x1b[31m✗\x1b[0m ${err.message} — e.g. uniweb login --server http://localhost:8080`
       )
       process.exit(2)
     }
@@ -973,6 +989,19 @@ async function main() {
     return
   }
 
+  // Handle site command — the sites in a workspace: list them, unpublish or delete one.
+  // Runs anywhere: inside a project it can act on the site the project is synced to.
+  if (command === 'site') {
+    const { site } = await import('./commands/site.js')
+    const result = await site(args.slice(1))
+    // ⛔ EXIT ONLY ONCE STDOUT HAS DRAINED. To a pipe Node writes asynchronously, so an exit
+    // straight after a long list cut it at 8192 bytes — measured 2026-10-07: `site list --json`
+    // of 79 sites reached a reading process as half a JSON document, while the same command
+    // into a file (synchronous) was whole. Pinned by test/site-list-pipe.test.js.
+    await new Promise((resolve) => process.stdout.write('', resolve))
+    process.exit(result?.exitCode ?? 0)
+  }
+
   // Handle org command (new-backend orgs/units — publish-scope management)
   if (command === 'org') {
     const { org } = await import('./commands/org.js')
@@ -1796,7 +1825,7 @@ logged in to is where the backend commands go (push, pull, publish, status,
 register, clone) — so this is how you switch. Already logged in to it, login
 does nothing; add --password, --browser, --token-paste or --token to log in again.
 
-Without --backend: https://uniweb.app (or \$UNIWEB_REGISTER_URL). No command talks
+Without --server: https://uniweb.app (or \$UNIWEB_SERVER). No command talks
 to a backend you are not logged in to — run one before logging in and it asks first.
 
 ${colors.bright}The workspace you work in.${colors.reset} A login works in ONE workspace — your
@@ -1807,7 +1836,7 @@ or name it. Already logged in, \`uniweb login --org @other\` (or \`--personal\`)
 the workspace on the backend you are logged in to, without logging in again.
 
 ${colors.bright}Options:${colors.reset}
-  --backend <url>    The backend to log in to (without it: the default backend — or, for
+  --server <url>    The backend to log in to (without it: the default backend — or, for
                      --org / --personal alone, the one you are logged in to)
   --org @org         Work in @org (an organization you belong to)
   --personal         Work in your personal workspace
@@ -1875,13 +1904,13 @@ so it is deliberately kept away from the refresh half.
 ${colors.cyan}${colors.bright}uniweb forget${colors.reset} ${colors.dim}— Remove what this project recorded about where it synced${colors.reset}
 
 ${colors.bright}Usage:${colors.reset}
-  uniweb forget --backend <url>
+  uniweb forget --server <url>
   uniweb forget --all
 
 Local files only. Every site stays where it is on its backend.
 
 ${colors.bright}Options:${colors.reset}
-  --backend <url>    Forget one backend: its entries in sync.json and in the local
+  --server <url>    Forget one backend: its entries in sync.json and in the local
                      cache, and its deploy records in deploy.yml. Its targets stay,
                      so the next publish there creates a new site.
   --all              For a COPY of a project that should become a new one. Deletes
@@ -2062,6 +2091,7 @@ ${colors.bright}Commands:${colors.reset}
   sync               Catch up, then push (refresh + push)
   status             Show a site's sync state (unpushed content, foundation)
   forget             Forget a backend, or --all to make a copied project a new one
+  site <cmd>         The sites in a workspace: list, unpublish, delete
   inspect <path>     Inspect parsed content shape of a markdown file or folder
   docs               Generate component documentation
   families           List the standard section families (for meta.js family:)
@@ -2093,8 +2123,8 @@ ${colors.bright}Global Options:${colors.reset}
 
   Backend commands (push, pull, publish, status, register, clone) go to the
   backend you are logged in to, with its session. Switch with
-  \`uniweb login --backend <url>\` (add \`--token <bearer>\` to sign in with a token);
-  a script can aim and authenticate one process with UNIWEB_REGISTER_URL and
+  \`uniweb login --server <url>\` (add \`--token <bearer>\` to sign in with a token);
+  a script can aim and authenticate one process with UNIWEB_SERVER and
   UNIWEB_TOKEN instead.
 
 ${colors.bright}Push Options:${colors.reset}

package/src/utils/config.js

@@ -53,7 +53,7 @@ function readCliConfig() {
 /**
  * The origin the LAST `uniweb login` authenticated against — persisted on the
  * session record so subsequent verbs default to the backend you logged into
- * (no `--backend` per command). Sync read; null when there's no session or it
+ * (no backend flag per command). Sync read; null when there's no session or it
  * carries no origin (older sessions). Read directly (not via registry-auth.js)
  * to keep this module off the optional-peer / import-cycle path.
  * @returns {string|null}
@@ -91,7 +91,7 @@ function originOrNull(value) {
  * **The default backend** — where a bare `uniweb login` goes, and where a backend command
  * goes when nobody is logged in (the login it asks for is then this one).
  *
- * `UNIWEB_REGISTER_URL`, else `~/.uniweb/config.json` `registryApiUrl`, else
+ * `UNIWEB_SERVER`, else `~/.uniweb/config.json` `registryApiUrl`, else
  * https://uniweb.app. ⛔ **Never the current session** *[Diego, 2026-09-21: "the default
  * backend for login, if not specified, is uniweb.app"]* — a bare `uniweb login` means the
  * default backend, not "the one I am already on".
@@ -100,7 +100,7 @@ function originOrNull(value) {
  */
 export function getDefaultBackendOrigin() {
   return (
-    originOrNull(process.env.UNIWEB_REGISTER_URL) ||
+    originOrNull(process.env.UNIWEB_SERVER) ||
     originOrNull(readCliConfig().registryApiUrl) ||
     DEFAULT_BACKEND_ORIGIN
   )
@@ -108,7 +108,7 @@ export function getDefaultBackendOrigin() {
 
 /**
  * The `uniweb login` that SWITCHES the workspace on `origin` — the caller appends `--org @x`
- * or `--personal` — with `--backend` unless a switch without it reaches `origin`
+ * or `--personal` — with `--server` unless a switch without it reaches `origin`
  * (`resolveLoginOrigin`): the backend you are logged in to, or, logged in nowhere, the
  * default backend.
  *
@@ -118,12 +118,12 @@ export function getDefaultBackendOrigin() {
  *
  * @param {string} origin - the backend the hint is about
  * @param {string} [prefix='uniweb'] - how the user runs the CLI (`getCliPrefix`)
- * @returns {string} e.g. `uniweb login`, or `uniweb login --backend http://localhost:8080`
+ * @returns {string} e.g. `uniweb login`, or `uniweb login --server http://localhost:8080`
  */
 export function loginCommand(origin, prefix = 'uniweb') {
   const o = originOrNull(origin)
   const reached = originOrNull(loggedInOrigin()) || getDefaultBackendOrigin()
-  return o && o !== reached ? `${prefix} login --backend ${o}` : `${prefix} login`
+  return o && o !== reached ? `${prefix} login --server ${o}` : `${prefix} login`
 }
 
 /** The flags with which `uniweb login` SIGNS IN — a method, or a credential. */
@@ -145,7 +145,7 @@ export function isWorkspaceSwitch(args = []) {
 }
 
 /**
- * The backend `uniweb login` logs in to: `--backend`; else, for a workspace switch, the
+ * The backend `uniweb login` logs in to: `--server`; else, for a workspace switch, the
  * backend you are logged in to; else the default backend.
  *
  * ⭐ A SWITCH ACTS ON YOUR SESSION *[Diego, 2026-10-06: "`uniweb login --org @x` or
@@ -157,14 +157,14 @@ export function isWorkspaceSwitch(args = []) {
  * uniweb.app"]*. ⛔ Until 2026-10-06 a switch went to the default backend too, so on any
  * other backend it began a new login there, logging you out of the one you were on.
  *
- * ⛔ A mistyped `--backend` is an error, never a fallback — it would log you in, and so
+ * ⛔ A mistyped `--server` is an error, never a fallback — it would log you in, and so
  * point every command, somewhere you did not name.
  *
  * @param {string|null|undefined} flag - `readFlagValue`'s answer: undefined when the
  *   flag is absent, null when it was given with no value
  * @param {string[]} [args] - the login's argv, to tell a switch from a sign-in
  * @returns {string}
- * @throws {Error} when --backend was given and is not a URL
+ * @throws {Error} when --server was given and is not a URL
  */
 export function resolveLoginOrigin(flag, args = []) {
   if (flag === undefined) {
@@ -172,7 +172,7 @@ export function resolveLoginOrigin(flag, args = []) {
     return session || getDefaultBackendOrigin()
   }
   const origin = originOrNull(flag)
-  if (!origin) throw new Error(flag ? `Not a URL: ${flag}` : '--backend needs a URL')
+  if (!origin) throw new Error(flag ? `Not a URL: ${flag}` : '--server needs a URL')
   return origin
 }
 
@@ -180,12 +180,12 @@ export function resolveLoginOrigin(flag, args = []) {
  * **The backend a command talks to** — the base of every `/dev/*` route (`register`
  * POSTs to {origin}/dev/registry/register, and so on).
  *
- * `UNIWEB_REGISTER_URL` > **the backend the user is logged in to** > the default
+ * `UNIWEB_SERVER` > **the backend the user is logged in to** > the default
  * (`getDefaultBackendOrigin`). ⭐ Nothing talks to a backend the user is not logged in
  * to *[Diego, 2026-09-21]*: when this falls through to the default, the command's first
  * request asks for that login — so the default is where the login goes, never a
  * backend reached without one. `resolveBackendOrigin` (backend/client.js) returns this
- * unchanged: no command takes a `--backend`. ⛔ *Until 2026-10-05 this said "when no
+ * unchanged: no command takes a backend flag. ⛔ *Until 2026-10-05 this said "when no
  * `--backend` is given" and that `resolveBackendOrigin` put `--backend` on top — read as
  * a per-command flag outranking the login. The verbs lost that flag on 2026-09-21.*
  *
@@ -193,7 +193,7 @@ export function resolveLoginOrigin(flag, args = []) {
  */
 export function getRegistryApiBaseUrl() {
   return (
-    originOrNull(process.env.UNIWEB_REGISTER_URL) ||
+    originOrNull(process.env.UNIWEB_SERVER) ||
     originOrNull(loggedInOrigin()) ||
     getDefaultBackendOrigin()
   )

package/src/utils/flag-guard.js

@@ -9,14 +9,15 @@
  * Tolerable for a cosmetic flag; dangerous for any flag that aims the command or picks
  * its identity. This turns that class into one sentence.
  *
- * ⛔ **`--backend` and `--token` are NOT flags of these verbs** *(2026-09-21)*. Every
+ * ⛔ **A backend flag and `--token` are NOT flags of these verbs** *(2026-09-21)*. Every
  * backend verb goes to the backend you are logged in to, with that login's session:
- * switching and signing in are `uniweb login` (`--backend`, `--token`), and a script
- * aims one process with UNIWEB_REGISTER_URL + UNIWEB_TOKEN. Both flags predate
- * per-backend sessions. Passed now, each is an unknown flag — and this guard is what
- * makes that a loud error, with a pointer to the login, instead of a command that
- * quietly runs against wherever and as whoever you happen to be. `--backend` stays on
- * `forget`, where it SELECTS which backend's records to remove.
+ * switching and signing in are `uniweb login` (`--server`, `--token`), and a script
+ * aims one process with UNIWEB_SERVER + UNIWEB_TOKEN. Passed to a verb, each is an
+ * unknown flag — and this guard is what makes that a loud error, with a pointer to the
+ * login, instead of a command that quietly runs against wherever and as whoever you
+ * happen to be. `--server` stays on `forget`, where it SELECTS which backend's records
+ * to remove. ⛔ *The flag was `--backend` until 2026-10-07, renamed so it is not read as
+ * a site's `backend` service; `--backend` is refused everywhere, naming `--server`.*
  *
  * ⚠️ A wrong rejection is worse than a missed one — it breaks an invocation that
  * works — so the per-command lists must be complete, INCLUDING flags read by
@@ -93,12 +94,17 @@ const VERBS = {
     '--personal'
   ],
   /**
-   * `forget` = remove one backend's records (`--backend <url>`), or everything a
+   * `forget` = remove one backend's records (`--server <url>`), or everything a
    * copied project inherited (`--all`). One of the two is required — the verb refuses
    * without it — and they exclude each other. `--non-interactive` reaches it through
    * resolveSiteDir in a workspace of several sites.
    */
-  forget: ['--backend', '--all'],
+  forget: ['--server', '--all'],
+  /**
+   * `site list | unpublish | delete` — a workspace's sites. `--yes` confirms a write;
+   * `--json` is `list`'s porcelain; the workspace is `--org` / `--personal`.
+   */
+  site: ['--json', '--yes', '--org', '--personal'],
   status: [
     '--json', '--remote', '--dry-run',
     '--force', '--no-verify', '--no-validate', '--yes', '--org', '--personal',
@@ -191,16 +197,24 @@ export function checkFlags(verb, args = []) {
   if (!unknown.length) return null
 
   const flag = unknown[0]
-  // ⭐ `--backend` and `--token` are not typos on these verbs — they are RETIRED
-  // (2026-09-21), and the useful answer is what replaced them, not "run --help".
-  if (flag === '--backend') {
+  // ⭐ `--backend`, `--server` and `--token` are not typos on these verbs — they aim a
+  // command or pick its identity, which only the login does (2026-09-21), and `--backend`
+  // is `--server` since 2026-10-07. The useful answer is where each went, not "run --help".
+  if (flag === '--backend' && verb === 'forget') {
+    return {
+      flag,
+      suggestion: '--server',
+      message: '`--backend` is now `--server`: uniweb forget --server <url>'
+    }
+  }
+  if (flag === '--backend' || flag === '--server') {
     return {
       flag,
       suggestion: null,
       message: [
-        `\`uniweb ${verb}\` has no \`--backend\`: it goes to the backend you are logged in to.`,
-        '  Switch with: uniweb login --backend <url>',
-        '  (A script can aim one process with UNIWEB_REGISTER_URL instead.)'
+        `\`uniweb ${verb}\` has no \`${flag}\`: it goes to the backend you are logged in to.`,
+        '  Switch with: uniweb login --server <url>',
+        '  (A script can aim one process with UNIWEB_SERVER instead.)'
       ].join('\n')
     }
   }
@@ -210,7 +224,7 @@ export function checkFlags(verb, args = []) {
       suggestion: null,
       message: [
         `\`uniweb ${verb}\` has no \`--token\`: it uses the session of the backend you are logged in to.`,
-        '  Sign in with a token: uniweb login --backend <url> --token <bearer>',
+        '  Sign in with a token: uniweb login --server <url> --token <bearer>',
         '  (A script can authenticate one process with UNIWEB_TOKEN instead.)'
       ].join('\n')
     }

package/src/utils/site-identity.js

@@ -116,8 +116,8 @@ export function syncedElsewhere(siteDir, origin) {
 
 /**
  * The heads-up for `syncedElsewhere`, as lines — each verb prints them with its own
- * reporter. Only worth saying when the verb was not TOLD where to go: a `--backend` the
- * user typed is already a decision.
+ * reporter. Only worth saying when the verb was not TOLD where to go: a backend named with
+ * UNIWEB_SERVER is already a decision.
  *
  * ⚖️ Worded for where the verb GOES, not for why: it is the logged-in backend, or — logged
  * in nowhere — the default one, where the login it is about to ask for will be.
@@ -130,7 +130,7 @@ export function describeSyncedElsewhere(known, origin, verb) {
   const where = known.length === 1 ? `site is on ${known[0]}` : `sites are on ${known.join(', ')}`
   return [
     `This project's ${where} — not on ${origin}, where this ${verb} goes.`,
-    `It creates a new site there. To ${verb} to ${known.length === 1 ? 'that one' : 'one of those'} instead: uniweb login --backend <url>`
+    `It creates a new site there. To ${verb} to ${known.length === 1 ? 'that one' : 'one of those'} instead: uniweb login --server <url>`
   ]
 }
 

package/src/utils/yaml-edit.js

@@ -1,115 +0,0 @@
-/**
- * In-place edits to a YAML file a person wrote (`site.yml`), for a command that
- * must change one value and leave everything else as it was: comments, key
- * order, blank lines, quoting, a flow list written on one line.
- *
- * ⛔ Never load a hand-written file and dump it back. js-yaml's `dump` drops every
- * comment and re-flows lists and long strings — `scaffold.js` records what that
- * did to the templates whose comments are the point of them.
- *
- * ⭐ Every edit is VERIFIED: the edited text must parse to exactly the old data
- * with that one value changed. A value written in a form the line-level edit
- * cannot reach (a block scalar, an entry split across lines) returns null
- * rather than a guess, so the caller can refuse before it changes anything.
- */
-
-import { isDeepStrictEqual } from 'node:util'
-import yaml from 'js-yaml'
-
-const escapeRegex = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
-
-/** A scalar as written after `key: `, quoted only when YAML needs it (`@scope/name` does). */
-const scalar = (value) => yaml.dump(value, { lineWidth: -1 }).trim()
-
-/**
- * Where a trailing ` # comment` begins in the text after `key:`, outside quotes,
- * including the whitespace before it. -1 when the line has none.
- */
-function commentStart(rest) {
-  let quote = null
-  for (let i = 0; i < rest.length; i++) {
-    const ch = rest[i]
-    if (quote) {
-      if (ch === quote) quote = null
-    } else if (ch === '"' || ch === "'") {
-      quote = ch
-    } else if (ch === '#' && i > 0 && /\s/.test(rest[i - 1])) {
-      let start = i
-      while (start > 0 && /\s/.test(rest[start - 1])) start--
-      return start
-    }
-  }
-  return -1
-}
-
-/** The edited text when it parses to `expected`, else null. */
-function verified(after, expected) {
-  try {
-    return isDeepStrictEqual(yaml.load(after) ?? {}, expected) ? after : null
-  } catch {
-    return null
-  }
-}
-
-function load(text) {
-  try {
-    const data = yaml.load(text) ?? {}
-    return data && typeof data === 'object' && !Array.isArray(data) ? data : null
-  } catch {
-    return null
-  }
-}
-
-/**
- * Set a top-level, one-line scalar `key` to `value`, keeping the line's inline
- * comment and every other line as it was.
- *
- * @param {string} text - the file's contents
- * @param {string} key - a top-level key, e.g. `foundation`
- * @param {string} value
- * @returns {string|null} the new contents, or null when the edit cannot be made in place
- */
-export function setTopLevelScalar(text, key, value) {
-  const data = load(text)
-  if (!data) return null
-  const match = new RegExp(`^${escapeRegex(key)}:([^\\n]*)$`, 'm').exec(text)
-  if (!match) return null
-  const at = commentStart(match[1])
-  const comment = at === -1 ? '' : match[1].slice(at)
-  const line = `${key}: ${scalar(value)}${comment}`
-  const after = text.slice(0, match.index) + line + text.slice(match.index + match[0].length)
-  return verified(after, { ...data, [key]: value })
-}
-
-/**
- * Replace entries of a top-level list `key` — each `from` value becomes its `to`
- * — wherever an entry is written on a line of its own or inside a one-line flow
- * list, plain or quoted. A value that only CONTAINS `from` is left alone, and so
- * is a comment line.
- *
- * @param {string} text - the file's contents
- * @param {string} key - a top-level list key, e.g. `extensions`
- * @param {Map<string, string>} replacements - old entry → new entry
- * @returns {string|null} the new contents, or null when the edit cannot be made in place
- */
-export function replaceInTopLevelList(text, key, replacements) {
-  const data = load(text)
-  if (!data || !Array.isArray(data[key])) return null
-  const expected = { ...data, [key]: data[key].map((v) => (replacements.has(v) ? replacements.get(v) : v)) }
-
-  const after = text
-    .split('\n')
-    .map((line) => {
-      if (/^\s*#/.test(line)) return line
-      for (const [from, to] of replacements) {
-        const f = escapeRegex(from)
-        line = line
-          .replace(new RegExp(`'${f}'`, 'g'), () => `'${to.replace(/'/g, "''")}'`)
-          .replace(new RegExp(`"${f}"`, 'g'), () => JSON.stringify(to))
-          .replace(new RegExp(`(^|[\\s\\[,])${f}(?=$|[\\s,\\]])`, 'g'), (_, lead) => lead + to)
-      }
-      return line
-    })
-    .join('\n')
-  return verified(after, expected)
-}