uniweb 0.61.0 → 0.63.0

package/src/commands/register.js

@@ -3,15 +3,14 @@
  * standalone schemas package (the data schemas alone, no foundation), to the
  * registry as one names-only `.uwx` document (uwx-format.md §5).
  *
- * `uniweb login && uniweb register`. Distinct from `uniweb publish` (which
- * targets the legacy platform) — `register` talks to the registry over HTTP at a
- * configurable endpoint.
+ * `uniweb login && uniweb register`. Distinct from `uniweb publish`, which ships a
+ * SITE — and releases the site's local foundation by running this command
+ * (`backend/foundation-bring-along.js`).
  *
- * If the foundation's `dist/` is missing or version-stale (the baked schema
- * version differs from package.json), `register` builds it first — the same
- * build-if-stale `uniweb publish` does, so `register` is a full drop-in.
- * Preview paths (`--dry-run`, `-o`) never write to `dist/`; they require a
- * pre-built foundation.
+ * If the foundation's `dist/` is missing or stale — no build, a version bump
+ * since it, a source file newer than it, no SSR bundle (`foundationNeedsBuild`)
+ * — `register` builds it first. Preview paths (`--dry-run`, `-o`) never write to
+ * `dist/`; they require a pre-built foundation.
  *
  * Run from a foundation, or from a schemas-only package — a package that exports
  * schemas (e.g. `@uniweb/schemas`, any `@org/schemas`) or a bare `schemas/*.yml`
@@ -22,8 +21,13 @@
  *   uniweb register                      Build the .uwx, submit it, then deliver
  *                                        the foundation's dist/ code (plan +
  *                                        upload — see utils/code-upload.js)
- *   uniweb register --scope @org         Publish under @org (resolves @/x -> @org/x).
- *                                        Default: the package's package.json "uniweb.scope".
+ *   uniweb register --scope @org         A foundation whose name is bare: register it under
+ *                                        @org (resolves @/x -> @org/x) and write the scope
+ *                                        into its name in main.js. Refused when the name
+ *                                        already carries another scope — a foundation's
+ *                                        scope is the one in its name.
+ *                                        A schemas-only package: publish under @org.
+ *                                        Default: its package.json "uniweb.scope".
  *   uniweb register --schema-only        Skip the code delivery (schemas land, no dist upload)
  *   uniweb register --dry-run            Print the .uwx + the code file plan; submit nothing
  *   uniweb register -o foundation.uwx    Write the .uwx to a file; submit nothing
@@ -64,13 +68,21 @@ import {
   statSync
 } from 'node:fs'
 import { execSync } from 'node:child_process'
-import { resolve, join } from 'node:path'
+import { resolve, join, relative } from 'node:path'
+import prompts from 'prompts'
 import { buildRegistryPackage, buildSchemaOnlyPackage } from '@uniweb/build/uwx'
 import {
   classifyPackage,
   isSchemasPackage,
-  collectStandaloneSchemas
+  collectStandaloneSchemas,
+  readFoundationName,
+  checkFoundationName,
+  splitFoundationName
 } from '@uniweb/build'
+import {
+  suggestFoundationName,
+  writeFoundationName
+} from '../utils/foundation-name.js'
 import { readRegistryAuth } from '../utils/registry-auth.js'
 import {
   collectDistFiles,
@@ -137,8 +149,10 @@ function cliVersion() {
   }
 }
 
-// The foundation's recorded publish org, from its package.json `uniweb.scope`
-// (`{ "uniweb": { "scope": "@acme" } }`) — the default when `--scope` is absent.
+// A SCHEMAS-ONLY package's recorded publish org, from its package.json `uniweb.scope`
+// (`{ "uniweb": { "scope": "@acme" } }`) — the default when `--scope` is absent. It
+// has no main.js whose name could carry it. ⛔ A foundation's scope is part of its name
+// (2026-09-22); its `uniweb.scope` is refused by `readFoundationName`.
 function readPkgScope(foundationDir) {
   try {
     const pkg = JSON.parse(
@@ -150,9 +164,10 @@ function readPkgScope(foundationDir) {
   }
 }
 
-// Record the chosen publish scope in the foundation's package.json so it travels
-// with the foundation (read back by readPkgScope on the next register). Preserves
-// the file's existing JSON style.
+// Record the chosen publish scope in a schemas-only package's package.json so it
+// travels with the package (read back by readPkgScope on the next register). Preserves
+// the file's existing JSON style. A foundation's goes into its name instead
+// (`settleFoundationScope`).
 async function writePkgScope(foundationDir, scope) {
   const path = join(foundationDir, 'package.json')
   const pkg = JSON.parse(readFileSync(path, 'utf8'))
@@ -209,6 +224,173 @@ async function resolveFoundationDir(args) {
   process.exit(1)
 }
 
+/**
+ * The foundation's name, settled before anything is built or sent.
+ *
+ * A foundation registers as `@org/<name>`, and sites pin it by that name. The name
+ * is `main.js`'s `name`, else package.json's — `readFoundationName`, the rule the
+ * build reads for the schema this command submits. ⛔ `src` and `foundation` are
+ * the folder the code sits in, not the code: a project scaffolded before the name
+ * moved to main.js has package name `src`, and every such project in an org would
+ * register the same `@org/src`. So a name that cannot register is ASKED FOR here,
+ * once, and kept in main.js — or, with nobody to ask, refused with the line to add.
+ * Before the build, so a written name is built into the schema like any edit.
+ *
+ * @param {string} targetDir
+ * @param {{ args: string[], isPreview: boolean }} o
+ * @returns {Promise<boolean>} false → stop; the reason is printed
+ */
+export async function settleFoundationName(targetDir, { args, isPreview }) {
+  let read
+  try {
+    read = await readFoundationName(targetDir)
+  } catch (err) {
+    error(err.message)
+    return false
+  }
+  const problem = checkFoundationName(read.name)
+  if (!problem) return true
+
+  const where = relative(process.cwd(), read.mainFile) || read.mainFile
+  const suggestion = suggestFoundationName(targetDir)
+  const reason = `${problem[0].toUpperCase()}${problem.slice(1)}.`
+
+  // Nobody to ask — a script, a preview (which writes nothing), or --json (whose
+  // stdout is a data channel a prompt would corrupt). Name the fix exactly.
+  if (isPreview || jsonMode || isNonInteractive(args)) {
+    error(`This foundation has no name it can register under. ${reason}`)
+    log(`  Name it in ${colors.bright}${where}${colors.reset}, in the default export:`)
+    log(`    ${colors.bright}name: '${suggestion || '<name>'}',${colors.reset}`)
+    log(`  ${colors.dim}It registers as @<org>/<name>, and sites pin that name.${colors.reset}`)
+    return false
+  }
+
+  info(`This foundation needs a name to register under. ${reason}`)
+  const { name } = await prompts(
+    {
+      type: 'text',
+      name: 'name',
+      message: 'Foundation name (it registers as @<org>/<name>):',
+      initial: suggestion || '',
+      validate: (v) => checkFoundationName(String(v).trim()) || true
+    },
+    {
+      onCancel: () => {
+        log('\nRegister cancelled.')
+        process.exit(0)
+      }
+    }
+  )
+  const chosen = String(name || '').trim()
+  if (!chosen) return false
+
+  const written = writeFoundationName(read.mainFile, chosen, {
+    replace: read.source === 'main.js' ? read.name : null
+  })
+  if (!written.ok) {
+    error(`Could not write the name: ${written.reason}.`)
+    log(`  Add it to the default export in ${colors.bright}${where}${colors.reset}:  name: '${chosen}',`)
+    return false
+  }
+  // Read it back through the build's own rule — the text edit is only a means.
+  const again = await readFoundationName(targetDir).catch(() => null)
+  if (again?.name !== chosen) {
+    error(`${where} now names the foundation '${chosen}', but it still reads as "${again?.name}".`)
+    return false
+  }
+  success(`Named the foundation ${colors.bright}${chosen}${colors.reset} — kept in ${where}.`)
+  return true
+}
+
+/**
+ * Settle the scope a foundation registers under — the one in its name.
+ *
+ * ⭐ THE SCOPE IS PART OF THE NAME (2026-09-22): `name: '@acme/marketing'` in main.js.
+ * A scoped name decides it, and a `--scope` naming another org is refused — which org
+ * was meant is not ours to guess, and today's alternative was a split identity (the
+ * foundation under one org, its data schemas under the other). A bare name has not
+ * registered yet: it takes `--scope`, else one derived from your orgs, and the chosen
+ * scope is WRITTEN INTO THE NAME, so it is chosen once and travels with the code.
+ * ⛔ Until then it was written to `package.json::uniweb.scope`, which is refused now
+ * (`readFoundationName`, naming the line to write).
+ *
+ * A preview (`--dry-run`, `-o`) writes nothing: a bare name previews under `--scope`,
+ * or unscoped.
+ *
+ * @returns {Promise<{ scope: string|null, source: string|null } | { cancelled: true } | null>}
+ *   null when refused (the reason is printed); `cancelled` when no org was chosen
+ */
+export async function settleFoundationScope(targetDir, { args, isPreview, flagScope, client }) {
+  let read
+  try {
+    read = await readFoundationName(targetDir)
+  } catch (err) {
+    error(err.message)
+    return null
+  }
+  const where = relative(process.cwd(), read.mainFile) || read.mainFile
+  const { scope: nameScope, bare } = splitFoundationName(read.name)
+
+  if (nameScope) {
+    if (flagScope && flagScope !== nameScope) {
+      error(
+        `${where} names this foundation ${read.name}, so it registers under ${nameScope} — ` +
+          `--scope ${flagScope} names another org.`
+      )
+      log(
+        `  ${colors.dim}To register it under ${flagScope}, change its name in ${where}: ` +
+          `name: '${flagScope}/${bare}'${colors.reset}`
+      )
+      return null
+    }
+    return { scope: nameScope, source: 'main.js' }
+  }
+
+  if (isPreview) return { scope: flagScope, source: flagScope ? '--scope' : null }
+
+  let scope = flagScope
+  let source = flagScope ? '--scope' : null
+  if (!scope) {
+    scope = await deriveScopeFromLogin(client, args)
+    if (!scope) return { cancelled: true }
+    source = 'login'
+  }
+
+  const scoped = `${scope}/${bare}`
+  const written = writeFoundationName(read.mainFile, scoped, {
+    replace: read.source === 'main.js' ? read.name : null
+  })
+  if (!written.ok) {
+    error(`Could not write the scope into the foundation's name: ${written.reason}.`)
+    log(`  Name it in the default export in ${colors.bright}${where}${colors.reset}:  name: '${scoped}',`)
+    return null
+  }
+  // Read it back through the build's own rule — the text edit is only a means.
+  const again = await readFoundationName(targetDir).catch(() => null)
+  if (again?.name !== scoped) {
+    error(`${where} now names the foundation '${scoped}', but it still reads as "${again?.name}".`)
+    return null
+  }
+  success(`This foundation registers as ${colors.bright}${scoped}${colors.reset} — kept in ${where}.`)
+  return { scope, source }
+}
+
+/**
+ * A publish scope derived from the login's org memberships (list → 1 use / 0 create /
+ * N pick), as `@handle` — or null when none was chosen.
+ */
+async function deriveScopeFromLogin(client, args) {
+  const token = await client.token()
+  const sess = await readRegistryAuth(client.origin)
+  const derived = await deriveScope({
+    apiBase: client.origin,
+    token,
+    accountHandle: sess?.handle || null,
+    args
+  })
+  return derived ? `@${derived}` : null
+}
+
 // Directories that are never foundation source. `dist` is the output we compare
 // against; the rest are tooling. Dotted entries are skipped wholesale.
 const NON_SOURCE_DIRS = new Set(['dist', 'node_modules'])
@@ -403,10 +585,13 @@ async function runRegister(args = []) {
     ? process.cwd()
     : await resolveFoundationDir(args)
 
-  // Scope: --scope flag, else package.json `uniweb.scope`, else (real submit
-  // only) derived from login membership in the bootstrap below. Either spelling,
-  // `@acme` or `acme`, and from here on the one form: `@acme` (publishScope).
-  const pkgScope = readPkgScope(targetDir)
+  // Scope. ⭐ A FOUNDATION's is the one in its name (`name: '@acme/marketing'` in
+  // main.js), settled below before the build; a bare name takes --scope, else one
+  // derived from your orgs, and register writes it into the name (2026-09-22).
+  // A SCHEMAS-ONLY package has no name to carry one: --scope, else package.json
+  // `uniweb.scope`, else (real submit only) derived from login membership. Either
+  // spelling, `@acme` or `acme`, and from here on the one form: `@acme` (publishScope).
+  const pkgScope = standalone ? readPkgScope(targetDir) : null
   const givenScope = scopeFlag || pkgScope
   let scope = publishScope(givenScope)
   let scopeSource = scopeFlag
@@ -443,8 +628,24 @@ async function runRegister(args = []) {
       return { exitCode: 2 }
     }
   } else {
-    // Build-if-stale (mirrors `uniweb publish`): a missing or version-stale
-    // dist/ gets (re)built before we read its schema. Preview paths
+    if (!(await settleFoundationName(targetDir, { args, isPreview }))) {
+      return { exitCode: 2 }
+    }
+    // ⭐ BEFORE THE BUILD, so the build embeds the name the foundation registers as.
+    // Settled after it, a scope written into main.js would leave dist/ describing the
+    // bare name — stale the moment it was built.
+    const settled = await settleFoundationScope(targetDir, {
+      args,
+      isPreview,
+      flagScope: scope,
+      client
+    })
+    if (!settled) return { exitCode: 2 }
+    if (settled.cancelled) return { exitCode: 0 }
+    scope = settled.scope
+    scopeSource = settled.source
+    // Build-if-stale (`foundationNeedsBuild`): a missing or stale dist/ gets
+    // (re)built before we read its schema. Preview paths
     // (--dry-run / -o) must not write to dist/, so they require a pre-built
     // foundation and say so instead of building.
     const { needs, reason } = foundationNeedsBuild(targetDir)
@@ -491,24 +692,18 @@ async function runRegister(args = []) {
     }
   }
 
-  // No scope for a real submit → derive it from login membership (list → 1 use /
-  // 0 create / N pick), persist to package.json, and reuse the session token.
-  if (!scope && !isPreview) {
-    const token = await client.token()
-    const sess = await readRegistryAuth(client.origin)
-    const derived = await deriveScope({
-      apiBase: client.origin,
-      token,
-      accountHandle: sess?.handle || null,
-      args
-    })
+  // A schemas-only package with no scope, on a real submit → derive it from login
+  // membership (list → 1 use / 0 create / N pick) and persist it to package.json.
+  // (A foundation's was settled before its build — `settleFoundationScope`.)
+  if (standalone && !scope && !isPreview) {
+    const derived = await deriveScopeFromLogin(client, args)
     if (!derived) return { exitCode: 0 }
-    scope = `@${derived}`
+    scope = derived
     scopeSource = 'login'
     try {
       await writePkgScope(targetDir, scope)
       info(
-        `Saved ${colors.bright}${scope}${colors.reset} as this ${standalone ? 'package' : 'foundation'}'s publish scope (package.json).`
+        `Saved ${colors.bright}${scope}${colors.reset} as this package's publish scope (package.json).`
       )
     } catch {
       log(
@@ -605,7 +800,9 @@ async function runRegister(args = []) {
   // Submit requires a concrete scope — the registry rejects @/… fail-closed.
   if (!scope) {
     error(
-      'No publish scope — set "uniweb.scope" in package.json, or pass --scope @org.'
+      standalone
+        ? 'No publish scope — set "uniweb.scope" in package.json, or pass --scope @org.'
+        : "No publish scope — name the foundation '@org/<name>' in main.js, or pass --scope @org."
     )
     log(
       `  ${colors.dim}Without a scope, names stay @/… and the registry rejects them.${colors.reset}`

package/src/commands/rename.js

@@ -20,7 +20,7 @@
  *
  * Extensions are technically a flavor of foundation (same build, same
  * package.json shape, distinguished only by `extension: true` in
- * src/foundation.js or `role: 'extension'` in the built schema). The
+ * main.js or `role: 'extension'` in the built schema). The
  * rename verb still keeps them on a separate subcommand because the
  * touch-point sets differ — `rename foundation` against an extension
  * would update the wrong things. Each subcommand guards its target
@@ -30,11 +30,13 @@
  * (target name already taken, target not found, folder collision,
  * type mismatch) we bail with a clear message and no partial state.
  *
- * Out of scope: registry side. The registered id (the scoped
- * `package.json::name` / `uniweb.id`) is independent of the workspace name and
- * stays untouched. There is no registry-rename flag — a registered version is
- * immutable; to change a foundation's registered identity, register it under
- * the new name (consuming sites repoint their `foundation:` ref).
+ * Out of scope: registry side. What a foundation registers as is `name` in its
+ * main.js, which is independent of the workspace name and stays untouched —
+ * except for a foundation with no main.js `name`, whose package name IS its name
+ * (`readFoundationName`), so renaming the package renames what it would register
+ * as. There is no registry-rename flag — a registered version is immutable; to
+ * change a foundation's registered name, change main.js's `name` and register
+ * again (consuming sites repoint their `foundation:` ref).
  *
  * Usage:
  *   uniweb rename foundation <old> <new>
@@ -632,9 +634,10 @@ ${colors.bright}What rename extension does:${colors.reset}
   • Updates pnpm-workspace.yaml + package.json::workspaces.
 
 ${colors.bright}What rename does NOT do (any subcommand):${colors.reset}
-  • Push to the registry. The registered id (package.json::uniweb.id) is
-    independent. To register under a new name, set it and run \`${prefix} register\`
-    (alias \`${prefix} release\`) — there is no rename flag.
+  • Push to the registry, or change what a foundation registers as — that is
+    \`name\` in its main.js, independent of the package name. To register under
+    a new name, change it there and run \`${prefix} register\` (alias
+    \`${prefix} release\`) — there is no rename flag.
 
 ${colors.bright}Examples:${colors.reset}
   ${prefix} rename foundation src marketing-src

package/src/commands/status.js

@@ -25,10 +25,19 @@ import { join } from 'node:path'
 import yaml from 'js-yaml'
 
 import { resolveSiteDir } from './deploy.js'
-import { probeUnpushed } from '../backend/site-sync.js'
-import { BackendClient, resolveBackendOrigin } from '../backend/client.js'
+import { probeUnpushed, nameSiteWorkspace, readSiteWorkspace } from '../backend/site-sync.js'
+import { readOrgFlag } from '../utils/args.js'
+import {
+  BackendClient,
+  resolveBackendOrigin,
+  workspaceHandle,
+  WorkspaceMismatchError
+} from '../backend/client.js'
 import { readBackendState } from '@uniweb/build/uwx'
-import { resolveLocalFoundation } from '../backend/foundation-bring-along.js'
+import {
+  resolveLocalFoundation,
+  foundationScopedName
+} from '../backend/foundation-bring-along.js'
 import { computeFoundationDigest } from '../utils/code-upload.js'
 import { checkFlags } from '../utils/flag-guard.js'
 
@@ -112,26 +121,40 @@ export async function status(args = []) {
   let site = null
   let fdnLatest = null
   let foundationFresh = null // true/false when both digests are known; else null
+  let remoteError = null // a refusal about the workspace — the one remote failure worth saying
   if (remote) {
     try {
       const client = new BackendClient({
         args,
         command: 'Status'
       })
+      // The workspace the site's requests name — as pull names it. A stale record is
+      // re-adopted from the backend's answer; `--json` keeps stdout to the document.
+      const orgFlag = readOrgFlag(args)
+      nameSiteWorkspace(client, {
+        siteDir,
+        workspace: orgFlag ? workspaceHandle(orgFlag) : readSiteWorkspace(siteDir, client.origin),
+        explicit: Boolean(orgFlag),
+        note: jsonMode ? undefined : say.dim
+      })
       if (uuid) site = await client.siteStatus(uuid)
       // Foundation freshness: prefer the LOCAL foundation's scoped name (so a
       // local-foundation site can be checked too); fall back to a scoped
       // site.yml ref. The digest compare is read-only — it never builds, so it
       // only fires when the local foundation is already built (dist present).
       const local = resolveLocalFoundation(siteDir, siteYml)
-      const lookupName = local?.scopedName || fndScope
+      const lookupName =
+        (local && (await foundationScopedName(local.dir))) || fndScope
       if (lookupName) fdnLatest = await client.readFoundationLatest(lookupName)
       if (local?.dir && fdnLatest?.digest) {
         const localDigest = computeFoundationDigest(join(local.dir, 'dist'))
         if (localDigest) foundationFresh = localDigest === fdnLatest.digest
       }
-    } catch {
-      // degrade silently
+    } catch (err) {
+      // Degrade silently — except a refusal about the workspace: `--org` named one the
+      // backend does not work on this site from, or the deployment has another. Saying
+      // nothing would read as "fine".
+      if (err instanceof WorkspaceMismatchError || err?.status === 409) remoteError = err.message
     }
   }
 
@@ -149,7 +172,8 @@ export async function status(args = []) {
               remote: {
                 site,
                 foundation_latest: fdnLatest?.latest_version ?? null,
-                foundation_fresh: foundationFresh
+                foundation_fresh: foundationFresh,
+                ...(remoteError ? { error: remoteError } : {})
               }
             }
           : {})
@@ -198,6 +222,7 @@ export async function status(args = []) {
 
   // Remote signals
   if (remote) {
+    if (remoteError) say.warn(remoteError)
     if (site) {
       if (site.draft_dirty) {
         say.info(

package/src/framework-index.json

@@ -1,16 +1,16 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-09-21T21:47:05.925Z",
+  "generatedAt": "2026-09-23T12:12:24.996Z",
   "packages": {
     "@uniweb/api": {
-      "version": "0.4.1",
+      "version": "0.5.0",
       "path": "framework/api",
       "deps": [
         "@uniweb/core"
       ]
     },
     "@uniweb/build": {
-      "version": "0.57.0",
+      "version": "0.59.0",
       "path": "framework/build",
       "deps": [
         "@uniweb/content-reader",
@@ -35,7 +35,7 @@
       "deps": []
     },
     "@uniweb/core": {
-      "version": "0.29.7",
+      "version": "0.29.8",
       "path": "framework/core",
       "deps": [
         "@uniweb/semantic-parser",
@@ -83,7 +83,7 @@
       ]
     },
     "@uniweb/runtime": {
-      "version": "0.27.3",
+      "version": "0.27.4",
       "path": "framework/runtime",
       "deps": [
         "@uniweb/core",
@@ -96,7 +96,7 @@
       "deps": []
     },
     "@uniweb/schemas": {
-      "version": "0.3.3",
+      "version": "0.3.4",
       "path": "framework/schemas",
       "deps": []
     },
@@ -116,7 +116,7 @@
       "deps": []
     },
     "@uniweb/templates": {
-      "version": "0.15.0",
+      "version": "0.16.0",
       "path": "framework/templates",
       "deps": []
     },
@@ -126,7 +126,7 @@
       "deps": []
     },
     "@uniweb/unipress": {
-      "version": "0.10.0",
+      "version": "0.10.2",
       "path": "framework/unipress",
       "deps": [
         "@uniweb/build",

package/src/index.js

@@ -53,6 +53,10 @@ import {
   mergeTemplateDependencies,
   getWorkspaceTemplateOutputs
 } from './utils/scaffold.js'
+import {
+  normalizeFoundationName,
+  ensureFoundationName
+} from './utils/foundation-name.js'
 import {
   detectPackageManager,
   detectWorkspacePm,
@@ -354,12 +358,16 @@ async function createFromPackageTemplates(
   // 2. Scaffold foundation (folder: src/, package name: src)
   // The folder name 'src' carries the meaning — a foundation is the site's
   // source code. The package name 'src' keeps it unique within the
-  // workspace, since 'site' is taken by the site package.
+  // workspace, since 'site' is taken by the site package. Neither is the
+  // foundation's NAME — what it registers as — which is main.js's `name`:
+  // the project's, since a project's code is its foundation.
   onProgress?.('Creating foundation...')
+  const registryName = normalizeFoundationName(projectName)
   await scaffoldFoundation(
     join(projectDir, 'src'),
     {
       name: 'src',
+      registryName,
       projectName,
       isExtension: false
     },
@@ -380,10 +388,12 @@ async function createFromPackageTemplates(
     { onProgress, onWarning }
   )
 
-  // 4. Apply starter content (unless creating a "none" project)
+  // 4. Apply starter content (unless creating a "none" project). Its main.js
+  // replaces the scaffolded one, so the name is given again.
   if (includeStarter) {
     onProgress?.('Adding starter content...')
     await applyStarter(projectDir, { projectName }, { onProgress, onWarning })
+    ensureFoundationName(join(projectDir, 'src'), registryName)
   }
 
   success(`Created project: ${projectName}`)
@@ -475,15 +485,31 @@ async function createFromContentTemplate(
   )
 
   // 2. Scaffold and apply content for each package
+  const claimed = new Set() // names this project's foundations register as
   for (const pkg of placed) {
     const fullPath = join(projectDir, pkg.relativePath)
 
+    // A foundation's name — what it registers as — is the template's name for
+    // the package when that is one, else the project's (`src` and `foundation`
+    // name a folder); `<project>-<package>` if another package here took it. A
+    // template's own main.js `name` outranks all of them.
+    let registryName = null
+    if (pkg.type === 'foundation' || pkg.type === 'extension') {
+      registryName =
+        [
+          normalizeFoundationName(pkg.name) || normalizeFoundationName(projectName),
+          normalizeFoundationName(`${projectName}-${pkg.name}`)
+        ].find((n) => n && !claimed.has(n)) || null
+      if (registryName) claimed.add(registryName)
+    }
+
     if (pkg.type === 'foundation' || pkg.type === 'extension') {
       onProgress?.(`Creating ${pkg.type}: ${pkg.name}...`)
       await scaffoldFoundation(
         fullPath,
         {
           name: pkg.name,
+          registryName,
           projectName,
           isExtension: pkg.type === 'extension'
         },
@@ -534,6 +560,7 @@ async function createFromContentTemplate(
           renames: contentDir.renames
         }
       )
+      ensureFoundationName(fullPath, registryName)
     }
 
     // Merge template dependencies into package.json
@@ -1429,11 +1456,12 @@ ${colors.bright}Options:${colors.reset}
                      bind to, and the app cannot open such a site.
   --no-save          Do not record this deploy in deploy.yml
   --no-validate      Skip the content-conformance check (it only warns)
-  --org @org         Publish under @org (membership-gated; alias: --as-org). Read
-                     only on a site's FIRST publish — that create decides which org
-                     owns the site, and whose storage its assets are charged to.
-                     Recorded in sync.json and replayed, so it is never
-                     re-typed. Without it, you are asked once.
+  --org @org         Publish under @org (membership-gated). On a site's FIRST
+                     publish it decides which org owns the site, and whose storage
+                     its assets are charged to. Recorded in sync.json and named on
+                     every request after, so it is never re-typed. Without it, you
+                     are asked once. Later, it must match the workspace the backend
+                     works on the site from, or publish stops.
   --personal         Create the site under your personal account, deliberately.
                      Only needed on a first publish, and only to answer the owner
                      question without a prompt (CI, agents, scripts).
@@ -1698,13 +1726,18 @@ Auto-detects what you run it in:
   • a schemas-only pkg   just its data schemas, no foundation — e.g. @uniweb/schemas,
                          any @org/schemas package, or a bare schemas/*.yml folder
 
-Schema scopes (set the org with --scope, or package.json uniweb.scope):
-  @/name     your own schema, scoped to the publish org   (@/x -> @org/x)
+A foundation's scope is part of its name — name: '@org/<name>' in main.js. A bare
+name takes --scope (or one of your orgs), and register writes it into the name.
+
+Schema scopes:
+  @/name     your own schema, in the foundation's scope   (@/x -> @org/x)
   @std/name  a shared standard schema (from @uniweb/schemas)
   @org/name  another org's published schema, referenced by name
 
 ${colors.bright}Options:${colors.reset}
-  --scope @org       Publish under @org (resolves @/x -> @org/x); default: package.json uniweb.scope
+  --scope @org       A foundation with a bare name: register under @org, and write it into
+                     the name (refused when the name has another scope). A schemas-only
+                     package: publish under @org; default: package.json uniweb.scope
   --dry-run          Print the .uwx; submit nothing
   -o, --output <f>   Write the .uwx to a file; submit nothing
   --non-interactive  Fail with usage info instead of prompting